Event and subevent editor: Do not allow map to capture scroll without interaction (Z#23252379)

src/pretix/api/serializers/media.py

@@ -197,8 +197,6 @@ class ReusableMediaSerializer(I18nAwareModelSerializer):
             'linked_giftcard',
             'info',
             'notes',
-            # When adding fields, check if they should be hidden in ReusableMediaViewSet
-            # for cross-organizer lookups
         )
 
 

src/pretix/api/views/media.py

@@ -183,18 +183,9 @@ class ReusableMediaViewSet(viewsets.ModelViewSet):
                         type=s.validated_data["type"],
                         identifier=s.validated_data["identifier"],
                     )
+                m.customer = None  # not relevant for cross-organizer
                 s = self.get_serializer(m)
-                data = s.data
-                # Remove fields that are not relevant for cross-organizer usage
-                data["customer"] = None
-                data["linked_orderposition"] = None
-                data["linked_orderpositions"] = []
-                data["info"] = {}
-                data["notes"] = None
-                data["claim_token"] = None
-                data["label"] = None
-
-                return Response({"result": data})
+                return Response({"result": s.data})
             except ReusableMedium.DoesNotExist:
                 mt = MEDIA_TYPES.get(s.validated_data["type"])
                 if mt:

src/pretix/presale/forms/customer.py

@@ -75,7 +75,6 @@ class AuthenticationForm(forms.Form):
         'unverified': _("You have not yet activated your account and set a password. Please click the link in the "
                         "email we sent you. In case you cannot find it, click \"Forgot your password?\" to receive "
                         "a new email."),
-        'rate_limit': _("For security reasons, please wait 5 minutes before you try again."),
     }
 
     def __init__(self, request=None, *args, **kwargs):
@@ -94,12 +93,6 @@ class AuthenticationForm(forms.Form):
         email = self.cleaned_data.get('email')
         password = self.cleaned_data.get('password')
 
-        if rate_limit("customer_login", include_ip_from_request=self.request, max_num=10, expire_time=300):
-            raise forms.ValidationError(
-                self.error_messages['rate_limit'],
-                code='rate_limit',
-            )
-
         if email is not None and password:
             try:
                 u = self.request.organizer.customers.get(email=email.lower(), provider__isnull=True)

src/pretix/static/pretixcontrol/js/ui/geo.js

@@ -130,7 +130,10 @@ $(document).on('pretix:bind-forms', function () {
 		if (tiles) {
 			let $map = $('<div>')
 			$grp.append($('<div>').addClass('col-md-9 col-md-offset-3').append($map))
-			let map = L.map($map.get(0))
+			let map = L.map($map.get(0), {
+				scrollWheelZoom: false
+			})
+			map.once('focus', function() { map.scrollWheelZoom.enable(); });
 			L.tileLayer(tiles, {
 				attribution: attrib,
 				maxZoom: 18,

src/tests/api/test_reusable_media.py

@@ -696,7 +696,7 @@ def test_medium_autocreate_giftcard(token_client, organizer, team):
 
 
 @pytest.mark.django_db
-def test_medium_lookup_cross_organizer(token_client, organizer, customer, organizer2, org2_event, medium2, giftcard2):
+def test_medium_lookup_cross_organizer(token_client, organizer, organizer2, org2_event, medium2, giftcard2):
     with scopes_disabled():
         o = Order.objects.create(
             code='FOO', event=org2_event, email='dummy@dummy.test',
@@ -708,12 +708,7 @@ def test_medium_lookup_cross_organizer(token_client, organizer, customer, organi
                                          personalized=True)
         op = o.positions.create(item=ticket, price=Decimal("14"))
         medium2.linked_orderpositions.add(op)
-        medium2.customer = customer
         medium2.linked_giftcard = giftcard2
-        medium2.claim_token = "1234"
-        medium2.info = {"foo": "bar"}
-        medium2.notes = "Internal notes"
-        medium2.label = "Max Muster"
         medium2.save()
 
     resp = token_client.post(
@@ -760,9 +755,3 @@ def test_medium_lookup_cross_organizer(token_client, organizer, customer, organi
     assert resp.data["result"]["organizer"] == "partner"
     assert resp.data["result"]["linked_giftcard"] is not None
     assert resp.data["result"]["linked_orderposition"] is None
-    assert resp.data["result"]["linked_orderpositions"] == []
-    assert resp.data["result"]["customer"] is None
-    assert resp.data["result"]["info"] == {}
-    assert resp.data["result"]["notes"] is None
-    assert resp.data["result"]["claim_token"] is None
-    assert resp.data["result"]["label"] is None