Drop line numbers from gettext .po files

Knowing what file a string comes from is useful, but the line number is less
useful and changes a lot, causing very unreadable diffs of translation
files. I propose we drop them and only include the file names

pyproject.toml

@@ -53,7 +53,6 @@ dependencies = [
   "django-oauth-toolkit==2.3.*",
   "django-otp==1.7.*",
   "django-phonenumber-field==8.4.*",
-  "django-querytagger==0.0.3",
   "django-redis==6.0.*",
   "django-scopes==2.0.*",
   "django-statici18n==2.7.*",
@@ -94,7 +93,7 @@ dependencies = [
   "redis==7.4.*",
   "reportlab==4.5.*",
   "requests==2.32.*",
-  "sentry-sdk==2.64.*",
+  "sentry-sdk==2.63.*",
   "sepaxml==2.7.*",
   "stripe==7.9.*",
   "text-unidecode==1.*",

src/pretix/_base_settings.py

@@ -118,7 +118,6 @@ ALL_LANGUAGES = [
     ('sv', _('Swedish')),
     ('es', _('Spanish')),
     ('es-419', _('Spanish (Latin America)')),
-    ('th', _('Thai')),
     ('tr', _('Turkish')),
     ('uk', _('Ukrainian')),
 ]

src/pretix/base/middleware.py

@@ -19,8 +19,6 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-import logging
-import re
 from collections import OrderedDict
 from urllib.parse import urlparse, urlsplit
 from zoneinfo import ZoneInfo, ZoneInfoNotFoundError
@@ -45,8 +43,6 @@ from pretix.multidomain.urlreverse import (
 )
 from pretix.presale.style import get_fonts
 
-logger = logging.getLogger(__name__)
-
 _supported = None
 
 
@@ -227,26 +223,7 @@ def _parse_csp(header):
     return h
 
 
-VALID_CSP_DIRECTIVES = [
-    "child-src", "connect-src", "default-src", "fenced-frame-src", "font-src", "form-action", "frame-src", "img-src",
-    "manifest-src", "media-src", "object-src", "prefetch-src", "report-uri", "script-src", "script-src-elem",
-    "script-src-attr", "style-src", "style-src-elem", "style-src-attr", "worker-src",
-]
-
-CSP_ILLEGAL_CHARS = re.compile(r'[\s,;]')
-
-
-def _sanitize_csp(h):
-    for k, v in h.items():
-        if k not in VALID_CSP_DIRECTIVES:
-            raise ValueError("Invalid CSP directive " + k)
-        if any(CSP_ILLEGAL_CHARS.search(el) for el in v):
-            logger.warning("Stripping invalid component from CSP: %r", h)
-            h[k] = [el for el in v if not CSP_ILLEGAL_CHARS.search(el)]
-
-
 def _render_csp(h):
-    _sanitize_csp(h)
     return "; ".join(k + ' ' + ' '.join(v) for k, v in h.items() if v)
 
 
@@ -266,7 +243,21 @@ def _merge_csp(a, b):
 
 
 class SecurityMiddleware(MiddlewareMixin):
+    CSP_EXEMPT = (
+        '/api/v1/docs/',
+    )
+
     def process_response(self, request, resp):
+        def nested_dict_values(d):
+            for v in d.values():
+                if isinstance(v, dict):
+                    yield from nested_dict_values(v)
+                else:
+                    if isinstance(v, str):
+                        yield v
+
+        url = resolve(request.path_info)
+
         if settings.DEBUG and resp.status_code >= 400:
             # Don't use CSP on debug error page as it breaks of Django's fancy error
             # pages
@@ -277,15 +268,18 @@ class SecurityMiddleware(MiddlewareMixin):
         # https://github.com/pretix/pretix/issues/765
         resp['P3P'] = 'CP=\"ALL DSP COR CUR ADM TAI OUR IND COM NAV INT\"'
 
-        if not getattr(resp, '_csp_ignore', False):
-            resp['Content-Security-Policy'] = _render_csp(self._build_csp(request, resp))
-        elif 'Content-Security-Policy' in resp:
-            del resp['Content-Security-Policy']
+        img_src = []
+        gs = global_settings_object(request)
+        if gs.settings.leaflet_tiles:
+            img_src.append(gs.settings.leaflet_tiles[:gs.settings.leaflet_tiles.index("/", 10)].replace("{s}", "*"))
 
-        return resp
-
-    def _build_csp(self, request, resp):
-        url = resolve(request.path_info)
+        font_src = set()
+        if hasattr(request, 'event'):
+            for font in get_fonts(request.event, pdf_support_required=False).values():
+                for path in list(nested_dict_values(font)):
+                    font_location = urlparse(path)
+                    if font_location.scheme and font_location.netloc:
+                        font_src.add('{}://{}'.format(font_location.scheme, font_location.netloc))
 
         h = {
             'default-src': ["{static}"],
@@ -294,8 +288,8 @@ class SecurityMiddleware(MiddlewareMixin):
             'frame-src': ['{static}'],
             'style-src': ["{static}", "{media}"],
             'connect-src': ["{dynamic}", "{media}"],
-            'img-src': ["{static}", "{media}", "data:"],
-            'font-src': ["{static}"],
+            'img-src': ["{static}", "{media}", "data:"] + img_src,
+            'font-src': ["{static}"] + list(font_src),
             'media-src': ["{static}", "data:"],
             # form-action is not only used to match on form actions, but also on URLs
             # form-actions redirect to. In the context of e.g. payment providers or
@@ -304,13 +298,6 @@ class SecurityMiddleware(MiddlewareMixin):
             'form-action': ["{dynamic}", "https:"] + (['http:'] if settings.SITE_URL.startswith('http://') else []),
         }
 
-        gs = global_settings_object(request)
-        if gs.settings.leaflet_tiles:
-            h['img-src'].append(gs.settings.leaflet_tiles[:gs.settings.leaflet_tiles.index("/", 10)].replace("{s}", "*"))
-
-        if hasattr(request, 'event'):
-            h['font-src'] += list(self._get_font_origins(request.event))
-
         if settings.VITE_DEV_MODE:
             h['script-src'] += ["http://localhost:5173", "ws://localhost:5173"]
             h['style-src'] += ["'unsafe-inline'"]
@@ -322,7 +309,6 @@ class SecurityMiddleware(MiddlewareMixin):
             if not settings.VITE_DEV_MODE:
                 # can't have 'unsafe-inline' and nonce at the same time
                 h['style-src'].append(nonce)
-
         # Only include pay.google.com for wallet detection purposes on the Payment selection page
         if (
                 url.url_name == "event.order.pay.change" or
@@ -331,32 +317,27 @@ class SecurityMiddleware(MiddlewareMixin):
             h['script-src'].append('https://pay.google.com')
             h['frame-src'].append('https://pay.google.com')
             h['connect-src'].append('https://google.com/pay')
-
         if settings.LOG_CSP:
             h['report-uri'] = ["/csp_report/"]
-
         if 'Content-Security-Policy' in resp:
             _merge_csp(h, _parse_csp(resp['Content-Security-Policy']))
-
         if settings.CSP_ADDITIONAL_HEADER:
             _merge_csp(h, _parse_csp(settings.CSP_ADDITIONAL_HEADER))
 
-        placeholders = {
-            "{static}": ["'self'"],
-            "{dynamic}": ["'self'"],
-            "{media}": ["'self'"],
-        }
+        staticdomain = "'self'"
+        dynamicdomain = "'self'"
+        mediadomain = "'self'"
         if settings.MEDIA_URL.startswith('http'):
-            placeholders["{media}"].append(settings.MEDIA_URL[:settings.MEDIA_URL.find('/', 9)])
+            mediadomain += " " + settings.MEDIA_URL[:settings.MEDIA_URL.find('/', 9)]
         if settings.STATIC_URL.startswith('http'):
-            placeholders["{static}"].append(settings.STATIC_URL[:settings.STATIC_URL.find('/', 9)])
+            staticdomain += " " + settings.STATIC_URL[:settings.STATIC_URL.find('/', 9)]
         if settings.SITE_URL.startswith('http'):
             if settings.SITE_URL.find('/', 9) > 0:
-                placeholders["{static}"].append(settings.SITE_URL[:settings.SITE_URL.find('/', 9)])
-                placeholders["{dynamic}"].append(settings.SITE_URL[:settings.SITE_URL.find('/', 9)])
+                staticdomain += " " + settings.SITE_URL[:settings.SITE_URL.find('/', 9)]
+                dynamicdomain += " " + settings.SITE_URL[:settings.SITE_URL.find('/', 9)]
             else:
-                placeholders["{static}"].append(settings.SITE_URL)
-                placeholders["{dynamic}"].append(settings.SITE_URL)
+                staticdomain += " " + settings.SITE_URL
+                dynamicdomain += " " + settings.SITE_URL
 
         if hasattr(request, 'organizer') and request.organizer:
             if hasattr(request, 'event') and request.event:
@@ -367,29 +348,18 @@ class SecurityMiddleware(MiddlewareMixin):
                 siteurlsplit = urlsplit(settings.SITE_URL)
                 if siteurlsplit.port and siteurlsplit.port not in (80, 443):
                     domain = '%s:%d' % (domain, siteurlsplit.port)
-                placeholders["{dynamic}"].append(domain)
+                dynamicdomain += " " + domain
 
-        for k, v in h.items():
-            h[k] = sorted(set(result for part in v for result in placeholders.get(part, [part])))
+        if request.path not in self.CSP_EXEMPT and not getattr(resp, '_csp_ignore', False):
+            resp['Content-Security-Policy'] = _render_csp(h).format(static=staticdomain, dynamic=dynamicdomain,
+                                                                    media=mediadomain)
+            for k, v in h.items():
+                h[k] = sorted(set(' '.join(v).format(static=staticdomain, dynamic=dynamicdomain, media=mediadomain).split(' ')))
+            resp['Content-Security-Policy'] = _render_csp(h)
+        elif 'Content-Security-Policy' in resp:
+            del resp['Content-Security-Policy']
 
-        return h
-
-    def _get_font_origins(self, event):
-        def nested_dict_values(d):
-            for v in d.values():
-                if isinstance(v, dict):
-                    yield from nested_dict_values(v)
-                else:
-                    if isinstance(v, str):
-                        yield v
-
-        font_src = set()
-        for font in get_fonts(event, pdf_support_required=False).values():
-            for path in list(nested_dict_values(font)):
-                font_location = urlparse(path)
-                if font_location.scheme and font_location.netloc:
-                    font_src.add('{}://{}'.format(font_location.scheme, font_location.netloc))
-        return font_src
+        return resp
 
 
 class RejectInvalidInputMiddleware(MiddlewareMixin):

src/pretix/base/models/auth.py

@@ -647,22 +647,25 @@ class User(AbstractBaseUser, PermissionsMixin, LoggingMixin):
             id__in=self.teams.filter(TeamQuerySet.organizer_permission_q(permission)).values_list('organizer', flat=True)
         )
 
-    def has_active_staff_session(self, session_key):
+    def has_active_staff_session(self, session_key=None):
         """
         Returns whether or not a user has an active staff session (formerly known as superuser session)
         with the given session key.
         """
         return self.get_active_staff_session(session_key) is not None
 
-    def get_active_staff_session(self, session_key):
-        if not self.is_staff or not session_key:
+    def get_active_staff_session(self, session_key=None):
+        if not self.is_staff:
             return None
         if not hasattr(self, '_staff_session_cache'):
             self._staff_session_cache = {}
         if session_key not in self._staff_session_cache:
-            sess = StaffSession.objects.filter(
-                user=self, date_end__isnull=True, session_key=session_key
-            ).first()
+            qs = StaffSession.objects.filter(
+                user=self, date_end__isnull=True
+            )
+            if session_key:
+                qs = qs.filter(session_key=session_key)
+            sess = qs.first()
             if sess:
                 if sess.date_start < now() - timedelta(seconds=settings.PRETIX_SESSION_TIMEOUT_ABSOLUTE):
                     sess.date_end = now()

src/pretix/base/models/event.py

@@ -1403,12 +1403,15 @@ class Event(EventMixin, LoggedModel):
 
         for mp in self.organizer.meta_properties.all():
             if mp.required and not self.meta_data.get(mp.name):
-                issues.append(format_html(
-                    '<a href="{href}{href_hash}">{text}</a>',
-                    text=gettext('You need to fill the meta parameter "{property}".').format(property=mp.name),
-                    href=reverse('control:event.settings', kwargs={'organizer': self.organizer.slug, 'event': self.slug}),
-                    href_hash=f'#id_prop-{mp.pk}-value',
-                ))
+                issues.append(
+                    ('<a {a_attr}>' + gettext('You need to fill the meta parameter "{property}".') + '</a>').format(
+                        property=mp.name,
+                        a_attr='href="%s#id_prop-%d-value"' % (
+                            reverse('control:event.settings', kwargs={'organizer': self.organizer.slug, 'event': self.slug}),
+                            mp.pk
+                        )
+                    )
+                )
 
         responses = event_live_issues.send(self)
         for receiver, response in sorted(responses, key=lambda r: str(r[0])):

src/pretix/base/settings.py

@@ -1924,6 +1924,8 @@ DEFAULTS = {
         'serializer_class': serializers.BooleanField,
         'form_kwargs': dict(
             label=_("Hide all past dates from calendar"),
+            help_text=_("This option currently only affects the calendar of this event series, not the organizer-wide "
+                        "calendar.")
         )
     },
     'allow_modifications': {

src/pretix/base/signals.py

@@ -535,9 +535,8 @@ EventPluginRegistry = PluginAwareRegistry  # for backwards compatibility
 event_live_issues = EventPluginSignal()
 """
 This signal is sent out to determine whether an event can be taken live. If you want to
-prevent the event from going live, return an error message to display to the user (either
-as a SafeString containing HTML, or a string that will be HTML-escaped). If you don't,
-your receiver should return ``None``.
+prevent the event from going live, return a string that will be displayed to the user
+as the error message. If you don't, your receiver should return ``None``.
 
 As with all event-plugin signals, the ``sender`` keyword argument will contain the event.
 """

src/pretix/base/templatetags/eventsignal.py

@@ -22,7 +22,6 @@
 import importlib
 
 from django import template
-from django.utils.html import conditional_escape
 from django.utils.safestring import mark_safe
 
 from pretix.base.models import Event
@@ -45,7 +44,7 @@ def eventsignal(event: Event, signame: str, **kwargs):
     _html = []
     for receiver, response in signal.send(event, **kwargs):
         if response:
-            _html.append(conditional_escape(response))
+            _html.append(response)
     return mark_safe("".join(_html))
 
 
@@ -64,5 +63,5 @@ def signal(signame: str, request, **kwargs):
     _html = []
     for receiver, response in signal.send(request, **kwargs):
         if response:
-            _html.append(conditional_escape(response))
+            _html.append(response)
     return mark_safe("".join(_html))

src/pretix/base/templatetags/rich_text.py

@@ -42,6 +42,8 @@ from bleach import DEFAULT_CALLBACKS, html5lib_shim
 from bleach.linkifier import build_email_re
 from django import template
 from django.conf import settings
+from django.core import signing
+from django.urls import reverse
 from django.utils.functional import SimpleLazyObject
 from django.utils.html import escape
 from django.utils.http import url_has_allowed_host_and_scheme

src/pretix/control/middleware.py

@@ -36,7 +36,6 @@ from urllib.parse import quote, urljoin, urlparse
 
 from django.conf import settings
 from django.contrib.auth import REDIRECT_FIELD_NAME, logout
-from django.contrib.auth.views import redirect_to_login
 from django.http import Http404
 from django.shortcuts import get_object_or_404, resolve_url
 from django.template.response import TemplateResponse
@@ -215,15 +214,12 @@ class AuditLogMiddleware:
                 hijack_history = request.session.get('hijack_history', False)
                 hijacker = get_object_or_404(User, pk=hijack_history[0]["user"])
                 ss = hijacker.get_active_staff_session(request.session.get('hijacker_session'))
-                if not ss:
-                    # Staff session expired or not found
-                    logout(request)
-                    return redirect_to_login(request.get_full_path())
-                ss.logs.create(
-                    url=request.path,
-                    method=request.method,
-                    impersonating=request.user
-                )
+                if ss:
+                    ss.logs.create(
+                        url=request.path,
+                        method=request.method,
+                        impersonating=request.user
+                    )
             else:
                 ss = request.user.get_active_staff_session(request.session.session_key)
                 if ss:

src/pretix/control/signals.py

@@ -39,8 +39,7 @@ from pretix.base.signals import (
 html_page_start = GlobalSignal()
 """
 This signal allows you to put code in the beginning of the main page for every
-page in the backend. You are expected to return a SafeString containing HTML, or
-a string that will be HTML-escaped.
+page in the backend. You are expected to return HTML.
 
 The ``sender`` keyword argument will contain the request.
 """
@@ -130,7 +129,7 @@ event_dashboard_top = EventPluginSignal()
 Arguments: 'request'
 
 This signal is sent out to include custom HTML in the top part of the the event dashboard.
-Receivers should return a SafeString containing HTML, or a string that will be HTML-escaped.
+Receivers should return HTML.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 An additional keyword argument ``subevent`` *can* contain a sub-event.
@@ -173,7 +172,6 @@ Arguments: 'form'
 
 This signal allows you to add additional HTML to the form that is used for modifying vouchers.
 You receive the form object in the ``form`` keyword argument.
-Receivers should return a SafeString containing HTML, or a string that will be HTML-escaped.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 """
@@ -211,7 +209,6 @@ Arguments: 'quota'
 
 This signal allows you to append HTML to a Quota's detail view. You receive the
 quota as argument in the ``quota`` keyword argument.
-Receivers should return a SafeString containing HTML, or a string that will be HTML-escaped.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 """
@@ -222,7 +219,6 @@ Arguments: 'subevent'
 
 This signal allows you to append HTML to a SubEvent's detail view. You receive the
 subevent as argument in the ``subevent`` keyword argument.
-Receivers should return a SafeString containing HTML, or a string that will be HTML-escaped.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 """
@@ -269,8 +265,7 @@ order_info = EventPluginSignal()
 """
 Arguments: ``order``, ``request``
 
-This signal is sent out to display additional information on the order detail page.
-Receivers should return a SafeString containing HTML, or a string that will be HTML-escaped.
+This signal is sent out to display additional information on the order detail page
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 Additionally, the argument ``order`` and ``request`` are available.
@@ -280,8 +275,7 @@ order_approve_info = EventPluginSignal()
 """
 Arguments: ``order``, ``request``
 
-This signal is sent out to display additional information on the order approve page.
-Receivers should return a SafeString containing HTML, or a string that will be HTML-escaped.
+This signal is sent out to display additional information on the order approve page
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 Additionally, the argument ``order`` and ``request`` are available.
@@ -292,7 +286,6 @@ order_position_buttons = EventPluginSignal()
 Arguments: ``order``, ``position``, ``request``
 
 This signal is sent out to display additional buttons for a single position of an order.
-Receivers should return a SafeString containing HTML, or a string that will be HTML-escaped.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 Additionally, the argument ``order`` and ``request`` are available.
@@ -322,7 +315,6 @@ Arguments: 'request'
 
 This signal is sent out to include template snippets on the settings page of an event
 that allows generating a pretix Widget code.
-Receivers should return a SafeString containing HTML, or a string that will be HTML-escaped.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 A second keyword argument ``request`` will contain the request object.

src/pretix/control/templates/pretixcontrol/event/live.html

@@ -19,7 +19,7 @@
                         </p>
                         <ul>
                             {% for issue in issues %}
-                                <li>{{ issue }}</li>
+                                <li>{{ issue|safe }}</li>
                             {% endfor %}
                         </ul>
                     </div>
@@ -42,7 +42,7 @@
                         </p>
                         <ul>
                             {% for issue in issues %}
-                                <li>{{ issue }}</li>
+                                <li>{{ issue|safe }}</li>
                             {% endfor %}
                         </ul>
                     </div>

src/pretix/control/views/users.py

@@ -31,7 +31,6 @@ from django.contrib.auth import (
 )
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.auth.views import redirect_to_login
-from django.core.exceptions import PermissionDenied
 from django.db import transaction
 from django.shortcuts import get_object_or_404, redirect
 from django.urls import reverse
@@ -222,13 +221,11 @@ class UserImpersonateView(AdministratorPermissionRequiredMixin, RecentAuthentica
 
     def post(self, request, *args, **kwargs):
         self.object = get_object_or_404(User, pk=self.kwargs.get("id"))
-        staff_session = request.user.get_active_staff_session(request.session.session_key)
         self.request.user.log_action('pretix.control.auth.user.impersonated',
                                      user=request.user,
                                      data={
                                          'other': self.kwargs.get("id"),
-                                         'other_email': self.object.email,
-                                         'staff_session': staff_session.pk,
+                                         'other_email': self.object.email
                                      })
         oldkey = request.session.session_key
 
@@ -252,12 +249,6 @@ class UserImpersonateView(AdministratorPermissionRequiredMixin, RecentAuthentica
         with signals.no_update_last_login(), keep_session_age(request.session):
             login(request, hijacked, backend=backend)
 
-        request.session.save()
-        staff_session.logs.create(
-            method='(NOTE)',
-            url=f'Begin impersonating user #{hijacked.pk} (request session {oldkey[:8]} -> {request.session.session_key[:8]})',
-        )
-
         request.session["hijack_history"] = hijack_history
 
         signals.hijack_started.send(
@@ -274,15 +265,13 @@ class UserImpersonateView(AdministratorPermissionRequiredMixin, RecentAuthentica
 class UserImpersonateStopView(LoginRequiredMixin, View):
 
     def post(self, request, *args, **kwargs):
-        staff_session_key = request.session['hijacker_session']
-        prev_session_key = request.session.session_key
+        impersonated = request.user
+
+        hijs = request.session['hijacker_session']
         hijack_history = request.session.get("hijack_history", [])
         hijacked = request.user
         prev_session = hijack_history.pop()
         hijacker = get_object_or_404(get_user_model(), pk=prev_session["user"])
-        staff_session = hijacker.get_active_staff_session(staff_session_key)
-        if not staff_session:
-            raise PermissionDenied
 
         expected_hash = salted_hmac(
             key_salt=b"hijack-history-hash",
@@ -310,22 +299,17 @@ class UserImpersonateStopView(LoginRequiredMixin, View):
             hijacked=hijacked,
         )
 
-        request.session.save()
-        staff_session.session_key = request.session.session_key
-        staff_session.save()
-
-        staff_session.logs.create(
-            method='(NOTE)',
-            url=f'Stop impersonating user #{hijacked.pk} (request session {prev_session_key[:8]}, '
-                f'staff session {staff_session_key[:8]} -> {request.session.session_key[:8]})',
-        )
+        ss = request.user.get_active_staff_session(hijs)
+        if ss:
+            request.session.save()
+            ss.session_key = request.session.session_key
+            ss.save()
 
         request.user.log_action('pretix.control.auth.user.impersonate_stopped',
                                 user=request.user,
                                 data={
-                                    'other': hijacked.pk,
-                                    'other_email': hijacked.email,
-                                    'staff_session': staff_session.pk,
+                                    'other': impersonated.pk,
+                                    'other_email': impersonated.email
                                 })
         return redirect(reverse('control:index'))
 

src/pretix/presale/signals.py

@@ -161,8 +161,7 @@ voucher_redeem_info = EventPluginSignal()
 """
 Arguments: ``voucher``
 
-This signal is sent out to display additional information on the "redeem a voucher" page.
-You are expected to return a SafeString containing HTML, or a string that will be HTML-escaped.
+This signal is sent out to display additional information on the "redeem a voucher" page
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 """
@@ -195,7 +194,6 @@ Arguments: ``request``
 
 This signals allows you to add HTML content to the confirmation page that is presented at the
 end of the checkout process, just before the order is being created.
-You are expected to return a SafeString containing HTML, or a string that will be HTML-escaped.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event. A ``request``
 argument will contain the request object.
@@ -278,8 +276,7 @@ order_info = EventPluginSignal()
 """
 Arguments: ``order``, ``request``
 
-This signal is sent out to display additional information on the order detail page.
-Return a SafeString containing HTML, or a string that will be HTML-escaped.
+This signal is sent out to display additional information on the order detail page
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 """
@@ -288,8 +285,7 @@ position_info = EventPluginSignal()
 """
 Arguments: ``order``, ``position``, ``request``
 
-This signal is sent out to display additional information on the position detail page.
-Return a SafeString containing HTML, or a string that will be HTML-escaped.
+This signal is sent out to display additional information on the position detail page
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 """
@@ -298,8 +294,7 @@ order_info_top = EventPluginSignal()
 """
 Arguments: ``order``, ``request``
 
-This signal is sent out to display additional information on top of the order detail page.
-Return a SafeString containing HTML, or a string that will be HTML-escaped.
+This signal is sent out to display additional information on top of the order detail page
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 """
@@ -308,8 +303,7 @@ position_info_top = EventPluginSignal()
 """
 Arguments: ``order``, ``position``, ``request``
 
-This signal is sent out to display additional information on top of the position detail page.
-Return a SafeString containing HTML, or a string that will be HTML-escaped.
+This signal is sent out to display additional information on top of the position detail page
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 """
@@ -355,7 +349,7 @@ This signal is sent out to display additional information on the frontpage above
 of products and but below a custom frontpage text.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event. The
-receivers are expected to return a SafeString containing HTML, or a string that will be HTML-escaped.
+receivers are expected to return HTML.
 """
 
 render_seating_plan = EventPluginSignal()
@@ -367,7 +361,7 @@ You will be passed the ``request`` as a keyword argument. If applicable, a ``sub
 ``voucher`` argument might be given.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event. The
-receivers are expected to return a SafeString containing HTML, or a string that will be HTML-escaped.
+receivers are expected to return HTML.
 """
 
 front_page_bottom = EventPluginSignal()
@@ -378,7 +372,7 @@ This signal is sent out to display additional information on the frontpage below
 of products.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event. The
-receivers are expected to return a SafeString containing HTML, or a string that will be HTML-escaped.
+receivers are expected to return HTML.
 """
 
 front_page_bottom_widget = EventPluginSignal()
@@ -389,7 +383,7 @@ This signal is sent out to display additional information on the frontpage below
 of products if the front page is shown in the widget.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event. The
-receivers are expected to return a SafeString containing HTML, or a string that will be HTML-escaped.
+receivers are expected to return HTML.
 """
 
 checkout_all_optional = EventPluginSignal()
@@ -409,7 +403,7 @@ Arguments: ``item``, ``variation``, ``subevent``
 
 This signal is sent out when the description of an item or variation is rendered and allows you to append
 additional text to the description. You are passed the ``item``, ``variation`` and ``subevent``. You are
-expected to return markdown.
+expected to return HTML.
 """
 
 register_cookie_providers = EventPluginSignal()

src/pretix/presale/templates/pretixpresale/event/base.html

@@ -9,7 +9,7 @@
 {% load anonymize_email %}
 {% block thetitle %}
     {% if messages %}
-        {{ messages|join:" " }} ::
+        {{ messages|join:" " }} :: 
     {% endif %}
     {% block title %}{% endblock %}{% if request.resolver_match.url_name != "event.index" %} :: {% endif %}{{ event.name }}
 {% endblock %}

src/pretix/presale/templates/pretixpresale/event/index.html

@@ -1,7 +1,6 @@
 {% extends "pretixpresale/event/base.html" %}
 {% load i18n %}
 {% load l10n %}
-{% load static %}
 {% load eventurl %}
 {% load cache_large %}
 {% load money %}
@@ -40,7 +39,6 @@
     {% else %}
         <meta property="og:url" content="{% abseventurl request.event "presale:event.index" %}" />
     {% endif %}
-    <script type="text/javascript" src="{% static "pretixpresale/js/csrfcookieretry.js" %}"></script>
 {% endblock %}
 {% block content %}
 

src/pretix/presale/templates/pretixpresale/event/order.html

@@ -6,7 +6,6 @@
 {% load money %}
 {% load expiresformat %}
 {% load eventurl %}
-{% load static %}
 {% load phone_format %}
 {% load rich_text %}
 {% load getitem %}
@@ -23,10 +22,6 @@
     {% endif %}
     {% trans "Order details" %}
 {% endblock %}
-{% block custom_header %}
-    {{ block.super }}
-     <script type="text/javascript" src="{% static "pretixpresale/js/csrfcookieretry.js" %}"></script>
-{% endblock %}
 {% block content %}
     {% if "thanks" in request.GET or "paid" in request.GET %}
         <div class="thank-you">

src/pretix/presale/templates/pretixpresale/fragment_calendar.html

@@ -21,21 +21,22 @@
                             data-date="{{ day.date|date_fast:"SHORT_DATE_FORMAT" }}">
                             <p>
                             {% if day.events %}
-                                <a href="#selected-day" class="day-label event hidden-sm hidden-md hidden-lg" aria-describedby="nr-of-events-{{ day.date|date_fast:"Y-m-d" }}">
+                                <a href="#selected-day" class="day-label event hidden-sm hidden-md hidden-lg">
                                     <b aria-hidden="true">{{ day.day }}</b>
                                     <time datetime="{{ day.date|date_fast:"Y-m-d" }}" class="sr-only">
                                         {{ day.date|date_fast:"SHORT_DATE_FORMAT" }}
                                     </time>
-                                    <span class="sr-only" id="nr-of-events-{{ day.date|date_fast:"Y-m-d" }}">{% blocktrans trimmed count count=day.events|length %}
-                                        {{ count }} event
-                                    {% plural %}
-                                        {{ count }} events
-                                    {% endblocktrans %}</span>
+                                    <span class="sr-only">
+                                        ({% blocktrans trimmed count count=day.events|length %}
+                                            {{ count }} event
+                                        {% plural %}
+                                            {{ count }} events
+                                        {% endblocktrans %})
+                                    </span>
                                 </a>
                                 <time datetime="{{ day.date|date_fast:"Y-m-d" }}" class="hidden-xs">{{ day.day }}</time>
                             {% else %}
                                 <time datetime="{{ day.date|date_fast:"Y-m-d" }}" class="day-label">{{ day.day }}</time>
-                                <span class="sr-only">{% trans "No events" %}</span>
                             {% endif %}
                             </p>
                             <ul class="events">

src/pretix/presale/views/organizer.py

@@ -650,10 +650,6 @@ def add_subevents_for_days(qs, before, after, ebd, timezones, sales_channel, eve
             if hide:
                 continue
 
-        if s.event_calendar_future_only:
-            if (se.date_to or se.date_from) < time_machine_now():
-                continue
-
         timezones.add(s.timezone)
         tz = ZoneInfo(s.timezone)
         datetime_from = se.date_from.astimezone(tz)

src/pretix/presale/views/widget.py

@@ -123,7 +123,7 @@ def widget_css_etag(request, version, **kwargs):
 
 
 def _use_vite(request):
-    if getattr(settings, 'PRETIX_WIDGET_VITE', False) or "beta" in request.GET:
+    if getattr(settings, 'PRETIX_WIDGET_VITE', False):
         return True
     origin = request.META.get('HTTP_ORIGIN', '')
     gs = GlobalSettingsObject()

src/pretix/settings.py

@@ -440,7 +440,6 @@ CSRF_COOKIE_NAME = 'pretix_csrftoken'
 SESSION_COOKIE_HTTPONLY = True
 
 INSTALLED_APPS += [ # noqa
-    'django_querytagger',
     'django_filters',
     'django_markup',
     'django_otp',
@@ -506,7 +505,6 @@ MIDDLEWARE = [
     'pretix.helpers.logs.RequestIdMiddleware',
     'pretix.api.middleware.IdempotencyMiddleware',
     'pretix.multidomain.middlewares.MultiDomainMiddleware',
-    'django_querytagger.middleware.SetTagMiddleware',  # after MultiDomainMiddleware for correct url resolving
     'pretix.base.middleware.CustomCommonMiddleware',
     'pretix.multidomain.middlewares.SessionMiddleware',
     'pretix.multidomain.middlewares.CsrfViewMiddleware',

src/pretix/static/pretixpresale/js/csrfcookieretry.js

@@ -1,15 +0,0 @@
-document.addEventListener("DOMContentLoaded", () => {
-  const COOKIE_NAME = "__Host-pretix_csrftoken";
-  const RELOAD_FLAG = "csrfReloadPerformed";
-
-  const hasCookie = document.cookie
-    .split("; ")
-    .some((c) => c.startsWith(COOKIE_NAME + "="));
-
-  if (!hasCookie && !sessionStorage.getItem(RELOAD_FLAG)) {
-    sessionStorage.setItem(RELOAD_FLAG, "1");
-    location.reload();
-  } else if (hasCookie && sessionStorage.getItem(RELOAD_FLAG)) {
-      sessionStorage.removeItem(RELOAD_FLAG);
-  }
-});

src/tests/base/test_middleware.py

@@ -126,81 +126,3 @@ class LocaleDeterminationTest(TestCase):
         response = c.get('/dummy/dummy/')
         language = response['Content-Language']
         self.assertEqual(language, 'en')
-
-
-def test_render_csp():
-    from pretix.base.middleware import _render_csp
-
-    assert _render_csp({}) == ""
-    assert _render_csp({'default-src': ["'self'"]}) == "default-src 'self'"
-
-    h = {
-        'default-src': ["'self'"],
-        'script-src': ["'self'"],
-        'object-src': ["'none'"],
-        'frame-src': ["'self'"],
-        'style-src': ["'self'", "'self'"],
-        'connect-src': ["'self'", "'self'"],
-        'img-src': ["'self'", "'self'", "data:"],
-        'font-src': ["'self'"],
-        'media-src': ["'self'", "data:"],
-        'form-action': ["'self'", "https:"],
-    }
-    assert _render_csp(h) == (
-        "default-src 'self'; script-src 'self'; object-src 'none'; frame-src 'self'; style-src 'self' 'self'; "
-        "connect-src 'self' 'self'; img-src 'self' 'self' data:; font-src 'self'; media-src 'self' data:; form-action 'self' https:"
-    )
-
-
-def test_merge_csp():
-    from pretix.base.middleware import _merge_csp, _parse_csp, _render_csp
-
-    h = {
-        'default-src': ["'self'"],
-        'script-src': ["'self'"],
-        'style-src': ["'self'", "'self'"],
-        'form-action': ["'self'", "https:"],
-        'connect-src': ["'self'", "'self'"],
-    }
-    assert _render_csp(h) == (
-        "default-src 'self'; script-src 'self'; style-src 'self' 'self'; form-action 'self' https:; connect-src 'self' 'self'"
-    )
-
-    _merge_csp(h, _parse_csp("style-src 'unsafe-inline'; connect-src https://example.com"))
-    assert _render_csp(h) == (
-        "default-src 'self'; script-src 'self'; style-src 'self' 'self' 'unsafe-inline'; form-action 'self' "
-        "https:; connect-src 'self' 'self' https://example.com"
-    )
-
-
-def test_roundtrip_csp():
-    from pretix.base.middleware import _merge_csp, _parse_csp, _render_csp
-
-    prod_csp = ("default-src 'self' https://pretix.eu https://static.pretix.cloud; script-src 'self' "
-                "'sha256-+tmFggeXIPOAC2UgcQ3LW/gPHTkwyWg3/D6FOJ5BHGo=' 'unsafe-eval' https://matomo.rami.io "
-                "https://pretix.eu https://static.pretix.cloud https://support.rami.io; object-src 'none'; "
-                "frame-src 'self' https://matomo.rami.io https://pretix.eu https://static.pretix.cloud "
-                "https://support.rami.io https://www.youtube-nocookie.com; style-src 'self' 'unsafe-inline' "
-                "data: https://cdn.pretix.cloud https://pretix.eu https://static.pretix…rt.rami.io; connect-src "
-                "'self' https://cdn.pretix.cloud https://matomo.rami.io https://pretix.eu https://static.pretix.cloud "
-                "https://support.rami.io ws://support.rami.io; img-src 'self' data: https://cdn.pretix.cloud "
-                "https://matomo.rami.io https://pretix.eu https://static.pretix.cloud https://support.rami.io; "
-                "font-src 'self' https://pretix.eu https://static.pretix.cloud; media-src 'self' data: "
-                "https://cdn.pretix.cloud https://pretix.eu https://static.pretix.cloud; form-action 'self' "
-                "https: https://pretix.eu")
-    h = _parse_csp(prod_csp)
-    _merge_csp(h, _parse_csp(prod_csp))
-    assert _render_csp(h) == prod_csp
-
-
-def test_sanitize_csp():
-    from pretix.base.middleware import _render_csp
-
-    h = {
-        'style-src': ["'self'", "https://example.com", "https://example.org https://attack.example.net", "https://\fexample.org",
-                      "https://\texample.org", "https://example.org;script-src https://example.org", ],
-        'script-src': ["'self'"],
-    }
-    assert _render_csp(h) == (
-        "style-src 'self' https://example.com; script-src 'self'"
-    )