Add voucher tag to orderlist positions export

Safari currently exhibits a bug where Partitioned cookies (CHIPS) are not
sent back to the originating site after multi-hop cross-site redirects,
breaking SSO login flows in pretix.

Partitioned cookies were initially introduced in Safari 18.4, removed
again in 18.5 due to a bug, and reintroduced in Safari 26.2, where the
current issue is present.

As a mitigation, disable sending the `Partitioned` attribute for Safari
user agents. This is intentionally conservative; once the Safari issue
is fixed, this check should be refined to be conditional on the affected
versions only.

WebKit issues:

  - https://bugs.webkit.org/show_bug.cgi?id=292975
  - https://bugs.webkit.org/show_bug.cgi?id=306194

pyproject.toml

@@ -92,7 +92,7 @@ dependencies = [
   "redis==7.1.*",
   "reportlab==4.4.*",
   "requests==2.32.*",
-  "sentry-sdk==2.52.*",
+  "sentry-sdk==2.53.*",
   "sepaxml==2.7.*",
   "stripe==7.9.*",
   "text-unidecode==1.*",
@@ -110,7 +110,7 @@ dev = [
   "aiohttp==3.13.*",
   "coverage",
   "coveralls",
-  "fakeredis==2.33.*",
+  "fakeredis==2.34.*",
   "flake8==7.3.*",
   "freezegun",
   "isort==7.0.*",

src/pretix/api/views/checkin.py

@@ -188,11 +188,15 @@ class CheckinListViewSet(viewsets.ModelViewSet):
         clist = self.get_object()
         if serializer.validated_data.get('nonce'):
             if kwargs.get('position'):
-                prev = kwargs['position'].all_checkins.filter(nonce=serializer.validated_data['nonce']).first()
+                prev = kwargs['position'].all_checkins.filter(
+                    nonce=serializer.validated_data['nonce'],
+                    successful=False
+                ).first()
             else:
                 prev = clist.checkins.filter(
                     nonce=serializer.validated_data['nonce'],
                     raw_barcode=serializer.validated_data['raw_barcode'],
+                    successful=False
                 ).first()
             if prev:
                 # Ignore because nonce is already handled

src/pretix/base/email.py

@@ -22,7 +22,7 @@
 import logging
 from itertools import groupby
 from smtplib import SMTPResponseException
-from typing import TypeVar, Union
+from typing import TypeVar
 
 import bleach
 import css_inline
@@ -31,7 +31,6 @@ from django.core.mail.backends.smtp import EmailBackend
 from django.db.models import Count
 from django.dispatch import receiver
 from django.template.loader import get_template
-from django.utils.safestring import mark_safe
 from django.utils.translation import get_language, gettext_lazy as _
 
 from pretix.base.models import Event
@@ -40,9 +39,7 @@ from pretix.base.templatetags.rich_text import (
     DEFAULT_CALLBACKS, EMAIL_RE, URL_RE, abslink_callback,
     markdown_compile_email, truelink_callback,
 )
-from pretix.helpers.format import (
-    FormattedString, PlainHtmlAlternativeString, SafeFormatter, format_map,
-)
+from pretix.helpers.format import FormattedString, SafeFormatter, format_map
 
 from pretix.base.services.placeholders import (  # noqa
     get_available_placeholders, PlaceholderContext
@@ -86,8 +83,8 @@ class BaseHTMLMailRenderer:
     def __str__(self):
         return self.identifier
 
-    def render(self, content: Union[str, FormattedString, PlainHtmlAlternativeString], plain_signature: str,
-               subject: str, order=None, position=None, context=None) -> str:
+    def render(self, plain_body: str, plain_signature: str, subject: str, order=None,
+               position=None, context=None) -> str:
         """
         This method should generate the HTML part of the email.
 
@@ -143,37 +140,27 @@ class TemplateBasedMailRenderer(BaseHTMLMailRenderer):
     def compile_markdown(self, plaintext, context=None):
         return markdown_compile_email(plaintext, context=context)
 
-    def render(self, content: Union[str, FormattedString, PlainHtmlAlternativeString], plain_signature: str,
-               subject: str, order=None, position=None, context=None) -> str:
-        if isinstance(content, FormattedString):
-            # Raw string that is already formatted but not markdown-rendered
-            body_content_html = self.compile_markdown(content, context)
-
-        elif isinstance(content, PlainHtmlAlternativeString):
-            # HTML already rendered by Django templates
-            body_content_html = content.html
-
-        else:
-            # Raw string that is not yet formatted or markdown-rendered
-            body_content_html = self.compile_markdown(content, context)
-            if context:
-                linker = bleach.Linker(
-                    url_re=URL_RE,
-                    email_re=EMAIL_RE,
-                    callbacks=DEFAULT_CALLBACKS + [truelink_callback, abslink_callback],
-                    parse_email=True
-                )
-                body_content_html = format_map(
-                    body_content_html,
+    def render(self, plain_body: str, plain_signature: str, subject: str, order, position, context) -> str:
+        apply_format_map = not isinstance(plain_body, FormattedString)
+        body_md = self.compile_markdown(plain_body, context)
+        if context:
+            linker = bleach.Linker(
+                url_re=URL_RE,
+                email_re=EMAIL_RE,
+                callbacks=DEFAULT_CALLBACKS + [truelink_callback, abslink_callback],
+                parse_email=True
+            )
+            if apply_format_map:
+                body_md = format_map(
+                    body_md,
                     context=context,
                     mode=SafeFormatter.MODE_RICH_TO_HTML,
                     linkifier=linker
                 )
-
         htmlctx = {
             'site': settings.PRETIX_INSTANCE_NAME,
             'site_url': settings.SITE_URL,
-            'body': mark_safe(body_content_html),
+            'body': body_md,
             'subject': str(subject),
             'color': settings.PRETIX_PRIMARY_COLOR,
             'rtl': get_language() in settings.LANGUAGES_RTL or get_language().split('-')[0] in settings.LANGUAGES_RTL,

src/pretix/base/exporters/orderlist.py

@@ -651,6 +651,7 @@ class OrderListExporter(MultiSheetListExporter):
             pgettext('address', 'State'),
             _('Voucher'),
             _('Voucher budget usage'),
+            _('Voucher tag'),
             _('Pseudonymization ID'),
             _('Ticket secret'),
             _('Seat ID'),
@@ -769,6 +770,7 @@ class OrderListExporter(MultiSheetListExporter):
                     op.state_for_address or '',
                     op.voucher.code if op.voucher else '',
                     op.voucher_budget_use if op.voucher_budget_use else '',
+                    op.voucher.tag if op.voucher else '',
                     op.pseudonymization_id,
                     op.secret,
                 ]

src/pretix/base/invoicing/email.py

@@ -33,7 +33,8 @@ from pretix.base.invoicing.transmission import (
     transmission_types,
 )
 from pretix.base.models import Invoice, InvoiceAddress
-from pretix.base.services.mail import mail
+from pretix.base.services.mail import mail, render_mail
+from pretix.helpers.format import format_map
 
 
 @transmission_types.new()
@@ -133,7 +134,9 @@ class EmailTransmissionProvider(TransmissionProvider):
             subject = invoice.order.event.settings.get('mail_subject_order_invoice', as_type=LazyI18nString)
 
             # Do not set to completed because that is done by the email sending task
-            outgoing_mail = mail(
+            subject = format_map(subject, context)
+            email_content = render_mail(template, context)
+            mail(
                 [recipient],
                 subject,
                 template,
@@ -148,10 +151,19 @@ class EmailTransmissionProvider(TransmissionProvider):
                 plain_text_only=True,
                 no_order_links=True,
             )
-            if outgoing_mail:
-                invoice.order.log_action(
-                    'pretix.event.order.email.invoice',
-                    user=None,
-                    auth=None,
-                    data=outgoing_mail.log_data()
-                )
+            invoice.order.log_action(
+                'pretix.event.order.email.invoice',
+                user=None,
+                auth=None,
+                data={
+                    'subject': subject,
+                    'message': email_content,
+                    'position': None,
+                    'recipient': recipient,
+                    'invoices': [invoice.pk],
+                    'attach_tickets': False,
+                    'attach_ical': False,
+                    'attach_other_files': [],
+                    'attach_cached_files': [],
+                }
+            )

src/pretix/base/modelimport_vouchers.py

@@ -132,7 +132,7 @@ class AllowIgnoreQuotaColumn(BooleanColumnMixin, ImportColumn):
 
 class PriceModeColumn(ImportColumn):
     identifier = 'price_mode'
-    verbose_name = gettext_lazy('Price mode')
+    verbose_name = gettext_lazy('Price effect')
     default_value = None
     initial = 'static:none'
 
@@ -147,7 +147,7 @@ class PriceModeColumn(ImportColumn):
         elif value in reverse:
             return reverse[value]
         else:
-            raise ValidationError(_("Could not parse {value} as a price mode, use one of {options}.").format(
+            raise ValidationError(_("Could not parse {value} as a price effect, use one of {options}.").format(
                 value=value, options=', '.join(d.keys())
             ))
 
@@ -162,7 +162,7 @@ class ValueColumn(DecimalColumnMixin, ImportColumn):
     def clean(self, value, previous_values):
         value = super().clean(value, previous_values)
         if value and previous_values.get("price_mode") == "none":
-            raise ValidationError(_("It is pointless to set a value without a price mode."))
+            raise ValidationError(_("It is pointless to set a value without a price effect."))
         return value
 
     def assign(self, value, obj: Voucher, **kwargs):

src/pretix/base/models/mail.py

@@ -220,20 +220,3 @@ class OutgoingMail(models.Model):
             error_log_action_type = 'pretix.email.error'
             log_target = None
         return log_target, error_log_action_type
-
-    def log_data(self):
-        return {
-            "subject": self.subject,
-            "message": self.body_plain,
-            "to": self.to,
-            "cc": self.cc,
-            "bcc": self.bcc,
-
-            "invoices": [i.pk for i in self.should_attach_invoices.all()],
-            "attach_tickets": self.should_attach_tickets,
-            "attach_ical": self.should_attach_ical,
-            "attach_other_files": self.should_attach_other_files,
-            "attach_cached_files": [cf.filename for cf in self.should_attach_cached_files.all()],
-
-            "position": self.orderposition.positionid if self.orderposition else None,
-        }

src/pretix/base/models/orders.py

@@ -87,6 +87,7 @@ from pretix.base.timemachine import time_machine_now
 
 from ...helpers import OF_SELF
 from ...helpers.countries import CachedCountries, FastCountryField
+from ...helpers.format import FormattedString, format_map
 from ...helpers.names import build_name
 from ...testutils.middleware import debugflags_var
 from ._transactions import (
@@ -1166,7 +1167,7 @@ class Order(LockModel, LoggedModel):
                          only be attached for this position and child positions, the link will only point to the
                          position and the attendee email will be used if available.
         """
-        from pretix.base.services.mail import mail
+        from pretix.base.services.mail import mail, render_mail
 
         if not self.email and not (position and position.attendee_email):
             return
@@ -1176,20 +1177,32 @@ class Order(LockModel, LoggedModel):
             if position and position.attendee_email:
                 recipient = position.attendee_email
 
-            outgoing_mail = mail(
+            email_content = render_mail(template, context)
+            if not isinstance(subject, FormattedString):
+                subject = format_map(subject, context)
+            mail(
                 recipient, subject, template, context,
                 self.event, self.locale, self, headers=headers, sender=sender,
                 invoices=invoices, attach_tickets=attach_tickets,
                 position=position, auto_email=auto_email, attach_ical=attach_ical,
                 attach_other_files=attach_other_files, attach_cached_files=attach_cached_files,
             )
-            if outgoing_mail:
-                self.log_action(
-                    log_entry_type,
-                    user=user,
-                    auth=auth,
-                    data=outgoing_mail.log_data(),
-                )
+            self.log_action(
+                log_entry_type,
+                user=user,
+                auth=auth,
+                data={
+                    'subject': subject,
+                    'message': email_content,
+                    'position': position.positionid if position else None,
+                    'recipient': recipient,
+                    'invoices': [i.pk for i in invoices] if invoices else [],
+                    'attach_tickets': attach_tickets,
+                    'attach_ical': attach_ical,
+                    'attach_other_files': attach_other_files,
+                    'attach_cached_files': [cf.filename for cf in attach_cached_files] if attach_cached_files else [],
+                }
+            )
 
     def resend_link(self, user=None, auth=None):
         with language(self.locale, self.event.settings.region):
@@ -2887,14 +2900,17 @@ class OrderPosition(AbstractPosition):
         :param attach_tickets: Attach tickets of this order, if they are existing and ready to download
         :param attach_ical: Attach relevant ICS files
         """
-        from pretix.base.services.mail import mail
+        from pretix.base.services.mail import mail, render_mail
 
         if not self.attendee_email:
             return
 
         with language(self.order.locale, self.order.event.settings.region):
             recipient = self.attendee_email
-            outgoing_mail = mail(
+            email_content = render_mail(template, context)
+            if not isinstance(subject, FormattedString):
+                subject = format_map(subject, context)
+            mail(
                 recipient, subject, template, context,
                 self.event, self.order.locale, order=self.order, headers=headers, sender=sender,
                 position=self,
@@ -2903,13 +2919,21 @@ class OrderPosition(AbstractPosition):
                 attach_ical=attach_ical,
                 attach_other_files=attach_other_files,
             )
-            if outgoing_mail:
-                self.order.log_action(
-                    log_entry_type,
-                    user=user,
-                    auth=auth,
-                    data=outgoing_mail.log_data(),
-                )
+            self.order.log_action(
+                log_entry_type,
+                user=user,
+                auth=auth,
+                data={
+                    'subject': subject,
+                    'message': email_content,
+                    'recipient': recipient,
+                    'invoices': [i.pk for i in invoices] if invoices else [],
+                    'attach_tickets': attach_tickets,
+                    'attach_ical': attach_ical,
+                    'attach_other_files': attach_other_files,
+                    'attach_cached_files': [],
+                }
+            )
 
     def resend_link(self, user=None, auth=None):
 

src/pretix/base/models/vouchers.py

@@ -239,7 +239,7 @@ class Voucher(LoggedModel):
         )
     )
     price_mode = models.CharField(
-        verbose_name=_("Price mode"),
+        verbose_name=_("Price effect"),
         max_length=100,
         choices=PRICE_MODES,
         default='none'

src/pretix/base/models/waitinglist.py

@@ -34,9 +34,10 @@ from phonenumber_field.modelfields import PhoneNumberField
 from pretix.base.email import get_email_context
 from pretix.base.i18n import language
 from pretix.base.models import User, Voucher
-from pretix.base.services.mail import mail
+from pretix.base.services.mail import mail, render_mail
 from pretix.helpers import OF_SELF
 
+from ...helpers.format import format_map
 from ...helpers.names import build_name
 from .base import LoggedModel
 from .event import Event, SubEvent
@@ -271,7 +272,9 @@ class WaitingListEntry(LoggedModel):
         with language(self.locale, self.event.settings.region):
             recipient = self.email
 
-            outgoing_mail = mail(
+            email_content = render_mail(template, context)
+            subject = format_map(subject, context)
+            mail(
                 recipient, subject, template, context,
                 self.event,
                 self.locale,
@@ -281,13 +284,18 @@ class WaitingListEntry(LoggedModel):
                 attach_other_files=attach_other_files,
                 attach_cached_files=attach_cached_files,
             )
-            if outgoing_mail:
-                self.log_action(
-                    log_entry_type,
-                    user=user,
-                    auth=auth,
-                    data=outgoing_mail.log_data(),
-                )
+            self.log_action(
+                log_entry_type,
+                user=user,
+                auth=auth,
+                data={
+                    'subject': subject,
+                    'message': email_content,
+                    'recipient': recipient,
+                    'attach_other_files': attach_other_files,
+                    'attach_cached_files': [cf.filename for cf in attach_cached_files] if attach_cached_files else [],
+                }
+            )
 
     @staticmethod
     def clean_itemvar(event, item, variation):

src/pretix/base/payment.py

@@ -1295,7 +1295,6 @@ class ManualPayment(BasePaymentProvider):
 
     def format_map(self, order, payment):
         return {
-            # Possible placeholder injection, we should make sure to never include user-controlled variables here
             'order': order.code,
             'amount': payment.amount,
             'currency': self.event.currency,

src/pretix/base/services/cancelevent.py

@@ -45,6 +45,7 @@ from pretix.base.services.tax import split_fee_for_taxes
 from pretix.base.templatetags.money import money_filter
 from pretix.celery_app import app
 from pretix.helpers import OF_SELF
+from pretix.helpers.format import format_map
 
 logger = logging.getLogger(__name__)
 
@@ -54,7 +55,7 @@ def _send_wle_mail(wle: WaitingListEntry, subject: LazyI18nString, message: Lazy
         email_context = get_email_context(event_or_subevent=subevent or wle.event, event=wle.event)
         mail(
             wle.email,
-            str(subject),
+            format_map(subject, email_context),
             message,
             email_context,
             wle.event,
@@ -72,8 +73,9 @@ def _send_mail(order: Order, subject: LazyI18nString, message: LazyI18nString, s
 
         email_context = get_email_context(event_or_subevent=subevent or order.event, refund_amount=refund_amount,
                                           order=order, position_or_address=ia, event=order.event)
+        real_subject = format_map(subject, email_context)
         order.send_mail(
-            subject, message, email_context,
+            real_subject, message, email_context,
             'pretix.event.order.email.event_canceled',
             user,
         )
@@ -83,13 +85,14 @@ def _send_mail(order: Order, subject: LazyI18nString, message: LazyI18nString, s
                 continue
 
             if p.addon_to_id is None and p.attendee_email and p.attendee_email != order.email:
+                real_subject = format_map(subject, email_context)
                 email_context = get_email_context(event_or_subevent=p.subevent or order.event,
                                                   event=order.event,
                                                   refund_amount=refund_amount,
                                                   position_or_address=p,
                                                   order=order, position=p)
                 order.send_mail(
-                    subject, message, email_context,
+                    real_subject, message, email_context,
                     'pretix.event.order.email.event_canceled',
                     position=p,
                     user=user

src/pretix/base/services/mail.py

@@ -58,7 +58,6 @@ from django.core.mail.message import SafeMIMEText
 from django.db import connection, transaction
 from django.db.models import Q
 from django.dispatch import receiver
-from django.template import Context
 from django.template.loader import get_template
 from django.utils.html import escape
 from django.utils.timezone import now, override
@@ -150,13 +149,13 @@ def prefix_subject(settings_holder, subject, highlight=False):
     return subject
 
 
-def mail(email: Union[str, Sequence[str]], subject: Union[str, FormattedString], template: Union[str, LazyI18nString],
+def mail(email: Union[str, Sequence[str]], subject: str, template: Union[str, LazyI18nString],
          context: Dict[str, Any] = None, event: Event = None, locale: str = None, order: Order = None,
          position: OrderPosition = None, *, headers: dict = None, sender: str = None, organizer: Organizer = None,
          customer: Customer = None, invoices: Sequence = None, attach_tickets=False, auto_email=True, user=None,
          attach_ical=False, attach_cached_files: Sequence = None, attach_other_files: list=None,
          plain_text_only=False, no_order_links=False, cc: Sequence[str]=None, bcc: Sequence[str]=None,
-         sensitive: bool=False) -> Optional[OutgoingMail]:
+         sensitive: bool=False):
     """
     Sends out an email to a user. The mail will be sent synchronously or asynchronously depending on the installation.
 
@@ -262,22 +261,17 @@ def mail(email: Union[str, Sequence[str]], subject: Union[str, FormattedString],
             _autoextend_context(context, order)
 
         # Build raw content
-        content = render_mail(template, context, placeholder_mode=None)
+        content_plain = render_mail(template, context, placeholder_mode=None)
         if settings_holder:
             signature = str(settings_holder.settings.get('mail_text_signature'))
         else:
             signature = ""
 
         # Build full plain-text body
-        if isinstance(content, FormattedString):
-            # Already formatted by render_mail() from format_values
-            body_plain = content
-        elif isinstance(content, PlainHtmlAlternativeString):
-            # Already formatted by render_mail() form a django template
-            body_plain = content.plain
+        if not isinstance(content_plain, FormattedString):
+            body_plain = format_map(content_plain, context, mode=SafeFormatter.MODE_RICH_TO_PLAIN)
         else:
-            # Not yet formatted
-            body_plain = format_map(content, context, mode=SafeFormatter.MODE_RICH_TO_PLAIN)
+            body_plain = content_plain
         body_plain = _wrap_plain_body(body_plain, signature, event, order, position, no_order_links)
 
         # Build subject
@@ -304,19 +298,19 @@ def mail(email: Union[str, Sequence[str]], subject: Union[str, FormattedString],
 
             try:
                 if 'context' in inspect.signature(renderer.render).parameters:
-                    body_html = renderer.render(content, signature, raw_subject, order, position, context)
+                    body_html = renderer.render(content_plain, signature, raw_subject, order, position, context)
                 elif 'position' in inspect.signature(renderer.render).parameters:
                     # Backwards compatibility
                     warnings.warn('Email renderer called without context argument because context argument is not '
                                   'supported.',
                                   DeprecationWarning)
-                    body_html = renderer.render(content, signature, raw_subject, order, position)
+                    body_html = renderer.render(content_plain, signature, raw_subject, order, position)
                 else:
                     # Backwards compatibility
                     warnings.warn('Email renderer called without position argument because position argument is not '
                                   'supported.',
                                   DeprecationWarning)
-                    body_html = renderer.render(content, signature, raw_subject, order)
+                    body_html = renderer.render(content_plain, signature, raw_subject, order)
             except:
                 logger.exception('Could not render HTML body')
                 body_html = None
@@ -341,26 +335,14 @@ def mail(email: Union[str, Sequence[str]], subject: Union[str, FormattedString],
             should_attach_other_files=attach_other_files or [],
             sensitive=sensitive,
         )
-        m._prefetched_objects_cache = {}
         if invoices and not position:
             m.should_attach_invoices.add(*invoices)
-            # Hack: For logging, we'll later make a `should_attach_invoices.all()` call. We can prevent a useless
-            # DB query by filling the cache
-            m._prefetched_objects_cache[m.should_attach_invoices.prefetch_cache_name] = invoices
-        else:
-            m._prefetched_objects_cache[m.should_attach_invoices.prefetch_cache_name] = Invoice.objects.none()
         if attach_cached_files:
-            cf_list = []
             for cf in attach_cached_files:
                 if not isinstance(cf, CachedFile):
-                    cf = CachedFile.objects.get(pk=cf)
-                m.should_attach_cached_files.add(cf)
-                cf_list.append(cf)
-            # Hack: For logging, we'll later make a `should_attach_cached_files.all()` call. We can prevent a useless
-            # DB query by filling the cache
-            m._prefetched_objects_cache[m.should_attach_cached_files.prefetch_cache_name] = cf_list
-        else:
-            m._prefetched_objects_cache[m.should_attach_cached_files.prefetch_cache_name] = CachedFile.objects.none()
+                    m.should_attach_cached_files.add(CachedFile.objects.get(pk=cf))
+                else:
+                    m.should_attach_cached_files.add(cf)
 
         send_task = mail_send_task.si(
             outgoing_mail=m.id
@@ -382,8 +364,6 @@ def mail(email: Union[str, Sequence[str]], subject: Union[str, FormattedString],
                 lambda: chain(*task_chain).apply_async()
             )
 
-    return m
-
 
 class CustomEmail(EmailMultiAlternatives):
     def _create_mime_attachment(self, content, mimetype):
@@ -816,22 +796,15 @@ def render_mail(template, context, placeholder_mode: Optional[int]=SafeFormatter
         body = str(template)
         if context and placeholder_mode:
             body = format_map(body, context, mode=placeholder_mode)
-        return body
     else:
         tpl = get_template(template)
-
-        plain_context = Context({
-            k: v.plain if isinstance(v, PlainHtmlAlternativeString) else v
-            for k, v in context.items()
-        } | {"to_html": False}, autoescape=False)
-        html_context = Context({
+        context = {
+            # Known bug, should behave differently for plain and HTML but we'll fix after security release
             k: v.html if isinstance(v, PlainHtmlAlternativeString) else v
             for k, v in context.items()
-        } | {"to_html": True}, autoescape=True)
-        return PlainHtmlAlternativeString(
-            plain=tpl.template.render(plain_context),
-            html=tpl.template.render(html_context),
-        )
+        }
+        body = FormattedString(tpl.render(context))
+    return body
 
 
 def replace_images_with_cid_paths(body_html):

src/pretix/base/services/vouchers.py

@@ -39,7 +39,7 @@ def vouchers_send(event: Event, vouchers: list, subject: str, message: str, reci
         with language(event.settings.locale):
             email_context = get_email_context(event=event, name=r.get('name') or '',
                                               voucher_list=[v.code for v in voucher_list])
-            outgoing_mail = mail(
+            mail(
                 r['email'],
                 subject,
                 LazyI18nString(message),
@@ -60,8 +60,8 @@ def vouchers_send(event: Event, vouchers: list, subject: str, message: str, reci
                     data={
                         'recipient': r['email'],
                         'name': r.get('name'),
-                        'subject': outgoing_mail.subject,
-                        'message': outgoing_mail.body_plain,
+                        'subject': subject,
+                        'message': message,
                     },
                     save=False
                 ))

src/pretix/base/shredder.py

@@ -363,7 +363,7 @@ class EmailAddressShredder(BaseDataShredder):
                     le.save(update_fields=['data', 'shredded'])
             else:
                 shred_log_fields(le, banlist=[
-                    'recipient', 'message', 'subject', 'full_mail', 'old_email', 'new_email', 'bcc', 'cc',
+                    'recipient', 'message', 'subject', 'full_mail', 'old_email', 'new_email'
                 ])
 
 

src/pretix/base/templates/404.html

@@ -8,9 +8,6 @@
         <h1>{% trans "Not found" %}</h1>
         <p>{% trans "I'm afraid we could not find the the resource you requested." %}</p>
         <p>{{ exception }}</p>
-        <p class="links">
-            <a id='goback' href='#'>{% trans "Take a step back" %}</a>
-        </p>
         {% if request.user.is_staff and not staff_session %}
             <form action="{% url 'control:user.sudo' %}?next={{ request.path|add:"?"|add:request.GET.urlencode|urlencode }}" method="post">
                 <p>

src/pretix/control/templates/pretixcontrol/order/mail_history.html

@@ -24,9 +24,7 @@
                         {% if log.display %}
                             <br/><span class="fa fa-fw fa-comment-o"></span> {{ log.display }}
                         {% endif %}
-                        {% if log.parsed_data.to %}
-                            <br/><span class="fa fa-fw fa-envelope-o"></span> {{ log.parsed_data.to|join:", " }}
-                        {% elif log.parsed_data.recipient %} {# legacy #}
+                        {% if log.parsed_data.recipient %}
                             <br/><span class="fa fa-fw fa-envelope-o"></span> {{ log.parsed_data.recipient }}
                         {% endif %}
                     </p>

src/pretix/control/views/orders.py

@@ -2413,9 +2413,9 @@ class OrderSendMail(EventPermissionRequiredMixin, OrderViewMixin, FormView):
         with language(order.locale, self.request.event.settings.region):
             email_context = get_email_context(event=order.event, order=order)
         email_template = LazyI18nString(form.cleaned_data['message'])
+        email_subject = format_map(str(form.cleaned_data['subject']), email_context)
+        email_content = render_mail(email_template, email_context)
         if self.request.POST.get('action') == 'preview':
-            email_subject = format_map(str(form.cleaned_data['subject']), email_context)
-            email_content = render_mail(email_template, email_context)
             self.preview_output = {
                 'subject': mark_safe(_('Subject: {subject}').format(
                     subject=prefix_subject(order.event, escape(email_subject), highlight=True)
@@ -2477,9 +2477,9 @@ class OrderPositionSendMail(OrderSendMail):
         with language(position.order.locale, self.request.event.settings.region):
             email_context = get_email_context(event=position.order.event, order=position.order, position=position)
         email_template = LazyI18nString(form.cleaned_data['message'])
+        email_subject = format_map(str(form.cleaned_data['subject']), email_context)
+        email_content = render_mail(email_template, email_context)
         if self.request.POST.get('action') == 'preview':
-            email_subject = format_map(str(form.cleaned_data['subject']), email_context)
-            email_content = render_mail(email_template, email_context)
             self.preview_output = {
                 'subject': mark_safe(_('Subject: {subject}').format(
                     subject=prefix_subject(position.order.event, escape(email_subject), highlight=True))

src/pretix/helpers/cookies.py

@@ -34,7 +34,10 @@ def set_cookie_without_samesite(request, response, key, *args, **kwargs):
     if not is_secure:
         # https://www.chromestatus.com/feature/5633521622188032
         return
-    if should_send_same_site_none(request.headers.get('User-Agent', '')):
+
+    useragent = request.headers.get('User-Agent', '')
+
+    if should_send_same_site_none(useragent):
         # Chromium is rolling out SameSite=Lax as a default
         # https://www.chromestatus.com/feature/5088147346030592
         # This however breaks all pretix-in-an-iframe things, such as the pretix Widget.
@@ -44,8 +47,29 @@ def set_cookie_without_samesite(request, response, key, *args, **kwargs):
         # This will only work on secure cookies as well
         # https://www.chromestatus.com/feature/5633521622188032
         response.cookies[key]['secure'] = is_secure
-        # CHIPS
-        response.cookies[key]['Partitioned'] = True
+
+        if can_send_partitioned_cookie(useragent):
+            # CHIPS
+            response.cookies[key]['Partitioned'] = True
+
+
+def can_send_partitioned_cookie(useragent):
+    # Safari currently exhibits a bug where Partitioned cookies (CHIPS) are not
+    # sent back to the originating site after multi-hop cross-site redirects,
+    # breaking SSO login flows in pretix.
+    #
+    # Partitioned cookies were initially introduced in Safari 18.4, removed
+    # again in 18.5 due to a bug, and reintroduced in Safari 26.2, where the
+    # current issue is present.
+    #
+    # Once the Safari issue is fixed, this check should be refined to be
+    # conditional on the affected versions only.
+    #
+    # WebKit issues:
+    #
+    #   - https://bugs.webkit.org/show_bug.cgi?id=292975
+    #   - https://bugs.webkit.org/show_bug.cgi?id=306194
+    return not is_safari(useragent)
 
 
 # Based on https://www.chromium.org/updates/same-site/incompatible-clients

src/pretix/plugins/banktransfer/templates/pretixplugins/banktransfer/pending.html

@@ -21,10 +21,10 @@
             <dt>{% trans "Reference code (important):" %}</dt><dd><b>{{ code }}</b></dd>
             <dt>{% trans "Amount:" %}</dt><dd>{{ amount|money:event.currency }}</dd>
             {% if settings.bank_details_type == "sepa" %}
-                <dt>{% trans "Account holder" %}:</dt><dd>{{ settings.bank_details_sepa_name }}</dt>
-                <dt>{% trans "IBAN" %}:</dt><dd>{{ settings.bank_details_sepa_iban|ibanformat }}</dt>
-                <dt>{% trans "BIC" %}:</dt><dd>{{ settings.bank_details_sepa_bic }}</dt>
-                <dt>{% trans "Bank" %}:</dt><dd>{{ settings.bank_details_sepa_bank }}</dt>
+                <dt>{% trans "Account holder" %}:</dt><dd>{{ settings.bank_details_sepa_name }}</dd>
+                <dt>{% trans "IBAN" %}:</dt><dd>{{ settings.bank_details_sepa_iban|ibanformat }}</dd>
+                <dt>{% trans "BIC" %}:</dt><dd>{{ settings.bank_details_sepa_bic }}</dd>
+                <dt>{% trans "Bank" %}:</dt><dd>{{ settings.bank_details_sepa_bank }}</dd>
             {% endif %}
         </dl>
         {% if details %}
@@ -38,4 +38,4 @@
     {% if payment_qr_codes %}
         {% include "pretixpresale/event/payment_qr_codes.html" %}
     {% endif %}
-</div>
+</div>

src/pretix/plugins/sendmail/tasks.py

@@ -38,10 +38,13 @@ from i18nfield.strings import LazyI18nString
 
 from pretix.base.email import get_email_context
 from pretix.base.i18n import language
-from pretix.base.models import Checkin, Event, InvoiceAddress, Order, User
+from pretix.base.models import (
+    CachedFile, Checkin, Event, InvoiceAddress, Order, User,
+)
 from pretix.base.services.mail import mail
 from pretix.base.services.tasks import ProfiledEventTask
 from pretix.celery_app import app
+from pretix.helpers.format import format_map
 
 
 def _chunks(lst, n):
@@ -61,6 +64,7 @@ def send_mails_to_orders(event: Event, user: int, subject: dict, message: dict,
     user = User.objects.get(pk=user) if user else None
     subject = LazyI18nString(subject)
     message = LazyI18nString(message)
+    attachments_for_log = [cf.filename for cf in CachedFile.objects.filter(pk__in=attachments)] if attachments else []
 
     def _send_to_order(o):
         send_to_order = recipients in ('both', 'orders')
@@ -118,7 +122,7 @@ def send_mails_to_orders(event: Event, user: int, subject: dict, message: dict,
 
                 with language(o.locale, event.settings.region):
                     email_context = get_email_context(event=event, order=o, invoice_address=ia, position=p)
-                    outgoing_mail = mail(
+                    mail(
                         p.attendee_email,
                         subject,
                         message,
@@ -131,17 +135,25 @@ def send_mails_to_orders(event: Event, user: int, subject: dict, message: dict,
                         attach_ical=attach_ical,
                         attach_cached_files=attachments
                     )
-                    if outgoing_mail:
-                        o.log_action(
-                            'pretix.plugins.sendmail.order.email.sent.attendee',
-                            user=user,
-                            data=outgoing_mail.log_data(),
-                        )
+                    o.log_action(
+                        'pretix.plugins.sendmail.order.email.sent.attendee',
+                        user=user,
+                        data={
+                            'position': p.positionid,
+                            'subject': format_map(subject.localize(o.locale), email_context),
+                            'message': format_map(message.localize(o.locale), email_context),
+                            'recipient': p.attendee_email,
+                            'attach_tickets': attach_tickets,
+                            'attach_ical': attach_ical,
+                            'attach_other_files': [],
+                            'attach_cached_files': attachments_for_log,
+                        }
+                    )
 
         if send_to_order and o.email:
             with language(o.locale, event.settings.region):
                 email_context = get_email_context(event=event, order=o, invoice_address=ia)
-                outgoing_mail = mail(
+                mail(
                     o.email,
                     subject,
                     message,
@@ -153,12 +165,19 @@ def send_mails_to_orders(event: Event, user: int, subject: dict, message: dict,
                     attach_ical=attach_ical,
                     attach_cached_files=attachments,
                 )
-                if outgoing_mail:
-                    o.log_action(
-                        'pretix.plugins.sendmail.order.email.sent',
-                        user=user,
-                        data=outgoing_mail.log_data(),
-                    )
+                o.log_action(
+                    'pretix.plugins.sendmail.order.email.sent',
+                    user=user,
+                    data={
+                        'subject': format_map(subject.localize(o.locale), email_context),
+                        'message': format_map(message.localize(o.locale), email_context),
+                        'recipient': o.email,
+                        'attach_tickets': attach_tickets,
+                        'attach_ical': attach_ical,
+                        'attach_other_files': [],
+                        'attach_cached_files': attachments_for_log,
+                    }
+                )
 
     for chunk in _chunks(objects, 1000):
         orders = Order.objects.filter(pk__in=chunk, event=event)

src/pretix/presale/templates/pretixpresale/event/resend_link.html

@@ -1,14 +1,14 @@
 {% extends "pretixpresale/event/base.html" %}
 {% load i18n %}
 {% load bootstrap3 %}
-{% block title %}{% trans "Resend order links" %}{% endblock %}
+{% block title %}{% trans "Resend order link" %}{% endblock %}
 {% block custom_header %}
     {{ block.super }}
     <meta name="robots" content="noindex, nofollow">
 {% endblock %}
 {% block content %}
     <h2>
-        {% trans "Resend order links" %}
+        {% trans "Resend order link" %}
     </h2>
     <p>
         {% blocktrans trimmed %}

src/pretix/presale/views/order.py

@@ -1510,7 +1510,10 @@ class OrderChangeMixin:
                             'max_count': iao.max_count,
                             'iao': iao,
                             'items': [i for i in items if not i.require_voucher],
-                            'items_missing': {k: v for k, v in current_addon_products_missing.items() if v},
+                            'items_missing': {
+                                k: v for k, v in current_addon_products_missing.items()
+                                if v and k[0].category_id == iao.addon_category_id
+                            },
                         })
 
         return positions

src/tests/api/test_checkin.py

@@ -1177,6 +1177,30 @@ def test_store_failed(token_client, organizer, clist, event, order):
     assert resp.status_code == 400
 
 
+@pytest.mark.django_db
+def test_store_failed_after_success(token_client, organizer, clist, event, order):
+    with scopes_disabled():
+        p = order.positions.first()
+        p.all_checkins.create(
+            type=Checkin.TYPE_ENTRY,
+            nonce='foobar',
+            successful=True,
+            list=clist,
+            raw_barcode=p.secret
+        )
+    resp = token_client.post('/api/v1/organizers/{}/events/{}/checkinlists/{}/failed_checkins/'.format(
+        organizer.slug, event.slug, clist.pk,
+    ), {
+        'raw_barcode': p.secret,
+        'nonce': 'foobar',
+        'position': p.pk,
+        'error_reason': 'unpaid'
+    }, format='json')
+    assert resp.status_code == 201
+    with scopes_disabled():
+        assert Checkin.all.filter(position=p).count() == 2
+
+
 @pytest.mark.django_db
 def test_redeem_unknown(token_client, organizer, clist, event, order):
     resp = _redeem(token_client, organizer, clist, 'unknown_secret', {'force': True})

src/tests/base/test_mail.py

@@ -42,6 +42,7 @@ import pytest
 from django.conf import settings
 from django.core import mail as djmail
 from django.test import override_settings
+from django.utils.html import escape
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 from django_scopes import scope, scopes_disabled
@@ -331,14 +332,13 @@ def test_placeholder_html_rendering_from_template(env):
 
     assert len(djmail.outbox) == 1
     assert djmail.outbox[0].to == [user.email]
-    assert 'Event name: <strong>event & co. kg</strong> {currency}' in djmail.outbox[0].body
-    assert 'Event: <strong>event & co. kg</strong> {currency}' in djmail.outbox[0].body
-    assert '**IBAN**: 123  \n**BIC**: 456' in djmail.outbox[0].body
-    assert '**Meta**: *Beep*' in djmail.outbox[0].body
-    assert 'Event website: [<strong>event & co. kg</strong> {currency}](https://example.org/dummy)' in djmail.outbox[0].body
-    assert '<a ' not in djmail.outbox[0].body
-    assert '&lt;' not in djmail.outbox[0].body
-    assert '&amp;' not in djmail.outbox[0].body
+    # Known bug for now: These should not have HTML for the plain body, but we'll fix this safter the security release
+    assert escape('Event name: <strong>event & co. kg</strong> {currency}') in djmail.outbox[0].body
+    assert '<strong>IBAN</strong>: 123<br>\n<strong>BIC</strong>: 456' in djmail.outbox[0].body
+    assert '**Meta**: <em>Beep</em>' in djmail.outbox[0].body
+    assert escape('Event website: [<strong>event & co. kg</strong> {currency}](https://example.org/dummy)') in djmail.outbox[0].body
+    # todo: assert '&lt;' not in djmail.outbox[0].body
+    # todo: assert '&amp;' not in djmail.outbox[0].body
     assert 'Unevaluated placeholder: {currency}' in djmail.outbox[0].body
     assert 'EUR' not in djmail.outbox[0].body
     html = _extract_html(djmail.outbox[0])
@@ -346,13 +346,11 @@ def test_placeholder_html_rendering_from_template(env):
     assert '<strong>event' not in html
     assert 'Event name: &lt;strong&gt;event &amp; co. kg&lt;/strong&gt; {currency}' in html
     assert '<strong>IBAN</strong>: 123<br/>\n<strong>BIC</strong>: 456' in html
-    assert '**Meta**: <em>Beep</em>' in html
+    assert '<strong>Meta</strong>: <em>Beep</em>' in html
     assert 'Unevaluated placeholder: {currency}' in html
     assert 'EUR' not in html
-    assert 'Event website: [&lt;strong&gt;event &amp; co. kg&lt;/strong&gt; {currency}](https://example.org/dummy)' in html
-    # Links are from raw HTML and therefore trusted, rel and target is not added automatically
     assert re.search(
-        r'Event: <a href="https://example.com/dummy" style="[^"]+">'
+        r'Event website: <a href="https://example.org/dummy" rel="noopener" style="[^"]+" target="_blank">'
         r'&lt;strong&gt;event &amp; co. kg&lt;/strong&gt; {currency}</a>',
         html
     )

src/tests/base/test_modelimport_vouchers.py

@@ -170,7 +170,7 @@ def test_price_mode_validation(event, item, user):
         import_vouchers.apply(
             args=(event.pk, inputfile_factory().id, settings, 'en', user.pk)
         ).get()
-    assert 'It is pointless to set a value without a price mode.' in str(excinfo.value)
+    assert 'It is pointless to set a value without a price effect.' in str(excinfo.value)
 
     settings['price_mode'] = 'static:percent'
     import_vouchers.apply(

src/tests/templates/mailtest.txt

@@ -1,29 +1,13 @@
 {% load i18n %}
 This is a test file for sending mails.
-
-Django variables will get evaluated:
-
 Event name: {{ event }}
-
-pretix variables will not in a template rendering:
-
 Unevaluated placeholder: {currency}
-
-We can use advanced Django things:
-
 {% get_current_language as LANGUAGE_CODE %}
 The language code used for rendering this email is {{ LANGUAGE_CODE }}.
 
-Custom content is rendered safely without HTML/Markdown/parameter injection
-unless the parameter is marked as "HTML-safe":
-
 Payment info:
 {{ payment_info }}
 
 **Meta**: {{ meta_Test }}
 
-Markdown will not be evaluated when coming from a template file!
-
-Event website: [{{event}}](https://example.org/{{event_slug}})
-
-Event: {% if to_html %}<a href="https://example.com/{{event_slug}}">{% endif %}{{ event }}{% if to_html %}</a>{% endif %}
+Event website: [{{event}}](https://example.org/{{event_slug}})