Drop importlib_metadata dependency

No longer needed as a polyfill and starts to break things
Extend log_action filter and make recursive (Z#23247315) (#6598 )
2026-10-30 23:59:51 +00:00 · 2026-10-30 09:21:27 +01:00 · 2026-10-29 10:52:00 +01:00 · 2026-10-29 09:59:11 +01:00 · 2026-10-29 09:59:06 +01:00 · 2026-10-28 14:41:38 +01:00
329 changed files with 38798 additions and 32635 deletions
@@ -0,0 +1,2 @@
+# Format pre-vue code with eslint where possible (2026-09-10)
+d85e52c83ed3639e040372fd0052e842e4899d90
@@ -16,8 +16,6 @@ recursive-include src/pretix/plugins/banktransfer/templates *
 recursive-include src/pretix/plugins/banktransfer/static *
 recursive-include src/pretix/plugins/manualpayment/templates *
 recursive-include src/pretix/plugins/manualpayment/static *
-recursive-include src/pretix/plugins/paypal/templates *
-recursive-include src/pretix/plugins/paypal/static *
 recursive-include src/pretix/plugins/paypal2/templates *
 recursive-include src/pretix/plugins/paypal2/static *
 recursive-include src/pretix/plugins/src/pretixdroid/templates *
@@ -44,6 +42,7 @@ recursive-include src *.py
 recursive-include src *.svg
 recursive-include src *.txt
 recursive-include src Makefile
+recursive-include src *.pdf

 recursive-exclude doc *
 recursive-exclude deployment *
@@ -173,7 +173,7 @@ Datetime              String in ISO 8601 format    ``"2017-12-27T10:00:00Z"``
                      with timezone (normally UTC) ``"2017-12-27T10:00:00.596934Z"``,
                                                   ``"2017-12-27T10:00:00+02:00"``
 Date                  String in ISO 8601 format    ``2017-12-27``
-Multi-lingual string  Object of strings            ``{"en": "red", "de": "rot", "de_Informal": "rot"}``
+Multi-lingual string  Object of strings            ``{"en": "red", "de": "rot", "de-informal": "rot"}``
 Money                 String with decimal number   ``"23.42"``
 Currency              String with ISO 4217 code    ``"EUR"``, ``"USD"``
 Relative datetime     *either* String in ISO 8601  ``"2017-12-27T10:00:00.596934Z"``,
@@ -53,6 +53,8 @@ Checking a ticket in
                                    Defaults to ``false`` in which case the server will determine the language (currently
                                    the event default language, might change in the future with support for the
                                    ``Accept-Language`` header).
+   :<json boolean simulate: Do not actually perform the check-in, only simulate the response. The ``position`` response
+                            object will not reflect the simulated changes.
   :>json string status: ``"ok"``, ``"incomplete"``, ``"exchange"``, or ``"error"``
   :>json string reason: Reason code, only set on status ``"error"``, see below for possible values.
   :>json string reason_explanation: Human-readable explanation, only set on status ``"error"`` and reason ``"rules"``, can be null.
@@ -71,8 +73,6 @@ Checking a ticket in
   :>json object questions: List of questions to be answered for check-in, only set on status ``"incomplete"``.
   :>json object media_policy: Reusable media policy (see documentation on items), only set on status ``"exchange"``.
   :>json object media_type: Reusable media type (see documentation on items), only set on status ``"exchange"``.
-   :>json boolean simulate: Do not actually perform the check-in, only simulate the response. The ``position`` response
-                            object will not reflect the simulated changes.

   **Example request**:

@@ -0,0 +1,241 @@
+Event Meta Properties
+=====================
+
+Resource description
+--------------------
+
+An event meta property is used to to define meta information fields for its events.
+This information can be re-used, for example, in ticket layouts.
+
+The event meta property resource contains the following public fields:
+
+.. rst-class:: rest-resource-table
+
+===================================== ========================== =======================================================
+Field                                 Type                       Description
+===================================== ========================== =======================================================
+id                                    integer                    Unique ID for this property
+name                                  string                     Name of the property
+default                               string                     Value of the default option
+required                              boolean                    If ``true``, an event can only be taken live if the
+                                                                 property is set. In event series, it's always optional
+                                                                 to set a value for individual dates
+protected                             boolean                    If ``true``, the value for an event can only be changed
+                                                                 by organizer-level administrators
+filter_public                         boolean                    If ``true``, this property will be shown to filter
+                                                                 events in the public event list and calendar
+public_label                          string                     Public name of the property
+filter_allowed                        boolean                    If ``true``, this property will be shown to filter
+                                                                 events or reports in the backend, and it can also be
+                                                                 used for hidden filter parameters in the frontend
+choices                               list of objects            List of JSON objects representing all permitted values
+                                                                 for this property, or ``null`` for no limitation.
+                                                                 Each choice object has a required internal name named
+                                                                 ``key`` and optional public name named ``label``
+                                                                 consisting of a dictionary of i18n string translations
+===================================== ========================== =======================================================
+
+Endpoints
+---------
+
+.. http:get:: /api/v1/organizers/(organizer)/event_meta_properties/
+
+   Returns a list of all meta properties for the organizer.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/meta_properties/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "count": 1,
+        "next": null,
+        "previous": null,
+        "results": [
+          {
+            "id": 1,
+            "name": "Color",
+            "default": "blue",
+            "required": false,
+            "protected": false,
+            "filter_public": false,
+            "public_label": {},
+            "filter_allowed": true,
+            "choices": [
+                {
+                    "key": "blue",
+                    "label": {
+                        "en": "Blue"
+                    },
+                }
+            ]
+          }
+        ]
+      }
+
+   :param organizer: The ``slug`` field of the organizer
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to view this resource.
+
+.. http:get:: /api/v1/organizers/(organizer)/event_meta_properties/(id)/
+
+   Returns information on one property, identified by its id.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/event_meta_properties/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      {
+        "id": 1,
+        "name": "Color",
+        "default": "blue",
+        "required": false,
+        "protected": false,
+        "filter_public": false,
+        "public_label": {},
+        "filter_allowed": true,
+        "choices": null
+      }
+
+   :param organizer: The ``slug`` field of the organizer
+   :param id: The ``id`` field of the meta property to retrieve
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to view this resource.
+
+.. http:post:: /api/v1/organizers/(organizer)/event_meta_properties/
+
+   Creates a new meta property
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      POST /api/v1/organizers/bigevents/event_meta_properties/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content-Type: application/json
+
+      {
+        "name": "ref-code",
+        "default": "abcde",
+        "required": true,
+        "choices": null
+      }
+
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+    {
+        "id": 2,
+        "name": "reference",
+        "default": "abcde",
+        "required": true,
+        "protected": false,
+        "filter_public": false,
+        "public_label": null,
+        "filter_allowed": true,
+        "choices": null
+    }
+
+   :param organizer: The ``slug`` field of the organizer
+   :statuscode 201: no error
+   :statuscode 400: The meta property could not be created due to invalid submitted data.
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to create this resource.
+
+.. http:patch:: /api/v1/organizers/(organizer)/event_meta_properties/(id)/
+
+   Update a meta property. You can also use ``PUT`` instead of ``PATCH``. With ``PUT``, you have to provide
+   all fields of the resource, other fields will be reset to default. With ``PATCH``, you only need to provide the
+   fields that you want to change.
+
+   You can change all fields of the resource except the ``id`` field.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      PATCH /api/v1/organizers/bigevents/event_meta_properties/2/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content-Type: application/json
+      Content-Length: 94
+
+      {
+        "required": false
+      }
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "id": 3,
+        "name": "reference",
+        "default": "abcde",
+        "required": false,
+        "protected": false,
+        "filter_public": false,
+        "public_label": null,
+        "filter_allowed": true,
+        "choices": null
+      }
+
+   :param organizer: The ``slug`` field of the organizer
+   :param id: The ``id`` field of the meta property to modify
+   :statuscode 200: no error
+   :statuscode 400: The property could not be modified due to invalid submitted data
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to change this resource.
+
+.. http:delete:: /api/v1/organizers/(organizer)/event_meta_properties/(id)/
+
+   Delete a meta property.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      DELETE /api/v1/organizers/bigevents/event_meta_properties/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 204 No Content
+      Vary: Accept
+
+   :param organizer: The ``slug`` field of the organizer
+   :param id: The ``id`` field of the meta property to delete
+   :statuscode 204: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to delete this resource.
@@ -110,7 +110,7 @@ Endpoints
            "plugins": [
              "pretix.plugins.banktransfer",
              "pretix.plugins.stripe",
-              "pretix.plugins.paypal",
+              "pretix.plugins.paypal2",
              "pretix.plugins.ticketoutputpdf"
            ],
            "all_sales_channels": false,
@@ -199,7 +199,7 @@ Endpoints
        "plugins": [
          "pretix.plugins.banktransfer",
          "pretix.plugins.stripe",
-          "pretix.plugins.paypal",
+          "pretix.plugins.paypal2",
          "pretix.plugins.ticketoutputpdf"
        ],
        "valid_keys": {
@@ -262,7 +262,7 @@ Endpoints
        "item_meta_properties": {},
        "plugins": [
          "pretix.plugins.stripe",
-          "pretix.plugins.paypal"
+          "pretix.plugins.paypal2"
        ],
        "all_sales_channels": true,
        "limit_sales_channels": []
@@ -299,7 +299,7 @@ Endpoints
        "item_meta_properties": {},
        "plugins": [
          "pretix.plugins.stripe",
-          "pretix.plugins.paypal"
+          "pretix.plugins.paypal2"
        ],
        "all_sales_channels": true,
        "limit_sales_channels": [],
@@ -364,7 +364,7 @@ Endpoints
        "item_meta_properties": {},
        "plugins": [
          "pretix.plugins.stripe",
-          "pretix.plugins.paypal"
+          "pretix.plugins.paypal2"
        ],
        "all_sales_channels": true,
        "limit_sales_channels": []
@@ -401,7 +401,7 @@ Endpoints
        "item_meta_properties": {},
        "plugins": [
          "pretix.plugins.stripe",
-          "pretix.plugins.paypal"
+          "pretix.plugins.paypal2"
        ],
        "all_sales_channels": true,
        "limit_sales_channels": [],
@@ -438,7 +438,7 @@ Endpoints
        "plugins": [
          "pretix.plugins.banktransfer",
          "pretix.plugins.stripe",
-          "pretix.plugins.paypal",
+          "pretix.plugins.paypal2",
          "pretix.plugins.pretixdroid"
        ]
      }
@@ -475,7 +475,7 @@ Endpoints
        "plugins": [
          "pretix.plugins.banktransfer",
          "pretix.plugins.stripe",
-          "pretix.plugins.paypal",
+          "pretix.plugins.paypal2",
          "pretix.plugins.pretixdroid"
        ],
        "all_sales_channels": true,
@@ -12,6 +12,7 @@ at :ref:`plugin-docs`.
   organizers
   events
   subevents
+   event_meta_properties
   taxrules
   categories
   items
@@ -116,6 +116,7 @@ Endpoints

   :query integer page: The page number in case of a multi-page result set, default is 1
   :query string code: Only show the voucher with the given voucher code.
+   :query string search: Only show the voucher with the given query found in the code, tag, or comment.
   :query integer max_usages: Only show vouchers with the given maximal number of usages.
   :query integer redeemed: Only show vouchers with the given number of redemptions. Note that this doesn't tell you if
                            the voucher can still be redeemed, as this also depends on ``max_usages``. See the
@@ -11,7 +11,8 @@ Core
 ----

 .. automodule:: pretix.base.signals
-   :members: periodic_task, event_live_issues, event_copy_data, email_filter, register_notification_types, notification,
+   :members: periodic_task, event_live_issues, event_copy_data, email_filter,
+      register_notification_types, event_notification_sent, organizer_notification_sent,
      item_copy_data, register_sales_channel_types, register_global_settings, quota_availability, global_email_filter,
      register_ticket_secret_generators, gift_card_transaction_display,
      register_text_placeholders, register_mail_placeholders, device_info_updated,
@@ -1,6 +1,6 @@
 sphinx==9.1.*
 sphinx-rtd-theme~=3.1.0
-sphinxcontrib-httpdomain~=2.0.0
+sphinxcontrib-httpdomain~=2.1.0
 sphinxcontrib-images~=1.0.1
 sphinxcontrib-jquery~=4.1
 sphinxcontrib-spelling~=8.0.2
@@ -1,7 +1,7 @@
 -e ../
 sphinx==9.1.*
 sphinx-rtd-theme~=3.1.0
-sphinxcontrib-httpdomain~=2.0.0
+sphinxcontrib-httpdomain~=2.1.0
 sphinxcontrib-images~=1.0.1
 sphinxcontrib-jquery~=4.1
 sphinxcontrib-spelling~=8.0.2
@@ -49,7 +49,6 @@ const ignores = globalIgnores([
 	'src/pretix/static/pretixcontrol/js/ui/editor.js',
 	'src/pretix/static/pretixcontrol/js/ui/geo.js',
 	'src/pretix/static/pretixcontrol/js/ui/main.js',
-	'src/pretix/static/pretixcontrol/js/ui/plugins.js',
 	'src/pretix/static/pretixcontrol/js/ui/subevent.js',
 	'src/pretix/static/pretixcontrol/js/ui/variations.js',
 	'src/pretix/static/pretixcontrol/js/ui/webauthn.js',
@@ -33,15 +33,15 @@ dependencies = [
  "bleach==6.4.*",
  "celery==5.6.*",
  "chardet==5.2.*",
-  "cryptography>=50.0.0",
-  "css-inline==0.21.*",
+  "cryptography>=50.0.2",
+  "css-inline==0.22.*",
  "defusedcsv>=3.0.0",
  "dnspython==2.*",
-  "Django[argon2]==5.2.*",
-  "django-bootstrap3==26.2",
+  "Django[argon2]==5.2.*,>=5.2.17",
+  "django-bootstrap3==26.3",
  "django-compressor==4.6.0",
-  "django-countries==9.0.*",
-  "django-filter==26.1",
+  "django-countries==9.1.*",
+  "django-filter==26.2",
  "django-formset-js-improved==0.5.0.5",
  "django-formtools==2.7",
  "django-hierarkey==2.0.*,>=2.0.2",
@@ -57,17 +57,16 @@ dependencies = [
  "django-redis==7.0.*",
  "django-scopes==2.1.*",
  "django-statici18n==2.8.*",
-  "djangorestframework==3.17.*",
+  "djangorestframework>=3.18.3",
  "dnspython==2.8.*",
  "drf_ujson2==1.7.*",
  "geoip2==5.*",
-  "importlib_metadata==9.*",  # Polyfill, we can probably drop this once we require Python 3.10+
  "isoweek",
  "jsonschema",
  "kombu==5.6.*",
  "libsass==0.23.*",
  "lxml",
-  "markdown==3.10.3",  # 3.3.5 requires importlib-metadata>=4.4, but django-bootstrap3 requires importlib-metadata<3.
+  "markdown==3.11.2",  # 3.3.5 requires importlib-metadata>=4.4, but django-bootstrap3 requires importlib-metadata<3.
  # We can upgrade markdown again once django-bootstrap3 upgrades or once we drop Python 3.6 and 3.7
  "mt-940==4.30.*",
  "oauthlib==3.3.*",
@@ -75,18 +74,18 @@ dependencies = [
  "packaging",
  "paypalrestsdk==1.13.*",
  "paypal-checkout-serversdk==1.0.*",
-  "PyJWT==2.13.*",
+  "PyJWT==2.15.*",
  "phonenumberslite==9.0.*",
-  "Pillow==12.3.*",
+  "Pillow==13.0.*",
  "pretix-plugin-build",
  "protobuf==7.36.*",
  "psycopg2-binary",
  "pycountry",
-  "pycparser==3.0",
-  "pycryptodome==3.23.*",
-  "pypdf==6.5.*",
+  "pycparser==3.11",
+  "pycryptodome==3.24.*",
+  "pypdf==6.20.*",
  "python-bidi==0.6.*",  # Support for Arabic in reportlab
-  "python-dateutil==2.9.*",
+  "python-dateutil==3.0.*",
  "pytz",
  "pytz-deprecation-shim==0.1.*",
  "pyuca",
@@ -94,11 +93,11 @@ dependencies = [
  "redis==7.4.*",
  "reportlab==5.0.*",
  "requests==2.34.*",
-  "sentry-sdk==2.68.*",
+  "sentry-sdk==2.71.*",
  "sepaxml==2.7.*",
  "stripe==7.9.*",
  "text-unidecode==1.*",
-  "tlds>=2026072401",
+  "tlds>=2026093003",
  "tqdm==4.*",
  "ua-parser==1.0.*",
  "vobject==0.9.*",
@@ -112,23 +111,24 @@ dev = [
  "aiohttp==3.14.*",
  "coverage",
  "coveralls",
-  "fakeredis==2.37.*",
-  "flake8==7.3.*",
+  "fakeredis==2.39.*",
+  "flake8==7.4.*",
  "freezegun",
-  "isort==8.0.*",
+  "isort==9.0.*",
  "pep8-naming==0.15.*",
  "potypo",
  "pytest-asyncio>=1.4.0",
  "pytest-cache",
  "pytest-cov",
  "pytest-django==4.*",
-  "pytest-mock==3.15.*",
+  "pytest-mock==3.16.*",
  "pytest-sugar",
  "pytest-xdist==3.8.*",
  "pytest-playwright",
  "pytest==9.1.*",
  "playwright",
  "responses",
+  "pypdfium2"
 ]

 [project.entry-points."distutils.commands"]
@@ -26,7 +26,6 @@ ignore =
    src/tests/plugins/*
    src/tests/plugins/badges/*
    src/tests/plugins/banktransfer/*
-    src/tests/plugins/paypal/*
    src/tests/plugins/paypal2/*
    src/tests/plugins/pretixdroid/*
    src/tests/plugins/stripe/*
@@ -30,3 +30,5 @@ npminstall:
 npmbuild:
 	npm run build

+licenseheaders:
+	licenseheaders -t ../.licenseheader -E .py -x "*/migrations/*.py"
@@ -19,4 +19,4 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-__version__ = "2026.8.0.dev0"
+__version__ = "2026.10.0.dev0"
@@ -76,7 +76,7 @@ class DeviceTokenAuthentication(TokenAuthentication):
            except DeviceLastSeen.DoesNotExist:
                # First request from device, create model, ignore result. Use get_or_create to be safe
                # against concurrent create requests
-                DeviceLastSeen.objects.get_or_create(device=device, last_seen=now())
+                DeviceLastSeen.objects.get_or_create(device=device, defaults={"last_seen": now()})
            else:
                if now() - last_seen_obj.last_seen < timedelta(seconds=10):
                    # We don't need to know the last seen info of a device to more precision than this,
@@ -19,13 +19,12 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-
-from django.dispatch import receiver
-
-from pretix.base.signals import register_payment_providers
+def get_session_key_for_api_auth(user, auth, prefix='api-upload'):
+    if user.is_authenticated:
+        return f'{prefix}-User-{user.pk}'
+    else:
+        return f'{prefix}-{str(type(auth))}-{auth.pk}'


-@receiver(register_payment_providers, dispatch_uid="payment_paypal")
-def register_payment_provider(sender, **kwargs):
-    from .payment import Paypal
-    return Paypal
+def get_session_key_for_api_request(request, prefix='api-upload'):
+    return get_session_key_for_api_auth(request.user, request.auth, prefix)
@@ -101,6 +101,10 @@ class OAuthAccessToken(AbstractAccessToken):
        self.expires = now() - timedelta(hours=1)
        self.save(update_fields=['expires'])

+    def is_valid(self, scopes=None):
+        # Can maybe be removed after upgrading django-oauth-toolkit to 3.4.1
+        return super().is_valid(scopes) and self.application.is_usable(None)
+

 class OAuthRefreshToken(AbstractRefreshToken):
    application = models.ForeignKey(
@@ -35,10 +35,13 @@
 import logging

 from django.conf import settings
-from django.core.exceptions import PermissionDenied
+from django.core.exceptions import (
+    PermissionDenied, ValidationError as DjangoValidationError,
+)
 from django.db import transaction
 from django.utils.crypto import get_random_string
 from django.utils.functional import cached_property
+from django.utils.html import strip_tags
 from django.utils.translation import gettext as _
 from django_countries.serializers import CountryFieldMixin
 from pytz import common_timezones
@@ -218,8 +221,6 @@ class EventSerializer(SalesChannelMigrationMixin, I18nAwareModelSerializer):
            if self.instance is None:
                raise ValidationError(_('Events cannot be created as \'live\'. Quotas and payment must be added to the '
                                        'event before sales can go live.'))
-            else:
-                self.instance.clean_live()
        return value

    @cached_property
@@ -429,6 +430,14 @@ class EventSerializer(SalesChannelMigrationMixin, I18nAwareModelSerializer):
            event.set_active_plugins(plugins)
            event.save()

+        live = validated_data.get('live') or event.live
+        if live:
+            event.refresh_from_db()
+            try:
+                event.clean_live()
+            except DjangoValidationError as e:
+                raise ValidationError({'live': [strip_tags(m) for m in e.messages]})
+
        return event


@@ -37,6 +37,8 @@ from collections import OrderedDict
 from django.core.exceptions import ValidationError
 from rest_framework import serializers

+from pretix.api.auth.utils import get_session_key_for_api_request
+

 def remove_duplicates_from_list(data):
    return list(OrderedDict.fromkeys(data))
@@ -83,10 +85,16 @@ class UploadedFileField(serializers.Field):
        request = self.context.get('request', None)
        try:
            cf = CachedFile.objects.get(
-                session_key=f'api-upload-{str(type(request.user or request.auth))}-{(request.user or request.auth).pk}',
                file__isnull=False,
                pk=data[len("file:"):],
            )
+            if cf.session_key == "api-upload-<class 'django.contrib.auth.models.AnonymousUser'>-None":
+                # OK, backwards-compatibility of a security bug fixed 2026-09, delete this at some point, but should
+                # also be harmless because all files with this key are expired one day after deployment of this fix
+                # and no new files with this key are created
+                pass
+            elif cf.session_key != get_session_key_for_api_request(request):
+                self.fail('not_found')
        except (ValidationError, IndexError):  # invalid uuid
            self.fail('not_found')
        except CachedFile.DoesNotExist:
@@ -261,7 +261,9 @@ class ItemAddOnSerializer(serializers.ModelSerializer):
    def validate(self, data):
        data = super().validate(data)

-        ItemAddOn.clean_max_min_count(data.get('max_count'), data.get('min_count'))
+        full_data = self.to_internal_value(self.to_representation(self.instance)) if self.instance else {}
+        full_data.update(data)
+        ItemAddOn.clean_max_min_count(full_data.get('max_count'), full_data.get('min_count'))

        return data

@@ -376,7 +378,7 @@ class ItemSerializer(SalesChannelMigrationMixin, I18nAwareModelSerializer):
    def validate_bundles(self, value):
        if not self.instance:
            for b_data in value:
-                ItemBundle.clean_itemvar(self.context['event'], b_data['bundled_item'], b_data['bundled_variation'])
+                ItemBundle.clean_itemvar(self.context['event'], b_data.get('bundled_item'), b_data.get('bundled_variation'))
        return value

    def validate_addons(self, value):
@@ -41,6 +41,7 @@ from rest_framework.exceptions import ValidationError
 from rest_framework.relations import SlugRelatedField
 from rest_framework.reverse import reverse

+from pretix.api.auth.utils import get_session_key_for_api_request
 from pretix.api.serializers import CompatDecimalField, CompatibleJSONField
 from pretix.api.serializers.event import SubEventSerializer
 from pretix.api.serializers.forms import form_field_to_serializer_field
@@ -258,16 +259,21 @@ class AnswerSerializer(I18nAwareModelSerializer):
        if data['answer'] == 'file:keep':
            return data
        try:
-            ao = self.context["request"].user or self.context["request"].auth
            cf = CachedFile.objects.get(
-                session_key=f'api-upload-{str(type(ao))}-{ao.pk}',
                file__isnull=False,
                pk=data['answer'][len("file:"):],
            )
+            if cf.session_key == "api-upload-<class 'django.contrib.auth.models.AnonymousUser'>-None":
+                # OK, backwards-compatibility of a security bug fixed 2026-09, delete this at some point, but should
+                # also be harmless because all files with this key are expired one day after deployment of this fix
+                # and no new files with this key are created
+                pass
+            elif cf.session_key != get_session_key_for_api_request(self.context["request"]):
+                raise ValidationError('The submitted file ID "{fid}" was not found.'.format(fid=data['answer']))
        except (ValidationError, IndexError):  # invalid uuid
-            raise ValidationError('The submitted file ID "{fid}" was not found.'.format(fid=data))
+            raise ValidationError('The submitted file ID "{fid}" was not found.'.format(fid=data['answer']))
        except CachedFile.DoesNotExist:
-            raise ValidationError('The submitted file ID "{fid}" was not found.'.format(fid=data))
+            raise ValidationError('The submitted file ID "{fid}" was not found.'.format(fid=data['answer']))

        allowed_types = (
            'image/png', 'image/jpeg', 'image/gif', 'application/pdf'
@@ -1234,6 +1240,9 @@ class OrderCreateSerializer(I18nAwareModelSerializer):
            return None
        if pp not in self.context['event'].get_payment_providers():
            raise ValidationError('The given payment provider is not known.')
+        if pp == "giftcard":
+            raise serializers.ValidationError("Cannot create giftcard payment. Use `use_gift_cards` instead")
+
        return pp

    def validate_payment_info(self, info):
@@ -1954,10 +1963,15 @@ class OrderPaymentCreateSerializer(I18nAwareModelSerializer):
        model = OrderPayment
        fields = ('state', 'amount', 'payment_date', 'provider', 'info')

+    def validate_provider(self, value):
+        if value == "giftcard":
+            raise serializers.ValidationError("Cannot create giftcard payment")
+        return value
+
    def create(self, validated_data):
-        order = OrderPayment(order=self.context['order'], **validated_data)
-        order.save()
-        return order
+        payment = OrderPayment(order=self.context['order'], **validated_data)
+        payment.save()
+        return payment


 class OrderRefundCreateSerializer(I18nAwareModelSerializer):
@@ -1969,6 +1983,12 @@ class OrderRefundCreateSerializer(I18nAwareModelSerializer):
        model = OrderRefund
        fields = ('state', 'source', 'amount', 'payment', 'execution_date', 'provider', 'info', 'comment')

+    def validate_provider(self, value):
+        if value == "giftcard":
+            raise serializers.ValidationError("Cannot create giftcard payment")
+
+        return value
+
    def create(self, validated_data):
        pid = validated_data.pop('payment', None)
        if pid:
@@ -28,6 +28,7 @@ from django.db import transaction
 from django.db.models import Q
 from django.utils.crypto import get_random_string
 from django.utils.translation import gettext, gettext_lazy as _
+from i18nfield.rest_framework import I18nField
 from rest_framework import serializers
 from rest_framework.exceptions import ValidationError

@@ -40,7 +41,7 @@ from pretix.api.serializers.settings import SettingsSerializer
 from pretix.base.auth import get_auth_backends
 from pretix.base.i18n import get_language_without_region
 from pretix.base.models import (
-    Customer, Device, GiftCard, GiftCardAcceptance, GiftCardTransaction,
+    Customer, Device, EventMetaProperty, GiftCard, GiftCardTransaction,
    Membership, MembershipType, OrderPosition, Organizer, ReusableMedium,
    SalesChannel, SeatingPlan, Team, TeamAPIToken, TeamInvite, User,
 )
@@ -268,15 +269,7 @@ class GiftCardSerializer(I18nAwareModelSerializer):
        data = super().validate(data)
        if 'secret' in data:
            s = data['secret']
-            qs = GiftCard.objects.filter(
-                secret=s
-            ).filter(
-                Q(issuer=self.context["organizer"]) |
-                Q(issuer__in=GiftCardAcceptance.objects.filter(
-                    acceptor=self.context["organizer"],
-                    active=True,
-                ).values_list('issuer', flat=True))
-            )
+            qs = self.context["organizer"].accepted_gift_cards.filter(secret=s)
            if self.instance:
                qs = qs.exclude(pk=self.instance.pk)
            if qs.exists():
@@ -640,3 +633,88 @@ class OrganizerSettingsSerializer(SettingsSerializer):
        )
        # TODO: make sure pub is always correct
        return 'pub/' + fname
+
+
+class MetaPropertyListField(serializers.ListField):
+    def __init__(self, *args, **kwargs):
+        kwargs["validators"] = kwargs.pop("validators", [])
+
+        def validate_keys_unique(choices):
+            if not choices:
+                return
+            keys = [c.get("key") for c in choices]
+            if len(set(keys)) < len(keys):
+                raise ValidationError("The key for each meta property value option must be unique.")
+
+        kwargs["validators"].append(
+            validate_keys_unique
+        )
+        super().__init__(*args, **kwargs)
+
+
+class MetaPropertyDictField(serializers.DictField):
+
+    def __init__(self, **kwargs):
+        self.label_child = kwargs.pop("label_child", I18nField())
+        super().__init__(**kwargs)
+
+    def to_representation(self, value):
+        # django added unneccessary keys DELETE, ORDER through formsets, filter them here for backwards compat
+        d = {
+            "key": value["key"]
+        }
+        if "label" in value:
+            d["label"] = self.label_child.to_representation(value["label"])
+
+        return super().to_representation(d)
+
+    def to_internal_value(self, data):
+        if not isinstance(data, dict):
+            raise ValidationError("Meta property value options must be a dict.")
+
+        if not isinstance(data.get("key"), str):
+            raise ValidationError("Meta property value options must have a key of type string.")
+
+        if any(k not in {"key", "label"} for k in data.keys()):
+            raise ValidationError("Meta property value options may only have a key and optionally a label.")
+
+        if "label" in data:
+            try:
+                data["label"] = self.label_child.to_internal_value(data["label"])
+            except ValidationError as e:
+                raise ValidationError({"label": e.detail})
+
+        return super().to_internal_value(data)
+
+
+class EventMetaPropertiesSerializer(I18nAwareModelSerializer):
+    choices = MetaPropertyListField(
+        child=MetaPropertyDictField(
+            label_child=I18nField()
+        ),
+        allow_null=True,
+    )
+
+    class Meta:
+        model = EventMetaProperty
+        fields = (
+            'id', 'name', 'default', 'required', 'protected', 'filter_public', 'public_label', 'filter_allowed',
+            'choices'
+        )
+
+    def validate(self, data):
+        data = super().validate(data)
+        full_data = self.to_internal_value(self.to_representation(self.instance)) if self.instance else {}
+        full_data.update(data)
+
+        choices = full_data.get("choices")
+        default = full_data.get("default")
+        if choices and default:
+            choice_keys = [c.get("key") for c in choices]
+            if default not in choice_keys:
+                raise ValidationError("You cannot set a default value that is not a valid value.")
+
+        if not choices and "choices" in data:
+            # normalize empty dict to None
+            data["choices"] = None
+        return data
@@ -68,6 +68,7 @@ orga_router.register(r'scheduled_exports', exporters.ScheduledOrganizerExportVie
 orga_router.register(r'exporters', exporters.OrganizerExportersViewSet, basename='exporters')
 orga_router.register(r'transactions', order.OrganizerTransactionViewSet)
 orga_router.register(r'orderpositions', order.OrganizerOrderPositionViewSet, basename='orderpositions')
+orga_router.register(r'event_meta_properties', organizer.EventMetaPropertiesViewSet)

 team_router = routers.DefaultRouter()
 team_router.register(r'members', organizer.TeamMemberViewSet)
@@ -50,6 +50,7 @@ from rest_framework.generics import ListAPIView
 from rest_framework.permissions import SAFE_METHODS
 from rest_framework.response import Response

+from pretix.api.auth.utils import get_session_key_for_api_auth
 from pretix.api.serializers.checkin import (
    CheckinListSerializer, CheckinRPCAnnulInputSerializer,
    CheckinRPCRedeemInputSerializer, MiniCheckinListSerializer,
@@ -331,10 +332,16 @@ with scopes_disabled():
 def _handle_file_upload(data, user, auth):
    try:
        cf = CachedFile.objects.get(
-            session_key=f'api-upload-{str(type(user or auth))}-{(user or auth).pk}',
            file__isnull=False,
            pk=data[len("file:"):],
        )
+        if cf.session_key == "api-upload-<class 'django.contrib.auth.models.AnonymousUser'>-None":
+            # OK, backwards-compatibility of a security bug fixed 2026-09, delete this at some point, but should
+            # also be harmless because all files with this key are expired one day after deployment of this fix
+            # and no new files with this key are created
+            pass
+        elif cf.session_key != get_session_key_for_api_auth(user, auth):
+            raise ValidationError('The submitted file ID "{fid}" was not found.'.format(fid=data))
    except (ValidationError, BaseValidationError, IndexError):  # invalid uuid
        raise ValidationError('The submitted file ID "{fid}" was not found.'.format(fid=data))
    except CachedFile.DoesNotExist:
@@ -75,7 +75,7 @@ class ExportersMixin:

    @action(detail=True, methods=['GET'], url_name='download', url_path='download/(?P<asyncid>[^/]+)/(?P<cfid>[^/]+)')
    def download(self, *args, **kwargs):
-        cf = get_object_or_404(CachedFile, id=kwargs['cfid'])
+        cf = get_object_or_404(CachedFile, id=kwargs['cfid'], web_download=True)
        if not cf.allowed_for_session(self.request, "exporters-api"):
            return Response(
                {'status': 'failed', 'message': 'Unknown file ID or export failed'},
@@ -39,7 +39,7 @@ from pretix.api.serializers.media import (
 )
 from pretix.base.media import MEDIA_TYPES
 from pretix.base.models import (
-    Checkin, GiftCard, GiftCardAcceptance, GiftCardTransaction, OrderPosition,
+    Checkin, GiftCardAcceptance, GiftCardTransaction, OrderPosition,
    ReusableMedium,
 )
 from pretix.base.models.orders import PrintLog
@@ -88,7 +88,7 @@ class ReusableMediaViewSet(viewsets.ModelViewSet):
            ),
            Prefetch(
                'linked_giftcard',
-                queryset=GiftCard.objects.annotate(
+                queryset=self.request.organizer.accepted_gift_cards.annotate(
                    cached_value=Coalesce(Subquery(s), Decimal('0.00'))
                )
            )
@@ -1683,7 +1683,7 @@ class PaymentViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet):
    @action(detail=True, methods=['POST'])
    def confirm(self, request, **kwargs):
        payment = self.get_object()
-        force = request.data.get('force', False)
+        force = request.data.get('force', False) if request.data else False
        send_mail = request.data.get('send_email', True) if request.data else True

        if payment.state not in (OrderPayment.PAYMENT_STATE_PENDING, OrderPayment.PAYMENT_STATE_CREATED):
@@ -44,15 +44,16 @@ from pretix.api.models import OAuthAccessToken
 from pretix.api.pagination import TotalOrderingFilter
 from pretix.api.serializers.organizer import (
    CustomerCreateSerializer, CustomerSerializer, DeviceSerializer,
-    GiftCardSerializer, GiftCardTransactionSerializer, MembershipSerializer,
+    EventMetaPropertiesSerializer, GiftCardSerializer,
+    GiftCardTransactionSerializer, MembershipSerializer,
    MembershipTypeSerializer, OrganizerSerializer, OrganizerSettingsSerializer,
    SalesChannelSerializer, SeatingPlanSerializer, TeamAPITokenSerializer,
    TeamInviteSerializer, TeamMemberSerializer, TeamSerializer,
 )
 from pretix.base.models import (
-    Customer, Device, Event, GiftCard, GiftCardTransaction, LogEntry,
-    Membership, MembershipType, Organizer, SalesChannel, SeatingPlan, Team,
-    TeamAPIToken, TeamInvite, User,
+    Customer, Device, Event, EventMetaProperty, GiftCard, GiftCardTransaction,
+    LogEntry, Membership, MembershipType, Organizer, SalesChannel, SeatingPlan,
+    Team, TeamAPIToken, TeamInvite, User,
 )
 from pretix.base.plugins import (
    PLUGIN_LEVEL_EVENT, PLUGIN_LEVEL_EVENT_ORGANIZER_HYBRID,
@@ -846,3 +847,49 @@ class SalesChannelViewSet(viewsets.ModelViewSet):
            data={'id': instance.pk}
        )
        instance.delete()
+
+
+class EventMetaPropertiesViewSet(viewsets.ModelViewSet):
+    serializer_class = EventMetaPropertiesSerializer
+    queryset = EventMetaProperty.objects.none()
+    write_permission = 'organizer.settings.general:write'
+
+    def get_queryset(self):
+        return self.request.organizer.meta_properties.all()
+
+    def get_serializer_context(self):
+        ctx = super().get_serializer_context()
+        ctx['organizer'] = self.request.organizer
+        return ctx
+
+    @transaction.atomic()
+    def perform_destroy(self, instance):
+        instance.log_action(
+            'pretix.property.deleted',
+            user=self.request.user,
+            auth=self.request.auth,
+            data={'id': instance.pk}
+        )
+        instance.delete()
+
+    @transaction.atomic()
+    def perform_create(self, serializer):
+        inst = serializer.save(organizer_id=self.request.organizer.pk)
+        serializer.instance.log_action(
+            'pretix.property.created',
+            user=self.request.user,
+            auth=self.request.auth,
+            data=self.request.data,
+        )
+        return inst
+
+    @transaction.atomic()
+    def perform_update(self, serializer):
+        inst = serializer.save(organizer_id=self.request.organizer.pk)
+        serializer.instance.log_action(
+            'pretix.property.changed',
+            user=self.request.user,
+            auth=self.request.auth,
+            data=self.request.data,
+        )
+        return inst
@@ -33,6 +33,7 @@ from rest_framework.exceptions import ValidationError
 from rest_framework.response import Response
 from rest_framework.reverse import reverse

+from pretix.api.auth.utils import get_session_key_for_api_request
 from pretix.api.serializers.shredders import (
    JobRunSerializer, ShredderSerializer,
 )
@@ -68,8 +69,14 @@ class ShreddersMixin:
        cf = get_object_or_404(
            CachedFile,
            id=kwargs['cfid'],
-            session_key=f'api-shredder-{str(type(self.request.user or self.request.auth))}-{(self.request.user or self.request.auth).pk}'
        )
+        if cf.session_key == "api-shredder-<class 'django.contrib.auth.models.AnonymousUser'>-None":
+            # OK, backwards-compatibility of a security bug fixed 2026-10, delete this at some point, but should
+            # also be harmless because all files with this key are expired one day after deployment of this fix
+            # and no new files with this key are created
+            pass
+        elif cf.session_key != get_session_key_for_api_request(self.request, prefix='api-shredder'):
+            raise Http404()
        if cf.file:
            resp = ChunkBasedFileResponse(cf.file.file, content_type=cf.type)
            resp['Content-Disposition'] = 'attachment; filename="{}"'.format(cf.filename).encode("ascii", "ignore")
@@ -118,10 +125,16 @@ class ShreddersMixin:
                )

        try:
-            CachedFile.objects.get(
+            cf = CachedFile.objects.get(
                id=kwargs['cfid'],
-                session_key=f'api-shredder-{str(type(self.request.user or self.request.auth))}-{(self.request.user or self.request.auth).pk}'
            )
+            if cf.session_key == "api-shredder-<class 'django.contrib.auth.models.AnonymousUser'>-None":
+                # OK, backwards-compatibility of a security bug fixed 2026-10, delete this at some point, but should
+                # also be harmless because all files with this key are expired one day after deployment of this fix
+                # and no new files with this key are created
+                pass
+            elif cf.session_key != get_session_key_for_api_request(self.request, prefix='api-shredder'):
+                raise CachedFile.DoesNotExist()
        except CachedFile.DoesNotExist:
            return Response(
                {'status': 'gone', 'message': 'May have succeeded or timed out'},
@@ -140,8 +153,14 @@ class ShreddersMixin:
        cf = get_object_or_404(
            CachedFile,
            id=kwargs['cfid'],
-            session_key=f'api-shredder-{str(type(self.request.user or self.request.auth))}-{(self.request.user or self.request.auth).pk}'
        )
+        if cf.session_key == "api-shredder-<class 'django.contrib.auth.models.AnonymousUser'>-None":
+            # OK, backwards-compatibility of a security bug fixed 2026-10, delete this at some point, but should
+            # also be harmless because all files with this key are expired one day after deployment of this fix
+            # and no new files with this key are created
+            pass
+        elif cf.session_key != get_session_key_for_api_request(self.request, prefix='api-shredder'):
+            raise Http404()
        if cf.file:
            async_result = self.do_shred(cf)
            url_kwargs = {
@@ -184,7 +203,7 @@ class ShreddersMixin:
        cf = CachedFile(web_download=False)
        cf.date = now()
        cf.expires = now() + timedelta(hours=2)
-        cf.session_key = f'api-shredder-{str(type(self.request.user or self.request.auth))}-{(self.request.user or self.request.auth).pk}'
+        cf.session_key = get_session_key_for_api_request(self.request, prefix='api-shredder')
        cf.save()
        d = serializer.data
        for k, v in d.items():
@@ -224,7 +243,7 @@ class EventShreddersViewSet(ShreddersMixin, viewsets.ViewSet):
        return export.apply_async(args=(
            self.request.event.id,
            list(shredders),
-            f'api-shredder-{str(type(self.request.user or self.request.auth))}-{(self.request.user or self.request.auth).pk}',
+            get_session_key_for_api_request(self.request, prefix='api-shredder'),
            str(cf.pk)
        ))

@@ -33,6 +33,7 @@ from rest_framework.views import APIView
 from pretix.api.auth.device import DeviceTokenAuthentication
 from pretix.api.auth.permission import AnyAuthenticatedClientPermission
 from pretix.api.auth.token import TeamTokenAuthentication
+from pretix.api.auth.utils import get_session_key_for_api_request
 from pretix.base.models import CachedFile
 from pretix.helpers.images import (
    IMAGE_TYPES, validate_uploaded_file_for_valid_image,
@@ -78,7 +79,7 @@ class UploadView(APIView):
            web_download=False,
            filename=file_obj.name,
            type=content_type,
-            session_key=f'api-upload-{str(type(request.user or request.auth))}-{(request.user or request.auth).pk}'
+            session_key=get_session_key_for_api_request(request)
        )
        cf.file.save(file_obj.name, file_obj)
        cf.save()
@@ -40,6 +40,7 @@ with scopes_disabled():
    class VoucherFilter(FilterSet):
        active = BooleanFilter(method='filter_active')
        code = CharFilter(lookup_expr='iexact')
+        search = CharFilter(method='search_qs')

        class Meta:
            model = Voucher
@@ -54,6 +55,9 @@ with scopes_disabled():
                return queryset.filter(Q(redeemed__gte=F('max_usages')) |
                                       (Q(valid_until__isnull=False) & Q(valid_until__lte=now())))

+        def search_qs(self, qs, name, value):
+            return qs.filter(Q(code__icontains=value) | Q(tag__icontains=value) | Q(comment__icontains=value))
+

 class VoucherViewSet(viewsets.ModelViewSet):
    serializer_class = VoucherSerializer
@@ -239,8 +239,9 @@ def oidc_validate_authorization(provider, code, redirect_uri, pkce_code_verifier
            )
        )

-    if 'email_verified' in userinfo and not userinfo['email_verified']:
-        # todo: how universal is this, do we need to make this configurable?
+    if 'email_verified' in userinfo and userinfo['email_verified'] not in (True, 1, "1", "True", "true", "TRUE"):
+        # Documented criteria for using a provider with pretix:
+        # "The SSO provider only allows verified accounts to log in or the SSO provider sends the claim email_verified. "
        raise ValidationError(_('The email address on this account is not yet verified. Please first confirm the '
                                'email address in your customer account.'))

@@ -27,7 +27,7 @@ from datetime import timedelta
 from functools import cached_property
 from typing import List, Optional, Protocol

-import sentry_sdk
+from django.conf import settings
 from django.db import DatabaseError, transaction
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
@@ -236,7 +236,9 @@ class OutboundSyncProvider:
                # model changes saved by set_sync_error / clear_in_flight calls below
                if sq.failed_attempts >= self.max_attempts:
                    logger.exception('Failed to sync order (max attempts exceeded)')
-                    sentry_sdk.capture_exception(e)
+                    if settings.SENTRY_ENABLED:
+                        import sentry_sdk
+                        sentry_sdk.capture_exception(e)
                    sq.set_sync_error("exceeded", e.messages, e.full_message)
                else:
                    logger.info(
@@ -247,7 +249,9 @@ class OutboundSyncProvider:
                    sq.clear_in_flight()
            except Exception as e:
                logger.exception('Failed to sync order (unhandled exception)')
-                sentry_sdk.capture_exception(e)
+                if settings.SENTRY_ENABLED:
+                    import sentry_sdk
+                    sentry_sdk.capture_exception(e)
                sq.set_sync_error("internal", [], str(e))

    @cached_property
@@ -160,7 +160,11 @@ class CustomerListExporter(OrganizerLevelExportMixin, MultiSheetListExporter):
            ]
            if name_scheme and len(name_scheme['fields']) > 1:
                for k, label, w in name_scheme['fields']:
-                    row.append(obj.attendee_name_parts.get(k, ''))
+                    row.append(
+                        obj.attendee_name_parts.get(k, '')
+                        if obj.attendee_name_parts
+                        else ''
+                    )
            yield row

    def get_filename(self):
@@ -54,6 +54,7 @@ from ...control.forms.filter import get_all_payment_providers
 from ...helpers import GroupConcat
 from ...helpers.iter import chunked_iterable
 from ..exporter import BaseExporter, MultiSheetListExporter
+from ..invoicing.transmission import get_transmission_types
 from ..services.export import ExportError
 from ..services.invoices import invoice_pdf_task
 from ..signals import (
@@ -197,7 +198,7 @@ class InvoiceDataExporter(InvoiceExporterMixin, MultiSheetListExporter):
    def iterate_sheet(self, form_data, sheet):
        _ = gettext
        if sheet == 'invoices':
-            yield [
+            headers = [
                _('Invoice number'),
                _('Date'),
                _('Order code'),
@@ -230,8 +231,18 @@ class InvoiceDataExporter(InvoiceExporterMixin, MultiSheetListExporter):
                _('Total value (without taxes)'),
                _('Payment matching IDs'),
                _('Payment providers'),
+                _('Transmission type'),
+                _('Transmission status'),
+                _('Transmission date'),
            ]

+            transmission_types = get_transmission_types()
+            for tt in transmission_types:
+                for c in tt.describe_info_columns():
+                    headers.append(str(tt.verbose_name) + ': ' + str(c))
+
+            yield headers
+
            p_providers = OrderPayment.objects.filter(
                order=OuterRef('order'),
                state__in=(OrderPayment.PAYMENT_STATE_CONFIRMED, OrderPayment.PAYMENT_STATE_REFUNDED,
@@ -242,7 +253,7 @@ class InvoiceDataExporter(InvoiceExporterMixin, MultiSheetListExporter):
                'm'
            ).order_by()

-            base_qs = self.invoices_queryset(form_data)\
+            base_qs = self.invoices_queryset(form_data)

            qs = base_qs.select_related(
                'order', 'refers'
@@ -280,7 +291,7 @@ class InvoiceDataExporter(InvoiceExporterMixin, MultiSheetListExporter):
                                if mid:
                                    pmis.append(mid)
                    pmi = '\n'.join(pmis)
-                    yield [
+                    line = [
                        i.full_invoice_no,
                        date_format(i.date, "SHORT_DATE_FORMAT"),
                        i.order.code,
@@ -315,8 +326,20 @@ class InvoiceDataExporter(InvoiceExporterMixin, MultiSheetListExporter):
                        ', '.join([
                            str(self.providers.get(p, p)) for p in sorted(set((i.payment_providers or '').split(',')))
                            if p and p != 'free'
-                        ])
+                        ]),
+                        i.transmission_type_instance.verbose_name,
+                        i.get_transmission_status_display(),
+                        date_format(i.transmission_date, "SHORT_DATETIME_FORMAT") if i.transmission_date else "",
                    ]
+                    for tt in transmission_types:
+                        if tt.identifier == i.transmission_type:
+                            described = dict(tt.describe_info(i.invoice_to_transmission_info, i.invoice_to_country, i.invoice_to_is_business))
+                            for c in tt.describe_info_columns():
+                                line.append(described.get(c, ""))
+                        else:
+                            for c in tt.describe_info_columns():
+                                line.append("")
+                    yield line
        elif sheet == 'lines':
            yield [
                _('Invoice number'),
@@ -55,9 +55,10 @@ from openpyxl.comments import Comment
 from openpyxl.styles import Font, PatternFill

 from pretix.base.models import (
-    Checkin, GiftCard, GiftCardTransaction, Invoice, InvoiceAddress, Order,
+    Checkin, GiftCardTransaction, Invoice, InvoiceAddress, Order,
    OrderPosition, Question,
 )
+from pretix.base.models.giftcards import GiftCard
 from pretix.base.models.orders import (
    OrderFee, OrderPayment, OrderRefund, Transaction,
 )
@@ -1326,12 +1327,12 @@ class GiftcardRedemptionListExporter(ListExporter):
            order__event__in=self.events,
            provider='giftcard',
            state__in=(OrderPayment.PAYMENT_STATE_CONFIRMED, OrderPayment.PAYMENT_STATE_REFUNDED),
-        ).order_by('created')
+        ).order_by('created').select_related("order__event__organizer")
        refunds = OrderRefund.objects.filter(
            order__event__in=self.events,
            provider='giftcard',
            state=OrderRefund.REFUND_STATE_DONE
-        ).order_by('created')
+        ).order_by('created').select_related("order__event__organizer")

        objs = sorted(list(payments) + list(refunds), key=lambda o: (o.order.code, o.created))

@@ -1348,9 +1349,9 @@ class GiftcardRedemptionListExporter(ListExporter):
                obj.order.code,
                obj.full_id,
                obj.created.astimezone(tz).date().strftime('%Y-%m-%d'),
-                gc.secret,
+                gc.secret if gc.accepted_by(obj.order.event.organizer) else '?',
                obj.amount * (-1 if isinstance(obj, OrderRefund) else 1),
-                gc.issuer
+                gc.issuer.slug
            ]
            yield row

@@ -350,16 +350,22 @@ class WrappedPhonePrefixSelect(Select):
        return super().render(name, value or self.initial, *args, **kwargs)

    def get_context(self, name, value, attrs):
-        if value and self.choices[1][0] != value:
-            matching_choices = len([1 for p, c in self.choices if p == value])
+        # self.choices is lazy evaluated, needs to be realized to be modifiable
+        choices = list(self.choices)
+        if value and choices[1][0] != value:
+            matching_choices = len([1 for p, c in choices if p == value])
            if matching_choices > 1:
                # Some countries share a phone prefix, for example +1 is used all over the Americas.
                # This causes a UX problem: If the default value or the existing data is +12125552368,
                # the widget will just show the first <option> entry with value="+1" as selected,
                # which alphabetically is America Samoa, although most numbers statistically are from
-                # the US. As a workaround, we detect this case and add an aditional choice value with
+                # the US. As a workaround, we detect this case and add an additional choice value with
                # just <option value="+1">+1</option> without an explicit country.
-                self.choices.insert(1, (value, value))
+                self.choices = [
+                    choices[0],
+                    (value, value),
+                    *choices[1:],
+                ]
        context = super().get_context(name, value, attrs)
        return context

@@ -594,12 +600,16 @@ class PortraitImageField(SizeValidationMixin, ExtValidationMixin, forms.FileFiel
            image = ImageOps.exif_transpose(image)

            if f._cropdata:
-                image = image.crop((
-                    f._cropdata.get('x', 0),
-                    f._cropdata.get('y', 0),
-                    f._cropdata.get('x', 0) + f._cropdata.get('width', image.width),
-                    f._cropdata.get('y', 0) + f._cropdata.get('height', image.height),
-                ))
+                left = int(f._cropdata.get('x', 0))
+                top = int(f._cropdata.get('y', 0))
+                right = left + int(f._cropdata.get('width', image.width))
+                bottom = top + int(f._cropdata.get('height', image.height))
+                if left >= image.width or top >= image.height or right > image.width or bottom > image.height:
+                    raise ValidationError(
+                        self.error_messages['max_dimension'],
+                        code='max_dimension',
+                    )
+                image = image.crop((left, top, right, bottom))
                with BytesIO() as output:
                    # This might use a lot of memory, but temporary files are not a good option since
                    # we don't control the cleanup
@@ -1196,8 +1206,9 @@ class TicketLevelQuestionsForm(BaseQuestionsForm):
            return field

    def clean(self):
-        from pretix.base.addressvalidation import \
-            validate_address  # local import to prevent impact on startup time
+        from pretix.base.addressvalidation import (  # local import to prevent impact on startup time
+            validate_address,
+        )

        d = super().clean()

@@ -1438,8 +1449,9 @@ class BaseInvoiceAddressForm(forms.ModelForm):
        self.fields['transmission_type'].widget.attrs['data-trigger-address-info'] = 'on'

    def clean(self):
-        from pretix.base.addressvalidation import \
-            validate_address  # local import to prevent impact on startup time
+        from pretix.base.addressvalidation import (  # local import to prevent impact on startup time
+            validate_address,
+        )

        data = self.cleaned_data

@@ -1493,7 +1505,7 @@ class BaseInvoiceAddressForm(forms.ModelForm):
                "vat_id": _("This field is required.")
            })

-        if self.validate_vat_id and self.instance.vat_id_validated and 'vat_id' not in self.changed_data:
+        if self.validate_vat_id and self.instance.vat_id_validated and not any(v in self.changed_data for v in ('is_business', 'vat_id', 'country')):
            pass  # Skip re-validation if it is validated
        elif self.validate_vat_id and vat_id_applicable:
            try:
@@ -82,8 +82,8 @@ class UserSettingsForm(forms.ModelForm):
 class User2FADeviceAddForm(forms.Form):
    name = forms.CharField(label=_('Device name'), max_length=64)
    devicetype = forms.ChoiceField(label=_('Device type'), widget=forms.RadioSelect, choices=(
-        ('totp', _('Smartphone with the Authenticator application')),
-        ('webauthn', _('WebAuthn-compatible hardware token (e.g. Yubikey)')),
+        ('otp_totp.totpdevice', _('Smartphone with the Authenticator application')),
+        ('pretixbase.webauthndevice', _('WebAuthn-compatible hardware token (e.g. Yubikey)')),
    ))


@@ -71,8 +71,8 @@ class EmailTransmissionType(TransmissionType):

    def transmission_info_to_form_data(self, transmission_info: dict) -> dict:
        return {
-            "transmission_email_other": bool(transmission_info.get("transmission_email_address")),
-            "transmission_email_address": transmission_info.get("transmission_email_address"),
+            "transmission_email_other": bool((transmission_info or {}).get("transmission_email_address")),
+            "transmission_email_address": (transmission_info or {}).get("transmission_email_address"),
        }

    def form_data_to_transmission_info(self, form_data: dict) -> dict:
@@ -146,7 +146,7 @@ class PeppolIdValidator:
                                  params={"number": prefix})

        if self.validate_online:
-            base_hostnames = ['edelivery.tech.ec.europa.eu', 'acc.edelivery.tech.ec.europa.eu']
+            base_hostnames = ['participant.sml.prod.tech.peppol.org', 'participant.sml.test.tech.peppol.org']
            smp_id = base64.b32encode(hashlib.sha256(value.lower().encode()).digest()).decode().rstrip("=")
            for base_hostname in base_hostnames:
                smp_domain = f'{smp_id}.iso6523-actorid-upis.{base_hostname}'
@@ -107,6 +107,9 @@ class TransmissionType:
    def transmission_info_to_form_data(self, transmission_info: dict) -> dict:
        return transmission_info

+    def describe_info_columns(self):
+        return [f.label for f in self.invoice_address_form_fields.values()]
+
    def describe_info(self, transmission_info: dict, country: Country, is_business: bool):
        form_data = self.transmission_info_to_form_data(transmission_info)
        data = []
@@ -0,0 +1,49 @@
+# Generated by Django 5.2.17 on 2026-09-21 11:30
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+def fix_unshredded_invoices(apps, _):
+    Invoice = apps.get_model("pretixbase", "Invoice")
+    InvoiceLine = apps.get_model("pretixbase", "InvoiceLine")
+    ignore_fields = (
+        # bool/int fields are not listed and skipped automatically
+        'prefix', 'invoice_no', 'full_invoice_no', 'invoice_from', 'invoice_from_name', 'invoice_from_zipcode',
+        'invoice_from_city', 'invoice_from_state', 'invoice_from_country', 'invoice_from_tax_id',
+        'invoice_from_vat_id', 'locale', 'payment_provider_stamp', 'footer_text', 'foreign_currency_display',
+        'foreign_currency_source', 'transmission_type', 'transmission_provider', 'transmission_status',
+    )
+
+    for i in Invoice.objects.filter(shredded=True):
+        for f in Invoice._meta.fields:
+            if f.name in ignore_fields:
+                continue
+            val = getattr(i, f.name, None)
+            if val and isinstance(val, str):
+                setattr(i, f.name, "█")
+            elif val and isinstance(val, list):  # jsonfield
+                setattr(i, f.name, [])
+            elif val and isinstance(val, dict):  # jsonfield
+                setattr(i, f.name, {"_shredded": True})
+        i.save()
+
+    InvoiceLine.objects.filter(
+        attendee_name__isnull=False,
+        invoice__shredded=True
+    ).update(attendee_name="█")
+
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("pretixbase", "0310_question_valid_string_length_min"),
+    ]
+
+    operations = [
+        migrations.RunPython(
+            fix_unshredded_invoices,
+            migrations.RunPython.noop,
+        ),
+    ]
@@ -151,12 +151,29 @@ class LoggingMixin:
        logentry = LogEntry(content_object=self, user=user, action_type=action, event=event,
                            organizer_id=organizer_id, **kwargs)
        if isinstance(data, dict):
-            sensitivekeys = ['password', 'secret', 'api_key']
+            # sensitivekeys are matched whether contained, not exactly
+            sensitivekeys = [
+                'auth',
+                'key',
+                'token',
+                'password',
+                'Password',
+                '_pass',
+                'salt',
+                'secret',
+            ]

-            for sensitivekey in sensitivekeys:
-                for k, v in data.items():
-                    if (sensitivekey in k) and v:
+            def clean_recursive(d):
+                data = d
+                data_iterator = d.items() if isinstance(d, dict) else enumerate(d)
+                for k, v in data_iterator:
+                    if v and any([sensitivekey in str(k) for sensitivekey in sensitivekeys]):
                        data[k] = "********"
+                    elif isinstance(v, (list, dict)):
+                        data[k] = clean_recursive(v)
+                return data
+
+            data = clean_recursive(data)

            logentry.data = json.dumps(data, cls=CustomJSONEncoder, sort_keys=True)
        elif data:
@@ -166,6 +166,7 @@ class Device(LoggedModel):
    )
    security_profile = models.CharField(
        max_length=190,
+        verbose_name=_('Security profile'),
        default='full',
        null=True,
        blank=False
@@ -1050,10 +1050,8 @@ class Item(LoggedModel):

                replace_year = valid_until.year
                replace_month = valid_until.month + self.validity_dynamic_duration_months
-
-                while replace_month > 12:
-                    replace_month -= 12
-                    replace_year += 1
+                replace_year += (replace_month - 1) // 12
+                replace_month = ((replace_month - 1) % 12) + 1
                max_day = calendar.monthrange(replace_year, replace_month)[1]
                replace_date = date(
                    year=replace_year,
@@ -42,7 +42,7 @@ from django.conf import settings
 from django.core.mail import get_connection
 from django.core.validators import MinLengthValidator, RegexValidator
 from django.db import models
-from django.db.models import Q
+from django.db.models import Exists, OuterRef, Q
 from django.urls import reverse
 from django.utils.crypto import get_random_string
 from django.utils.functional import cached_property
@@ -312,6 +312,25 @@ class Organizer(LoggedModel):
            )
            i += 1

+    def get_users_with_permission(self, permission):
+        """
+        Returns a queryset of users who have a specific permission to this organizer.
+
+        :return: Iterable of User
+        """
+        from .auth import User
+
+        if permission:
+            qs = Team.objects.with_organizer_permission(permission)
+        else:
+            qs = Team.objects.all()
+
+        team_with_perm = qs.filter(
+            members__pk=OuterRef('pk'),
+            organizer=self,
+        )
+        return User.objects.filter(Exists(team_with_perm))
+

 def generate_invite_token():
    return get_random_string(length=32, allowed_chars=string.ascii_lowercase + string.digits)
@@ -35,12 +35,13 @@
 import logging
 from collections import OrderedDict, namedtuple
 from itertools import groupby
+from typing import Optional, Union

 from django.dispatch import receiver
 from django.utils.formats import date_format
 from django.utils.translation import gettext_lazy as _, pgettext_lazy

-from pretix.base.models import Event, LogEntry
+from pretix.base.models import Event, LogEntry, Organizer
 from pretix.base.signals import register_notification_types
 from pretix.base.templatetags.money import money_filter
 from pretix.helpers.urls import mainreverse_absolute
@@ -57,7 +58,8 @@ class Notification:
    """
    Represents a notification that is sent/shown to a user. A notification consists of:

-    * one ``event`` reference
+    * one ``event`` reference (can be ``Ǹone``)
+    * one ``organizer`` reference
    * one ``title`` text that is shown e.g. in the email subject or in a headline
    * optionally one ``detail`` text that may or may not be shown depending on the notification method
    * optionally one ``url`` that should be absolute and point to the context of an notification (e.g. an order)
@@ -67,8 +69,12 @@ class Notification:
      each consisting of a button label and an absolute URL to point to.
    """

-    def __init__(self, event: Event, title: str, detail: str=None, url: str=None):
+    def __init__(self, event: Optional[Event], title: str, detail: Optional[str]=None, url: Optional[str]=None, organizer: Optional[Organizer]=None):
+        assert event or organizer, "You need to pass either event or organizer"
+        if event and organizer:
+            assert event.organizer_id == organizer.id, "Organizer and event mismatch"
        self.title = title
+        self.organizer = organizer or event.organizer
        self.event = event
        self.detail = detail
        self.url = url
@@ -91,8 +97,16 @@ class Notification:


 class NotificationType:
-    def __init__(self, event: Event = None):
-        self.event = event
+    def __init__(self, event_or_organizer: Union[Event, Organizer] = None):
+        if isinstance(event_or_organizer, Event):
+            self.event = event_or_organizer
+            self.organizer = event_or_organizer.organizer
+        elif isinstance(event_or_organizer, Organizer):
+            self.event = None
+            self.organizer = event_or_organizer
+        else:
+            self.event = None
+            self.organizer = None

    def __repr__(self):
        return '<NotificationType: {}>'.format(self.action_type)
@@ -121,31 +135,39 @@ class NotificationType:
        """
        raise NotImplementedError()  # NOQA

+    @property
+    def is_event_level(self) -> bool:
+        """
+        Return `True` if this notification type can be configured per event (the default).
+        """
+        return True
+
    def build_notification(self, logentry: LogEntry) -> Notification:
        """
        This is the main function that you should override. It is supposed to turn a log entry
        object into a notification object that can then be rendered e.g. into an email.
        """
        return Notification(
-            logentry.event,
-            logentry.display()
+            event=logentry.event,
+            title=logentry.display(),
+            organizer=logentry.organizer,
        )


-def get_all_notification_types(event=None):
+def get_all_notification_types(event_or_organizer=None):
    global _ALL_TYPES

-    if event is None and _ALL_TYPES:
+    if event_or_organizer is None and _ALL_TYPES:
        return _ALL_TYPES

    types = OrderedDict()
-    for recv, ret in register_notification_types.send(event):
+    for recv, ret in register_notification_types.send(event_or_organizer):
        if isinstance(ret, (list, tuple)):
            for r in ret:
                types[r.action_type] = r
        else:
            types[ret.action_type] = ret
-    if event is None:
+    if event_or_organizer is None:
        _ALL_TYPES = types
    return types

@@ -181,6 +203,7 @@ class ParametrizedOrderNotificationType(NotificationType):

        n = Notification(
            event=logentry.event,
+            organizer=logentry.organizer,
            title=self._title.format(order=order, event=logentry.event),
            url=order_url
        )
@@ -1527,42 +1527,37 @@ class GiftCardPayment(BasePaymentProvider):
        })

    def refund_control_render(self, request, refund) -> str:
-        from .models import GiftCard
-
        if 'gift_card' in refund.info_data:
-            gc = GiftCard.objects.get(pk=refund.info_data.get('gift_card'))
            template = get_template('pretixcontrol/giftcards/payment.html')
-
            ctx = {
                'request': request,
                'event': self.event,
-                'gc': gc,
            }
+            try:
+                gc = self.event.organizer.accepted_gift_cards.get(pk=refund.info_data.get('gift_card'))
+                ctx['gc'] = gc
+            except GiftCard.DoesNotExist:
+                pass
            return template.render(ctx)

    def payment_control_render(self, request, payment) -> str:
-        from .models import GiftCard
+        template = get_template('pretixcontrol/giftcards/payment.html')
+        ctx = {
+            'request': request,
+            'event': self.event,
+            **({'error': payment.info_data[
+                'error']} if 'error' in payment.info_data else {}),
+            **({'gift_card_secret': payment.info_data[
+                'gift_card_secret']} if 'gift_card_secret' in payment.info_data else {})
+        }

-        if any(key in payment.info_data for key in ('gift_card', 'error')):
-            template = get_template('pretixcontrol/giftcards/payment.html')
-            ctx = {
-                'request': request,
-                'event': self.event,
-                **({'error': payment.info_data[
-                    'error']} if 'error' in payment.info_data else {}),
-                **({'gift_card_secret': payment.info_data[
-                    'gift_card_secret']} if 'gift_card_secret' in payment.info_data else {})
-            }
+        try:
+            ctx['gc'] = self.event.organizer.accepted_gift_cards.get(pk=payment.info_data.get('gift_card'))
+        except GiftCard.DoesNotExist:
+            pass

-            try:
-                gc = GiftCard.objects.get(pk=payment.info_data.get('gift_card'))
-                ctx = {
-                    'gc': gc,
-                }
-            except GiftCard.DoesNotExist:
-                pass
-            finally:
-                return template.render(ctx)
+        if any(key in ctx for key in ('gc', 'gift_card_secret', 'error')):
+            return template.render(ctx)

    def payment_control_render_short(self, payment: OrderPayment) -> str:
        d = payment.info_data
@@ -1572,10 +1567,9 @@ class GiftCardPayment(BasePaymentProvider):
        d = refund.info_data
        return d.get('gift_card_secret', d.get('gift_card_code', self.public_name))

-    def api_payment_details(self, payment: OrderPayment):
-        from .models import GiftCard
+    def api_payment_details(self, payment: OrderPayment | OrderRefund):
        try:
-            gc = GiftCard.objects.get(pk=payment.info_data.get('gift_card'))
+            gc = self.event.organizer.accepted_gift_cards.get(pk=payment.info_data.get('gift_card'))
        except GiftCard.DoesNotExist:
            return {
                **({'error': payment.info_data[
@@ -1698,7 +1692,19 @@ class GiftCardPayment(BasePaymentProvider):
    @transaction.atomic()
    def execute_refund(self, refund: OrderRefund):
        from .models import GiftCard
-        gc = GiftCard.objects.get(pk=refund.info_data.get('gift_card') or refund.payment.info_data.get('gift_card'))
+        try:
+            gc = self.event.organizer.accepted_gift_cards.get(
+                pk=refund.info_data.get('gift_card') or refund.payment.info_data.get('gift_card'),
+                currency=self.event.currency
+            )
+        except GiftCard.DoesNotExist:
+            raise PaymentException(_("Gift card not found."))
+
+        if gc.testmode != refund.order.testmode:
+            raise PaymentException(_("Only test gift card can be used in test mode and vice versa."))
+        if gc.expires and gc.expires < time_machine_now():
+            raise PaymentException(_("This gift card is no longer valid."))
+
        trans = gc.transactions.create(
            value=refund.amount,
            order=refund.order,
@@ -801,6 +801,18 @@ def generate_compressed_addon_list(op, order, event, only_checked_in=False):
    return addonlist


+def get_sizebox(page: pypdf.PageObject):
+    mediabox = page.mediabox
+    cropbox = page.cropbox
+
+    return pypdf.generic.RectangleObject((
+        max(mediabox[0], cropbox[0]),
+        max(mediabox[1], cropbox[1]),
+        min(mediabox[2], cropbox[2]),
+        min(mediabox[3], cropbox[3]),
+    ))
+
+
 class Renderer:

    def __init__(self, event, layout, background_file):
@@ -1079,7 +1091,7 @@ class Renderer:
        fontsize = float(o['fontsize'])
        height = float(o['height']) * mm
        width = float(o['width']) * mm
-        while True:
+        for _i in range(25):  # try adapting the font size at most 25 times
            p, ad, lineheight = self._text_paragraph(op, order, o, override_fontsize=fontsize)
            w, h = p.wrapOn(canvas, width, 1000 * mm)
            widths = p.getActualLineWidths0()
@@ -1153,11 +1165,10 @@ class Renderer:
                elif o['type'] == "poweredby":
                    self._draw_poweredby(canvas, op, o)
                if self.bg_pdf:
-                    page_size = (
-                        self.bg_pdf.pages[0].mediabox[2] - self.bg_pdf.pages[0].mediabox[0],
-                        self.bg_pdf.pages[0].mediabox[3] - self.bg_pdf.pages[0].mediabox[1]
-                    )
-                    if self.bg_pdf.pages[0].get('/Rotate') in (90, 270):
+                    first_page = self.bg_pdf.pages[0]
+                    sizebox = get_sizebox(first_page)
+                    page_size = (sizebox.width, sizebox.height)
+                    if first_page.rotation in (90, 270):
                        # swap dimensions due to pdf being rotated
                        page_size = page_size[::-1]
                    canvas.setPageSize(page_size)
@@ -1232,9 +1243,7 @@ class Renderer:

            for i, page in enumerate(fg_pdf.pages):
                bg_page = self.bg_pdf.pages[i]
-                _correct_page_media_box(bg_page)
-                page.merge_page(bg_page, over=False)
-                output.add_page(page)
+                _merge_with_correct_page_media_box(output, page, bg_page)

            # pdf_header is a string like "%pdf-X.X"
            if float(self.bg_pdf.pdf_header[5:]) > float(fg_pdf.pdf_header[5:]):
@@ -1299,39 +1308,36 @@ def merge_background(fg_pdf: PdfWriter, bg_pdf: PdfWriter, out_file, compress):
            bg_pdf.write(bg_filename)
            subprocess.run(pdftk_cmd, check=True, stdout=out_file)
    else:
+        output = PdfWriter()
        for i, page in enumerate(fg_pdf.pages):
            bg_page = bg_pdf.pages[i]
-            _correct_page_media_box(bg_page)
-            page.merge_page(bg_page, over=False)
+            _merge_with_correct_page_media_box(output, page, bg_page)

        # pdf_header is a string like "%pdf-X.X"
-        if float(bg_pdf.pdf_header[5:]) > float(fg_pdf.pdf_header[5:]):
-            fg_pdf.pdf_header = bg_pdf.pdf_header
-
-        fg_pdf.write(out_file)
+        output.pdf_header = (
+            bg_pdf.pdf_header
+            if float(bg_pdf.pdf_header[5:]) > float(fg_pdf.pdf_header[5:])
+            else fg_pdf.pdf_header
+        )
+        output.write(out_file)


-def _correct_page_media_box(page: pypdf.PageObject):
-    if page.rotation != 0:
-        page.transfer_rotation_to_content()
-    media_box = page.mediabox
+def _merge_with_correct_page_media_box(output: pypdf.PdfWriter, fg_page: pypdf.PageObject, bg_page: pypdf.PageObject):
+    """
+    Adds fg_page to output, merging bg_page behind it.
+
+    If bg_page has a non-zero mergebox/cropbox or is rotated via /Rotate, a transformation is applied to fix this."""
    trsf = pypdf.Transformation()
-    if media_box.bottom != 0:
-        trsf = trsf.translate(0, -media_box.bottom)
-    if media_box.left != 0:
-        trsf = trsf.translate(-media_box.left, 0)
-    page.add_transformation(trsf, False)
-    for b in ["/MediaBox", "/CropBox", "/BleedBox", "/TrimBox", "/ArtBox"]:
-        if b in page:
-            rr = pypdf.generic.RectangleObject(page[b])
-            pt1 = trsf.apply_on(rr.lower_left)
-            pt2 = trsf.apply_on(rr.upper_right)
-            page[pypdf.generic.NameObject(b)] = pypdf.generic.RectangleObject((
-                min(pt1[0], pt2[0]),
-                min(pt1[1], pt2[1]),
-                max(pt1[0], pt2[0]),
-                max(pt1[1], pt2[1]),
-            ))
+    if bg_page.rotation != 0:
+        trsf = trsf.rotate(-bg_page.rotation)
+
+    mb = get_sizebox(bg_page)
+    pt1 = trsf.apply_on(mb.lower_left)
+    pt2 = trsf.apply_on(mb.upper_right)
+    trsf = trsf.translate(-min(pt1[0], pt2[0]), -min(pt1[1], pt2[1]))
+
+    fg_page = output.add_page(fg_page)
+    fg_page.merge_transformed_page(bg_page, trsf, over=False, expand=False)


@deconstructible
@@ -22,9 +22,9 @@
 import os
 import sys
 from enum import Enum
+from importlib import metadata
 from typing import List

-import importlib_metadata as metadata
 from django.apps import AppConfig, apps
 from django.conf import settings
 from django.core.exceptions import ImproperlyConfigured
@@ -54,7 +54,7 @@ from celery.exceptions import MaxRetriesExceededError
 from django.conf import settings
 from django.core.files.storage import default_storage
 from django.core.mail import EmailMultiAlternatives, SafeMIMEMultipart
-from django.core.mail.message import SafeMIMEText
+from django.core.mail.message import SafeMIMEText, utf8_charset_qp
 from django.db import connection, transaction
 from django.db.models import Q
 from django.dispatch import receiver
@@ -316,6 +316,7 @@ def mail(email: Union[str, Sequence[str]], subject: Union[str, FormattedString],
                body_html = None

        m = OutgoingMail.objects.create(
+            guid=guid,
            organizer=organizer,
            event=event,
            order=order,
@@ -380,6 +381,8 @@ def mail(email: Union[str, Sequence[str]], subject: Union[str, FormattedString],


 class CustomEmail(EmailMultiAlternatives):
+    encoding = utf8_charset_qp
+
    def _create_mime_attachment(self, content, mimetype):
        """
        Convert the content, mimetype pair into a MIME attachment object.
@@ -449,9 +452,9 @@ def mail_send_task(self, **kwargs) -> bool:

    # Rewrite all <img> tags from real URLs or data URLs to inline attachments referred to by content ID
    if outgoing_mail.body_html is not None:
-        html_message = SafeMIMEMultipart(_subtype='related', encoding=settings.DEFAULT_CHARSET)
+        html_message = SafeMIMEMultipart(_subtype='related')
        html_with_cid, cid_images = replace_images_with_cid_paths(outgoing_mail.body_html)
-        html_message.attach(SafeMIMEText(html_with_cid, 'html', settings.DEFAULT_CHARSET))
+        html_message.attach(SafeMIMEText(html_with_cid, 'html', utf8_charset_qp))
        attach_cid_images(html_message, cid_images, verify_ssl=True)
        email.attach_alternative(html_message, "multipart/related")

@@ -34,7 +34,9 @@ from pretix.base.models import (
 from pretix.base.notifications import Notification, get_all_notification_types
 from pretix.base.services.mail import mail_send_task
 from pretix.base.services.tasks import ProfiledTask, TransactionAwareTask
-from pretix.base.signals import notification
+from pretix.base.signals import (
+    event_notification_sent, organizer_notification_sent,
+)
 from pretix.celery_app import app
 from pretix.helpers.celery import get_task_priority
 from pretix.helpers.urls import mainreverse_absolute
@@ -47,40 +49,47 @@ def notify(logentry_ids: list):
        logentry_ids = [logentry_ids]

    qs = LogEntry.all.select_related(
-        'event', 'event__organizer'
+        'event', 'event__organizer', 'organizer'
    ).order_by(
-        'action_type', 'event_id',
+        'action_type', 'event_id', 'organizer_id',
    ).filter(id__in=logentry_ids)

-    _event, _at, notify_specific, notify_global = None, None, None, None
+    _event, _organizer, _at, notify_specific, notify_global = None, None, None, None, None
    for logentry in qs:
-        if not logentry.event:
-            break  # Ignore, we only have event-related notifications right now
+        if not logentry.event and not logentry.organizer:
+            break  # Ignore, we only have event- or organizer-related notifications right now

        notification_type = logentry.notification_type

        if not notification_type:
            break  # No suitable plugin

-        if _event != logentry.event or _at != logentry.action_type or notify_global is None:
+        if _event != logentry.event or _organizer != logentry.organizer or _at != logentry.action_type or notify_global is None:
            _event = logentry.event
+            _organizer = logentry.organizer
            _at = logentry.action_type
+
+            event_or_organizer = logentry.event or logentry.organizer
            # All users that have the permission to get the notification
-            users = logentry.event.get_users_with_permission(
+            users = event_or_organizer.get_users_with_permission(
                notification_type.required_permission
            ).filter(notifications_send=True, is_active=True)
+
            if logentry.user:
                users = users.exclude(pk=logentry.user.pk)

            # Get all notification settings, both specific to this event as well as global
-            notify_specific = {
-                (ns.user, ns.method): ns.enabled
-                for ns in NotificationSetting.objects.filter(
-                    event=logentry.event,
-                    action_type=notification_type.action_type,
-                    user__pk__in=users.values_list('pk', flat=True)
-                )
-            }
+            if logentry.event:
+                notify_specific = {
+                    (ns.user, ns.method): ns.enabled
+                    for ns in NotificationSetting.objects.filter(
+                        event=logentry.event,
+                        action_type=notification_type.action_type,
+                        user__pk__in=users.values_list('pk', flat=True)
+                    )
+                }
+            else:
+                notify_specific = {}
            notify_global = {
                (ns.user, ns.method): ns.enabled
                for ns in NotificationSetting.objects.filter(
@@ -106,7 +115,10 @@ def notify(logentry_ids: list):
                    priority=get_task_priority("notifications", logentry.organizer_id),
                )

-        notification.send(logentry.event, logentry_id=logentry.id, notification_type=notification_type.action_type)
+        if logentry.event:
+            event_notification_sent.send(logentry.event, logentry_id=logentry.id, notification_type=notification_type.action_type)
+        elif logentry.organizer:
+            organizer_notification_sent.send(logentry.organizer, logentry_id=logentry.id, notification_type=notification_type.action_type)


@app.task(base=ProfiledTask, acks_late=True, max_retries=9, default_retry_delay=900)
@@ -158,13 +170,20 @@ def send_notification_mail(notification: Notification, user: User):
    body_plain = tpl_plain.render(ctx)

    guid = uuid.uuid4()
+    settings_holder = notification.event or notification.organizer
+    prefix = settings_holder.settings.mail_prefix
+    if not prefix:
+        if notification.event:
+            prefix = notification.event.slug.upper()
+        elif notification.organizer:
+            prefix = notification.organizer.name
    m = OutgoingMail.objects.create(
        guid=guid,
        user=user,
        to=[user.email],
        subject='[{}] {}: {}'.format(
            settings.PRETIX_INSTANCE_NAME,
-            notification.event.settings.mail_prefix or notification.event.slug.upper(),
+            prefix,
            notification.title
        ),
        body_plain=body_plain,
@@ -359,7 +359,8 @@ def mark_order_refunded(order, user=None, auth=None, api_token=None):

 def mark_order_expired(order, user=None, auth=None):
    """
-    Mark this order as expired. This sets the payment status and returns the order object.
+    Mark this order as expired. This sets the order status, generates an invoice cancellation
+    and returns the order object.
    :param order: The order to change
    :param user: The user that performed the change
    """
@@ -969,7 +970,7 @@ def _apply_rounding_and_fees(positions: List[CartPosition], payment_requests: Li
    gift_cards = []  # for backwards compatibility
    for p in payment_requests:
        if p['provider'] == 'giftcard':
-            gift_cards.append(GiftCard.objects.get(pk=p['info_data']['gift_card']))
+            gift_cards.extend(event.organizer.accepted_gift_cards.filter(pk=p['info_data']['gift_card']))

    for recv, resp in order_fee_calculation.send(sender=event, invoice_address=address, total=total, payment_requests=payment_requests,
                                                 meta_info=meta_info, positions=positions, gift_cards=gift_cards):
@@ -2474,7 +2475,11 @@ class OrderChangeManager:
                self.order.log_action('pretix.event.order.changed.feevalue', user=self.user, auth=self.auth, data={
                    'fee': fee.pk,
                    'old_price': fee.value,
-                    'new_price': op.value.gross
+                    'new_price': op.value.gross,
+                    'old_tax_rate': fee.tax_rate,
+                    'new_tax_rate': op.value.rate,
+                    'old_tax_value': fee.tax_value,
+                    'new_tax_value': op.value.tax,
                })
                fee.value = op.value.gross
                fee._calculate_tax()
@@ -2484,9 +2489,13 @@ class OrderChangeManager:
                self.order.log_action('pretix.event.order.changed.price', user=self.user, auth=self.auth, data={
                    'position': position.pk,
                    'positionid': position.positionid,
-                    'old_price': position.price,
                    'addon_to': position.addon_to_id,
-                    'new_price': op.price.gross
+                    'old_price': position.price,
+                    'new_price': op.price.gross,
+                    'old_tax_rate': position.tax_rate,
+                    'new_tax_rate': op.price.rate,
+                    'old_tax_value': position.tax_value,
+                    'new_tax_value': op.price.tax,
                })
                position.price = op.price.gross
                position.price_includes_rounding_correction = Decimal("0.00")
@@ -2501,25 +2510,43 @@ class OrderChangeManager:
            elif isinstance(op, self.TaxRuleOperation):
                if isinstance(op.position, OrderPosition):
                    position = position_cache.setdefault(op.position.pk, op.position)
-                    self.order.log_action('pretix.event.order.changed.tax_rule', user=self.user, auth=self.auth, data={
+                    log = {
                        'position': position.pk,
                        'positionid': position.positionid,
                        'addon_to': position.addon_to_id,
                        'old_taxrule': position.tax_rule.pk if position.tax_rule else None,
-                        'new_taxrule': op.tax_rule.pk
-                    })
+                        'new_taxrule': op.tax_rule.pk,
+                        'old_price': position.price,
+                        'old_tax_rate': position.tax_rate,
+                        'old_tax_value': position.tax_value,
+                    }
                    position._calculate_tax(op.tax_rule)
                    position.save()
+                    log.update({
+                        'new_price': position.price,
+                        'new_tax_rate': position.tax_rate,
+                        'new_tax_value': position.tax_value,
+                    })
+                    self.order.log_action('pretix.event.order.changed.tax_rule', user=self.user, auth=self.auth, data=log)
                elif isinstance(op.position, OrderFee):
                    fee = fee_cache.setdefault(op.position.pk, op.position)
-                    self.order.log_action('pretix.event.order.changed.tax_rule', user=self.user, auth=self.auth, data={
+                    log = {
                        'fee': fee.pk,
                        'fee_type': fee.fee_type,
                        'old_taxrule': fee.tax_rule.pk if fee.tax_rule else None,
-                        'new_taxrule': op.tax_rule.pk
-                    })
+                        'new_taxrule': op.tax_rule.pk,
+                        'old_price': fee.value,
+                        'old_tax_rate': fee.tax_rate,
+                        'old_tax_value': fee.tax_value,
+                    }
                    fee._calculate_tax(op.tax_rule)
                    fee.save()
+                    log.update({
+                        'new_price': fee.value,
+                        'new_tax_rate': fee.tax_rate,
+                        'new_tax_value': fee.tax_value,
+                    })
+                    self.order.log_action('pretix.event.order.changed.tax_rule', user=self.user, auth=self.auth, data=log)
            elif isinstance(op, self.CancelFeeOperation):
                fee = fee_cache.setdefault(op.fee.pk, op.fee)
                self.order.log_action('pretix.event.order.changed.cancelfee', user=self.user, auth=self.auth, data={
@@ -752,6 +752,11 @@ def base_placeholders(sender, **kwargs):
        lambda position_or_address: concatenation_for_salutation(get_best_name(position_or_address, parts=True)),
        lambda event: concatenation_for_salutation(name_scheme['sample']),
    ))
+    ph.append(SimpleFunctionalTextPlaceholder(
+        "attendee_name_for_salutation", ["position"],
+        lambda position: concatenation_for_salutation(position.attendee_name_parts),
+        lambda event: concatenation_for_salutation(name_scheme['sample']),
+    ))

    for f, l, w in name_scheme['fields']:
        if f == 'full_name':
@@ -3767,10 +3767,6 @@ Your {organizer} team"""))  # noqa: W291
        'default': "7B227073704964223A2239373943394538343346343131343044463144313834343232393232313734313034353044314339464446394437384337313531303944334643463542433731222C2276657273696F6E223A312C22637265617465644F6E223A313536363233343735303036312C227369676E6174757265223A22333038303036303932613836343838366637306430313037303261303830333038303032303130313331306633303064303630393630383634383031363530333034303230313035303033303830303630393261383634383836663730643031303730313030303061303830333038323033653333303832303338386130303330323031303230323038346333303431343935313964353433363330306130363038326138363438636533643034303330323330376133313265333032633036303335353034303330633235343137303730366336353230343137303730366336393633363137343639366636653230343936653734363536373732363137343639366636653230343334313230326432303437333333313236333032343036303335353034306230633164343137303730366336353230343336353732373436393636363936333631373436393666366532303431373537343638366637323639373437393331313333303131303630333535303430613063306134313730373036633635323034393665363332653331306233303039303630333535303430363133303235353533333031653137306433313339333033353331333833303331333333323335333735613137306433323334333033353331333633303331333333323335333735613330356633313235333032333036303335353034303330633163363536333633326437333664373032643632373236663662363537323264373336393637366535663535343333343264353035323466343433313134333031323036303335353034306230633062363934663533323035333739373337343635366437333331313333303131303630333535303430613063306134313730373036633635323034393665363332653331306233303039303630333535303430363133303235353533333035393330313330363037326138363438636533643032303130363038326138363438636533643033303130373033343230303034633231353737656465626436633762323231386636386464373039306131323138646337623062643666326332383364383436303935643934616634613534313162383334323065643831316633343037653833333331663163353463336637656233323230643662616435643465666634393238393839336537633066313361333832303231313330383230323064333030633036303335353164313330313031666630343032333030303330316630363033353531643233303431383330313638303134323366323439633434663933653465663237653663346636323836633366613262626664326534623330343530363038326230363031303530353037303130313034333933303337333033353036303832623036303130353035303733303031383632393638373437343730336132663266366636333733373032653631373037303663363532653633366636643266366636333733373033303334326436313730373036633635363136393633363133333330333233303832303131643036303335353164323030343832303131343330383230313130333038323031306330363039326138363438383666373633363430353031333038316665333038316333303630383262303630313035303530373032303233303831623630633831623335323635366336393631366536333635323036663665323037343638363937333230363336353732373436393636363936333631373436353230363237393230363136653739323037303631373237343739323036313733373337353664363537333230363136333633363537303734363136653633363532303666363632303734363836353230373436383635366532303631373037303663363936333631363236633635323037333734363136653634363137323634323037343635373236643733323036313665363432303633366636653634363937343639366636653733323036663636323037353733363532633230363336353732373436393636363936333631373436353230373036663663363936333739323036313665363432303633363537323734363936363639363336313734363936663665323037303732363136333734363936333635323037333734363137343635366436353665373437333265333033363036303832623036303130353035303730323031313632613638373437343730336132663266373737373737326536313730373036633635326536333666366432663633363537323734363936363639363336313734363536313735373436383666373236393734373932663330333430363033353531643166303432643330326233303239613032376130323538363233363837343734373033613266326636333732366332653631373037303663363532653633366636643266363137303730366336353631363936333631333332653633373236633330316430363033353531643065303431363034313439343537646236666435373438313836383938393736326637653537383530376537396235383234333030653036303335353164306630313031666630343034303330323037383033303066303630393261383634383836663736333634303631643034303230353030333030613036303832613836343863653364303430333032303334393030333034363032323130306265303935373166653731653165373335623535653561666163623463373266656234343566333031383532323263373235313030326236316562643666353530323231303064313862333530613564643664643665623137343630333562313165623263653837636661336536616636636264383338303839306463383263646461613633333038323032656533303832303237356130303330323031303230323038343936643266626633613938646139373330306130363038326138363438636533643034303330323330363733313162333031393036303335353034303330633132343137303730366336353230353236663666373432303433343132303264323034373333333132363330323430363033353530343062306331643431373037303663363532303433363537323734363936363639363336313734363936663665323034313735373436383666373236393734373933313133333031313036303335353034306130633061343137303730366336353230343936653633326533313Line truncated
        'type': str,
    },
-    'widget_vite_origins': {
-        'default': '',
-        'type': str,
-    },
 }
 PERSON_NAME_TITLE_GROUPS = OrderedDict([
    ('english_common', (_('Most common English titles'), (
@@ -50,8 +50,8 @@ from pretix.api.serializers.order import (
 from pretix.api.serializers.waitinglist import WaitingListSerializer
 from pretix.base.i18n import LazyLocaleException
 from pretix.base.models import (
-    CachedCombinedTicket, CachedTicket, Event, InvoiceAddress, OrderPayment,
-    OrderPosition, OrderRefund, OutgoingMail, QuestionAnswer,
+    CachedCombinedTicket, CachedTicket, Event, Invoice, InvoiceAddress,
+    OrderPayment, OrderPosition, OrderRefund, OutgoingMail, QuestionAnswer,
 )
 from pretix.base.services.invoices import invoice_pdf_task
 from pretix.base.signals import register_data_shredders
@@ -598,18 +598,30 @@ class InvoiceShredder(BaseDataShredder):
    def shred_data(self, progress_callback=None):
        qs_i = self.event.invoices.filter(shredded=False)
        total = qs_i.count()
+        ignore_fields = (
+            'prefix', 'invoice_no', 'full_invoice_no', 'invoice_from', 'invoice_from_name', 'invoice_from_zipcode',
+            'invoice_from_city', 'invoice_from_state', 'invoice_from_country', 'invoice_from_tax_id',
+            'invoice_from_vat_id', 'locale', 'payment_provider_stamp', 'footer_text', 'foreign_currency_display',
+            'foreign_currency_source', 'transmission_type', 'transmission_provider', 'transmission_status',
+        )

        for i in _progress_helper(qs_i, progress_callback, 0, total):
            if i.file:
                i.file.delete()
-                i.shredded = True
-                i.introductory_text = "█"
-                i.additional_text = "█"
-                i.invoice_to = "█"
-                i.payment_provider_text = "█"
-                i.transmission_info = {"_shredded": True}
-                i.save()
-                i.lines.update(description="█")
+            i.shredded = True
+
+            for f in Invoice._meta.fields:
+                if f.name in ignore_fields:
+                    continue
+                val = getattr(i, f.name, None)
+                if val and isinstance(val, str):
+                    setattr(i, f.name, "█")
+                elif val and isinstance(val, list):  # jsonfield
+                    setattr(i, f.name, [])
+                elif val and isinstance(val, dict):  # jsonfield
+                    setattr(i, f.name, {"_shredded": True})
+            i.save()
+            i.lines.update(description="█", attendee_name="█")


 class CachedTicketShredder(BaseDataShredder):
@@ -605,15 +605,14 @@ subclass of pretix.base.ticketoutput.BaseTicketOutput
 As with all event-plugin signals, the ``sender`` keyword argument will contain the event.
 """

-register_notification_types = EventPluginSignal()
+register_notification_types = GlobalSignal()
 """
 This signal is sent out to get all known notification types. Receivers should return an
 instance of a subclass of pretix.base.notifications.NotificationType or a list of such
 instances.

-As with all event-plugin signals, the ``sender`` keyword argument will contain the event,
-however for this signal, the ``sender`` **may also be None** to allow creating the general
-notification settings!
+When called for actually sending notifications, ``sender`` will be the event or organizer,
+depending on context.
 """

 register_event_permission_groups = GlobalSignal()
@@ -628,7 +627,7 @@ This signal is sent out to get all known permissions. Receivers should return an
 instance of pretix.base.permissions.PermissionGroup or a list of such instances.
 """

-notification = EventPluginSignal()
+event_notification_sent = EventPluginSignal()
 """
 Arguments: ``logentry_id``, ``notification_type``

@@ -637,6 +636,15 @@ This signal is sent out when a notification is sent.
 As with all event-plugin signals, the ``sender`` keyword argument will contain the event.
 """

+organizer_notification_sent = OrganizerPluginSignal()
+"""
+Arguments: ``logentry_id``, ``notification_type``
+
+This signal is sent out when a notification is sent.
+
+As with all organizer-plugin signals, the ``sender`` keyword argument will contain the organizer.
+"""
+
 register_sales_channel_types = GlobalSignal()
 """
 This signal is sent out to get all known sales channels types. Receivers should return an
@@ -20,6 +20,7 @@
 # <https://www.gnu.org/licenses/>.
 #
 from decimal import ROUND_HALF_UP, Decimal
+from typing import Optional

 from babel import Locale, UnknownLocaleError
 from babel.numbers import format_currency
@@ -35,32 +36,32 @@ register = template.Library()


@register.filter("money")
-def money_filter(value: Decimal, arg='', hide_currency=False):
-    if isinstance(value, (float, int)):
+def money_filter(value: Optional[Decimal | float | int | str], arg='', hide_currency=False):
+    if isinstance(value, (float, int, str)):
+        if value == '':
+            return value
        value = Decimal(value)
    if value is None:
        value = Decimal('0.00')
    if not isinstance(value, Decimal):
-        if value == '':
-            return value
        raise TypeError("Invalid data type passed to money filter: %r" % type(value))
    if not arg:
        raise ValueError("No currency passed.")
    arg = arg.upper()

-    places = settings.CURRENCY_PLACES.get(arg, 2)
-    rounded = value.quantize(Decimal('1') / 10 ** places, ROUND_HALF_UP)
-    if places < 2 and rounded != value:
-        # We display decimal places even if we shouldn't for this currency if rounding
-        # would make the numbers incorrect. If this branch executes, it's likely a bug in
-        # pretix, but we won't show wrong numbers!
-        if hide_currency:
-            return floatformat(value, "2g")
-        else:
-            return '{} {}'.format(arg, floatformat(value, "2g"))
+    if value.normalize().as_tuple().exponent < -9:
+        # Heuristic: It's unlikely we'll ever see values of less than 0.000000001 in any currency. Therefore, if we
+        # do see them, we very likely deal with a floating point error. This happens mostly in dev mode when computations
+        # are made in SQLite, which uses REAL precision, but it can also happen when we naively pass a float from Python
+        # land to this filter (even though it should not happen).
+        value = value.quantize(Decimal('1e-9'), ROUND_HALF_UP).normalize()
+
+    currency_places = settings.CURRENCY_PLACES.get(arg, 2)
+    required_places = -value.normalize().as_tuple().exponent
+    render_places = max(currency_places, required_places)

    if hide_currency:
-        return floatformat(value, f"{places}g")
+        return floatformat(value, f"{render_places}g")

    try:
        locale = Locale(get_babel_locale())
@@ -68,14 +69,29 @@ def money_filter(value: Decimal, arg='', hide_currency=False):
        locale = "en"

    try:
-        return format_currency(value, arg, locale=locale)
+        return format_currency(
+            value,
+            arg,
+            locale=locale,
+            # We only allow Babel to restrict the digits to the digits defined by the currency if this does not remove any
+            # precision in case we have sub-currency precision (which we shouldn't have in most places, but it's still
+            # better than showing wrong data). Note: Weird precision effects can occur after in-database arithmetic
+            # on SQLite, since SQLite does not have fixed-decimal computation.
+            currency_digits=currency_places >= required_places,
+            decimal_quantization=currency_places >= required_places,
+        )
    except:
-        return '{} {}'.format(arg, floatformat(value, f"{places}g"))
+        return '{} {}'.format(arg, floatformat(value, f"{render_places}g"))
+
+
+@register.filter("money_without_currency")
+def money_filter_without_currency(value: Optional[Decimal | float | int | str], arg=''):
+    return money_filter(value, arg, hide_currency=True)


@register.filter("money_numberfield")
-def money_numberfield_filter(value: Decimal, arg=''):
-    if isinstance(value, (float, int)):
+def money_numberfield_filter(value: Optional[Decimal | float | int | str], arg=''):
+    if isinstance(value, (float, int, str)):
        value = Decimal(value)
    if not isinstance(value, Decimal):
        raise TypeError("Invalid data type passed to money filter: %r" % type(value))
@@ -87,15 +103,28 @@ def money_numberfield_filter(value: Decimal, arg=''):


@register.filter(is_safe=True)
-def tax_rate_format(number):
+def tax_rate_format(number: Optional[Decimal | float | int | str]):
    """
    Display a Decimal to its significant decimal places, used for tax rates.
    """
-    assert isinstance(number, Decimal)
+    if isinstance(number, (float, int, str)):
+        if number == '':
+            return number
+        number = Decimal(number)
+    if number is None:
+        number = Decimal('0.00')
+    if not isinstance(number, Decimal):
+        raise TypeError("Invalid data type passed to tax rate format filter: %r" % type(number))
+    if number.normalize().as_tuple().exponent < -9:
+        # Heuristic: It's unlikely we'll ever see values of less than 0.000000001 in any currency. Therefore, if we
+        # do see them, we very likely deal with a floating point error. This happens mostly in dev mode when computations
+        # are made in SQLite, which uses REAL precision, but it can also happen when we naively pass a float from Python
+        # land to this filter (even though it should not happen).
+        number = number.quantize(Decimal('1e-9'), ROUND_HALF_UP).normalize()
    return mark_safe(
        formats.number_format(
-            number.normalize(),
-            -number.as_tuple().exponent,
+            number,
+            -number.normalize().as_tuple().exponent,
            use_l10n=True,
            force_grouping=False,
        )
@@ -23,10 +23,10 @@ import json
 import logging
 import pathlib
 import re
+from importlib import metadata
 from urllib.parse import urljoin
 from urllib.request import urlopen

-import importlib_metadata as metadata
 from django import template
 from django.conf import settings
 from django.utils.safestring import mark_safe
@@ -21,8 +21,8 @@
 #
 import contextvars
 from contextlib import contextmanager
+from datetime import datetime

-from dateutil.parser import parse
 from django.utils.timezone import now

 from pretix.base.auth import has_event_access_permission
@@ -34,7 +34,7 @@ timemachine_now_var = contextvars.ContextVar('timemachine_now', default=None)
 def time_machine_now_assigned_from_request(request):
    if hasattr(request, 'event') and f'timemachine_now_dt:{request.event.pk}' in request.session and \
            request.event.testmode and has_event_access_permission(request):
-        request.now_dt = parse(request.session[f'timemachine_now_dt:{request.event.pk}'])
+        request.now_dt = datetime.fromisoformat(request.session[f'timemachine_now_dt:{request.event.pk}'])
        request.now_dt_is_fake = True
    else:
        request.now_dt = now()
@@ -19,6 +19,7 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
+from django.conf import settings
 from django.http import (
    HttpResponseForbidden, HttpResponseNotFound, HttpResponseServerError,
 )
@@ -27,7 +28,6 @@ from django.template import TemplateDoesNotExist, loader
 from django.template.loader import get_template
 from django.utils.functional import Promise
 from django.utils.translation import gettext as _
-from sentry_sdk import last_event_id

 from pretix.base.i18n import language
 from pretix.base.middleware import get_language_from_request
@@ -106,9 +106,14 @@ def server_error(request):
            template = loader.get_template('500.html')
        except TemplateDoesNotExist:
            return HttpResponseServerError('<h1>Server Error (500)</h1>', content_type='text/html')
+        if settings.SENTRY_ENABLED:
+            from sentry_sdk import last_event_id
+            sentry_id = last_event_id()
+        else:
+            sentry_id = None
        r = HttpResponseServerError(template.render({
            'request': request,
-            'sentry_event_id': last_event_id(),
+            'sentry_event_id': sentry_id,
        }))
        r.xframe_options_exempt = True
        return r
@@ -20,6 +20,7 @@
 # <https://www.gnu.org/licenses/>.
 #
 import logging
+import multiprocessing
 import os

 from celery import Celery, signals
@@ -54,6 +55,21 @@ def on_task_received(sender, request, **kwargs):
        logger.info(f"Task {request.id} has trace {trace}")


+@receiver(signals.after_setup_task_logger)
+def on_after_setup_task_logger(sender, logger, loglevel, logfile, format, colorize, **kwargs):
+    # This hack seems to be required to get celery to log internal events from eg billiard/pool.py such as
+    # "worker killed because it used too much memory"
+    # You can test that it is working by starting a celery worker with a low value like
+    # --max-memory-per-child 300000
+    # and then trigger a task. Result should look like this:
+    # [2026-09-23 10:42:26,234: WARNING/ForkPoolWorker-16]: [???:???] child process exiting after exceeding memory limit (394540KiB / 300000KiB)
+    # The ???:??? are likely because by copying the handlers, we are also copying the format, but I was unable to find
+    # a better compatible way.
+    multi_logger = multiprocessing.get_logger()
+    multi_logger.setLevel(logging.WARNING)
+    multi_logger.handlers = logger.handlers
+
+
@receiver(signals.task_prerun)
 def on_task_prerun(sender, task_id, task, **kwargs):
    from pretix.helpers.logs import local
@@ -172,7 +172,7 @@ class CachedFileInput(forms.ClearableFileInput):
        from ...base.models import CachedFile
        v = super().value_from_datadict(data, files, name)
        if v is None and data.get(name + '-cachedfile'):  # An explicit "[x] clear" would be False, not None
-            v = CachedFile.objects.filter(id=data[name + '-cachedfile']).first()
+            v = CachedFile.objects.filter(id=data[name + '-cachedfile'], web_download=True).first()
            if not v.allowed_for_session(self.request):
                v = None
        return v
@@ -400,10 +400,10 @@ class EventMetaValueForm(forms.ModelForm):
        if self.disabled:
            self.fields['value'].widget.attrs['readonly'] = 'readonly'

-    def clean_slug(self):
+    def clean_value(self):
        if self.disabled:
            return self.instance.value if self.instance else None
-        return self.cleaned_data['slug']
+        return self.cleaned_data['value']

    class Meta:
        model = EventMetaValue
@@ -838,9 +838,10 @@ class CancelSettingsForm(SettingsForm):
    def __init__(self, *args, **kwargs):
        super().__init__(*args, **kwargs)
        if self.obj.settings.giftcard_expiry_years is not None:
-            self.fields['cancel_allow_user_paid_refund_as_giftcard'].help_text = gettext(
-                'You have configured gift cards to be valid {} years plus the year the gift card is issued in.'
-            ).format(self.obj.settings.giftcard_expiry_years)
+            self.fields['cancel_allow_user_paid_refund_as_giftcard'].help_text = format_html(
+                gettext('You have configured gift cards to be valid {} years plus the year the gift card is issued in.'),
+                self.obj.settings.giftcard_expiry_years
+            )


 class PaymentSettingsForm(EventSettingsValidationMixin, SettingsForm):
@@ -1635,10 +1636,15 @@ class MailSettingsForm(FormPlaceholderMixin, SettingsForm):
            self._set_field_placeholders(k, v, rich=k.startswith('mail_text_') and k not in self.plain_rendering)

        for k, v in list(self.fields.items()):
-            if k.endswith('_attendee') and not event.settings.attendee_emails_asked:
-                # If we don't ask for attendee emails, we can't send them anything and we don't need to clutter
-                # the user interface with it
-                del self.fields[k]
+            if k.endswith('_attendee'):
+                if not event.settings.attendee_emails_asked:
+                    # If we don't ask for attendee emails, we can't send them anything and we don't need to clutter
+                    # the user interface with it
+                    del self.fields[k]
+                elif 'subject' in k and k.replace("subject", "send") in self.fields:
+                    v.widget.attrs["data-display-dependency"] = f'#id_{k.replace("subject", "send")}'
+                elif 'text' in k and k.replace("text", "send") in self.fields:
+                    v.widget.attrs["data-display-dependency"] = f'#id_{k.replace("text", "send")}'


 class TicketSettingsForm(SettingsForm):
@@ -105,13 +105,6 @@ class GlobalSettingsForm(SettingsForm):
                    domain=settings.SITE_URL
                )
            )),
-            ('widget_vite_origins', forms.CharField(
-                widget=forms.Textarea(attrs={'rows': '3'}),
-                required=False,
-                # Not translated on purpose, this is a temporary feature and contains too many special case words
-                label="Vite widget origins",
-                help_text="One origin per line (e.g. https://example.com). Requests from these origins will be served the new vite-based widget.",
-            ))
        ])
        responses = register_global_settings.send(self)
        for r, response in sorted(responses, key=lambda r: str(r[0])):
@@ -22,7 +22,7 @@
 from django import forms
 from django.core.exceptions import ValidationError
 from django.utils.functional import lazy
-from django.utils.html import format_html
+from django.utils.html import conditional_escape, format_html
 from django.utils.translation import gettext_lazy as _

 from pretix.base.modelimport_orders import get_order_import_columns
@@ -66,7 +66,7 @@ class ProcessForm(forms.Form):
                widget=forms.Select(
                    attrs={'data-static': 'true'}
                ),
-                help_text=c.help_text,
+                help_text=conditional_escape(c.help_text or ""),
            )

    def get_columns(self):
@@ -38,7 +38,6 @@ from urllib.parse import urlparse
 from django import forms
 from django.conf import settings
 from django.core.exceptions import ValidationError
-from django.db.models import Q
 from django.forms import formset_factory, inlineformset_factory
 from django.forms.utils import ErrorDict
 from django.urls import reverse
@@ -70,9 +69,9 @@ from pretix.base.forms.widgets import (
    SplitDateTimePickerWidget, format_placeholders_help_text,
 )
 from pretix.base.models import (
-    Customer, Device, Event, EventMetaProperty, Gate, GiftCard,
-    GiftCardAcceptance, Membership, MembershipType, OrderPosition, Organizer,
-    ReusableMedium, SalesChannel, Team,
+    Customer, Device, Event, EventMetaProperty, Gate, GiftCard, Membership,
+    MembershipType, OrderPosition, Organizer, ReusableMedium, SalesChannel,
+    Team,
 )
 from pretix.base.models.customers import CustomerSSOClient, CustomerSSOProvider
 from pretix.base.models.organizer import OrganizerFooterLink, TeamQuerySet
@@ -364,7 +363,7 @@ class TeamForm(forms.ModelForm):
                    for opt in pg.options
                ],
                label=pg.label,
-                help_text=pg.help_text,
+                help_text=conditional_escape(pg.help_text or ""),
                initial=initial,
                widget=forms.RadioSelect,
            )
@@ -389,7 +388,7 @@ class TeamForm(forms.ModelForm):
                    for opt in pg.options
                ],
                label=pg.label,
-                help_text=pg.help_text,
+                help_text=conditional_escape(pg.help_text or ""),
                initial=initial,
                widget=forms.RadioSelect,
            )
@@ -894,15 +893,7 @@ class GiftCardCreateForm(forms.ModelForm):

    def clean_secret(self):
        s = self.cleaned_data['secret']
-        if GiftCard.objects.filter(
-                secret__iexact=s
-        ).filter(
-            Q(issuer=self.organizer) |
-            Q(issuer__in=GiftCardAcceptance.objects.filter(
-                acceptor=self.organizer,
-                active=True,
-            ).values_list('issuer', flat=True))
-        ).exists():
+        if self.organizer.accepted_gift_cards.filter(secret__iexact=s).exists():
            raise ValidationError(
                _('A gift card with the same secret already exists in your or an affiliated organizer account.')
            )
@@ -1198,7 +1189,7 @@ OrganizerFooterLinkFormset = inlineformset_factory(
 class SSOProviderForm(I18nModelForm):

    config_oidc_base_url = forms.URLField(
-        label=pgettext_lazy('sso_oidc', 'Base URL'),
+        label=pgettext_lazy('sso_oidc', 'Base URL / issuer'),
        required=False,
    )
    config_oidc_client_id = forms.CharField(
@@ -1295,6 +1286,14 @@ class SSOProviderForm(I18nModelForm):


 class SSOClientForm(I18nModelForm):
+    disp_base_url = forms.CharField(
+        label=_('Base URL / issuer'),
+        disabled=True,
+    )
+    disp_client_id = forms.CharField(
+        label=_('Client ID'),
+        disabled=True,
+    )
    regenerate_client_secret = forms.BooleanField(
        label=_('Invalidate old client secret and generate a new one'),
        required=False,
@@ -1302,7 +1301,8 @@ class SSOClientForm(I18nModelForm):

    class Meta:
        model = CustomerSSOClient
-        fields = ['is_active', 'name', 'client_id', 'client_type', 'authorization_grant_type', 'redirect_uris',
+        fields = ['is_active', 'name', 'disp_base_url', 'disp_client_id', 'regenerate_client_secret',
+                  'client_type', 'authorization_grant_type', 'redirect_uris',
                  'allowed_scopes', 'require_pkce']
        widgets = {
            'authorization_grant_type': forms.RadioSelect,
@@ -1317,13 +1317,15 @@ class SSOClientForm(I18nModelForm):
            help_text=self.fields['allowed_scopes'].help_text,
            required=self.fields['allowed_scopes'].required,
            initial=self.fields['allowed_scopes'].initial,
-            choices=CustomerSSOClient.SCOPE_CHOICES,
+            choices=[(val, format_html('<code>{}</code> &ndash; {}', val, label)) for val, label in CustomerSSOClient.SCOPE_CHOICES],
            widget=forms.CheckboxSelectMultiple
        )
+        organizer = kwargs['event']
+        self.initial['disp_base_url'] = eventreverse_absolute(organizer, 'presale:organizer.index', {}).strip('/')
        if self.instance and self.instance.pk:
-            self.fields['client_id'].disabled = True
+            self.initial['disp_client_id'] = self.instance.client_id
        else:
-            del self.fields['client_id']
+            self.initial['disp_client_id'] = _('(will be generated)')
            del self.fields['regenerate_client_secret']


@@ -153,7 +153,7 @@ class SubEventBulkEditForm(I18nModelForm):
            self.fields[k].widget.is_required = False
            self.fields[k].required = False

-        for k in ('date_from', 'date_to', 'date_admission', 'presale_start', 'presale_end'):
+        for k in ('date_from', 'date_to'):
            self.fields[k + '_day'] = forms.DateField(
                label=self._meta.model._meta.get_field(k).verbose_name,
                help_text=self._meta.model._meta.get_field(k).help_text,
@@ -167,6 +167,14 @@ class SubEventBulkEditForm(I18nModelForm):
                required=False,
            )

+        for k in ('date_admission', 'presale_start', 'presale_end'):
+            self.fields[k + '_rel'] = RelativeDateTimeField(
+                label=self._meta.model._meta.get_field(k).verbose_name,
+                help_text=self._meta.model._meta.get_field(k).help_text,
+                required=False,
+                limit_choices=('event__date_from',),
+            )
+
    class Meta:
        model = SubEvent
        localized_fields = '__all__'
@@ -247,6 +255,18 @@ class SubEventBulkEditForm(I18nModelForm):
                    )
                    setattr(obj, k.replace('_time', ''), newval)
                fields.add(k.replace('_time', ''))
+            elif k.endswith('_rel'):
+                target_key = k[:-4]
+                for obj in objs:
+                    cval = self.cleaned_data[k]
+                    if cval is None:
+                        newval = None
+                        if not self._meta.model._meta.get_field(target_key).null:
+                            continue
+                    else:
+                        newval = cval.datetime(obj)
+                    setattr(obj, target_key, newval)
+                fields.add(target_key)
            else:
                fields.add(k)
                for obj in objs:
@@ -435,10 +455,10 @@ class SubEventMetaValueForm(forms.ModelForm):
        if self.disabled:
            self.fields['value'].widget.attrs['readonly'] = 'readonly'

-    def clean_slug(self):
+    def clean_value(self):
        if self.disabled:
            return self.instance.value if self.instance else None
-        return self.cleaned_data['slug']
+        return self.cleaned_data['value']

    class Meta:
        model = SubEventMetaValue
@@ -44,6 +44,7 @@ from django.db.models import Count, F, Max
 from django.db.models.functions import Upper
 from django.forms.utils import ErrorDict
 from django.urls import reverse
+from django.utils.html import escape
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _, pgettext_lazy
 from django_scopes.forms import SafeModelChoiceField
@@ -176,7 +177,7 @@ class VoucherForm(I18nModelForm):
                required=False,
                widget=forms.TextInput(attrs={'data-seat-guid-field': '1'}),
                initial=self.instance.seat.seat_guid if self.instance.seat else '',
-                help_text=str(self.instance.seat) if self.instance.seat else '',
+                help_text=escape(str(self.instance.seat) if self.instance.seat else ''),
            )

    def parse_itemvar(self, data):
@@ -717,6 +717,10 @@ class CoreUserImpersonatedLogEntryType(UserImpersonatedLogEntryType):
    'pretix.organizer.export.schedule.failed': _('A scheduled export has failed: {reason}.'),
    'pretix.organizer.outgoingmails.retried': _('Failed emails have been scheduled to be retried.'),
    'pretix.organizer.outgoingmails.aborted': _('Queued emails have been aborted.'),
+    'pretix.property.created': _('An organizer meta property has been created.'),
+    'pretix.property.deleted': _('An organizer meta property has been deleted.'),
+    'pretix.property.changed': _('An organizer meta property has been changed.'),
+    'pretix.property.reordered': _('An organizer meta property has been reordered.'),
    'pretix.giftcards.acceptance.added': _('Gift card acceptance for another organizer has been added.'),
    'pretix.giftcards.acceptance.removed': _('Gift card acceptance for another organizer has been removed.'),
    'pretix.giftcards.acceptance.acceptor.invited': _('A new gift card acceptor has been invited.'),
@@ -774,6 +778,7 @@ class CoreUserImpersonatedLogEntryType(UserImpersonatedLogEntryType):
    'pretix.user.settings.2fa.disabled': _('Two-factor authentication has been disabled.'),
    'pretix.user.settings.2fa.regenemergency': _('Your two-factor emergency codes have been regenerated.'),
    'pretix.user.settings.2fa.emergency': _('A two-factor emergency code has been generated.'),
+    'pretix.user.settings.2fa.resetdrift': _('Drift and throttle values for two-factor devices have been reset.'),
    'pretix.user.settings.2fa.device.added': _('A new two-factor authentication device "{name}" has been added to '
                                               'your account.'),
    'pretix.user.settings.2fa.device.deleted': _('The two-factor authentication device "{name}" has been removed '
@@ -85,8 +85,8 @@ class PermissionMiddleware:
        "user.settings.2fa.enable",
        "user.settings.2fa.disable",
        "user.settings.2fa.regenemergency",
-        "user.settings.2fa.confirm.totp",
-        "user.settings.2fa.confirm.webauthn",
+        "user.settings.2fa.confirm.otp_totp.totpdevice",
+        "user.settings.2fa.confirm.pretixbase.webauthndevice",
        "user.settings.2fa.delete",
        "user.settings.2fa.leaveteams",
        "auth.logout",
@@ -45,8 +45,8 @@
            </p>

            <div class="form-group buttons">
-                <input type="submit" class="btn btn-large btn-default" value="Cancel"/>
-                <input type="submit" class="btn btn-large btn-primary" name="allow" value="Authorize"/>
+                <input type="submit" class="btn btn-large btn-default" value="{% trans "Cancel" %}"/>
+                <input type="submit" class="btn btn-large btn-primary" name="allow" value="{% trans "Authorize" %}"/>
            </div>
        </form>
    {% else %}
@@ -33,7 +33,7 @@
                </div>
                <div class="slug-length alert alert-warning helper-display-none-soft">
                    {% blocktrans trimmed %}
-                        We strongly recommend against using short forms of more then 16 characters.
+                        We strongly recommend against using short forms of more than 16 characters.
                    {% endblocktrans %}
                </div>
            </div>
@@ -1,22 +1,24 @@
 {% load i18n %}

 <dl class="dl-horizontal">
-    <dt>{% trans "Gift card code" %}</dt>
-    <dd>
-        {% if gc %}
-            <a href="{% url "control:organizer.giftcard" organizer=gc.issuer.slug giftcard=gc.pk %}">
-                {{ gc.secret }}
-            </a>
-            {% if gc.issuer.slug != request.organizer %}
-                <span class="text-muted">
-                    <br>
-                    <span class="fa fa-group"></span> {{ gc.issuer }}
-                </span>
+    {% if gc or gift_card_secret %}
+        <dt>{% trans "Gift card code" %}</dt>
+        <dd>
+            {% if gc %}
+                <a href="{% url "control:organizer.giftcard" organizer=gc.issuer.slug giftcard=gc.pk %}">
+                    {{ gc.secret }}
+                </a>
+                {% if gc.issuer.slug != request.organizer %}
+                    <span class="text-muted">
+                        <br>
+                        <span class="fa fa-group"></span> {{ gc.issuer }}
+                    </span>
+                {% endif %}
+            {% elif gift_card_secret %}
+                {{ gift_card_secret }}
            {% endif %}
-        {% elif gift_card_secret %}
-            {{ gift_card_secret }}
-        {% endif %}
-    </dd>
+        </dd>
+    {% endif %}
    {% if gc %}
        <dt>{% trans "Issuer" %}</dt>
        <dd>{{ gc.issuer }}</dd>
@@ -25,4 +27,4 @@
         <dt>{% trans "Error" %}</dt>
        <dd>{{ error }}</dd>
    {% endif %}
-</dl>
+</dl>
@@ -1,12 +1,29 @@
 {% extends "pretixcontrol/organizers/base.html" %}
 {% load i18n %}
 {% load bootstrap3 %}
+{% block title %}
+    {% if client %}
+        {% trans "SSO client:" %} {{ client.name }}
+    {% else %}
+        {% trans "Create credentials for a new SSO client" %}
+    {% endif %}
+{% endblock %}
 {% block inner %}
    {% if client %}
        <h1>{% trans "SSO client:" %} {{ client.name }}</h1>
    {% else %}
-        <h1>{% trans "Create a new SSO client" %}</h1>
+        <h1>{% trans "Create credentials for a new SSO client" %}</h1>
+        <p>
+            {% blocktrans trimmed %}
+                After submitting this form, client credentials for your SSO client will be generated.
+            {% endblocktrans %}
+        </p>
    {% endif %}
+    <p>
+        {% blocktrans trimmed with url="https://docs.pretix.eu/guides/customer-accounts/#using-pretix-as-an-sso-provider" %}
+            For more information, refer to our documentation on <a href="{{ url }}">Using pretix as an SSO provider with external SSO clients</a>.
+        {% endblocktrans %}
+    </p>
    <form class="form-horizontal" action="" method="post">
        {% csrf_token %}
        {% bootstrap_form form layout="control" %}
@@ -3,16 +3,23 @@
 {% load bootstrap3 %}
 {% block title %}{% trans "SSO clients" %}{% endblock %}
 {% block inner %}
-    <h1>{% trans "SSO clients" %}</h1>
+    <h1>{% trans "SSO clients" %}  <small> &mdash; {% blocktrans %}
+    	"Login with pretix" in external systems
+    {% endblocktrans %}</small></h1>
    <p>
        {% blocktrans trimmed %}
            You can allow your customers to log into other systems using their customer account credentials by setting up
            your other systems as a Single-Sign-On (SSO) client based on OpenID Connect.
        {% endblocktrans %}
    </p>
+    <p>
+        {% blocktrans trimmed with url="https://docs.pretix.eu/guides/customer-accounts/#using-pretix-as-an-sso-provider" %}
+            For more information, refer to our documentation on <a href="{{ url }}">Using pretix as an SSO provider with external SSO clients</a>.
+        {% endblocktrans %}
+    </p>
    <a href="{% url "control:organizer.ssoclient.add" organizer=request.organizer.slug %}" class="btn btn-default">
        <span class="fa fa-plus"></span>
-        {% trans "Create a new SSO client" %}
+        {% trans "Create credentials for a new SSO client" %}
    </a>
    <table class="table table-condensed table-hover">
        <thead>
@@ -1,12 +1,24 @@
 {% extends "pretixcontrol/organizers/base.html" %}
 {% load i18n %}
 {% load bootstrap3 %}
+{% block title %}
+    {% if provider %}
+        {% trans "External SSO provider:" %} {{ provider.name }}
+    {% else %}
+        {% trans "Connect to an external SSO provider" %}
+    {% endif %}
+{% endblock %}
 {% block inner %}
    {% if provider %}
-        <h1>{% trans "SSO provider:" %} {{ provider.name }}</h1>
+        <h1>{% trans "External SSO provider:" %} {{ provider.name }}</h1>
    {% else %}
-        <h1>{% trans "Create a new SSO provider" %}</h1>
+        <h1>{% trans "Connect to an external SSO provider" %}</h1>
    {% endif %}
+    <p>
+        {% blocktrans trimmed with url="https://docs.pretix.eu/guides/customer-accounts/#using-pretix-as-an-sso-client" %}
+            For more information, refer to our documentation on <a href="{{ url }}" target="_blank">Using pretix as an SSO client</a>.
+        {% endblocktrans %}
+    </p>
    <form class="form-horizontal" action="" method="post">
        {% csrf_token %}
        {% bootstrap_form form layout="control" %}
@@ -3,16 +3,23 @@
 {% load bootstrap3 %}
 {% block title %}{% trans "SSO providers" %}{% endblock %}
 {% block inner %}
-    <h1>{% trans "SSO providers" %}</h1>
+    <h1>{% trans "SSO providers" %} <small> &mdash; {% blocktrans %}
+    	Connect to an external login provider
+    {% endblocktrans %}</small></h1>
    <p>
        {% blocktrans trimmed %}
            You can connect existing Single-Sign-On (SSO) providers to allow your customers to log in using your own
            account system.
        {% endblocktrans %}
    </p>
+    <p>
+        {% blocktrans trimmed with url="https://docs.pretix.eu/guides/customer-accounts/#using-pretix-as-an-sso-client" %}
+            For more information, refer to our documentation on <a href="{{ url }}" target="_blank">Using pretix as an SSO client</a>.
+        {% endblocktrans %}
+    </p>
    <a href="{% url "control:organizer.ssoprovider.add" organizer=request.organizer.slug %}" class="btn btn-default">
        <span class="fa fa-plus"></span>
-        {% trans "Create a new SSO provider" %}
+        {% trans "Connect to an external SSO provider" %}
    </a>
    <table class="table table-condensed table-hover">
        <thead>
@@ -116,39 +116,9 @@
                    {% bootstrap_field form.date_to_time layout="bulkedit_inline" form_group_class="" %}
                </div>
            </div>
-            <div class="form-group">
-                <label class="col-md-3 control-label" for="{{ form.date_admission_day.id_for_label }}">
-                    {{ form.date_admission_day.label }}
-                </label>
-                <div class="col-md-5">
-                    {% bootstrap_field form.date_admission_day layout="bulkedit_inline" form_group_class="" %}
-                </div>
-                <div class="col-md-4">
-                    {% bootstrap_field form.date_admission_time layout="bulkedit_inline" form_group_class="" %}
-                </div>
-            </div>
-            <div class="form-group">
-                <label class="col-md-3 control-label" for="{{ form.presale_start_day.id_for_label }}">
-                    {{ form.presale_start_day.label }}
-                </label>
-                <div class="col-md-5">
-                    {% bootstrap_field form.presale_start_day layout="bulkedit_inline" form_group_class="" %}
-                </div>
-                <div class="col-md-4">
-                    {% bootstrap_field form.presale_start_time layout="bulkedit_inline" form_group_class="" %}
-                </div>
-            </div>
-            <div class="form-group">
-                <label class="col-md-3 control-label" for="{{ form.presale_end_day.id_for_label }}">
-                    {{ form.presale_end_day.label }}
-                </label>
-                <div class="col-md-5">
-                    {% bootstrap_field form.presale_end_day layout="bulkedit_inline" form_group_class="" %}
-                </div>
-                <div class="col-md-4">
-                    {% bootstrap_field form.presale_end_time layout="bulkedit_inline" form_group_class="" %}
-                </div>
-            </div>
+            {% bootstrap_field form.date_admission_rel layout="bulkedit" %}
+            {% bootstrap_field form.presale_start_rel layout="bulkedit" %}
+            {% bootstrap_field form.presale_end_rel layout="bulkedit" %}
        </fieldset>
        <fieldset>
            <legend>{% trans "Item prices" %}</legend>
@@ -15,7 +15,7 @@
                <div>
                    <div class="big-radio radio">
                        <label>
-                            <input type="radio" required value="totp" name="{{ form.devicetype.html_name }}" {% if form.devicetype.value == "totp" %}checked{% endif %}>
+                            <input type="radio" required value="otp_totp.totpdevice" name="{{ form.devicetype.html_name }}" {% if form.devicetype.value == "otp_totp.totpdevice" %}checked{% endif %}>
                            <strong>{% trans "Smartphone with Authenticator app" %}</strong><br>
                            <div class="help-block">
                                {% blocktrans trimmed %}
@@ -26,7 +26,7 @@
                    </div>
                    <div class="big-radio radio">
                        <label>
-                            <input type="radio" required value="webauthn" name="{{ form.devicetype.html_name }}" {% if form.devicetype.value == "webauthn" %}checked{% endif %}>
+                            <input type="radio" required value="pretixbase.webauthndevice" name="{{ form.devicetype.html_name }}" {% if form.devicetype.value == "pretixbase.webauthndevice" %}checked{% endif %}>
                            <strong>{% trans "WebAuthn-compatible hardware token" %}</strong><br>
                            <div class="help-block">
                                {% blocktrans trimmed %}
@@ -116,14 +116,14 @@
            {% for d in devices %}
                <li class="list-group-item">
                    <a class="btn btn-danger btn-xs pull-right flip"
-                       href="{% url "control:user.settings.2fa.delete" devicetype=d.devicetype device=d.pk %}">
+                       href="{% url "control:user.settings.2fa.delete" devicetype=d.model_label device=d.pk %}">
                        Delete
                    </a>
-                    {% if d.devicetype == "totp" %}
+                    {% if d.model_label == "otp_totp.totpdevice" %}
                        <span class="fa fa-mobile"></span>
-                    {% elif d.devicetype == "webauthn" %}
+                    {% elif d.model_label == "pretixbase.webauthndevice" %}
                        <span class="fa fa-usb"></span>
-                    {% elif d.devicetype == "u2f" %}
+                    {% elif d.model_label == "pretixbase.u2fdevice" %}
                        <span class="fa fa-usb"></span>
                    {% endif %}
                    {{ d.name }}
@@ -1,6 +1,7 @@
 {% extends "pretixcontrol/base.html" %}
 {% load i18n %}
 {% load bootstrap3 %}
+{% load icon %}
 {% block title %}{% trans "User" %}{% endblock %}
 {% block content %}
    <h1>{% trans "User" %} {{ user.email }}</h1>
@@ -59,8 +60,83 @@
                        {% bootstrap_field form.is_verified layout='control' %}
                    {% endif %}
                    {% bootstrap_field form.last_login layout='control' %}
-                    {% bootstrap_field form.require_2fa layout='control' %}
                    {% bootstrap_field form.needs_password_change layout='control' %}
+                    {% bootstrap_field form.require_2fa layout='control' %}
+                    <div class="form-group">
+                        <div class="col-md-9 col-md-offset-3">
+                            <div class="panel panel-default">
+                                <div class="panel-heading">
+                                    <button class="btn btn-default btn-xs pull-right" type="submit" form="resetdriftthrottle">
+                                        {% trans "Reset drift and throttle" %}
+                                    </button>
+                                    <h3 class="panel-title">
+                                        {% trans "Available two-factor authentication methods" %}
+                                    </h3>
+                                </div>
+                                <table class="panel-body table table-hover">
+                                    {% for d in devices %}
+                                    <tr>
+                                        <td>
+                                            {% if d.model_label == 'otp_totp.totpdevice' %}
+                                                TOTP
+                                            {% elif d.model_label == 'pretixbase.u2fdevice' %}
+                                                U2F
+                                            {% elif d.model_label == 'pretixbase.webauthndevice' %}
+                                                WebAuthn
+                                            {% elif d.model_label == 'otp_static.staticdevice' %}
+                                                {% trans "Emergency tokens" %}
+                                            {% endif %}
+                                            {% if d.confirmed %}
+                                                {% icon "check" %}
+                                            {% else %}
+                                                {% icon "warning" %}
+                                            {% endif %}
+                                        </td>
+                                        <td>
+                                            {{ d.name }}
+                                        </td>
+                                        <td>
+                                            {% if d.throttling_failure_timestamp %}
+                                                {% blocktrans trimmed with date=d.throttling_failure_timestamp|date:"SHORT_DATETIME_FORMAT" count cnt=d.throttling_failure_count %}
+                                                    1 failed attempt since {{ date }}
+                                                {% plural %}
+                                                    {{ cnt }} failed attempts since {{ date }}
+                                                {% endblocktrans %}
+                                                <br>
+                                            {% endif %}
+                                            {% if d.throttling_enabled and not d.verify_is_allowed.0 %}
+                                                <strong>
+                                                    {% blocktrans trimmed with date=d.verify_is_allowed.1.locked_until|date:"SHORT_DATETIME_FORMAT" %}
+                                                        Currently locked until {{ date }}
+                                                    {% endblocktrans %}
+                                                </strong>
+                                                <br>
+                                            {% endif %}
+                                            {% if d.model_label == 'otp_totp.totpdevice' %}
+                                                <small>
+                                                    <code>step = {{ d.step }},
+                                                    t0 = {{ d.t0 }},
+                                                    digits = {{ d.digits }},
+                                                    tolerance = {{ d.tolerance }},
+                                                    drift = {{ d.drift }},
+                                                    last_t = {{ d.last_t }}</code>
+                                                </small>
+                                            {% elif d.model_label == 'pretixbase.u2fdevice' %}
+                                                <small>
+                                                    <code>sign_count = {{ d.sign_count }}</code>
+                                                </small>
+                                            {% elif d.model_label == 'otp_static.staticdevice' %}
+                                                <small>
+                                                    <code>token_count = {{ d.token_set.count }}</code>
+                                                </small>
+                                            {% endif %}
+                                        </td>
+                                    </tr>
+                                    {% endfor %}
+                                </table>
+                            </div>
+                        </div>
+                    </div>
                </fieldset>
                <fieldset>
                    <legend>{% trans "Team memberships" %}</legend>
@@ -102,4 +178,8 @@
            </div>
        </div>
    </div>
+
+    <form action="{% url "control:users.resetdriftthrottle" id=user.pk %}" id="resetdriftthrottle" method="post">
+        {% csrf_token %}
+    </form>
 {% endblock %}
@@ -78,6 +78,7 @@ urlpatterns = [
    re_path(r'^users/(?P<id>\d+)/impersonate$', users.UserImpersonateView.as_view(), name='users.impersonate'),
    re_path(r'^users/(?P<id>\d+)/anonymize$', users.UserAnonymizeView.as_view(), name='users.anonymize'),
    re_path(r'^users/(?P<id>\d+)/emergencytoken$', users.UserEmergencyTokenView.as_view(), name='users.emergencytoken'),
+    re_path(r'^users/(?P<id>\d+)/resetdriftthrottle$', users.Reset2FADriftThrottleView.as_view(), name='users.resetdriftthrottle'),
    re_path(r'^pdf/editor/webfonts.css', pdf.FontsCSSView.as_view(), name='pdf.css'),
    re_path(r'^settings/?$', user.UserSettings.as_view(), name='user.settings'),
    re_path(r'^settings/history/$', user.UserHistoryView.as_view(), name='user.settings.history'),
@@ -106,9 +107,9 @@ urlpatterns = [
    re_path(r'^settings/2fa/regenemergency', user.User2FARegenerateEmergencyView.as_view(),
            name='user.settings.2fa.regenemergency'),
    re_path(r'^settings/2fa/totp/(?P<device>[0-9]+)/confirm', user.User2FADeviceConfirmTOTPView.as_view(),
-            name='user.settings.2fa.confirm.totp'),
+            name='user.settings.2fa.confirm.otp_totp.totpdevice'),
    re_path(r'^settings/2fa/webauthn/(?P<device>[0-9]+)/confirm', user.User2FADeviceConfirmWebAuthnView.as_view(),
-            name='user.settings.2fa.confirm.webauthn'),
+            name='user.settings.2fa.confirm.pretixbase.webauthndevice'),
    re_path(r'^settings/2fa/(?P<devicetype>[^/]+)/(?P<device>[0-9]+)/delete', user.User2FADeviceDeleteView.as_view(),
            name='user.settings.2fa.delete'),
    re_path(r'^settings/email/confirm$', user.UserEmailConfirmView.as_view(), name='user.settings.email.confirm'),
@@ -35,6 +35,7 @@
 import base64
 import json
 import logging
+import math
 import time
 from urllib.parse import quote, urljoin, urlparse

@@ -50,11 +51,12 @@ from django.shortcuts import redirect, render
 from django.urls import reverse
 from django.utils.functional import cached_property
 from django.utils.http import url_has_allowed_host_and_scheme
-from django.utils.translation import gettext_lazy as _
+from django.utils.timezone import now
+from django.utils.translation import gettext_lazy as _, ngettext
 from django.views.decorators.csrf import csrf_exempt
 from django.views.decorators.http import require_http_methods
 from django.views.generic import TemplateView
-from django_otp import match_token
+from django_otp import devices_for_user
 from django_otp.plugins.otp_static.models import StaticDevice
 from webauthn.helpers import generate_challenge

@@ -463,6 +465,7 @@ class Login2FAView(TemplateView):
        token = request.POST.get('token', '').strip().replace(' ', '')

        valid = False
+        retry_after = None
        if 'webauthn_challenge' in self.request.session and token.startswith('{'):
            challenge = self.request.session['webauthn_challenge']

@@ -518,12 +521,28 @@ class Login2FAView(TemplateView):
                    valid = True
                    break
        else:
-            valid = match_token(self.user, token)
-            if isinstance(valid, StaticDevice):
+            with transaction.atomic():
+                for device in devices_for_user(self.user, for_verify=True):
+                    if isinstance(device, StaticDevice) and len(token) < 12:
+                        # If we enter a wrong TOTP token (which is 6 characters), do not even try if it is a valid
+                        # emergency token, which will only "lock up" the StaticDevice due to the throttling plugin
+                        # and just locks people out without security gain.
+                        continue
+                    if device.verify_token(token):
+                        valid = True
+                        break
+                    elif hasattr(device, 'verify_is_allowed'):
+                        verify_allowed, reason_dict = device.verify_is_allowed()
+                        if not verify_allowed:
+                            if not retry_after or reason_dict['locked_until'] > retry_after:
+                                retry_after = reason_dict['locked_until']
+                else:
+                    device = None
+
+            if isinstance(device, StaticDevice):
                self.user.send_security_notice([
                    _("A recovery code for two-factor authentification was used to log in.")
                ])
-
        if valid:
            logger.info(f"Backend login successful for user {self.user.pk} with 2FA.")
            pretix_successful_logins.inc(1)
@@ -536,7 +555,23 @@ class Login2FAView(TemplateView):
            return redirect('control:index')
        else:
            pretix_failed_logins.inc(1, reason="2fa")
-            messages.error(request, _('Invalid code, please try again.'))
+            msg = _('Invalid code, please try again.')
+            if retry_after:
+                seconds = (retry_after - now()).total_seconds()
+                minutes = seconds / 60
+                if minutes >= 1:
+                    msg = ngettext(
+                        'Invalid code. Please try again after waiting {value} minute.',
+                        'Invalid code. Please try again after waiting {value} minutes.',
+                        minutes,
+                    ).format(value=math.ceil(minutes))
+                elif seconds >= 1:
+                    msg = ngettext(
+                        'Invalid code. Please try again after waiting {value} second.',
+                        'Invalid code. Please try again after waiting {value} seconds.',
+                        seconds,
+                    ).format(value=math.ceil(seconds))
+            messages.error(request, msg)
            return redirect('control:auth.login.2fa')

    def get_context_data(self, **kwargs):
@@ -402,9 +402,12 @@ def event_index_widgets_lazy(request, organizer, event):
        except SubEvent.DoesNotExist:
            pass

+    can_view_orders = request.user.has_event_permission(request.organizer, request.event, 'event.orders:read',
+                                                        request=request)
    widgets = []
-    for r, result in event_dashboard_widgets.send(sender=request.event, subevent=subevent, lazy=False):
-        widgets.extend(result)
+    if can_view_orders:
+        for r, result in event_dashboard_widgets.send(sender=request.event, subevent=subevent, lazy=False):
+            widgets.extend(result)

    return build_json_response(widgets)

@@ -31,7 +31,8 @@
 # Unless required by applicable law or agreed to in writing, software distributed under the Apache License 2.0 is
 # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 # License for the specific language governing permissions and limitations under the License.
-import importlib_metadata as metadata
+from importlib import metadata as metadata
+
 from django.conf import settings
 from django.contrib import messages
 from django.db import transaction
@@ -1177,6 +1177,8 @@ class OrderRefundView(OrderView):
        manual_value = formats.sanitize_separators(manual_value)
        try:
            manual_value = Decimal(manual_value)
+            if manual_value < Decimal("0.00"):
+                raise TypeError("Please do not use negative numbers")
        except (DecimalException, TypeError):
            messages.error(self.request, _('You entered an invalid number.'))
            is_valid = False
@@ -1206,6 +1208,8 @@ class OrderRefundView(OrderView):
        giftcard_value = formats.sanitize_separators(giftcard_value)
        try:
            giftcard_value = Decimal(giftcard_value)
+            if giftcard_value < Decimal("0.00"):
+                raise TypeError("Please do not use negative numbers")
        except (DecimalException, TypeError):
            messages.error(self.request, _('You entered an invalid number.'))
            is_valid = False
@@ -1255,6 +1259,8 @@ class OrderRefundView(OrderView):
        offsetting_value = formats.sanitize_separators(offsetting_value)
        try:
            offsetting_value = Decimal(offsetting_value)
+            if offsetting_value < Decimal("0.00"):
+                raise TypeError("Please do not use negative numbers")
        except (DecimalException, TypeError):
            messages.error(self.request, _('You entered an invalid number.'))
            is_valid = False
@@ -1271,6 +1277,9 @@ class OrderRefundView(OrderView):
                    if offset_order.event.currency != self.request.event.currency:
                        messages.error(self.request, _('You entered an order in an event with a different currency.'))
                        is_valid = False
+                    if not self.request.user.has_event_permission(self.request.organizer, offset_order.event, 'event.orders:write', request=self.request):
+                        messages.error(self.request, _('You entered an order in an event that you do not have access to.'))
+                        is_valid = False
                    refunds.append(OrderRefund(
                        order=order,
                        payment=None,
@@ -1286,10 +1295,13 @@ class OrderRefundView(OrderView):
                    ))

        for identifier, prov in self.request.event.get_payment_providers().items():
+            # prof = process form, not a typo for prov(ider)
            prof_value = self.request.POST.get(f'newrefund-{identifier}', '0') or '0'
            prof_value = formats.sanitize_separators(prof_value)
            try:
                prof_value = Decimal(prof_value)
+                if prof_value < Decimal("0.00"):
+                    raise TypeError("Please do not use negative numbers")
            except (DecimalException, TypeError):
                messages.error(self.request, _('You entered an invalid number.'))
                is_valid = False
@@ -1313,6 +1325,8 @@ class OrderRefundView(OrderView):
            value = formats.sanitize_separators(value)
            try:
                value = Decimal(value)
+                if value < Decimal("0.00"):
+                    raise TypeError("Please do not use negative numbers")
            except (DecimalException, TypeError):
                messages.error(self.request, _('You entered an invalid number.'))
                is_valid = False
@@ -1342,7 +1356,12 @@ class OrderRefundView(OrderView):
                    ))

        any_success = False
-        if refund_selected == full_refund and is_valid:
+        if refund_selected != full_refund:
+            messages.error(self.request, _('The refunds you selected do not match the selected total refund '
+                                           'amount.'))
+            is_valid = False
+
+        if is_valid:
            for r in refunds:
                r.save()
                order.log_action('pretix.event.order.refund.created', {
@@ -1414,9 +1433,6 @@ class OrderRefundView(OrderView):
                            )
                        }))
            return redirect(self.get_order_url())
-        else:
-            messages.error(self.request, _('The refunds you selected do not match the selected total refund '
-                                           'amount.'))

    def post(self, *args, **kwargs):
        if self.start_form.is_valid():
@@ -778,9 +778,9 @@ class OrganizerPluginEvents(OrganizerDetailViewMixin, OrganizerPermissionRequire

    def get_form_kwargs(self):
        kwargs = super().get_form_kwargs()
-        kwargs["events"] = self.request.user.get_events_with_permission(
-            "event.settings.general:write", request=self.request
-        ).filter(organizer=self.request.organizer)
+        # Assumption: Who has access to modify organizer settings may see all events and disable/enable plugins
+        # for them. Otherwise, inconsistent situations occur.
+        kwargs["events"] = self.request.organizer.events.all()
        kwargs["initial"] = {
            "events": self.request.organizer.events.filter(plugins__regex='(^|,)' + self.plugin.module + '(,|$)')
        }
@@ -2202,7 +2202,7 @@ class ExportView(OrganizerPermissionRequiredMixin, ExportMixin, ListView):
                owner=self.request.user,
                timezone=str(get_current_timezone()),
            )
-        if not self.scheduled:
+        if not self.scheduled and not self.scheduled_copy_from:
            initial = {
                "mail_subject": gettext("Export: {title}").format(title=self.exporter.verbose_name),
                "mail_template": gettext(
@@ -2817,10 +2817,15 @@ class SSOProviderCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequire
        return get_object_or_404(CustomerSSOProvider, organizer=self.request.organizer, pk=self.kwargs.get('provider'))

    def get_success_url(self):
-        return reverse('control:organizer.ssoproviders', kwargs={
-            'organizer': self.request.organizer.slug,
+        return reverse('control:organizer.ssoprovider.edit', kwargs={
+            'organizer': self.request.organizer.slug, 'provider': self.object.pk,
        })

+    def get_context_data(self, **kwargs):
+        ctx = super().get_context_data(**kwargs)
+        ctx['redirect_uri'] = _('(will be generated)')
+        return ctx
+
    def get_form_kwargs(self):
        kwargs = super().get_form_kwargs()
        kwargs['event'] = self.request.organizer
@@ -2950,8 +2955,11 @@ class SSOClientCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredM
        secret = form.instance.set_client_secret()
        messages.success(
            self.request,
-            _('The SSO client has been created. Please note down the following client secret, it will never be shown '
-              'again: {secret}').format(secret=secret)
+            _('The SSO client has been created.') + ' ' +
+            _('Please note down the following client secret, it will never be shown again.') + '\n\n' +
+            _('Base URL / issuer') + f': {form.initial["disp_base_url"]}\n\n' +
+            _('Client ID') + f': {form.instance.client_id}\n\n' +
+            _('Client secret') + f': {secret}'
        )
        form.instance.organizer = self.request.organizer
        ret = super().form_valid(form)
@@ -3000,8 +3008,9 @@ class SSOClientUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredM
            secret = form.instance.set_client_secret()
            messages.success(
                self.request,
-                _('Your changes have been saved. Please note down the following client secret, it will never be shown '
-                  'again: {secret}').format(secret=secret)
+                _('Your changes have been saved.') + ' ' +
+                _('Please note down the following client secret, it will never be shown again.') + '\n\n' +
+                _('Client secret') + f': {secret}'
            )
        else:
            messages.success(
@@ -250,6 +250,8 @@ class BaseEditorView(EventPermissionRequiredMixin, TemplateView):
        if request.POST.get("background", "").strip():
            try:
                cf = CachedFile.objects.get(id=request.POST.get("background"), web_download=True)
+                if not cf.allowed_for_session(request, "ticketoutput-pdf-background"):
+                    cf = None
            except CachedFile.DoesNotExist:
                pass

@@ -305,7 +307,7 @@ class FontsCSSView(TemplateView):

 class PdfView(TemplateView):
    def get(self, request, *args, **kwargs):
-        cf = get_object_or_404(CachedFile, id=kwargs.get("filename"), filename="background_preview.pdf")
+        cf = get_object_or_404(CachedFile, id=kwargs.get("filename"), filename="background_preview.pdf", web_download=True)
        if not cf.allowed_for_session(request, "ticketoutput-pdf-background"):
            raise PermissionDenied()
        resp = FileResponse(cf.file, filename=cf.filename, content_type='application/pdf')
@@ -85,6 +85,7 @@ from pretix.control.views import PaginationMixin
 from pretix.control.views.event import MetaDataEditorMixin
 from pretix.helpers import GroupConcat
 from pretix.helpers.compat import CompatDeleteView
+from pretix.helpers.database import UnixTimestamp
 from pretix.helpers.i18n import get_format_without_seconds
 from pretix.helpers.models import modelcopy

@@ -1276,6 +1277,11 @@ class SubEventBulkEdit(SubEventQueryMixin, EventPermissionRequiredMixin, FormVie
            self._default_meta = self.request.event.meta_data

        for p in self.request.organizer.meta_properties.all():
+            if p.protected and not self.request.user.has_organizer_permission(
+                    self.request.organizer, 'organizer.settings.general:write', request=self.request
+            ):
+                continue
+
            inst = SubEventMetaValue(property=p)
            if len(matches[p.id]) == 1 and matches[p.id][0]['c'] == total:
                inst.value = matches[p.id][0]['value']
@@ -1578,21 +1584,6 @@ class SubEventBulkEdit(SubEventQueryMixin, EventPermissionRequiredMixin, FormVie
        mixed_values = set()
        qs = self.get_queryset()

-        qs = qs.annotate(
-            **{
-                # TODO: Once we're on Django 3.2, pass a tzinfo parameter
-                # Before Django 3.2, it uses the current timezone, which is hopefully fine
-                # as well in all cases we are concerned about
-                # See also: https://code.djangoproject.com/ticket/31948
-                k + '_day': TruncDate(k)
-                for k in ('date_from', 'date_to', 'date_admission', 'presale_start', 'presale_end')
-            },
-            **{
-                k + '_time': TruncTime(k)
-                for k in ('date_from', 'date_to', 'date_admission', 'presale_start', 'presale_end')
-            },
-        )
-
        fields = {
            'name',
            'location',
@@ -1606,21 +1597,75 @@ class SubEventBulkEdit(SubEventQueryMixin, EventPermissionRequiredMixin, FormVie
            'date_from_time',
            'date_to_day',
            'date_to_time',
-            'date_admission_day',
-            'date_admission_time',
-            'presale_start_day',
-            'presale_start_time',
-            'presale_end_day',
-            'presale_end_time',
        }
+        rel_fields = {'date_admission', 'presale_start', 'presale_end'}
+
+        qs = qs.annotate(
+            **{
+                k + '_day': TruncDate(k, tzinfo=self.request.event.timezone)
+                for k in ('date_from', 'date_to', 'date_admission')
+            },
+            **{
+                k + '_time': TruncTime(k, tzinfo=self.request.event.timezone)
+                for k in ('date_from', 'date_to', 'date_admission')
+            },
+            **{
+                k + '_rel_min': (UnixTimestamp('date_from') - UnixTimestamp(k)) / 60
+                for k in rel_fields
+            },
+            **{
+                k + '_rel_days': TruncDate('date_from', tzinfo=self.request.event.timezone) - TruncDate(k, tzinfo=self.request.event.timezone)
+                for k in rel_fields
+            }
+        )
+
        for k in fields:
-            existing_values = list(qs.order_by(k).values(k).annotate(c=Count('*')))
+            existing_values = list(qs.order_by(k).values(k).distinct())
            if len(existing_values) == 1:
                initial[k] = existing_values[0][k]
            elif len(existing_values) > 1:
                mixed_values.add(k)
                initial[k] = None

+        for k in rel_fields:
+            existing_fixed_values = list(qs.order_by(k).values(k).distinct())
+            existing_rel_days_values = list(qs.order_by(f'{k}_rel_days').values(f'{k}_rel_days').distinct())
+            existing_rel_min_values = list(qs.order_by(f'{k}_rel_min').values(f'{k}_rel_min').distinct())
+
+            if len(existing_fixed_values) == 1:
+                if existing_fixed_values[0][k]:
+                    initial[f"{k}_rel"] = RelativeDateWrapper(existing_fixed_values[0][k])
+                else:
+                    initial[f"{k}_rel"] = None
+
+            elif len(existing_rel_min_values) == 1:
+                if rel_min := existing_rel_min_values[0][f'{k}_rel_min']:
+                    initial[f"{k}_rel"] = RelativeDateWrapper(RelativeDate(
+                        days=0,
+                        base_date_name='event__date_from',
+                        time=None,
+                        minutes=abs(rel_min),
+                        is_after=rel_min < 0,
+                    ))
+                else:
+                    initial[f"{k}_rel"] = None
+
+            elif len(existing_rel_days_values) == 1:
+                if rel_days := existing_rel_days_values[0][f'{k}_rel_days']:
+                    initial[f"{k}_rel"] = RelativeDateWrapper(RelativeDate(
+                        days=abs(rel_days.days),
+                        base_date_name='event__date_from',
+                        time=None,
+                        minutes=None,
+                        is_after=rel_days.days < 0,
+                    ))
+                else:
+                    initial[f"{k}_rel"] = None
+
+            elif len(existing_fixed_values) > 1 or len(existing_rel_days_values) > 1 or len(existing_rel_min_values) > 1:
+                mixed_values.add(k)
+                initial[k] = None
+
        kwargs = super().get_form_kwargs()
        kwargs['event'] = self.request.event
        kwargs['prefix'] = 'bulkedit'
@@ -342,7 +342,7 @@ def nav_context_list(request):
        max_to=Max('subevents__date_to'),
        max_fromto=Greatest(Max('subevents__date_to'), Max('subevents__date_from'))
    ).annotate(
-        order_from=Coalesce('min_from', 'date_from'),
+        order_from=Coalesce('max_from', 'date_from'),
    ).order_by('-order_from', 'slug')

    if request.user.has_active_staff_session(request.session.session_key):
@@ -59,6 +59,7 @@ from django.utils.translation import gettext_lazy as _
 from django.views import View
 from django.views.decorators.cache import never_cache
 from django.views.generic import FormView, ListView, TemplateView, UpdateView
+from django_otp import devices_for_user
 from django_otp.plugins.otp_static.models import StaticDevice
 from django_otp.plugins.otp_totp.models import TOTPDevice
 from django_scopes import scopes_disabled
@@ -85,7 +86,6 @@ from pretix.helpers.ratelimit import rate_limit, rate_limit_reset
 from pretix.helpers.security import session_reauth
 from pretix.helpers.u2f import websafe_encode

-REAL_DEVICE_TYPES = (TOTPDevice, WebAuthnDevice, U2FDevice)
 logger = logging.getLogger(__name__)


@@ -313,17 +313,7 @@ class User2FAMainView(RecentAuthenticationRequiredMixin, TemplateView):
        except StaticDevice.DoesNotExist:
            ctx['static_tokens_device'] = None

-        ctx['devices'] = []
-        for dt in REAL_DEVICE_TYPES:
-            objs = list(dt.objects.filter(user=self.request.user, confirmed=True))
-            for obj in objs:
-                if dt == TOTPDevice:
-                    obj.devicetype = 'totp'
-                elif dt == U2FDevice:
-                    obj.devicetype = 'u2f'
-                elif dt == WebAuthnDevice:
-                    obj.devicetype = 'webauthn'
-            ctx['devices'] += objs
+        ctx['devices'] = [d for d in devices_for_user(self.request.user) if not isinstance(d, StaticDevice)]

        ctx['obligatory'] = None
        if settings.PRETIX_OBLIGATORY_2FA is True:
@@ -342,9 +332,9 @@ class User2FADeviceAddView(RecentAuthenticationRequiredMixin, FormView):
    template_name = 'pretixcontrol/user/2fa_add.html'

    def form_valid(self, form):
-        if form.cleaned_data['devicetype'] == 'totp':
+        if form.cleaned_data['devicetype'] == 'otp_totp.totpdevice':
            dev = TOTPDevice.objects.create(user=self.request.user, confirmed=False, name=form.cleaned_data['name'])
-        elif form.cleaned_data['devicetype'] == 'webauthn':
+        elif form.cleaned_data['devicetype'] == 'pretixbase.webauthndevice':
            if not self.request.is_secure():
                messages.error(self.request,
                               _('Security devices are only available if pretix is served via HTTPS.'))
@@ -364,11 +354,11 @@ class User2FADeviceDeleteView(RecentAuthenticationRequiredMixin, TemplateView):

    @cached_property
    def device(self):
-        if self.kwargs['devicetype'] == 'totp':
+        if self.kwargs['devicetype'] == 'otp_totp.totpdevice':
            return get_object_or_404(TOTPDevice, user=self.request.user, pk=self.kwargs['device'], confirmed=True)
-        elif self.kwargs['devicetype'] == 'webauthn':
+        elif self.kwargs['devicetype'] == 'pretixbase.webauthndevice':
            return get_object_or_404(WebAuthnDevice, user=self.request.user, pk=self.kwargs['device'], confirmed=True)
-        elif self.kwargs['devicetype'] == 'u2f':
+        elif self.kwargs['devicetype'] == 'pretixbase.u2fdevice':
            return get_object_or_404(U2FDevice, user=self.request.user, pk=self.kwargs['device'], confirmed=True)

    def get_context_data(self, **kwargs):
@@ -386,7 +376,7 @@ class User2FADeviceDeleteView(RecentAuthenticationRequiredMixin, TemplateView):
        msgs = [
            _('A two-factor authentication device has been removed from your account.')
        ]
-        if not any(dt.objects.filter(user=self.request.user, confirmed=True) for dt in REAL_DEVICE_TYPES):
+        if not any(d.confirmed for d in devices_for_user(self.request.user) if not isinstance(d, StaticDevice)):
            self.request.user.require_2fa = False
            self.request.user.save()
            self.request.user.log_action('pretix.user.settings.2fa.disabled', user=self.request.user)
@@ -461,7 +451,7 @@ class User2FADeviceConfirmWebAuthnView(RecentAuthenticationRequiredMixin, Templa
            ).first()
            if credential_id_exists:
                messages.error(request, _('This security device is already registered.'))
-                return redirect(reverse('control:user.settings.2fa.confirm.webauthn', kwargs={
+                return redirect(reverse('control:user.settings.2fa.confirm.pretixbase.webauthndevice', kwargs={
                    'device': self.device.pk
                }))

@@ -475,7 +465,7 @@ class User2FADeviceConfirmWebAuthnView(RecentAuthenticationRequiredMixin, Templa
            self.device.save()
            self.request.user.log_action('pretix.user.settings.2fa.device.added', user=self.request.user, data={
                'id': self.device.pk,
-                'devicetype': 'u2f',
+                'devicetype': 'pretixbase.webauthndevice',
                'name': self.device.name,
            })
            notices = [
@@ -503,7 +493,7 @@ class User2FADeviceConfirmWebAuthnView(RecentAuthenticationRequiredMixin, Templa
        except Exception:
            messages.error(request, _('The registration could not be completed. Please try again.'))
            logger.exception('WebAuthn registration failed')
-            return redirect(reverse('control:user.settings.2fa.confirm.webauthn', kwargs={
+            return redirect(reverse('control:user.settings.2fa.confirm.pretixbase.webauthndevice', kwargs={
                'device': self.device.pk
            }))

@@ -537,7 +527,7 @@ class User2FADeviceConfirmTOTPView(RecentAuthenticationRequiredMixin, TemplateVi
            self.request.user.log_action('pretix.user.settings.2fa.device.added', user=self.request.user, data={
                'id': self.device.pk,
                'name': self.device.name,
-                'devicetype': 'totp'
+                'devicetype': 'otp_totp.totpdevice'
            })
            notices = [
                _('A new two-factor authentication device has been added to your account.')
@@ -563,7 +553,7 @@ class User2FADeviceConfirmTOTPView(RecentAuthenticationRequiredMixin, TemplateVi
        else:
            messages.error(request, _('The code you entered was not valid. If this problem persists, please check '
                                      'that the date and time of your phone are configured correctly.'))
-            return redirect(reverse('control:user.settings.2fa.confirm.totp', kwargs={
+            return redirect(reverse('control:user.settings.2fa.confirm.otp_totp.totpdevice', kwargs={
                'device': self.device.pk
            }))

@@ -594,7 +584,7 @@ class User2FAEnableView(RecentAuthenticationRequiredMixin, TemplateView):
    template_name = 'pretixcontrol/user/2fa_enable.html'

    def dispatch(self, request, *args, **kwargs):
-        if not any(dt.objects.filter(user=self.request.user, confirmed=True) for dt in REAL_DEVICE_TYPES):
+        if not any(d.confirmed for d in devices_for_user(self.request.user) if not isinstance(d, StaticDevice)):
            messages.error(request, _('Please configure at least one device before enabling two-factor '
                                      'authentication.'))
            return redirect(reverse('control:user.settings.2fa'))
@@ -771,6 +761,7 @@ class UserNotificationsEditView(TemplateView):
                {k: a.get(t) for k, a in self.global_set.items()},
            )
            for t, tv in self.types.items()
+            if tv.is_event_level or not self.event
        ]
        ctx['event'] = self.event
        if self.event:
@@ -956,7 +947,7 @@ class UserEmailConfirmView(FormView):

    @transaction.atomic()
    def form_valid(self, form):
-        reason = self.request.GET['reason']
+        reason = self.request.GET.get('reason')
        if reason not in ('email_change', 'email_verify'):
            raise PermissionDenied
        try:
@@ -40,6 +40,7 @@ from django.utils.functional import cached_property
 from django.utils.translation import gettext_lazy as _
 from django.views import View
 from django.views.generic import ListView, TemplateView
+from django_otp import devices_for_user
 from django_otp.plugins.otp_static.models import StaticDevice
 from hijack import signals

@@ -107,6 +108,9 @@ class UserEditView(AdministratorPermissionRequiredMixin, RecentAuthenticationReq
        ctx['backend'] = (
            b[self.object.auth_backend].verbose_name if self.object.auth_backend in b else self.object.auth_backend
        )
+
+        ctx['devices'] = devices_for_user(self.object)
+
        return ctx

    def get_success_url(self):
@@ -183,6 +187,25 @@ class UserEmergencyTokenView(AdministratorPermissionRequiredMixin, RecentAuthent
        return reverse('control:users.edit', kwargs=self.kwargs)


+class Reset2FADriftThrottleView(AdministratorPermissionRequiredMixin, RecentAuthenticationRequiredMixin, View):
+
+    def get(self, request, *args, **kwargs):
+        return redirect(reverse('control:users.edit', kwargs=self.kwargs))
+
+    def post(self, request, *args, **kwargs):
+        self.object = get_object_or_404(User, pk=self.kwargs.get("id"))
+        self.object.totpdevice_set.update(drift=0, throttling_failure_timestamp=None, throttling_failure_count=0)
+        self.object.staticdevice_set.update(throttling_failure_timestamp=None, throttling_failure_count=0)
+        self.object.log_action('pretix.user.settings.2fa.resetdrift', user=self.request.user)
+        messages.success(request, _(
+            'The drift values for TOTP devices have been reset.'
+        ))
+        return redirect(self.get_success_url())
+
+    def get_success_url(self):
+        return reverse('control:users.edit', kwargs=self.kwargs)
+
+
 class UserAnonymizeView(AdministratorPermissionRequiredMixin, RecentAuthenticationRequiredMixin, TemplateView):
    template_name = "pretixcontrol/users/anonymize.html"

@@ -144,7 +144,7 @@ class VoucherList(VoucherQueryMixin, PaginationMixin, EventPermissionRequiredMix
        headers = [
            _('Voucher code'), _('Valid until'), _('Product'), _('Reserve quota'), _('Bypass quota'),
            _('Price effect'), _('Value'), _('Tag'), _('Redeemed'), _('Maximum usages'), _('Seat'),
-            _('Comment')
+            _('Comment'), _('Budget'), _('Budget used')
        ]
        writer.writerow(headers)

@@ -170,7 +170,9 @@ class VoucherList(VoucherQueryMixin, PaginationMixin, EventPermissionRequiredMix
                str(v.redeemed),
                str(v.max_usages),
                str(v.seat) if v.seat else "",
-                str(v.comment) if v.comment else ""
+                str(v.comment) if v.comment else "",
+                str(v.budget) if v.budget is not None else "",
+                str(v.budget_used) if v.budget is not None else "",
            ]
            writer.writerow(row)

@@ -26,7 +26,8 @@ from django.contrib.postgres.indexes import BrinIndex
 from django.core.exceptions import FieldDoesNotExist, ImproperlyConfigured
 from django.db import connection, transaction
 from django.db.models import (
-    Aggregate, Expression, F, Field, JSONField, Lookup, OrderBy, Value,
+    Aggregate, Expression, F, Field, Func, IntegerField, JSONField, Lookup,
+    OrderBy, Value,
 )
 from django.utils.functional import lazy

@@ -313,3 +314,13 @@ class IgnoreOnSQLiteMixin:

 class BrinIndexIgnoredOnSQLite(IgnoreOnSQLiteMixin, BrinIndex):
    pass
+
+
+class UnixTimestamp(Func):
+    output_field = IntegerField()
+
+    def as_postgresql(self, compiler, connection):
+        return self.as_sql(compiler, connection, template="EXTRACT(epoch from %(expressions)s)")
+
+    def as_sqlite(self, compiler, connection):
+        return self.as_sql(compiler, connection, template="CAST(strftime('%%%%s', datetime(%(expressions)s)) AS INT)")
@@ -27,6 +27,7 @@ from http import cookies

 from django.conf import settings
 from django.core.exceptions import SuspiciousFileOperation
+from django.middleware.csrf import CsrfViewMiddleware as BaseCsrfMiddleware
 from PIL import Image
 from requests.adapters import HTTPAdapter
 from urllib3.connection import HTTPConnection, HTTPSConnection
@@ -42,6 +43,7 @@ from urllib3.util.timeout import _DEFAULT_TIMEOUT

 from pretix.helpers.reportlab import ThumbnailingImageReader
 from pretix.helpers.ssrf import should_block_access
+from pretix.multidomain.middlewares import CsrfViewMiddleware


 def monkeypatch_vobject_performance():
@@ -242,6 +244,20 @@ def monkeypatch_reportlab_imagereader():
    utils.ImageReader.__init__ = new_init


+def monkeypatch_csrf_middleware():
+    # Some views from django or plugins use the middleware or the derived decorators directly,
+    # so we have to also patch the stock middleware
+    BaseCsrfMiddleware._get_secret = CsrfViewMiddleware._get_secret
+    BaseCsrfMiddleware._set_csrf_cookie = CsrfViewMiddleware._set_csrf_cookie
+
+
+def monkeypatch_json_constants():
+    from json.decoder import _CONSTANTS  # noqa
+    del _CONSTANTS['-Infinity']
+    del _CONSTANTS['Infinity']
+    del _CONSTANTS['NaN']
+
+
 def monkeypatch_all_at_ready():
    monkeypatch_vobject_performance()
    monkeypatch_pillow_safer()
@@ -249,3 +265,5 @@ def monkeypatch_all_at_ready():
    monkeypatch_urllib3_ssrf_protection()
    monkeypatch_cookie_morsel()
    monkeypatch_reportlab_imagereader()
+    monkeypatch_csrf_middleware()
+    monkeypatch_json_constants()