Do not use redis cache at import time

During our [2026-06-27 incident](https://pretix.eu/about/en/blog/20260630-pretix-hosted-outage/),
we noticed that pretix is using redis at import time. This means that
gunicorn and celery process were unable to start on servers who could
currently not reach redis. This is kinda mitigated through auto-restart
on systemd or docker level, but that's not really how it is supposed to
work. Celery even has smart retry/reconnect logic that becomes pointless
this way.

doc/development/setup.rst

@@ -53,7 +53,7 @@ Working with the code
 ---------------------
 If you do not have a recent installation of ``nodejs``, install it now::
 
-    curl -sL https://deb.nodesource.com/setup_24.x | sudo -E bash -
+    curl -sL https://deb.nodesource.com/setup_17.x | sudo -E bash -
     sudo apt install nodejs
 
 To make sure it is on your path variable, close and reopen your terminal. Now, install the Python-level dependencies of pretix::

pyproject.toml

@@ -53,8 +53,7 @@ dependencies = [
   "django-oauth-toolkit==2.3.*",
   "django-otp==1.7.*",
   "django-phonenumber-field==8.4.*",
-  "django-querytagger==0.0.3",
+  "django-redis==6.0.*",
-  "django-redis==7.0.*",
   "django-scopes==2.0.*",
   "django-statici18n==2.7.*",
   "djangorestframework==3.17.*",
@@ -77,7 +76,7 @@ dependencies = [
   "paypal-checkout-serversdk==1.0.*",
   "PyJWT==2.13.*",
   "phonenumberslite==9.0.*",
-  "Pillow==12.3.*",
+  "Pillow==12.2.*",
   "pretix-plugin-build",
   "protobuf==7.35.*",
   "psycopg2-binary",
@@ -92,9 +91,9 @@ dependencies = [
   "pyuca",
   "qrcode==8.2",
   "redis==7.4.*",
-  "reportlab==5.0.*",
+  "reportlab==4.5.*",
-  "requests==2.34.*",
+  "requests==2.32.*",
-  "sentry-sdk==2.64.*",
+  "sentry-sdk==2.63.*",
   "sepaxml==2.7.*",
   "stripe==7.9.*",
   "text-unidecode==1.*",
@@ -102,7 +101,7 @@ dependencies = [
   "tqdm==4.*",
   "ua-parser==1.0.*",
   "vobject==0.9.*",
-  "webauthn==3.0.*",
+  "webauthn==2.8.*",
   "zeep==4.3.*"
 ]
 

src/Makefile

@@ -6,8 +6,8 @@ localecompile:
 	./manage.py compilemessages
 
 localegen:
-	./manage.py makemessages --keep-pot --add-location file --ignore "pretix/static/npm_dir/*" $(LNGS)
+	./manage.py makemessages --keep-pot --ignore "pretix/static/npm_dir/*" $(LNGS)
-	./manage.py makemessages --keep-pot --add-location file -e js,ts,vue -d djangojs --ignore "pretix/static/npm_dir/*" --ignore "pretix/helpers/*" --ignore "pretix/static/jsi18n/*" --ignore "pretix/static/jsi18n/*" --ignore "pretix/static.dist/*" --ignore "data/*" --ignore "pretix/static/rrule/*" --ignore "build/*" $(LNGS)
+	./manage.py makemessages --keep-pot -e js,ts,vue -d djangojs --ignore "pretix/static/npm_dir/*" --ignore "pretix/helpers/*" --ignore "pretix/static/jsi18n/*" --ignore "pretix/static/jsi18n/*" --ignore "pretix/static.dist/*" --ignore "data/*" --ignore "pretix/static/rrule/*" --ignore "build/*" $(LNGS)
 
 staticfiles: npminstall npmbuild jsi18n
 	./manage.py collectstatic --noinput

src/pretix/__init__.py

@@ -19,4 +19,4 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-__version__ = "2026.7.0.dev0"
+__version__ = "2026.6.0.dev0"

src/pretix/_base_settings.py

@@ -118,7 +118,6 @@ ALL_LANGUAGES = [
     ('sv', _('Swedish')),
     ('es', _('Spanish')),
     ('es-419', _('Spanish (Latin America)')),
-    ('th', _('Thai')),
     ('tr', _('Turkish')),
     ('uk', _('Ukrainian')),
 ]

src/pretix/api/serializers/event.py

@@ -747,7 +747,6 @@ class EventSettingsSerializer(SettingsSerializer):
         'max_items_per_order',
         'reservation_time',
         'contact_mail',
-        'contact_url',
         'show_variations_expanded',
         'hide_sold_out',
         'meta_noindex',

src/pretix/api/serializers/organizer.py

@@ -27,7 +27,7 @@ from django.core.exceptions import ObjectDoesNotExist
 from django.db import transaction
 from django.db.models import Q
 from django.utils.crypto import get_random_string
-from django.utils.translation import gettext, gettext_lazy as _
+from django.utils.translation import gettext_lazy as _
 from rest_framework import serializers
 from rest_framework.exceptions import ValidationError
 
@@ -492,9 +492,7 @@ class TeamInviteSerializer(serializers.ModelSerializer):
     def _send_invite(self, instance):
         mail(
             instance.email,
-            gettext('You\'ve been invited to join %(organizer)s') % {
+            _('Account invitation'),
-                'organizer': self.context['organizer'].name,
-            },
             'pretixcontrol/email/invitation.txt',
             {
                 'instance': settings.PRETIX_INSTANCE_NAME,
@@ -576,7 +574,6 @@ class OrganizerSettingsSerializer(SettingsSerializer):
         'customer_accounts_require_login_for_order_access',
         'invoice_regenerate_allowed',
         'contact_mail',
-        'contact_url',
         'imprint_url',
         'organizer_info_text',
         'event_list_type',

src/pretix/base/forms/questions.py

@@ -1404,7 +1404,7 @@ class BaseInvoiceAddressForm(forms.ModelForm):
         elif self.validate_vat_id and vat_id_applicable:
             try:
                 normalized_id = validate_vat_id(data.get('vat_id'), str(data.get('country')))
-                self.instance.vat_id_validated = bool(normalized_id)
+                self.instance.vat_id_validated = True
                 self.instance.vat_id = data['vat_id'] = normalized_id
             except VATIDFinalError as e:
                 if self.all_optional:

src/pretix/base/management/commands/runperiodic.py

@@ -40,7 +40,6 @@ from django.core.cache import cache
 from django.core.management.base import BaseCommand
 from django.db import close_old_connections
 from django.dispatch.dispatcher import NO_RECEIVERS
-from django_querytagger.tagging import with_tag
 
 from pretix.helpers.periodic import SKIPPED
 
@@ -83,8 +82,7 @@ class Command(BaseCommand):
             try:
                 # Check if the DB connection is still good, it might be closed if the previous task took too long.
                 close_old_connections()
-                with with_tag(f"periodictask={name}"):
+                r = receiver(signal=periodic_task, sender=self)
-                    r = receiver(signal=periodic_task, sender=self)
             except Exception as err:
                 if isinstance(err, KeyboardInterrupt):
                     raise err

src/pretix/base/middleware.py

@@ -19,8 +19,6 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-import logging
-import re
 from collections import OrderedDict
 from urllib.parse import urlparse, urlsplit
 from zoneinfo import ZoneInfo, ZoneInfoNotFoundError
@@ -45,8 +43,6 @@ from pretix.multidomain.urlreverse import (
 )
 from pretix.presale.style import get_fonts
 
-logger = logging.getLogger(__name__)
-
 _supported = None
 
 
@@ -227,26 +223,7 @@ def _parse_csp(header):
     return h
 
 
-VALID_CSP_DIRECTIVES = [
-    "child-src", "connect-src", "default-src", "fenced-frame-src", "font-src", "form-action", "frame-src", "img-src",
-    "manifest-src", "media-src", "object-src", "prefetch-src", "report-uri", "script-src", "script-src-elem",
-    "script-src-attr", "style-src", "style-src-elem", "style-src-attr", "worker-src",
-]
-
-CSP_ILLEGAL_CHARS = re.compile(r'[\s,;]')
-
-
-def _sanitize_csp(h):
-    for k, v in h.items():
-        if k not in VALID_CSP_DIRECTIVES:
-            raise ValueError("Invalid CSP directive " + k)
-        if any(CSP_ILLEGAL_CHARS.search(el) for el in v):
-            logger.warning("Stripping invalid component from CSP: %r", h)
-            h[k] = [el for el in v if not CSP_ILLEGAL_CHARS.search(el)]
-
-
 def _render_csp(h):
-    _sanitize_csp(h)
     return "; ".join(k + ' ' + ' '.join(v) for k, v in h.items() if v)
 
 
@@ -266,7 +243,21 @@ def _merge_csp(a, b):
 
 
 class SecurityMiddleware(MiddlewareMixin):
+    CSP_EXEMPT = (
+        '/api/v1/docs/',
+    )
+
     def process_response(self, request, resp):
+        def nested_dict_values(d):
+            for v in d.values():
+                if isinstance(v, dict):
+                    yield from nested_dict_values(v)
+                else:
+                    if isinstance(v, str):
+                        yield v
+
+        url = resolve(request.path_info)
+
         if settings.DEBUG and resp.status_code >= 400:
             # Don't use CSP on debug error page as it breaks of Django's fancy error
             # pages
@@ -277,15 +268,18 @@ class SecurityMiddleware(MiddlewareMixin):
         # https://github.com/pretix/pretix/issues/765
         resp['P3P'] = 'CP=\"ALL DSP COR CUR ADM TAI OUR IND COM NAV INT\"'
 
-        if not getattr(resp, '_csp_ignore', False):
+        img_src = []
-            resp['Content-Security-Policy'] = _render_csp(self._build_csp(request, resp))
+        gs = global_settings_object(request)
-        elif 'Content-Security-Policy' in resp:
+        if gs.settings.leaflet_tiles:
-            del resp['Content-Security-Policy']
+            img_src.append(gs.settings.leaflet_tiles[:gs.settings.leaflet_tiles.index("/", 10)].replace("{s}", "*"))
 
-        return resp
+        font_src = set()
-
+        if hasattr(request, 'event'):
-    def _build_csp(self, request, resp):
+            for font in get_fonts(request.event, pdf_support_required=False).values():
-        url = resolve(request.path_info)
+                for path in list(nested_dict_values(font)):
+                    font_location = urlparse(path)
+                    if font_location.scheme and font_location.netloc:
+                        font_src.add('{}://{}'.format(font_location.scheme, font_location.netloc))
 
         h = {
             'default-src': ["{static}"],
@@ -294,8 +288,8 @@ class SecurityMiddleware(MiddlewareMixin):
             'frame-src': ['{static}'],
             'style-src': ["{static}", "{media}"],
             'connect-src': ["{dynamic}", "{media}"],
-            'img-src': ["{static}", "{media}", "data:"],
+            'img-src': ["{static}", "{media}", "data:"] + img_src,
-            'font-src': ["{static}"],
+            'font-src': ["{static}"] + list(font_src),
             'media-src': ["{static}", "data:"],
             # form-action is not only used to match on form actions, but also on URLs
             # form-actions redirect to. In the context of e.g. payment providers or
@@ -304,13 +298,6 @@ class SecurityMiddleware(MiddlewareMixin):
             'form-action': ["{dynamic}", "https:"] + (['http:'] if settings.SITE_URL.startswith('http://') else []),
         }
 
-        gs = global_settings_object(request)
-        if gs.settings.leaflet_tiles:
-            h['img-src'].append(gs.settings.leaflet_tiles[:gs.settings.leaflet_tiles.index("/", 10)].replace("{s}", "*"))
-
-        if hasattr(request, 'event'):
-            h['font-src'] += list(self._get_font_origins(request.event))
-
         if settings.VITE_DEV_MODE:
             h['script-src'] += ["http://localhost:5173", "ws://localhost:5173"]
             h['style-src'] += ["'unsafe-inline'"]
@@ -322,7 +309,6 @@ class SecurityMiddleware(MiddlewareMixin):
             if not settings.VITE_DEV_MODE:
                 # can't have 'unsafe-inline' and nonce at the same time
                 h['style-src'].append(nonce)
-
         # Only include pay.google.com for wallet detection purposes on the Payment selection page
         if (
                 url.url_name == "event.order.pay.change" or
@@ -331,32 +317,27 @@ class SecurityMiddleware(MiddlewareMixin):
             h['script-src'].append('https://pay.google.com')
             h['frame-src'].append('https://pay.google.com')
             h['connect-src'].append('https://google.com/pay')
-
         if settings.LOG_CSP:
             h['report-uri'] = ["/csp_report/"]
-
         if 'Content-Security-Policy' in resp:
             _merge_csp(h, _parse_csp(resp['Content-Security-Policy']))
-
         if settings.CSP_ADDITIONAL_HEADER:
             _merge_csp(h, _parse_csp(settings.CSP_ADDITIONAL_HEADER))
 
-        placeholders = {
+        staticdomain = "'self'"
-            "{static}": ["'self'"],
+        dynamicdomain = "'self'"
-            "{dynamic}": ["'self'"],
+        mediadomain = "'self'"
-            "{media}": ["'self'"],
-        }
         if settings.MEDIA_URL.startswith('http'):
-            placeholders["{media}"].append(settings.MEDIA_URL[:settings.MEDIA_URL.find('/', 9)])
+            mediadomain += " " + settings.MEDIA_URL[:settings.MEDIA_URL.find('/', 9)]
         if settings.STATIC_URL.startswith('http'):
-            placeholders["{static}"].append(settings.STATIC_URL[:settings.STATIC_URL.find('/', 9)])
+            staticdomain += " " + settings.STATIC_URL[:settings.STATIC_URL.find('/', 9)]
         if settings.SITE_URL.startswith('http'):
             if settings.SITE_URL.find('/', 9) > 0:
-                placeholders["{static}"].append(settings.SITE_URL[:settings.SITE_URL.find('/', 9)])
+                staticdomain += " " + settings.SITE_URL[:settings.SITE_URL.find('/', 9)]
-                placeholders["{dynamic}"].append(settings.SITE_URL[:settings.SITE_URL.find('/', 9)])
+                dynamicdomain += " " + settings.SITE_URL[:settings.SITE_URL.find('/', 9)]
             else:
-                placeholders["{static}"].append(settings.SITE_URL)
+                staticdomain += " " + settings.SITE_URL
-                placeholders["{dynamic}"].append(settings.SITE_URL)
+                dynamicdomain += " " + settings.SITE_URL
 
         if hasattr(request, 'organizer') and request.organizer:
             if hasattr(request, 'event') and request.event:
@@ -367,29 +348,18 @@ class SecurityMiddleware(MiddlewareMixin):
                 siteurlsplit = urlsplit(settings.SITE_URL)
                 if siteurlsplit.port and siteurlsplit.port not in (80, 443):
                     domain = '%s:%d' % (domain, siteurlsplit.port)
-                placeholders["{dynamic}"].append(domain)
+                dynamicdomain += " " + domain
 
-        for k, v in h.items():
+        if request.path not in self.CSP_EXEMPT and not getattr(resp, '_csp_ignore', False):
-            h[k] = sorted(set(result for part in v for result in placeholders.get(part, [part])))
+            resp['Content-Security-Policy'] = _render_csp(h).format(static=staticdomain, dynamic=dynamicdomain,
+                                                                    media=mediadomain)
+            for k, v in h.items():
+                h[k] = sorted(set(' '.join(v).format(static=staticdomain, dynamic=dynamicdomain, media=mediadomain).split(' ')))
+            resp['Content-Security-Policy'] = _render_csp(h)
+        elif 'Content-Security-Policy' in resp:
+            del resp['Content-Security-Policy']
 
-        return h
+        return resp
-
-    def _get_font_origins(self, event):
-        def nested_dict_values(d):
-            for v in d.values():
-                if isinstance(v, dict):
-                    yield from nested_dict_values(v)
-                else:
-                    if isinstance(v, str):
-                        yield v
-
-        font_src = set()
-        for font in get_fonts(event, pdf_support_required=False).values():
-            for path in list(nested_dict_values(font)):
-                font_location = urlparse(path)
-                if font_location.scheme and font_location.netloc:
-                    font_src.add('{}://{}'.format(font_location.scheme, font_location.netloc))
-        return font_src
 
 
 class RejectInvalidInputMiddleware(MiddlewareMixin):

src/pretix/base/migrations/0302_resolve_duplicate_codes_and_secrets.py

@@ -1,58 +0,0 @@
-# Generated by Django 4.2.8 on 2024-07-01 09:27
-import logging
-
-from django.db import migrations
-from django.db.models import Count
-
-logger = logging.getLogger(__name__)
-
-
-def clean_duplicate_secrets(apps, schema_editor):
-    # This will autofix all possible duplicate Order.code and OrderPosition.secret values,
-    # unless Order.code is already too long to append something. This would need to be fixed by
-    # sysadmins manually.
-    OrderPosition = apps.get_model("pretixbase", "OrderPosition")
-    Order = apps.get_model("pretixbase", "Order")
-
-    qs = OrderPosition.all.values("secret", "order__event__organizer_id").order_by().annotate(c=Count("*")).filter(c__gt=1)
-    for row in qs:
-        affected = OrderPosition.all.filter(
-            **{k: v for k, v in row.items() if k != "c"}
-        ).order_by("pk")
-        logger.error(f"Found {row['c']} tickets with with the same secret \"{row['secret']}\" in organizer {row['order__event__organizer_id']}, all except one will be changed")
-        for i, a in enumerate(affected):
-            if i > 0:
-                a.secret = a.secret + "__dupl__" + str(a.pk)
-                logger.info(
-                    f"Ticket {a.pk} has new secret {a.secret}"
-                )
-            a.save(update_fields=["organizer_id", "secret"])
-
-    qs = Order.objects.values("code", "event__organizer_id").order_by().annotate(c=Count("*")).filter(c__gt=1)
-    for row in qs:
-        affected = Order.objects.filter(
-            **{k: v for k, v in row.items() if k != "c"}
-        ).order_by("pk")
-        logger.error(f"Found {row['c']} orders with with the same code \"{row['code']}\" in organizer {row['event__organizer_id']}, all except one will be changed")
-        for i, a in enumerate(affected):
-            if i > 0:
-                if len(a.code) > 16 - len(str(a.pk)):
-                    raise ValueError(f"Cannot auto-fix order with duplicate code {a.code}, order code is too long already")
-                a.code = a.code + str(a.pk).zfill(16 - len(a.code))
-                logger.info(
-                    f"Order {a.pk} has new code {a.code}"
-                )
-            a.save(update_fields=["organizer_id", "code"])
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        (
-            "pretixbase",
-            "0301_reusablemedium_remove_orderposition",
-        ),
-    ]
-
-    operations = [
-        migrations.RunPython(clean_duplicate_secrets, migrations.RunPython.noop),
-    ]

src/pretix/base/migrations/0303_alter_order_organizer_alter_orderposition_organizer.py

@@ -1,46 +0,0 @@
-# Generated by Django 4.2.8 on 2024-07-01 09:27
-
-import django.db.models.deletion
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        (
-            "pretixbase",
-            "0302_resolve_duplicate_codes_and_secrets",
-        ),
-    ]
-
-    operations = [
-        migrations.RunSQL(
-            "UPDATE pretixbase_order "
-            "SET organizer_id = (SELECT e.organizer_id FROM pretixbase_event e WHERE e.id = pretixbase_order.event_id) "
-            "WHERE pretixbase_order.organizer_id IS NULL;",
-            migrations.RunSQL.noop,
-        ),
-        migrations.RunSQL(
-            "UPDATE pretixbase_orderposition "
-            "SET organizer_id = (SELECT e.organizer_id FROM pretixbase_order o LEFT JOIN pretixbase_event e ON e.id = o.event_id WHERE o.id = pretixbase_orderposition.order_id) "
-            "WHERE pretixbase_orderposition.organizer_id IS NULL;",
-            migrations.RunSQL.noop,
-        ),
-        migrations.AlterField(
-            model_name="order",
-            name="organizer",
-            field=models.ForeignKey(
-                on_delete=django.db.models.deletion.CASCADE,
-                related_name="orders",
-                to="pretixbase.organizer",
-            ),
-        ),
-        migrations.AlterField(
-            model_name="orderposition",
-            name="organizer",
-            field=models.ForeignKey(
-                on_delete=django.db.models.deletion.CASCADE,
-                related_name="order_positions",
-                to="pretixbase.organizer",
-            ),
-        ),
-    ]

src/pretix/base/models/auth.py

@@ -373,7 +373,7 @@ class User(AbstractBaseUser, PermissionsMixin, LoggingMixin):
 
         mail(
             email or self.email,
-            _('Changes to your account'),
+            _('Account information changed'),
             'pretixcontrol/email/security_notice.txt',
             {
                 'user': self,
@@ -400,13 +400,12 @@ class User(AbstractBaseUser, PermissionsMixin, LoggingMixin):
 
         with language(self.locale):
             if reason == 'email_change':
-                msg = str(_('To change your email address from {old_email} to {new_email}, use the following code:').format(
+                msg = str(_('to confirm changing your email address from {old_email}\nto {new_email}, use the following code:').format(
                     old_email=self.email, new_email=email,
                 ))
             elif reason == 'email_verify':
-                msg = str(_('To verify your email address {email} on {instance}, use the following code:').format(
+                msg = str(_('to confirm that your email address {email} belongs to your pretix account, use the following code:').format(
                     email=self.email,
-                    instance=settings.PRETIX_INSTANCE_NAME,
                 ))
             else:
                 raise Exception('Invalid confirmation code reason')
@@ -419,7 +418,7 @@ class User(AbstractBaseUser, PermissionsMixin, LoggingMixin):
         }
         mail(
             email or self.email,
-            _('Your confirmation code'),
+            _('pretix confirmation code'),
             'pretixcontrol/email/confirmation_code.txt',
             {
                 'user': self,
@@ -463,9 +462,7 @@ class User(AbstractBaseUser, PermissionsMixin, LoggingMixin):
         from pretix.base.services.mail import mail
 
         mail(
-            self.email,
+            self.email, _('Password recovery'), 'pretixcontrol/email/forgot.txt',
-            _('Reset your password'),
-            'pretixcontrol/email/forgot.txt',
             {
                 'instance': settings.PRETIX_INSTANCE_NAME,
                 'user': self,
@@ -650,22 +647,25 @@ class User(AbstractBaseUser, PermissionsMixin, LoggingMixin):
             id__in=self.teams.filter(TeamQuerySet.organizer_permission_q(permission)).values_list('organizer', flat=True)
         )
 
-    def has_active_staff_session(self, session_key):
+    def has_active_staff_session(self, session_key=None):
         """
         Returns whether or not a user has an active staff session (formerly known as superuser session)
         with the given session key.
         """
         return self.get_active_staff_session(session_key) is not None
 
-    def get_active_staff_session(self, session_key):
+    def get_active_staff_session(self, session_key=None):
-        if not self.is_staff or not session_key:
+        if not self.is_staff:
             return None
         if not hasattr(self, '_staff_session_cache'):
             self._staff_session_cache = {}
         if session_key not in self._staff_session_cache:
-            sess = StaffSession.objects.filter(
+            qs = StaffSession.objects.filter(
-                user=self, date_end__isnull=True, session_key=session_key
+                user=self, date_end__isnull=True
-            ).first()
+            )
+            if session_key:
+                qs = qs.filter(session_key=session_key)
+            sess = qs.first()
             if sess:
                 if sess.date_start < now() - timedelta(seconds=settings.PRETIX_SESSION_TIMEOUT_ABSOLUTE):
                     sess.date_end = now()

src/pretix/base/models/event.py

@@ -40,7 +40,6 @@ import warnings
 from collections import Counter, OrderedDict, defaultdict
 from datetime import datetime, time, timedelta
 from operator import attrgetter
-from typing import TYPE_CHECKING
 from urllib.parse import urljoin
 from zoneinfo import ZoneInfo
 
@@ -80,16 +79,10 @@ from pretix.helpers.thumb import get_thumbnail
 from ..settings import settings_hierarkey
 from .organizer import Organizer, Team
 
-if TYPE_CHECKING:
-    from hierarkey.proxy import HierarkeyProxy
-
 logger = logging.getLogger(__name__)
 
 
 class EventMixin:
-    if TYPE_CHECKING:
-        settings: HierarkeyProxy
-
     def clean(self):
         if self.presale_start and self.presale_end and self.presale_start > self.presale_end:
             raise ValidationError({'presale_end': _('The end of the presale period has to be later than its start.')})
@@ -906,7 +899,7 @@ class Event(EventMixin, LoggedModel):
         self.save()
         self.log_action('pretix.object.cloned', data={'source': other.slug, 'source_id': other.pk})
 
-        if hasattr(other, 'alternative_domain_assignment') and not is_cross_organizer:
+        if hasattr(other, 'alternative_domain_assignment'):
             other.alternative_domain_assignment.domain.event_assignments.create(event=self)
 
         if not self.all_sales_channels:
@@ -1403,12 +1396,15 @@ class Event(EventMixin, LoggedModel):
 
         for mp in self.organizer.meta_properties.all():
             if mp.required and not self.meta_data.get(mp.name):
-                issues.append(format_html(
+                issues.append(
-                    '<a href="{href}{href_hash}">{text}</a>',
+                    ('<a {a_attr}>' + gettext('You need to fill the meta parameter "{property}".') + '</a>').format(
-                    text=gettext('You need to fill the meta parameter "{property}".').format(property=mp.name),
+                        property=mp.name,
-                    href=reverse('control:event.settings', kwargs={'organizer': self.organizer.slug, 'event': self.slug}),
+                        a_attr='href="%s#id_prop-%d-value"' % (
-                    href_hash=f'#id_prop-{mp.pk}-value',
+                            reverse('control:event.settings', kwargs={'organizer': self.organizer.slug, 'event': self.slug}),
-                ))
+                            mp.pk
+                        )
+                    )
+                )
 
         responses = event_live_issues.send(self)
         for receiver, response in sorted(responses, key=lambda r: str(r[0])):

src/pretix/base/models/orders.py

@@ -224,6 +224,8 @@ class Order(LockModel, LoggedModel):
         "Organizer",
         related_name="orders",
         on_delete=models.CASCADE,
+        null=True,
+        blank=True,
     )
     event = models.ForeignKey(
         Event,
@@ -327,7 +329,7 @@ class Order(LockModel, LoggedModel):
         default="line",
     )
 
-    objects = ScopedManager(OrderQuerySet.as_manager().__class__, organizer='organizer')
+    objects = ScopedManager(OrderQuerySet.as_manager().__class__, organizer='event__organizer')
 
     class Meta:
         verbose_name = _("Order")
@@ -2539,6 +2541,8 @@ class OrderPosition(AbstractPosition):
         "Organizer",
         related_name="order_positions",
         on_delete=models.CASCADE,
+        null=True,
+        blank=True,
     )
     order = models.ForeignKey(
         Order,
@@ -2595,7 +2599,7 @@ class OrderPosition(AbstractPosition):
         blank=True,
     )
 
-    all = ScopedManager(organizer='organizer')
+    all = ScopedManager(organizer='order__event__organizer')
     objects = ActivePositionManager()
 
     def __init__(self, *args, **kwargs):

src/pretix/base/models/organizer.py

@@ -35,7 +35,6 @@ import operator
 import string
 from datetime import date, datetime, time
 from functools import reduce
-from typing import TYPE_CHECKING
 
 import pytz_deprecation_shim
 from django.conf import settings
@@ -62,9 +61,6 @@ from ...helpers.permission_migration import (
 from ..settings import settings_hierarkey
 from .auth import User
 
-if TYPE_CHECKING:
-    from hierarkey.proxy import HierarkeyProxy
-
 
 @settings_hierarkey.add(cache_namespace='organizer')
 class Organizer(LoggedModel):
@@ -82,9 +78,6 @@ class Organizer(LoggedModel):
     """
 
     settings_namespace = 'organizer'
-    if TYPE_CHECKING:
-        settings: HierarkeyProxy
-
     name = models.CharField(max_length=200,
                             verbose_name=_("Name"))
     slug = models.CharField(

src/pretix/base/models/vouchers.py

@@ -32,10 +32,8 @@
 # Unless required by applicable law or agreed to in writing, software distributed under the Apache License 2.0 is
 # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 # License for the specific language governing permissions and limitations under the License.
-import datetime
+
-from dataclasses import dataclass
 from decimal import ROUND_HALF_UP, Decimal
-from typing import Union
 
 from django.conf import settings
 from django.core.exceptions import ValidationError
@@ -423,33 +421,27 @@ class Voucher(LoggedModel):
         return False
 
     @staticmethod
-    def get_affected_quotas(quota, item, variation, subevent):
+    def clean_quota_get_ignored(old_instance):
-        if quota:
+        quotas = set()
-            return {quota}
+        was_valid = old_instance and (
-        elif item and variation:
+            old_instance.valid_until is None or old_instance.valid_until >= now()
-            return set(variation.quotas.filter(subevent=subevent))
+        )
-        elif item and not item.has_variations:
+        if old_instance and old_instance.block_quota and was_valid:
-            return set(item.quotas.filter(subevent=subevent))
+            if old_instance.quota:
-        elif item and item.has_variations:
+                quotas.add(old_instance.quota)
-            return set(
+            elif old_instance.variation:
-                Quota.objects.filter(
+                quotas |= set(old_instance.variation.quotas.filter(subevent=old_instance.subevent))
-                    pk__in=Quota.variations.through.objects.filter(
+            elif old_instance.item:
-                        itemvariation__item=item,
+                if old_instance.item.has_variations:
-                        quota__subevent=subevent,
+                    quotas |= set(
-                    ).values('quota_id')
+                        Quota.objects.filter(pk__in=Quota.variations.through.objects.filter(
-                )
+                            itemvariation__item=old_instance.item,
-            )
+                            quota__subevent=old_instance.subevent,
-        else:
+                        ).values('quota_id'))
-            return set()
+                    )
-
+                else:
-    @staticmethod
+                    quotas |= set(old_instance.item.quotas.filter(subevent=old_instance.subevent))
-    def clean_quota_get_ignored(voucher_data: Union["VoucherBulkData", "Voucher"]):
+        return quotas
-        if voucher_data:
-            valid = voucher_data.valid_until is None or voucher_data.valid_until >= now()
-            if valid and voucher_data.block_quota and voucher_data.max_usages > voucher_data.redeemed:
-                return Voucher.get_affected_quotas(voucher_data.quota, voucher_data.item, voucher_data.variation, voucher_data.subevent)
-
-        return set()
 
     @staticmethod
     def clean_quota_check(data, cnt, old_instance, event, quota, item, variation):
@@ -461,8 +453,22 @@ class Voucher(LoggedModel):
         if event.has_subevents and data.get('block_quota') and not data.get('subevent'):
             raise ValidationError(_('If you want this voucher to block quota, you need to select a specific date.'))
 
-        new_quotas = Voucher.get_affected_quotas(quota, item, variation, data.get('subevent'))
+        if quota:
-        if not new_quotas:
+            new_quotas = {quota}
+        elif item and variation:
+            new_quotas = set(variation.quotas.filter(subevent=data.get('subevent')))
+        elif item and not item.has_variations:
+            new_quotas = set(item.quotas.filter(subevent=data.get('subevent')))
+        elif item and item.has_variations:
+            new_quotas = set(
+                Quota.objects.filter(
+                    pk__in=Quota.variations.through.objects.filter(
+                        itemvariation__item=item,
+                        quota__subevent=data.get('subevent'),
+                    ).values('quota_id')
+                )
+            )
+        else:
             raise ValidationError(_('You need to select a specific product or quota if this voucher should reserve '
                                     'tickets.'))
 
@@ -638,16 +644,3 @@ class Voucher(LoggedModel):
             ]
         ).aggregate(s=Sum('voucher_budget_use'))['s'] or Decimal('0.00')
         return ops
-
-
-@dataclass
-class VoucherBulkData:
-    item: object
-    variation: object
-    quota: object
-    block_quota: bool
-    valid_until: datetime.datetime
-    subevent: object
-    redeemed: int
-    max_usages: int
-    allow_ignore_quota: bool

src/pretix/base/payment.py

@@ -834,7 +834,7 @@ class BasePaymentProvider:
         """
         raise NotImplementedError()  # NOQA
 
-    def execute_payment(self, request: HttpRequest, payment: OrderPayment) -> str | None:
+    def execute_payment(self, request: HttpRequest, payment: OrderPayment) -> str:
         """
         After the user has confirmed their purchase, this method will be called to complete
         the payment process. This is the place to actually move the money if applicable.
@@ -936,7 +936,7 @@ class BasePaymentProvider:
         """
         Will be called if the *event administrator* views the details of a payment.
 
-        It should return a SafeString containing HTML code, with information regarding the current payment
+        It should return HTML code containing information regarding the current payment
         status and, if applicable, next steps.
 
         The default implementation returns an empty string.
@@ -961,7 +961,7 @@ class BasePaymentProvider:
         """
         Will be called if the *event administrator* views the details of a refund.
 
-        It should return a SafeString containing HTML code, with information regarding the current refund
+        It should return HTML code containing information regarding the current refund
         status and, if applicable, next steps.
 
         The default implementation returns an empty string.

src/pretix/base/pdf.py

@@ -77,7 +77,6 @@ from reportlab.platypus import Paragraph
 
 from pretix.base.i18n import language
 from pretix.base.models import Checkin, Event, Order, OrderPosition, Question
-from pretix.base.services.placeholders import PlaceholderContext
 from pretix.base.settings import PERSON_NAME_SCHEMES
 from pretix.base.signals import layout_image_variables, layout_text_variables
 from pretix.base.templatetags.money import money_filter
@@ -402,7 +401,11 @@ DEFAULT_VARIABLES = OrderedDict((
         "editor_sample": _("Event organizer info text"),
         "evaluate": lambda op, order, ev: str(order.event.settings.organizer_info_text)
     }),
-    ("event_info_text", {}),  # Placeholder to "reserve" position, defined later in `get_variables`
+    ("event_info_text", {
+        "label": _("Event info text"),
+        "editor_sample": _("Event info text"),
+        "evaluate": lambda op, order, ev: str(order.event.settings.event_info_text)
+    }),
     ("now_date", {
         "label": _("Printing date"),
         "editor_sample": _("2017-05-31"),
@@ -667,14 +670,6 @@ def get_images(event):
 def get_variables(event):
     v = copy.copy(DEFAULT_VARIABLES)
 
-    templating_context = PlaceholderContext(event=event)
-    v['event_info_text'] = {
-        "label": _("Event info text"),
-        "editor_sample": _("Event info text"),
-        "evaluate": lambda op, order, ev:
-            templating_context.format(str(order.event.settings.event_info_text))
-    }
-
     scheme = PERSON_NAME_SCHEMES[event.settings.name_scheme]
 
     concatenation_for_salutation = scheme.get("concatenation_for_salutation", scheme["concatenation"])

src/pretix/base/services/cancelevent.py

@@ -22,7 +22,6 @@
 import logging
 from decimal import Decimal
 
-from django.conf import settings
 from django.db import transaction
 from django.db.models import Count, Exists, IntegerField, OuterRef, Q, Subquery
 from django.utils.crypto import get_random_string
@@ -378,13 +377,12 @@ def cancel_event(self, event: Event, subevent: int, auto_refund: bool,
         confirmation_code = get_random_string(8, allowed_chars="01234567890")
         mail(
             user.email,
-            subject=gettext('Confirm event cancellation and bulk refund'),
+            subject=gettext('Bulk-refund confirmation'),
             template='pretixbase/email/cancel_confirm.txt',
             context={
                 "event": str(event),
                 "amount": money_filter(refund_total, event.currency),
                 "confirmation_code": confirmation_code,
-                "instance": settings.PRETIX_INSTANCE_NAME,
             },
             locale=user.locale,
         )

src/pretix/base/services/export.py

@@ -340,13 +340,12 @@ def _run_scheduled_export(schedule, context: Union[Event, Organizer], exporter,
             if schedule.owner.is_active:
                 mail(
                     email=schedule.owner.email,
-                    subject=gettext('Scheduled export failed'),
+                    subject=gettext('Export failed'),
                     template='pretixbase/email/export_failed.txt',
                     context={
                         'configuration_url': config_url,
                         'reason': msg,
                         'soft': soft,
-                        'instance': settings.PRETIX_INSTANCE_NAME,
                     },
                     event=context if isinstance(context, Event) else None,
                     organizer=context.organizer if isinstance(context, Event) else context,

src/pretix/base/services/shredder.py

@@ -44,7 +44,7 @@ from django.conf import settings
 from django.utils.crypto import get_random_string
 from django.utils.formats import date_format
 from django.utils.timezone import now
-from django.utils.translation import gettext, gettext_lazy as _
+from django.utils.translation import gettext_lazy as _
 
 from pretix.base.i18n import language
 from pretix.base.models import CachedFile, Event, User, cachedfile_name
@@ -171,16 +171,15 @@ def shred(self, event: Event, fileid: str, confirm_code: str, user: int=None, lo
 
     if user:
         with language(user.locale):
-            event_name = str(event.name)
             mail(
                 user.email,
-                gettext('Data shredding completed for %(event)s') % {'event': event_name},
+                _('Data shredding completed'),
                 'pretixbase/email/shred_completed.txt',
                 {
                     'instance': settings.PRETIX_INSTANCE_NAME,
                     'user': user,
                     'organizer': event.organizer.name,
-                    'event': event_name,
+                    'event': str(event.name),
                     'start_time': date_format(parse(indexdata['time']).astimezone(event.timezone), 'SHORT_DATETIME_FORMAT'),
                     'shredders': ', '.join([str(s.verbose_name) for s in shredders])
                 },

src/pretix/base/settings.py

@@ -1276,7 +1276,7 @@ DEFAULTS = {
         'serializer_class': serializers.BooleanField,
         'write_permission': 'event.settings.invoicing:write',
         'form_kwargs': dict(
-            label=_("Allow updating existing invoices"),
+            label=_("Allow to update existing invoices"),
             help_text=_("By default, invoices can never again be changed once they are issued. In most countries, we "
                         "recommend to leave this option turned off and always issue a new invoice if a change needs "
                         "to be made."),
@@ -1924,6 +1924,8 @@ DEFAULTS = {
         'serializer_class': serializers.BooleanField,
         'form_kwargs': dict(
             label=_("Hide all past dates from calendar"),
+            help_text=_("This option currently only affects the calendar of this event series, not the organizer-wide "
+                        "calendar.")
         )
     },
     'allow_modifications': {
@@ -2284,17 +2286,6 @@ DEFAULTS = {
             help_text=_("We'll show this publicly to allow attendees to contact you.")
         )
     },
-    'contact_url': {
-        'default': None,
-        'type': str,
-        'serializer_class': serializers.URLField,
-        'form_class': forms.URLField,
-        'form_kwargs': dict(
-            label=_("Contact URL"),
-            help_text=_("If you set this, the footer contact link will point here instead of using the email address above. "
-                        "Please note that you still need to add a contact email address that will be shared with all emails you send.")
-        )
-    },
     'imprint_url': {
         'default': None,
         'type': str,

src/pretix/base/signals.py

@@ -535,9 +535,8 @@ EventPluginRegistry = PluginAwareRegistry  # for backwards compatibility
 event_live_issues = EventPluginSignal()
 """
 This signal is sent out to determine whether an event can be taken live. If you want to
-prevent the event from going live, return an error message to display to the user (either
+prevent the event from going live, return a string that will be displayed to the user
-as a SafeString containing HTML, or a string that will be HTML-escaped). If you don't,
+as the error message. If you don't, your receiver should return ``None``.
-your receiver should return ``None``.
 
 As with all event-plugin signals, the ``sender`` keyword argument will contain the event.
 """

src/pretix/base/templates/pretixbase/email/cancel_confirm.txt

@@ -1,14 +1,10 @@
 {% load i18n %}
-{% trans "You requested to cancel an event that involves a large bulk refund:" %}
+{% trans "You have requested us to cancel an event which includes a larger bulk-refund:" %}
 
-- {% trans "Event" %}: {{ event }}
+{% trans "Event" %}: {{ event }}
-- {% trans "Estimated refund" %}: **{{ amount }}**
 
-{% trans "To confirm, paste the following code into the cancellation form:" %}
+{% trans "Estimated refund amount" %}: **{{ amount }}**
 
-    {{ confirmation_code }}
+{% trans "Please confirm that you want to proceed by coping the following confirmation code into the cancellation form:" %}
 
-{% blocktrans with instance=instance %}Don't share this code with anyone. The {{ instance }} team will never ask you for it.{% endblocktrans %}
+**{{ confirmation_code }}**
-
-{% blocktrans with instance=instance %}Thanks,  
-The {{ instance }} Team{% endblocktrans %}

src/pretix/base/templates/pretixbase/email/export_failed.txt

@@ -1,13 +1,12 @@
 {% load i18n %}
-{% trans "Your scheduled export failed." %}
+{% trans "Your export failed." %}
 
-- {% trans "Reason" %}: {{ reason }}
+{% trans "Reason:" %} {{ reason }}
 
-{% if not soft %}{% trans "If an export fails five times in a row, we'll stop sending it." %}{% endif %}
+{% if not soft %}
+{% trans "If your export fails five times in a row, it will no longer be sent." %}
+{% endif %}
 
-{% trans "You can adjust or remove this export here:" %}
+{% trans "Configuration link:" %}
 
 {{ configuration_url }}
-
-{% blocktrans with instance=instance %}Thanks,  
-The {{ instance }} Team{% endblocktrans %}

src/pretix/base/templates/pretixbase/email/notification.html

@@ -52,13 +52,13 @@
                     <table cellpadding="20"><tr><td>
             <![endif]-->
             <div class="content">
-                {% trans "You're receiving this email based on your notification settings." %}<br>
+                {% trans "You receive these emails based on your notification settings." %}<br>
                 <a href="{{ settings_url }}">
-                    {% trans "Manage settings" %}
+                    {% trans "Click here to view and change your notification settings" %}
                 </a>
                 {% if disable_url %}<br>
                     <a href="{{ disable_url }}">
-                        {% trans "Disable all notifications" %}
+                        {% trans "Click here disable all notifications immediately." %}
                     </a>
                 {% endif %}
             </div>

src/pretix/base/templates/pretixbase/email/notification.txt

@@ -1,21 +1,19 @@
 {% load i18n %}
 {{ notification.title }}{% if notification.detail %}
 
-{{ notification.detail }}{% endif %}{% if notification.url %}
+{{ notification.detail }}
+{% endif %}{% if notification.url %}
 
-{{ notification.url }}{% endif %}{% if notification.attributes %}
+{{ notification.url }}{% endif %}{% for attr in notification.attributes %}
 
-{% for attr in notification.attributes %}- {{ attr.title }}: {{ attr.value }}
+{{ attr.title }}: {{ attr.value }}{% endfor %}{% for action in notification.actions %}
-{% endfor %}{% endif %}{% for action in notification.actions %}
 
-{{ action.label }}:
+{{ action.label }}
+    {{ action.url }}{% endfor %}
 
-{{ action.url }}{% endfor %}
+{% trans "You receive these emails based on your notification settings." %}
-
+{% trans "Click here to view and change your notification settings:" %}
----
+{{ settings_url }}
-
+{% if disable_url %}{% trans "Click here disable all notifications immediately:" %}
-{% trans "You're receiving this email based on your notification settings." %}
+{{ disable_url }}
-
-- {% trans "Manage settings" %}: {{ settings_url }}
-{% if disable_url %}- {% trans "Disable all notifications" %}: {{ disable_url }}
 {% endif %}

src/pretix/base/templates/pretixbase/email/shred_completed.txt

@@ -1,14 +1,17 @@
-{% load i18n %}{% blocktrans %}Hello,
+{% load i18n %}
+{% load i18n %}{% blocktrans with url=url|safe %}Hello,
 
-The following data shredding job has been completed:
+we hereby confirm that the following data shredding job has been completed:
 
-- Organizer: {{ organizer }}
+Organizer: {{ organizer }}
-- Event: {{ event }}
-- Data selection: {{ shredders }}
-- Start time: {{ start_time }}
 
-Any data added to the event after the start time may not have been deleted.
+Event: {{ event }}
 
-Thanks,  
+Data selection: {{ shredders }}
-The {{ instance }} Team
+
+Start time: {{ start_time }} (new data added after this time might not have been deleted)
+
+Best regards,
+
+Your {{ instance }} team
 {% endblocktrans %}

src/pretix/base/templates/pretixbase/framebreak.html

@@ -1,28 +0,0 @@
-{% extends "error.html" %}
-{% load i18n %}
-{% load eventurl %}
-{% load urlreplace %}
-{% load static %}
-
-{% block content %}
-    <h1>{% trans "Please continue in a new tab" %}</h1>
-    <p class="larger">
-        {% blocktrans trimmed %}
-            For security reasons, the following step is only possible in a new tab.
-        {% endblocktrans %}
-    </p>
-    <p class="larger">
-        {% blocktrans trimmed %}
-            If the new tab did not open automatically, please click the following button:
-        {% endblocktrans %}
-    </p>
-    <div class="text-center">
-        <a href="{{ url }}"
-           class="btn btn-primary btn-lg" target="_blank">
-            <span class="fa fa-external-link-square"></span>
-            {% trans "Continue in new tab" %}
-        </a>
-        {{ url|json_script:"framebreak-url" }}
-        <script type="text/javascript" src="{% static "pretixbase/js/framebreak.js" %}"></script>
-    </div>
-{% endblock %}

src/pretix/base/templatetags/eventsignal.py

@@ -22,7 +22,6 @@
 import importlib
 
 from django import template
-from django.utils.html import conditional_escape
 from django.utils.safestring import mark_safe
 
 from pretix.base.models import Event
@@ -45,7 +44,7 @@ def eventsignal(event: Event, signame: str, **kwargs):
     _html = []
     for receiver, response in signal.send(event, **kwargs):
         if response:
-            _html.append(conditional_escape(response))
+            _html.append(response)
     return mark_safe("".join(_html))
 
 
@@ -64,5 +63,5 @@ def signal(signame: str, request, **kwargs):
     _html = []
     for receiver, response in signal.send(request, **kwargs):
         if response:
-            _html.append(conditional_escape(response))
+            _html.append(response)
     return mark_safe("".join(_html))

src/pretix/base/templatetags/rich_text.py

@@ -42,6 +42,8 @@ from bleach import DEFAULT_CALLBACKS, html5lib_shim
 from bleach.linkifier import build_email_re
 from django import template
 from django.conf import settings
+from django.core import signing
+from django.urls import reverse
 from django.utils.functional import SimpleLazyObject
 from django.utils.html import escape
 from django.utils.http import url_has_allowed_host_and_scheme
@@ -52,7 +54,6 @@ from markdown.postprocessors import Postprocessor
 from markdown.treeprocessors import UnescapeTreeprocessor
 from tlds import tld_set
 
-from pretix.base.views.redirect import safelink
 from pretix.helpers.format import SafeFormatter, format_map
 
 register = template.Library()
@@ -157,7 +158,8 @@ def safelink_callback(attrs, new=False):
     """
     url = html.unescape(attrs.get((None, 'href'), '/'))
     if not url_has_allowed_host_and_scheme(url, allowed_hosts=None) and not url.startswith('mailto:') and not url.startswith('tel:'):
-        attrs[None, 'href'] = safelink(url)
+        signer = signing.Signer(salt='safe-redirect')
+        attrs[None, 'href'] = reverse('redirect') + '?url=' + urllib.parse.quote(signer.sign(url))
         attrs[None, 'target'] = '_blank'
         attrs[None, 'rel'] = 'noopener'
     return attrs

src/pretix/base/views/redirect.py

@@ -19,7 +19,6 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-import logging
 import urllib.parse
 
 from django.core import signing
@@ -27,8 +26,6 @@ from django.http import HttpResponseBadRequest, HttpResponseRedirect
 from django.shortcuts import render
 from django.urls import reverse
 
-logger = logging.getLogger(__name__)
-
 
 def _is_samesite_referer(request):
     referer = request.headers.get('referer')
@@ -45,16 +42,11 @@ def _is_samesite_referer(request):
 
 
 def redir_view(request):
-    framebreak = "framebreak" in request.GET
+    signer = signing.Signer(salt='safe-redirect')
-    salt = 'framebreak-safelink-url' if framebreak else 'safelink-url'
     try:
-        url = signing.Signer(salt=salt).unsign(request.GET.get('url', ''))
+        url = signer.unsign(request.GET.get('url', ''))
     except signing.BadSignature:
-        try:
+        return HttpResponseBadRequest('Invalid parameter')
-            # Backwards-compatibility for a change in 2026-06, remove after a while
-            url = signing.Signer(salt='safe-redirect').unsign(request.GET.get('url', ''))
-        except signing.BadSignature:
-            return HttpResponseBadRequest('Invalid parameter')
 
     if not _is_samesite_referer(request):
         u = urllib.parse.urlparse(url)
@@ -63,26 +55,11 @@ def redir_view(request):
             'url': url,
         })
 
-    if framebreak:
-        r = render(request, 'pretixbase/framebreak.html', {
-            'url': url,
-        })
-        r.xframe_options_exempt = True
-        return r
-
     r = HttpResponseRedirect(url)
     r['X-Robots-Tag'] = 'noindex'
     return r
 
 
-def safelink(url, framebreak=False):
+def safelink(url):
-    url = str(url)
+    signer = signing.Signer(salt='safe-redirect')
-    if not (url.startswith('https://') or url.startswith('http://') or url.startswith("/")):
+    return reverse('redirect') + '?url=' + urllib.parse.quote(signer.sign(url))
-        logger.warning('Invalid URL passed to safelink: %r', url)
-        return '#invalid-url'
-    salt = 'framebreak-safelink-url' if framebreak else 'safelink-url'
-    signer = signing.Signer(salt=salt)
-    u = reverse('redirect') + '?url=' + urllib.parse.quote(signer.sign(url))
-    if framebreak:
-        u += "&framebreak=true"
-    return u

src/pretix/celery_app.py

@@ -19,56 +19,14 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-import logging
 import os
 
-from celery import Celery, signals
+from celery import Celery
-from django.dispatch import receiver
 
 os.environ.setdefault("DJANGO_SETTINGS_MODULE", "pretix.settings")
-logger = logging.getLogger(__name__)
 
 from django.conf import settings
 
 app = Celery('pretix')
 app.config_from_object('django.conf:settings', namespace='CELERY')
 app.autodiscover_tasks(lambda: settings.INSTALLED_APPS)
-
-
-@receiver(signals.before_task_publish)
-def on_before_task_publish(sender, body, exchange, routing_key, headers, properties, declare, retry_policy, **kwargs):
-    from pretix.helpers.logs import local
-
-    trace = getattr(local, 'trace', [])
-    request_id = getattr(local, 'request_id', None)
-    if request_id:
-        trace.append(request_id)
-
-    headers["X-Pretix-Trace"] = " ".join(trace)
-
-
-@receiver(signals.task_received)
-def on_task_received(sender, request, **kwargs):
-    trace = request._request_dict.get("X-Pretix-Trace")
-    if trace:
-        logger.info(f"Task {request.id} has trace {trace}")
-
-
-@receiver(signals.task_prerun)
-def on_task_prerun(sender, task_id, task, **kwargs):
-    from pretix.helpers.logs import local
-
-    local.request_id = task_id
-    if "X-Pretix-Trace" in task.request.headers:
-        local.trace = task.request.headers["X-Pretix-Trace"].split(" ")
-    else:
-        local.trace = []
-    local.trace.append(task_id)
-
-
-@receiver(signals.task_postrun)
-def on_task_postrun(sender, task_id, task, **kwargs):
-    from pretix.helpers.logs import local
-
-    local.request_id = None
-    local.trace = []

src/pretix/control/forms/event.py

@@ -625,7 +625,6 @@ class EventSettingsForm(EventSettingsValidationMixin, FormPlaceholderMixin, Sett
         'max_items_per_order',
         'reservation_time',
         'contact_mail',
-        'contact_url',
         'show_variations_expanded',
         'hide_sold_out',
         'meta_noindex',
@@ -672,11 +671,6 @@ class EventSettingsForm(EventSettingsValidationMixin, FormPlaceholderMixin, Sett
 
     base_context = {
         'frontpage_text': ['event'],
-        'presale_has_ended_text': ['event'],
-        'voucher_explanation_text': ['event'],
-        'banner_text': ['event'],
-        'banner_text_bottom': ['event'],
-        'event_info_text': ['event'],
     }
 
     def _resolve_virtual_keys_input(self, data, prefix=''):

src/pretix/control/forms/organizer.py

@@ -604,7 +604,6 @@ class OrganizerSettingsForm(SettingsForm):
         'customer_accounts_require_login_for_order_access',
         'invoice_regenerate_allowed',
         'contact_mail',
-        'contact_url',
         'imprint_url',
         'organizer_info_text',
         'event_list_type',

src/pretix/control/forms/vouchers.py

@@ -32,20 +32,16 @@
 # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 # License for the specific language governing permissions and limitations under the License.
 
-import copy
 import csv
-from collections import Counter, namedtuple
+from collections import namedtuple
 from io import StringIO
 
 from django import forms
 from django.core.exceptions import ObjectDoesNotExist, ValidationError
 from django.core.validators import EmailValidator
-from django.db.models import Count, F, Max
 from django.db.models.functions import Upper
-from django.forms.utils import ErrorDict
 from django.urls import reverse
-from django.utils.timezone import now
+from django.utils.translation import gettext_lazy as _
-from django.utils.translation import gettext_lazy as _, pgettext_lazy
 from django_scopes.forms import SafeModelChoiceField
 
 from pretix.base.email import get_available_placeholders
@@ -54,10 +50,7 @@ from pretix.base.forms import (
 )
 from pretix.base.forms.widgets import format_placeholders_help_text
 from pretix.base.i18n import language
-from pretix.base.models import Item, ItemVariation, Quota, SubEvent, Voucher
+from pretix.base.models import Item, Voucher
-from pretix.base.models.vouchers import VoucherBulkData
-from pretix.base.services.locking import lock_objects
-from pretix.base.services.quotas import QuotaAvailability
 from pretix.control.forms import SplitDateTimeField, SplitDateTimePickerWidget
 from pretix.control.forms.widgets import Select2, Select2ItemVarQuota
 from pretix.control.signals import voucher_form_validation
@@ -112,22 +105,15 @@ class VoucherForm(I18nModelForm):
             except Item.DoesNotExist:
                 pass
         super().__init__(*args, **kwargs)
-        if not self.event and self.instance:
-            self.event = self.instance.event
 
-        self.fields['tag'].widget.attrs['data-typeahead-url'] = reverse('control:event.vouchers.tags.typeahead', kwargs={
+        if instance.event.has_subevents:
-            'event': self.event.slug,
+            self.fields['subevent'].queryset = instance.event.subevents.all()
-            'organizer': self.event.organizer.slug,
-        })
-
-        if self.event.has_subevents:
-            self.fields['subevent'].queryset = self.event.subevents.all()
             self.fields['subevent'].widget = Select2(
                 attrs={
                     'data-model-select2': 'event',
                     'data-select2-url': reverse('control:event.subevents.select2', kwargs={
-                        'event': self.event.slug,
+                        'event': instance.event.slug,
-                        'organizer': self.event.organizer.slug,
+                        'organizer': instance.event.organizer.slug,
                     }),
                 }
             )
@@ -137,19 +123,18 @@ class VoucherForm(I18nModelForm):
             del self.fields['subevent']
 
         choices = []
-        prefix = (self.prefix + '-') if self.prefix else ''
+        if 'itemvar' in initial or (self.data and 'itemvar' in self.data):
-        if 'itemvar' in initial or (self.data and prefix + 'itemvar' in self.data):
+            iv = self.data.get('itemvar') or initial.get('itemvar', '')
-            iv = self.data.get(prefix + 'itemvar', '') or initial.get('itemvar', '') or ''
             if iv.startswith('q-'):
-                q = self.event.quotas.get(pk=iv[2:])
+                q = self.instance.event.quotas.get(pk=iv[2:])
                 choices.append(('q-%d' % q.pk, _('Any product in quota "{quota}"').format(quota=q)))
             elif '-' in iv:
                 itemid, varid = iv.split('-')
-                i = self.event.items.get(pk=itemid)
+                i = self.instance.event.items.get(pk=itemid)
                 v = i.variations.get(pk=varid)
                 choices.append(('%d-%d' % (i.pk, v.pk), '%s – %s' % (str(i), v.value)))
             elif iv:
-                i = self.event.items.get(pk=iv)
+                i = self.instance.event.items.get(pk=iv)
                 if i.variations.exists():
                     choices.append((str(i.pk), _('{product} – Any variation').format(product=i)))
                 else:
@@ -160,8 +145,8 @@ class VoucherForm(I18nModelForm):
             attrs={
                 'data-model-select2': 'generic',
                 'data-select2-url': reverse('control:event.vouchers.itemselect2', kwargs={
-                    'event': self.event.slug,
+                    'event': instance.event.slug,
-                    'organizer': self.event.organizer.slug,
+                    'organizer': instance.event.organizer.slug,
                 }),
                 'data-placeholder': _('All products')
             }
@@ -169,7 +154,7 @@ class VoucherForm(I18nModelForm):
         self.fields['itemvar'].required = False
         self.fields['itemvar'].widget.choices = self.fields['itemvar'].choices
 
-        if self.event.seating_plan or self.event.subevents.filter(seating_plan__isnull=False).exists():
+        if self.instance.event.seating_plan or self.instance.event.subevents.filter(seating_plan__isnull=False).exists():
             self.fields['seat'] = forms.CharField(
                 label=_("Specific seat ID"),
                 max_length=255,
@@ -179,45 +164,40 @@ class VoucherForm(I18nModelForm):
                 help_text=str(self.instance.seat) if self.instance.seat else '',
             )
 
-    def parse_itemvar(self, data):
-        try:
-            itemid = quotaid = None
-            iv = data.get('itemvar', '')
-            if iv.startswith('q-'):
-                quotaid = iv[2:]
-            elif '-' in iv:
-                itemid, varid = iv.split('-')
-            elif iv:
-                itemid, varid = iv, None
-            else:
-                itemid, varid = None, None
-
-            if itemid:
-                item = self.event.items.get(pk=itemid)
-                if varid:
-                    variation = item.variations.get(pk=varid)
-                else:
-                    variation = None
-                quota = None
-            elif quotaid:
-                quota = self.event.quotas.get(pk=quotaid)
-                item = None
-                variation = None
-            else:
-                quota = None
-                item = None
-                variation = None
-
-            return (item, variation, quota)
-
-        except ObjectDoesNotExist:
-            raise ValidationError(_("Invalid product selected."))
-
     def clean(self):
         data = super().clean()
 
         if not self._errors:
-            self.instance.item, self.instance.variation, self.instance.quota = self.parse_itemvar(self.data)
+            try:
+                itemid = quotaid = None
+                iv = self.data.get('itemvar', '')
+                if iv.startswith('q-'):
+                    quotaid = iv[2:]
+                elif '-' in iv:
+                    itemid, varid = iv.split('-')
+                elif iv:
+                    itemid, varid = iv, None
+                else:
+                    itemid, varid = None, None
+
+                if itemid:
+                    self.instance.item = self.instance.event.items.get(pk=itemid)
+                    if varid:
+                        self.instance.variation = self.instance.item.variations.get(pk=varid)
+                    else:
+                        self.instance.variation = None
+                    self.instance.quota = None
+                elif quotaid:
+                    self.instance.quota = self.instance.event.quotas.get(pk=quotaid)
+                    self.instance.item = None
+                    self.instance.variation = None
+                else:
+                    self.instance.quota = None
+                    self.instance.item = None
+                    self.instance.variation = None
+
+            except ObjectDoesNotExist:
+                raise ValidationError(_("Invalid product selected."))
 
         if 'codes' in data:
             data['codes'] = [a.strip() for a in data.get('codes', '').strip().split("\n") if a]
@@ -229,7 +209,7 @@ class VoucherForm(I18nModelForm):
 
         try:
             Voucher.clean_item_properties(
-                data, self.event,
+                data, self.instance.event,
                 self.instance.quota, self.instance.item, self.instance.variation,
                 seats_given=data.get('seat') or data.get('seats'),
                 block_quota=data.get('block_quota')
@@ -249,7 +229,7 @@ class VoucherForm(I18nModelForm):
 
         try:
             Voucher.clean_subevent(
-                data, self.event
+                data, self.instance.event
             )
         except ValidationError as e:
             raise ValidationError({"subevent": e.message})
@@ -265,19 +245,19 @@ class VoucherForm(I18nModelForm):
         if check_quota:
             Voucher.clean_quota_check(
                 data, cnt, self.initial_instance_data,
-                self.event, self.instance.quota, self.instance.item, self.instance.variation
+                self.instance.event, self.instance.quota, self.instance.item, self.instance.variation
             )
-        Voucher.clean_voucher_code(data, self.event, self.instance.pk)
+        Voucher.clean_voucher_code(data, self.instance.event, self.instance.pk)
         if 'seat' in self.fields:
             if data.get('seat'):
                 self.instance.seat = Voucher.clean_seat_id(
-                    data, self.instance.item, self.instance.quota, self.event, self.instance.pk
+                    data, self.instance.item, self.instance.quota, self.instance.event, self.instance.pk
                 )
                 self.instance.item = self.instance.seat.product
             else:
                 self.instance.seat = None
 
-        voucher_form_validation.send(sender=self.event, form=self, data=data)
+        voucher_form_validation.send(sender=self.instance.event, form=self, data=data)
 
         return data
 
@@ -285,215 +265,6 @@ class VoucherForm(I18nModelForm):
         return super().save(commit)
 
 
-class VoucherBulkEditForm(VoucherForm):
-    def __init__(self, *args, **kwargs):
-        self.mixed_values = kwargs.pop('mixed_values')
-        self.queryset = kwargs.pop('queryset')
-        super().__init__(**kwargs)
-        del self.fields["code"]
-        self.fields.pop("seat", None)
-
-    def is_bulk_checked(self, fieldname):
-        return self.prefix + fieldname in self.data.getlist('_bulk')
-
-    def clean(self):
-        # We skip the parent class because it's not suited for bulk editing and implement custom validation here.
-        # This does not validate *everything* we validate in VoucherForm. For example, we skip validation that one does
-        # not create a voucher for an add-on product or that the seat matches the product to save on complexity.
-        # This is a UX validation only anyway, since one could first create the voucher and then make the product an
-        # add-on product. However, we need to validate everything that we don't want violated in the database.
-        data = super(VoucherForm, self).clean()
-
-        if self.is_bulk_checked("itemvar"):
-            data["item"], data["variation"], data["quota"] = self.parse_itemvar(data)
-
-        if self.is_bulk_checked("max_usages") and "max_usages" in data:
-            max_redeemed = self.queryset.aggregate(m=Max("redeemed"))["m"]
-            if data["max_usages"] < max_redeemed:
-                raise ValidationError(_(
-                    "You cannot reduce the maximum number of redemptions to %(max_usages)s, because at least one "
-                    "of the selected vouchers has already been redeemed %(max_redeemed)s times."
-                ) % {"max_usages": data["max_usages"], "max_redeemed": max_redeemed})
-
-        # Check diff on product and quota usage based on old groups of vouchers
-        if any(self.is_bulk_checked(k) for k in ("max_usages", "itemvar", "block_quota", "valid_until", "subevent")):
-            quota_diff = Counter()
-
-            current_vouchers = self.queryset.order_by().values(
-                "item", "variation", "quota", "block_quota", "valid_until", "subevent", "redeemed", "max_usages",
-                "allow_ignore_quota",
-            ).annotate(c=Count("*"))
-            item_cache = {i.pk: i for i in Item.objects.filter(pk__in=[c["item"] for c in current_vouchers])}
-            var_cache = {v.pk: v for v in ItemVariation.objects.filter(pk__in=[c["variation"] for c in current_vouchers])}
-            quota_cache = {q.pk: q for q in Quota.objects.filter(pk__in=[c["quota"] for c in current_vouchers])}
-            subevent_cache = {s.pk: s for s in SubEvent.objects.filter(pk__in=[c["subevent"] for c in current_vouchers])}
-
-            for current in current_vouchers:
-                bulk_count = current.pop('c')
-                current = VoucherBulkData(**current)
-                # Get quotas that are currently used
-                if current.item:
-                    current.item = item_cache[current.item]
-                if current.variation:
-                    current.variation = var_cache[current.variation]
-                if current.quota:
-                    current.quota = quota_cache[current.quota]
-                if current.subevent:
-                    current.subevent = subevent_cache[current.subevent]
-
-                old_quotas = Voucher.clean_quota_get_ignored(current)
-                old_amount = max(current.max_usages - current.redeemed, 0) * bulk_count
-
-                # Predict state after change
-                after_change = copy.copy(current)
-                if self.is_bulk_checked("itemvar") and "itemvar" in data:
-                    after_change.item = data["item"]
-                    after_change.variation = data["variation"]
-                    after_change.quota = data["quota"]
-                if self.is_bulk_checked("subevent") and "subevent" in data:
-                    after_change.subevent = data["subevent"]
-                if self.is_bulk_checked("max_usages") and "max_usages" in data:
-                    after_change.max_usages = data["max_usages"]
-                if self.is_bulk_checked("block_quota") and "block_quota" in data:
-                    after_change.block_quota = data["block_quota"]
-                if self.is_bulk_checked("valid_until") and "valid_until" in data:
-                    after_change.valid_until = data["valid_until"]
-                if self.is_bulk_checked("allow_ignore_quota") and "allow_ignore_quota" in data:
-                    after_change.allow_ignore_quota = data["allow_ignore_quota"]
-
-                if after_change.quota and self.event.has_subevents and not after_change.subevent:
-                    raise ValidationError(_("You cannot create a voucher that allows selection of a quota but has no date selected."))
-
-                if after_change.quota and after_change.subevent and after_change.quota.subevent_id != after_change.subevent.pk:
-                    raise ValidationError(_("The selected quota does not match the selected subevent."))
-
-                if after_change.block_quota and self.event.has_subevents and not after_change.subevent:
-                    raise ValidationError(
-                        _('If you want this voucher to block quota, you need to select a specific date.'))
-
-                if after_change.block_quota and not after_change.item and not after_change.quota:
-                    raise ValidationError(
-                        _('You need to select a specific product or quota if this voucher should reserve '
-                          'tickets.')
-                    )
-
-                if after_change.allow_ignore_quota:
-                    # todo: is this the most useful way to do this?
-                    continue
-
-                new_quotas = Voucher.clean_quota_get_ignored(after_change)
-                new_amount = max(after_change.max_usages - after_change.redeemed, 0) * bulk_count
-
-                if new_quotas != old_quotas or new_amount != old_amount:
-                    for q in old_quotas:
-                        quota_diff[q] -= old_amount
-                    for q in new_quotas:
-                        quota_diff[q] += new_amount
-
-            if any(v > 0 for q, v in quota_diff.items()):
-                lock_objects([q for q, v in quota_diff.items() if q.size is not None and v > 0], shared_lock_objects=[self.event])
-                qa = QuotaAvailability(count_waitinglist=False)
-                qa.queue(*(q for q, v in quota_diff.items() if v > 0))
-                qa.compute()
-
-                if any(qa.results[q][0] != Quota.AVAILABILITY_OK or (qa.results[q][1] is not None and qa.results[q][1] < required)
-                       for q, required in quota_diff.items() if required > 0):
-                    raise ValidationError(_(
-                        'There is no sufficient quota available to perform this change.'
-                    ))
-
-        has_seat = self.queryset.filter(seat__isnull=False).exists()
-        if has_seat:
-            if self.is_bulk_checked("max_usages"):
-                raise ValidationError(_(
-                    'Changing the maximum number of usages in bulk is not supported if any of the selected vouchers '
-                    'is assigned a seat.'
-                ))
-            if self.is_bulk_checked("subevent"):
-                raise ValidationError(pgettext_lazy(
-                    'subevent',
-                    'Changing the date in bulk is not supported if any of the selected vouchers '
-                    'is assigned a seat.'
-                ))
-            if self.is_bulk_checked("itemvar") and data["quota"]:
-                raise ValidationError(_(
-                    'Changing the product to a quota is not supported if any of the selected vouchers '
-                    'is assigned a seat.'
-                ))
-
-            if self.is_bulk_checked("valid_until"):
-                if data["valid_until"] is None or data["valid_until"] >= now():
-                    currently_not_blocked_seats = self.queryset.filter(
-                        seat__isnull=False,
-                        max_usages__gt=F("redeemed"),
-                        valid_until__lt=now(),
-                    )
-                    if self.event.has_subevents:
-                        subevents = self.event.subevents.filter(pk__in=currently_not_blocked_seats.values_list("subevent"))
-                        for se in subevents:
-                            conflicts = currently_not_blocked_seats.filter(
-                                subevent=se
-                            ).exclude(
-                                seat_id__in=se.free_seats().values("pk")
-                            )
-                            if conflicts:
-                                raise ValidationError(_(
-                                    'This change cannot be completed because not all assigned seats of the vouchers are '
-                                    'still available'
-                                ))
-                    else:
-                        conflicts = currently_not_blocked_seats.exclude(
-                            seat_id__in=self.event.free_seats().values("pk")
-                        )
-                        if conflicts:
-                            raise ValidationError(_(
-                                'This change cannot be completed because not all assigned seats of the vouchers are '
-                                'still available'
-                            ))
-
-        return data
-
-    def save(self, commit=True):
-        objs = list(self.queryset)
-        fields = set()
-
-        check_map = {
-            'price_mode': '__price',
-            'value': '__price',
-        }
-        for k in self.fields:
-            if not self.is_bulk_checked(check_map.get(k, k)):
-                continue
-
-            if k == 'itemvar':
-                fields.add("item")
-                fields.add("variation")
-                fields.add("quota")
-            else:
-                fields.add(k)
-            for obj in objs:
-                if k == 'itemvar':
-                    obj.item = self.cleaned_data["item"]
-                    obj.variation = self.cleaned_data["variation"]
-                    obj.quota = self.cleaned_data["quota"]
-                else:
-                    setattr(obj, k, self.cleaned_data[k])
-
-        fields = [f for f in fields if f != 'itemvars']
-        if fields:
-            Voucher.objects.bulk_update(objs, fields, 200)
-
-    def full_clean(self):
-        if len(self.data) == 0:
-            # form wasn't submitted
-            self._errors = ErrorDict()
-            return
-        super().full_clean()
-
-    def _post_clean(self):
-        pass  # skip model-level clean
-
-
 class VoucherBulkForm(VoucherForm):
     codes = forms.CharField(
         widget=forms.Textarea,

src/pretix/control/middleware.py

@@ -36,8 +36,7 @@ from urllib.parse import quote, urljoin, urlparse
 
 from django.conf import settings
 from django.contrib.auth import REDIRECT_FIELD_NAME, logout
-from django.contrib.auth.views import redirect_to_login
+from django.http import Http404
-from django.http import Http404, HttpResponse
 from django.shortcuts import get_object_or_404, resolve_url
 from django.template.response import TemplateResponse
 from django.urls import get_script_prefix, resolve, reverse
@@ -98,8 +97,6 @@ class PermissionMiddleware:
         super().__init__()
 
     def _login_redirect(self, request):
-        from django.contrib.auth.views import redirect_to_login
-
         # Taken from django/contrib/auth/decorators.py
         path = request.build_absolute_uri()
         # urlparse chokes on lazy objects in Python 3, force to str
@@ -112,21 +109,10 @@ class PermissionMiddleware:
         if ((not login_scheme or login_scheme == current_scheme) and
                 (not login_netloc or login_netloc == current_netloc)):
             path = request.get_full_path()
+        from django.contrib.auth.views import redirect_to_login
 
-        if request.headers.get("X-Requested-With") == "XMLHttpRequest":
+        return redirect_to_login(
-            # It's not useful to return a 302 redirect on a XMLHttpRequest request,  because
+            path, resolved_login_url, REDIRECT_FIELD_NAME)
-            # the XMLHttpRequest is unable to detect redirects.
-            return HttpResponse(
-                "Authentication required",
-                status=401,
-                headers={
-                    # Appending ?next= is handled by client, because it should be the top-level context url,
-                    # not the URL called in the background
-                    "X-Login-Url": resolved_login_url,
-                }
-            )
-
-        return redirect_to_login(path, resolved_login_url, REDIRECT_FIELD_NAME)
 
     def __call__(self, request):
         url = resolve(request.path_info)
@@ -226,17 +212,14 @@ class AuditLogMiddleware:
         if request.path.startswith(get_script_prefix() + 'control') and request.user.is_authenticated:
             if getattr(request.user, "is_hijacked", False):
                 hijack_history = request.session.get('hijack_history', False)
-                hijacker = get_object_or_404(User, pk=hijack_history[0]["user"])
+                hijacker = get_object_or_404(User, pk=hijack_history[0])
                 ss = hijacker.get_active_staff_session(request.session.get('hijacker_session'))
-                if not ss:
+                if ss:
-                    # Staff session expired or not found
+                    ss.logs.create(
-                    logout(request)
+                        url=request.path,
-                    return redirect_to_login(request.get_full_path())
+                        method=request.method,
-                ss.logs.create(
+                        impersonating=request.user
-                    url=request.path,
+                    )
-                    method=request.method,
-                    impersonating=request.user
-                )
             else:
                 ss = request.user.get_active_staff_session(request.session.session_key)
                 if ss:

src/pretix/control/signals.py

@@ -39,8 +39,7 @@ from pretix.base.signals import (
 html_page_start = GlobalSignal()
 """
 This signal allows you to put code in the beginning of the main page for every
-page in the backend. You are expected to return a SafeString containing HTML, or
+page in the backend. You are expected to return HTML.
-a string that will be HTML-escaped.
 
 The ``sender`` keyword argument will contain the request.
 """
@@ -130,7 +129,7 @@ event_dashboard_top = EventPluginSignal()
 Arguments: 'request'
 
 This signal is sent out to include custom HTML in the top part of the the event dashboard.
-Receivers should return a SafeString containing HTML, or a string that will be HTML-escaped.
+Receivers should return HTML.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 An additional keyword argument ``subevent`` *can* contain a sub-event.
@@ -173,7 +172,6 @@ Arguments: 'form'
 
 This signal allows you to add additional HTML to the form that is used for modifying vouchers.
 You receive the form object in the ``form`` keyword argument.
-Receivers should return a SafeString containing HTML, or a string that will be HTML-escaped.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 """
@@ -211,7 +209,6 @@ Arguments: 'quota'
 
 This signal allows you to append HTML to a Quota's detail view. You receive the
 quota as argument in the ``quota`` keyword argument.
-Receivers should return a SafeString containing HTML, or a string that will be HTML-escaped.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 """
@@ -222,7 +219,6 @@ Arguments: 'subevent'
 
 This signal allows you to append HTML to a SubEvent's detail view. You receive the
 subevent as argument in the ``subevent`` keyword argument.
-Receivers should return a SafeString containing HTML, or a string that will be HTML-escaped.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 """
@@ -269,8 +265,7 @@ order_info = EventPluginSignal()
 """
 Arguments: ``order``, ``request``
 
-This signal is sent out to display additional information on the order detail page.
+This signal is sent out to display additional information on the order detail page
-Receivers should return a SafeString containing HTML, or a string that will be HTML-escaped.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 Additionally, the argument ``order`` and ``request`` are available.
@@ -280,8 +275,7 @@ order_approve_info = EventPluginSignal()
 """
 Arguments: ``order``, ``request``
 
-This signal is sent out to display additional information on the order approve page.
+This signal is sent out to display additional information on the order approve page
-Receivers should return a SafeString containing HTML, or a string that will be HTML-escaped.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 Additionally, the argument ``order`` and ``request`` are available.
@@ -292,7 +286,6 @@ order_position_buttons = EventPluginSignal()
 Arguments: ``order``, ``position``, ``request``
 
 This signal is sent out to display additional buttons for a single position of an order.
-Receivers should return a SafeString containing HTML, or a string that will be HTML-escaped.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 Additionally, the argument ``order`` and ``request`` are available.
@@ -322,7 +315,6 @@ Arguments: 'request'
 
 This signal is sent out to include template snippets on the settings page of an event
 that allows generating a pretix Widget code.
-Receivers should return a SafeString containing HTML, or a string that will be HTML-escaped.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 A second keyword argument ``request`` will contain the request object.

src/pretix/control/templates/pretixcontrol/auth/login.html

@@ -56,4 +56,5 @@
     </form>
     <script type="text/plain" id="good_origin">{{ good_origin }}</script>
     <script type="text/plain" id="bad_origin_report_url">{{ bad_origin_report_url }}</script>
+    <!-- pretix-login-marker -->{# marker required for ajax calls to detect that user session is over #}
 {% endblock %}

src/pretix/control/templates/pretixcontrol/auth/login_2fa.html

@@ -3,7 +3,6 @@
 {% load i18n %}
 {% load static %}
 {% load compress %}
-{% load escapejson %}
 {% block content %}
     <form class="form-signin" action="" method="post" id="webauthn-form">
         {% csrf_token %}
@@ -31,7 +30,8 @@
     </form>
     {% if jsondata %}
         <script type="text/json" id="webauthn-login">
-            {{ jsondata|escapejson }}
+            {{ jsondata|safe }}
+
         </script>
     {% endif %}
     {% compress js %}

src/pretix/control/templates/pretixcontrol/email/confirmation_code.txt

@@ -1,13 +1,13 @@
-{% load i18n %}{% blocktrans with code=code reason=reason instance=instance %}Hello,
+{% load i18n %}{% blocktrans with url=url|safe messages=messages|safe %}Hello,
 
 {{ reason }}
 
     {{ code }}
 
-Don't share this code with anyone. The {{ instance }} team will never ask you for it.
+Please do never give this code to another person. Our support team will never ask for this code.
 
-If you didn't request this code, please contact us immediately.
+If this code was not requested by you, please contact us immediately.
 
-Thanks,  
+Best regards,
-The {{ instance }} Team
+Your {{ instance }} team
 {% endblocktrans %}

src/pretix/control/templates/pretixcontrol/email/email_setup.txt

@@ -1,15 +1,14 @@
-{% load i18n %}{% blocktrans with code=code address=address instance=instance %}Hello,
+{% load i18n %}{% blocktrans with code=code instance=instance %}Hello,
 
-Someone requested to use {{ address }} as a sender address on {{ instance }}. Once verified, emails sent from {{ instance }} can show this address as the sender.
+someone requested to use {{ address }} as a sender address on {{ instance }}.
+This will allow them to send emails that are shown to originate from this email address.
+If that was you, please enter the following confirmation code:
 
-If this was you, enter the following code in the setup form:
+{{ code }}
 
-    {{ code }}
+If this was not requested by you, you can safely ignore this email.
 
-Don't share this code with anyone unless you want to authorize them to use this address for this purpose. The {{ instance }} team will never ask you for it.
+Best regards,  
 
-If you didn't request this, you can safely ignore this email.
+Your {{ instance }} team
-
+{% endblocktrans %}
-Thanks,  
-The {{ instance }} Team
-{% endblocktrans %}

src/pretix/control/templates/pretixcontrol/email/forgot.txt

@@ -1,11 +1,9 @@
 {% load i18n %}{% blocktrans with url=url|safe %}Hello,
 
-We received a request to reset the password for your {{ instance }} account. To choose a new password, follow the link below:
+you requested a new password. Please go to the following page to reset your password:
 
 {{ url }}
 
-If you didn't request this, you can safely ignore this email — your password won't change.
+Best regards,  
-
+Your {{ instance }} team
-Thanks,  
-The {{ instance }} Team
 {% endblocktrans %}

src/pretix/control/templates/pretixcontrol/email/invitation.txt

@@ -1,16 +1,17 @@
 {% load i18n %}{% blocktrans with url=url|safe %}Hello,
 
-You've been invited to join a team on {{ instance }}, an event ticket sales platform.
+you have been invited to a team on {{ instance }}, a platform to perform event
+ticket sales.
 
-- Organizer: {{ organizer }}
+Organizer: {{ organizer }}
-- Team: {{ team }}
+Team: {{ team }}
-
-To accept, follow the link below:
 
+If you want to join that team, just click on the following link:
 {{ url }}
 
-If you don't want to join, you can safely ignore this email.
+If you do not want to join, you can safely ignore or delete this email.
 
-Thanks,  
+Best regards,  
-The {{ instance }} Team
+
+Your {{ instance }} team
 {% endblocktrans %}

src/pretix/control/templates/pretixcontrol/email/login_notice.txt

@@ -1,19 +1,13 @@
-{% load i18n %}{% blocktrans %}Hello,
+{% load i18n %}{% blocktrans with url=url|safe os=source.os_type agent=source.agent_type %}Hello,
 
-We noticed a new sign-in to your {{ instance }} account:
+a login to your {{ instance }} account from an unusual or new location was detected. The login was performed using {{ agent }} on {{ os }} from {{ country }}.
-{% endblocktrans %}
-- {% trans "Time" %}: {{ when }}
-- {% trans "Browser" %}: {{ agent }}
-- {% trans "Operating system" %}: {{ os }}
-{% if device %}- {% trans "Device" %}: {{ device }}
-{% endif %}{% if country %}- {% trans "Country" %}: {{ country }}
-{% endif %}
-{% blocktrans with url=url|safe %}If it was you, no action is needed.
 
-If you don't recognize this sign-in, please change your password immediately:
+If this was you, you can safely ignore this email.
+
+If this was not you, we recommend that you change your password in your account settings:
 
 {{ url }}
 
-Thanks,  
+Best regards,  
-The {{ instance }} Team
+Your {{ instance }} team
 {% endblocktrans %}

src/pretix/control/templates/pretixcontrol/email/security_notice.txt

@@ -1,15 +1,16 @@
 {% load i18n %}{% blocktrans with url=url|safe messages=messages|safe %}Hello,
 
-The following changes were made to your {{ instance }} account:
+this is to inform you that the account information of your {{ instance }} account has been
+changed. In particular, the following changes have been performed:
 
 {{ messages }}
 
-If you didn't make these changes, please contact the {{ instance }} support team immediately.
+If this change was not performed by you, please contact us immediately.
 
-You can review your account settings here:
+You can review and change your account settings here:
 
 {{ url }}
 
-Thanks,  
+Best regards,  
-The {{ instance }} Team
+Your {{ instance }} team
 {% endblocktrans %}

src/pretix/control/templates/pretixcontrol/event/live.html

@@ -19,7 +19,7 @@
                         </p>
                         <ul>
                             {% for issue in issues %}
-                                <li>{{ issue }}</li>
+                                <li>{{ issue|safe }}</li>
                             {% endfor %}
                         </ul>
                     </div>
@@ -42,7 +42,7 @@
                         </p>
                         <ul>
                             {% for issue in issues %}
-                                <li>{{ issue }}</li>
+                                <li>{{ issue|safe }}</li>
                             {% endfor %}
                         </ul>
                     </div>

src/pretix/control/templates/pretixcontrol/event/settings.html

@@ -30,7 +30,6 @@
                 {% bootstrap_field form.date_admission layout="control" %}
                 {% bootstrap_field form.currency layout="control" %}
                 {% bootstrap_field sform.contact_mail layout="control" %}
-                {% bootstrap_field sform.contact_url layout="control" %}
                 {% bootstrap_field sform.imprint_url layout="control" %}
                 {% bootstrap_field form.is_public layout="control" %}
                 {% bootstrap_field form.all_sales_channels layout="control" %}

src/pretix/control/templates/pretixcontrol/order/cancel.html

@@ -2,7 +2,6 @@
 {% load i18n %}
 {% load bootstrap3 %}
 {% load money %}
-{% load wrap_in %}
 {% block title %}
     {% trans "Cancel order" %}
 {% endblock %}
@@ -27,7 +26,7 @@
         {% if form.cancellation_fee %}
             {% if fee %}
                 {% with fee|money:request.event.currency as f %}
-                    <p>{% blocktrans trimmed with fee=f|wrap_in:"strong" %}
+                    <p>{% blocktrans trimmed with fee="<strong>"|add:f|add:"</strong>"|safe %}
                         The configured cancellation fee for a self-service cancellation would be {{ fee }} for this
                         order, but for a cancellation performed by you, you need to set the cancellation fee here:
                     {% endblocktrans %}</p>

src/pretix/control/templates/pretixcontrol/order/index.html

@@ -903,7 +903,7 @@
                                             <tr>
                                                 <td colspan="1"></td>
                                                 <td colspan="5">
-                                                    {{ p.html_info }}
+                                                    {{ p.html_info|safe }}
                                                     {% if staff_session %}
                                                         <p>
                                                             <a href="" class="btn btn-default btn-xs admin-only" data-expandpayment data-id="{{ p.pk }}">
@@ -1018,7 +1018,7 @@
                                                             </dl>
                                                         {% endif %}
                                                         {% if r.html_info %}
-                                                            {{ r.html_info }}
+                                                            {{ r.html_info|safe }}
                                                         {% endif %}
                                                         {% if staff_session %}
                                                             <p>

src/pretix/control/templates/pretixcontrol/organizers/device_connect.html

@@ -2,7 +2,6 @@
 {% load i18n %}
 {% load static %}
 {% load bootstrap3 %}
-{% load escapejson %}
 {% block inner %}
     <h1>{% trans "Connect to device:" %} {{ device.name }}</h1>
 
@@ -19,7 +18,7 @@
                 {% trans "Open the app that you want to connect and optionally reset it to the original state." %}
             </li>
             <li>{% trans "Scan the following configuration code:" %}<br><br>
-                <script type="application/json" data-replace-with-qr>{{ qrdata|escapejson_dumps }}</script><br>
+                <script type="text/json" data-replace-with-qr>{{ qrdata|safe }}</script><br>
                 {% trans "If your app/device does not support scanning a QR code, you can also enter the following information:" %}
                 <br>
                 <strong>{% trans "System URL:" %}</strong> <code id="system_url">{{ settings.SITE_URL }}</code>

src/pretix/control/templates/pretixcontrol/organizers/edit.html

@@ -34,7 +34,6 @@
                         {% endif %}
                         {% bootstrap_field sform.imprint_url layout="control" %}
                         {% bootstrap_field sform.contact_mail layout="control" %}
-                        {% bootstrap_field sform.contact_url layout="control" %}
                         {% bootstrap_field sform.organizer_info_text layout="control" %}
                         {% bootstrap_field sform.event_team_provisioning layout="control" %}
                         {% if sform.allowed_restricted_plugins %}

src/pretix/control/templates/pretixcontrol/user/2fa_confirm_totp.html

@@ -1,7 +1,6 @@
 {% extends "pretixcontrol/base.html" %}
 {% load i18n %}
 {% load bootstrap3 %}
-{% load escapejson %}
 {% block title %}{% trans "Add a two-factor authentication device" %}{% endblock %}
 {% block content %}
     <h1>{% trans "Add a two-factor authentication device" %}</h1>
@@ -33,7 +32,7 @@
         </li>
         <li>
             {% trans "Add a new account to the app by scanning the following barcode:" %}
-            <script type="application/json" data-replace-with-qr>{{ qrdata|escapejson_dumps }}</script>
+            <div class="qrcode-canvas" data-qrdata="#qrdata"></div>
             <p>
                 <a data-toggle="collapse" href="#no_scan">
                     {% trans "Can't scan the barcode?" %}
@@ -82,4 +81,9 @@
         </li>
     </ol>
 
+    <script type="text/json" id="qrdata">
+        {{ qrdata|safe }}
+
+
+    </script>
 {% endblock %}

src/pretix/control/templates/pretixcontrol/user/2fa_confirm_webauthn.html

@@ -3,7 +3,6 @@
 {% load bootstrap3 %}
 {% load static %}
 {% load compress %}
-{% load escapejson %}
 {% block title %}{% trans "Add a two-factor authentication device" %}{% endblock %}
 {% block content %}
     <h1>{% trans "Add a two-factor authentication device" %}</h1>
@@ -27,7 +26,9 @@
         {% trans "Device registration failed." %}
     </div>
     <script type="text/json" id="webauthn-enroll">
-        {{ jsondata|escapejson }}
+        {{ jsondata|safe }}
+
+
     </script>
     {% compress js %}
         <script type="text/javascript" src="{% static "pretixcontrol/js/base64js.js" %}"></script>

src/pretix/control/templates/pretixcontrol/user/reauth.html

@@ -3,7 +3,6 @@
 {% load bootstrap3 %}
 {% load compress %}
 {% load static %}
-{% load escapejson %}
 {% block content %}
     <form class="form-signin" id="webauthn-form" action="" method="post">
         {% csrf_token %}
@@ -44,7 +43,7 @@
 
         {% if jsondata %}
             <script type="text/json" id="webauthn-login">
-                {{ jsondata|escapejson }}
+            {{ jsondata|safe }}
             </script>
         {% endif %}
         {% compress js %}

src/pretix/control/templates/pretixcontrol/vouchers/bulk_edit.html

@@ -1,83 +0,0 @@
-{% extends "pretixcontrol/items/base.html" %}
-{% load i18n %}
-{% load bootstrap3 %}
-{% load eventsignal %}
-{% load eventurl %}
-{% block title %}{% trans "Change multiple vouchers" %}{% endblock %}
-{% block inside %}
-    <h1>
-        {% trans "Change multiple vouchers" %}
-        <small>
-            {% blocktrans trimmed with number=vouchers.count %}
-                {{ number }} selected
-            {% endblocktrans %}
-        </small>
-    </h1>
-    <form action="" method="post" class="form-horizontal">
-        {% csrf_token %}
-        <div class="hidden">
-            {% for v in vouchers %}
-                <input type="hidden" name="voucher" value="{{ v.pk }}">
-            {% endfor %}
-        </div>
-        {% bootstrap_form_errors form %}
-            <fieldset>
-                <legend>{% trans "Voucher details" %}</legend>
-                {% bootstrap_field form.max_usages layout="bulkedit" %}
-                {% bootstrap_field form.valid_until layout="bulkedit" %}
-                {% bootstrap_field form.itemvar layout="bulkedit" %}
-
-                <div class="bulk-edit-field-group">
-                    <label class="field-toggle">
-                        <input type="checkbox" name="_bulk" value="{{ form.prefix }}__price" {% if form.prefix|add:"__price" in bulk_selected %}checked{% endif %}>
-                        {% trans "change" context "form_bulk" %}
-                    </label>
-                    <div class="field-content">
-                        <div class="form-group">
-                            <label class="col-md-3 control-label" for="id_tag">{% trans "Price effect" %}</label>
-                            <div class="col-md-5">
-                                {% bootstrap_field form.price_mode show_label=False form_group_class="" %}
-                            </div>
-                            <div class="col-md-4">
-                                {% bootstrap_field form.value show_label=False form_group_class="" %}
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="form-group">
-                    <div class="col-md-9 col-md-offset-3">
-                        <div class="controls">
-                            <div class="alert alert-info">
-                                {% blocktrans trimmed %}
-                                    If you choose "any product" for a specific quota and choose to reserve quota for this
-                                    voucher above, the product can still be unavailable to the voucher holder if another quota
-                                    associated with the product is sold out!
-                                {% endblocktrans %}
-                            </div>
-                        </div>
-                    </div>
-                </div>
-                {% if form.subevent %}
-                    {% bootstrap_field form.subevent layout="bulkedit" %}
-                {% endif %}
-            </fieldset>
-            <fieldset>
-                <legend>{% trans "Advanced settings" %}</legend>
-                {% bootstrap_field form.block_quota layout="bulkedit" %}
-                {% bootstrap_field form.allow_ignore_quota layout="bulkedit" %}
-                {% bootstrap_field form.min_usages layout="bulkedit" %}
-                {% bootstrap_field form.budget addon_after=request.event.currency layout="bulkedit" %}
-                {% bootstrap_field form.tag layout="bulkedit" %}
-                {% bootstrap_field form.comment layout="bulkedit" %}
-                {% bootstrap_field form.show_hidden_items layout="bulkedit" %}
-                {% bootstrap_field form.all_addons_included layout="bulkedit" %}
-                {% bootstrap_field form.all_bundles_included layout="bulkedit" %}
-            </fieldset>
-            <div class="form-group submit-group">
-                <button type="submit" class="btn btn-primary btn-save">
-                    {% trans "Save" %}
-                </button>
-            </div>
-    </form>
-{% endblock %}

src/pretix/control/templates/pretixcontrol/vouchers/index.html

@@ -99,9 +99,6 @@
         </p>
         <form action="{% url "control:event.vouchers.bulkaction"  organizer=request.event.organizer.slug event=request.event.slug %}" method="post">
             {% csrf_token %}
-            {% for field in filter_form %}
-                {{ field.as_hidden }}
-            {% endfor %}
             <div class="table-responsive">
                 <table class="table table-hover table-quotas">
                     <thead>
@@ -147,18 +144,6 @@
                         {% endif %}
                         <th></th>
                     </tr>
-                    {% if "event.vouchers:write" in request.eventpermset and page_obj.paginator.num_pages > 1 %}
-                        <tr class="table-select-all warning hidden">
-                            <td>
-                                <input type="checkbox" name="__ALL" id="__all" data-results-total="{{ page_obj.paginator.count }}">
-                            </td>
-                            <td colspan="5">
-                                <label for="__all">
-                                    {% trans "Select all results on other pages as well" %}
-                                </label>
-                            </td>
-                        </tr>
-                    {% endif %}
                     </thead>
                     <tbody>
                     {% for v in vouchers %}
@@ -226,10 +211,6 @@
                         <i class="fa fa-trash" aria-hidden="true"></i>
                         {% trans "Delete selected" %}
                     </button>
-                    <button type="submit" class="btn btn-primary btn-save" name="action" value="edit"
-                            formaction="{% url "control:event.vouchers.bulkedit"  organizer=request.event.organizer.slug event=request.event.slug %}">
-                        <i class="fa fa-edit"></i>{% trans "Edit selected" %}
-                    </button>
                 </div>
             {% endif %}
         </form>

src/pretix/control/templates/pretixcontrol/vouchers/tags.html

@@ -49,11 +49,11 @@
                         <td>
                             <strong>
                             {% if t.tag %}
-                                <a href="{% url "control:event.vouchers" organizer=request.event.organizer.slug event=request.event.slug %}?filter-tag={{ '"'|add:t.tag|add:'"'|urlencode }}">
+                                <a href="{% url "control:event.vouchers" organizer=request.event.organizer.slug event=request.event.slug %}?tag={{ '"'|add:t.tag|add:'"'|urlencode }}">
                                     {{ t.tag }}
                                 </a>
                             {% else %}
-                                <a href="{% url "control:event.vouchers" organizer=request.event.organizer.slug event=request.event.slug %}?filter-tag={{ '<>'|urlencode }}">
+                                <a href="{% url "control:event.vouchers" organizer=request.event.organizer.slug event=request.event.slug %}?tag={{ '<>'|urlencode }}">
                                     {% trans "Empty tag" %}
                                 </a>
                             {% endif %}

src/pretix/control/urls.py

@@ -370,7 +370,6 @@ urlpatterns = [
         re_path(r'^discounts/add$', discounts.DiscountCreate.as_view(), name='event.items.discounts.add'),
         re_path(r'^vouchers/$', vouchers.VoucherList.as_view(), name='event.vouchers'),
         re_path(r'^vouchers/tags/$', vouchers.VoucherTags.as_view(), name='event.vouchers.tags'),
-        re_path(r'^vouchers/tags/typeahead$', typeahead.voucher_tag_typeahead, name='event.vouchers.tags.typeahead'),
         re_path(r'^vouchers/rng$', vouchers.VoucherRNG.as_view(), name='event.vouchers.rng'),
         re_path(r'^vouchers/item_select$', typeahead.itemvarquota_select2, name='event.vouchers.itemselect2'),
         re_path(r'^vouchers/(?P<voucher>\d+)/$', vouchers.VoucherUpdate.as_view(), name='event.voucher'),
@@ -383,7 +382,6 @@ urlpatterns = [
         re_path(r'^vouchers/bulk_add$', vouchers.VoucherBulkCreate.as_view(), name='event.vouchers.bulk'),
         re_path(r'^vouchers/bulk_add/mail_preview$', vouchers.VoucherBulkMailPreview.as_view(), name='event.vouchers.bulk.mail_preview'),
         re_path(r'^vouchers/bulk_action$', vouchers.VoucherBulkAction.as_view(), name='event.vouchers.bulkaction'),
-        re_path(r'^vouchers/bulk_edit$', vouchers.VoucherBulkUpdateView.as_view(), name='event.vouchers.bulkedit'),
         re_path(r'^vouchers/import/$', modelimport.VoucherImportView.as_view(), name='event.vouchers.import'),
         re_path(r'^vouchers/import/(?P<file>[^/]+)/$', modelimport.VoucherProcessView.as_view(), name='event.vouchers.import.process'),
         re_path(r'^orders/(?P<code>[0-9A-Z]+)/transition$', orders.OrderTransition.as_view(),

src/pretix/control/views/event.py

@@ -1428,16 +1428,11 @@ class TaxUpdate(EventSettingsViewMixin, EventPermissionRequiredMixin, UpdateView
         form.instance.custom_rules = json.dumps([
             f.cleaned_data for f in self.formset.ordered_forms if f not in self.formset.deleted_forms
         ], cls=I18nJSONEncoder)
-        if form.has_changed() or self.formset.has_changed():
+        if form.has_changed():
-            change_data = {
-                k: form.cleaned_data.get(k) for k in form.changed_data
-            }
-            if self.formset.has_changed():
-                change_data["custom_rules"] = [
-                    f.cleaned_data for f in self.formset.ordered_forms if f not in self.formset.deleted_forms
-                ]
             self.object.log_action(
-                'pretix.event.taxrule.changed', user=self.request.user, data=change_data
+                'pretix.event.taxrule.changed', user=self.request.user, data={
+                    k: form.cleaned_data.get(k) for k in form.changed_data
+                }
             )
         return super().form_valid(form)
 

src/pretix/control/views/mailsetup.py

@@ -28,7 +28,7 @@ from django.core.mail import get_connection
 from django.shortcuts import redirect
 from django.utils.crypto import get_random_string
 from django.utils.functional import cached_property
-from django.utils.translation import gettext, gettext_lazy as _
+from django.utils.translation import gettext_lazy as _
 from django.views.generic import TemplateView
 
 from pretix.base import email
@@ -216,14 +216,13 @@ class MailSettingsSetupView(TemplateView):
                     messages.error(request, _('The verification code was incorrect, please try again.'))
                 else:
                     self.request.session[session_key] = get_random_string(length=6, allowed_chars='1234567890')
-                    sender_address = self.simple_form.cleaned_data.get('mail_from')
                     mail(
-                        sender_address,
+                        self.simple_form.cleaned_data.get('mail_from'),
-                        gettext('Confirm %(address)s as a sender address') % {'address': sender_address},
+                        _('Sender address verification'),
                         'pretixcontrol/email/email_setup.txt',
                         {
                             'code': self.request.session[session_key],
-                            'address': sender_address,
+                            'address': self.simple_form.cleaned_data.get('mail_from'),
                             'instance': settings.PRETIX_INSTANCE_NAME,
                         },
                         None,

src/pretix/control/views/orders.py

@@ -551,10 +551,10 @@ class OrderDetail(OrderView):
         ctx['refunds'] = self.order.refunds.select_related('payment').order_by('-created')
         for p in ctx['payments']:
             if p.payment_provider:
-                p.html_info = p.payment_provider.payment_control_render(self.request, p) or ""
+                p.html_info = (p.payment_provider.payment_control_render(self.request, p) or "").strip()
         for r in ctx['refunds']:
             if r.payment_provider:
-                r.html_info = r.payment_provider.refund_control_render(self.request, r) or ""
+                r.html_info = (r.payment_provider.refund_control_render(self.request, r) or "").strip()
         ctx['invoices'] = list(self.order.invoices.all().select_related('event'))
         ctx['comment_form'] = CommentForm(initial={
             'comment': self.order.comment,

src/pretix/control/views/organizer.py

@@ -1032,9 +1032,7 @@ class TeamMemberView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin,
     def _send_invite(self, instance):
         mail(
             instance.email,
-            gettext('You\'ve been invited to join %(organizer)s') % {
+            _('Account invitation'),
-                'organizer': self.request.organizer.name,
-            },
             'pretixcontrol/email/invitation.txt',
             {
                 'instance': settings.PRETIX_INSTANCE_NAME,

src/pretix/control/views/typeahead.py

@@ -975,21 +975,6 @@ def subevent_meta_values(request, organizer, event):
     })
 
 
-@event_permission_required('event.vouchers:read')
-def voucher_tag_typeahead(request, **kwargs):
-    q = request.GET.get('q', '')
-    tags = request.event.vouchers.filter(
-        tag__isnull=False,
-        waitinglistentries__isnull=True,
-    ).filter(
-        tag__icontains=q,
-    ).values_list('tag', flat=True).distinct().order_by('tag')[:10]
-
-    return JsonResponse({
-        'results': [{'name': t} for t in tags]
-    })
-
-
 def item_meta_values(request, organizer, event):
     q = request.GET.get('q')
     propname = request.GET.get('property')

src/pretix/control/views/users.py

@@ -19,23 +19,19 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-import hmac
 import json
 from contextlib import contextmanager
 
 from django.conf import settings
 from django.contrib import messages
 from django.contrib.auth import (
-    BACKEND_SESSION_KEY, HASH_SESSION_KEY, get_user_model, load_backend, login,
+    BACKEND_SESSION_KEY, get_user_model, load_backend, login,
-    logout,
 )
 from django.contrib.auth.mixins import LoginRequiredMixin
-from django.contrib.auth.views import redirect_to_login
-from django.core.exceptions import PermissionDenied
 from django.db import transaction
 from django.shortcuts import get_object_or_404, redirect
 from django.urls import reverse
-from django.utils.crypto import get_random_string, salted_hmac
+from django.utils.crypto import get_random_string
 from django.utils.functional import cached_property
 from django.utils.translation import gettext_lazy as _
 from django.views import View
@@ -222,13 +218,11 @@ class UserImpersonateView(AdministratorPermissionRequiredMixin, RecentAuthentica
 
     def post(self, request, *args, **kwargs):
         self.object = get_object_or_404(User, pk=self.kwargs.get("id"))
-        staff_session = request.user.get_active_staff_session(request.session.session_key)
         self.request.user.log_action('pretix.control.auth.user.impersonated',
                                      user=request.user,
                                      data={
                                          'other': self.kwargs.get("id"),
-                                         'other_email': self.object.email,
+                                         'other_email': self.object.email
-                                         'staff_session': staff_session.pk,
                                      })
         oldkey = request.session.session_key
 
@@ -236,15 +230,7 @@ class UserImpersonateView(AdministratorPermissionRequiredMixin, RecentAuthentica
         hijacked = self.object
 
         hijack_history = request.session.get("hijack_history", [])
-        hijack_history.append({
+        hijack_history.append(request.user._meta.pk.value_to_string(hijacker))
-            "user": request.user.pk,
-            # We include the auth_hash, because it is unguessable. So should an attacker gain an attack vector to
-            # modify hijack_history, they can't just insert or change a user that shouldn't be there. We HMAC it
-            # again, though, since we also do not want the auth_hash of the admin user to be in the session of an
-            # unprivileged user to contain the risk if there is some leak of session data.
-            "auth_hash": salted_hmac(key_salt=b"hijack-history-hash", value=request.session[HASH_SESSION_KEY],
-                                     algorithm="sha256", secret=settings.SECRET_KEY).hexdigest(),
-        })
 
         backend = get_used_backend(request)
         backend = f"{backend.__module__}.{backend.__class__.__name__}"
@@ -252,12 +238,6 @@ class UserImpersonateView(AdministratorPermissionRequiredMixin, RecentAuthentica
         with signals.no_update_last_login(), keep_session_age(request.session):
             login(request, hijacked, backend=backend)
 
-        request.session.save()
-        staff_session.logs.create(
-            method='(NOTE)',
-            url=f'Begin impersonating user #{hijacked.pk} (request session {oldkey[:8]} -> {request.session.session_key[:8]})',
-        )
-
         request.session["hijack_history"] = hijack_history
 
         signals.hijack_started.send(
@@ -274,28 +254,13 @@ class UserImpersonateView(AdministratorPermissionRequiredMixin, RecentAuthentica
 class UserImpersonateStopView(LoginRequiredMixin, View):
 
     def post(self, request, *args, **kwargs):
-        staff_session_key = request.session['hijacker_session']
+        impersonated = request.user
-        prev_session_key = request.session.session_key
+
+        hijs = request.session['hijacker_session']
         hijack_history = request.session.get("hijack_history", [])
         hijacked = request.user
-        prev_session = hijack_history.pop()
+        user_pk = hijack_history.pop()
-        hijacker = get_object_or_404(get_user_model(), pk=prev_session["user"])
+        hijacker = get_object_or_404(get_user_model(), pk=user_pk)
-        staff_session = hijacker.get_active_staff_session(staff_session_key)
-        if not staff_session:
-            raise PermissionDenied
-
-        expected_hash = salted_hmac(
-            key_salt=b"hijack-history-hash",
-            value=hijacker.get_session_auth_hash(),
-            algorithm="sha256",
-            secret=settings.SECRET_KEY
-        ).hexdigest()
-        if not hmac.compare_digest(expected_hash, prev_session["auth_hash"]):
-            # Could be an attacker-controlled hijack history, but could also be e.g. a password change of the admin user
-            # that happened during the hijack session
-            logout(request)
-            return redirect_to_login(request.get_full_path())
-
         backend = get_used_backend(request)
         backend = f"{backend.__module__}.{backend.__class__.__name__}"
         with signals.no_update_last_login(), keep_session_age(request.session):
@@ -310,22 +275,17 @@ class UserImpersonateStopView(LoginRequiredMixin, View):
             hijacked=hijacked,
         )
 
-        request.session.save()
+        ss = request.user.get_active_staff_session(hijs)
-        staff_session.session_key = request.session.session_key
+        if ss:
-        staff_session.save()
+            request.session.save()
-
+            ss.session_key = request.session.session_key
-        staff_session.logs.create(
+            ss.save()
-            method='(NOTE)',
-            url=f'Stop impersonating user #{hijacked.pk} (request session {prev_session_key[:8]}, '
-                f'staff session {staff_session_key[:8]} -> {request.session.session_key[:8]})',
-        )
 
         request.user.log_action('pretix.control.auth.user.impersonate_stopped',
                                 user=request.user,
                                 data={
-                                    'other': hijacked.pk,
+                                    'other': impersonated.pk,
-                                    'other_email': hijacked.email,
+                                    'other_email': impersonated.email
-                                    'staff_session': staff_session.pk,
                                 })
         return redirect(reverse('control:index'))
 

src/pretix/control/views/vouchers.py

@@ -40,11 +40,9 @@ import bleach
 from defusedcsv import csv
 from django.conf import settings
 from django.contrib import messages
-from django.core.exceptions import (
+from django.core.exceptions import PermissionDenied, ValidationError
-    BadRequest, PermissionDenied, ValidationError,
-)
 from django.db import connection, transaction
-from django.db.models import Count, Exists, OuterRef, Sum
+from django.db.models import Exists, OuterRef, Sum
 from django.http import (
     Http404, HttpResponse, HttpResponseBadRequest, HttpResponseRedirect,
     JsonResponse,
@@ -57,7 +55,7 @@ from django.utils.safestring import mark_safe
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 from django.views.generic import (
-    CreateView, FormView, ListView, TemplateView, UpdateView, View,
+    CreateView, ListView, TemplateView, UpdateView, View,
 )
 from django_scopes import scopes_disabled
 
@@ -72,9 +70,7 @@ from pretix.base.services.vouchers import vouchers_send
 from pretix.base.templatetags.rich_text import markdown_compile_email
 from pretix.base.views.tasks import AsyncFormView
 from pretix.control.forms.filter import VoucherFilterForm, VoucherTagFilterForm
-from pretix.control.forms.vouchers import (
+from pretix.control.forms.vouchers import VoucherBulkForm, VoucherForm
-    VoucherBulkEditForm, VoucherBulkForm, VoucherForm,
-)
 from pretix.control.permissions import EventPermissionRequiredMixin
 from pretix.control.signals import voucher_form_class
 from pretix.control.views import PaginationMixin
@@ -84,37 +80,7 @@ from pretix.helpers.models import modelcopy
 from pretix.multidomain.urlreverse import eventreverse_absolute
 
 
-class VoucherQueryMixin:
+class VoucherList(PaginationMixin, EventPermissionRequiredMixin, ListView):
-
-    @cached_property
-    def request_data(self):
-        if self.request.method == "POST":
-            return self.request.POST
-        return self.request.GET
-
-    @scopes_disabled()  # we have an event check here, and we can save some performance on subqueries
-    def get_queryset(self):
-        qs = self.request.event.vouchers.exclude(
-            Exists(WaitingListEntry.objects.filter(voucher_id=OuterRef('pk')))
-        )
-        if 'voucher' in self.request_data and '__ALL' not in self.request_data:
-            qs = qs.filter(
-                id__in=self.request_data.getlist('voucher')
-            )
-        elif self.request.method == 'GET' or '__ALL' in self.request_data:
-            if self.filter_form.is_valid():
-                qs = self.filter_form.filter_qs(qs)
-        else:
-            raise BadRequest("No vouchers selected")
-
-        return qs
-
-    @cached_property
-    def filter_form(self):
-        return VoucherFilterForm(data=self.request_data, prefix='filter', event=self.request.event)
-
-
-class VoucherList(VoucherQueryMixin, PaginationMixin, EventPermissionRequiredMixin, ListView):
     model = Voucher
     context_object_name = 'vouchers'
     template_name = 'pretixcontrol/vouchers/index.html'
@@ -122,15 +88,25 @@ class VoucherList(VoucherQueryMixin, PaginationMixin, EventPermissionRequiredMix
 
     @scopes_disabled()  # we have an event check here, and we can save some performance on subqueries
     def get_queryset(self):
-        return Voucher.annotate_budget_used(super().get_queryset().select_related(
+        qs = Voucher.annotate_budget_used(self.request.event.vouchers.exclude(
+            Exists(WaitingListEntry.objects.filter(voucher_id=OuterRef('pk')))
+        ).select_related(
             'item', 'variation', 'seat'
         ))
+        if self.filter_form.is_valid():
+            qs = self.filter_form.filter_qs(qs)
+
+        return qs
 
     def get_context_data(self, **kwargs):
         ctx = super().get_context_data(**kwargs)
         ctx['filter_form'] = self.filter_form
         return ctx
 
+    @cached_property
+    def filter_form(self):
+        return VoucherFilterForm(data=self.request.GET, event=self.request.event)
+
     def get(self, request, *args, **kwargs):
         if request.GET.get("download", "") == "yes":
             return self._download_csv()
@@ -317,12 +293,6 @@ class VoucherUpdate(EventPermissionRequiredMixin, UpdateView):
                 f.disabled = True
         return form
 
-    def get_form_kwargs(self):
-        return {
-            **super().get_form_kwargs(),
-            "event": self.request.event,
-        }
-
     def get_object(self, queryset=None) -> VoucherForm:
         url = resolve(self.request.path_info)
         try:
@@ -633,21 +603,26 @@ class VoucherRNG(EventPermissionRequiredMixin, View):
         })
 
 
-class VoucherBulkAction(VoucherQueryMixin, EventPermissionRequiredMixin, View):
+class VoucherBulkAction(EventPermissionRequiredMixin, View):
     permission = 'event.vouchers:write'
 
+    @cached_property
+    def objects(self):
+        return self.request.event.vouchers.filter(
+            id__in=self.request.POST.getlist('voucher')
+        )
+
     @transaction.atomic
     def post(self, request, *args, **kwargs):
         if request.POST.get('action') == 'delete':
             return render(request, 'pretixcontrol/vouchers/delete_bulk.html', {
-                'allowed': self.get_queryset().filter(redeemed=0),
+                'allowed': self.objects.filter(redeemed=0),
-                'forbidden': self.get_queryset().exclude(redeemed=0),
+                'forbidden': self.objects.exclude(redeemed=0),
             })
         elif request.POST.get('action') == 'delete_confirm':
             log_entries = []
             to_delete = []
-            to_update = []
+            for obj in self.objects:
-            for obj in self.get_queryset():
                 if obj.allow_delete():
                     log_entries.append(obj.log_action('pretix.voucher.deleted', user=self.request.user, save=False))
                     to_delete.append(obj.pk)
@@ -657,14 +632,12 @@ class VoucherBulkAction(VoucherQueryMixin, EventPermissionRequiredMixin, View):
                         'bulk': True
                     }, save=False))
                     obj.max_usages = min(obj.redeemed, obj.max_usages)
-                    to_update.append(obj)
+                    obj.save(update_fields=['max_usages'])
 
             if to_delete:
                 CartPosition.objects.filter(addon_to__voucher_id__in=to_delete).delete()
                 CartPosition.objects.filter(voucher_id__in=to_delete).delete()
                 Voucher.objects.filter(pk__in=to_delete).delete()
-            if to_update:
-                Voucher.objects.bulk_update(to_update, ['max_usages'])
 
             LogEntry.bulk_create_and_postprocess(log_entries)
             messages.success(request, _('The selected vouchers have been deleted or disabled.'))
@@ -675,117 +648,3 @@ class VoucherBulkAction(VoucherQueryMixin, EventPermissionRequiredMixin, View):
             'organizer': self.request.event.organizer.slug,
             'event': self.request.event.slug,
         })
-
-
-class VoucherBulkUpdateView(VoucherQueryMixin, EventPermissionRequiredMixin, FormView):
-    template_name = 'pretixcontrol/vouchers/bulk_edit.html'
-    permission = 'event.vouchers:write'
-    context_object_name = 'vouchers'
-    form_class = VoucherBulkEditForm
-
-    def get_queryset(self):
-        return super().get_queryset().prefetch_related(None).order_by()
-
-    def get(self, request, *args, **kwargs):
-        return HttpResponse(status=405)
-
-    @cached_property
-    def is_submitted(self):
-        # Usually, django considers a form "bound" / "submitted" on every POST request. However, this view is always
-        # called with POST method, even if just to pass the selection of objects to work on, so we want to modify
-        # that behavior
-        return '_bulk' in self.request.POST
-
-    def get_form_kwargs(self):
-        initial = {}
-        mixed_values = set()
-        qs = self.get_queryset().annotate()
-
-        fields = (
-            'valid_until', 'block_quota', 'allow_ignore_quota', 'value', 'tag', 'comment', 'max_usages',
-            'min_usages', 'price_mode', 'subevent', 'show_hidden_items', 'all_addons_included', 'all_bundles_included',
-            'budget',
-        )
-        for f in fields:
-            existing_values = list(qs.order_by(f).values(f).annotate(c=Count('*')))
-            if len(existing_values) == 1:
-                initial[f] = existing_values[0][f]
-            elif len(existing_values) > 1:
-                mixed_values.add(f)
-                if f == "max_usages":
-                    initial[f] = 1
-                else:
-                    initial[f] = None
-
-        existing_values = list(qs.order_by("item", "variation", "quota").values("item", "variation", "quota").annotate(c=Count('*')))
-        if len(existing_values) == 1:
-            i = existing_values[0]
-            if i["quota"]:
-                initial["itemvar"] = f'q-{i["quota"]}'
-            elif i["variation"]:
-                initial["itemvar"] = f'{i["item"]}-{i["variation"]}'
-            elif i["item"]:
-                initial["itemvar"] = f'{i["item"]}'
-            else:
-                initial["itemvar"] = None
-        elif len(existing_values) > 1:
-            mixed_values.add("itemvar")
-            initial["itemvar"] = None
-
-        kwargs = super().get_form_kwargs()
-        kwargs['event'] = self.request.event
-        kwargs['prefix'] = 'bulkedit'
-        kwargs['initial'] = initial
-        kwargs['queryset'] = self.get_queryset()
-        kwargs['mixed_values'] = mixed_values
-        if not self.is_submitted:
-            kwargs['data'] = None
-            kwargs['files'] = None
-        return kwargs
-
-    def get_success_url(self):
-        return reverse('control:event.vouchers', kwargs={
-            'organizer': self.request.event.organizer.slug,
-            'event': self.request.event.slug,
-        })
-
-    def form_valid(self, form):
-        log_entries = []
-
-        # Main form
-        form.save()
-        data = {
-            k: v
-            for k, v in form.cleaned_data.items()
-            if k in form.changed_data
-        }
-        data['_raw_bulk_data'] = self.request.POST.dict()
-        for obj in self.get_queryset():
-            log_entries.append(
-                obj.log_action('pretix.voucher.changed', data=data, user=self.request.user, save=False)
-            )
-
-        LogEntry.bulk_create_and_postprocess(log_entries)
-
-        messages.success(self.request, _('Your changes have been saved.'))
-        return super().form_valid(form)
-
-    def get_context_data(self, **kwargs):
-        ctx = super().get_context_data(**kwargs)
-        ctx['vouchers'] = self.get_queryset()
-        ctx['bulk_selected'] = self.request.POST.getlist("_bulk")
-        return ctx
-
-    @transaction.atomic
-    def post(self, request, *args, **kwargs):
-        form = self.get_form()
-        is_valid = (
-            self.is_submitted and
-            form.is_valid()
-        )
-        if is_valid:
-            return self.form_valid(form)
-        else:
-            if self.is_submitted:
-                messages.error(self.request, _('We could not save your changes. See below for details.'))
-            return self.form_invalid(form)

src/pretix/helpers/config.py

@@ -29,61 +29,36 @@ class EnvOrParserConfig:
         self.cp = configparser
 
     def _envkey(self, section, option):
-        section = re.sub("[^a-zA-Z0-9]", "_", section.upper())
+        section = re.sub('[^a-zA-Z0-9]', '_', section.upper())
-        option = re.sub("[^a-zA-Z0-9]", "_", option.upper())
+        option = re.sub('[^a-zA-Z0-9]', '_', option.upper())
-        return f"PRETIX_{section}_{option}"
+        return f'PRETIX_{section}_{option}'
-
-    def _file_envkey(self, section, option):
-        section = re.sub("[^a-zA-Z0-9]", "_", section.upper())
-        option = re.sub("[^a-zA-Z0-9]", "_", option.upper())
-        return f"FILE__PRETIX_{section}_{option}"
 
     def get(self, section, option, *, raw=False, vars=None, fallback=_UNSET):
-        if self._file_envkey(section, option) in os.environ:
-            with open(os.environ[self._file_envkey(section, option)], "r") as f:
-                return f.read().strip()
         if self._envkey(section, option) in os.environ:
             return os.environ[self._envkey(section, option)]
         return self.cp.get(section, option, raw=raw, vars=vars, fallback=fallback)
 
     def getint(self, section, option, *, raw=False, vars=None, fallback=_UNSET):
-        if self._file_envkey(section, option) in os.environ:
-            with open(os.environ[self._file_envkey(section, option)], "r") as f:
-                return int(f.read().strip())
         if self._envkey(section, option) in os.environ:
             return int(os.environ[self._envkey(section, option)])
         return self.cp.getint(section, option, raw=raw, vars=vars, fallback=fallback)
 
     def getfloat(self, section, option, *, raw=False, vars=None, fallback=_UNSET):
-        if self._file_envkey(section, option) in os.environ:
-            with open(os.environ[self._file_envkey(section, option)], "r") as f:
-                return float(f.read().strip())
         if self._envkey(section, option) in os.environ:
             return float(os.environ[self._envkey(section, option)])
         return self.cp.getfloat(section, option, raw=raw, vars=vars, fallback=fallback)
 
     def getboolean(self, section, option, *, raw=False, vars=None, fallback=_UNSET):
-        if self._file_envkey(section, option) in os.environ:
-            with open(os.environ[self._file_envkey(section, option)], "r") as f:
-                return self.cp._convert_to_boolean(f.read().strip())
         if self._envkey(section, option) in os.environ:
-            return self.cp._convert_to_boolean(
+            return self.cp._convert_to_boolean(os.environ[self._envkey(section, option)])
-                os.environ[self._envkey(section, option)]
+        return self.cp.getboolean(section, option, raw=raw, vars=vars, fallback=fallback)
-            )
-        return self.cp.getboolean(
-            section, option, raw=raw, vars=vars, fallback=fallback
-        )
 
     def has_section(self, section):
-        if any(k.startswith(self._file_envkey(section, "")) for k in os.environ):
+        if any(k.startswith(self._envkey(section, '')) for k in os.environ):
-            return True
-        if any(k.startswith(self._envkey(section, "")) for k in os.environ):
             return True
         return self.cp.has_section(section)
 
     def has_option(self, section, option):
-        if self._file_envkey(section, option) in os.environ:
-            return True
         if self._envkey(section, option) in os.environ:
             return True
         return self.cp.has_option(section, option)

src/pretix/helpers/escapejson.py

@@ -47,5 +47,5 @@ def escapejson(value):
 
 @keep_lazy(str, SafeText)
 def escapejson_attr(value):
-    """Hex encodes characters for use in a html attribute."""
+    """Hex encodes characters for use in a html attributw script."""
     return mark_safe(force_str(value).translate(_json_escapes_attr))

src/pretix/helpers/logs.py

@@ -20,7 +20,6 @@
 # <https://www.gnu.org/licenses/>.
 #
 import logging
-import uuid
 
 from django.core.signals import request_finished
 from django.dispatch import receiver
@@ -47,13 +46,6 @@ class RequestIdFilter(logging.Filter):
         return True
 
 
-class SkipNotFoundFilter(logging.Filter):
-    # Drop the WARNING "Not Found: ..." records django.request emits for 404s
-    # We have different access logs for that
-    def filter(self, record):
-        return getattr(record, 'status_code', None) != 404
-
-
 class RequestIdMiddleware:
     def __init__(self, get_response):
         self.get_response = get_response
@@ -66,9 +58,7 @@ class RequestIdMiddleware:
                 import sentry_sdk
                 sentry_sdk.set_tag("request_id", request.request_id)
         else:
-            # Web server did not pass a request ID, we still generate one to correlate between django logs and
+            local.request_id = request.request_id = None
-            # celery logs
-            local.request_id = request.request_id = str(uuid.uuid4())
 
         return self.get_response(request)
 

src/pretix/helpers/payment.py

@@ -25,19 +25,6 @@ import text_unidecode
 from django.utils.safestring import mark_safe
 from django.utils.translation import gettext_lazy as _
 
-EPC_QR_ALLOWED_CHARS = set(
-    "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
-    "abcdefghijklmnopqrstuvwxyz"
-    "0123456789/-?:().,'+ "
-)
-
-
-def epc_qr_field(value):
-    return ''.join(
-        char for char in text_unidecode.unidecode(str(value or ''))
-        if char in EPC_QR_ALLOWED_CHARS
-    )
-
 
 def dotdecimal(value):
     return str(value).replace(",", ".")
@@ -90,7 +77,7 @@ def euro_epc_qr(
     return {
         "id": "girocode",
         "label": "EPC-QR",
-        "qr_data": "\n".join(epc_qr_field(d) for d in [
+        "qr_data": "\n".join(text_unidecode.unidecode(str(d or '')) for d in [
             "BCD",   # Service Tag: ‘BCD’
             "002",   # Version: V2
             "2",     # Character set: ISO 8859-1

src/pretix/helpers/security.py

@@ -27,7 +27,6 @@ from django.conf import settings
 from django.contrib.auth import login as auth_login
 from django.contrib.gis import geoip2
 from django.core.cache import cache
-from django.utils.formats import date_format
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 from django_countries.fields import Country
@@ -170,15 +169,11 @@ def handle_login_source(user, request):
             with language(user.locale):
                 mail(
                     user.email,
-                    _('New sign-in to your account'),
+                    _('Login from new source detected'),
                     'pretixcontrol/email/login_notice.txt',
                     {
-                        'when': date_format(src.last_seen, 'DATETIME_FORMAT'),
+                        'source': src,
-                        'agent': src.agent_type,
+                        'country': Country(str(country)).name if country else _('Unknown country'),
-                        'os': src.os_type,
-                        # ua-parser returns "Other" for unidentified desktop devices.
-                        'device': src.device_type if src.device_type and src.device_type != 'Other' else None,
-                        'country': Country(str(country)).name if country else None,
                         'instance': settings.PRETIX_INSTANCE_NAME,
                         'url': mainreverse_absolute('control:user.settings')
                     },

src/pretix/locale/de/wordlist.txt

@@ -74,7 +74,6 @@ Bokmål
 Boleto
 Branding-Informationen
 Browsereinstellungen
-Browserfenster
 BSD-Lizenz
 bspw
 Bundles
@@ -135,7 +134,6 @@ Einlasskontrolle
 Einmalpasswörter
 einzuchecken
 email
-E-Mail-App
 E-Mail-Renderer
 Enterprise-Lizenz
 Enterprise-Lizenzen
@@ -154,7 +152,6 @@ erstmalig
 etc
 EU-USt-ID-Nr
 Event
-Event-Absage
 Event-Eigenschaft
 Eventeingang
 Event-Erstellung
@@ -209,7 +206,6 @@ innenname
 innennamen
 innergemeinschaftliche
 Innergemeinschaftlicher
-Instagram
 Installations-ID
 Integrationen
 invalidieren
@@ -231,7 +227,6 @@ Linktext
 lit
 Log-ID
 Logindaten
-Loginvorgangs
 Macau
 MapQuest-API-Key
 max
@@ -455,7 +450,6 @@ Strong
 Swish
 systemweiten
 Tab
-Tabs
 tag
 Teammitglied
 Teamname

src/pretix/locale/de_Informal/wordlist.txt

@@ -74,7 +74,6 @@ Bokmål
 Boleto
 Branding-Informationen
 Browsereinstellungen
-Browserfenster
 BSD-Lizenz
 bspw
 Bundles
@@ -135,7 +134,6 @@ Einlasskontrolle
 Einmalpasswörter
 einzuchecken
 email
-E-Mail-App
 E-Mail-Renderer
 Enterprise-Lizenz
 Enterprise-Lizenzen
@@ -154,7 +152,6 @@ erstmalig
 etc
 EU-USt-ID-Nr
 Event
-Event-Absage
 Event-Eigenschaft
 Eventeingang
 Event-Erstellung
@@ -209,7 +206,6 @@ innenname
 innennamen
 innergemeinschaftliche
 Innergemeinschaftlicher
-Instagram
 Installations-ID
 Integrationen
 invalidieren
@@ -231,7 +227,6 @@ Linktext
 lit
 Log-ID
 Logindaten
-Loginvorgangs
 Macau
 MapQuest-API-Key
 max
@@ -455,7 +450,6 @@ Strong
 Swish
 systemweiten
 Tab
-Tabs
 tag
 Teammitglied
 Teamname