Fix handling of required fields

Co-authored-by: Richard Schreiber <wiffbi@gmail.com>

Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.13-trixie
+FROM python:3.11-bookworm
 
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \

pyproject.toml

@@ -76,7 +76,7 @@ dependencies = [
   "paypal-checkout-serversdk==1.0.*",
   "PyJWT==2.12.*",
   "phonenumberslite==9.0.*",
-  "Pillow==12.2.*",
+  "Pillow==12.1.*",
   "pretix-plugin-build",
   "protobuf==7.34.*",
   "psycopg2-binary",
@@ -90,10 +90,10 @@ dependencies = [
   "pytz-deprecation-shim==0.1.*",
   "pyuca",
   "qrcode==8.2",
-  "redis==7.4.*",
+  "redis==7.1.*",
   "reportlab==4.4.*",
   "requests==2.32.*",
-  "sentry-sdk==2.57.*",
+  "sentry-sdk==2.56.*",
   "sepaxml==2.7.*",
   "stripe==7.9.*",
   "text-unidecode==1.*",

src/pretix/__init__.py

@@ -19,4 +19,4 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-__version__ = "2026.4.0.dev0"
+__version__ = "2026.3.0.dev0"

src/pretix/api/serializers/media.py

@@ -31,9 +31,7 @@ from pretix.api.serializers.order import OrderPositionSerializer
 from pretix.api.serializers.organizer import (
     CustomerSerializer, GiftCardSerializer,
 )
-from pretix.base.models import (
-    Device, Order, OrderPosition, ReusableMedium, TeamAPIToken,
-)
+from pretix.base.models import Order, OrderPosition, ReusableMedium
 
 logger = logging.getLogger(__name__)
 
@@ -82,7 +80,8 @@ class ReusableMediaSerializer(I18nAwareModelSerializer):
             )
 
         if 'linked_orderposition' in self.context['request'].query_params.getlist('expand'):
-            # Permission Check performed in to_representation
+            # No additional permission check performed, documented limitation of the permission system
+            # Would get to complex/unusable otherwise since the permission depends on the event
             self.fields['linked_orderposition'] = NestedOrderPositionSerializer(read_only=True)
         else:
             self.fields['linked_orderposition'] = serializers.PrimaryKeyRelatedField(
@@ -118,27 +117,6 @@ class ReusableMediaSerializer(I18nAwareModelSerializer):
                 )
         return data
 
-    def to_representation(self, instance):
-        r = super().to_representation(instance)
-        request = self.context.get('request')
-        # late permission evaluations for checks that depend on the actual linked events
-        expand_nested = self.context['request'].query_params.getlist('expand')
-        perm_holder = request.auth if isinstance(request.auth, (Device, TeamAPIToken)) else request.user
-        if 'linked_orderposition' in expand_nested:
-            if instance.linked_orderposition is not None:
-                event = instance.linked_orderposition.order.event
-                if not perm_holder.has_event_permission(event.organizer, event, 'event.orders:read', request):
-                    r['linked_orderposition'] = {'id': instance.linked_orderposition.id}
-
-        if 'linked_giftcard.owner_ticket' in expand_nested:
-            gc = instance.linked_giftcard
-            if gc is not None and gc.owner_ticket is not None:
-                event = gc.owner_ticket.order.event
-                if not perm_holder.has_event_permission(event.organizer, event, 'event.orders:read', request):
-                    r['linked_giftcard']['owner_ticket'] = {'id': instance.linked_giftcard.owner_ticket.id}
-
-        return r
-
     class Meta:
         model = ReusableMedium
         fields = (

src/pretix/api/serializers/order.py

@@ -769,11 +769,7 @@ class PaymentDetailsField(serializers.Field):
         pp = value.payment_provider
         if not pp:
             return {}
-        try:
-            return pp.api_payment_details(value)
-        except Exception:
-            logger.exception("Failed to retrieve payment_details")
-            return {}
+        return pp.api_payment_details(value)
 
 
 class OrderPaymentSerializer(I18nAwareModelSerializer):

src/pretix/api/serializers/organizer.py

@@ -286,19 +286,6 @@ class GiftCardSerializer(I18nAwareModelSerializer):
                 )
         return data
 
-    def to_representation(self, instance):
-        r = super().to_representation(instance)
-        request = self.context.get('request')
-        # late permission evaluations for checks that depend on the actual linked events
-        if 'owner_ticket' in self.context['request'].query_params.getlist('expand'):
-            owner_ticket = instance.owner_ticket
-            if owner_ticket:
-                event = owner_ticket.order.event
-                perm_holder = request.auth if isinstance(request.auth, (Device, TeamAPIToken)) else request.user
-                if not perm_holder.has_event_permission(event.organizer, event, 'event.orders:read', request):
-                    r['owner_ticket'] = {'id': instance.owner_ticket.id}
-        return r
-
     class Meta:
         model = GiftCard
         fields = ('id', 'secret', 'issuance', 'value', 'currency', 'testmode', 'expires', 'conditions', 'owner_ticket',

src/pretix/api/views/checkin.py

@@ -1122,7 +1122,7 @@ class CheckinViewSet(viewsets.ReadOnlyModelViewSet):
     permission = 'event.orders:read'
 
     def get_queryset(self):
-        qs = Checkin.all.filter(list__event=self.request.event).select_related(
+        qs = Checkin.all.filter().select_related(
             "position",
             "device",
         )

src/pretix/base/email.py

@@ -19,10 +19,7 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-import ipaddress
 import logging
-import smtplib
-import socket
 from itertools import groupby
 from smtplib import SMTPResponseException
 from typing import TypeVar
@@ -240,80 +237,3 @@ def base_renderers(sender, **kwargs):
 
 def get_email_context(**kwargs):
     return PlaceholderContext(**kwargs).render_all()
-
-
-def create_connection(address, timeout=socket.getdefaulttimeout(),
-                      source_address=None, *, all_errors=False):
-    # Taken from the python stdlib, extended with a check for local ips
-
-    host, port = address
-    exceptions = []
-    for res in socket.getaddrinfo(host, port, 0, socket.SOCK_STREAM):
-        af, socktype, proto, canonname, sa = res
-
-        if not getattr(settings, "MAIL_CUSTOM_SMTP_ALLOW_PRIVATE_NETWORKS", False):
-            ip_addr = ipaddress.ip_address(sa[0])
-            if ip_addr.is_multicast:
-                raise socket.error(f"Request to multicast address {sa[0]} blocked")
-            if ip_addr.is_loopback or ip_addr.is_link_local:
-                raise socket.error(f"Request to local address {sa[0]} blocked")
-            if ip_addr.is_private:
-                raise socket.error(f"Request to private address {sa[0]} blocked")
-
-        sock = None
-        try:
-            sock = socket.socket(af, socktype, proto)
-            if timeout is not socket.getdefaulttimeout():
-                sock.settimeout(timeout)
-            if source_address:
-                sock.bind(source_address)
-            sock.connect(sa)
-            # Break explicitly a reference cycle
-            exceptions.clear()
-            return sock
-
-        except socket.error as exc:
-            if not all_errors:
-                exceptions.clear()  # raise only the last error
-            exceptions.append(exc)
-            if sock is not None:
-                sock.close()
-
-    if len(exceptions):
-        try:
-            if not all_errors:
-                raise exceptions[0]
-            raise ExceptionGroup("create_connection failed", exceptions)
-        finally:
-            # Break explicitly a reference cycle
-            exceptions.clear()
-    else:
-        raise socket.error("getaddrinfo returns an empty list")
-
-
-class CheckPrivateNetworkMixin:
-    # _get_socket taken 1:1 from smtplib, just with a call to our own create_connection
-    def _get_socket(self, host, port, timeout):
-        # This makes it simpler for SMTP_SSL to use the SMTP connect code
-        # and just alter the socket connection bit.
-        if timeout is not None and not timeout:
-            raise ValueError('Non-blocking socket (timeout=0) is not supported')
-        if self.debuglevel > 0:
-            self._print_debug('connect: to', (host, port), self.source_address)
-        return create_connection((host, port), timeout, self.source_address)
-
-
-class SMTP(CheckPrivateNetworkMixin, smtplib.SMTP):
-    pass
-
-
-# SMTP used here instead of mixin, because smtp.SMTP_SSL._get_socket calls super()._get_socket and then wraps this socket
-# super()._get_socket needs to be our version from the mixin
-class SMTP_SSL(smtplib.SMTP_SSL, SMTP):  # noqa: N801
-    pass
-
-
-class CheckPrivateNetworkSmtpBackend(EmailBackend):
-    @property
-    def connection_class(self):
-        return SMTP_SSL if self.use_ssl else SMTP

src/pretix/base/exporter.py

@@ -47,7 +47,6 @@ from django.utils.formats import localize
 from django.utils.translation import gettext, gettext_lazy as _
 
 from pretix.base.models import Event
-from pretix.base.models.auth import PermissionHolder
 from pretix.helpers.safe_openpyxl import (  # NOQA: backwards compatibility for plugins using excel_safe
     SafeWorkbook, remove_invalid_excel_chars as excel_safe,
 )
@@ -60,20 +59,11 @@ class BaseExporter:
     This is the base class for all data exporters
     """
 
-    def __init__(self, event, organizer, permission_holder: PermissionHolder=None, progress_callback=lambda v: None):
-        """
-        :param event: Event context, can also be a queryset of events for multi-event exports
-        :param organizer: Organizer context
-        :param user: The user who triggered the export (or None).
-        :param token: The API token that triggered the export (or None).
-        :param device: The device that triggered the export (or None)
-        :param progress_callback: Callback function with progress
-        """
+    def __init__(self, event, organizer, progress_callback=lambda v: None):
         self.event = event
         self.organizer = organizer
         self.progress_callback = progress_callback
         self.is_multievent = isinstance(event, QuerySet)
-        self.permission_holder = permission_holder
         if isinstance(event, QuerySet):
             self.events = event
             self.event = None
@@ -190,7 +180,7 @@ class BaseExporter:
         return True
 
     @classmethod
-    def get_required_event_permission(cls) -> Optional[str]:
+    def get_required_event_permission(cls) -> str:
         """
         The permission level required to use this exporter for events. For multi-event-exports, this will be used
         to limit the selection of events. Will be ignored if the ``OrganizerLevelExportMixin`` mixin is used.
@@ -205,7 +195,7 @@ class OrganizerLevelExportMixin:
         raise TypeError("required_event_permission may not be called on OrganizerLevelExportMixin")
 
     @classmethod
-    def get_required_organizer_permission(cls) -> Optional[str]:
+    def get_required_organizer_permission(cls) -> str:
         """
         The permission level required to use this exporter. Must be set for organizer-level exports. Set to `None` to
         allow everyone with any access to the organizer.

src/pretix/base/forms/auth.py

@@ -196,7 +196,8 @@ class RegistrationForm(forms.Form):
     def clean_password(self):
         password1 = self.cleaned_data.get('password', '')
         user = User(email=self.cleaned_data.get('email'))
-        validate_password(password1, user=user)
+        if validate_password(password1, user=user) is not None:
+            raise forms.ValidationError(_(password_validators_help_texts()), code='pw_invalid')
         return password1
 
     def clean_email(self):

src/pretix/base/modelimport.py

@@ -70,10 +70,6 @@ def parse_csv(file, length=None, mode="strict", charset=None):
         except ImportError:
             charset = file.charset
     data = data.decode(charset or "utf-8", mode)
-
-    # remove stray linebreaks from the end of the file
-    data = data.rstrip("\n")
-
     # If the file was modified on a Mac, it only contains \r as line breaks
     if '\r' in data and '\n' not in data:
         data = data.replace('\r', '\n')

src/pretix/base/models/_transactions.py

@@ -29,9 +29,7 @@ import inspect
 import logging
 import os
 import threading
-from pathlib import Path
 
-import django
 from django.conf import settings
 from django.db import transaction
 
@@ -76,14 +74,10 @@ def _transactions_mark_order_dirty(order_id, using=None):
     if "PYTEST_CURRENT_TEST" in os.environ:
         # We don't care about Order.objects.create() calls in test code so let's try to figure out if this is test code
         # or not.
-        for frame in inspect.stack()[1:]:
-            if (
-                'pretix/base/models/orders' in frame.filename
-                or Path(frame.filename).is_relative_to(Path(django.__file__).parent)
-            ):
-                # Ignore model- and django-internal code
+        for frame in inspect.stack():
+            if 'pretix/base/models/orders' in frame.filename:
                 continue
-            elif 'test_' in frame.filename or 'conftest.py' in frame.filename:
+            elif 'test_' in frame.filename or 'conftest.py in frame.filename':
                 return
             elif 'pretix/' in frame.filename or 'pretix_' in frame.filename:
                 # This went through non-test code, let's consider it non-test

src/pretix/base/models/auth.py

@@ -38,7 +38,6 @@ import operator
 import secrets
 from datetime import timedelta
 from functools import reduce
-from typing import Protocol
 
 from django.conf import settings
 from django.contrib.auth.models import (
@@ -68,14 +67,6 @@ class EmailAddressTakenError(IntegrityError):
     pass
 
 
-class PermissionHolder(Protocol):
-    def has_event_permission(self, organizer, event, perm_name=None, request=None, session_key=None) -> bool:
-        ...
-
-    def has_organizer_permission(self, organizer, perm_name=None, request=None):
-        ...
-
-
 class UserManager(BaseUserManager):
     """
     This is the user manager for our custom user model. See the User
@@ -705,18 +696,6 @@ class User(AbstractBaseUser, PermissionsMixin, LoggingMixin):
         return self.teams.exists()
 
 
-class UserWithStaffSession:
-    # Wrapper around a User object with a staff session, implementing the PermissionHolder Protocol
-    def __init__(self, user):
-        self.user = user
-
-    def has_event_permission(self, organizer, event, perm_name=None, request=None, session_key=None) -> bool:
-        return True
-
-    def has_organizer_permission(self, organizer, perm_name=None, request=None):
-        return True
-
-
 class UserKnownLoginSource(models.Model):
     user = models.ForeignKey('User', on_delete=models.CASCADE, related_name="known_login_sources")
     agent_type = models.CharField(max_length=255, null=True, blank=True)

src/pretix/base/models/devices.py

@@ -229,7 +229,7 @@ class Device(LoggedModel):
         """
         return self._organizer_permission_set() if self.organizer == organizer else set()
 
-    def has_event_permission(self, organizer, event, perm_name=None, request=None, session_key=None) -> bool:
+    def has_event_permission(self, organizer, event, perm_name=None, request=None) -> bool:
         """
         Checks if this token is part of a team that grants access of type ``perm_name``
         to the event ``event``.
@@ -238,7 +238,6 @@ class Device(LoggedModel):
         :param event: The event to check
         :param perm_name: The permission, e.g. ``event.orders:read``
         :param request: This parameter is ignored and only defined for compatibility reasons.
-        :param session_key: This parameter is ignored and only defined for compatibility reasons.
         :return: bool
         """
         has_event_access = (self.all_events and organizer == self.organizer) or (

src/pretix/base/models/orders.py

@@ -590,7 +590,7 @@ class Order(LockModel, LoggedModel):
             not kwargs.get('force_save_with_deferred_fields', None) and
             (not update_fields or ('require_approval' not in update_fields and 'status' not in update_fields))
         ):
-            _fail("It is unsafe to call save() on an Order with deferred fields since we can't check if you missed "
+            _fail("It is unsafe to call save() on an OrderFee with deferred fields since we can't check if you missed "
                   "creating a transaction. Call save(force_save_with_deferred_fields=True) if you really want to do "
                   "this.")
 
@@ -2841,7 +2841,7 @@ class OrderPosition(AbstractPosition):
             if Transaction.key(self) != self.__initial_transaction_key or self.canceled != self.__initial_canceled or not self.pk:
                 _transactions_mark_order_dirty(self.order_id, using=kwargs.get('using', None))
         elif not kwargs.get('force_save_with_deferred_fields', None):
-            _fail("It is unsafe to call save() on an OrderPosition with deferred fields since we can't check if you missed "
+            _fail("It is unsafe to call save() on an OrderFee with deferred fields since we can't check if you missed "
                   "creating a transaction. Call save(force_save_with_deferred_fields=True) if you really want to do "
                   "this.")
 

src/pretix/base/models/organizer.py

@@ -319,9 +319,6 @@ class TeamQuerySet(models.QuerySet):
     def event_permission_q(cls, perm_name):
         from ..permissions import assert_valid_event_permission
 
-        if perm_name is None:
-            return Q()
-
         if perm_name.startswith('can_') and perm_name in OLD_TO_NEW_EVENT_COMPAT:  # legacy
             return reduce(operator.and_, [cls.event_permission_q(p) for p in OLD_TO_NEW_EVENT_COMPAT[perm_name]])
         assert_valid_event_permission(perm_name, allow_legacy=False)
@@ -334,9 +331,6 @@ class TeamQuerySet(models.QuerySet):
     def organizer_permission_q(cls, perm_name):
         from ..permissions import assert_valid_organizer_permission
 
-        if perm_name is None:
-            return Q()
-
         if perm_name.startswith('can_') and perm_name in OLD_TO_NEW_ORGANIZER_COMPAT:  # legacy
             return reduce(operator.and_, [cls.organizer_permission_q(p) for p in OLD_TO_NEW_ORGANIZER_COMPAT[perm_name]])
         assert_valid_organizer_permission(perm_name, allow_legacy=False)
@@ -556,7 +550,7 @@ class TeamAPIToken(models.Model):
         """
         return self.team.organizer_permission_set() if self.team.organizer == organizer else set()
 
-    def has_event_permission(self, organizer, event, perm_name=None, request=None, session_key=None) -> bool:
+    def has_event_permission(self, organizer, event, perm_name=None, request=None) -> bool:
         """
         Checks if this token is part of a team that grants access of type ``perm_name``
         to the event ``event``.
@@ -565,7 +559,6 @@ class TeamAPIToken(models.Model):
         :param event: The event to check
         :param perm_name: The permission, e.g. ``event.orders:read``
         :param request: This parameter is ignored and only defined for compatibility reasons.
-        :param session_key: This parameter is ignored and only defined for compatibility reasons.
         :return: bool
         """
         has_event_access = (self.team.all_events and organizer == self.team.organizer) or (

src/pretix/base/pdf.py

@@ -54,7 +54,7 @@ from bidi import get_display
 from django.conf import settings
 from django.contrib.staticfiles import finders
 from django.core.exceptions import ValidationError
-from django.db.models import Exists, Max, Min, OuterRef
+from django.db.models import Max, Min
 from django.db.models.fields.files import FieldFile
 from django.dispatch import receiver
 from django.utils.deconstruct import deconstructible
@@ -76,7 +76,7 @@ from reportlab.pdfgen.canvas import Canvas
 from reportlab.platypus import Paragraph
 
 from pretix.base.i18n import language
-from pretix.base.models import Checkin, Event, Order, OrderPosition, Question
+from pretix.base.models import Event, Order, OrderPosition, Question
 from pretix.base.settings import PERSON_NAME_SCHEMES
 from pretix.base.signals import layout_image_variables, layout_text_variables
 from pretix.base.templatetags.money import money_filter
@@ -379,13 +379,6 @@ DEFAULT_VARIABLES = OrderedDict((
             str(p) for p in generate_compressed_addon_list(op, order, ev)
         ])
     }),
-    ("checked_in_addons", {
-        "label": _("List of Checked-In Add-Ons"),
-        "editor_sample": _("Add-on 1\n2x Add-on 2"),
-        "evaluate": lambda op, order, ev: "\n".join([
-            str(p) for p in generate_compressed_addon_list(op, order, ev, only_checked_in=True)
-        ])
-    }),
     ("organizer", {
         "label": _("Organizer name"),
         "editor_sample": _("Event organizer company"),
@@ -757,16 +750,12 @@ def get_program_times(op: OrderPosition, ev: Event):
     ])
 
 
-def generate_compressed_addon_list(op, order, event, only_checked_in=False):
+def generate_compressed_addon_list(op, order, event):
     itemcount = defaultdict(int)
-    addon_qs = (
+    addons = [p for p in (
         op.addons.all() if 'addons' in getattr(op, '_prefetched_objects_cache', {})
         else op.addons.select_related('item', 'variation')
-    )
-    if only_checked_in:
-        addon_qs = addon_qs.filter(Exists(Checkin.objects.filter(position=OuterRef('pk'))), canceled=False)
-    addons = [p for p in addon_qs if not p.canceled]
-
+    ) if not p.canceled]
     for pos in addons:
         itemcount[pos.item, pos.variation] += 1
 

src/pretix/base/services/export.py

@@ -40,7 +40,6 @@ from pretix.base.models import (
     CachedFile, Device, Event, Organizer, ScheduledEventExport, TeamAPIToken,
     User, cachedfile_name,
 )
-from pretix.base.models.auth import UserWithStaffSession
 from pretix.base.models.exports import ScheduledOrganizerExport
 from pretix.base.services.mail import mail
 from pretix.base.services.tasks import (
@@ -212,12 +211,7 @@ def init_event_exporters(event, user=None, token=None, device=None, request=None
         if not perm_holder.has_event_permission(event.organizer, event, permission_name, request) and not staff_session:
             continue
 
-        exporter: BaseExporter = response(
-            event=event,
-            organizer=event.organizer,
-            permission_holder=token or device or (UserWithStaffSession(user) if staff_session else user),
-            **kwargs
-        )
+        exporter: BaseExporter = response(event=event, organizer=event.organizer, **kwargs)
 
         if not exporter.available_for_user(user if user and user.is_authenticated else None):
             continue
@@ -249,12 +243,7 @@ def init_organizer_exporters(
             continue
 
         if issubclass(response, OrganizerLevelExportMixin):
-            exporter: BaseExporter = response(
-                event=Event.objects.none(),
-                organizer=organizer,
-                permission_holder=token or device or (UserWithStaffSession(user) if staff_session else user),
-                **kwargs,
-            )
+            exporter: BaseExporter = response(event=Event.objects.none(), organizer=organizer, **kwargs)
 
             try:
                 if not perm_holder.has_organizer_permission(organizer, response.get_required_organizer_permission(), request) and not staff_session:
@@ -306,12 +295,7 @@ def init_organizer_exporters(
             if not _has_permission_on_any_team_cache[permission_name] and not staff_session:
                 continue
 
-            exporter: BaseExporter = response(
-                event=_event_list_cache[permission_name],
-                organizer=organizer,
-                permission_holder=token or device or (UserWithStaffSession(user) if staff_session else user),
-                **kwargs,
-            )
+            exporter: BaseExporter = response(event=_event_list_cache[permission_name], organizer=organizer, **kwargs)
 
         if not exporter.available_for_user(user if user and user.is_authenticated else None):
             continue

src/pretix/base/services/mail.py

@@ -411,7 +411,7 @@ def mail_send_task(self, **kwargs) -> bool:
         try:
             outgoing_mail = OutgoingMail.objects.select_for_update(of=OF_SELF).get(pk=outgoing_mail)
         except OutgoingMail.DoesNotExist:
-            logger.info(f"Ignoring job for non existing email {outgoing_mail}")
+            logger.info(f"Ignoring job for non existing email {outgoing_mail.guid}")
             return False
         if outgoing_mail.status == OutgoingMail.STATUS_INFLIGHT:
             logger.info(f"Ignoring job for inflight email {outgoing_mail.guid}")

src/pretix/base/services/orders.py

@@ -67,9 +67,9 @@ from pretix.base.email import get_email_context
 from pretix.base.i18n import get_language_without_region, language
 from pretix.base.media import MEDIA_TYPES
 from pretix.base.models import (
-    CartPosition, Device, Event, GiftCard, Item, ItemVariation, LogEntry,
-    Membership, Order, OrderPayment, OrderPosition, Quota, Seat,
-    SeatCategoryMapping, User, Voucher,
+    CartPosition, Device, Event, GiftCard, Item, ItemVariation, Membership,
+    Order, OrderPayment, OrderPosition, Quota, Seat, SeatCategoryMapping, User,
+    Voucher,
 )
 from pretix.base.models.event import SubEvent
 from pretix.base.models.orders import (
@@ -1618,7 +1618,7 @@ class OrderChangeManager:
     MembershipOperation = namedtuple('MembershipOperation', ('position', 'membership'))
     CancelOperation = namedtuple('CancelOperation', ('position', 'price_diff'))
     AddOperation = namedtuple('AddOperation', ('item', 'variation', 'price', 'addon_to', 'subevent', 'seat', 'membership',
-                                               'valid_from', 'valid_until', 'is_bundled', 'result', 'count'))
+                                               'valid_from', 'valid_until', 'is_bundled', 'result'))
     SplitOperation = namedtuple('SplitOperation', ('position',))
     FeeValueOperation = namedtuple('FeeValueOperation', ('fee', 'value', 'price_diff'))
     AddFeeOperation = namedtuple('AddFeeOperation', ('fee', 'price_diff'))
@@ -1632,24 +1632,16 @@ class OrderChangeManager:
     ForceRecomputeOperation = namedtuple('ForceRecomputeOperation', tuple())
 
     class AddPositionResult:
-        _positions: Optional[List[OrderPosition]]
+        _position: Optional[OrderPosition]
 
         def __init__(self):
-            self._positions = None
+            self._position = None
 
         @property
         def position(self) -> OrderPosition:
-            if self._positions is None:
+            if self._position is None:
                 raise RuntimeError("Order position has not been created yet. Call commit() first on OrderChangeManager.")
-            if len(self._positions) != 1:
-                raise RuntimeError("More than one position created.")
-            return self._positions[0]
-
-        @property
-        def positions(self) -> List[OrderPosition]:
-            if self._positions is None:
-                raise RuntimeError("Order position has not been created yet. Call commit() first on OrderChangeManager.")
-            return self._positions
+            return self._position
 
     def __init__(self, order: Order, user=None, auth=None, notify=True, reissue_invoice=True, allow_blocked_seats=False):
         self.order = order
@@ -1856,12 +1848,8 @@ class OrderChangeManager:
 
     def add_position(self, item: Item, variation: ItemVariation, price: Decimal, addon_to: OrderPosition = None,
                      subevent: SubEvent = None, seat: Seat = None, membership: Membership = None,
-                     valid_from: datetime = None, valid_until: datetime = None, count: int = 1) -> 'OrderChangeManager.AddPositionResult':
-        if count < 1:
-            raise ValueError("Count must be positive")
+                     valid_from: datetime = None, valid_until: datetime = None) -> 'OrderChangeManager.AddPositionResult':
         if isinstance(seat, str):
-            if count > 1:
-                raise ValueError("Cannot combine count > 1 with seat")
             if not seat:
                 seat = None
             else:
@@ -1915,14 +1903,14 @@ class OrderChangeManager:
         if self.order.event.settings.invoice_include_free or price.gross != Decimal('0.00'):
             self._invoice_dirty = True
 
-        self._totaldiff_guesstimate += price.gross * count
-        self._quotadiff.update({q: count for q in new_quotas})
+        self._totaldiff_guesstimate += price.gross
+        self._quotadiff.update(new_quotas)
         if seat:
             self._seatdiff.update([seat])
 
         result = self.AddPositionResult()
         self._operations.append(self.AddOperation(item, variation, price, addon_to, subevent, seat, membership,
-                                                  valid_from, valid_until, is_bundled, result, count))
+                                                  valid_from, valid_until, is_bundled, result))
         return result
 
     def split(self, position: OrderPosition):
@@ -2542,35 +2530,29 @@ class OrderChangeManager:
                     secret_dirty.remove(position)
                 position.save(update_fields=['canceled', 'secret'])
             elif isinstance(op, self.AddOperation):
-                new_pos = []
-                new_logs = []
-                for i in range(op.count):
-                    pos = OrderPosition.objects.create(
-                        item=op.item, variation=op.variation, addon_to=op.addon_to,
-                        price=op.price.gross, order=self.order, tax_rate=op.price.rate, tax_code=op.price.code,
-                        tax_value=op.price.tax, tax_rule=op.item.tax_rule,
-                        positionid=nextposid, subevent=op.subevent, seat=op.seat,
-                        used_membership=op.membership, valid_from=op.valid_from, valid_until=op.valid_until,
-                        is_bundled=op.is_bundled,
-                    )
-                    nextposid += 1
-                    new_pos.append(pos)
-                    new_logs.append(self.order.log_action('pretix.event.order.changed.add', user=self.user, auth=self.auth, data={
-                        'position': pos.pk,
-                        'item': op.item.pk,
-                        'variation': op.variation.pk if op.variation else None,
-                        'addon_to': op.addon_to.pk if op.addon_to else None,
-                        'price': op.price.gross,
-                        'positionid': pos.positionid,
-                        'membership': pos.used_membership_id,
-                        'subevent': op.subevent.pk if op.subevent else None,
-                        'seat': op.seat.pk if op.seat else None,
-                        'valid_from': op.valid_from.isoformat() if op.valid_from else None,
-                        'valid_until': op.valid_until.isoformat() if op.valid_until else None,
-                    }, save=False))
-
-                op.result._positions = new_pos
-                LogEntry.bulk_create_and_postprocess(new_logs)
+                pos = OrderPosition.objects.create(
+                    item=op.item, variation=op.variation, addon_to=op.addon_to,
+                    price=op.price.gross, order=self.order, tax_rate=op.price.rate, tax_code=op.price.code,
+                    tax_value=op.price.tax, tax_rule=op.item.tax_rule,
+                    positionid=nextposid, subevent=op.subevent, seat=op.seat,
+                    used_membership=op.membership, valid_from=op.valid_from, valid_until=op.valid_until,
+                    is_bundled=op.is_bundled,
+                )
+                nextposid += 1
+                self.order.log_action('pretix.event.order.changed.add', user=self.user, auth=self.auth, data={
+                    'position': pos.pk,
+                    'item': op.item.pk,
+                    'variation': op.variation.pk if op.variation else None,
+                    'addon_to': op.addon_to.pk if op.addon_to else None,
+                    'price': op.price.gross,
+                    'positionid': pos.positionid,
+                    'membership': pos.used_membership_id,
+                    'subevent': op.subevent.pk if op.subevent else None,
+                    'seat': op.seat.pk if op.seat else None,
+                    'valid_from': op.valid_from.isoformat() if op.valid_from else None,
+                    'valid_until': op.valid_until.isoformat() if op.valid_until else None,
+                })
+                op.result._position = pos
             elif isinstance(op, self.SplitOperation):
                 position = position_cache.setdefault(op.position.pk, op.position)
                 split_positions.append(position)
@@ -2895,7 +2877,7 @@ class OrderChangeManager:
         return total
 
     def _check_order_size(self):
-        if (len(self.order.positions.all()) + sum([op.count for op in self._operations if isinstance(op, self.AddOperation)])) > settings.PRETIX_MAX_ORDER_SIZE:
+        if (len(self.order.positions.all()) + len([op for op in self._operations if isinstance(op, self.AddOperation)])) > settings.PRETIX_MAX_ORDER_SIZE:
             raise OrderError(
                 self.error_messages['max_order_size'] % {
                     'max': settings.PRETIX_MAX_ORDER_SIZE,
@@ -2956,7 +2938,7 @@ class OrderChangeManager:
         ]) + len([
             o for o in self._operations if isinstance(o, self.SplitOperation)
         ])
-        adds = sum([o.count for o in self._operations if isinstance(o, self.AddOperation)])
+        adds = len([o for o in self._operations if isinstance(o, self.AddOperation)])
         if current > 0 and current - cancels + adds < 1:
             raise OrderError(self.error_messages['complete_cancel'])
 
@@ -3003,18 +2985,17 @@ class OrderChangeManager:
             elif isinstance(op, self.CancelOperation) and op.position in positions_to_fake_cart:
                 fake_cart.remove(positions_to_fake_cart[op.position])
             elif isinstance(op, self.AddOperation):
-                for i in range(op.count):
-                    cp = CartPosition(
-                        event=self.event,
-                        item=op.item,
-                        variation=op.variation,
-                        used_membership=op.membership,
-                        subevent=op.subevent,
-                        seat=op.seat,
-                    )
-                    cp.override_valid_from = op.valid_from
-                    cp.override_valid_until = op.valid_until
-                    fake_cart.append(cp)
+                cp = CartPosition(
+                    event=self.event,
+                    item=op.item,
+                    variation=op.variation,
+                    used_membership=op.membership,
+                    subevent=op.subevent,
+                    seat=op.seat,
+                )
+                cp.override_valid_from = op.valid_from
+                cp.override_valid_until = op.valid_until
+                fake_cart.append(cp)
         try:
             validate_memberships_in_order(self.order.customer, fake_cart, self.event, lock=True, ignored_order=self.order, testmode=self.order.testmode)
         except ValidationError as e:

src/pretix/control/forms/filter.py

@@ -1528,6 +1528,133 @@ class SubEventFilterForm(FilterForm):
         return self.event.organizer.meta_properties.filter(filter_allowed=True)
 
 
+class QuotaFilterForm(FilterForm):
+    orders = {
+        '-date': ('-subevent__date_from', 'name', 'pk'),
+        'date': ('subevent__date_from', '-name', '-pk'),
+        'size': ('size', 'name', 'pk'),
+        '-size': ('-size', '-name', '-pk'),
+        'name': ('name', 'pk'),
+        '-name': ('-name', '-pk'),
+    }
+    subevent = forms.ModelChoiceField(
+        label=pgettext_lazy('subevent', 'Date'),
+        queryset=SubEvent.objects.none(),
+        required=False,
+        empty_label=pgettext_lazy('subevent', 'All dates')
+    )
+    date_from = forms.DateField(
+        label=_('Date from'),
+        required=False,
+        widget=DatePickerWidget({
+            'placeholder': _('Date from'),
+        }),
+    )
+    date_until = forms.DateField(
+        label=_('Date until'),
+        required=False,
+        widget=DatePickerWidget({
+            'placeholder': _('Date until'),
+        }),
+    )
+    time_from = forms.TimeField(
+        label=_('Start time from'),
+        required=False,
+        widget=TimePickerWidget({}),
+    )
+    time_until = forms.TimeField(
+        label=_('Start time until'),
+        required=False,
+        widget=TimePickerWidget({}),
+    )
+    weekday = forms.MultipleChoiceField(
+        label=_('Weekday'),
+        choices=(
+            ('2', _('Monday')),
+            ('3', _('Tuesday')),
+            ('4', _('Wednesday')),
+            ('5', _('Thursday')),
+            ('6', _('Friday')),
+            ('7', _('Saturday')),
+            ('1', _('Sunday')),
+        ),
+        widget=forms.CheckboxSelectMultiple,
+        required=False
+    )
+    query = forms.CharField(
+        label=_('Quota name'),
+        widget=forms.TextInput(),
+        required=False
+    )
+
+    def __init__(self, *args, **kwargs):
+        self.event = kwargs.pop('event')
+        super().__init__(*args, **kwargs)
+        if self.event.has_subevents:
+            self.fields['date_from'].widget = DatePickerWidget()
+            self.fields['date_until'].widget = DatePickerWidget()
+            self.fields['subevent'].queryset = self.event.subevents.all()
+            self.fields['subevent'].widget = Select2(
+                attrs={
+                    'data-model-select2': 'event',
+                    'data-select2-url': reverse('control:event.subevents.select2', kwargs={
+                        'event': self.event.slug,
+                        'organizer': self.event.organizer.slug,
+                    }),
+                    'data-placeholder': pgettext_lazy('subevent', 'All dates')
+                }
+            )
+            self.fields['subevent'].widget.choices = self.fields['subevent'].choices
+        else:
+            del self.fields['subevent']
+            del self.fields['date_from']
+            del self.fields['date_until']
+            del self.fields['time_from']
+            del self.fields['time_until']
+            del self.fields['weekday']
+
+    def filter_qs(self, qs):
+        fdata = self.cleaned_data
+
+        if fdata.get('weekday'):
+            qs = qs.annotate(wday=ExtractWeekDay('subevent__date_from')).filter(wday__in=fdata.get('weekday'))
+
+        if fdata.get('subevent'):
+            qs = qs.filter(subevent=fdata["subevent"])
+
+        if fdata.get('query'):
+            query = fdata.get('query')
+            qs = qs.filter(name__icontains=query)
+
+        if fdata.get('date_until'):
+            date_end = make_aware(datetime.combine(
+                fdata.get('date_until') + timedelta(days=1),
+                time(hour=0, minute=0, second=0, microsecond=0)
+            ), get_current_timezone())
+            qs = qs.filter(
+                Q(subevent__date_to__isnull=True, subevent__date_from__lt=date_end) |
+                Q(subevent__date_to__isnull=False, subevent__date_to__lt=date_end)
+            )
+        if fdata.get('date_from'):
+            date_start = make_aware(datetime.combine(
+                fdata.get('date_from'),
+                time(hour=0, minute=0, second=0, microsecond=0)
+            ), get_current_timezone())
+            qs = qs.filter(subevent__date_from__gte=date_start)
+
+        if fdata.get('time_until'):
+            qs = qs.filter(subevent__date_from__time__lte=fdata.get('time_until'))
+        if fdata.get('time_from'):
+            qs = qs.filter(subevent__date_from__time__gte=fdata.get('time_from'))
+
+        if fdata.get('ordering'):
+            qs = qs.order_by(*get_deterministic_ordering(Quota, self.get_order_by()))
+        else:
+            qs = qs.order_by('-subevent__date_from', 'name', 'pk')
+
+        return qs
+
+
 class OrganizerFilterForm(FilterForm):
     orders = {
         'slug': 'slug',

src/pretix/control/forms/item.py

@@ -43,6 +43,7 @@ from django.core.exceptions import ValidationError
 from django.db.models import Max, Q
 from django.forms import ChoiceField, RadioSelect
 from django.forms.formsets import DELETION_FIELD_NAME
+from django.forms.utils import ErrorDict
 from django.urls import reverse
 from django.utils.functional import cached_property
 from django.utils.html import escape, format_html
@@ -375,6 +376,60 @@ class QuotaForm(I18nModelForm):
         return inst
 
 
+class QuotaBulkEditForm(QuotaForm):
+
+    def __init__(self, *args, **kwargs):
+        self.mixed_values = kwargs.pop('mixed_values')
+        self.queryset = kwargs.pop('queryset')
+        super().__init__(**kwargs)
+        self.fields.pop("subevent", None)  # Would add extra complexity and it's hard to imagine a use case for that
+        self.fields["name"].required = False
+        self.fields["itemvars"].required = False
+
+    def clean(self):
+        d = super().clean()
+        if self.prefix + "name" in self.data.getlist('_bulk') and not d.get("name"):
+            raise ValidationError({"name": _("This field is required.")})
+        if self.prefix + "itemvars" in self.data.getlist('_bulk') and not d.get("itemvars"):
+            raise ValidationError({"itemvars": _("This field is required.")})
+        return d
+
+    def save(self, commit=True):
+        objs = list(self.queryset)
+        fields = set()
+
+        for k in self.fields:
+            cb_val = self.prefix + k
+            if cb_val not in self.data.getlist('_bulk'):
+                continue
+
+            fields.add(k)
+            if k == 'itemvars':
+                selected_items = set(list(self.event.items.filter(id__in=[
+                    i.split('-')[0] for i in self.cleaned_data['itemvars']
+                ])))
+                selected_variations = list(ItemVariation.objects.filter(item__event=self.event, id__in=[
+                    i.split('-')[1] for i in self.cleaned_data['itemvars'] if '-' in i
+                ]))
+                for obj in objs:
+                    obj.items.set(selected_items)
+                    obj.variations.set(selected_variations)
+            else:
+                for obj in objs:
+                    setattr(obj, k, self.cleaned_data[k])
+
+        fields = [f for f in fields if f != 'itemvars']
+        if fields:
+            Quota.objects.bulk_update(objs, fields, 200)
+
+    def full_clean(self):
+        if len(self.data) == 0:
+            # form wasn't submitted
+            self._errors = ErrorDict()
+            return
+        super().full_clean()
+
+
 class ItemCreateForm(I18nModelForm):
     NONE = 'none'
     EXISTING = 'existing'

src/pretix/control/forms/orders.py

@@ -331,10 +331,6 @@ class OtherOperationsForm(forms.Form):
 
 
 class OrderPositionAddForm(forms.Form):
-    count = forms.IntegerField(
-        label=_('Number of products to add'),
-        initial=1,
-    )
     itemvar = forms.ChoiceField(
         label=_('Product')
     )
@@ -436,10 +432,6 @@ class OrderPositionAddForm(forms.Form):
             d['used_membership'] = [m for m in self.memberships if str(m.pk) == d['used_membership']][0]
         else:
             d['used_membership'] = None
-        if d.get("count", 1) > 1 and d.get("seat"):
-            raise ValidationError({
-                "seat": _("You can not choose a seat when adding multiple products at once.")
-            })
         return d
 
 

src/pretix/control/templates/pretixcontrol/items/quota_bulk_edit.html

@@ -0,0 +1,49 @@
+{% extends "pretixcontrol/event/base.html" %}
+{% load i18n %}
+{% load bootstrap3 %}
+{% block content %}
+    <h1>
+        {% trans "Change multiple quotas" %}
+        <small>
+            {% blocktrans trimmed with number=quotas.count %}
+                {{ number }} selected
+            {% endblocktrans %}
+        </small>
+    </h1>
+    <form class="form-horizontal" action="" method="post">
+        {% csrf_token %}
+        {% bootstrap_form_errors form %}
+        <div class="hidden">
+            {% for d in quotas %}
+                <input type="hidden" name="quota" value="{{ d.pk }}">
+            {% endfor %}
+        </div>
+        <fieldset>
+            <legend>{% trans "General information" %}</legend>
+            {% bootstrap_field form.name layout="bulkedit" %}
+            {% bootstrap_field form.size layout="bulkedit" %}
+        </fieldset>
+        <fieldset>
+            <legend>{% trans "Items" %}</legend>
+            <p>
+                {% blocktrans trimmed %}
+                    Please select the products or product variations this quota should be applied to. If you apply two
+                    quotas to the same product, it will only be available if <strong>both</strong> quotas have capacity
+                    left.
+                {% endblocktrans %}
+            </p>
+            {% bootstrap_field form.itemvars layout="bulkedit" %}
+        </fieldset>
+        <fieldset>
+            <legend>{% trans "Advanced options" %}</legend>
+            {% bootstrap_field form.close_when_sold_out layout="bulkedit" %}
+            {% bootstrap_field form.release_after_exit layout="bulkedit" %}
+            {% bootstrap_field form.ignore_for_event_availability layout="bulkedit" %}
+        </fieldset>
+        <div class="form-group submit-group">
+            <button type="submit" class="btn btn-primary btn-save">
+                {% trans "Save" %}
+            </button>
+        </div>
+    </form>
+{% endblock %}

src/pretix/control/templates/pretixcontrol/items/quota_delete_bulk.html

@@ -0,0 +1,34 @@
+{% extends "pretixcontrol/event/base.html" %}
+{% load i18n %}
+{% load bootstrap3 %}
+{% block title %}{% trans "Delete quotas" %}{% endblock %}
+{% block content %}
+    <h1>{% trans "Delete quotas" %}</h1>
+    <form action="" method="post" class="form-horizontal">
+        {% csrf_token %}
+        {% if allowed %}
+            <p>{% blocktrans trimmed count num=allowed|length %}
+                Are you sure you want to delete the following quota?
+            {% plural %}
+                Are you sure you want to delete the following {{ num }} quotas?
+            {% endblocktrans %}</p>
+            <ul>
+                {% for q in allowed %}
+                    <li>
+                        {{ q }} {% if q.subevent %}({{ q.subevent }}){% endif %}
+                        <input type="hidden" name="quota" value="{{ q.pk }}">
+                    </li>
+                {% endfor %}
+            </ul>
+        {% endif %}
+        <div class="form-group submit-group">
+            <a href="{% url "control:event.items.quotas" organizer=request.event.organizer.slug event=request.event.slug %}"
+               class="btn btn-default btn-cancel">
+                {% trans "Cancel" %}
+            </a>
+            <button type="submit" class="btn btn-danger btn-save" value="delete_confirm" name="action">
+                {% trans "Delete" %}
+            </button>
+        </div>
+    </form>
+{% endblock %}

src/pretix/control/templates/pretixcontrol/items/quotas.html

@@ -1,6 +1,7 @@
 {% extends "pretixcontrol/items/base.html" %}
 {% load i18n %}
 {% load urlreplace %}
+{% load bootstrap3 %}
 {% block title %}{% trans "Quotas" %}{% endblock %}
 {% block inside %}
     <h1>{% trans "Quotas" %}</h1>
@@ -13,21 +14,12 @@
             number of a specific ticket type at the same time.
         {% endblocktrans %}
     </p>
-    {% if request.event.has_subevents %}
-        <form class="form-inline helper-display-inline" action="" method="get">
-            {% include "pretixcontrol/event/fragment_subevent_choice_simple.html" %}
-        </form>
-    {% endif %}
-    {% if quotas|length == 0 %}
+    {% if quotas|length == 0 and not filter_form.filtered %}
         <div class="empty-collection">
             <p>
-                {% if request.GET.subevent %}
-                    {% trans "Your search did not match any quotas." %}
-                {% else %}
-                    {% blocktrans trimmed %}
-                        You haven't created any quotas yet.
-                    {% endblocktrans %}
-                {% endif %}
+                {% blocktrans trimmed %}
+                    You haven't created any quotas yet.
+                {% endblocktrans %}
             </p>
 
             {% if 'event.items:write' in request.eventpermset %}
@@ -36,79 +28,160 @@
             {% endif %}
         </div>
     {% else %}
+
+        <div class="panel panel-default">
+            <div class="panel-heading">
+                <h3 class="panel-title">
+                    {% trans "Filter" %}
+                </h3>
+            </div>
+            <form class="panel-body filter-form" action="" method="get">
+                <div class="row">
+                    <div class="{% if not filter_form.subevent %}col-lg-6{% else %}col-lg-2{% endif %} col-md-6 col-sm-6 col-xs-12">
+                        {% bootstrap_field filter_form.query %}
+                    </div>
+                    {% if filter_form.subevent %}
+                        <div class="col-lg-2 col-md-6 col-md-2 col-sm-6 col-xs-12">
+                            {% bootstrap_field filter_form.subevent %}
+                        </div>
+                        <div class="col-lg-2 col-md-3 col-sm-6 col-xs-12">
+                            {% bootstrap_field filter_form.date_from %}
+                        </div>
+                        <div class="col-lg-2 col-md-3 col-sm-6 col-xs-12">
+                            {% bootstrap_field filter_form.date_until %}
+                        </div>
+                        <div class="col-lg-2 col-md-3 col-sm-6 col-xs-12">
+                            {% bootstrap_field filter_form.time_from %}
+                        </div>
+                        <div class="col-lg-2 col-md-3 col-sm-6 col-xs-12">
+                            {% bootstrap_field filter_form.time_until %}
+                        </div>
+                        <div class="col-xs-12 one-line-checkboxes">
+                            {% bootstrap_field filter_form.weekday %}
+                        </div>
+                    {% endif %}
+                </div>
+
+                <div class="text-right flip">
+                    <button class="btn btn-primary btn-lg" type="submit">
+                        <span class="fa fa-filter"></span>
+                        {% trans "Filter" %}
+                    </button>
+                </div>
+            </form>
+        </div>
         {% if 'event.items:write' in request.eventpermset %}
             <p>
                 <a href="{% url "control:event.items.quotas.add" organizer=request.event.organizer.slug event=request.event.slug %}" class="btn btn-default"><i class="fa fa-plus"></i> {% trans "Create a new quota" %}
                 </a>
             </p>
         {% endif %}
-        <div class="table-responsive">
-            <table class="table table-hover table-quotas">
-                <thead>
-                <tr>
-                    <th>{% trans "Quota name" %}
-                        <a href="?{% url_replace request 'ordering' '-name' %}"><i class="fa fa-caret-down"></i></a>
-                        <a href="?{% url_replace request 'ordering' 'name' %}"><i class="fa fa-caret-up"></i></a>
-                    </th>
-                    <th>{% trans "Products" %}</th>
-                    {% if request.event.has_subevents %}
-                        <th>{% trans "Date" context "subevent" %}
-                            <a href="?{% url_replace request 'ordering' '-date' %}"><i class="fa fa-caret-down"></i></a>
-                            <a href="?{% url_replace request 'ordering' 'date' %}"><i class="fa fa-caret-up"></i></a>
-                        </th>
-                    {% endif %}
-                    <th>{% trans "Total capacity" %}
-                        <a href="?{% url_replace request 'ordering' '-size' %}"><i class="fa fa-caret-down"></i></a>
-                        <a href="?{% url_replace request 'ordering' 'size' %}"><i class="fa fa-caret-up"></i></a>
-                    </th>
-                    <th>{% trans "Capacity left" %}</th>
-                    <th class="action-col-2"></th>
-                </tr>
-                </thead>
-                <tbody>
-                {% for q in quotas %}
+        <form action="{% url "control:event.items.quotas.bulkaction"  organizer=request.event.organizer.slug event=request.event.slug %}" method="post">
+            {% csrf_token %}
+            {% for field in filter_form %}
+                {{ field.as_hidden }}
+            {% endfor %}
+            <div class="table-responsive">
+                <table class="table table-hover table-quotas">
+                    <thead>
                     <tr>
-                        <td>
-                            <strong><a href="{% url "control:event.items.quotas.show" organizer=request.event.organizer.slug event=request.event.slug quota=q.id %}">{{ q.name }}</a></strong>
-                            {% if q.ignore_for_event_availability %}
-                                <span class="fa fa-eye-slash text-muted" data-toggle="tooltip" title="{% trans "Ignore this quota when determining event availability" %}"></span>
-                            {% endif %}
-                        </td>
-                        <td>
-                            <ul>
-                                {% for item in q.cached_items %}
-                                    {% if not item.has_variations %}
-                                        <li><a href="{% url "control:event.item" organizer=request.event.organizer.slug event=request.event.slug item=item.id %}">{{ item }}</a></li>
-                                    {% endif %}
-                                {% endfor %}
-                                {% for v in q.variations.all %}
-                                    <li><a href="{% url "control:event.item" organizer=request.event.organizer.slug event=request.event.slug item=v.item.id %}#tab-0-3-open">
-                                        {{ v.item }} – {{ v }}</a></li>
-                                {% endfor %}
-                            </ul>
-                        </td>
-                        {% if request.event.has_subevents %}
-                            <td>
-                                {{ q.subevent.name }} – {{ q.subevent.get_date_range_display_with_times }}
-                            </td>
+                        {% if "event.items:write" in request.eventpermset %}
+                            <th>
+                                <label aria-label="{% trans "select all rows for batch-operation" %}" class="batch-select-label"><input type="checkbox" data-toggle-table/></label>
+                            </th>
                         {% endif %}
-                        <td>{% if q.size == None %}Unlimited{% else %}{{ q.size }}{% endif %}</td>
-                        <td>{% include "pretixcontrol/items/fragment_quota_availability.html" with availability=q.cached_avail closed=q.closed %}</td>
-                        <td class="text-right flip">
-                            {% if 'event.items:write' in request.eventpermset %}
-                                <a href="{% url "control:event.items.quotas.edit" organizer=request.event.organizer.slug event=request.event.slug quota=q.id %}" class="btn btn-default btn-sm"><i class="fa fa-edit"></i></a>
-                                <a href="{% url "control:event.items.quotas.add" organizer=request.event.organizer.slug event=request.event.slug %}?copy_from={{ q.id }}"
-                                   class="btn btn-sm btn-default" title="{% trans "Clone" %}" data-toggle="tooltip">
-                                    <span class="fa fa-copy"></span>
-                                </a>
-                                <a href="{% url "control:event.items.quotas.delete" organizer=request.event.organizer.slug event=request.event.slug quota=q.id %}" class="btn btn-danger btn-sm"><i class="fa fa-trash"></i></a>
-                            {% endif %}
-                        </td>
+                        <th>{% trans "Quota name" %}
+                            <a href="?{% url_replace request 'filter-ordering' '-name' %}"><i class="fa fa-caret-down"></i></a>
+                            <a href="?{% url_replace request 'filter-ordering' 'name' %}"><i class="fa fa-caret-up"></i></a>
+                        </th>
+                        <th>{% trans "Products" %}</th>
+                        {% if request.event.has_subevents %}
+                            <th>{% trans "Date" context "subevent" %}
+                                <a href="?{% url_replace request 'filter-ordering' '-date' %}"><i class="fa fa-caret-down"></i></a>
+                                <a href="?{% url_replace request 'filter-ordering' 'date' %}"><i class="fa fa-caret-up"></i></a>
+                            </th>
+                        {% endif %}
+                        <th>{% trans "Total capacity" %}
+                            <a href="?{% url_replace request 'filter-ordering' '-size' %}"><i class="fa fa-caret-down"></i></a>
+                            <a href="?{% url_replace request 'filter-ordering' 'size' %}"><i class="fa fa-caret-up"></i></a>
+                        </th>
+                        <th>{% trans "Capacity left" %}</th>
+                        <th class="action-col-2"></th>
                     </tr>
-                {% endfor %}
-                </tbody>
-            </table>
-        </div>
+                    {% if "event.items:write" in request.eventpermset and page_obj.paginator.num_pages > 1 %}
+                        <tr class="table-select-all warning hidden">
+                            <td>
+                                <input type="checkbox" name="__ALL" id="__all" data-results-total="{{ page_obj.paginator.count }}">
+                            </td>
+                            <td colspan="6">
+                                <label for="__all">
+                                    {% trans "Select all results on other pages as well" %}
+                                </label>
+                            </td>
+                        </tr>
+                    {% endif %}
+                    </thead>
+                    <tbody>
+                    {% for q in quotas %}
+                        <tr>
+                            {% if "event.items:write" in request.eventpermset %}
+                                <td>
+                                    <label aria-label="{% trans "select row for batch-operation" %}" class="batch-select-label"><input type="checkbox" name="quota" class="batch-select-checkbox" value="{{ q.pk }}"/></label>
+                                </td>
+                            {% endif %}
+                            <td>
+                                <strong><a href="{% url "control:event.items.quotas.show" organizer=request.event.organizer.slug event=request.event.slug quota=q.id %}">{{ q.name }}</a></strong>
+                                {% if q.ignore_for_event_availability %}
+                                    <span class="fa fa-eye-slash text-muted" data-toggle="tooltip" title="{% trans "Ignore this quota when determining event availability" %}"></span>
+                                {% endif %}
+                            </td>
+                            <td>
+                                <ul>
+                                    {% for item in q.cached_items %}
+                                        {% if not item.has_variations %}
+                                            <li><a href="{% url "control:event.item" organizer=request.event.organizer.slug event=request.event.slug item=item.id %}">{{ item }}</a></li>
+                                        {% endif %}
+                                    {% endfor %}
+                                    {% for v in q.variations.all %}
+                                        <li><a href="{% url "control:event.item" organizer=request.event.organizer.slug event=request.event.slug item=v.item.id %}#tab-0-3-open">
+                                            {{ v.item }} – {{ v }}</a></li>
+                                    {% endfor %}
+                                </ul>
+                            </td>
+                            {% if request.event.has_subevents %}
+                                <td>
+                                    {{ q.subevent.name }} – {{ q.subevent.get_date_range_display_with_times }}
+                                </td>
+                            {% endif %}
+                            <td>{% if q.size == None %}Unlimited{% else %}{{ q.size }}{% endif %}</td>
+                            <td>{% include "pretixcontrol/items/fragment_quota_availability.html" with availability=q.cached_avail closed=q.closed %}</td>
+                            <td class="text-right flip">
+                                {% if 'event.items:write' in request.eventpermset %}
+                                    <a href="{% url "control:event.items.quotas.edit" organizer=request.event.organizer.slug event=request.event.slug quota=q.id %}" class="btn btn-default btn-sm"><i class="fa fa-edit"></i></a>
+                                    <a href="{% url "control:event.items.quotas.add" organizer=request.event.organizer.slug event=request.event.slug %}?copy_from={{ q.id }}"
+                                       class="btn btn-sm btn-default" title="{% trans "Clone" %}" data-toggle="tooltip">
+                                        <span class="fa fa-copy"></span>
+                                    </a>
+                                    <a href="{% url "control:event.items.quotas.delete" organizer=request.event.organizer.slug event=request.event.slug quota=q.id %}" class="btn btn-danger btn-sm"><i class="fa fa-trash"></i></a>
+                                {% endif %}
+                            </td>
+                        </tr>
+                    {% endfor %}
+                    </tbody>
+                </table>
+            </div>
+            {% if "event.items:write" in request.eventpermset %}
+                <div class="batch-select-actions">
+                    <button type="submit" class="btn btn-danger btn-save" name="action" value="delete">
+                        <i class="fa fa-trash"></i>{% trans "Delete selected" %}
+                    </button>
+                    <button type="submit" class="btn btn-primary btn-save" name="action" value="edit"
+                            formaction="{% url "control:event.items.quotas.bulkedit"  organizer=request.event.organizer.slug event=request.event.slug %}">
+                        <i class="fa fa-edit"></i>{% trans "Edit selected" %}
+                    </button>
+                </div>
+            {% endif %}
+        </form>
     {% endif %}
     {% include "pretixcontrol/pagination.html" %}
 {% endblock %}

src/pretix/control/templates/pretixcontrol/order/change.html

@@ -329,7 +329,6 @@
                                         {{ add_form.custom_error }}
                                     </div>
                                 {% endif %}
-                                {% bootstrap_field add_form.count layout="control" %}
                                 {% bootstrap_field add_form.itemvar layout="control" %}
                                 {% bootstrap_field add_form.price addon_after=request.event.currency layout="control" %}
                                 {% if add_form.addon_to %}
@@ -365,7 +364,6 @@
                         </div>
                         <div class="panel-body">
                             <div class="form-horizontal">
-                                {% bootstrap_field add_position_formset.empty_form.count layout="control" %}
                                 {% bootstrap_field add_position_formset.empty_form.itemvar layout="control" %}
                                 {% bootstrap_field add_position_formset.empty_form.price addon_after=request.event.currency layout="control" %}
                                 {% if add_position_formset.empty_form.addon_to %}

src/pretix/control/urls.py

@@ -349,6 +349,8 @@ urlpatterns = [
                 name='event.items.questions.edit'),
         re_path(r'^questions/add$', item.QuestionCreate.as_view(), name='event.items.questions.add'),
         re_path(r'^quotas/$', item.QuotaList.as_view(), name='event.items.quotas'),
+        re_path(r'^quotas/bulk_action$', item.QuotaBulkAction.as_view(), name='event.items.quotas.bulkaction'),
+        re_path(r'^quotas/bulk_edit$', item.QuotaBulkUpdateView.as_view(), name='event.items.quotas.bulkedit'),
         re_path(r'^quotas/(?P<quota>\d+)/$', item.QuotaView.as_view(), name='event.items.quotas.show'),
         re_path(r'^quotas/select$', typeahead.quotas_select2, name='event.items.quotas.select2'),
         re_path(r'^quotas/(?P<quota>\d+)/change$', item.QuotaUpdate.as_view(), name='event.items.quotas.edit'),

src/pretix/control/views/item.py

@@ -41,21 +41,22 @@ from json.decoder import JSONDecodeError
 from django.contrib import messages
 from django.core.exceptions import PermissionDenied
 from django.core.files import File
-from django.db import transaction
+from django.db import models, transaction
 from django.db.models import (
-    Count, Exists, F, OuterRef, Prefetch, ProtectedError, Q,
+    Count, Exists, F, OuterRef, Prefetch, ProtectedError, Q, Subquery, Value,
 )
+from django.db.models.functions import Cast, Concat
 from django.forms.models import inlineformset_factory
 from django.http import (
     Http404, HttpResponse, HttpResponseBadRequest, HttpResponseRedirect,
 )
-from django.shortcuts import redirect
+from django.shortcuts import redirect, render
 from django.urls import resolve, reverse
 from django.utils.functional import cached_property
 from django.utils.timezone import now
 from django.utils.translation import gettext, gettext_lazy as _
 from django.views.decorators.http import require_http_methods
-from django.views.generic import ListView
+from django.views.generic import FormView, ListView, View
 from django.views.generic.detail import DetailView, SingleObjectMixin
 from django_countries.fields import Country
 
@@ -65,7 +66,7 @@ from pretix.api.serializers.item import (
 )
 from pretix.base.forms import I18nFormSet
 from pretix.base.models import (
-    CartPosition, Item, ItemCategory, ItemProgramTime, ItemVariation,
+    CartPosition, Item, ItemCategory, ItemProgramTime, ItemVariation, LogEntry,
     OrderPosition, Question, QuestionAnswer, QuestionOption, Quota,
     SeatCategoryMapping, Voucher,
 )
@@ -74,12 +75,15 @@ from pretix.base.models.items import ItemAddOn, ItemBundle, ItemMetaValue
 from pretix.base.services.quotas import QuotaAvailability
 from pretix.base.services.tickets import invalidate_cache
 from pretix.base.signals import quota_availability
-from pretix.control.forms.filter import QuestionAnswerFilterForm
+from pretix.control.forms.filter import (
+    QuestionAnswerFilterForm, QuotaFilterForm,
+)
 from pretix.control.forms.item import (
     CategoryForm, ItemAddOnForm, ItemAddOnsFormSet, ItemBundleForm,
     ItemBundleFormSet, ItemCreateForm, ItemMetaValueForm, ItemProgramTimeForm,
     ItemProgramTimeFormSet, ItemUpdateForm, ItemVariationForm,
-    ItemVariationsFormSet, QuestionForm, QuestionOptionForm, QuotaForm,
+    ItemVariationsFormSet, QuestionForm, QuestionOptionForm, QuotaBulkEditForm,
+    QuotaForm,
 )
 from pretix.control.permissions import (
     EventPermissionRequiredMixin, event_permission_required,
@@ -87,6 +91,7 @@ from pretix.control.permissions import (
 from pretix.control.signals import item_forms, item_formsets
 from pretix.helpers.models import modelcopy
 
+from ...helpers import GroupConcat
 from ...helpers.compat import CompatDeleteView
 from . import ChartContainingView, CreateView, PaginationMixin, UpdateView
 
@@ -831,13 +836,38 @@ class QuestionCreate(EventPermissionRequiredMixin, QuestionMixin, CreateView):
         return ret
 
 
-class QuotaList(PaginationMixin, ListView):
+class QuotaQueryMixin:
+
+    @cached_property
+    def request_data(self):
+        if self.request.method == "POST":
+            return self.request.POST
+        return self.request.GET
+
+    def get_queryset(self):
+        qs = self.request.event.quotas
+        if self.filter_form.is_valid():
+            qs = self.filter_form.filter_qs(qs)
+
+        if 'quota' in self.request_data and '__ALL' not in self.request_data:
+            qs = qs.filter(
+                id__in=self.request_data.getlist('quota')
+            )
+
+        return qs
+
+    @cached_property
+    def filter_form(self):
+        return QuotaFilterForm(data=self.request_data, prefix='filter', event=self.request.event)
+
+
+class QuotaList(PaginationMixin, QuotaQueryMixin, ListView):
     model = Quota
     context_object_name = 'quotas'
     template_name = 'pretixcontrol/items/quotas.html'
 
     def get_queryset(self):
-        qs = self.request.event.quotas.prefetch_related(
+        return super().get_queryset().prefetch_related(
             Prefetch(
                 "items",
                 queryset=Item.objects.annotate(
@@ -852,28 +882,10 @@ class QuotaList(PaginationMixin, ListView):
                 queryset=self.request.event.subevents.all()
             )
         )
-        if self.request.GET.get("subevent", "") != "":
-            s = self.request.GET.get("subevent", "")
-            qs = qs.filter(subevent_id=s)
-
-        valid_orders = {
-            '-date': ('-subevent__date_from', 'name', 'pk'),
-            'date': ('subevent__date_from', '-name', '-pk'),
-            'size': ('size', 'name', 'pk'),
-            '-size': ('-size', '-name', '-pk'),
-            'name': ('name', 'pk'),
-            '-name': ('-name', '-pk'),
-        }
-
-        if self.request.GET.get("ordering", "-date") in valid_orders:
-            qs = qs.order_by(*valid_orders[self.request.GET.get("ordering", "-date")])
-        else:
-            qs = qs.order_by('name', 'subevent__date_from', 'pk')
-
-        return qs
 
     def get_context_data(self, **kwargs):
         ctx = super().get_context_data()
+        ctx['filter_form'] = self.filter_form
 
         qa = QuotaAvailability()
         qa.queue(*ctx['quotas'])
@@ -884,6 +896,165 @@ class QuotaList(PaginationMixin, ListView):
         return ctx
 
 
+class QuotaBulkAction(QuotaQueryMixin, EventPermissionRequiredMixin, View):
+    permission = 'event.items:write'
+
+    @transaction.atomic
+    def post(self, request, *args, **kwargs):
+        if request.POST.get('action') == 'delete':
+            return render(request, 'pretixcontrol/items/quota_delete_bulk.html', {
+                'allowed': self.get_queryset().select_related("subevent"),
+            })
+        elif request.POST.get('action') == 'delete_confirm':
+            log_entries = []
+            to_delete = []
+            for obj in self.get_queryset():
+                log_entries.append(obj.log_action('pretix.event.quota.deleted', user=self.request.user, save=False))
+                to_delete.append(obj.pk)
+
+            if to_delete:
+                LogEntry.bulk_create_and_postprocess(log_entries)
+                Quota.objects.filter(pk__in=to_delete).delete()
+            messages.success(request, _('The selected quotas have been deleted or disabled.'))
+        return redirect(self.get_success_url())
+
+    def get_success_url(self) -> str:
+        return reverse('control:event.items.quotas', kwargs={
+            'organizer': self.request.event.organizer.slug,
+            'event': self.request.event.slug,
+        })
+
+
+class QuotaBulkUpdateView(QuotaQueryMixin, EventPermissionRequiredMixin, FormView):
+    template_name = 'pretixcontrol/items/quota_bulk_edit.html'
+    permission = 'event.items:write'
+    context_object_name = 'quota'
+    form_class = QuotaBulkEditForm
+
+    def get_queryset(self):
+        return super().get_queryset().prefetch_related(None).order_by()
+
+    def get(self, request, *args, **kwargs):
+        return HttpResponse(status=405)
+
+    @cached_property
+    def is_submitted(self):
+        # Usually, django considers a form "bound" / "submitted" on every POST request. However, this view is always
+        # called with POST method, even if just to pass the selection of objects to work on, so we want to modify
+        # that behaviour
+        return '_bulk' in self.request.POST
+
+    def get_form_kwargs(self):
+        initial = {}
+        mixed_values = set()
+        qs = self.get_queryset().annotate(
+            items_list=Subquery(
+                Quota.items.through.objects.filter(
+                    quota_id=OuterRef('pk'),
+                    item__variations__isnull=True,
+                ).order_by().values('quota_id').annotate(
+                    g=GroupConcat('item_id', separator=',', ordered=True)
+                ).values('g')
+            ),
+            vars_list=Subquery(
+                Quota.variations.through.objects.filter(
+                    quota_id=OuterRef('pk')
+                ).order_by().values('quota_id').annotate(
+                    g=GroupConcat(
+                        Concat(
+                            Cast(F('itemvariation__item_id'), output_field=models.TextField()),
+                            Value('-', output_field=models.TextField()),
+                            Cast(F('itemvariation_id'), output_field=models.TextField()),
+                        ),
+                        separator=',',
+                        ordered=True
+                    )
+                ).values('g')
+            ),
+        )
+
+        fields = {
+            'name': 'name',
+            'size': 'size',
+            'subevent': 'subevent',
+            'close_when_sold_out': 'close_when_sold_out',
+            'release_after_exit': 'release_after_exit',
+            'ignore_for_event_availability': 'ignore_for_event_availability',
+        }
+        for k, f in fields.items():
+            existing_values = list(qs.order_by(f).values(f).annotate(c=Count('*')))
+            if len(existing_values) == 1:
+                initial[k] = existing_values[0][f]
+            elif len(existing_values) > 1:
+                mixed_values.add(k)
+                initial[k] = None
+
+        item_values = list(qs.order_by("items_list").values("items_list").annotate(c=Count('*')))
+        var_values = list(qs.order_by("vars_list").values("vars_list").annotate(c=Count('*')))
+        if len(item_values) > 1 or len(var_values) > 1:
+            mixed_values.add("itemvars")
+        else:
+            initial["itemvars"] = [iv for iv in (item_values[0]["items_list"] or "").split(",") + (var_values[0]["vars_list"] or "").split(",") if iv]
+
+        kwargs = super().get_form_kwargs()
+        kwargs['event'] = self.request.event
+        kwargs['prefix'] = 'bulkedit'
+        kwargs['initial'] = initial
+        kwargs['queryset'] = self.get_queryset()
+        kwargs['mixed_values'] = mixed_values
+        if not self.is_submitted:
+            kwargs['data'] = None
+            kwargs['files'] = None
+        return kwargs
+
+    def get_success_url(self):
+        return reverse('control:event.items.quotas', kwargs={
+            'organizer': self.request.event.organizer.slug,
+            'event': self.request.event.slug,
+        })
+
+    @transaction.atomic()
+    def form_valid(self, form):
+        log_entries = []
+
+        # Main form
+        form.save()
+        data = {
+            k: v
+            for k, v in form.cleaned_data.items()
+            if k in form.changed_data
+        }
+        data['_raw_bulk_data'] = self.request.POST.dict()
+        for obj in self.get_queryset():
+            log_entries.append(
+                obj.log_action('pretix.event.quota.changed', data=data, user=self.request.user, save=False)
+            )
+
+        LogEntry.bulk_create_and_postprocess(log_entries)
+
+        messages.success(self.request, _('Your changes have been saved.'))
+        return super().form_valid(form)
+
+    def get_context_data(self, **kwargs):
+        ctx = super().get_context_data(**kwargs)
+        ctx['quotas'] = self.get_queryset()
+        ctx['bulk_selected'] = self.request.POST.getlist("_bulk")
+        return ctx
+
+    def post(self, request, *args, **kwargs):
+        form = self.get_form()
+        is_valid = (
+            self.is_submitted and
+            form.is_valid()
+        )
+        if is_valid:
+            return self.form_valid(form)
+        else:
+            if self.is_submitted:
+                messages.error(self.request, _('We could not save your changes. See below for details.'))
+            return self.form_invalid(form)
+
+
 class QuotaCreate(EventPermissionRequiredMixin, CreateView):
     model = Quota
     form_class = QuotaForm

src/pretix/control/views/orders.py

@@ -2059,13 +2059,12 @@ class OrderChange(OrderView):
                 else:
                     variation = None
                 try:
-                    for i in range(f.cleaned_data.get("count", 1)):
-                        ocm.add_position(item, variation,
-                                         f.cleaned_data['price'],
-                                         f.cleaned_data.get('addon_to'),
-                                         f.cleaned_data.get('subevent'),
-                                         f.cleaned_data.get('seat'),
-                                         f.cleaned_data.get('used_membership'))
+                    ocm.add_position(item, variation,
+                                     f.cleaned_data['price'],
+                                     f.cleaned_data.get('addon_to'),
+                                     f.cleaned_data.get('subevent'),
+                                     f.cleaned_data.get('seat'),
+                                     f.cleaned_data.get('used_membership'))
                 except OrderError as e:
                     f.custom_error = str(e)
                     return False

src/pretix/control/views/organizer.py

@@ -1322,7 +1322,7 @@ class DeviceUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixi
     def form_valid(self, form):
         if form.has_changed():
             self.object.log_action('pretix.device.changed', user=self.request.user, data={
-                k: form.cleaned_data[k] if k != 'limit_events' else [e.id for e in form.cleaned_data[k]]
+                k: getattr(self.object, k) if k != 'limit_events' else [e.id for e in getattr(self.object, k).all()]
                 for k in form.changed_data
             })
 

src/pretix/helpers/database.py

@@ -117,12 +117,17 @@ class GroupConcat(Aggregate):
             template = "%(function)s(%(distinct)s%(field)s::text, '%(separator)s' ORDER BY %(field)s::text ASC)"
         else:
             template = "%(function)s(%(distinct)s%(field)s::text, '%(separator)s')"
-        return super().as_sql(
+
+        template, params = super().as_sql(
             compiler, connection,
             function='string_agg',
             template=template,
             **extra_context,
         )
+        if self.ordered:
+            # ordered statement requires field parameters twice
+            params = params + params
+        return template, params
 
 
 class ReplicaRouter:

src/pretix/helpers/monkeypatching.py

@@ -19,26 +19,12 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-import ipaddress
-import socket
-import sys
 import types
 from datetime import datetime
 from http import cookies
 
-from django.conf import settings
 from PIL import Image
 from requests.adapters import HTTPAdapter
-from urllib3.connection import HTTPConnection, HTTPSConnection
-from urllib3.connectionpool import HTTPConnectionPool, HTTPSConnectionPool
-from urllib3.exceptions import (
-    ConnectTimeoutError, HTTPError, LocationParseError, NameResolutionError,
-    NewConnectionError,
-)
-from urllib3.util.connection import (
-    _TYPE_SOCKET_OPTIONS, _set_socket_options, allowed_gai_family,
-)
-from urllib3.util.timeout import _DEFAULT_TIMEOUT
 
 
 def monkeypatch_vobject_performance():
@@ -103,123 +89,6 @@ def monkeypatch_requests_timeout():
     HTTPAdapter.send = httpadapter_send
 
 
-def monkeypatch_urllib3_ssrf_protection():
-    """
-    pretix allows HTTP requests to untrusted URLs, e.g. through webhooks or external API URLs. This is dangerous since
-    it can allow access to private networks that should not be reachable by users ("server-side request forgery", SSRF).
-    Validating URLs at submission is not sufficient, since with DNS rebinding an attacker can make a domain name pass
-    validation and then resolve to a private IP address on actual execution. Unfortunately, there seems no clean solution
-    to this in Python land, so we monkeypatch urllib3's connection management to check the IP address to be external
-    *after* the DNS resolution.
-
-    This does not work when a global http(s) proxy is used, but in that scenario the proxy can perform the validation.
-    """
-    if getattr(settings, "ALLOW_HTTP_TO_PRIVATE_NETWORKS", False):
-        # Settings are not supposed to change during runtime, so we can optimize performance and complexity by skipping
-        # this if not needed.
-        return
-
-    def create_connection(
-        address: tuple[str, int],
-        timeout=_DEFAULT_TIMEOUT,
-        source_address: tuple[str, int] | None = None,
-        socket_options: _TYPE_SOCKET_OPTIONS | None = None,
-    ) -> socket.socket:
-        # This is copied from urllib3.util.connection v2.3.0
-        host, port = address
-        if host.startswith("["):
-            host = host.strip("[]")
-        err = None
-
-        # Using the value from allowed_gai_family() in the context of getaddrinfo lets
-        # us select whether to work with IPv4 DNS records, IPv6 records, or both.
-        # The original create_connection function always returns all records.
-        family = allowed_gai_family()
-
-        try:
-            host.encode("idna")
-        except UnicodeError:
-            raise LocationParseError(f"'{host}', label empty or too long") from None
-
-        for res in socket.getaddrinfo(host, port, family, socket.SOCK_STREAM):
-            af, socktype, proto, canonname, sa = res
-
-            if not getattr(settings, "ALLOW_HTTP_TO_PRIVATE_NETWORKS", False):
-                ip_addr = ipaddress.ip_address(sa[0])
-                if ip_addr.is_multicast:
-                    raise HTTPError(f"Request to multicast address {sa[0]} blocked")
-                if ip_addr.is_loopback or ip_addr.is_link_local:
-                    raise HTTPError(f"Request to local address {sa[0]} blocked")
-                if ip_addr.is_private:
-                    raise HTTPError(f"Request to private address {sa[0]} blocked")
-
-            sock = None
-            try:
-                sock = socket.socket(af, socktype, proto)
-
-                # If provided, set socket level options before connecting.
-                _set_socket_options(sock, socket_options)
-
-                if timeout is not _DEFAULT_TIMEOUT:
-                    sock.settimeout(timeout)
-                if source_address:
-                    sock.bind(source_address)
-                sock.connect(sa)
-                # Break explicitly a reference cycle
-                err = None
-                return sock
-
-            except OSError as _:
-                err = _
-                if sock is not None:
-                    sock.close()
-
-        if err is not None:
-            try:
-                raise err
-            finally:
-                # Break explicitly a reference cycle
-                err = None
-        else:
-            raise OSError("getaddrinfo returns an empty list")
-
-    class ProtectionMixin:
-        def _new_conn(self) -> socket.socket:
-            # This is 1:1 the version from urllib3.connection.HTTPConnection._new_conn v2.3.0
-            # just with a call to our own create_connection
-            try:
-                sock = create_connection(
-                    (self._dns_host, self.port),
-                    self.timeout,
-                    source_address=self.source_address,
-                    socket_options=self.socket_options,
-                )
-            except socket.gaierror as e:
-                raise NameResolutionError(self.host, self, e) from e
-            except socket.timeout as e:
-                raise ConnectTimeoutError(
-                    self,
-                    f"Connection to {self.host} timed out. (connect timeout={self.timeout})",
-                ) from e
-
-            except OSError as e:
-                raise NewConnectionError(
-                    self, f"Failed to establish a new connection: {e}"
-                ) from e
-
-            sys.audit("http.client.connect", self, self.host, self.port)
-            return sock
-
-    class ProtectedHTTPConnection(ProtectionMixin, HTTPConnection):
-        pass
-
-    class ProtectedHTTPSConnection(ProtectionMixin, HTTPSConnection):
-        pass
-
-    HTTPConnectionPool.ConnectionCls = ProtectedHTTPConnection
-    HTTPSConnectionPool.ConnectionCls = ProtectedHTTPSConnection
-
-
 def monkeypatch_cookie_morsel():
     # See https://code.djangoproject.com/ticket/34613
     cookies.Morsel._flags.add("partitioned")
@@ -230,5 +99,4 @@ def monkeypatch_all_at_ready():
     monkeypatch_vobject_performance()
     monkeypatch_pillow_safer()
     monkeypatch_requests_timeout()
-    monkeypatch_urllib3_ssrf_protection()
     monkeypatch_cookie_morsel()

src/pretix/locale/de/wordlist.txt

@@ -32,7 +32,6 @@ ausgecheckt
 ausgeklappt
 auswahl
 Authentication
-Authenticator
 Authenticator-App
 Autorisierungscode
 Autorisierungs-Endpunktes
@@ -131,7 +130,6 @@ Eingangsscan
 Einlassbuchung
 Einlassdatum
 Einlasskontrolle
-Einmalpasswörter
 einzuchecken
 email
 E-Mail-Renderer
@@ -165,7 +163,6 @@ Explorer
 FA
 Favicon
 F-Droid
-freeOTP
 Footer
 Footer-Link
 Footer-Text
@@ -560,7 +557,6 @@ Zahlungs-ID
 Zahlungspflichtig
 Zehnerkarten
 Zeitbasiert
-zeitbasierte
 Zeitslotbuchung
 Zimpler
 ZIP-Datei

src/pretix/locale/de_Informal/wordlist.txt

@@ -32,7 +32,6 @@ ausgecheckt
 ausgeklappt
 auswahl
 Authentication
-Authenticator
 Authenticator-App
 Autorisierungscode
 Autorisierungs-Endpunktes
@@ -131,7 +130,6 @@ Eingangsscan
 Einlassbuchung
 Einlassdatum
 Einlasskontrolle
-Einmalpasswörter
 einzuchecken
 email
 E-Mail-Renderer
@@ -165,7 +163,6 @@ Explorer
 FA
 Favicon
 F-Droid
-freeOTP
 Footer
 Footer-Link
 Footer-Text
@@ -560,7 +557,6 @@ Zahlungs-ID
 Zahlungspflichtig
 Zehnerkarten
 Zeitbasiert
-zeitbasierte
 Zeitslotbuchung
 Zimpler
 ZIP-Datei

src/pretix/locale/djangojs.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-03-30 11:25+0000\n"
+"POT-Creation-Date: 2026-03-17 14:06+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"

src/pretix/locale/es/LC_MESSAGES/djangojs.po

@@ -8,7 +8,7 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-03-17 14:06+0000\n"
-"PO-Revision-Date: 2026-03-30 03:00+0000\n"
+"PO-Revision-Date: 2026-03-18 12:23+0000\n"
 "Last-Translator: CVZ-es <damien.bremont@casadevelazquez.org>\n"
 "Language-Team: Spanish <https://translate.pretix.eu/projects/pretix/pretix-"
 "js/es/>\n"
@@ -329,7 +329,7 @@ msgstr "Pedido no aprobado"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:68
 msgid "Checked-in Tickets"
-msgstr "Billetes registrados"
+msgstr "Registro de código QR"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:69
 msgid "Valid Tickets"

src/pretix/locale/wordlist.txt

@@ -12,7 +12,6 @@ anonymized
 Auth
 authentification
 authenticator
-Authenticator
 automatical
 availabilities
 backend
@@ -23,7 +22,6 @@ barcodes
 Bcc
 BCC
 BezahlCode
-biometric
 BLIK
 blocklist
 BN
@@ -58,7 +56,6 @@ EPS
 eps
 favicon
 filetype
-freeOTP
 frontend
 frontpage
 Galician

src/pretix/presale/forms/customer.py

@@ -28,7 +28,7 @@ from django import forms
 from django.conf import settings
 from django.contrib.auth.hashers import check_password
 from django.contrib.auth.password_validation import (
-    MinimumLengthValidator, get_password_validators, validate_password,
+    get_password_validators, password_validators_help_texts, validate_password,
 )
 from django.contrib.auth.tokens import PasswordResetTokenGenerator
 from django.core import signing
@@ -83,7 +83,7 @@ class AuthenticationForm(forms.Form):
         self.request = request
         self.customer_cache = None
         super().__init__(*args, **kwargs)
-        self.fields['password'].help_text = "<a target='_blank' href='{}'>{}</a>".format(
+        self.fields['password'].help_text = "<a href='{}'>{}</a>".format(
             build_absolute_uri(False, 'presale:organizer.customer.resetpw', kwargs={
                 'organizer': request.organizer.slug,
             }),
@@ -296,17 +296,17 @@ class SetPasswordForm(forms.Form):
     }
     email = forms.EmailField(
         label=_('Email'),
-        widget=forms.EmailInput(attrs={'autocomplete': 'username', 'readonly': 'readonly'}),
-        required=False,
+        disabled=True
     )
     password = forms.CharField(
         label=_('Password'),
-        widget=forms.PasswordInput(attrs={'autocomplete': 'new-password'}),
+        widget=forms.PasswordInput(attrs={'minlength': '8', 'autocomplete': 'new-password'}),
         max_length=4096,
+        required=True
     )
     password_repeat = forms.CharField(
         label=_('Repeat password'),
-        widget=forms.PasswordInput(attrs={'autocomplete': 'new-password'}),
+        widget=forms.PasswordInput(attrs={'minlength': '8', 'autocomplete': 'new-password'}),
         max_length=4096,
     )
 
@@ -316,14 +316,6 @@ class SetPasswordForm(forms.Form):
         kwargs['initial']['email'] = self.customer.email
         super().__init__(*args, **kwargs)
 
-        pw_min_len_validators = [v for v in get_customer_password_validators() if isinstance(v, MinimumLengthValidator)]
-        if pw_min_len_validators:
-            self.fields['password'].widget.attrs['minlength'] = max(v.min_length for v in pw_min_len_validators)
-            self.fields['password_repeat'].widget.attrs['minlength'] = max(v.min_length for v in pw_min_len_validators)
-
-        if 'password' not in self.data:
-            self.fields['password'].help_text = ' '.join(v.get_help_text() for v in pw_min_len_validators)
-
     def clean(self):
         password1 = self.cleaned_data.get('password', '')
         password2 = self.cleaned_data.get('password_repeat')
@@ -337,7 +329,8 @@ class SetPasswordForm(forms.Form):
 
     def clean_password(self):
         password1 = self.cleaned_data.get('password', '')
-        validate_password(password1, user=self.customer, password_validators=get_customer_password_validators())
+        if validate_password(password1, user=self.customer, password_validators=get_customer_password_validators()) is not None:
+            raise forms.ValidationError(_(password_validators_help_texts()), code='pw_invalid')
         return password1
 
 
@@ -402,13 +395,13 @@ class ChangePasswordForm(forms.Form):
     )
     password = forms.CharField(
         label=_('New password'),
-        widget=forms.PasswordInput(attrs={'autocomplete': 'new-password'}),
+        widget=forms.PasswordInput(attrs={'minlength': '8', 'autocomplete': 'new-password'}),
         max_length=4096,
         required=True
     )
     password_repeat = forms.CharField(
         label=_('Repeat password'),
-        widget=forms.PasswordInput(attrs={'autocomplete': 'new-password'}),
+        widget=forms.PasswordInput(attrs={'minlength': '8', 'autocomplete': 'new-password'}),
         max_length=4096,
     )
 
@@ -418,14 +411,6 @@ class ChangePasswordForm(forms.Form):
         kwargs['initial']['email'] = self.customer.email
         super().__init__(*args, **kwargs)
 
-        pw_min_len_validators = [v for v in get_customer_password_validators() if isinstance(v, MinimumLengthValidator)]
-        if pw_min_len_validators:
-            self.fields['password'].widget.attrs['minlength'] = max(v.min_length for v in pw_min_len_validators)
-            self.fields['password_repeat'].widget.attrs['minlength'] = max(v.min_length for v in pw_min_len_validators)
-
-        if 'password' not in self.data:
-            self.fields['password'].help_text = ' '.join(v.get_help_text() for v in pw_min_len_validators)
-
     def clean(self):
         password1 = self.cleaned_data.get('password', '')
         password2 = self.cleaned_data.get('password_repeat')
@@ -439,7 +424,8 @@ class ChangePasswordForm(forms.Form):
 
     def clean_password(self):
         password1 = self.cleaned_data.get('password', '')
-        validate_password(password1, user=self.customer, password_validators=get_customer_password_validators())
+        if validate_password(password1, user=self.customer, password_validators=get_customer_password_validators()) is not None:
+            raise forms.ValidationError(_(password_validators_help_texts()), code='pw_invalid')
         return password1
 
     def clean_password_current(self):

src/pretix/presale/views/__init__.py

@@ -70,21 +70,18 @@ def cached_invoice_address(request):
             # do not create a session, if we don't have a session we also don't have an invoice address ;)
             request._checkout_flow_invoice_address = InvoiceAddress()
             return request._checkout_flow_invoice_address
-        cs = cart_session(request, create=False)
-        if cs is None:
+        cs = cart_session(request)
+        iapk = cs.get('invoice_address')
+        if not iapk:
             request._checkout_flow_invoice_address = InvoiceAddress()
         else:
-            iapk = cs.get('invoice_address')
-            if not iapk:
+            try:
+                with scopes_disabled():
+                    request._checkout_flow_invoice_address = InvoiceAddress.objects.get(
+                        pk=iapk, order__isnull=True
+                    )
+            except InvoiceAddress.DoesNotExist:
                 request._checkout_flow_invoice_address = InvoiceAddress()
-            else:
-                try:
-                    with scopes_disabled():
-                        request._checkout_flow_invoice_address = InvoiceAddress.objects.get(
-                            pk=iapk, order__isnull=True
-                        )
-                except InvoiceAddress.DoesNotExist:
-                    request._checkout_flow_invoice_address = InvoiceAddress()
     return request._checkout_flow_invoice_address
 
 
@@ -114,12 +111,6 @@ class CartMixin:
         return cached_invoice_address(self.request)
 
     def get_cart(self, answers=False, queryset=None, order=None, downloads=False, payments=None):
-        if not self.request.session.session_key and not order:
-            # The user has not even a session ID yet, so they can't have a cart and we can save a lot of work
-            return {
-                'positions': [],
-                # Other keys are not used on non-checkout pages
-            }
         if queryset is not None:
             prefetch = []
             if answers:
@@ -175,8 +166,7 @@ class CartMixin:
         else:
             fees = []
 
-        if not order and lcp:
-            # Do not re-round for empty cart (useless) or confirmed order (incorrect)
+        if not order:
             apply_rounding(self.request.event.settings.tax_rounding, self.invoice_address, self.request.event.currency, [*lcp, *fees])
 
         total = sum([c.price for c in lcp]) + sum([f.value for f in fees])
@@ -287,12 +277,6 @@ class CartMixin:
         }
 
     def current_selected_payments(self, positions, fees, invoice_address, *, warn=False):
-        from pretix.presale.views.cart import get_or_create_cart_id
-
-        if not get_or_create_cart_id(self.request, create=False):
-            # No active cart ID, no payments there
-            return []
-
         raw_payments = copy.deepcopy(self.cart_session.get('payments', []))
         fees = [f for f in fees if f.fee_type != OrderFee.FEE_TYPE_PAYMENT]  # we re-compute these here
 

src/pretix/presale/views/cart.py

@@ -417,7 +417,7 @@ def get_or_create_cart_id(request, create=True):
     return new_id
 
 
-def cart_session(request, create=True):
+def cart_session(request):
     """
     Before pretix 1.8.0, all checkout-related information (like the entered email address) was stored
     in the user's regular session dictionary. This led to data interference and leaks for example if a
@@ -428,9 +428,7 @@ def cart_session(request, create=True):
     active cart session sub-dictionary for read and write access.
     """
     request.session.modified = True
-    cart_id = get_or_create_cart_id(request, create=create)
-    if not cart_id and not create:
-        return None
+    cart_id = get_or_create_cart_id(request)
     return request.session['carts'][cart_id]
 
 

src/pretix/presale/views/event.py

@@ -681,6 +681,8 @@ class EventIndex(EventViewMixin, EventListMixin, CartMixin, TemplateView):
         context = {}
         context['list_type'] = self.request.GET.get("style", self.request.event.settings.event_list_type)
         if context['list_type'] not in ("calendar", "week") and self.request.event.subevents.filter(date_from__gt=time_machine_now()).count() > 50:
+            if self.request.event.settings.event_list_type not in ("calendar", "week"):
+                self.request.event.settings.event_list_type = "calendar"
             context['list_type'] = "calendar"
 
         if context['list_type'] == "calendar":

src/pretix/presale/views/waiting.py

@@ -66,27 +66,22 @@ class WaitingView(EventViewMixin, FormView):
                 if customer else None
             ),
         )
-        groups = {}
+        choices = []
         for i in items:
             if not i.allow_waitinglist:
                 continue
 
-            category_name = str(i.category.name) if i.category else ''
-            group = groups.setdefault(category_name, [])
-
             if i.has_variations:
                 for v in i.available_variations:
                     if v.cached_availability[0] == Quota.AVAILABILITY_OK:
                         continue
-                    group.append((f'{i.pk}-{v.pk}', f'{i.name} – {v.value}'))
+                    choices.append((f'{i.pk}-{v.pk}', f'{i.name} – {v.value}'))
 
             else:
                 if i.cached_availability[0] == Quota.AVAILABILITY_OK:
                     continue
-                group.append((f'{i.pk}', f'{i.name}'))
-
-        # Remove categories where all items were available (no waiting list choices)
-        return [(cat, choices) for cat, choices in groups.items() if choices]
+                choices.append((f'{i.pk}', f'{i.name}'))
+        return choices
 
     def get_form_kwargs(self):
         kwargs = super().get_form_kwargs()

src/pretix/presale/views/widget.py

@@ -530,10 +530,12 @@ class WidgetAPIProductList(EventListMixin, View):
         ]
 
         if hasattr(self.request, 'event') and data['list_type'] not in ("calendar", "week"):
-            # only allow list-view of more than 50 subevents if ordering is by date as this can be done in the database
+            # only allow list-view of more than 50 subevents if ordering is by data as this can be done in the database
             # ordering by name is currently not supported in database due to I18NField-JSON
             ordering = self.request.event.settings.get('frontpage_subevent_ordering', default='date_ascending', as_type=str)
             if ordering not in ("date_ascending", "date_descending") and self.request.event.subevents.filter(date_from__gt=now()).count() > 50:
+                if self.request.event.settings.event_list_type not in ("calendar", "week"):
+                    self.request.event.settings.event_list_type = "calendar"
                 data['list_type'] = list_type = 'calendar'
 
         if hasattr(self.request, 'event'):

src/pretix/settings.py

@@ -157,7 +157,7 @@ DATABASES = {
         'HOST': config.get('database', 'host', fallback=''),
         'PORT': config.get('database', 'port', fallback=''),
         'CONN_MAX_AGE': 0 if db_backend == 'sqlite3' else 120,
-        'CONN_HEALTH_CHECKS': db_backend != 'sqlite3',
+        'CONN_HEALTH_CHECKS': db_backend != 'sqlite3',  # Will only be used from Django 4.1 onwards
         'DISABLE_SERVER_SIDE_CURSORS': db_disable_server_side_cursors,
         'OPTIONS': db_options,
         'TEST': {}
@@ -179,21 +179,6 @@ if config.has_section('replica'):
     }
     DATABASE_ROUTERS = ['pretix.helpers.database.ReplicaRouter']
 
-if config.has_section('dbreadonly'):
-    DATABASES['readonly'] = {
-        'ENGINE': 'django.db.backends.' + db_backend,
-        'NAME': config.get('dbreadonly', 'name', fallback=DATABASES['default']['NAME']),
-        'USER': config.get('dbreadonly', 'user', fallback=DATABASES['default']['USER']),
-        'PASSWORD': config.get('dbreadonly', 'password', fallback=DATABASES['default']['PASSWORD']),
-        'HOST': config.get('dbreadonly', 'host', fallback=DATABASES['default']['HOST']),
-        'PORT': config.get('dbreadonly', 'port', fallback=DATABASES['default']['PORT']),
-        'CONN_MAX_AGE': 0,  # do not spam primary with open connections as long as readonly is only used occasionally
-        'CONN_HEALTH_CHECKS': db_backend != 'sqlite3',
-        'DISABLE_SERVER_SIDE_CURSORS': db_disable_server_side_cursors,
-        'OPTIONS': db_options,
-        'TEST': {}
-    }
-
 STATIC_URL = config.get('urls', 'static', fallback='/static/')
 
 MEDIA_URL = config.get('urls', 'media', fallback='/media/')
@@ -223,7 +208,6 @@ CSRF_TRUSTED_ORIGINS = [urlparse(SITE_URL).scheme + '://' + urlparse(SITE_URL).h
 
 TRUST_X_FORWARDED_FOR = config.getboolean('pretix', 'trust_x_forwarded_for', fallback=False)
 USE_X_FORWARDED_HOST = config.getboolean('pretix', 'trust_x_forwarded_host', fallback=False)
-ALLOW_HTTP_TO_PRIVATE_NETWORKS = config.getboolean('pretix', 'allow_http_to_private_networks', fallback=False)
 
 
 REQUEST_ID_HEADER = config.get('pretix', 'request_id_header', fallback=False)
@@ -264,8 +248,7 @@ EMAIL_HOST_PASSWORD = config.get('mail', 'password', fallback='')
 EMAIL_USE_TLS = config.getboolean('mail', 'tls', fallback=False)
 EMAIL_USE_SSL = config.getboolean('mail', 'ssl', fallback=False)
 EMAIL_SUBJECT_PREFIX = '[pretix] '
-EMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend'
-EMAIL_CUSTOM_SMTP_BACKEND = 'pretixbase.email.CheckPrivateNetworkSmtpBackend'
+EMAIL_BACKEND = EMAIL_CUSTOM_SMTP_BACKEND = 'django.core.mail.backends.smtp.EmailBackend'
 EMAIL_TIMEOUT = 60
 
 ADMINS = [('Admin', n) for n in config.get('mail', 'admins', fallback='').split(",") if n]

src/pretix/static/npm_dir/package-lock.json

@@ -1835,9 +1835,10 @@
       "integrity": "sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg=="
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.13",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
-      "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
+      "version": "1.1.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
+      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+      "license": "MIT",
       "optional": true,
       "dependencies": {
         "balanced-match": "^1.0.0",
@@ -2878,9 +2879,9 @@
       "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA=="
     },
     "node_modules/picomatch": {
-      "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
-      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
+      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
       "engines": {
         "node": ">=8.6"
       },
@@ -4935,9 +4936,9 @@
       "integrity": "sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg=="
     },
     "brace-expansion": {
-      "version": "1.1.13",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
-      "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
+      "version": "1.1.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
+      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
       "optional": true,
       "requires": {
         "balanced-match": "^1.0.0",
@@ -5714,9 +5715,9 @@
       "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA=="
     },
     "picomatch": {
-      "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
-      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA=="
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
+      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA=="
     },
     "pify": {
       "version": "4.0.1",