change event listener to pretix:bind-forms

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

doc/api/resources/checkinlists.rst

@@ -351,7 +351,8 @@ Endpoints
 
    :<json boolean error_reason: One of ``canceled``, ``invalid``, ``unpaid``, ``product``, ``rules``, ``revoked``,
                                 ``incomplete``, ``already_redeemed``, ``blocked``, ``invalid_time``, or ``error``. Required.
-   :<json raw_barcode: The raw barcode you scanned. Required.
+   :<json raw_barcode: The raw barcode or identifier you scanned. Required.
+   :<json raw_source_type: The type of medium you scanned, defaults to ``barcode``. Optional.
    :<json datetime: Date and time of the scan. Optional.
    :<json type: Type of scan, defaults to ``"entry"``.
    :<json position: Internal ID of an order position you matched. Optional.

doc/api/resources/orders.rst

@@ -864,6 +864,9 @@ Generating new secrets
 
    Triggers generation of new ``secret`` and ``web_secret`` attributes for both the order and all order positions.
 
+   Ticket secrets of order positions that have been used to issue a gift card can not
+   be changed. Only the link (``web_secret``) will be changed in this case.
+
    **Example request**:
 
    .. sourcecode:: http
@@ -895,6 +898,9 @@ Generating new secrets
 
    Triggers generation of a new ``secret`` and ``web_secret`` attribute for a single order position.
 
+   Ticket secrets of order positions that have been used to issue a gift card can not
+   be changed. Only the link (``web_secret``) will be changed in this case.
+
    **Example request**:
 
    .. sourcecode:: http

pyproject.toml

@@ -41,10 +41,10 @@ dependencies = [
   "django-bootstrap3==26.1",
   "django-compressor==4.6.0",
   "django-countries==8.2.*",
-  "django-filter==25.1",
+  "django-filter==26.1",
   "django-formset-js-improved==0.5.0.5",
   "django-formtools==2.7",
-  "django-hierarkey==2.0.*,>=2.0.1",
+  "django-hierarkey==2.0.*,>=2.0.2",
   "django-hijack==3.7.*",
   "django-i18nfield==1.11.*",
   "django-libsass==0.9",
@@ -94,7 +94,7 @@ dependencies = [
   "redis==7.4.*",
   "reportlab==5.0.*",
   "requests==2.34.*",
-  "sentry-sdk==2.64.*",
+  "sentry-sdk==2.66.*",
   "sepaxml==2.7.*",
   "stripe==7.9.*",
   "text-unidecode==1.*",

src/pretix/api/serializers/__init__.py

@@ -20,6 +20,7 @@
 # <https://www.gnu.org/licenses/>.
 #
 import json
+import re
 
 from django.db.models import prefetch_related_objects
 from rest_framework import serializers
@@ -135,3 +136,30 @@ class SalesChannelMigrationMixin:
         else:
             value["sales_channels"] = value["limit_sales_channels"]
         return value
+
+
+class CompatDecimalField(serializers.DecimalField):
+    """
+    Historically, pretix recorded tax rates as decimals with two places. Today, pretix supports tax rates with up to
+    four places. Since our API outputs decimals with the stored precision, this would have changed the API output from
+    "19.00" to "19.0000" without warning. While this is semantically the same thing, we need to assume some pretix API
+    users might run into trouble, either because they treat the value as a string and then map something
+    (e.g. ``if tax_rate == "19.00"``) or process it with a language where this is a significant difference. For example,
+    while in Python ``Decimal("19.00") == Decimal("19.0000")`` is true, in Java
+    ``(new BigDecimal("19.00")).equals(new BigDecimal("19.0000"))`` is false and only
+    ``(new BigDecimal("19.00")).compareTo(new BigDecimal("19.0000")) == 0`` is true.
+
+    Therefore, we stay backwards compatible by outputting two decimal places *as long as the trailing digits are zero-valued.
+    """
+
+    regex = re.compile(r"^([0-9]+\.[0-9]{2})0+$")
+
+    def to_representation(self, value):
+        if self.localize:
+            raise ValueError("localization not supported")
+        value = super().to_representation(value)
+        if value and "." not in value:
+            return f"{value}.00"
+        if m := self.regex.match(value):
+            return m.group(1)
+        return value

src/pretix/api/serializers/event.py

@@ -48,7 +48,7 @@ from rest_framework.fields import ChoiceField, Field
 from rest_framework.relations import SlugRelatedField
 
 from pretix.api.serializers import (
-    CompatibleJSONField, SalesChannelMigrationMixin,
+    CompatDecimalField, CompatibleJSONField, SalesChannelMigrationMixin,
 )
 from pretix.api.serializers.fields import PluginsField
 from pretix.api.serializers.i18n import I18nAwareModelSerializer
@@ -681,6 +681,7 @@ class TaxRuleSerializer(CountryFieldMixin, I18nAwareModelSerializer):
         required=False,
         allow_null=True,
     )
+    rate = CompatDecimalField(max_digits=7, decimal_places=4)
 
     class Meta:
         model = TaxRule

src/pretix/api/serializers/item.py

@@ -42,7 +42,9 @@ from django.utils.functional import cached_property, lazy
 from django.utils.translation import gettext_lazy as _
 from rest_framework import serializers
 
-from pretix.api.serializers import SalesChannelMigrationMixin
+from pretix.api.serializers import (
+    CompatDecimalField, SalesChannelMigrationMixin,
+)
 from pretix.api.serializers.event import MetaDataField
 from pretix.api.serializers.fields import UploadedFileField
 from pretix.api.serializers.i18n import I18nAwareModelSerializer
@@ -276,10 +278,10 @@ class ItemAddOnSerializer(serializers.ModelSerializer):
         return value
 
 
-class ItemTaxRateField(serializers.Field):
+class ItemTaxRateField(CompatDecimalField):
     def to_representation(self, i):
         if i.tax_rule:
-            return str(Decimal(i.tax_rule.rate))
+            return super().to_representation(Decimal(i.tax_rule.rate))
         else:
             return str(Decimal('0.00'))
 
@@ -289,7 +291,7 @@ class ItemSerializer(SalesChannelMigrationMixin, I18nAwareModelSerializer):
     bundles = InlineItemBundleSerializer(many=True, required=False)
     variations = InlineItemVariationSerializer(many=True, required=False)
     program_times = InlineItemProgramTimeSerializer(many=True, required=False)
-    tax_rate = ItemTaxRateField(source='*', read_only=True)
+    tax_rate = ItemTaxRateField(source='*', read_only=True, max_digits=7, decimal_places=4)
     meta_data = MetaDataField(required=False, source='*')
     picture = UploadedFileField(required=False, allow_null=True, allowed_types=(
         'image/png', 'image/jpeg', 'image/gif'

src/pretix/api/serializers/order.py

@@ -41,7 +41,7 @@ from rest_framework.exceptions import ValidationError
 from rest_framework.relations import SlugRelatedField
 from rest_framework.reverse import reverse
 
-from pretix.api.serializers import CompatibleJSONField
+from pretix.api.serializers import CompatDecimalField, CompatibleJSONField
 from pretix.api.serializers.event import SubEventSerializer
 from pretix.api.serializers.forms import form_field_to_serializer_field
 from pretix.api.serializers.i18n import I18nAwareModelSerializer
@@ -52,6 +52,7 @@ from pretix.api.signals import order_api_details, orderposition_api_details
 from pretix.base.decimal import round_decimal
 from pretix.base.i18n import language
 from pretix.base.invoicing.transmission import get_transmission_types
+from pretix.base.media import MEDIA_TYPES
 from pretix.base.models import (
     CachedFile, Checkin, Customer, Device, GiftCard, Invoice, InvoiceAddress,
     InvoiceLine, Item, ItemVariation, Order, OrderPosition, Question,
@@ -381,6 +382,7 @@ class PrintLogSerializer(serializers.ModelSerializer):
 class FailedCheckinSerializer(I18nAwareModelSerializer):
     error_reason = serializers.ChoiceField(choices=Checkin.REASONS, required=True, allow_null=False)
     raw_barcode = serializers.CharField(required=True, allow_null=False)
+    raw_source_type = serializers.ChoiceField(choices=[(k, v) for k, v in MEDIA_TYPES.items()], default='barcode')
     position = serializers.PrimaryKeyRelatedField(queryset=OrderPosition.all.none(), required=False, allow_null=True)
     raw_item = serializers.PrimaryKeyRelatedField(queryset=Item.objects.none(), required=False, allow_null=True)
     raw_variation = serializers.PrimaryKeyRelatedField(queryset=ItemVariation.objects.none(), required=False, allow_null=True)
@@ -390,7 +392,7 @@ class FailedCheckinSerializer(I18nAwareModelSerializer):
     class Meta:
         model = Checkin
         fields = ('error_reason', 'error_explanation', 'raw_barcode', 'raw_item', 'raw_variation',
-                  'raw_subevent', 'nonce', 'datetime', 'type', 'position')
+                  'raw_subevent', 'raw_source_type', 'nonce', 'datetime', 'type', 'position')
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
@@ -591,6 +593,7 @@ class OrderPositionSerializer(I18nAwareModelSerializer):
     country = CompatibleCountryField(source='*')
     attendee_name = serializers.CharField(required=False)
     plugin_data = OrderPositionPluginDataField(source='*', allow_null=True, read_only=True)
+    tax_rate = CompatDecimalField(max_digits=7, decimal_places=4)
 
     class Meta:
         list_serializer_class = OrderPositionListSerializer
@@ -747,6 +750,8 @@ class OrderPaymentDateField(serializers.DateField):
 
 
 class OrderFeeSerializer(I18nAwareModelSerializer):
+    tax_rate = CompatDecimalField(max_digits=7, decimal_places=4)
+
     class Meta:
         model = OrderFee
         fields = ('id', 'fee_type', 'value', 'description', 'internal_type', 'tax_rate', 'tax_value', 'tax_rule',
@@ -1911,6 +1916,7 @@ class InlineInvoiceLineSerializer(I18nAwareModelSerializer):
     position = LinePositionField(read_only=True)
     event_date_from = serializers.DateTimeField(read_only=True, source="period_start")
     event_date_to = serializers.DateTimeField(read_only=True, source="period_end")
+    tax_rate = CompatDecimalField(max_digits=7, decimal_places=4)
 
     class Meta:
         model = InvoiceLine
@@ -1994,6 +2000,7 @@ class BlockedTicketSecretSerializer(I18nAwareModelSerializer):
 
 class TransactionSerializer(I18nAwareModelSerializer):
     order = serializers.SlugRelatedField(slug_field="code", read_only=True)
+    tax_rate = CompatDecimalField(max_digits=7, decimal_places=4)
 
     class Meta:
         model = Transaction

src/pretix/api/views/order.py

@@ -1658,6 +1658,7 @@ class PaymentViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet):
                         count_waitinglist=False,
                         force=request.data.get('force', False),
                         send_mail=send_mail,
+                        ignore_date=request.data.get('force', False),
                     )
                 except Quota.QuotaExceededException:
                     pass
@@ -1693,7 +1694,8 @@ class PaymentViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet):
                             auth=self.request.auth,
                             count_waitinglist=False,
                             send_mail=send_mail,
-                            force=force)
+                            force=force,
+                            ignore_date=force)
         except Quota.QuotaExceededException as e:
             return Response({'detail': str(e)}, status=status.HTTP_400_BAD_REQUEST)
         except PaymentException as e:

src/pretix/base/context.py

@@ -23,6 +23,7 @@ import sys
 
 from django.conf import settings
 from django.urls import reverse
+from django.utils.html import escape, format_html
 from django.utils.safestring import mark_safe
 from django.utils.translation import gettext
 
@@ -35,21 +36,23 @@ def get_powered_by(request, safelink=True):
     d = gs.settings.license_check_input
     if d.get('poweredby_name'):
         if d.get('poweredby_url'):
-            msg = gettext('<a {a_name_attr}>powered by {name}</a> <a {a_attr}>based on pretix</a>').format(
+            msg = format_html(
+                gettext('<a {a_name_attr}>powered by {name}</a> <a {a_attr}>based on pretix</a>'),
                 name=d['poweredby_name'],
-                a_name_attr='href="{}" target="_blank" rel="noopener"'.format(
-                    sl(d['poweredby_url']) if safelink else d['poweredby_url'],
-                ),
-                a_attr='href="{}" target="_blank" rel="noopener"'.format(
+                a_name_attr=mark_safe('href="{}" target="_blank" rel="noopener"'.format(
+                    escape(sl(d['poweredby_url'])) if safelink else escape(d['poweredby_url']),
+                )),
+                a_attr=mark_safe('href="{}" target="_blank" rel="noopener"'.format(
                     sl('https://pretix.eu') if safelink else 'https://pretix.eu',
-                )
+                ))
             )
         else:
-            msg = gettext('<a {a_attr}>powered by {name} based on pretix</a>').format(
+            msg = format_html(
+                gettext('<a {a_attr}>powered by {name} based on pretix</a>'),
                 name=d['poweredby_name'],
-                a_attr='href="{}" target="_blank" rel="noopener"'.format(
+                a_attr=mark_safe('href="{}" target="_blank" rel="noopener"'.format(
                     sl('https://pretix.eu') if safelink else 'https://pretix.eu',
-                )
+                ))
             )
     else:
         msg = gettext('<a %(a_attr)s>ticketing powered by pretix</a>') % {

src/pretix/base/forms/auth.py

@@ -33,8 +33,6 @@
 # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 # License for the specific language governing permissions and limitations under the License.
 
-import hashlib
-import ipaddress
 import logging
 
 from django import forms
@@ -42,13 +40,12 @@ from django.conf import settings
 from django.contrib.auth.password_validation import (
     password_validators_help_texts, validate_password,
 )
-from django.utils.functional import cached_property
 from django.utils.translation import gettext_lazy as _
 
 from pretix.base.metrics import pretix_failed_logins
 from pretix.base.models import User
 from pretix.helpers.dicts import move_to_end
-from pretix.helpers.http import get_client_ip
+from pretix.helpers.ratelimit import rate_limit
 
 logger = logging.getLogger(__name__)
 
@@ -85,40 +82,20 @@ class LoginForm(forms.Form):
         else:
             move_to_end(self.fields, 'keep_logged_in')
 
-    @cached_property
-    def ratelimit_key(self):
-        if not settings.HAS_REDIS:
-            return None
-        client_ip = get_client_ip(self.request)
-        if not client_ip:
-            return None
-        try:
-            client_ip = ipaddress.ip_address(client_ip)
-        except ValueError:
-            # Web server not set up correctly
-            return None
-        if client_ip.is_private:
-            # This is the private IP of the server, web server not set up correctly
-            return None
-        return 'pretix_login_{}'.format(hashlib.sha1(str(client_ip).encode()).hexdigest())
-
     def clean(self):
         if all(k in self.cleaned_data for k, f in self.fields.items() if f.required):
-            if self.ratelimit_key:
-                from django_redis import get_redis_connection
-                rc = get_redis_connection("redis")
-                cnt = rc.get(self.ratelimit_key)
-                if cnt and int(cnt) > 10:
-                    pretix_failed_logins.inc(1, reason="ratelimit")
-                    logger.info("Backend login rejected due to rate limit.")
-                    raise forms.ValidationError(self.error_messages['rate_limit'], code='rate_limit')
+            rate_limit_kwargs = dict(include_ip_from_request=self.request, max_num=10, expire_time=300)
+            if rate_limit("login", **rate_limit_kwargs, increase=False):
+                # Check rate limit without counting up, we increase below only on failed logins
+                pretix_failed_logins.inc(1, reason="ratelimit")
+                logger.info("Backend login rejected due to rate limit.")
+                raise forms.ValidationError(self.error_messages['rate_limit'], code='rate_limit')
             self.user_cache = self.backend.form_authenticate(self.request, self.cleaned_data)
             if self.user_cache is None:
-                if self.ratelimit_key:
-                    rc.incr(self.ratelimit_key)
-                    rc.expire(self.ratelimit_key, 300)
                 logger.info("Backend login invalid.")
                 pretix_failed_logins.inc(1, reason="invalid")
+                # Count towards rate limit (result is ignored, we are checking above)
+                rate_limit("login", **rate_limit_kwargs)
                 raise forms.ValidationError(
                     self.error_messages['invalid_login'],
                     code='invalid_login'

src/pretix/base/forms/questions.py

@@ -959,7 +959,7 @@ class BaseQuestionsForm(forms.Form):
                     label=label, required=required,
                     help_text=help_text,
                     initial=_initial,
-                    widget=TimePickerWidget(time_format=get_format_without_seconds('TIME_INPUT_FORMATS')),
+                    widget=TimePickerWidget(without_seconds=True),
                 )
             elif q.type == Question.TYPE_DATETIME:
                 if not help_text:
@@ -1116,6 +1116,13 @@ class BaseQuestionsForm(forms.Form):
             if q.dependency_question_id and not question_is_visible(q.dependency_question_id, q.dependency_values) and answer is not None:
                 d['question_%d' % q.pk] = None
 
+        # Strip False answers to required yes/no questions even if all_optional is set, as our data model assumes that
+        # required yes/no questions can only be answered with yes
+        for q in question_cache.values():
+            if q.required and q.type == Question.TYPE_BOOLEAN:
+                if 'question_%d' % q.pk in d and d['question_%d' % q.pk] is False:
+                    del d['question_%d' % q.pk]
+
         return d
 
 

src/pretix/base/forms/user.py

@@ -33,7 +33,6 @@
 # License for the specific language governing permissions and limitations under the License.
 
 from django import forms
-from django.conf import settings
 from django.contrib.auth.hashers import check_password
 from django.contrib.auth.password_validation import (
     password_validators_help_texts, validate_password,
@@ -46,6 +45,7 @@ from pytz import common_timezones
 from pretix.base.models import User
 from pretix.control.forms import SingleLanguageWidget
 from pretix.helpers.format import format_map
+from pretix.helpers.ratelimit import rate_limit
 
 
 class UserSettingsForm(forms.ModelForm):
@@ -128,16 +128,11 @@ class UserPasswordChangeForm(forms.Form):
     def clean_old_pw(self):
         old_pw = self.cleaned_data.get('old_pw')
 
-        if settings.HAS_REDIS:
-            from django_redis import get_redis_connection
-            rc = get_redis_connection("redis")
-            cnt = rc.incr('pretix_pwchange_%s' % self.user.pk)
-            rc.expire('pretix_pwchange_%s' % self.user.pk, 300)
-            if cnt > 10:
-                raise forms.ValidationError(
-                    self.error_messages['rate_limit'],
-                    code='rate_limit',
-                )
+        if rate_limit("pwchange", self.user.pk, max_num=10, expire_time=300):
+            raise forms.ValidationError(
+                self.error_messages['rate_limit'],
+                code='rate_limit',
+            )
 
         if not check_password(old_pw, self.user.password):
             raise forms.ValidationError(
@@ -175,19 +170,35 @@ class UserEmailChangeForm(forms.Form):
     error_messages = {
         'duplicate_identifier': _("There already is an account associated with this email address. "
                                   "Please choose a different one."),
+        'rate_limit': _("For security reasons, please wait 5 minutes before you try again."),
     }
     old_email = forms.EmailField(label=_('Old email address'), disabled=True)
     new_email = forms.EmailField(label=_('New email address'))
 
     def __init__(self, *args, **kwargs):
         self.user = kwargs.pop('user')
+        self.request = kwargs.pop('request')
         super().__init__(*args, **kwargs)
 
     def clean_new_email(self):
         email = self.cleaned_data['new_email']
+
+        if rate_limit("emailchange_attempt", include_ip_from_request=self.request, max_num=5, expire_time=300):
+            # Rate limit lookup for conflicting email addresses to make enumeration harder
+            raise forms.ValidationError(
+                self.error_messages['rate_limit'],
+                code='rate_limit',
+            )
+
         if User.objects.filter(Q(email__iexact=email) & ~Q(pk=self.user.pk)).exists():
             raise forms.ValidationError(
                 self.error_messages['duplicate_identifier'],
                 code='duplicate_identifier',
             )
+
+        if rate_limit("emailchange", self.user.pk, max_num=2, expire_time=300):
+            raise forms.ValidationError(
+                self.error_messages['rate_limit'],
+                code='rate_limit',
+            )
         return email

src/pretix/base/forms/widgets.py

@@ -43,6 +43,10 @@ from django.utils.timezone import get_current_timezone, now
 from django.utils.translation import gettext_lazy as _
 
 from pretix.helpers.format import PlainHtmlAlternativeString
+from pretix.helpers.i18n import (
+    get_format_without_seconds, get_javascript_format,
+    get_javascript_format_without_seconds,
+)
 
 
 def replace_arabic_numbers(inp):
@@ -108,7 +112,7 @@ class DatePickerWidget(forms.DateInput):
 
 
 class TimePickerWidget(forms.TimeInput):
-    def __init__(self, attrs=None, time_format=None):
+    def __init__(self, attrs=None, time_format=None, without_seconds=False):
         attrs = attrs or {}
         if 'placeholder' in attrs:
             del attrs['placeholder']
@@ -117,8 +121,27 @@ class TimePickerWidget(forms.TimeInput):
         time_attrs['class'] += ' timepickerfield'
         time_attrs['autocomplete'] = 'off'
 
+        if time_format or without_seconds:
+            # Explicitly set data-format attributes for the JS layer instead of relying on the body-wide config
+            def time_format_attr():
+                if without_seconds:
+                    return get_javascript_format_without_seconds(time_format or "TIME_INPUT_FORMATS")
+                return get_javascript_format(time_format or "TIME_INPUT_FORMATS")
+
+            time_attrs['data-format'] = lazy(time_format_attr, str)
+
+            def time_format_attr():
+                if without_seconds:
+                    return get_javascript_format_without_seconds(time_format or "TIME_INPUT_FORMATS")
+                return get_javascript_format(time_format or "TIME_INPUT_FORMATS")
+
+            time_attrs['data-format'] = lazy(time_format_attr, str)
+
         def placeholder():
-            tf = time_format or get_format('TIME_INPUT_FORMATS')[0]
+            if without_seconds:
+                tf = time_format or get_format_without_seconds('TIME_INPUT_FORMATS')
+            else:
+                tf = time_format or get_format('TIME_INPUT_FORMATS')[0]
             return now().replace(
                 year=2000, month=1, day=1, hour=0, minute=0, second=0, microsecond=0
             ).strftime(tf)
@@ -182,7 +205,7 @@ class UploadedFileWidget(forms.ClearableFileInput):
 class SplitDateTimePickerWidget(forms.SplitDateTimeWidget):
     template_name = 'pretixbase/forms/widgets/splitdatetime.html'
 
-    def __init__(self, attrs=None, date_format=None, time_format=None, min_date=None, max_date=None):
+    def __init__(self, attrs=None, date_format=None, time_format=None, min_date=None, max_date=None, without_seconds=False):
         attrs = attrs or {}
         if 'placeholder' in attrs:
             del attrs['placeholder']
@@ -205,14 +228,36 @@ class SplitDateTimePickerWidget(forms.SplitDateTimeWidget):
                 max_date if not isinstance(max_date, datetime) else max_date.astimezone(get_current_timezone()).date()
             ).isoformat()
 
+        if date_format or time_format or without_seconds:
+            # Explicitly set data-format attributes for the JS layer instead of relying on the body-wide config
+            def date_format_attr():
+                if without_seconds:
+                    return get_javascript_format_without_seconds(date_format or "DATE_INPUT_FORMATS")
+                return get_javascript_format(date_format or "DATE_INPUT_FORMATS")
+
+            date_attrs['data-format'] = lazy(date_format_attr, str)
+
+            def time_format_attr():
+                if without_seconds:
+                    return get_javascript_format_without_seconds(time_format or "TIME_INPUT_FORMATS")
+                return get_javascript_format(time_format or "TIME_INPUT_FORMATS")
+
+            time_attrs['data-format'] = lazy(time_format_attr, str)
+
         def date_placeholder():
-            df = date_format or get_format('DATE_INPUT_FORMATS')[0]
+            if without_seconds:
+                df = date_format or get_format_without_seconds('DATE_INPUT_FORMATS')
+            else:
+                df = date_format or get_format('DATE_INPUT_FORMATS')[0]
             return now().replace(
                 year=2000, month=12, day=31, hour=18, minute=0, second=0, microsecond=0
             ).strftime(df)
 
         def time_placeholder():
-            tf = time_format or get_format('TIME_INPUT_FORMATS')[0]
+            if without_seconds:
+                tf = time_format or get_format_without_seconds('TIME_INPUT_FORMATS')
+            else:
+                tf = time_format or get_format('TIME_INPUT_FORMATS')[0]
             return now().replace(
                 year=2000, month=1, day=1, hour=0, minute=0, second=0, microsecond=0
             ).strftime(tf)
@@ -269,3 +314,18 @@ class BusinessBooleanRadio(forms.RadioSelect):
             'False': False,
             False: False,
         }.get(value)
+
+
+class OptionAttrsSelect(forms.Select):
+    def __init__(self, *args, option_attrs=None, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.option_attrs = option_attrs or {}
+
+    def create_option(self, name, value, label, selected, index, subindex=None, attrs=None):
+        option = super().create_option(
+            name, value, label, selected, index, subindex=subindex, attrs=attrs
+        )
+        extra = self.option_attrs.get(str(value))
+        if extra:
+            option["attrs"].update(extra)
+        return option

src/pretix/base/middleware.py

@@ -69,11 +69,44 @@ def get_supported_language(requested_language, allowed_languages, default_langua
     return language
 
 
-class LocaleMiddleware(MiddlewareMixin):
-
+class BaseLocaleMiddleware(MiddlewareMixin):
     """
-    This middleware sets the correct locale and timezone
-    for a request.
+    This is a reduced LocaleMiddleware that uses only information contained in the WSGI request data
+    to figure out the language (cookie and browser settings). We need it to have a consistent language
+    for error pages that are generated from the middleware stack before we know e.g. which user is logged
+    in or which event is selected.
+    """
+
+    def process_request(self, request: HttpRequest):
+        language = get_language_from_early_request(request)
+        translation.activate(language)
+        set_region(None)
+        request.LANGUAGE_CODE = language
+        timezone.deactivate()
+
+    def process_response(self, request: HttpRequest, response: HttpResponse):
+        language = translation.get_language()
+        patch_vary_headers(response, ('Accept-Language',))
+        if 'Content-Language' not in response:
+            response['Content-Language'] = language
+        return response
+
+
+class LocaleMiddleware(MiddlewareMixin):
+    """
+    This is the full LocaleMiddleware that uses all available information to figure out the correct
+    language for the request using all available sources, in this order of priority:
+
+    - Backend: User settings
+    - Language cookie
+    - Frontend: Customer account settings
+    - Browser settings
+    - Frontend: Event/Organizer settings
+    - System default
+
+    It needs to run late in the middleware stack to have all information available for these steps.
+    For some cases, it is even ran a second time since the event is sometimes only figured out after the
+    middleware stack (can happen for plugin views).
     """
 
     def process_request(self, request: HttpRequest):
@@ -188,6 +221,24 @@ def get_default_language():
         return settings.LANGUAGE_CODE
 
 
+def get_language_from_early_request(request: HttpRequest) -> str:
+    """
+    Analyzes the request to find what language the user wants the system to
+    show using only WSGI-available information. Only languages listed in
+    settings.LANGUAGES are taken into account. If the user requests a sublanguage
+    where we have a main language, we send out the main language.
+    """
+    global _supported
+    if _supported is None:
+        _supported = OrderedDict(settings.LANGUAGES)
+
+    return (
+        get_language_from_cookie(request)
+        or get_language_from_browser(request)
+        or get_default_language()
+    )
+
+
 def get_language_from_request(request: HttpRequest) -> str:
     """
     Analyzes the request to find what language the user wants the system to
@@ -202,7 +253,6 @@ def get_language_from_request(request: HttpRequest) -> str:
     if request.path.startswith(get_script_prefix() + 'control'):
         return (
             get_language_from_user_settings(request)
-            or get_language_from_customer_settings(request)
             or get_language_from_cookie(request)
             or get_language_from_browser(request)
             or get_language_from_event(request)
@@ -266,6 +316,22 @@ def _merge_csp(a, b):
 
 
 class SecurityMiddleware(MiddlewareMixin):
+    SAFE_TYPES = (
+        # CSP policies are only used for:
+        # - HTML and SVG in top-level contexts
+        # - SVG or JS Workers delivered in embedded contexts
+        # See: https://www.w3.org/TR/CSP2/#which-policy-applies
+        # Therefore, we can save bandwidth on not including our (sometimes huge) policy
+        # on API responses or CSS. We do however include it with other types as a precaution
+        # (whitelist instead of blacklist) and we also do not whitelist JavaScript in
+        # we ever add service workers to not break the protection of this feature:
+        # https://www.w3.org/TR/CSP2/#sandboxing-and-workers
+        'application/json',
+        'text/css',
+        # We used to skip CSP for PDF since it was necessary for inline previews in Safari,
+        # but at the moment it does not seem to be an issue to just send it.
+    )
+
     def process_response(self, request, resp):
         if settings.DEBUG and resp.status_code >= 400:
             # Don't use CSP on debug error page as it breaks of Django's fancy error
@@ -277,6 +343,11 @@ class SecurityMiddleware(MiddlewareMixin):
         # https://github.com/pretix/pretix/issues/765
         resp['P3P'] = 'CP=\"ALL DSP COR CUR ADM TAI OUR IND COM NAV INT\"'
 
+        if "Content-Type" in resp and resp["Content-Type"].split(";")[0] in self.SAFE_TYPES:
+            if 'Content-Security-Policy' in resp:
+                del resp['Content-Security-Policy']
+            return resp
+
         if not getattr(resp, '_csp_ignore', False):
             resp['Content-Security-Policy'] = _render_csp(self._build_csp(request, resp))
         elif 'Content-Security-Policy' in resp:
@@ -293,7 +364,7 @@ class SecurityMiddleware(MiddlewareMixin):
             'object-src': ["'none'"],
             'frame-src': ['{static}'],
             'style-src': ["{static}", "{media}"],
-            'connect-src': ["{dynamic}", "{media}"],
+            'connect-src': ["{static}", "{dynamic}", "{media}"],
             'img-src': ["{static}", "{media}", "data:"],
             'font-src': ["{static}"],
             'media-src': ["{static}", "data:"],

src/pretix/base/migrations/0304_tax_rate_decimals.py

@@ -0,0 +1,48 @@
+# Generated by Django 5.2.12 on 2026-04-15 20:10
+
+from decimal import Decimal
+
+from django.db import migrations, models
+
+import pretix.helpers.models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0303_alter_order_organizer_alter_orderposition_organizer'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='cartposition',
+            name='tax_rate',
+            field=pretix.helpers.models.NormalizedDecimalField(decimal_places=4, default=Decimal('0'), max_digits=7),
+        ),
+        migrations.AlterField(
+            model_name='invoiceline',
+            name='tax_rate',
+            field=pretix.helpers.models.NormalizedDecimalField(decimal_places=4, default=Decimal('0'), max_digits=7),
+        ),
+        migrations.AlterField(
+            model_name='orderfee',
+            name='tax_rate',
+            field=pretix.helpers.models.NormalizedDecimalField(decimal_places=4, max_digits=7),
+        ),
+        migrations.AlterField(
+            model_name='orderposition',
+            name='tax_rate',
+            field=pretix.helpers.models.NormalizedDecimalField(decimal_places=4, max_digits=7),
+        ),
+        migrations.AlterField(
+            model_name='transaction',
+            name='tax_rate',
+            field=pretix.helpers.models.NormalizedDecimalField(decimal_places=4, max_digits=7),
+        ),
+        migrations.AlterField(
+            model_name='taxrule',
+            name='rate',
+            field=pretix.helpers.models.NormalizedDecimalField(decimal_places=4, max_digits=7),
+        ),
+
+    ]

src/pretix/base/migrations/0305_fixup_eventmetaproperties.py

@@ -0,0 +1,91 @@
+# Generated by Django 5.2.12 on 2026-04-28 11:34
+import logging
+
+from django.db import IntegrityError, migrations, transaction
+from django.db.models import Count, F
+
+logger = logging.getLogger(__name__)
+
+
+def fix_cross_organizer_eventmetavalues(apps, schema_editor):
+    EventMetaProperty = apps.get_model("pretixbase", "EventMetaProperty")
+    EventMetaValue = apps.get_model("pretixbase", "EventMetaValue")
+
+    cross_org_values = EventMetaValue.objects.filter(
+        event__organizer__pk__ne=F('property__organizer__pk')
+    ).order_by('event__organizer__slug', 'event__slug')
+    for emv in cross_org_values:
+        logger.warning("%s", f"Fixing cross-organizer EventMetaValue: {emv.event.organizer.slug}/{emv.event.slug}")
+        logger.warning("  %s", f"{emv.property.name}({emv.property.id}@{emv.property.organizer.slug}) = {repr(emv.value)}")
+        try:
+            emv.property = emv.event.organizer.meta_properties.get(name=emv.property.name)
+            if EventMetaValue.objects.filter(event=emv.event, property=emv.property).exists():
+                correct = EventMetaValue.objects.get(event=emv.event, property=emv.property)
+                if correct.value != emv.value:
+                    logger.warning("  %s", f"WARN: conflicting EventMetaValue with property in correct organizer already exists, deleting the cross-organizer one")
+                else:
+                    logger.warning("  %s", f"OK: same-value EventMetaValue with property in correct organizer already exists, deleting the cross-organizer one")
+                logger.warning("  %s", f"keeping: {correct.property.name}({correct.property.id}@{correct.property.organizer.slug}) = {repr(correct.value)}")
+                emv.delete()
+            else:
+                logger.warning("  %s", f"OK: found existing EventMetaProperty in {emv.event.organizer.slug}, updating reference")
+                logger.warning("  %s", f"after: {emv.property.name}({emv.property.id}@{emv.property.organizer.slug}) = {repr(emv.value)}")
+                emv.save(update_fields=["property"])
+        except EventMetaProperty.DoesNotExist:
+            meta_prop = emv.property
+            meta_prop.pk = None
+            meta_prop.organizer = emv.event.organizer
+            meta_prop.filter_public = False
+            meta_prop.save(force_insert=True)
+            logger.warning("  %s", f"WARN: found no matching EventMetaProperty, creating")
+            logger.warning("  %s", f"after: {emv.property.name}({emv.property.id}@{emv.property.organizer.slug}) = {repr(emv.value)}")
+            emv.save(update_fields=["property"])
+
+
+def make_eventmetaproperties_unique(apps, schema_editor):
+    EventMetaProperty = apps.get_model("pretixbase", "EventMetaProperty")
+    EventMetaValue = apps.get_model("pretixbase", "EventMetaValue")
+
+    duplicates = EventMetaProperty.objects.values('organizer', 'organizer__slug', 'name').annotate(count=Count('id')).filter(count__gt=1)
+    for dup in duplicates:
+        logger.warning("%s", f"Fixup duplicate property {dup['organizer__slug']} {dup['name']}")
+        props = list(EventMetaProperty.objects.filter(organizer=dup['organizer'], name=dup['name']))
+
+        target = props[0]
+        invalid = props[1:]
+
+        try:
+            with transaction.atomic():
+                affected = EventMetaValue.objects.filter(
+                    event__organizer=dup['organizer'], property__in=invalid
+                ).update(
+                    property=target
+                )
+                logger.warning("%s", f"  Switching {affected} value(s) over to {target.name}({target.id}@{target.organizer.slug})")
+
+        except IntegrityError as e:
+            logger.warning("%s", f"  Failed to switch all value(s) over to {target.name}({target.id}@{target.organizer.slug})")
+            logger.warning("%s", f"  {e}")
+            for prop in invalid:
+                newname = f'{prop.name}_DUPLICATE_{prop.id}'
+                logger.warning("%s", f"  Renaming {prop.name}({prop.id}@{prop.organizer.slug}) to {newname}({prop.id}@{prop.organizer.slug})")
+                prop.name = newname
+                prop.filter_public = False
+                prop.save()
+
+        else:
+            for prop in invalid:
+                logger.warning("%s", f"  Deleting {prop.name}({prop.id}@{prop.organizer.slug})")
+                prop.delete()
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("pretixbase", "0304_tax_rate_decimals"),
+    ]
+
+    operations = [
+        migrations.RunPython(fix_cross_organizer_eventmetavalues, migrations.RunPython.noop),
+        migrations.RunPython(make_eventmetaproperties_unique, migrations.RunPython.noop),
+    ]

src/pretix/base/migrations/0306_alter_eventmetaproperty_unique_together.py

@@ -0,0 +1,17 @@
+# Generated by Django 5.2.12 on 2026-04-28 11:34
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("pretixbase", "0305_fixup_eventmetaproperties"),
+    ]
+
+    operations = [
+        migrations.AlterUniqueTogether(
+            name="eventmetaproperty",
+            unique_together={("organizer", "name")},
+        ),
+    ]

src/pretix/base/models/event.py

@@ -179,6 +179,12 @@ class EventMixin:
             self.date_to.astimezone(tz), ("D" if short else "l")
         )
 
+    def is_same_day(self):
+        if not self.date_to:
+            return True
+        else:
+            return self.date_from.astimezone(self.timezone).date() == self.date_to.astimezone(self.timezone).date()
+
     def get_date_range_display(self, tz=None, force_show_end=False, as_html=False, try_to_show_times=False) -> str:
         """
         Returns a formatted string containing the start date and the end date
@@ -649,7 +655,7 @@ class Event(EventMixin, LoggedModel):
     is_remote = models.BooleanField(
         default=False,
         verbose_name=_("This event is remote or partially remote."),
-        help_text=_("This will be used to let users know if the event is in a different timezone and let’s us calculate users’ local times."),
+        help_text=_("This will be used to let users know if the event is in a different timezone, and to let us calculate the local time of a user."),
     )
     geo_lat = models.FloatField(
         verbose_name=_("Latitude"),
@@ -1851,6 +1857,7 @@ class EventMetaProperty(LoggedModel):
 
     class Meta:
         ordering = ("position", "name",)
+        unique_together = ('organizer', 'name')
 
     @property
     def choice_keys(self):

src/pretix/base/models/invoices.py

@@ -49,6 +49,7 @@ from django_scopes import ScopedManager
 
 from pretix.base.settings import COUNTRIES_WITH_STATE_IN_ADDRESS
 from pretix.helpers.countries import FastCountryField
+from pretix.helpers.models import NormalizedDecimalField
 
 
 def invoice_filename(instance, filename: str) -> str:
@@ -450,7 +451,7 @@ class InvoiceLine(models.Model):
     description = models.TextField()
     gross_value = models.DecimalField(max_digits=13, decimal_places=2)
     tax_value = models.DecimalField(max_digits=13, decimal_places=2, default=Decimal('0.00'))
-    tax_rate = models.DecimalField(max_digits=7, decimal_places=2, default=Decimal('0.00'))
+    tax_rate = NormalizedDecimalField(max_digits=7, decimal_places=4, default=Decimal('0'))
     tax_name = models.CharField(max_length=190)
     tax_code = models.CharField(max_length=190, null=True, blank=True)
     subevent = models.ForeignKey('SubEvent', null=True, blank=True, on_delete=models.PROTECT)

src/pretix/base/models/items.py

@@ -885,26 +885,6 @@ class Item(LoggedModel):
             return False
         return True
 
-    def unavailability_reason(self, now_dt: datetime=None, has_voucher=False, subevent=None) -> Optional[str]:
-        now_dt = now_dt or time_machine_now()
-        subevent_item = subevent and subevent.item_overrides.get(self.pk)
-        if not self.active:
-            return 'active'
-        elif self.available_from and self.available_from > now_dt:
-            return 'available_from'
-        elif self.available_until and self.available_until < now_dt:
-            return 'available_until'
-        elif (self.require_voucher or self.hide_without_voucher) and not has_voucher:
-            return 'require_voucher'
-        elif subevent_item and subevent_item.available_from and subevent_item.available_from > now_dt:
-            return 'available_from'
-        elif subevent_item and subevent_item.available_until and subevent_item.available_until < now_dt:
-            return 'available_until'
-        elif self.hidden_if_item_available and self._dependency_available:
-            return 'hidden_if_item_available'
-        else:
-            return None
-
     def _get_quotas(self, ignored_quotas=None, subevent=None):
         check_quotas = set(getattr(
             self, '_subevent_quotas',  # Utilize cache in product list
@@ -1413,22 +1393,6 @@ class ItemVariation(models.Model):
             return False
         return True
 
-    def unavailability_reason(self, now_dt: datetime=None, has_voucher=False, subevent=None) -> Optional[str]:
-        now_dt = now_dt or time_machine_now()
-        subevent_var = subevent and subevent.var_overrides.get(self.pk)
-        if not self.active:
-            return 'active'
-        elif self.available_from and self.available_from > now_dt:
-            return 'available_from'
-        elif self.available_until and self.available_until < now_dt:
-            return 'available_until'
-        elif subevent_var and subevent_var.available_from and subevent_var.available_from > now_dt:
-            return 'available_from'
-        elif subevent_var and subevent_var.available_until and subevent_var.available_until < now_dt:
-            return 'available_until'
-        else:
-            return None
-
     @property
     def meta_data(self):
         data = self.item.meta_data

src/pretix/base/models/orders.py

@@ -87,6 +87,7 @@ from pretix.base.timemachine import time_machine_now
 
 from ...helpers import OF_SELF
 from ...helpers.countries import CachedCountries, FastCountryField
+from ...helpers.models import NormalizedDecimalField
 from ...helpers.names import build_name
 from ...testutils.middleware import debugflags_var
 from ._transactions import (
@@ -2354,8 +2355,8 @@ class OrderFee(RoundingCorrectionMixin, models.Model):
     )
     description = models.CharField(max_length=190, blank=True)
     internal_type = models.CharField(max_length=255, blank=True)
-    tax_rate = models.DecimalField(
-        max_digits=7, decimal_places=2,
+    tax_rate = NormalizedDecimalField(
+        max_digits=7, decimal_places=4,
         verbose_name=_('Tax rate')
     )
     tax_rule = models.ForeignKey(
@@ -2551,8 +2552,8 @@ class OrderPosition(AbstractPosition):
         max_digits=13, decimal_places=2, null=True, blank=True,
     )
 
-    tax_rate = models.DecimalField(
-        max_digits=7, decimal_places=2,
+    tax_rate = NormalizedDecimalField(
+        max_digits=7, decimal_places=4,
         verbose_name=_('Tax rate')
     )
     tax_rule = models.ForeignKey(
@@ -3070,8 +3071,8 @@ class Transaction(models.Model):
     price_includes_rounding_correction = models.DecimalField(
         max_digits=13, decimal_places=2, default=Decimal("0.00")
     )
-    tax_rate = models.DecimalField(
-        max_digits=7, decimal_places=2,
+    tax_rate = NormalizedDecimalField(
+        max_digits=7, decimal_places=4,
         verbose_name=_('Tax rate')
     )
     tax_rule = models.ForeignKey(
@@ -3186,8 +3187,8 @@ class CartPosition(AbstractPosition):
         verbose_name=_("Limit for extending expiration date"),
         null=True
     )
-    tax_rate = models.DecimalField(
-        max_digits=7, decimal_places=2, default=Decimal('0.00'),
+    tax_rate = NormalizedDecimalField(
+        max_digits=7, decimal_places=4, default=Decimal('0'),
         verbose_name=_('Tax rate')
     )
     tax_code = models.CharField(

src/pretix/base/models/tax.py

@@ -40,6 +40,7 @@ from pretix.base.decimal import round_decimal
 from pretix.base.models.base import LoggedModel
 from pretix.base.templatetags.money import money_filter
 from pretix.helpers.countries import FastCountryField
+from pretix.helpers.models import NormalizedDecimalField
 
 
 class TaxedPrice:
@@ -335,9 +336,9 @@ class TaxRule(LoggedModel):
         max_length=190,
         choices=TAX_CODE_LISTS,
     )
-    rate = models.DecimalField(
-        max_digits=10,
-        decimal_places=2,
+    rate = NormalizedDecimalField(
+        max_digits=7,
+        decimal_places=4,
         validators=[
             MaxValueValidator(
                 limit_value=Decimal("100.00"),

src/pretix/base/payment.py

@@ -936,7 +936,7 @@ class BasePaymentProvider:
         """
         Will be called if the *event administrator* views the details of a payment.
 
-        It should return HTML code containing information regarding the current payment
+        It should return a SafeString containing HTML code, with information regarding the current payment
         status and, if applicable, next steps.
 
         The default implementation returns an empty string.
@@ -961,7 +961,7 @@ class BasePaymentProvider:
         """
         Will be called if the *event administrator* views the details of a refund.
 
-        It should return HTML code containing information regarding the current refund
+        It should return a SafeString containing HTML code, with information regarding the current refund
         status and, if applicable, next steps.
 
         The default implementation returns an empty string.

src/pretix/base/reldate.py

@@ -19,30 +19,245 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
+import copy
 import datetime
+import os
+import warnings
 from collections import namedtuple
-from typing import Union
+from dataclasses import dataclass
+from typing import (
+    TYPE_CHECKING, Iterable, List, Literal, Optional, Tuple, Union, cast,
+)
 from zoneinfo import ZoneInfo
 
 from dateutil import parser
 from django import forms
 from django.core.exceptions import ValidationError
 from django.db import models
+from django.forms.widgets import Widget
 from django.utils.formats import get_format
-from django.utils.functional import lazy
+from django.utils.functional import Promise, lazy
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 from rest_framework import serializers
 
-BASE_CHOICES = (
-    ('date_from', _('Event start')),
-    ('date_to', _('Event end')),
-    ('date_admission', _('Event admission')),
-    ('presale_start', _('Presale start')),
-    ('presale_end', _('Presale end')),
-)
+from pretix.base.forms.widgets import OptionAttrsSelect
 
-RelativeDate = namedtuple('RelativeDate', ['days', 'minutes', 'time', 'is_after', 'base_date_name'], defaults=(0, None, None, False, 'date_from'))
+if TYPE_CHECKING:
+    from .models import Event, Order, SubEvent
+
+
+@dataclass(frozen=True)
+class BaseChoice:
+    base: Literal["event", "order"]
+    attribute: str
+    text: Promise
+    supports_before: bool
+    supports_after: bool
+
+    @property
+    def key(self) -> str:
+        key = f"{self.base}__{self.attribute}"
+        return key
+
+    @staticmethod
+    def find(objects: Iterable["BaseChoice"], key: str) -> "BaseChoice":
+        if "__" in key:
+            choice = next((obj for obj in objects if obj.key == key), None)
+        else:
+            # fallback for RelativeDateFields stored, before support for bases other than event was added
+            choice = next((obj for obj in objects if obj.attribute == key and obj.base == "event"), None)
+
+        if choice is None:
+            raise TypeError(f"key {key} must be a valid key in BASE_CHOICES")
+
+        return choice
+
+
+BASE_CHOICES: List[BaseChoice] = [
+    BaseChoice('event', 'date_from', _('Event start'), True, True),
+    BaseChoice('event', 'date_to', _('Event end'), True, True),
+    BaseChoice('event', 'date_admission', _('Event admission'), True, True),
+    BaseChoice('event', 'presale_start', _('Presale start'), True, True),
+    BaseChoice('event', 'presale_end', _('Presale end'), True, True),
+    BaseChoice('order', 'datetime', _('Order creation'), False, True),
+    BaseChoice('order', 'expires', _('Order expiry'), True, True),
+]
+
+EVENT_BASE_CHOICES = [
+    x for x in BASE_CHOICES if x.base == 'event'
+]
+
+ORDER_BASE_CHOICES = [
+    x for x in BASE_CHOICES if x.base == 'order'
+]
+
+
+@dataclass(frozen=True)
+class RelativeDate:
+    """
+    This contains information on a date that is defined in relation to a fixed base point.
+    This means that the underlying data is a fixed date as the base point and a number of days or a time interval
+    to calculate the date.
+
+    The list of valid base date choices is defined in BASE_CHOICES.
+    If the base_date_name is not set, the date_from attribute of Event is used.
+    """
+
+    days: int = 0
+    minutes: Optional[int] = None
+    time: Optional[datetime.time] = None
+    is_after: bool = False
+    base_date_name: str = 'event__date_from__'
+
+    def __post_init__(self) -> None:
+        if self.is_after and not self._choice.supports_after:
+            raise ValueError(
+                "The selected base date and attribute combination does not support relative dates placed after the base date"
+            )
+        if not self.is_after and not self._choice.supports_before:
+            raise ValueError(
+                "The selected base date and attribute combination does not support relative dates placed before the base date")
+
+    @property
+    def _choice(self):
+        return BaseChoice.find(BASE_CHOICES, self.base_date_name)
+
+    @property
+    def key(self):
+        return self._choice.key
+
+    def __eq__(self, o: object) -> bool:
+        if not isinstance(o, RelativeDate):
+            return False
+        return self.to_string() == o.to_string()
+
+    def _resolve_date(self, base: "Event | Order | SubEvent") -> Tuple[datetime.datetime, ZoneInfo]:
+        """
+        Resolves the datetime and timezone information of this RelativeDate object in relation to the provided reference.
+
+        :param base: the reference which should be used to resolve the relative date
+        :return:
+        """
+        from .models import Event, Order, SubEvent
+
+        choice = self._choice
+
+        if choice.base == "order" and isinstance(base, Order):
+            event = base.event
+            base_date = getattr(base, choice.attribute)
+        elif choice.base == "event" and isinstance(base, SubEvent):
+            event = base.event
+            base_date = (getattr(base, choice.attribute) or
+                         getattr(base.event, choice.attribute) or
+                         base.date_from)
+        elif choice.base == "event" and isinstance(base, Event):
+            event = base
+            base_date = getattr(base, choice.attribute) or event.date_from
+        else:
+            raise TypeError("The base defined by data does not match the passed in base")
+
+        tz = ZoneInfo(event.settings.timezone)
+        return base_date, tz
+
+    def date(self, base: "Event | Order | SubEvent") -> datetime.date:
+        """
+        Resolves the effective date of this RelativeDate object in relation to the provided reference.
+
+        :param base: the reference which should be used to resolve the date
+        :return: datetime.date
+        """
+        if self.minutes is not None:
+            raise ValueError('A minute-based relative datetime can not be used as a date')
+
+        base_date, tz = self._resolve_date(base)
+
+        if self.is_after:
+            new_date = base_date.astimezone(tz) + datetime.timedelta(days=self.days)
+        else:
+            new_date = base_date.astimezone(tz) - datetime.timedelta(days=self.days)
+        return new_date.date()
+
+    def datetime(self, base: "Event | Order | SubEvent") -> datetime.datetime:
+        """
+        Resolves the effective datetime of this RelativeDate object in relation to the provided reference.
+
+        :param base: the reference which should be used to resolve the datetime
+        :return: datetime.datetime
+        """
+        base_date, tz = self._resolve_date(base)
+
+        if self.minutes is not None:
+            if self.is_after:
+                return base_date.astimezone(tz) + datetime.timedelta(minutes=self.minutes)
+            else:
+                return base_date.astimezone(tz) - datetime.timedelta(minutes=self.minutes)
+        else:
+            if self.is_after:
+                new_date = (base_date.astimezone(tz) + datetime.timedelta(days=self.days)).astimezone(tz)
+            else:
+                new_date = (base_date.astimezone(tz) - datetime.timedelta(days=self.days)).astimezone(tz)
+            if self.time:
+                new_date = new_date.replace(
+                    hour=self.time.hour,
+                    minute=self.time.minute,
+                    second=self.time.second
+                )
+            new_date = new_date.astimezone(tz)
+            return new_date
+
+    def to_string(self) -> str:
+        if self.minutes is not None:
+            return 'RELDATE/minutes/{}/{}/{}'.format(  #
+                self.minutes,
+                self._choice.key,
+                'after' if self.is_after else '',
+            )
+        return 'RELDATE/{}/{}/{}/{}'.format(  #
+            self.days,
+            self.time.strftime('%H:%M:%S') if self.time else '-',
+            self._choice.key,
+            'after' if self.is_after else '',
+        )
+
+    @classmethod
+    def from_string(cls, input: str):
+        if not input.startswith('RELDATE/'):
+            raise TypeError("Invalid input for RelativeDate.from_string()")
+
+        parts = input.split('/')
+        if parts[1] == 'minutes':
+            data = RelativeDate(
+                days=0,
+                minutes=int(parts[2]),
+                base_date_name=parts[3],
+                time=None,
+                is_after=len(parts) > 4 and parts[4] == "after",
+            )
+        else:
+            if parts[2] == '-':
+                time = None
+            else:
+                timeparts = parts[2].split(':')
+                time = datetime.time(hour=int(timeparts[0]), minute=int(timeparts[1]), second=int(timeparts[2]))
+            try:
+                data = RelativeDate(
+                    days=int(parts[1] or 0),
+                    base_date_name=parts[3],
+                    time=time,
+                    minutes=None,
+                    is_after=len(parts) > 4 and parts[4] == "after",
+                )
+            except ValueError:
+                data = RelativeDate(
+                    days=0,
+                    base_date_name=parts[3],
+                    time=time,
+                    minutes=None,
+                    is_after=len(parts) > 4 and parts[4] == "after",
+                )
+
+        return data
 
 
 class RelativeDateWrapper:
@@ -50,130 +265,53 @@ class RelativeDateWrapper:
     This contains information on a date that might be relative to an event. This means
     that the underlying data is either a fixed date or a number of days and a wall clock
     time to calculate the date based on a base point.
-
-    The base point can be the date_from, date_to, date_admission, presale_start or presale_end
-    attribute of an event or subevent. If the respective attribute is not set, ``date_from``
-    will be used.
     """
 
     def __init__(self, data: Union[datetime.datetime, RelativeDate]):
         self.data = data
 
-    def date(self, event) -> datetime.date:
-        from .models import SubEvent
+    def date(self, base: "Event | Order | SubEvent") -> datetime.date:
+        """
+        If the RelativeDateWrapper wraps a RelativeDate object:
+            Resolves the effective date of this object in relation to the provided reference.
+        If the RelativeDateWrapper wraps an absolute date or datetime:
+            Returns the wrapped absolute date.
 
+        :param base: the reference which should be used to resolve the date in case it is a relative date.
+        :return: datetime.date
+        """
         if isinstance(self.data, datetime.datetime):
             return self.data.date()
         elif isinstance(self.data, datetime.date):
             return self.data
         else:
-            if self.data.minutes is not None:
-                raise ValueError('A minute-based relative datetime can not be used as a date')
+            return self.data.date(base)
 
-            tz = ZoneInfo(event.settings.timezone)
-            if isinstance(event, SubEvent):
-                base_date = (
-                    getattr(event, self.data.base_date_name)
-                    or getattr(event.event, self.data.base_date_name)
-                    or event.date_from
-                )
-            else:
-                base_date = getattr(event, self.data.base_date_name) or event.date_from
-
-            if self.data.is_after:
-                new_date = base_date.astimezone(tz) + datetime.timedelta(days=self.data.days)
-            else:
-                new_date = base_date.astimezone(tz) - datetime.timedelta(days=self.data.days)
-            return new_date.date()
-
-    def datetime(self, event) -> datetime.datetime:
-        from .models import SubEvent
+    def datetime(self, base: "Event | Order | SubEvent") -> datetime.datetime:
+        """
+        If the RelativeDateWrapper wraps a RelativeDate object:
+            Resolves the effective datetime of this object in relation to the provided reference.
+        If the RelativeDateWrapper wraps an absolute date or datetime:
+            Returns the wrapped absolute datetime.
 
+        :param base: the reference which should be used to resolve the datetime in case it is a relative datetime.
+        :return: datetime.datetime
+        """
         if isinstance(self.data, (datetime.datetime, datetime.date)):
             return self.data
         else:
-            tz = ZoneInfo(event.settings.timezone)
-            if isinstance(event, SubEvent):
-                base_date = (
-                    getattr(event, self.data.base_date_name)
-                    or getattr(event.event, self.data.base_date_name)
-                    or event.date_from
-                )
-            else:
-                base_date = getattr(event, self.data.base_date_name) or event.date_from
-
-            if self.data.minutes is not None:
-                if self.data.is_after:
-                    return base_date.astimezone(tz) + datetime.timedelta(minutes=self.data.minutes)
-                else:
-                    return base_date.astimezone(tz) - datetime.timedelta(minutes=self.data.minutes)
-            else:
-                if self.data.is_after:
-                    new_date = (base_date.astimezone(tz) + datetime.timedelta(days=self.data.days)).astimezone(tz)
-                else:
-                    new_date = (base_date.astimezone(tz) - datetime.timedelta(days=self.data.days)).astimezone(tz)
-                if self.data.time:
-                    new_date = new_date.replace(
-                        hour=self.data.time.hour,
-                        minute=self.data.time.minute,
-                        second=self.data.time.second
-                    )
-                new_date = new_date.astimezone(tz)
-                return new_date
+            return self.data.datetime(base)
 
     def to_string(self) -> str:
         if isinstance(self.data, (datetime.datetime, datetime.date)):
             return self.data.isoformat()
         else:
-            if self.data.minutes is not None:
-                return 'RELDATE/minutes/{}/{}/{}'.format(  #
-                    self.data.minutes,
-                    self.data.base_date_name,
-                    'after' if self.data.is_after else '',
-                )
-            return 'RELDATE/{}/{}/{}/{}'.format(  #
-                self.data.days,
-                self.data.time.strftime('%H:%M:%S') if self.data.time else '-',
-                self.data.base_date_name,
-                'after' if self.data.is_after else '',
-            )
+            return self.data.to_string()
 
     @classmethod
     def from_string(cls, input: str):
         if input.startswith('RELDATE/'):
-            parts = input.split('/')
-            if parts[1] == 'minutes':
-                data = RelativeDate(
-                    days=0,
-                    minutes=int(parts[2]),
-                    base_date_name=parts[3],
-                    time=None,
-                    is_after=len(parts) > 4 and parts[4] == "after",
-                )
-            else:
-                if parts[2] == '-':
-                    time = None
-                else:
-                    timeparts = parts[2].split(':')
-                    time = datetime.time(hour=int(timeparts[0]), minute=int(timeparts[1]), second=int(timeparts[2]))
-                try:
-                    data = RelativeDate(
-                        days=int(parts[1] or 0),
-                        base_date_name=parts[3],
-                        time=time,
-                        minutes=None,
-                        is_after=len(parts) > 4 and parts[4] == "after",
-                    )
-                except ValueError:
-                    data = RelativeDate(
-                        days=0,
-                        base_date_name=parts[3],
-                        time=time,
-                        minutes=None,
-                        is_after=len(parts) > 4 and parts[4] == "after",
-                    )
-            if data.base_date_name not in [k[0] for k in BASE_CHOICES]:
-                raise ValueError('{} is not a valid base date'.format(data.base_date_name))
+            data = RelativeDate.from_string(input)
         else:
             data = parser.parse(input)
         return RelativeDateWrapper(data)
@@ -187,7 +325,6 @@ BEFORE_AFTER_CHOICE = (
     ('after', _('after')),
 )
 
-
 reldatetimeparts = namedtuple('reldatetimeparts', (
     "status",  # 0
     "absolute",  # 1
@@ -202,6 +339,14 @@ reldatetimeparts = namedtuple('reldatetimeparts', (
 reldatetimeparts.indizes = reldatetimeparts(*range(9))
 
 
+def _get_choices(base_choices: List[BaseChoice]) -> List[Tuple[str, Promise]]:
+    return [(c.key, c.text) for c in base_choices]
+
+
+def _get_choice_validation_obj(choices: List[BaseChoice]):
+    return {c.key: {"data-supports-before": c.supports_before, "data-supports-after": c.supports_after} for c in choices}
+
+
 class RelativeDateTimeWidget(forms.MultiWidget):
     template_name = 'pretixbase/forms/widgets/reldatetime.html'
     parts = reldatetimeparts
@@ -209,6 +354,7 @@ class RelativeDateTimeWidget(forms.MultiWidget):
     def __init__(self, *args, **kwargs):
         self.status_choices = kwargs.pop('status_choices')
         base_choices = kwargs.pop('base_choices')
+        choices = _get_choices(base_choices)
 
         def placeholder_datetime_format():
             df = get_format('DATETIME_INPUT_FORMATS')[0]
@@ -220,21 +366,29 @@ class RelativeDateTimeWidget(forms.MultiWidget):
             tf = get_format('TIME_INPUT_FORMATS')[0]
             return datetime.time(8, 30, 0).strftime(tf)
 
-        widgets = reldatetimeparts(
+        widgets = cast(dict[str, Widget | type[Widget]], cast(object, reldatetimeparts(
             status=forms.RadioSelect(choices=self.status_choices),
             absolute=forms.DateTimeInput(
                 attrs={'placeholder': lazy(placeholder_datetime_format, str), 'class': 'datetimepicker'}
             ),
             rel_days_number=forms.NumberInput(),
-            rel_mins_relationto=forms.Select(choices=base_choices),
+            rel_mins_relationto=OptionAttrsSelect(
+                attrs={'data-relative-choice': True},
+                choices=choices,
+                option_attrs=_get_choice_validation_obj(base_choices)
+            ),
             rel_days_timeofday=forms.TimeInput(
                 attrs={'placeholder': lazy(placeholder_time_format, str), 'class': 'timepickerfield'}
             ),
             rel_mins_number=forms.NumberInput(),
-            rel_days_relationto=forms.Select(choices=base_choices),
-            rel_mins_relation=forms.Select(choices=BEFORE_AFTER_CHOICE),
-            rel_days_relation=forms.Select(choices=BEFORE_AFTER_CHOICE),
-        )
+            rel_days_relationto=OptionAttrsSelect(
+                attrs={'data-relative-choice': True},
+                choices=choices,
+                option_attrs=_get_choice_validation_obj(base_choices)
+            ),
+            rel_mins_relation=forms.Select(attrs={'data-relation-choice': True}, choices=BEFORE_AFTER_CHOICE),
+            rel_days_relation=forms.Select(attrs={'data-relation-choice': True}, choices=BEFORE_AFTER_CHOICE),
+        )))
         super().__init__(widgets=widgets, *args, **kwargs)
 
     def decompress(self, value):
@@ -247,10 +401,10 @@ class RelativeDateTimeWidget(forms.MultiWidget):
                 status="unset",
                 absolute=None,
                 rel_days_number=1,
-                rel_mins_relationto="date_from",
+                rel_mins_relationto="event__date_from",
                 rel_days_timeofday=None,
                 rel_mins_number=0,
-                rel_days_relationto="date_from",
+                rel_days_relationto="event__date_from",
                 rel_mins_relation="before",
                 rel_days_relation="before"
             )
@@ -259,10 +413,10 @@ class RelativeDateTimeWidget(forms.MultiWidget):
                 status="absolute",
                 absolute=value.data,
                 rel_days_number=1,
-                rel_mins_relationto="date_from",
+                rel_mins_relationto="event__date_from",
                 rel_days_timeofday=None,
                 rel_mins_number=0,
-                rel_days_relationto="date_from",
+                rel_days_relationto="event__date_from",
                 rel_mins_relation="before",
                 rel_days_relation="before"
             )
@@ -271,10 +425,10 @@ class RelativeDateTimeWidget(forms.MultiWidget):
                 status="relative_minutes",
                 absolute=None,
                 rel_days_number=None,
-                rel_mins_relationto=value.data.base_date_name,
+                rel_mins_relationto=value.data.key,
                 rel_days_timeofday=None,
                 rel_mins_number=value.data.minutes,
-                rel_days_relationto=value.data.base_date_name,
+                rel_days_relationto=value.data.key,
                 rel_mins_relation="after" if value.data.is_after else "before",
                 rel_days_relation="after" if value.data.is_after else "before"
             )
@@ -282,10 +436,10 @@ class RelativeDateTimeWidget(forms.MultiWidget):
             status="relative",
             absolute=None,
             rel_days_number=value.data.days,
-            rel_mins_relationto=value.data.base_date_name,
+            rel_mins_relationto=value.data.key,
             rel_days_timeofday=value.data.time,
             rel_mins_number=0,
-            rel_days_relationto=value.data.base_date_name,
+            rel_days_relationto=value.data.key,
             rel_mins_relation="after" if value.data.is_after else "before",
             rel_days_relation="after" if value.data.is_after else "before"
         )
@@ -309,17 +463,41 @@ class RelativeDateTimeField(forms.MultiValueField):
             ('relative', _('Relative date:')),
             ('relative_minutes', _('Relative time:')),
         ]
+        self.relative_to_order = kwargs.pop('relative_to_order', False)
+
+        possible_choices = copy.deepcopy(EVENT_BASE_CHOICES)
+        if self.relative_to_order:
+            possible_choices.extend(ORDER_BASE_CHOICES)
+
         if kwargs.get('limit_choices'):
             limit = kwargs.pop('limit_choices')
-            choices = [(k, v) for k, v in BASE_CHOICES if k in limit]
-        else:
-            choices = BASE_CHOICES
+            if any(["__" not in l for l in limit]):
+                _warn_skips = (str(os.path.dirname(__file__)),)
+
+                warnings.warn(
+                    message="Please prefix limit_choices with the base the attributes refer to, for example event__date_from",
+                    category=DeprecationWarning,
+                    skip_file_prefixes=_warn_skips
+                )
+
+            possible_choices = [
+                c for c in possible_choices if
+                # new base case as we want limit_choices to be expressed as base__attribute
+                (c.key in limit) or
+                # fallback for old event based entries
+                # if the base is an event, then using only attribute is fine
+                (c.base == "event" and c.attribute in limit)
+            ]
+
         if not kwargs.get('required', True):
             status_choices.insert(0, ('unset', _('Not set')))
+
+        choices = _get_choices(possible_choices)
+
         fields = reldatetimeparts(
             status=forms.ChoiceField(
                 choices=status_choices,
-                required=True
+                required=True,
             ),
             absolute=forms.DateTimeField(
                 required=False
@@ -329,7 +507,7 @@ class RelativeDateTimeField(forms.MultiValueField):
             ),
             rel_mins_relationto=forms.ChoiceField(
                 choices=choices,
-                required=False
+                required=False,
             ),
             rel_days_timeofday=forms.TimeField(
                 required=False,
@@ -339,7 +517,7 @@ class RelativeDateTimeField(forms.MultiValueField):
             ),
             rel_days_relationto=forms.ChoiceField(
                 choices=choices,
-                required=False
+                required=False,
             ),
             rel_mins_relation=forms.ChoiceField(
                 choices=BEFORE_AFTER_CHOICE,
@@ -350,8 +528,9 @@ class RelativeDateTimeField(forms.MultiValueField):
                 required=False
             ),
         )
+
         if 'widget' not in kwargs:
-            kwargs['widget'] = RelativeDateTimeWidget(status_choices=status_choices, base_choices=choices)
+            kwargs['widget'] = RelativeDateTimeWidget(status_choices=status_choices, base_choices=possible_choices)
         kwargs.pop('max_length', 0)
         kwargs.pop('empty_value', 0)
         super().__init__(
@@ -359,21 +538,24 @@ class RelativeDateTimeField(forms.MultiValueField):
         )
 
     def set_event(self, event):
-        self.widget.widgets[reldatetimeparts.indizes.rel_days_relationto].choices = [
-            (k, v) for k, v in BASE_CHOICES if getattr(event, k, None)
-        ]
-        self.widget.widgets[reldatetimeparts.indizes.rel_mins_relationto].choices = [
-            (k, v) for k, v in BASE_CHOICES if getattr(event, k, None)
-        ]
+        possible_choices = copy.deepcopy(EVENT_BASE_CHOICES)
+        if self.relative_to_order:
+            possible_choices.extend(ORDER_BASE_CHOICES)
+
+        possible_choices = possible_choices
+        choices = _get_choices(possible_choices)
+
+        self.widget.widgets[reldatetimeparts.indizes.rel_days_relationto].choices = choices
+        self.widget.widgets[reldatetimeparts.indizes.rel_mins_relationto].choices = choices
 
     def compress(self, data_list):
         if not data_list:
             return None
         data = reldatetimeparts(*data_list)
-        if data.status == 'absolute':
-            return RelativeDateWrapper(data.absolute)
-        elif data.status == 'unset':
+        if data.status == 'unset':
             return None
+        elif data.status == 'absolute':
+            return RelativeDateWrapper(data.absolute)
         elif data.status == 'relative_minutes':
             return RelativeDateWrapper(RelativeDate(
                 days=0,
@@ -404,6 +586,18 @@ class RelativeDateTimeField(forms.MultiValueField):
             raise ValidationError(self.error_messages['incomplete'])
         elif data.status == 'relative_minutes' and (data.rel_mins_number is None or not data.rel_mins_relationto):
             raise ValidationError(self.error_messages['incomplete'])
+        elif data.status == 'relative':
+            choice = BaseChoice.find(BASE_CHOICES, data.rel_days_relationto)
+            if data.rel_days_relation == "before" and not choice.supports_before:
+                raise ValidationError(_('A relative date cannot be expressed as "before" for "{}"'.format(choice.text)))
+            elif data.status == 'relative' and data.rel_days_relation == "after" and not choice.supports_after:
+                raise ValidationError(_('A relative date cannot be expressed as "after" for "{}"'.format(choice.text)))
+        elif data.status == 'relative_minutes':
+            choice = BaseChoice.find(BASE_CHOICES, data.rel_days_relationto)
+            if data.rel_days_relation == "before" and not choice.supports_before:
+                raise ValidationError(_('A relative time cannot be expressed as "before" for "{}"'.format(choice.text)))
+            elif data.rel_days_relation == "after" and not choice.supports_after:
+                raise ValidationError(_('A relative time cannot be expressed as "after" for "{}"'.format(choice.text)))
 
         return super().clean(value)
 
@@ -424,15 +618,20 @@ class RelativeDateWidget(RelativeDateTimeWidget):
 
     def __init__(self, *args, **kwargs):
         self.status_choices = kwargs.pop('status_choices')
-        widgets = reldateparts(
+        self.base_choices = kwargs.pop('base_choices')
+        widgets = cast(dict[str, Widget | type[Widget]], cast(object, reldateparts(
             status=forms.RadioSelect(choices=self.status_choices),
             absolute=forms.DateInput(
                 attrs={'class': 'datepickerfield'}
             ),
             rel_days_number=forms.NumberInput(),
-            rel_days_relationto=forms.Select(choices=kwargs.pop('base_choices')),
-            rel_days_relation=forms.Select(choices=BEFORE_AFTER_CHOICE),
-        )
+            rel_days_relationto=OptionAttrsSelect(
+                choices=self.base_choices,
+                option_attrs=_get_choice_validation_obj(self.base_choices),
+                attrs={'data-relative-choice': True},
+            ),
+            rel_days_relation=forms.Select(choices=BEFORE_AFTER_CHOICE, attrs={'data-relation-choice': True},),
+        )))
         forms.MultiWidget.__init__(self, widgets=widgets, *args, **kwargs)
 
     def decompress(self, value):
@@ -460,7 +659,7 @@ class RelativeDateWidget(RelativeDateTimeWidget):
             status="relative",
             absolute=None,
             rel_days_number=value.data.days,
-            rel_days_relationto=value.data.base_date_name,
+            rel_days_relationto=value.data.key,
             rel_days_relation="after" if value.data.is_after else "before"
         )
 
@@ -474,6 +673,15 @@ class RelativeDateField(RelativeDateTimeField):
         ]
         if not kwargs.get('required', True):
             status_choices.insert(0, ('unset', _('Not set')))
+
+        self.relative_to_order = kwargs.pop('relative_to_order', False)
+
+        possible_choices = copy.deepcopy(EVENT_BASE_CHOICES)
+        if self.relative_to_order:
+            possible_choices.extend(ORDER_BASE_CHOICES)
+
+        choices = _get_choices(possible_choices)
+
         fields = reldateparts(
             status=forms.ChoiceField(
                 choices=status_choices,
@@ -486,33 +694,37 @@ class RelativeDateField(RelativeDateTimeField):
                 required=False
             ),
             rel_days_relationto=forms.ChoiceField(
-                choices=BASE_CHOICES,
-                required=False
+                choices=choices,
+                required=False,
             ),
             rel_days_relation=forms.ChoiceField(
                 choices=BEFORE_AFTER_CHOICE,
                 required=False
             ),
         )
+
         if 'widget' not in kwargs:
-            kwargs['widget'] = RelativeDateWidget(status_choices=status_choices, base_choices=BASE_CHOICES)
+            kwargs['widget'] = RelativeDateWidget(status_choices=status_choices, base_choices=possible_choices)
         forms.MultiValueField.__init__(
             self, fields=fields, require_all_fields=False, *args, **kwargs
         )
 
     def set_event(self, event):
-        self.widget.widgets[reldateparts.indizes.rel_days_relationto].choices = [
-            (k, v) for k, v in BASE_CHOICES if getattr(event, k, None)
+        choices = [
+            (c.key, c.text) for c in EVENT_BASE_CHOICES if getattr(event, c.attribute, None)
         ]
+        if self.relative_to_order:
+            choices += [(c.key, c.text) for c in ORDER_BASE_CHOICES]
+        self.widget.widgets[reldateparts.indizes.rel_days_relationto].choices = choices
 
     def compress(self, data_list):
         if not data_list:
             return None
         data = reldateparts(*data_list)
-        if data.status == 'absolute':
-            return RelativeDateWrapper(data.absolute)
-        elif data.status == 'unset':
+        if data.status == 'unset':
             return None
+        elif data.status == 'absolute':
+            return RelativeDateWrapper(data.absolute)
         else:
             return RelativeDateWrapper(RelativeDate(
                 days=data.rel_days_number,
@@ -525,8 +737,14 @@ class RelativeDateField(RelativeDateTimeField):
         data = reldateparts(*value)
         if data.status == 'absolute' and not data.absolute:
             raise ValidationError(self.error_messages['incomplete'])
-        elif data.status == 'relative' and (data.rel_days_number is None or not data.rel_days_relationto):
-            raise ValidationError(self.error_messages['incomplete'])
+        if data.status == 'relative':
+            choice = BaseChoice.find(BASE_CHOICES, data.rel_days_relationto)
+            if data.rel_days_number is None or not data.rel_days_relationto:
+                raise ValidationError(self.error_messages['incomplete'])
+            elif data.rel_days_relation == "before" and not choice.supports_before:
+                raise ValidationError(_("A relative date cannot be expressed as 'before' for '{}'".format(choice.text)))
+            elif data.rel_days_relation == "after" and not choice.supports_after:
+                raise ValidationError(_("A relative date cannot be expressed as 'after' for '{}'".format(choice.text)))
 
         return forms.MultiValueField.clean(self, value)
 

src/pretix/base/secrets.py

@@ -245,6 +245,9 @@ def recv_classic(sender, **kwargs):
 
 
 def assign_ticket_secret(event, position, force_invalidate_if_revokation_list_used=False, force_invalidate=False, save=True):
+    if position.pk and position.issued_gift_cards.exists():
+        return
+
     gen = event.ticket_secret_generator
     if gen.use_revocation_list and force_invalidate_if_revokation_list_used:
         force_invalidate = True

src/pretix/base/services/cross_selling.py

@@ -29,7 +29,7 @@ from typing import List
 from django.utils.functional import cached_property
 
 from pretix.base.models import CartPosition, ItemCategory, SalesChannel
-from pretix.presale.views.event import get_grouped_items
+from pretix.presale.productlist import prepare_item_list_for_shop
 
 
 class DummyCategory:
@@ -162,7 +162,7 @@ class CrossSellingService:
         ]
 
     def _prepare_items(self, subevent, items_qs, discount_info):
-        items, _btn = get_grouped_items(
+        items, _btn = prepare_item_list_for_shop(
             self.event,
             subevent=subevent,
             voucher=None,

src/pretix/base/services/memberships.py

@@ -24,6 +24,7 @@ from typing import List, Optional
 
 from dateutil.relativedelta import relativedelta
 from django.core.exceptions import ValidationError
+from django.db import transaction
 from django.utils.formats import date_format
 from django.utils.translation import gettext_lazy as _
 
@@ -96,6 +97,8 @@ def validate_memberships_in_order(customer: Customer, positions: List[AbstractPo
     :param valid_from_not_chosen: Set to ``True`` to indicate that the customer is in an early step of the checkout flow
                                   where the valid_from date is not selected yet. In this case, the valid_from date is not checked.
     """
+    if lock and not transaction.get_connection().in_atomic_block:
+        raise Exception('validate_memberships_in_order(lock=True) should only be called in atomic transaction!')
     tz = event.timezone
     applicable_positions = [
         p for p in positions

src/pretix/base/services/orders.py

@@ -110,6 +110,7 @@ from pretix.celery_app import app
 from pretix.helpers import OF_SELF
 from pretix.helpers.models import modelcopy
 from pretix.helpers.periodic import minimum_interval
+from pretix.presale.productlist import prepare_item_list_for_shop
 from pretix.testutils.middleware import debugflags_var
 
 
@@ -790,6 +791,12 @@ def _check_positions(event: Event, now_dt: datetime, time_machine_now_dt: dateti
                 [op.seat for op in sorted_positions if op.seat],
                 shared_lock_objects=[event]
             )
+    elif any(cp.voucher and cp.voucher.budget for cp in sorted_positions):
+        # Voucher budgets are not guaranteed by the cart manager
+        lock_objects(
+            [op.voucher for op in sorted_positions if op.voucher and op.voucher.budget],
+            shared_lock_objects=[event]
+        )
 
     q_avail = Counter()
     v_avail = Counter()
@@ -1599,6 +1606,7 @@ class OrderChangeManager:
         'seat_forbidden': gettext_lazy('The selected product does not allow to select a seat.'),
         'tax_rule_country_blocked': gettext_lazy('The selected country is blocked by your tax rule.'),
         'gift_card_change': gettext_lazy('You cannot change the price of a position that has been used to issue a gift card.'),
+        'gift_card_secret': gettext_lazy('You cannot change the ticket secret of a position that has been used to issue a gift card.'),
         'max_items_per_product': ngettext_lazy(
             "You cannot select more than %(max)s item of the product %(product)s.",
             "You cannot select more than %(max)s items of the product %(product)s.",
@@ -1756,6 +1764,9 @@ class OrderChangeManager:
         self._operations.append(self.RegenerateSecretOperation(position))
 
     def change_ticket_secret(self, position: OrderPosition, new_secret: str):
+        if position.issued_gift_cards.exists():
+            raise OrderError(self.error_messages['gift_card_secret'])
+
         self._operations.append(self.ChangeSecretOperation(position, new_secret))
 
     def change_valid_from(self, position: OrderPosition, new_value: datetime):
@@ -1943,13 +1954,18 @@ class OrderChangeManager:
 
         :param addons: A list of dictionaries with the keys ``"addon_to"``, ``"item"``, ``"variation"`` (all ID values),
                        ``"count"``, and ``"price"``.
-        :param limit_main_positions: By default, the method works on all methods of the order. If you set this to a
+        :param limit_main_positions: By default, the method works on all positions of the order. If you set this to a
                                      queryset or a list of positions, all other positions and their add-ons will be kept
                                      untouched.
         """
         if self._operations:
             raise ValueError("Setting addons should be the first/only operation")
 
+        def _allowed_on_order_sales_channel(item_or_var, order):
+            return item_or_var.all_sales_channels or (
+                order.sales_channel.identifier in (s.identifier for s in item_or_var.limit_sales_channels.all())
+            )
+
         # Prepare containers for min/max check of products
         item_counts = Counter()
         for p in self.order.positions.all():
@@ -2043,13 +2059,11 @@ class OrderChangeManager:
             if not item.is_available() or (variation and not variation.is_available()):
                 raise OrderError(error_messages['unavailable'])
 
-            if not item.all_sales_channels:
-                if self.order.sales_channel.identifier not in (s.identifier for s in item.limit_sales_channels.all()):
-                    raise OrderError(error_messages['unavailable'])
+            if not _allowed_on_order_sales_channel(item, self.order):
+                raise OrderError(error_messages['unavailable'])
 
-            if variation and not variation.all_sales_channels:
-                if self.order.sales_channel.identifier not in (s.identifier for s in variation.limit_sales_channels.all()):
-                    raise OrderError(error_messages['unavailable'])
+            if variation and not _allowed_on_order_sales_channel(variation, self.order):
+                raise OrderError(error_messages['unavailable'])
 
             if subevent and item.pk in subevent.item_overrides and not subevent.item_overrides[item.pk].is_available():
                 raise OrderError(error_messages['not_for_sale'])
@@ -2097,6 +2111,36 @@ class OrderChangeManager:
                     )
                     item_counts[item] += 1
 
+        def _addon_is_available(a):
+            # If an item is no longer available due to time, it should usually also be no longer
+            # user-removable, because e.g. the stock has already been ordered.
+            # We always set voucher=None because that's what's done when generating the form in
+            # OrderChangeMixin (vouchers for addons are not supported).
+            # This also prevents accidental removal through the UI because a hidden product will no longer
+            # be part of the input.
+            if not _allowed_on_order_sales_channel(a.item, self.order) or (
+                a.variation and not _allowed_on_order_sales_channel(a.variation, self.order)
+            ):
+                return False
+
+            items, _ = prepare_item_list_for_shop(
+                self.order.event,
+                channel=self.order.sales_channel,
+                subevent=a.subevent,
+                voucher=None,
+                base_qs=Item.objects.filter(pk=a.item.pk),
+                allow_addons=True
+            )
+            if (not items) or items[0].current_unavailability_reason:
+                return False
+
+            if a.variation:
+                variations = [var for var in items[0].available_variations if var.pk == a.variation.pk]
+                if (not variations) or variations[0].current_unavailability_reason:
+                    return False
+
+            return True
+
         # Detect removed add-ons and create RemoveOperations
         for cp, al in list(current_addons.items()):
             for k, v in al.items():
@@ -2106,22 +2150,7 @@ class OrderChangeManager:
                     for a in current_addons[cp][k][:current_num - input_num]:
                         if a.canceled:
                             continue
-                        is_unavailable = (
-                            # If an item is no longer available due to time, it should usually also be no longer
-                            # user-removable, because e.g. the stock has already been ordered.
-                            # We always pass has_voucher=True because if a product now requires a voucher, it usually does
-                            # not mean it should be unremovable for others.
-                            # This also prevents accidental removal through the UI because a hidden product will no longer
-                            # be part of the input.
-                            (a.variation and a.variation.unavailability_reason(has_voucher=True, subevent=a.subevent))
-                            or (a.variation and not a.variation.all_sales_channels and not a.variation.limit_sales_channels.contains(self.order.sales_channel))
-                            or a.item.unavailability_reason(has_voucher=True, subevent=a.subevent)
-                            or (
-                                not a.item.all_sales_channels and
-                                not a.item.limit_sales_channels.contains(self.order.sales_channel)
-                            )
-                        )
-                        if is_unavailable:
+                        if not _addon_is_available(a):
                             # "Re-select" add-on
                             selected_addons[cp.id, a.item.category_id][a.item_id, a.variation_id] += 1
                             continue

src/pretix/base/templatetags/money.py

@@ -26,6 +26,8 @@ from babel.numbers import format_currency
 from django import template
 from django.conf import settings
 from django.template.defaultfilters import floatformat
+from django.utils import formats
+from django.utils.safestring import mark_safe
 
 from pretix.base.i18n import get_babel_locale
 
@@ -82,3 +84,19 @@ def money_numberfield_filter(value: Decimal, arg=''):
 
     places = settings.CURRENCY_PLACES.get(arg, 2)
     return str(value.quantize(Decimal('1') / 10 ** places, ROUND_HALF_UP))
+
+
+@register.filter(is_safe=True)
+def tax_rate_format(number):
+    """
+    Display a Decimal to its significant decimal places, used for tax rates.
+    """
+    assert isinstance(number, Decimal)
+    return mark_safe(
+        formats.number_format(
+            number.normalize(),
+            -number.as_tuple().exponent,
+            use_l10n=True,
+            force_grouping=False,
+        )
+    )

src/pretix/base/views/errors.py

@@ -27,11 +27,11 @@ from django.template import TemplateDoesNotExist, loader
 from django.template.loader import get_template
 from django.utils.functional import Promise
 from django.utils.translation import gettext as _
-from django.views.decorators.csrf import requires_csrf_token
 from sentry_sdk import last_event_id
 
 from pretix.base.i18n import language
 from pretix.base.middleware import get_language_from_request
+from pretix.multidomain.middlewares import requires_csrf_token
 
 
 def csrf_failure(request, reason=""):

src/pretix/control/forms/event.py

@@ -197,10 +197,10 @@ class EventWizardBasicsForm(I18nModelForm):
             'presale_end': SplitDateTimeField,
         }
         widgets = {
-            'date_from': SplitDateTimePickerWidget(),
-            'date_to': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_basics-date_from_0'}),
-            'presale_start': SplitDateTimePickerWidget(),
-            'presale_end': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_basics-presale_start_0'}),
+            'date_from': SplitDateTimePickerWidget(without_seconds=True),
+            'date_to': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_basics-date_from_0'}, without_seconds=True),
+            'presale_start': SplitDateTimePickerWidget(without_seconds=True),
+            'presale_end': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_basics-presale_start_0'}, without_seconds=True),
             'slug': SlugWidget,
         }
 
@@ -521,11 +521,11 @@ class EventUpdateForm(I18nModelForm):
             'limit_sales_channels': SafeModelMultipleChoiceField,
         }
         widgets = {
-            'date_from': SplitDateTimePickerWidget(),
-            'date_to': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_date_from_0'}),
-            'date_admission': SplitDateTimePickerWidget(attrs={'data-date-default': '#id_date_from_0'}),
-            'presale_start': SplitDateTimePickerWidget(),
-            'presale_end': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_presale_start_0'}),
+            'date_from': SplitDateTimePickerWidget(without_seconds=True),
+            'date_to': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_date_from_0'}, without_seconds=True),
+            'date_admission': SplitDateTimePickerWidget(attrs={'data-date-default': '#id_date_from_0'}, without_seconds=True),
+            'presale_start': SplitDateTimePickerWidget(without_seconds=True),
+            'presale_end': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_presale_start_0'}, without_seconds=True),
         }
 
 

src/pretix/control/forms/filter.py

@@ -770,7 +770,7 @@ class EventOrderExpertFilterForm(EventOrderFilterForm):
                 )
             elif q.type == Question.TYPE_TIME:
                 self.fields[fname] = forms.TimeField(
-                    widget=TimePickerWidget(time_format=get_format_without_seconds('TIME_INPUT_FORMATS')),
+                    widget=TimePickerWidget(without_seconds=True),
                     help_text=_('Exact matches only'),
                     **kwargs,
                 )

src/pretix/control/forms/item.py

@@ -246,8 +246,8 @@ class QuestionForm(I18nModelForm):
             'valid_string_length_max',
         ]
         widgets = {
-            'valid_datetime_min': SplitDateTimePickerWidget(),
-            'valid_datetime_max': SplitDateTimePickerWidget(),
+            'valid_datetime_min': SplitDateTimePickerWidget(without_seconds=True),
+            'valid_datetime_max': SplitDateTimePickerWidget(without_seconds=True),
             'valid_date_min': DatePickerWidget(),
             'valid_date_max': DatePickerWidget(),
             'items': forms.CheckboxSelectMultiple(
@@ -1427,6 +1427,6 @@ class ItemProgramTimeForm(I18nModelForm):
             'end': forms.SplitDateTimeField,
         }
         widgets = {
-            'start': SplitDateTimePickerWidget(),
-            'end': SplitDateTimePickerWidget(),
+            'start': SplitDateTimePickerWidget(without_seconds=True),
+            'end': SplitDateTimePickerWidget(without_seconds=True),
         }

src/pretix/control/forms/subevents.py

@@ -39,6 +39,7 @@ from pretix.base.reldate import RelativeDateTimeField, RelativeDateWrapper
 from pretix.base.templatetags.money import money_filter
 from pretix.control.forms import SplitDateTimeField, SplitDateTimePickerWidget
 from pretix.control.forms.rrule import RRuleForm
+from pretix.helpers.i18n import get_javascript_format_without_seconds
 from pretix.helpers.money import change_decimal_field
 
 
@@ -80,11 +81,11 @@ class SubEventForm(I18nModelForm):
             'presale_end': SplitDateTimeField,
         }
         widgets = {
-            'date_from': SplitDateTimePickerWidget(),
-            'date_to': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_date_from_0'}),
-            'date_admission': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_date_from_0'}),
-            'presale_start': SplitDateTimePickerWidget(),
-            'presale_end': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_presale_start_0'}),
+            'date_from': SplitDateTimePickerWidget(without_seconds=True),
+            'date_to': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_date_from_0'}, without_seconds=True),
+            'date_admission': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_date_from_0'}, without_seconds=True),
+            'presale_start': SplitDateTimePickerWidget(without_seconds=True),
+            'presale_end': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_presale_start_0'}, without_seconds=True),
         }
 
 
@@ -93,14 +94,14 @@ class SubEventBulkForm(SubEventForm):
         label=_('Start of presale'),
         help_text=_('Optional. No products will be sold before this date.'),
         required=False,
-        limit_choices=('date_from', 'date_to'),
+        limit_choices=('event__date_from', 'event__date_to'),
     )
     rel_presale_end = RelativeDateTimeField(
         label=_('End of presale'),
         help_text=_('Optional. No products will be sold after this date. If you do not set this value, the presale '
                     'will end after the end date of your event.'),
         required=False,
-        limit_choices=('date_from', 'date_to'),
+        limit_choices=('event__date_from', 'event__date_to'),
     )
     skip_if_overlap = forms.BooleanField(
         label=pgettext_lazy('subevent', 'Skip dates that overlap with any existing date'),
@@ -162,7 +163,7 @@ class SubEventBulkEditForm(I18nModelForm):
             self.fields[k + '_time'] = forms.TimeField(
                 label=self._meta.model._meta.get_field(k).verbose_name,
                 help_text=self._meta.model._meta.get_field(k).help_text,
-                widget=TimePickerWidget(),
+                widget=TimePickerWidget(without_seconds=True),
                 required=False,
             )
 
@@ -332,12 +333,12 @@ class BulkSubEventItemForm(SubEventItemForm):
     rel_available_from = RelativeDateTimeField(
         label=_('Available from'),
         required=False,
-        limit_choices=('date_from', 'date_to'),
+        limit_choices=('event__date_from', 'event__date_to'),
     )
     rel_available_until = RelativeDateTimeField(
         label=_('Available until'),
         required=False,
-        limit_choices=('date_from', 'date_to'),
+        limit_choices=('event__date_from', 'event__date_to'),
     )
 
     def __init__(self, *args, **kwargs):
@@ -354,12 +355,12 @@ class BulkSubEventItemVariationForm(SubEventItemVariationForm):
     rel_available_from = RelativeDateTimeField(
         label=_('Available from'),
         required=False,
-        limit_choices=('date_from', 'date_to'),
+        limit_choices=('event__date_from', 'event__date_to'),
     )
     rel_available_until = RelativeDateTimeField(
         label=_('Available_until'),
         required=False,
-        limit_choices=('date_from', 'date_to'),
+        limit_choices=('event__date_from', 'event__date_to'),
     )
 
     def __init__(self, *args, **kwargs):
@@ -506,6 +507,12 @@ class TimeForm(forms.Form):
         required=False
     )
 
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.fields['time_from'].widget.attrs['data-format'] = get_javascript_format_without_seconds("TIME_INPUT_FORMATS")
+        self.fields['time_to'].widget.attrs['data-format'] = get_javascript_format_without_seconds("TIME_INPUT_FORMATS")
+        self.fields['time_admission'].widget.attrs['data-format'] = get_javascript_format_without_seconds("TIME_INPUT_FORMATS")
+
 
 TimeFormSet = formset_factory(
     TimeForm,

src/pretix/control/signals.py

@@ -141,7 +141,7 @@ event_dashboard_widgets = EventPluginSignal()
 This signal is sent out to include widgets in the event dashboard. Receivers
 should return a list of dictionaries, where each dictionary can have the keys:
 
-* content (str, containing HTML)
+* content (SafeString, containing HTML)
 * display_size (str, one of "full" (whole row), "big" (half a row) or "small"
   (quarter of a row). May be ignored on small displays, default is "small")
 * priority (int, used for ordering, higher comes first, default is 1)
@@ -158,7 +158,7 @@ Arguments: 'user'
 This signal is sent out to include widgets in the personal user dashboard. Receivers
 should return a list of dictionaries, where each dictionary can have the keys:
 
-* content (str, containing HTML)
+* content (SafeString, containing HTML)
 * display_size (str, one of "full" (whole row), "big" (half a row) or "small"
   (quarter of a row). May be ignored on small displays, default is "small")
 * priority (int, used for ordering, higher comes first, default is 1)

src/pretix/control/templates/pretixcontrol/auth/login_2fa.html

@@ -3,6 +3,7 @@
 {% load i18n %}
 {% load static %}
 {% load compress %}
+{% load escapejson %}
 {% block content %}
     <form class="form-signin" action="" method="post" id="webauthn-form">
         {% csrf_token %}
@@ -30,8 +31,7 @@
     </form>
     {% if jsondata %}
         <script type="text/json" id="webauthn-login">
-            {{ jsondata|safe }}
-
+            {{ jsondata|escapejson }}
         </script>
     {% endif %}
     {% compress js %}

src/pretix/control/templates/pretixcontrol/base.html

@@ -58,6 +58,7 @@
             <script type="text/javascript" src="{% static "leaflet/leaflet.js" %}"></script>
             <script type="text/javascript" src="{% static "pretixcontrol/js/ui/geo.js" %}"></script>
             <script type="text/javascript" src="{% static "pretixbase/js/details.js" %}"></script>
+            <script type="text/javascript" src="{% static "pretixbase/js/reldate.js" %}"></script>
             <script type="text/javascript" src="{% static "pretixbase/js/asynctask.js" %}"></script>
             <script type="text/javascript" src="{% static "sortable/Sortable.js" %}"></script>
             <script type="text/javascript" src="{% static "colorpicker/bootstrap-colorpicker.js" %}"></script>

src/pretix/control/templates/pretixcontrol/dashboard.html

@@ -28,7 +28,7 @@
                         {% if w.lazy %}
                             <span class="fa fa-cog fa-4x"></span>
                         {% else %}
-                            {{ w.content|safe }}
+                            {{ w.content }}
                         {% endif %}
                     </div>
                 </div>
@@ -51,7 +51,7 @@
                         {% if w.lazy %}
                             <span class="fa fa-cog fa-4x"></span>
                         {% else %}
-                            {{ w.content|safe }}
+                            {{ w.content }}
                         {% endif %}
                     </div>
                 </div>
@@ -72,7 +72,7 @@
                         {% if w.lazy %}
                             <span class="fa fa-cog fa-4x"></span>
                         {% else %}
-                            {{ w.content|safe }}
+                            {{ w.content }}
                         {% endif %}
                     </div>
                 </div>
@@ -94,7 +94,7 @@
                             {% if w.lazy %}
                                 <span class="fa fa-cog fa-4x"></span>
                             {% else %}
-                                {{ w.content|safe }}
+                                {{ w.content }}
                             {% endif %}
                         </a>
                     {% else %}
@@ -102,7 +102,7 @@
                             {% if w.lazy %}
                                 <span class="fa fa-cog fa-4x"></span>
                             {% else %}
-                                {{ w.content|safe }}
+                                {{ w.content }}
                             {% endif %}
                         </div>
                     {% endif %}

src/pretix/control/templates/pretixcontrol/email_setup_simple.html

@@ -50,6 +50,46 @@
                         {% endblocktrans %}
                     </div>
                 {% endif %}
+                {% if dkim_warning %}
+                    <div class="alert alert-danger">
+                        <p>
+                            {{ dkim_warning }}
+                        </p>
+                        <p>
+                            {% trans "Your new DKIM record should be set up as a CNAME record like this:" %}
+                        </p>
+                        <pre><code>{{ dkim_hostname }}  CNAME  {{ dkim_cname }}</code></pre>
+                        <p>
+                            {% trans "Please keep in mind that updates to DNS might require multiple hours to take effect." %}
+                        </p>
+                    </div>
+                {% elif dkim_cname %}
+                    <div class="alert alert-success">
+                        {% blocktrans trimmed %}
+                            We found a DKIM record on your domain for this system. Great!
+                        {% endblocktrans %}
+                    </div>
+                {% endif %}
+                {% if dmarc_warning %}
+                    <div class="alert alert-danger">
+                        <p>
+                            {{ dmarc_warning }}
+                        </p>
+                        <p>
+                            {% trans "Your new DMARC record could look like this:" %}
+                        </p>
+                        <pre><code>_dmarc.{{ hostname }}  TXT  "v=DMARC1; p=quarantine; sp=none; adkim=r; aspf=r;"</code></pre>
+                        <p>
+                            {% trans "Please keep in mind that updates to DNS might require multiple hours to take effect." %}
+                        </p>
+                    </div>
+                {% elif dkim_cname %}
+                    <div class="alert alert-success">
+                        {% blocktrans trimmed %}
+                            We found a DMARC record on your domain for this system. Great!
+                        {% endblocktrans %}
+                    </div>
+                {% endif %}
                 {% if verification %}
                     <h3>{% trans "Verification" %}</h3>
                     <p>
@@ -70,7 +110,7 @@
             </div>
         </div>
 
-        {% if spf_warning %}
+        {% if spf_warning or dkim_warning or dmarc_warning %}
             <div class="form-group submit-group">
                 <a href="" class="btn btn-default btn-save">
                     {% trans "Cancel" %}

src/pretix/control/templates/pretixcontrol/event/index.html

@@ -106,7 +106,7 @@
                         {% if w.lazy %}
                             <span class="fa fa-cog fa-4x"></span>
                         {% else %}
-                            {{ w.content|safe }}
+                            {{ w.content }}
                         {% endif %}
                     </a>
                 {% elif w.link %}
@@ -114,7 +114,7 @@
                         {% if w.lazy %}
                             <span class="fa fa-cog fa-4x´"></span>
                         {% else %}
-                            {{ w.content|safe }}
+                            {{ w.content }}
                         {% endif %}
                     </a>
                 {% else %}
@@ -122,7 +122,7 @@
                         {% if w.lazy %}
                             <span class="fa fa-cog fa-4x"></span>
                         {% else %}
-                            {{ w.content|safe }}
+                            {{ w.content }}
                         {% endif %}
                     </div>
                 {% endif %}

src/pretix/control/templates/pretixcontrol/event/payment.html

@@ -12,7 +12,7 @@
                 <table class="table table-payment-providers">
                     <tbody>
                     {% for provider in providers %}
-                        <tr>
+                        <tr{% if provider.highlight %} class="success-left"{% endif %}>
                             <td>
                                 <strong>{{ provider.verbose_name }}</strong>
                             </td>
@@ -56,7 +56,7 @@
                             <td colspan="4">
                                 <br>
                                 {% url "control:event.settings.plugins" event=request.event.slug organizer=request.organizer.slug as plugin_settings_url %}
-                                <a href="{{ plugin_settings_url }}#tab-0-1-open" class="btn btn-default">
+                                <a href="{{ plugin_settings_url }}?go=payment#tab-0-1-open" class="btn btn-default">
                                     <i class="fa fa-plus"></i> {% trans "Enable additional payment plugins" %}
                                 </a>
                             </td>

src/pretix/control/templates/pretixcontrol/event/plugins.html

@@ -28,6 +28,7 @@
     </div>
     <form action="" method="post" class="form-horizontal form-plugins">
         {% csrf_token %}
+        <input type="hidden" name="go" value="{{ request.GET.go }}">
         <div id="plugin_search_results" class="panel panel-default collapse">
             <div class="panel-heading">
                 <button type="button" class="close" aria-label="Close"><span aria-hidden="true">×</span></button>

src/pretix/control/templates/pretixcontrol/items/index.html

@@ -156,11 +156,11 @@
                                     <br/>
                                     <small class="text-muted">
                                         {% if not i.tax_rule.price_includes_tax %}
-                                            {% blocktrans trimmed with rate=i.tax_rule.rate|floatformat:-2 taxname=i.tax_rule.name %}
+                                            {% blocktrans trimmed with rate=i.tax_rule.rate|tax_rate_format taxname=i.tax_rule.name %}
                                                 <strong>plus</strong> {{ rate }}% {{ taxname }}
                                             {% endblocktrans %}
                                         {% else %}
-                                            {% blocktrans trimmed with rate=i.tax_rule.rate|floatformat:-2 taxname=i.tax_rule.name|default:s_taxes %}
+                                            {% blocktrans trimmed with rate=i.tax_rule.rate|tax_rate_format taxname=i.tax_rule.name|default:s_taxes %}
                                                 incl. {{ rate }}% {{ taxname }}
                                             {% endblocktrans %}
                                         {% endif %}

src/pretix/control/templates/pretixcontrol/order/cancel.html

@@ -2,6 +2,7 @@
 {% load i18n %}
 {% load bootstrap3 %}
 {% load money %}
+{% load wrap_in %}
 {% block title %}
     {% trans "Cancel order" %}
 {% endblock %}
@@ -26,7 +27,7 @@
         {% if form.cancellation_fee %}
             {% if fee %}
                 {% with fee|money:request.event.currency as f %}
-                    <p>{% blocktrans trimmed with fee="<strong>"|add:f|add:"</strong>"|safe %}
+                    <p>{% blocktrans trimmed with fee=f|wrap_in:"strong" %}
                         The configured cancellation fee for a self-service cancellation would be {{ fee }} for this
                         order, but for a cancellation performed by you, you need to set the cancellation fee here:
                     {% endblocktrans %}</p>

src/pretix/control/templates/pretixcontrol/order/change.html

@@ -284,6 +284,14 @@
                             </div>
                             <div class="col-sm-4">
                                 {% bootstrap_field position.form.operation_secret layout='inline' %}
+                                {% if position.issued_gift_cards.exists %}
+                                    <div class="alert alert-info">
+                                        {% blocktrans trimmed %}
+                                        Ticket secrets of order positions that have been used to issue a gift card can not
+                                        be changed. Only the link will be changed in this case.
+                                        {% endblocktrans %}
+                                    </div>
+                                {% endif %}
                             </div>
                         </div>
 

src/pretix/control/templates/pretixcontrol/order/index.html

@@ -705,7 +705,7 @@
                                     {% if line.tax_rate %}
                                         <br/>
                                         <small>
-                                            {% blocktrans trimmed with rate=line.tax_rate|floatformat:-2 taxname=line.tax_rule.name|default:s_taxes %}
+                                            {% blocktrans trimmed with rate=line.tax_rate|tax_rate_format taxname=line.tax_rule.name|default:s_taxes %}
                                                 <strong>plus</strong> {{ rate }}% {{ taxname }}
                                             {% endblocktrans %}
                                         </small>
@@ -715,7 +715,7 @@
                                     {% if line.tax_rate and line.price %}
                                         <br/>
                                         <small>
-                                            {% blocktrans trimmed with rate=line.tax_rate|floatformat:-2 taxname=line.tax_rule.name|default:s_taxes %}
+                                            {% blocktrans trimmed with rate=line.tax_rate|tax_rate_format taxname=line.tax_rule.name|default:s_taxes %}
                                                 incl. {{ rate }}% {{ taxname }}
                                             {% endblocktrans %}
                                         </small>
@@ -755,7 +755,7 @@
                                     {% if fee.tax_rate %}
                                         <br/>
                                         <small>
-                                            {% blocktrans trimmed with rate=fee.tax_rate|floatformat:-2 taxname=fee.tax_rule.name|default:s_taxes %}
+                                            {% blocktrans trimmed with rate=fee.tax_rate|tax_rate_format taxname=fee.tax_rule.name|default:s_taxes %}
                                                 <strong>plus</strong> {{ rate }}% {{ taxname }}
                                             {% endblocktrans %}
                                         </small>
@@ -765,7 +765,7 @@
                                     {% if fee.tax_rate %}
                                         <br/>
                                         <small>
-                                            {% blocktrans trimmed with rate=fee.tax_rate|floatformat:-2 taxname=fee.tax_rule.name|default:s_taxes %}
+                                            {% blocktrans trimmed with rate=fee.tax_rate|tax_rate_format taxname=fee.tax_rule.name|default:s_taxes %}
                                                 incl. {{ rate }}% {{ taxname }}
                                             {% endblocktrans %}
                                         </small>
@@ -903,7 +903,7 @@
                                             <tr>
                                                 <td colspan="1"></td>
                                                 <td colspan="5">
-                                                    {{ p.html_info|safe }}
+                                                    {{ p.html_info }}
                                                     {% if staff_session %}
                                                         <p>
                                                             <a href="" class="btn btn-default btn-xs admin-only" data-expandpayment data-id="{{ p.pk }}">
@@ -1018,7 +1018,7 @@
                                                             </dl>
                                                         {% endif %}
                                                         {% if r.html_info %}
-                                                            {{ r.html_info|safe }}
+                                                            {{ r.html_info }}
                                                         {% endif %}
                                                         {% if staff_session %}
                                                             <p>

src/pretix/control/templates/pretixcontrol/organizers/device_connect.html

@@ -2,6 +2,7 @@
 {% load i18n %}
 {% load static %}
 {% load bootstrap3 %}
+{% load escapejson %}
 {% block inner %}
     <h1>{% trans "Connect to device:" %} {{ device.name }}</h1>
 
@@ -18,7 +19,7 @@
                 {% trans "Open the app that you want to connect and optionally reset it to the original state." %}
             </li>
             <li>{% trans "Scan the following configuration code:" %}<br><br>
-                <script type="text/json" data-replace-with-qr>{{ qrdata|safe }}</script><br>
+                <script type="application/json" data-replace-with-qr>{{ qrdata|escapejson_dumps }}</script><br>
                 {% trans "If your app/device does not support scanning a QR code, you can also enter the following information:" %}
                 <br>
                 <strong>{% trans "System URL:" %}</strong> <code id="system_url">{{ settings.SITE_URL }}</code>

src/pretix/control/templates/pretixcontrol/organizers/devices.html

@@ -137,6 +137,15 @@
                             </td>
                             <td>
                                 {{ d.software_brand|default_if_none:"" }} {{ d.software_version|default_if_none:"" }}
+                                {% if staff_session %}
+                                    <details class="admin-only">
+                                        <summary>
+                                            <i class="fa fa-angle-down collapse-indicator"></i>
+                                            {% trans "Details" %}
+                                        </summary>
+                                        <pre class="admin-only">{{ d.info|pprint }}</pre>
+                                    </details>
+                                {% endif %}
                             </td>
                             <td>
                                 {% if d.initialized %}

src/pretix/control/templates/pretixcontrol/pdf/index.html

@@ -560,11 +560,10 @@
             </div>
         </div>
     </div>
-    <script type="text/plain" id="schema-url">{% static "schema/pdf-layout.schema.json" %}</script>
     <script type="text/javascript" src="{% static "pdfjs/pdf.js" %}"></script>
-    <script type="text/javascript" src="{% static "ajv/ajv2020.bundle.min.js" %}"></script>
     <script type="text/javascript" src="{% static "fabric/fabric.min.js" %}"></script>
     <script type="text/javascript" src="{% static "pretixcontrol/js/ui/editor.js" %}"></script>
+    <script type="text/javascript" src="{% static "schema/pdf-layout.validate.js" %}"></script>
     <img src="{% static 'pretixpresale/pdf/powered_by_pretix_dark.png' %}" id="poweredby-dark" class="sr-only">
     <img src="{% static 'pretixpresale/pdf/powered_by_pretix_white.png' %}" id="poweredby-white" class="sr-only">
     {% for family, styles in fonts.items %}

src/pretix/control/templates/pretixcontrol/user/2fa_confirm_totp.html

@@ -1,6 +1,7 @@
 {% extends "pretixcontrol/base.html" %}
 {% load i18n %}
 {% load bootstrap3 %}
+{% load escapejson %}
 {% block title %}{% trans "Add a two-factor authentication device" %}{% endblock %}
 {% block content %}
     <h1>{% trans "Add a two-factor authentication device" %}</h1>
@@ -32,7 +33,7 @@
         </li>
         <li>
             {% trans "Add a new account to the app by scanning the following barcode:" %}
-            <div class="qrcode-canvas" data-qrdata="#qrdata"></div>
+            <script type="application/json" data-replace-with-qr>{{ qrdata|escapejson_dumps }}</script>
             <p>
                 <a data-toggle="collapse" href="#no_scan">
                     {% trans "Can't scan the barcode?" %}
@@ -81,9 +82,4 @@
         </li>
     </ol>
 
-    <script type="text/json" id="qrdata">
-        {{ qrdata|safe }}
-
-
-    </script>
 {% endblock %}

src/pretix/control/templates/pretixcontrol/user/2fa_confirm_webauthn.html

@@ -3,6 +3,7 @@
 {% load bootstrap3 %}
 {% load static %}
 {% load compress %}
+{% load escapejson %}
 {% block title %}{% trans "Add a two-factor authentication device" %}{% endblock %}
 {% block content %}
     <h1>{% trans "Add a two-factor authentication device" %}</h1>
@@ -26,9 +27,7 @@
         {% trans "Device registration failed." %}
     </div>
     <script type="text/json" id="webauthn-enroll">
-        {{ jsondata|safe }}
-
-
+        {{ jsondata|escapejson }}
     </script>
     {% compress js %}
         <script type="text/javascript" src="{% static "pretixcontrol/js/base64js.js" %}"></script>

src/pretix/control/templates/pretixcontrol/user/reauth.html

@@ -3,6 +3,7 @@
 {% load bootstrap3 %}
 {% load compress %}
 {% load static %}
+{% load escapejson %}
 {% block content %}
     <form class="form-signin" id="webauthn-form" action="" method="post">
         {% csrf_token %}
@@ -43,7 +44,7 @@
 
         {% if jsondata %}
             <script type="text/json" id="webauthn-login">
-            {{ jsondata|safe }}
+                {{ jsondata|escapejson }}
             </script>
         {% endif %}
         {% compress js %}

src/pretix/control/templates/pretixcontrol/vouchers/index.html

@@ -115,34 +115,34 @@
                         {% endif %}
                         <th>
                             {% trans "Voucher code" %}
-                            <a href="?{% url_replace request 'ordering' '-code' %}"><i class="fa fa-caret-down"></i></a>
-                            <a href="?{% url_replace request 'ordering' 'code' %}"><i class="fa fa-caret-up"></i></a>
+                            <a href="?{% url_replace request 'filter-ordering' '-code' %}"><i class="fa fa-caret-down"></i></a>
+                            <a href="?{% url_replace request 'filter-ordering' 'code' %}"><i class="fa fa-caret-up"></i></a>
                         </th>
                         <th>
                             {% trans "Redemptions" %}
-                            <a href="?{% url_replace request 'ordering' '-redeemed' %}"><i class="fa fa-caret-down"></i></a>
-                            <a href="?{% url_replace request 'ordering' 'redeemed' %}"><i class="fa fa-caret-up"></i></a>
+                            <a href="?{% url_replace request 'filter-ordering' '-redeemed' %}"><i class="fa fa-caret-down"></i></a>
+                            <a href="?{% url_replace request 'filter-ordering' 'redeemed' %}"><i class="fa fa-caret-up"></i></a>
                         </th>
                         <th>
                             {% trans "Expiry" %}
-                            <a href="?{% url_replace request 'ordering' '-valid_until' %}"><i class="fa fa-caret-down"></i></a>
-                            <a href="?{% url_replace request 'ordering' 'valid_until' %}"><i class="fa fa-caret-up"></i></a>
+                            <a href="?{% url_replace request 'filter-ordering' '-valid_until' %}"><i class="fa fa-caret-down"></i></a>
+                            <a href="?{% url_replace request 'filter-ordering' 'valid_until' %}"><i class="fa fa-caret-up"></i></a>
                         </th>
                         <th>
                             {% trans "Tag" %}
-                            <a href="?{% url_replace request 'ordering' '-tag' %}"><i class="fa fa-caret-down"></i></a>
-                            <a href="?{% url_replace request 'ordering' 'tag' %}"><i class="fa fa-caret-up"></i></a>
+                            <a href="?{% url_replace request 'filter-ordering' '-tag' %}"><i class="fa fa-caret-down"></i></a>
+                            <a href="?{% url_replace request 'filter-ordering' 'tag' %}"><i class="fa fa-caret-up"></i></a>
                         </th>
                         <th>
                             {% trans "Product" %}
-                            <a href="?{% url_replace request 'ordering' '-item' %}"><i class="fa fa-caret-down"></i></a>
-                            <a href="?{% url_replace request 'ordering' 'item' %}"><i class="fa fa-caret-up"></i></a>
+                            <a href="?{% url_replace request 'filter-ordering' '-item' %}"><i class="fa fa-caret-down"></i></a>
+                            <a href="?{% url_replace request 'filter-ordering' 'item' %}"><i class="fa fa-caret-up"></i></a>
                         </th>
                         {% if request.event.has_subevents %}
                             <th>
                                 {% trans "Date" context "subevent" %}
-                                <a href="?{% url_replace request 'ordering' '-subevent' %}"><i class="fa fa-caret-down"></i></a>
-                                <a href="?{% url_replace request 'ordering' 'subevent' %}"><i class="fa fa-caret-up"></i></a>
+                                <a href="?{% url_replace request 'filter-ordering' '-subevent' %}"><i class="fa fa-caret-down"></i></a>
+                                <a href="?{% url_replace request 'filter-ordering' 'subevent' %}"><i class="fa fa-caret-up"></i></a>
                             </th>
                         {% endif %}
                         <th></th>

src/pretix/control/views/auth.py

@@ -65,6 +65,7 @@ from pretix.base.forms.auth import (
 from pretix.base.metrics import pretix_failed_logins, pretix_successful_logins
 from pretix.base.models import TeamInvite, U2FDevice, User, WebAuthnDevice
 from pretix.helpers.http import get_client_ip, redirect_to_url
+from pretix.helpers.ratelimit import rate_limit, rate_limit_reset
 from pretix.helpers.security import handle_login_source, session_login
 
 logger = logging.getLogger(__name__)
@@ -319,19 +320,12 @@ class Forgot(TemplateView):
         if self.form.is_valid():
             email = self.form.cleaned_data['email']
 
-            has_redis = settings.HAS_REDIS
-
             try:
                 user = User.objects.get(is_active=True, auth_backend='native', email__iexact=email)
 
-                if has_redis:
-                    from django_redis import get_redis_connection
-                    rc = get_redis_connection("redis")
-                    if rc.exists('pretix_pwreset_%s' % (user.id)):
-                        user.log_action('pretix.control.auth.user.forgot_password.denied.repeated')
-                        raise RepeatedResetDenied()
-                    else:
-                        rc.setex('pretix_pwreset_%s' % (user.id), 3600 * 24, '1')
+                if rate_limit("pwreset", user.pk, max_num=1, expire_time=3600 * 24):
+                    user.log_action('pretix.control.auth.user.forgot_password.denied.repeated')
+                    raise RepeatedResetDenied()
 
             except User.DoesNotExist:
                 logger.warning('Backend password reset for unregistered e-mail \"' + email + '\" requested.')
@@ -344,6 +338,7 @@ class Forgot(TemplateView):
                 user.log_action('pretix.control.auth.user.forgot_password.mail_sent')
 
             finally:
+                has_redis = settings.HAS_REDIS
                 if has_redis:
                     messages.info(request, _('If the address is registered to valid account, then we have sent you an email containing further instructions. '
                                              'Please note that we will send at most one email every 24 hours.'))
@@ -412,11 +407,7 @@ class Recover(TemplateView):
             messages.success(request, _('You can now login using your new password.'))
             user.log_action('pretix.control.auth.user.forgot_password.recovered')
 
-            has_redis = settings.HAS_REDIS
-            if has_redis:
-                from django_redis import get_redis_connection
-                rc = get_redis_connection("redis")
-                rc.delete('pretix_pwreset_%s' % user.id)
+            rate_limit_reset("pwreset", user.pk)
             return redirect('control:auth.login')
         else:
             return self.get(request, *args, **kwargs)

src/pretix/control/views/dashboards.py

@@ -49,7 +49,7 @@ from django.shortcuts import render
 from django.template.loader import get_template
 from django.urls import reverse
 from django.utils.formats import date_format
-from django.utils.html import escape
+from django.utils.html import conditional_escape, escape, format_html
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _, ngettext, pgettext
 
@@ -112,7 +112,7 @@ def base_widgets(sender, subevent=None, lazy=False, **kwargs):
 
     return [
         {
-            'content': None if lazy else NUM_WIDGET.format(num=intcomma(tickc), text=_('Attendees (ordered)')),
+            'content': None if lazy else format_html(NUM_WIDGET, num=intcomma(tickc), text=_('Attendees (ordered)')),
             'lazy': 'attendees-ordered',
             'display_size': 'small',
             'priority': 100,
@@ -122,7 +122,7 @@ def base_widgets(sender, subevent=None, lazy=False, **kwargs):
             }) + ('?subevent={}'.format(subevent.pk) if subevent else '')
         },
         {
-            'content': None if lazy else NUM_WIDGET.format(num=intcomma(paidc), text=_('Attendees (paid)')),
+            'content': None if lazy else format_html(NUM_WIDGET, num=intcomma(paidc), text=_('Attendees (paid)')),
             'lazy': 'attendees-paid',
             'display_size': 'small',
             'priority': 100,
@@ -132,7 +132,8 @@ def base_widgets(sender, subevent=None, lazy=False, **kwargs):
             }) + ('?subevent={}'.format(subevent.pk) if subevent else '')
         },
         {
-            'content': None if lazy else NUM_WIDGET.format(
+            'content': None if lazy else format_html(
+                NUM_WIDGET,
                 num=money_filter(round_decimal(rev, sender.currency), sender.currency, hide_currency=True),
                 text=_('Total revenue ({currency})').format(currency=sender.currency)
             ),
@@ -145,7 +146,7 @@ def base_widgets(sender, subevent=None, lazy=False, **kwargs):
             }) + ('?subevent={}'.format(subevent.pk) if subevent else '')
         },
         {
-            'content': None if lazy else NUM_WIDGET.format(num=prodc, text=_('Active products')),
+            'content': None if lazy else format_html(NUM_WIDGET, num=prodc, text=_('Active products')),
             'lazy': 'active-products',
             'display_size': 'small',
             'priority': 100,
@@ -209,8 +210,8 @@ def waitinglist_widgets(sender, subevent=None, lazy=False, **kwargs):
                             quota_cache[q.pk] = (quota_cache[q.pk][0], quota_cache[q.pk][1] - min(wlt['cnt'], row[1]))
 
         widgets.append({
-            'content': None if lazy else NUM_WIDGET.format(
-                num=intcomma(happy), text=_('available to give to people on waiting list')
+            'content': None if lazy else format_html(
+                NUM_WIDGET, num=intcomma(happy), text=_('available to give to people on waiting list')
             ),
             'lazy': 'waitinglist-avail',
             'priority': 50,
@@ -220,7 +221,9 @@ def waitinglist_widgets(sender, subevent=None, lazy=False, **kwargs):
             })
         })
         widgets.append({
-            'content': None if lazy else NUM_WIDGET.format(num=intcomma(wles.count()), text=_('total waiting list length')),
+            'content': None if lazy else format_html(
+                NUM_WIDGET, num=intcomma(wles.count()), text=_('total waiting list length')
+            ),
             'lazy': 'waitinglist-length',
             'display_size': 'small',
             'priority': 50,
@@ -247,9 +250,10 @@ def quota_widgets(sender, subevent=None, lazy=False, **kwargs):
         if not lazy:
             status, left = qa.results[q] if q in qa.results else q.availability(allow_cache=True)
         widgets.append({
-            'content': None if lazy else NUM_WIDGET.format(
+            'content': None if lazy else format_html(
+                NUM_WIDGET,
                 num='{}/{}'.format(intcomma(left), intcomma(q.size)) if q.size is not None else '\u221e',
-                text=_('{quota} left').format(quota=escape(q.name))
+                text=format_html(_('{quota} left'), quota=q.name)
             ),
             'lazy': 'quota-{}'.format(q.pk),
             'display_size': 'small',
@@ -268,7 +272,8 @@ def shop_state_widget(sender, **kwargs):
     return [{
         'display_size': 'small',
         'priority': 1000,
-        'content': '<div class="shopstate">{t1}<br><span class="{cls}"><span class="fa {icon}"></span> {state}</span>{t2}</div>'.format(
+        'content': format_html(
+            '<div class="shopstate">{t1}<br><span class="{cls}"><span class="fa {icon}"></span> {state}</span>{t2}</div>',
             t1=_('Your ticket shop is'), t2=_('Click here to change'),
             state=_('live') if sender.live and not sender.testmode else (
                 _('live and in test mode') if sender.live else (
@@ -299,9 +304,10 @@ def checkin_widget(sender, subevent=None, lazy=False, **kwargs):
     qs = sender.checkin_lists.filter(subevent=subevent)
     for cl in qs:
         widgets.append({
-            'content': None if lazy else NUM_WIDGET.format(
+            'content': None if lazy else format_html(
+                NUM_WIDGET,
                 num='{}/{}'.format(intcomma(cl.inside_count), intcomma(cl.position_count)),
-                text=_('Present – {list}').format(list=escape(cl.name))
+                text=format_html(_('Present – {list}'), list=cl.name)
             ),
             'lazy': 'checkin-{}'.format(cl.pk),
             'display_size': 'small',
@@ -340,6 +346,12 @@ def welcome_wizard_widget(sender, **kwargs):
     }]
 
 
+def build_json_response(widgets):
+    for widget in widgets:
+        widget['content'] = conditional_escape(widget['content'])
+    return JsonResponse({'widgets': widgets})
+
+
 def event_index(request, organizer, event):
     from pretix.control.forms.event import CommentForm
 
@@ -418,7 +430,7 @@ def event_index_widgets_lazy(request, organizer, event):
     for r, result in event_dashboard_widgets.send(sender=request.event, subevent=subevent, lazy=False):
         widgets.extend(result)
 
-    return JsonResponse({'widgets': widgets})
+    return build_json_response(widgets)
 
 
 def event_index_log_lazy(request, organizer, event):
@@ -505,7 +517,7 @@ def widgets_for_event_qs(request, qs, user, nmax, lazy=False):
         <a href="{url}" class="event">
             <div class="name">{event}</div>
             <div class="daterange">{daterange}</div>
-            <div class="times">{times}</div>
+            <div class="times">{times}{timezone}</div>
         </a>
         <div class="bottomrow">
             {orders}
@@ -549,14 +561,16 @@ def widgets_for_event_qs(request, qs, user, nmax, lazy=False):
                 status = ('success', _('On sale'))
 
         widgets.append({
-            'content': tpl.format(
+            'content': format_html(
+                tpl,
                 event=escape(event.name),
                 times=_('Event series') if event.has_subevents else (
                     ((date_format(event.date_admission.astimezone(tz), 'TIME_FORMAT') + ' / ')
                      if event.date_admission and event.date_admission != event.date_from else '')
                     + (date_format(event.date_from.astimezone(tz), 'TIME_FORMAT') if event.date_from else '')
-                ) + (
-                    ' <span class="fa fa-globe text-muted" data-toggle="tooltip" title="{}"></span>'.format(tzname)
+                ),
+                timezone=(
+                    format_html(' <span class="fa fa-globe text-muted" data-toggle="tooltip" title="{}"></span>', tzname)
                     if tzname != request.timezone and not event.has_subevents else ''
                 ),
                 url=reverse('control:event.index', kwargs={
@@ -564,7 +578,8 @@ def widgets_for_event_qs(request, qs, user, nmax, lazy=False):
                     'organizer': event.organizer.slug
                 }),
                 orders=(
-                    '<a href="{orders_url}" class="orders">{orders_text}</a>'.format(
+                    format_html(
+                        '<a href="{orders_url}" class="orders">{orders_text}</a>',
                         orders_url=reverse('control:event.orders', kwargs={
                             'event': event.slug,
                             'organizer': event.organizer.slug
@@ -631,7 +646,7 @@ def user_index_widgets_lazy(request):
         request.user,
         8
     )
-    return JsonResponse({'widgets': widgets})
+    return build_json_response(widgets)
 
 
 def user_index(request):

src/pretix/control/views/event.py

@@ -41,7 +41,7 @@ from collections import OrderedDict, defaultdict
 from decimal import Decimal
 from io import BytesIO
 from itertools import groupby
-from urllib.parse import urlsplit
+from urllib.parse import quote, urlsplit
 from zoneinfo import ZoneInfo
 
 import bleach
@@ -82,7 +82,7 @@ from pretix.base.models import Event, LogEntry, Order, TaxRule, Voucher
 from pretix.base.models.event import EventMetaValue
 from pretix.base.services import tickets
 from pretix.base.services.invoices import build_preview_invoice_pdf
-from pretix.base.signals import register_ticket_outputs
+from pretix.base.signals import get_defining_app, register_ticket_outputs
 from pretix.base.templatetags.rich_text import markdown_compile_email
 from pretix.control.forms.event import (
     CancelSettingsForm, CommentForm, ConfirmTextFormset, EventDeleteForm,
@@ -441,6 +441,7 @@ class EventPlugins(EventSettingsViewMixin, EventPermissionRequiredMixin, Templat
         plugins_available = {
             p.module: p for p in self.available_plugins(self.object)
         }
+        plugin_enabled = None
 
         with transaction.atomic():
             save_organizer = False
@@ -490,6 +491,7 @@ class EventPlugins(EventSettingsViewMixin, EventPermissionRequiredMixin, Templat
                                 format_html(_('The plugin {} is now active.'),
                                             format_html("<strong>{}</strong>", pluginmeta.name)),
                             ]
+                        plugin_enabled = module
                         messages.success(self.request, mark_safe("".join(info)))
                     else:
                         self.request.event.log_action('pretix.event.plugins.disabled', user=self.request.user,
@@ -499,13 +501,19 @@ class EventPlugins(EventSettingsViewMixin, EventPermissionRequiredMixin, Templat
             self.object.save()
             if save_organizer:
                 self.object.organizer.save()
-        return redirect(self.get_success_url())
+        return redirect(self.get_success_url(plugin_enabled))
 
-    def get_success_url(self) -> str:
-        return reverse('control:event.settings.plugins', kwargs={
-            'organizer': self.request.organizer.slug,
-            'event': self.request.event.slug,
-        })
+    def get_success_url(self, plugin_enabled) -> str:
+        if plugin_enabled and self.request.POST.get('go') == 'payment':
+            return reverse('control:event.settings.payment', kwargs={
+                'organizer': self.request.organizer.slug,
+                'event': self.request.event.slug,
+            }) + '?highlight=' + quote(plugin_enabled) + '#'
+        else:
+            return reverse('control:event.settings.plugins', kwargs={
+                'organizer': self.request.organizer.slug,
+                'event': self.request.event.slug,
+            })
 
 
 class PaymentProviderSettings(EventSettingsViewMixin, EventPermissionRequiredMixin, TemplateView, SingleObjectMixin):
@@ -671,6 +679,8 @@ class PaymentSettings(WritePermissionMixin, EventSettingsViewMixin, EventSetting
             p.sales_channels = [sales_channels[channel] for channel in p.settings.get('_restrict_to_sales_channels', as_type=list, default=['web'])]
             if p.is_meta:
                 p.show_enabled = p.settings._enabled in (True, 'True')
+            if self.request.GET.get('highlight') and getattr(get_defining_app(p), 'name', None) == self.request.GET.get('highlight'):
+                p.highlight = True
         return context
 
 
@@ -952,7 +962,12 @@ class MailSettingsRendererPreview(MailSettingsPreview):
                     context=context,
                 )
                 r = HttpResponse(v, content_type='text/html')
-                r._csp_ignore = True
+                r['Content-Security-Policy'] = (
+                    # Plugin-provided email templates will contain inline styles or remote images
+                    # but emails should not contain JS
+                    "style-src 'unsafe-inline'; "
+                    "img-src https: data:"
+                )
                 return r
         else:
             raise Http404(_('Unknown email renderer.'))

src/pretix/control/views/mailsetup.py

@@ -41,6 +41,30 @@ from pretix.control.forms.mailsetup import SimpleMailForm, SMTPMailForm
 logger = logging.getLogger(__name__)
 
 
+def get_cname_record(hostname):
+    try:
+        r = dns.resolver.Resolver()
+        answers = r.resolve(hostname, 'CNAME')
+        answers = list(answers)
+        if len(answers) != 1:
+            logger.exception('Found multiple CNAME records for {}'.format(hostname))
+            return
+        return str(answers[0].target).lower()
+    except:
+        logger.exception('Could not fetch CNAME record for {}'.format(hostname))
+
+
+def get_dmarc_record(hostname):
+    try:
+        r = dns.resolver.Resolver()
+        for resp in r.resolve("_dmarc." + hostname, 'TXT'):
+            data = b''.join(resp.strings).decode()
+            if 'DMARC1' in data.strip():
+                return data
+    except:
+        logger.exception("Could not fetch DMARC record for {}".format(hostname))
+
+
 def get_spf_record(hostname):
     try:
         r = dns.resolver.Resolver()
@@ -49,7 +73,7 @@ def get_spf_record(hostname):
             if data.lower().strip().startswith('v=spf1 '):  # RFC7208, section 4.5
                 return data
     except:
-        logger.exception("Could not fetch SPF record")
+        logger.exception("Could not fetch SPF record for {}".format(hostname))
 
 
 def _check_spf_record(not_found_lookup_parts, spf_record, depth):
@@ -168,10 +192,15 @@ class MailSettingsSetupView(TemplateView):
                 return super().get(request, *args, **kwargs)
 
             session_key = f'sender_mail_verification_code_{self.request.path}_{self.simple_form.cleaned_data.get("mail_from")}'
+            verify_dns = (
+                settings.MAIL_CUSTOM_SENDER_SPF_STRING or
+                (settings.MAIL_CUSTOM_SENDER_DKIM_CNAME and settings.MAIL_CUSTOM_SENDER_DKIM_SELECTOR) or
+                settings.MAIL_CUSTOM_SENDER_DMARC_REQUIRED
+            )
             allow_save = (
                 (not settings.MAIL_CUSTOM_SENDER_VERIFICATION_REQUIRED or
                  ('verification' in self.request.POST and self.request.POST.get('verification', '') == self.request.session.get(session_key, None))) and
-                (not settings.MAIL_CUSTOM_SENDER_SPF_STRING or self.request.POST.get('state') == 'save')
+                (not verify_dns or self.request.POST.get('state') == 'save')
             )
 
             if allow_save:
@@ -192,8 +221,8 @@ class MailSettingsSetupView(TemplateView):
 
             spf_warning = None
             spf_record = None
+            hostname = self.simple_form.cleaned_data['mail_from'].split('@')[-1]
             if settings.MAIL_CUSTOM_SENDER_SPF_STRING:
-                hostname = self.simple_form.cleaned_data['mail_from'].split('@')[-1]
                 spf_record = get_spf_record(hostname)
                 if not spf_record:
                     spf_warning = _(
@@ -210,7 +239,43 @@ class MailSettingsSetupView(TemplateView):
                         'this system in the SPF record.'
                     )
 
-            verification = settings.MAIL_CUSTOM_SENDER_VERIFICATION_REQUIRED and not spf_warning
+            dkim_warning = None
+            dkim_hostname = None
+            dkim_cname = None
+            if settings.MAIL_CUSTOM_SENDER_DKIM_CNAME and settings.MAIL_CUSTOM_SENDER_DKIM_SELECTOR:
+                dkim_hostname = settings.MAIL_CUSTOM_SENDER_DKIM_SELECTOR + '._domainkey.' + hostname
+                cname_target = get_cname_record(dkim_hostname)
+                dkim_cname = settings.MAIL_CUSTOM_SENDER_DKIM_CNAME
+                if not dkim_cname.endswith("."):
+                    dkim_cname += "."
+                if "%s" in dkim_cname:
+                    dkim_cname = dkim_cname.replace("%s", hostname.replace(".", "-").lower())
+                if not cname_target:
+                    dkim_warning = _(
+                        'We could not find a CNAME record pointing to our DKIM key for domain you are trying to use. '
+                        'This means that there is a very high change most of the emails will be rejected or marked as '
+                        'spam. We strongly recommend setting up DKIM through a CNAME record. You can do so through the '
+                        'DNS settings at the provider you registered your domain with.'
+                    )
+                elif cname_target != dkim_cname:
+                    dkim_warning = _(
+                        'We found a CNAME record for a DKIM key, but it is not pointing to the right location. '
+                        'This means that there is a very high chance most of the emails will be rejected or marked as '
+                        'spam. You should update the DNS settings of your domain.'
+                    )
+
+            dmarc_warning = None
+            dmarc_record = None
+            if settings.MAIL_CUSTOM_SENDER_DMARC_REQUIRED:
+                dmarc_record = get_dmarc_record(hostname)
+                if not dmarc_record:
+                    spf_warning = _(
+                        'We did not find DMARC record for your domain. This means that there is a very high chance '
+                        'most of the emails will be rejected or marked as spam. You should update the DNS settings '
+                        'of your domain.'
+                    )
+
+            verification = settings.MAIL_CUSTOM_SENDER_VERIFICATION_REQUIRED and not spf_warning and not dkim_warning and not dmarc_warning
             if verification:
                 if 'verification' in self.request.POST:
                     messages.error(request, _('The verification code was incorrect, please try again.'))
@@ -241,6 +306,12 @@ class MailSettingsSetupView(TemplateView):
                     'spf_warning': spf_warning,
                     'spf_record': spf_record,
                     'spf_key': settings.MAIL_CUSTOM_SENDER_SPF_STRING,
+                    'dkim_warning': dkim_warning,
+                    'dkim_hostname': dkim_hostname,
+                    'dkim_cname': dkim_cname,
+                    'dmarc_warning': dmarc_warning,
+                    'dmarc_record': dmarc_record,
+                    'hostname': hostname,
                     'recp': self.simple_form.cleaned_data.get('mail_from')
                 },
                 using=self.template_engine,

src/pretix/control/views/orders.py

@@ -64,7 +64,7 @@ from django.urls import reverse
 from django.utils import formats
 from django.utils.formats import date_format, get_format
 from django.utils.functional import cached_property
-from django.utils.html import conditional_escape, escape
+from django.utils.html import conditional_escape, escape, format_html
 from django.utils.http import url_has_allowed_host_and_scheme
 from django.utils.safestring import mark_safe
 from django.utils.timezone import make_aware, now
@@ -79,7 +79,7 @@ from pretix.base.email import get_email_context
 from pretix.base.exporter import MultiSheetListExporter
 from pretix.base.i18n import language
 from pretix.base.models import (
-    CachedFile, CachedTicket, Checkin, Invoice, InvoiceAddress, Item,
+    CachedFile, CachedTicket, Checkin, GiftCard, Invoice, InvoiceAddress, Item,
     ItemVariation, LogEntry, Order, QuestionAnswer, Quota,
     ScheduledEventExport, generate_secret,
 )
@@ -551,10 +551,10 @@ class OrderDetail(OrderView):
         ctx['refunds'] = self.order.refunds.select_related('payment').order_by('-created')
         for p in ctx['payments']:
             if p.payment_provider:
-                p.html_info = (p.payment_provider.payment_control_render(self.request, p) or "").strip()
+                p.html_info = p.payment_provider.payment_control_render(self.request, p) or ""
         for r in ctx['refunds']:
             if r.payment_provider:
-                r.html_info = (r.payment_provider.refund_control_render(self.request, r) or "").strip()
+                r.html_info = r.payment_provider.refund_control_render(self.request, r) or ""
         ctx['invoices'] = list(self.order.invoices.all().select_related('event'))
         ctx['comment_form'] = CommentForm(initial={
             'comment': self.order.comment,
@@ -1994,7 +1994,7 @@ class OrderChange(OrderView):
         positions = list(self.order.positions.select_related(
             'item', 'item__tax_rule', 'used_membership', 'used_membership__membership_type', 'tax_rule',
             'seat', 'subevent',
-        ).prefetch_related('granted_memberships'))
+        ).prefetch_related('granted_memberships', 'issued_gift_cards'))
         for p in positions:
             p.form = OrderPositionChangeForm(prefix='op-{}'.format(p.pk), instance=p, items=self.items,
                                              initial={'seat': p.seat.seat_guid if p.seat else None},
@@ -2261,6 +2261,12 @@ class OrderContactChange(OrderView):
     def get_context_data(self, **kwargs):
         ctx = super().get_context_data()
         ctx['form'] = self.form
+        if self.order.all_positions.filter(Exists(GiftCard.objects.filter(issued_in=OuterRef('pk')))).exists():
+            self.form.fields['regenerate_secrets'].help_text = format_html(
+                '{}<br><br><strong><span class="fa fa-warning"></span> {}</strong>',
+                self.form.fields['regenerate_secrets'].help_text,
+                _("Ticket secrets of order positions that have been used to issue a gift card can not be changed. Only the link will be changed in this case."),
+            )
         return ctx
 
     @cached_property

src/pretix/control/views/pdf.py

@@ -70,7 +70,6 @@ class BaseEditorView(EventPermissionRequiredMixin, TemplateView):
         if 'placeholders' in request.GET:
             return self.get_placeholders_help(request)
         resp = super().get(request, *args, **kwargs)
-        resp._csp_ignore = True
         return resp
 
     def get_placeholders_help(self, request):

src/pretix/control/views/subevents.py

@@ -85,6 +85,7 @@ from pretix.control.views import PaginationMixin
 from pretix.control.views.event import MetaDataEditorMixin
 from pretix.helpers import GroupConcat
 from pretix.helpers.compat import CompatDeleteView
+from pretix.helpers.i18n import get_format_without_seconds
 from pretix.helpers.models import modelcopy
 
 
@@ -430,7 +431,7 @@ class SubEventEditorMixin(MetaDataEditorMixin):
         days = (self.copy_from.date_from.astimezone(tz).date() - value.astimezone(tz).date()).days
         return RelativeDateWrapper(RelativeDate(
             days=abs(days),
-            base_date_name='date_from',
+            base_date_name='event__date_from',
             time=value.astimezone(tz).time(),
             minutes=None,
             is_after=days < 0,
@@ -878,7 +879,7 @@ class SubEventBulkCreate(SubEventEditorMixin, EventPermissionRequiredMixin, Asyn
         ctx['rrule_formset'] = self.rrule_formset
         ctx['time_formset'] = self.time_formset
 
-        tf = get_format('TIME_INPUT_FORMATS')[0]
+        tf = get_format_without_seconds('TIME_INPUT_FORMATS')
         ctx['time_admission_sample'] = time(8, 30, 0).strftime(tf)
         ctx['time_begin_sample'] = time(9, 0, 0).strftime(tf)
         ctx['time_end_sample'] = time(18, 0, 0).strftime(tf)

src/pretix/control/views/user.py

@@ -80,6 +80,7 @@ from pretix.control.permissions import (
 )
 from pretix.control.views.auth import get_u2f_appid, get_webauthn_rp_id
 from pretix.helpers.http import redirect_to_url
+from pretix.helpers.ratelimit import rate_limit, rate_limit_reset
 from pretix.helpers.security import session_reauth
 from pretix.helpers.u2f import websafe_encode
 
@@ -849,6 +850,7 @@ class UserPasswordChangeView(FormView):
             msgs = []
             msgs.append(_('Your password has been changed.'))
             self.request.user.send_security_notice(msgs)
+            rate_limit_reset("pwreset", self.request.user.pk)
 
             self.request.user.log_action('pretix.user.settings.changed', user=self.request.user, data={'new_pw': True})
 
@@ -879,6 +881,7 @@ class UserEmailChangeView(RecentAuthenticationRequiredMixin, FormView):
 
         return {
             **super().get_form_kwargs(),
+            "request": self.request,
             "user": self.request.user,
         }
 
@@ -908,6 +911,10 @@ class UserEmailVerifyView(View):
             messages.success(self.request, _('Your email address was already verified.'))
             return redirect(reverse('control:user.settings', kwargs={}))
 
+        if rate_limit("emailverify", self.request.user.pk, max_num=2, expire_time=300):
+            messages.error(self.request, _("For security reasons, please wait 5 minutes before you try again."))
+            return redirect(reverse('control:user.settings', kwargs={}))
+
         self.request.user.send_confirmation_code(
             session=self.request.session,
             reason='email_verify',

src/pretix/helpers/cookies.py

@@ -19,7 +19,9 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
+import itertools
 import re
+from http.cookies import Morsel
 
 from django.conf import settings
 
@@ -48,6 +50,41 @@ def set_cookie_without_samesite(request, response, key, *args, **kwargs):
         response.cookies[key]['Partitioned'] = True
 
 
+def thoroughly_delete_cookie(response, cookie_name, **kwargs):
+    """ Deletes different possible versions of a cookie (SameSite, Partitioned) """
+    properties = {"SameSite": ["", 'None'], "Partitioned": ["", True]}
+    for i, values in enumerate(itertools.product(*properties.values())):
+        m = Morsel()
+        m.set(cookie_name, '', '')
+        m.update(kwargs)
+        m.update(zip(properties.keys(), values))
+        m['expires'] = "Thu, 01 Jan 1970 00:00:00 GMT"
+
+        response.cookies[f'___DELETECOOKIE__{i}___{cookie_name}'] = m
+
+    # Make sure settings a cookie afterwards will add a new item in the dictionary, placing
+    # it below our deletion headers.
+    response.cookies.pop(cookie_name, None)
+
+
+def get_all_values_of_cookie(cookie_header, cookie_name):
+    # like django.http.cookie.parse_cookie, but returns all values of duplicated cookies instead of only the last
+    values = list()
+    if not cookie_header:
+        return values
+    for chunk in cookie_header.split(";"):
+        if "=" in chunk:
+            key, val = chunk.split("=", 1)
+        else:
+            # Assume an empty name per
+            # https://bugzilla.mozilla.org/show_bug.cgi?id=169091
+            key, val = "", chunk
+        key, val = key.strip(), val.strip()
+        if key == cookie_name:
+            values.append(val)
+    return values
+
+
 # Based on https://www.chromium.org/updates/same-site/incompatible-clients
 # Copyright 2019 Google LLC.
 # SPDX-License-Identifier: Apache-2.0

src/pretix/helpers/escapejson.py

@@ -47,5 +47,5 @@ def escapejson(value):
 
 @keep_lazy(str, SafeText)
 def escapejson_attr(value):
-    """Hex encodes characters for use in a html attributw script."""
+    """Hex encodes characters for use in a html attribute."""
     return mark_safe(force_str(value).translate(_json_escapes_attr))

src/pretix/helpers/models.py

@@ -20,9 +20,11 @@
 # <https://www.gnu.org/licenses/>.
 #
 import copy
+from decimal import Decimal
 
 from django.core.files import File
 from django.db import models
+from django.db.models.fields import DecimalField
 
 
 class Thumbnail(models.Model):
@@ -54,3 +56,33 @@ def flatten_choices(choices):
             yield from label_or_nested
         else:
             yield value_or_group, label_or_nested
+
+
+def _normalize_decimal(d: Decimal) -> Decimal:
+    """
+    Strips trailing zeros, e.g.
+
+    20.000 → 20
+    20.010 → 20.01
+    20.100 → 20.1
+
+    But unlike of Decimal.normalize(), 20.000 will not become 2e+1. Very small decimals might still be represented
+    in scientific notation when printed.
+    """
+    normalized = d.normalize()
+    sign, digit, exponent = normalized.as_tuple()
+    if exponent > 0:
+        return normalized.quantize(1)
+    return normalized
+
+
+class NormalizedDecimalField(DecimalField):
+    """
+    Variant of DecimalField that never outputs the trailing zeros, so we always have normalized decimals internally.
+    Use this only for fields where the trailing zeros are pointless (e.g. percentages), not for monetary amounts.
+    """
+
+    def from_db_value(self, value, expression, connection):
+        if value is not None:
+            value = _normalize_decimal(value)
+        return value

src/pretix/helpers/ratelimit.py

@@ -0,0 +1,116 @@
+#
+# This file is part of pretix (Community Edition).
+#
+# Copyright (C) 2014-2020  Raphael Michel and contributors
+# Copyright (C) 2020-today pretix GmbH and contributors
+#
+# This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
+# Public License as published by the Free Software Foundation in version 3 of the License.
+#
+# ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are
+# applicable granting you additional permissions and placing additional restrictions on your usage of this software.
+# Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive
+# this file, see <https://pretix.eu/about/en/license>.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
+# details.
+#
+# You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
+# <https://www.gnu.org/licenses/>.
+#
+import hashlib
+import ipaddress
+import logging
+
+from django.conf import settings
+from django.http import HttpRequest
+
+from pretix.helpers.http import get_client_ip
+
+logger = logging.getLogger(__name__)
+
+
+def _get_key(key, parameters):
+    return f'pretix:ratelimit:{key}:' + hashlib.sha256(','.join(str(p) for p in parameters).encode()).hexdigest()
+
+
+def _get_ip(request):
+    client_ip = get_client_ip(request)
+    if not client_ip:
+        return None
+    try:
+        client_ip = ipaddress.ip_address(client_ip)
+    except ValueError:
+        # Web server not set up correctly
+        return None
+    if client_ip.is_private and not settings.DEBUG:
+        # This is the private IP of the server, web server not set up correctly
+        return None
+    return str(client_ip)
+
+
+def rate_limit(key: str, *parameters, include_ip_from_request: HttpRequest=None, max_num: int, expire_time: int, increase: bool = True):
+    """
+    This is a shared utility to implement simple rate limiting in operations like
+    password resets.
+
+    :param key: The key referring to the feature like "pwreset"
+    :param parameters: Any number of things to be hashed as the bucket key
+    :param include_ip_from_request: Add IP address from request to the bucket key. If IP address cannot be determined,
+                                    rate limit is not applied.
+    :param max_num: The maximum number of actions to performed within expire_time of the first action
+    :param expire_time: The length of the time window in seconds
+    :param increase: Whether to count the call as an event counted towards the rate, or just check
+    :return:
+    """
+    if not settings.HAS_REDIS:
+        # No rate limiting
+        return False
+
+    from django_redis import get_redis_connection
+    rc = get_redis_connection("redis")
+
+    if include_ip_from_request:
+        ip = _get_ip(include_ip_from_request)
+        if not ip:
+            # IP not discovered, can't rate limit
+            return False
+        parameters = (*parameters, ip)
+
+    redis_key = _get_key(key, parameters)
+
+    if increase:
+        p = rc.pipeline()
+        p.set(redis_key, 0, nx=True, ex=expire_time)  # Start a rate limit window if none is running
+        p.incr(redis_key)
+        new_counter = p.execute()[1]
+    else:
+        new_counter = int(rc.get(redis_key) or 0)
+
+    if new_counter > max_num:
+        return True
+
+    return False
+
+
+def rate_limit_reset(key: str, *parameters, include_ip_from_request: HttpRequest=None):
+    """
+    Reset a rate limit bucket.
+    """
+    if not settings.HAS_REDIS:
+        # No rate limiting
+        return
+
+    from django_redis import get_redis_connection
+    rc = get_redis_connection("redis")
+
+    if include_ip_from_request:
+        ip = _get_ip(include_ip_from_request)
+        if not ip:
+            # IP not discovered, can't rate limit
+            return False
+        parameters = (*parameters, ip)
+
+    redis_key = _get_key(key, parameters)
+    rc.delete(redis_key)

src/pretix/locale/ar/LC_MESSAGES/djangojs.po

@@ -8,8 +8,8 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-07-06 15:52+0000\n"
-"PO-Revision-Date: 2021-09-15 11:22+0000\n"
-"Last-Translator: Mohamed Tawfiq <mtawfiq@wafyapp.com>\n"
+"PO-Revision-Date: 2026-07-13 11:28+0000\n"
+"Last-Translator: ahmed badr <ahmedbadr@oma.com.eg>\n"
 "Language-Team: Arabic <https://translate.pretix.eu/projects/pretix/pretix-js/"
 "ar/>\n"
 "Language: ar\n"
@@ -18,7 +18,7 @@ msgstr ""
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=6; plural=n==0 ? 0 : n==1 ? 1 : n==2 ? 2 : n%100>=3 "
 "&& n%100<=10 ? 3 : n%100>=11 ? 4 : 5;\n"
-"X-Generator: Weblate 4.8\n"
+"X-Generator: Weblate 2026.7.1\n"
 
 #: pretix/plugins/banktransfer/static/pretixplugins/banktransfer/ui.js
 msgid "Marked as paid"
@@ -30,112 +30,110 @@ msgstr "تعليق:"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "PayPal"
-msgstr ""
+msgstr "باي بال"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "Venmo"
-msgstr ""
+msgstr "Venmo"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 #: pretix/static/pretixpresale/js/walletdetection.js
 msgid "Apple Pay"
-msgstr ""
+msgstr "Apple Pay"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "Itaú"
-msgstr ""
+msgstr "إيتاو"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "PayPal Credit"
-msgstr ""
+msgstr "الائتمان من PayPal"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "Credit Card"
-msgstr ""
+msgstr "بطاقة الائتمان"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "PayPal Pay Later"
-msgstr ""
+msgstr "الدفع لاحقًا عبر PayPal"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "iDEAL | Wero"
-msgstr ""
+msgstr "iDEAL | التحدي"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "SEPA Direct Debit"
-msgstr ""
+msgstr "الخصم المباشر في منطقة الدفع الموحدة (SEPA)"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "Bancontact"
-msgstr ""
+msgstr "بانكونتاكت"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "giropay"
-msgstr ""
+msgstr "giropay"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "SOFORT"
-msgstr ""
+msgstr "فوراً"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
-#, fuzzy
-#| msgid "Yes"
 msgid "eps"
-msgstr "نعم"
+msgstr "نقاط إضافية"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "MyBank"
-msgstr ""
+msgstr "بنكي"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "Przelewy24"
-msgstr ""
+msgstr "Przelewy24"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "Verkkopankki"
-msgstr ""
+msgstr "الخدمات المصرفية عبر الإنترنت"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "PayU"
-msgstr ""
+msgstr "الدفع لك"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "BLIK"
-msgstr ""
+msgstr "BLIK"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "Trustly"
-msgstr ""
+msgstr "Trustly"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "Zimpler"
-msgstr ""
+msgstr "Zimpler"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "Maxima"
-msgstr ""
+msgstr "الأعظم"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "OXXO"
-msgstr ""
+msgstr "OXXO"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "Boleto"
-msgstr ""
+msgstr "تذكرة"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "WeChat Pay"
-msgstr ""
+msgstr "WeChat Pay"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "Mercado Pago"
-msgstr ""
+msgstr "Mercado Pago"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
 #: pretix/static/pretixpresale/js/ui/cart.js
 msgid "Continue"
-msgstr "المتابعة"
+msgstr "تابع"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 #: pretix/plugins/stripe/static/pretixplugins/stripe/pretix-stripe.js
@@ -144,7 +142,7 @@ msgstr "جاري تأكيد الدفع الخاص بك …"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "Payment method unavailable"
-msgstr ""
+msgstr "طريقة الدفع غير متاحة"
 
 #: pretix/plugins/statistics/static/pretixplugins/statistics/statistics.js
 msgid "Placed orders"
@@ -156,11 +154,11 @@ msgstr "الطلبات المدفوعة"
 
 #: pretix/plugins/statistics/static/pretixplugins/statistics/statistics.js
 msgid "Attendees (ordered)"
-msgstr ""
+msgstr "الحاضرون (حسب الترتيب)"
 
 #: pretix/plugins/statistics/static/pretixplugins/statistics/statistics.js
 msgid "Attendees (paid)"
-msgstr ""
+msgstr "الحاضرون (الذين دفعوا رسوم الاشتراك)"
 
 #: pretix/plugins/statistics/static/pretixplugins/statistics/statistics.js
 msgid "Total revenue"
@@ -192,7 +190,7 @@ msgstr "تبديل قائمة الدخول"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
 msgid "Search results"
-msgstr "البحث في النتائج"
+msgstr "نتائج البحث"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
 msgid "No tickets found"
@@ -236,15 +234,15 @@ msgstr "غير مدفوع"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
 msgid "Canceled"
-msgstr "ملغاة"
+msgstr "تم إلغاؤه"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
 msgid "Confirmed"
-msgstr ""
+msgstr "تم التأكيد"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
 msgid "Approval pending"
-msgstr ""
+msgstr "في انتظار الموافقة"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
 msgid "Redeemed"
@@ -252,11 +250,11 @@ msgstr "مستخدم"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
 msgid "Cancel"
-msgstr "قم بالإلغاء"
+msgstr "إلغاء"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
 msgid "Ticket not paid"
-msgstr "لم يتم دفع قيمة التذكرة"
+msgstr "التذكرة لم يتم دفع ثمنها"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
 msgid "This ticket is not yet paid. Do you want to continue anyways?"
@@ -276,23 +274,19 @@ msgstr "تم تسجيل الخروج"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
 msgid "Ticket already used"
-msgstr "تم استخدام التذكرة مسبقا"
+msgstr "تم استخدام التذكرة بالفعل"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
 msgid "Information required"
-msgstr "معلومات مطلوبة"
+msgstr "المعلومات المطلوبة"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
-#, fuzzy
-#| msgid "Unknown error."
 msgid "Unknown ticket"
-msgstr "خطأ غير معروف."
+msgstr "تذكرة غير معروفة"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
-#, fuzzy
-#| msgid "Entry not allowed"
 msgid "Ticket type not allowed here"
-msgstr "إدخال غير مسموح"
+msgstr "نوع تذكرة الدخول غير مسموح به هنا"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
 msgid "Entry not allowed"
@@ -300,17 +294,13 @@ msgstr "إدخال غير مسموح"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
 msgid "Ticket code revoked/changed"
-msgstr "تم إلغاء رمز التذكرة أو تبديله"
+msgstr "تم إلغاء/تغيير رمز التذكرة"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
-#, fuzzy
-#| msgid "Ticket not paid"
 msgid "Ticket blocked"
-msgstr "لم يتم دفع قيمة التذكرة"
+msgstr "التذكرة غير محجوبة"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
-#, fuzzy
-#| msgid "Ticket not paid"
 msgid "Ticket not valid at this time"
 msgstr "لم يتم دفع قيمة التذكرة"
 
@@ -320,11 +310,11 @@ msgstr "تم إلغاء الطلب"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
 msgid "Ticket code is ambiguous on list"
-msgstr ""
+msgstr "رمز التذكرة غير واضح في القائمة"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
 msgid "Order not approved"
-msgstr ""
+msgstr "لم تتم الموافقة على الطلب"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
 msgid "Checked-in Tickets"
@@ -348,12 +338,9 @@ msgstr "نعم"
 #: pretix/static/pretixcontrol/js/ui/question.js
 #: pretix/static/pretixpresale/js/ui/questions.js
 msgid "No"
-msgstr "لا"
+msgstr "من"
 
 #: pretix/static/lightbox/js/lightbox.js
-#, fuzzy
-#| msgctxt "widget"
-#| msgid "Close"
 msgid "close"
 msgstr "إغلاق"
 
@@ -408,7 +395,7 @@ msgstr ""
 
 #: pretix/static/pretixbase/js/asynctask.js
 msgid "We are processing your request …"
-msgstr "جاري معالجة طلبك …"
+msgstr "نحن نقوم بمعالجة طلبك …"
 
 #: pretix/static/pretixbase/js/asynctask.js
 msgid ""
@@ -421,7 +408,7 @@ msgstr ""
 
 #: pretix/static/pretixbase/js/asynctask.js
 msgid "If this takes longer than a few minutes, please contact us."
-msgstr ""
+msgstr "إذا استغرق ذلك أكثر من بضع دقائق، يرجى الاتصال بنا."
 
 #: pretix/static/pretixbase/js/asynctask.js
 msgid "Close message"
@@ -437,11 +424,11 @@ msgstr "للنسخ اضغط Ctrl + C!"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/App.vue
 msgid "Edit"
-msgstr ""
+msgstr "تحرير"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/App.vue
 msgid "Visualize"
-msgstr ""
+msgstr "تصور"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/App.vue
 msgid ""
@@ -449,10 +436,13 @@ msgid ""
 "or variations are not contained in any of your rule parts so people with "
 "these tickets will not get in:"
 msgstr ""
+"تقوم القاعدة الخاصة بك دائمًا بالتصفية حسب المنتج أو النوع، لكن المنتجات أو "
+"الأنواع التالية غير مدرجة في أي من أجزاء القاعدة الخاصة بك، لذا لن يتم قبول "
+"الأشخاص الذين يحملون هذه التذاكر:"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/App.vue
 msgid "Please double-check if this was intentional."
-msgstr ""
+msgstr "يرجى التأكد مرة أخرى مما إذا كان ذلك مقصودًا أم لا."
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "All of the conditions below (AND)"
@@ -492,21 +482,21 @@ msgstr "أضف شرطا"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "minutes"
-msgstr "الدقائق"
+msgstr "دقائق"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "Duplicate"
-msgstr ""
+msgstr "مكرر"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgctxt "entry_status"
 msgid "present"
-msgstr ""
+msgstr "حاضر"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgctxt "entry_status"
 msgid "absent"
-msgstr ""
+msgstr "غائب"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "is one of"
@@ -522,11 +512,11 @@ msgstr "بعد"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "="
-msgstr ""
+msgstr "="
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "Product"
-msgstr "منتج"
+msgstr "المنتج"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "Product variation"
@@ -534,7 +524,7 @@ msgstr "نوع المنتج"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "Gate"
-msgstr ""
+msgstr "الشارع"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "Current date and time"
@@ -542,11 +532,11 @@ msgstr "التاريخ والوقت الحالي"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "Current day of the week (1 = Monday, 7 = Sunday)"
-msgstr ""
+msgstr "اليوم الحالي من الأسبوع (1 = الاثنين، 7 = الأحد)"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "Current entry status"
-msgstr ""
+msgstr "الحالة الحالية للطلب"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "Number of previous entries"
@@ -557,48 +547,40 @@ msgid "Number of previous entries since midnight"
 msgstr "عدد المدخلات السابقة قبل منتصف الليل"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
-#, fuzzy
-#| msgid "Number of previous entries"
 msgid "Number of previous entries since"
-msgstr "عدد المدخلات السابقة"
+msgstr "عدد الإدخالات السابقة منذ"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
-#, fuzzy
-#| msgid "Number of previous entries"
 msgid "Number of previous entries before"
-msgstr "عدد المدخلات السابقة"
+msgstr "عدد الإدخالات السابقة قبل"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "Number of days with a previous entry"
 msgstr "عدد الأيام التي تحتوي على مدخل سابق"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
-#, fuzzy
-#| msgid "Number of days with a previous entry"
 msgid "Number of days with a previous entry since"
-msgstr "عدد الأيام التي تحتوي على مدخل سابق"
+msgstr "عدد الأيام التي تحتوي على قيد سابق منذ"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
-#, fuzzy
-#| msgid "Number of days with a previous entry"
 msgid "Number of days with a previous entry before"
-msgstr "عدد الأيام التي تحتوي على مدخل سابق"
+msgstr "عدد الأيام التي يوجد فيها قيد سابق قبل ذلك"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "Minutes since last entry (-1 on first entry)"
-msgstr ""
+msgstr "عدد الدقائق منذ آخر تسجيل (-1 عند التسجيل الأول)"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "Minutes since first entry (-1 on first entry)"
-msgstr ""
+msgstr "عدد الدقائق منذ أول دخول (-1 عند أول دخول)"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/django-interop.ts
 msgid "Error: Product not found!"
-msgstr ""
+msgstr "خطأ: لم يتم العثور على المنتج!"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/django-interop.ts
 msgid "Error: Variation not found!"
-msgstr ""
+msgstr "خطأ: لم يتم العثور على النسخة!"
 
 #: pretix/static/pretixcontrol/js/ui/editor.js
 msgid "Check-in QR"
@@ -613,16 +595,12 @@ msgid "Group of objects"
 msgstr "مجموعة من العناصر"
 
 #: pretix/static/pretixcontrol/js/ui/editor.js
-#, fuzzy
-#| msgid "Text object"
 msgid "Text object (deprecated)"
-msgstr "عنصر نص"
+msgstr "كائن نصي (مهمل)"
 
 #: pretix/static/pretixcontrol/js/ui/editor.js
-#, fuzzy
-#| msgid "Text object"
 msgid "Text box"
-msgstr "عنصر نص"
+msgstr "مربع نصي"
 
 #: pretix/static/pretixcontrol/js/ui/editor.js
 msgid "Barcode area"
@@ -669,28 +647,28 @@ msgid "Unknown error."
 msgstr "خطأ غير معروف."
 
 #: pretix/static/pretixcontrol/js/ui/main.js
-#, fuzzy
-#| msgid "Your color has great contrast and is very easy to read!"
 msgid "Your color has great contrast and will provide excellent accessibility."
-msgstr "اللون يتمتع بتباين كبير وتسهل قراءته!"
+msgstr "يتميز لونك بتباين رائع ويسهل قراءته للغاية! وسيوفر إمكانية وصول ممتازة."
 
 #: pretix/static/pretixcontrol/js/ui/main.js
-#, fuzzy
-#| msgid "Your color has decent contrast and is probably good-enough to read!"
 msgid ""
 "Your color has decent contrast and is sufficient for minimum accessibility "
 "requirements."
-msgstr "اللون يحظى بتباين معقول ويمكن أن يكون مناسب للقراءة!"
+msgstr ""
+"يتميز لونك بتباين جيد، ومن المرجح أنه مناسب للقراءة! وهو كافٍ لتلبية الحد "
+"الأدنى من متطلبات سهولة الوصول."
 
 #: pretix/static/pretixcontrol/js/ui/main.js
 msgid ""
 "Your color has insufficient contrast to white. Accessibility of your site "
 "will be impacted."
 msgstr ""
+"اللون الذي اخترته لا يتمتع بتباين كافٍ مع اللون الأبيض. وسيؤثر ذلك على إمكانية "
+"الوصول إلى موقعك."
 
 #: pretix/static/pretixcontrol/js/ui/main.js
 msgid "Search query"
-msgstr "البحث في الاستفسارات"
+msgstr "استعلام البحث"
 
 #: pretix/static/pretixcontrol/js/ui/main.js
 msgid "All"
@@ -706,11 +684,11 @@ msgstr "المختارة فقط"
 
 #: pretix/static/pretixcontrol/js/ui/main.js
 msgid "Enter page number between 1 and %(max)s."
-msgstr ""
+msgstr "أدخل رقم الصفحة بين 1 و %(max)s."
 
 #: pretix/static/pretixcontrol/js/ui/main.js
 msgid "Invalid page number."
-msgstr ""
+msgstr "رقم الصفحة غير صحيح."
 
 #: pretix/static/pretixcontrol/js/ui/main.js
 msgid "Use a different name internally"
@@ -729,10 +707,8 @@ msgid "Calculating default price…"
 msgstr "حساب السعر الافتراضي…"
 
 #: pretix/static/pretixcontrol/js/ui/plugins.js
-#, fuzzy
-#| msgid "Search results"
 msgid "No results"
-msgstr "البحث في النتائج"
+msgstr "البحث: لا توجد نتائج"
 
 #: pretix/static/pretixcontrol/js/ui/question.js
 msgid "Others"
@@ -740,7 +716,7 @@ msgstr "غير ذلك"
 
 #: pretix/static/pretixcontrol/js/ui/question.js
 msgid "Count"
-msgstr "احسب"
+msgstr "العدد"
 
 #: pretix/static/pretixcontrol/js/ui/subevent.js
 msgid "(one more date)"
@@ -753,12 +729,12 @@ msgstr[4] "أيام عديدة"
 msgstr[5] "أخرى"
 
 #: pretix/static/pretixpresale/js/ui/cart.js
-#, fuzzy
-#| msgid "The items in your cart are no longer reserved for you."
 msgid ""
 "The items in your cart are no longer reserved for you. You can still "
 "complete your order as long as they’re available."
-msgstr "لم تعد العناصر الموجودة في عربة التسوق الخاصة بك محجوزة لك."
+msgstr ""
+"لم تعد المنتجات الموجودة في سلة التسوق محجوزة لك. لا يزال بإمكانك إتمام طلبك "
+"طالما كانت هذه المنتجات متوفرة."
 
 #: pretix/static/pretixpresale/js/ui/cart.js
 msgid "Cart expired"
@@ -766,13 +742,9 @@ msgstr "انتهت صلاحية عربة التسوق"
 
 #: pretix/static/pretixpresale/js/ui/cart.js
 msgid "Your cart is about to expire."
-msgstr ""
+msgstr "سوف تنتهي صلاحية سلة التسوق الخاصة بك قريبًا."
 
 #: pretix/static/pretixpresale/js/ui/cart.js
-#, fuzzy
-#| msgid "The items in your cart are reserved for you for one minute."
-#| msgid_plural ""
-#| "The items in your cart are reserved for you for {num} minutes."
 msgid "The items in your cart are reserved for you for one minute."
 msgid_plural "The items in your cart are reserved for you for {num} minutes."
 msgstr[0] "سيتم حجز العناصر لك في سلة التسوق لمدة {num}."
@@ -783,26 +755,24 @@ msgstr[4] "سيتم حجز العناصر لك في سلة التسوق لدقا
 msgstr[5] "سيتم حجز العناصر لك في سلة التسوق لمدة {num}."
 
 #: pretix/static/pretixpresale/js/ui/cart.js
-#, fuzzy
-#| msgid "Cart expired"
 msgid "Your cart has expired."
 msgstr "انتهت صلاحية عربة التسوق"
 
 #: pretix/static/pretixpresale/js/ui/cart.js
-#, fuzzy
-#| msgid "The items in your cart are no longer reserved for you."
 msgid ""
 "The items in your cart are no longer reserved for you. You can still "
 "complete your order as long as they're available."
-msgstr "لم تعد العناصر الموجودة في عربة التسوق الخاصة بك محجوزة لك."
+msgstr ""
+"لم تعد المنتجات الموجودة في سلة التسوق محجوزة لك. لا يزال بإمكانك إتمام طلبك "
+"طالما كانت هذه المنتجات متوفرة."
 
 #: pretix/static/pretixpresale/js/ui/cart.js
 msgid "Do you want to renew the reservation period?"
-msgstr ""
+msgstr "هل ترغب في تمديد فترة الحجز؟"
 
 #: pretix/static/pretixpresale/js/ui/cart.js
 msgid "Renew reservation"
-msgstr ""
+msgstr "تجديد الحجز"
 
 #: pretix/static/pretixpresale/js/ui/main.js
 msgid "The organizer keeps %(currency)s %(amount)s"
@@ -822,82 +792,77 @@ msgstr "التوقيت المحلي:"
 
 #: pretix/static/pretixpresale/js/walletdetection.js
 msgid "Google Pay"
-msgstr ""
+msgstr "Google Pay"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgctxt "widget"
 msgid "Quantity"
-msgstr ""
+msgstr "الكمية"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgctxt "widget"
 msgid "Decrease quantity"
-msgstr ""
+msgstr "تقليل الكمية"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgctxt "widget"
 msgid "Increase quantity"
-msgstr ""
+msgstr "زيادة الكمية"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgctxt "widget"
 msgid "Filter events by"
-msgstr ""
+msgstr "تصفية الأحداث حسب"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgctxt "widget"
 msgid "Filter"
-msgstr ""
+msgstr "فلتر"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgctxt "widget"
 msgid "Price"
-msgstr ""
+msgstr "السعر"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 #, javascript-format
 msgctxt "widget"
 msgid "Original price: %s"
-msgstr ""
+msgstr "السعر الأصلي: %s"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 #, javascript-format
 msgctxt "widget"
 msgid "New price: %s"
-msgstr ""
+msgstr "السعر الجديد: %s"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
-#, fuzzy
-#| msgid "Selected only"
 msgctxt "widget"
 msgid "Select"
 msgstr "المختارة فقط"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
-#, fuzzy, javascript-format
-#| msgid "Selected only"
+#, javascript-format
 msgctxt "widget"
 msgid "Select %s"
-msgstr "المختارة فقط"
+msgstr "تم اختيار %s فقط"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
-#, fuzzy, javascript-format
-#| msgctxt "widget"
-#| msgid "See variations"
+#, javascript-format
 msgctxt "widget"
 msgid "Select variant %s"
-msgstr "أنظر إلى الاختلافات"
+msgstr "اختر النوع %s"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
@@ -940,7 +905,7 @@ msgstr "من %(currency) s %(price)s"
 #, javascript-format
 msgctxt "widget"
 msgid "Image of %s"
-msgstr ""
+msgstr "صورة لـ %s"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
@@ -981,27 +946,21 @@ msgstr "متوفرة مع القسيمة فقط"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
-#, fuzzy
-#| msgctxt "widget"
-#| msgid "currently available: %s"
 msgctxt "widget"
 msgid "Not yet available"
-msgstr "متوفر حاليا: %s"
+msgstr "حاليًا غير متوفر: %s"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgctxt "widget"
 msgid "Not available anymore"
-msgstr ""
+msgstr "لم يعد متوفراً"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
-#, fuzzy
-#| msgctxt "widget"
-#| msgid "currently available: %s"
 msgctxt "widget"
 msgid "Currently not available"
-msgstr "متوفر حاليا: %s"
+msgstr "غير متوفر حاليًا: %s"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
@@ -1029,24 +988,20 @@ msgid ""
 "There are currently a lot of users in this ticket shop. Please open the shop "
 "in a new tab to continue."
 msgstr ""
+"يوجد حالياً عدد كبير من المستخدمين في متجر التذاكر هذا. يرجى فتح المتجر في "
+"علامة تبويب جديدة للمتابعة."
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
-#, fuzzy
-#| msgctxt "widget"
-#| msgid "Close ticket shop"
 msgctxt "widget"
 msgid "Open ticket shop"
-msgstr "إغلاق متجر التذاكر"
+msgstr "إغلاق/فتح متجر التذاكر"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
-#, fuzzy
-#| msgctxt "widget"
-#| msgid "Resume checkout"
 msgctxt "widget"
 msgid "Checkout"
-msgstr "استئناف الدفع"
+msgstr "استئناف عملية الدفع"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
@@ -1061,6 +1016,9 @@ msgid ""
 "We could not create your cart, since there are currently too many users in "
 "this ticket shop. Please click \"Continue\" to retry in a new tab."
 msgstr ""
+"لم نتمكن من إنشاء سلة التسوق الخاصة بك، نظرًا لوجود عدد كبير جدًّا من "
+"المستخدمين حاليًّا في متجر التذاكر هذا. يرجى النقر على «متابعة» لإعادة المحاولة "
+"في علامة تبويب جديدة."
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
@@ -1110,18 +1068,15 @@ msgstr "إغلاق"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
-#, fuzzy
-#| msgctxt "widget"
-#| msgid "Resume checkout"
 msgctxt "widget"
 msgid "Close checkout"
-msgstr "استئناف الدفع"
+msgstr "إغلاق عملية الدفع"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgctxt "widget"
 msgid "You cannot cancel this operation. Please wait for loading to finish."
-msgstr ""
+msgstr "لا يمكنك إلغاء هذه العملية. يرجى الانتظار حتى ينتهي التحميل."
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
@@ -1131,21 +1086,15 @@ msgstr "استمرار"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
-#, fuzzy
-#| msgctxt "widget"
-#| msgid "See variations"
 msgctxt "widget"
 msgid "Show variants"
-msgstr "أنظر إلى الاختلافات"
+msgstr "انظر الاختلافات"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
-#, fuzzy
-#| msgctxt "widget"
-#| msgid "See variations"
 msgctxt "widget"
 msgid "Hide variants"
-msgstr "أنظر إلى الاختلافات"
+msgstr "إخفاء الاختلافات"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
@@ -1203,11 +1152,11 @@ msgid ""
 "add yourself to the waiting list. We will then notify if seats are available "
 "again."
 msgstr ""
+"تم بيع جميع فئات التذاكر أو بعضها حاليًا. إذا أردت، يمكنك إضافة اسمك إلى "
+"قائمة الانتظار. وسنقوم بإخطارك إذا توفرت مقاعد مرة أخرى."
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
-#, fuzzy
-#| msgid "Load more"
 msgctxt "widget"
 msgid "Load more"
 msgstr "تحميل المزيد"
@@ -1250,37 +1199,37 @@ msgstr "الأحد"
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "Monday"
-msgstr ""
+msgstr "الاثنين"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "Tuesday"
-msgstr ""
+msgstr "الثلاثاء"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "Wednesday"
-msgstr ""
+msgstr "الأربعاء"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "Thursday"
-msgstr ""
+msgstr "الخميس"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "Friday"
-msgstr ""
+msgstr "الجمعة"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "Saturday"
-msgstr ""
+msgstr "السبت"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "Sunday"
-msgstr ""
+msgstr "الأحد"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
@@ -1305,7 +1254,7 @@ msgstr "أبريل"
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "May"
-msgstr "مايو"
+msgstr "هناك"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts

src/pretix/locale/de/LC_MESSAGES/django.po

@@ -5,8 +5,8 @@ msgstr ""
 "Project-Id-Version: 1\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-07-07 09:30+0000\n"
-"PO-Revision-Date: 2026-07-07 09:55+0000\n"
-"Last-Translator: Raphael Michel <michel@rami.io>\n"
+"PO-Revision-Date: 2026-07-15 14:20+0000\n"
+"Last-Translator: Jochen Siebert <siebert@rami.io>\n"
 "Language-Team: German <https://translate.pretix.eu/projects/pretix/pretix/"
 "de/>\n"
 "Language: de\n"
@@ -14,7 +14,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 2026.6.1\n"
+"X-Generator: Weblate 2026.7.1\n"
 "X-Poedit-Bookmarks: -1,-1,904,-1,-1,-1,-1,-1,-1,-1\n"
 
 #: htmlcov/d_daa1541d0cbf5e2b_dashboards_py.html
@@ -8166,7 +8166,7 @@ msgstr "Zugang zu existierenden Veranstaltungen"
 msgctxt "permission_level"
 msgid "Access existing and create new events"
 msgstr ""
-"Zugang zu existieren Veranstaltungen und neue Veranstaltungen erstellen"
+"Zugang zu existierenden Veranstaltungen und neue Veranstaltungen erstellen"
 
 #: pretix/base/permissions.py
 msgid ""

src/pretix/locale/de_Informal/LC_MESSAGES/djangojs.po

@@ -8,8 +8,8 @@ msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-07-06 15:52+0000\n"
-"PO-Revision-Date: 2026-05-04 07:42+0000\n"
-"Last-Translator: Martin Gross <gross@rami.io>\n"
+"PO-Revision-Date: 2026-07-13 11:28+0000\n"
+"Last-Translator: Raphael Michel <michel@rami.io>\n"
 "Language-Team: German (informal) <https://translate.pretix.eu/projects/"
 "pretix/pretix-js/de_Informal/>\n"
 "Language: de_Informal\n"
@@ -17,7 +17,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 5.17\n"
+"X-Generator: Weblate 2026.7.1\n"
 
 #: pretix/plugins/banktransfer/static/pretixplugins/banktransfer/ui.js
 msgid "Marked as paid"
@@ -430,11 +430,11 @@ msgstr "Drücke Strg+C zum kopieren!"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/App.vue
 msgid "Edit"
-msgstr ""
+msgstr "Bearbeiten"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/App.vue
 msgid "Visualize"
-msgstr ""
+msgstr "Visualisieren"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/App.vue
 msgid ""
@@ -442,10 +442,13 @@ msgid ""
 "or variations are not contained in any of your rule parts so people with "
 "these tickets will not get in:"
 msgstr ""
+"Deine Regeln filtern immer nach Produkt oder Variation, jedoch sind die "
+"folgenden Produkte oder Variationen nicht in einer Ihrer Regeln enthalten, "
+"sodass Kunden mit diesen Tickets keinen Eintritt erhalten werden:"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/App.vue
 msgid "Please double-check if this was intentional."
-msgstr ""
+msgstr "Bitte überprüfe, ob dies beabsichtigt war."
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "All of the conditions below (AND)"

src/pretix/locale/es/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-07-07 09:30+0000\n"
-"PO-Revision-Date: 2026-07-07 09:22+0000\n"
+"PO-Revision-Date: 2026-07-08 16:00+0000\n"
 "Last-Translator: CVZ-es <damien.bremont@casadevelazquez.org>\n"
 "Language-Team: Spanish <https://translate.pretix.eu/projects/pretix/pretix/"
 "es/>\n"
@@ -11453,10 +11453,8 @@ msgstr ""
 "contacto con usted."
 
 #: pretix/base/settings.py pretix/control/forms/event.py
-#, fuzzy
-#| msgid "Contact"
 msgid "Contact URL"
-msgstr "Contacto"
+msgstr "URL de contacto"
 
 #: pretix/base/settings.py pretix/control/forms/event.py
 msgid ""
@@ -11464,6 +11462,10 @@ msgid ""
 "the email address above. Please note that you still need to add a contact "
 "email address that will be shared with all emails you send."
 msgstr ""
+"Si activas esta opción, el enlace de contacto del pie de página redirigirá "
+"aquí, en lugar de utilizar la dirección de correo electrónico indicada más "
+"arriba. Ten en cuenta que aún así tendrás que añadir una dirección de correo "
+"electrónico de contacto que se incluirá en todos los correos que envíes."
 
 #: pretix/base/settings.py pretix/control/forms/event.py
 msgid "Imprint URL"
@@ -19946,25 +19948,7 @@ msgstr ""
 "El equipo de %(instance)s\n"
 
 #: pretix/control/templates/pretixcontrol/email/email_setup.txt
-#, fuzzy, python-format
-#| msgid ""
-#| "Hello,\n"
-#| "\n"
-#| "Someone requested to use %(address)s as a sender address on %(instance)s. "
-#| "Once verified, emails sent from %(instance)s can show this address as the "
-#| "sender.\n"
-#| "\n"
-#| "If this was you, enter the following code in the setup form:\n"
-#| "\n"
-#| "    %(code)s\n"
-#| "\n"
-#| "Don't share this code with anyone. The %(instance)s team will never ask "
-#| "you for it.\n"
-#| "\n"
-#| "If you didn't request this, you can safely ignore this email.\n"
-#| "\n"
-#| "Thanks,  \n"
-#| "The %(instance)s Team\n"
+#, python-format
 msgid ""
 "Hello,\n"
 "\n"
@@ -19987,19 +19971,19 @@ msgid ""
 msgstr ""
 "Hola,\n"
 "\n"
-"Alguien ha solicitado utilizar %(address)s como dirección de remitente en "
-"%(instance)s. Una vez verificado, los correos electrónicos enviados desde "
-"%(instance)s podrán mostrar esta dirección como remitente.\n"
+"Alguien ha solicitado utilizar %(address)s como dirección de remitente en %"
+"(instance)s. Una vez verificado, los correos electrónicos enviados desde %"
+"(instance)s podrán mostrar esta dirección como remitente.\n"
 "\n"
-"Si has sido tú, introduce el siguiente código en el formulario de "
-"configuración:\n"
+"Si ha sido usted quien lo ha solicitado, introduzca el siguiente código en "
+"el formulario de configuración:\n"
 "\n"
 "    %(code)s\n"
 "\n"
-"No compartas este código con nadie. El equipo de %(instance)s nunca te lo "
-"pedirá.\n"
+"No comparta este código con nadie a menos que quiera autorizarle a utilizar "
+"esta dirección para este fin. El equipo de %(instance)s nunca se lo pedirá.\n"
 "\n"
-"Si no has solicitado esto, puedes ignorar este correo electrónico sin ningún "
+"Si no ha solicitado esto, puede ignorar este correo electrónico sin ningún "
 "problema.\n"
 "\n"
 "Gracias,  \n"

src/pretix/locale/fr/LC_MESSAGES/django.po

@@ -4,10 +4,10 @@ msgstr ""
 "Project-Id-Version: 1\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-07-07 09:30+0000\n"
-"PO-Revision-Date: 2026-07-07 09:22+0000\n"
+"PO-Revision-Date: 2026-07-08 16:00+0000\n"
 "Last-Translator: CVZ-es <damien.bremont@casadevelazquez.org>\n"
-"Language-Team: French <https://translate.pretix.eu/projects/pretix/pretix/fr/"
-">\n"
+"Language-Team: French <https://translate.pretix.eu/projects/pretix/pretix/"
+"fr/>\n"
 "Language: fr\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
@@ -1933,7 +1933,7 @@ msgid ""
 "redeemed."
 msgstr ""
 "Ce produit ne sera affiché que si un bon de réduction correspondant au "
-"produit est échangé."
+"produit est validé."
 
 #: pretix/base/exporters/items.py pretix/base/models/items.py
 msgid "Buying this product requires approval"
@@ -4109,8 +4109,8 @@ msgstr ""
 msgid ""
 "To verify your email address {email} on {instance}, use the following code:"
 msgstr ""
-"Pour valider votre adresse e-mail {email} sur\n"
-"{instance}, utilisez le code suivant :"
+"Pour valider votre adresse e-mail {email} sur {instance}, utilisez le code "
+"suivant :"
 
 #: pretix/base/models/auth.py
 msgid "Your confirmation code"
@@ -6975,7 +6975,7 @@ msgstr "Nombre de fois que ce bon peut être utilisé."
 
 #: pretix/base/models/vouchers.py pretix/control/views/vouchers.py
 msgid "Redeemed"
-msgstr "Échangé"
+msgstr "Validé"
 
 #: pretix/base/models/vouchers.py
 msgid ""
@@ -11542,10 +11542,8 @@ msgstr ""
 "contacter."
 
 #: pretix/base/settings.py pretix/control/forms/event.py
-#, fuzzy
-#| msgid "Contact"
 msgid "Contact URL"
-msgstr "Contact"
+msgstr "URL de contact"
 
 #: pretix/base/settings.py pretix/control/forms/event.py
 msgid ""
@@ -11553,6 +11551,10 @@ msgid ""
 "the email address above. Please note that you still need to add a contact "
 "email address that will be shared with all emails you send."
 msgstr ""
+"Si vous activez cette option, le lien de contact figurant dans le pied de "
+"page redirigera vers cette page au lieu d'utiliser l'adresse e-mail indiquée "
+"ci-dessus. Veuillez noter que vous devrez tout de même ajouter une adresse e-"
+"mail de contact qui sera mentionnée dans tous les e-mails que vous enverrez."
 
 #: pretix/base/settings.py pretix/control/forms/event.py
 msgid "Imprint URL"
@@ -20094,25 +20096,7 @@ msgstr ""
 "L'équipe %(instance)s\n"
 
 #: pretix/control/templates/pretixcontrol/email/email_setup.txt
-#, fuzzy, python-format
-#| msgid ""
-#| "Hello,\n"
-#| "\n"
-#| "Someone requested to use %(address)s as a sender address on %(instance)s. "
-#| "Once verified, emails sent from %(instance)s can show this address as the "
-#| "sender.\n"
-#| "\n"
-#| "If this was you, enter the following code in the setup form:\n"
-#| "\n"
-#| "    %(code)s\n"
-#| "\n"
-#| "Don't share this code with anyone. The %(instance)s team will never ask "
-#| "you for it.\n"
-#| "\n"
-#| "If you didn't request this, you can safely ignore this email.\n"
-#| "\n"
-#| "Thanks,  \n"
-#| "The %(instance)s Team\n"
+#, python-format
 msgid ""
 "Hello,\n"
 "\n"
@@ -20136,22 +20120,23 @@ msgstr ""
 "Bonjour,\n"
 "\n"
 "Une personne a demandé à utiliser %(address)s comme adresse d'expéditeur sur "
-"%(instance)s. Une fois cette demande validée, les e-mails envoyés depuis "
-"%(instance)s pourront afficher cette adresse comme expéditeur.\n"
+"%(instance)s. Une fois cette demande validée, les e-mails envoyés depuis %"
+"(instance)s pourront afficher cette adresse comme expéditeur.\n"
 "\n"
-"Si c'est vous qui avez fait cette demande, veuillez saisir le code suivant "
-"dans le formulaire de configuration :\n"
+"Si c'est bien vous qui en avez fait la demande, veuillez saisir le code "
+"suivant dans le formulaire de configuration :\n"
 "\n"
 "    %(code)s\n"
 "\n"
-"Ne communiquez ce code à personne. L'équipe de %(instance)s ne vous le "
-"demandera jamais.\n"
+"Ne communiquez ce code à personne, sauf si vous souhaitez autoriser cette "
+"personne à utiliser cette adresse à cette fin. L'équipe de %(instance)s ne "
+"vous le demandera jamais.\n"
 "\n"
-"Si vous n’en avez pas fait la demande, vous pouvez ignorer cet e-mail en "
+"Si vous n'en avez pas fait la demande, vous pouvez ignorer cet e-mail en "
 "toute sécurité.\n"
 "\n"
 "Merci,  \n"
-"L’équipe %(instance)s\n"
+"L'équipe de %(instance)s\n"
 
 #: pretix/control/templates/pretixcontrol/email/forgot.txt
 #, python-format
@@ -36830,17 +36815,19 @@ msgstr ""
 
 #: pretix/presale/templates/pretixpresale/organizers/customer_login_interrupted_message.html
 msgid "How to fix this:"
-msgstr ""
+msgstr "Comment résoudre ce problème :"
 
 #: pretix/presale/templates/pretixpresale/organizers/customer_login_interrupted_message.html
 msgid "Close this page."
-msgstr ""
+msgstr "Fermer cette page."
 
 #: pretix/presale/templates/pretixpresale/organizers/customer_login_interrupted_message.html
 msgid ""
 "Open this website again directly in your main browser (for example Safari or "
 "Chrome)."
 msgstr ""
+"Rouvrez ce site directement dans votre navigateur principal (par exemple "
+"Safari ou Chrome)."
 
 #: pretix/presale/templates/pretixpresale/organizers/customer_login_interrupted_message.html
 msgid ""
@@ -36848,6 +36835,9 @@ msgid ""
 "browser window, without refreshing the page, opening new tabs, or switching "
 "apps part-way through."
 msgstr ""
+"Recommencez la procédure de paiement ou de connexion et menez-la à son terme "
+"dans la même fenêtre de navigateur, sans actualiser la page, ouvrir de "
+"nouveaux onglets ni changer d'application en cours de route."
 
 #: pretix/presale/templates/pretixpresale/organizers/customer_login_interrupted_message.html
 msgid ""
@@ -36855,6 +36845,10 @@ msgid ""
 "before retrying can help. As a last step, try using a different browser or "
 "another device (for example, a desktop or laptop computer)."
 msgstr ""
+"Si le problème persiste, il peut être utile de fermer toutes les fenêtres du "
+"navigateur et d'effacer les cookies avant de réessayer. En dernier recours, "
+"essayez d'utiliser un autre navigateur ou un autre appareil (par exemple, un "
+"ordinateur de bureau ou un ordinateur portable)."
 
 #: pretix/presale/templates/pretixpresale/organizers/customer_membership.html
 msgid "Your membership"

src/pretix/locale/fr/LC_MESSAGES/djangojs.po

@@ -7,8 +7,8 @@ msgstr ""
 "Project-Id-Version: French\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-07-06 15:52+0000\n"
-"PO-Revision-Date: 2026-06-29 17:00+0000\n"
-"Last-Translator: CVZ-es <damien.bremont@casadevelazquez.org>\n"
+"PO-Revision-Date: 2026-07-08 16:00+0000\n"
+"Last-Translator: Joram Schwartzmann <schwartzmann@pretix.eu>\n"
 "Language-Team: French <https://translate.pretix.eu/projects/pretix/pretix-js/"
 "fr/>\n"
 "Language: fr\n"
@@ -244,7 +244,7 @@ msgstr "En attente d'approbation"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
 msgid "Redeemed"
-msgstr "Échangé"
+msgstr "Validé"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
 msgid "Cancel"

src/pretix/locale/ja/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-07-07 09:30+0000\n"
-"PO-Revision-Date: 2026-07-07 09:17+0000\n"
+"PO-Revision-Date: 2026-07-14 15:00+0000\n"
 "Last-Translator: Hijiri Umemoto <hijiri@umemoto.org>\n"
 "Language-Team: Japanese <https://translate.pretix.eu/projects/pretix/pretix/"
 "ja/>\n"
@@ -17,7 +17,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=1; plural=0;\n"
-"X-Generator: Weblate 2026.6.1\n"
+"X-Generator: Weblate 2026.7.1\n"
 
 #: htmlcov/d_daa1541d0cbf5e2b_dashboards_py.html
 #: pretix/control/templates/pretixcontrol/events/index.html
@@ -11076,10 +11076,8 @@ msgid "We'll show this publicly to allow attendees to contact you."
 msgstr "参加者があなたに連絡できるように、これを公に表示します。"
 
 #: pretix/base/settings.py pretix/control/forms/event.py
-#, fuzzy
-#| msgid "Contact"
 msgid "Contact URL"
-msgstr "連絡先"
+msgstr "連絡先URL"
 
 #: pretix/base/settings.py pretix/control/forms/event.py
 msgid ""
@@ -11087,6 +11085,9 @@ msgid ""
 "the email address above. Please note that you still need to add a contact "
 "email address that will be shared with all emails you send."
 msgstr ""
+"これを設定すると、フッターの連絡先リンクが上記のメールアドレスではなくこちら"
+"を指すことになります。追加が必要な連絡先メールアドレスは、送信するすべての電"
+"子メールで共有されるのでご注意ください。"
 
 #: pretix/base/settings.py pretix/control/forms/event.py
 msgid "Imprint URL"
@@ -19360,25 +19361,7 @@ msgstr ""
 "%(instance)sのチーム\n"
 
 #: pretix/control/templates/pretixcontrol/email/email_setup.txt
-#, fuzzy, python-format
-#| msgid ""
-#| "Hello,\n"
-#| "\n"
-#| "Someone requested to use %(address)s as a sender address on %(instance)s. "
-#| "Once verified, emails sent from %(instance)s can show this address as the "
-#| "sender.\n"
-#| "\n"
-#| "If this was you, enter the following code in the setup form:\n"
-#| "\n"
-#| "    %(code)s\n"
-#| "\n"
-#| "Don't share this code with anyone. The %(instance)s team will never ask "
-#| "you for it.\n"
-#| "\n"
-#| "If you didn't request this, you can safely ignore this email.\n"
-#| "\n"
-#| "Thanks,  \n"
-#| "The %(instance)s Team\n"
+#, python-format
 msgid ""
 "Hello,\n"
 "\n"
@@ -19401,16 +19384,17 @@ msgid ""
 msgstr ""
 "こんにちは、\n"
 "\n"
-"誰かが %(address)s を送信者アドレスとして %(instance)s に使用するようリクエス"
-"トしました。検証が完了すると、%(instance)s から送信されたメールはこのアドレス"
-"を送信者として表示できます。\n"
+"誰かが %(address)s を送信者アドレスとして %(instance)s に使用するよう"
+"リクエストしました。検証が完了すると、%(instance)s から送信されたメールはこの"
+"アドレスを送信者として表示できます。\n"
 "\n"
 "もしこれがあなたであれば、設定フォームに以下のコードを入力してください。\n"
 "\n"
 "…%(code)s\n"
 "\n"
-"このコードを誰にも共有しないでください。%(instance)sのチームは、決してあなた"
-"にそれを求めることはありません。\n"
+"このコードを誰にも共有しないでください。ただし、このアドレスをこの目的で使用"
+"することを許可したい場合は除きます。%(instance)sのチームは、決してあなたにそ"
+"れを求めることはありません。\n"
 "\n"
 "もしこのメールをご依頼いただいていない場合は、このメールはご無視いただいて構"
 "いません。\n"

src/pretix/multidomain/middlewares.py

@@ -34,8 +34,6 @@
 
 import logging
 import time
-from datetime import datetime
-from http.cookies import Morsel
 from urllib.parse import urlparse
 
 from django.conf import settings
@@ -53,12 +51,16 @@ from django.middleware.csrf import (
 from django.shortcuts import render
 from django.urls import set_urlconf
 from django.utils.cache import patch_vary_headers
+from django.utils.decorators import decorator_from_middleware
 from django.utils.deprecation import MiddlewareMixin
 from django.utils.http import http_date
 from django_scopes import scopes_disabled
 
 from pretix.base.models import Event, Organizer
-from pretix.helpers.cookies import set_cookie_without_samesite
+from pretix.helpers.cookies import (
+    get_all_values_of_cookie, set_cookie_without_samesite,
+    thoroughly_delete_cookie,
+)
 from pretix.multidomain.models import KnownDomain
 
 logger = logging.getLogger(__name__)
@@ -181,9 +183,23 @@ class SessionMiddleware(BaseSessionMiddleware):
             # The session should be deleted only if the session is entirely empty
             is_secure = request.scheme == 'https'
             if '__Host-' + settings.SESSION_COOKIE_NAME in request.COOKIES and empty:
-                response.delete_cookie('__Host-' + settings.SESSION_COOKIE_NAME)
+                # response.delete_cookie does not work as we might have set a partitioned cookie
+                thoroughly_delete_cookie(
+                    response,
+                    '__Host-' + settings.SESSION_COOKIE_NAME,
+                    path=settings.SESSION_COOKIE_PATH,
+                    secure=is_secure,
+                    httponly=settings.SESSION_COOKIE_HTTPONLY or None
+                )
             elif settings.SESSION_COOKIE_NAME in request.COOKIES and empty:
-                response.delete_cookie(settings.SESSION_COOKIE_NAME)
+                # response.delete_cookie does not work as we might have set a partitioned cookie
+                thoroughly_delete_cookie(
+                    response,
+                    settings.SESSION_COOKIE_NAME,
+                    path=settings.SESSION_COOKIE_PATH,
+                    secure=is_secure,
+                    httponly=settings.SESSION_COOKIE_HTTPONLY or None
+                )
             else:
                 if accessed:
                     patch_vary_headers(response, ('Cookie',))
@@ -200,15 +216,21 @@ class SessionMiddleware(BaseSessionMiddleware):
                     if response.status_code != 500:
                         request.session.save()
                         if is_secure and settings.SESSION_COOKIE_NAME in request.COOKIES:  # remove legacy cookie
-                            response.delete_cookie(settings.SESSION_COOKIE_NAME)
-                            response.delete_cookie(settings.SESSION_COOKIE_NAME, samesite="None")
+                            # response.delete_cookie does not work as we might have set a partitioned cookie
+                            thoroughly_delete_cookie(
+                                response,
+                                settings.SESSION_COOKIE_NAME,
+                                path=settings.SESSION_COOKIE_PATH,
+                                secure=is_secure,
+                                httponly=settings.SESSION_COOKIE_HTTPONLY or None
+                            )
                         set_cookie_without_samesite(
                             request, response,
                             '__Host-' + settings.SESSION_COOKIE_NAME if is_secure else settings.SESSION_COOKIE_NAME,
                             request.session.session_key, max_age=max_age,
                             expires=expires,
                             path=settings.SESSION_COOKIE_PATH,
-                            secure=request.scheme == 'https',
+                            secure=is_secure,
                             httponly=settings.SESSION_COOKIE_HTTPONLY or None
                         )
         return response
@@ -253,75 +275,74 @@ class CsrfViewMiddleware(BaseCsrfMiddleware):
             if request.session.get(CSRF_SESSION_KEY) != request.META["CSRF_COOKIE"]:
                 request.session[CSRF_SESSION_KEY] = request.META["CSRF_COOKIE"]
         else:
-            is_secure = request.scheme == 'https'
             # Set the CSRF cookie even if it's already set, so we renew
             # the expiry timer.
-            if is_secure and settings.CSRF_COOKIE_NAME in request.COOKIES:  # remove legacy cookie
-                response.delete_cookie(settings.CSRF_COOKIE_NAME)
-                response.delete_cookie(settings.CSRF_COOKIE_NAME, samesite="None")
+
+            # remove legacy cookie
+            if request.is_secure() and settings.CSRF_COOKIE_NAME in request.COOKIES:
+                thoroughly_delete_cookie(
+                    response,
+                    settings.CSRF_COOKIE_NAME,
+                    path=settings.CSRF_COOKIE_PATH,
+                    secure=request.is_secure(),
+                    httponly=settings.CSRF_COOKIE_HTTPONLY
+                )
 
             handle_duplicated_csrftoken(request, response)
 
             set_cookie_without_samesite(
                 request, response,
-                '__Host-' + settings.CSRF_COOKIE_NAME if is_secure else settings.CSRF_COOKIE_NAME,
+                '__Host-' + settings.CSRF_COOKIE_NAME if request.is_secure() else settings.CSRF_COOKIE_NAME,
                 request.META["CSRF_COOKIE"],
                 max_age=settings.CSRF_COOKIE_AGE,
                 path=settings.CSRF_COOKIE_PATH,
-                secure=is_secure,
+                secure=request.is_secure(),
                 httponly=settings.CSRF_COOKIE_HTTPONLY
             )
             # Content varies with the CSRF cookie, so set the Vary header.
             patch_vary_headers(response, ('Cookie',))
 
+    def process_response(self, request, response):
+        if (
+            not settings.CSRF_USE_SESSIONS
+            and request.is_secure()
+            and settings.CSRF_COOKIE_NAME in response.cookies
+            and response.cookies[settings.CSRF_COOKIE_NAME].value
+        ):
+            logger.warning("Usage of djangos CsrfViewMiddleware detected (legacy cookie found in response). "
+                           "This may be caused by using csrf_project or requires_csrf_token from django.views.decorators.csrf. "
+                           "Use the pretix.multidomain.middlewares equivalent instead.")
+
+        return super().process_response(request, response)
+
 
 def handle_duplicated_csrftoken(request, response):
-    # Due to a Safari bug, in some browser, two csrftoken cookies with different values
-    # exist: one unpartitioned, one partitioned. This function generates an additional
+    # Due to a Safari bug, in some browser, two csrftoken cookies can exist:
+    # one unpartitioned, one partitioned. This function generates an additional
     # Set-Cookie header to get rid of the unpartitioned one.
 
     cookie_name = '__Host-' + settings.CSRF_COOKIE_NAME
 
-    if request.scheme == 'https' and cookie_name in request.COOKIES:
+    if request.is_secure() and cookie_name in request.COOKIES:
         values = get_all_values_of_cookie(request.headers.get('Cookie'), cookie_name)
         if len(values) > 1:
             logger.info('Trying to remove duplicated %s cookies: %r', cookie_name, values)
-
-            # Make sure the set_cookie_without_samesite below will add a new item in the dictionary, placing
-            # it below our deletion header.
-            response.cookies.pop(cookie_name, None)
-
-            # Add the deletion Set-Cookie header to the cookie dict under a wrong name, so it doesn't get
-            # overwritten by the set_cookie_without_samesite call below.  This works because the code in
-            # django.core.handlers.wsgi/asgi, that generates the actual Set-Cookie headers, only iterates
-            # over cookie.values(), ignoring the keys.
-            response.cookies['___DELETECOOKIE___' + cookie_name] = make_delete_morsel(cookie_name)
+            thoroughly_delete_cookie(
+                response,
+                cookie_name,
+                secure=request.is_secure(),
+                path=settings.CSRF_COOKIE_PATH,
+                httponly=settings.CSRF_COOKIE_HTTPONLY
+            )
 
 
-def get_all_values_of_cookie(cookie_header, cookie_name):
-    # like django.http.cookie.parse_cookie, but returns all values of duplicated cookies instead of only the last
-    values = list()
-    if not cookie_header:
-        return values
-    for chunk in cookie_header.split(";"):
-        if "=" in chunk:
-            key, val = chunk.split("=", 1)
-        else:
-            # Assume an empty name per
-            # https://bugzilla.mozilla.org/show_bug.cgi?id=169091
-            key, val = "", chunk
-        key, val = key.strip(), val.strip()
-        if key == cookie_name:
-            values.append(val)
-    return values
+csrf_protect = decorator_from_middleware(CsrfViewMiddleware)
 
 
-def make_delete_morsel(name):
-    m = Morsel()
-    m.set(name, '', '')
-    m['expires'] = datetime.utcfromtimestamp(0).strftime("%a, %d %b %Y %H:%M:%S GMT")
-    m['samesite'] = 'None'
-    m['secure'] = True
-    m['path'] = settings.CSRF_COOKIE_PATH
-    m['httponly'] = settings.CSRF_COOKIE_HTTPONLY
-    return m
+class _EnsureCsrfToken(CsrfViewMiddleware):
+    # Behave like CsrfViewMiddleware but don't reject requests or log warnings.
+    def _reject(self, request, reason):
+        return None
+
+
+requires_csrf_token = decorator_from_middleware(_EnsureCsrfToken)

src/pretix/plugins/badges/signals.py

@@ -26,6 +26,7 @@ from collections import defaultdict
 from django.dispatch import receiver
 from django.template.loader import get_template
 from django.urls import resolve, reverse
+from django.utils.safestring import mark_safe
 from django.utils.translation import gettext_lazy as _
 
 from pretix.base.logentrytypes import EventLogEntryType, log_entry_types
@@ -153,7 +154,7 @@ def control_order_position_info(sender: Event, position, request, order: Order,
         'event': sender,
         'position': position
     }
-    return template.render(ctx, request=request).strip()
+    return mark_safe(template.render(ctx, request=request).strip())
 
 
 @receiver(order_info, dispatch_uid="badges_control_order_info")

src/pretix/plugins/paypal/payment.py

@@ -44,6 +44,7 @@ from django.contrib import messages
 from django.http import HttpRequest
 from django.template.loader import get_template
 from django.urls import reverse
+from django.utils.html import format_html
 from django.utils.timezone import now
 from django.utils.translation import gettext as __, gettext_lazy as _
 from i18nfield.strings import LazyI18nString
@@ -112,9 +113,10 @@ class Paypal(BasePaymentProvider):
                      label=_('Client ID'),
                      max_length=80,
                      min_length=80,
-                     help_text=_('<a target="_blank" rel="noopener" href="{docs_url}">{text}</a>').format(
+                     help_text=format_html(
+                         '<a target="_blank" rel="noopener" href="{docs_url}">{text}</a>',
                          text=_('Click here for a tutorial on how to obtain the required keys'),
-                         docs_url='https://docs.pretix.eu/en/latest/user/payments/paypal.html'
+                         docs_url='https://docs.pretix.eu/en/latest/user/payments/paypal.html',
                      )
                  )),
                 ('secret',

src/pretix/plugins/paypal2/payment.py

@@ -36,6 +36,7 @@ from django.template.loader import get_template
 from django.templatetags.static import static
 from django.urls import resolve, reverse
 from django.utils.crypto import get_random_string
+from django.utils.html import format_html
 from django.utils.safestring import mark_safe
 from django.utils.timezone import now
 from django.utils.translation import gettext as __, gettext_lazy as _
@@ -110,7 +111,8 @@ class PaypalSettingsHolder(BasePaymentProvider):
                      label=_('Client ID'),
                      max_length=80,
                      min_length=80,
-                     help_text=_('<a target="_blank" rel="noopener" href="{docs_url}">{text}</a>').format(
+                     help_text=format_html(
+                         '<a target="_blank" rel="noopener" href="{docs_url}">{text}</a>',
                          text=_('Click here for a tutorial on how to obtain the required keys'),
                          docs_url='https://docs.pretix.eu/en/latest/user/payments/paypal.html'
                      )

src/pretix/plugins/paypal2/views.py

@@ -162,7 +162,6 @@ class XHRView(View):
 
         paypal_order = prov._create_paypal_order(request, None, cart_total)
         r = JsonResponse(paypal_order.dict() if paypal_order else {})
-        r._csp_ignore = True
         return r
 
 

src/pretix/plugins/reports/accountingreport.py

@@ -28,7 +28,7 @@ from decimal import Decimal
 from django import forms
 from django.db.models import F, Sum
 from django.db.models.functions import Coalesce
-from django.utils.formats import date_format, localize
+from django.utils.formats import date_format
 from django.utils.html import escape
 from django.utils.timezone import now
 from django.utils.translation import gettext as _, gettext_lazy, pgettext_lazy
@@ -43,7 +43,7 @@ from pretix.base.exporter import BaseExporter
 from pretix.base.models import (
     GiftCardTransaction, OrderFee, OrderPayment, OrderRefund, Transaction,
 )
-from pretix.base.templatetags.money import money_filter
+from pretix.base.templatetags.money import money_filter, tax_rate_format
 from pretix.base.timeframes import (
     DateFrameField,
     resolve_timeframe_to_datetime_start_inclusive_end_exclusive,
@@ -382,7 +382,7 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
                         else "",
                         tstyle_right,
                     ),
-                    PlainTextParagraph(localize(r["tax_rate"].normalize()) + " %", tstyle_right),
+                    PlainTextParagraph(tax_rate_format(r["tax_rate"]) + " %", tstyle_right),
                     PlainTextParagraph(str(r["sum_cont"]), tstyle_right),
                     PlainTextParagraph(
                         money_filter(r["sum_price"] - r["sum_tax"], currency), tstyle_right
@@ -408,7 +408,7 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
                     [
                         PlainTextParagraph(_("Sum"), tstyle),
                         PlainTextParagraph("", tstyle_right),
-                        PlainTextParagraph(localize(tax_rate.normalize()) + " %", tstyle_right),
+                        PlainTextParagraph(tax_rate_format(tax_rate) + " %", tstyle_right),
                         PlainTextParagraph("", tstyle_right),
                         PlainTextParagraph(
                             money_filter(

src/pretix/plugins/returnurl/views.py

@@ -22,6 +22,7 @@
 import re
 
 from django import forms
+from django.core.exceptions import ValidationError
 from django.urls import reverse
 from django.utils.translation import gettext_lazy as _
 
@@ -33,15 +34,22 @@ from pretix.control.views.event import (
 
 
 class ReturnSettingsForm(SettingsForm):
-    returnurl_prefix = forms.RegexField(
+    returnurl_prefix = forms.CharField(
         label=_("Base redirection URLs"),
         help_text=_("Redirection will only be allowed to URLs that start with one of these prefixes. "
-                    "Enter one or more allowed URL prefix per line. "
+                    "Enter one allowed URL prefix per line. "
                     "URL prefixes must include a slash after the hostname."),
         required=False,
         widget=forms.Textarea,
-        regex=re.compile(r'^((https://.*/.*|http://localhost[:/].*)\n*)*$')
     )
+    line_regex = re.compile(r'^(https://.*/.*|http://localhost(:[0-9]+)?/.*)$')
+
+    def clean_returnurl_prefix(self):
+        val = self.cleaned_data['returnurl_prefix']
+        for l in val.split("\n"):
+            if not re.match(self.line_regex, l):
+                raise ValidationError(_('All values must be URLs that include at last one slash after the hostname.'))
+        return val
 
 
 class ReturnSettings(EventSettingsViewMixin, EventSettingsFormView):

src/pretix/plugins/stripe/static/pretixplugins/stripe/pretix-stripe.js

@@ -323,7 +323,7 @@ $(function () {
             }
         }
     } else if ($("#stripe_payment_intent_next_action_redirect_url").length) {
-        let payment_intent_next_action_redirect_url = $.trim($("#stripe_payment_intent_next_action_redirect_url").html());
+        let payment_intent_next_action_redirect_url = JSON.parse($("#stripe_payment_intent_next_action_redirect_url").html());
         pretixstripe.handlePaymentRedirectAction(payment_intent_next_action_redirect_url);
     } else if ($.trim($("#stripe_payment_intent_action_type").html()) === "promptpay_display_qr_code") {
         waitingDialog.hide();
@@ -432,4 +432,4 @@ $(function () {
             }
         }
     );
-});
+});

src/pretix/plugins/stripe/templates/pretixplugins/stripe/sca.html

@@ -9,7 +9,7 @@
     <script type="text/plain" id="stripe_payment_intent_action_type">{{ payment_intent_action_type }}</script>
     <script type="text/plain" id="stripe_payment_intent_client_secret">{{ payment_intent_client_secret }}</script>
     {% if payment_intent_next_action_redirect_url %}
-        <script type="text/plain" id="stripe_payment_intent_next_action_redirect_url">{{ payment_intent_next_action_redirect_url|safe }}</script>
+        {{ payment_intent_next_action_redirect_url|json_script:"stripe_payment_intent_next_action_redirect_url" }}
     {% endif %}
     {% if payment_intent_redirect_action_handling %}
         <script type="text/plain" id="stripe_payment_intent_redirect_action_handling">{{ payment_intent_redirect_action_handling }}</script>

src/pretix/plugins/ticketoutputpdf/signals.py

@@ -189,7 +189,7 @@ def control_order_position_info(sender: Event, position, request, order, **kwarg
         'position': position,
         'layouts': layouts,
     }
-    return template.render(ctx, request=request).strip()
+    return template.render(ctx, request=request)
 
 
 override_layout = EventPluginSignal()

src/pretix/presale/checkoutflow.py

@@ -87,6 +87,7 @@ from pretix.presale.forms.checkout import (
     ContactForm, InvoiceAddressForm, InvoiceNameForm, MembershipForm,
 )
 from pretix.presale.forms.customer import AuthenticationForm, RegistrationForm
+from pretix.presale.productlist import prepare_item_list_for_shop
 from pretix.presale.signals import (
     checkout_all_optional, checkout_confirm_messages, checkout_flow_steps,
     contact_form_fields, contact_form_fields_overrides,
@@ -99,7 +100,6 @@ from pretix.presale.views.cart import (
     _items_from_post_data, cart_session, create_empty_cart_id,
     get_or_create_cart_id,
 )
-from pretix.presale.views.event import get_grouped_items
 from pretix.presale.views.questions import QuestionsViewMixin
 
 
@@ -603,7 +603,7 @@ class AddOnsStep(CartMixin, AsyncAction, TemplateFlowStep):
 
                 if ckey not in item_cache:
                     # Get all items to possibly show
-                    items, _btn = get_grouped_items(
+                    items, _btn = prepare_item_list_for_shop(
                         self.request.event,
                         subevent=cartpos.subevent,
                         voucher=None,

src/pretix/presale/forms/customer.py

@@ -20,8 +20,6 @@
 # <https://www.gnu.org/licenses/>.
 #
 import functools
-import hashlib
-import ipaddress
 import random
 
 from django import forms
@@ -32,7 +30,6 @@ from django.contrib.auth.password_validation import (
 )
 from django.contrib.auth.tokens import PasswordResetTokenGenerator
 from django.core import signing
-from django.utils.functional import cached_property
 from django.utils.html import escape
 from django.utils.translation import gettext_lazy as _
 from phonenumber_field.formfields import PhoneNumberField
@@ -44,6 +41,7 @@ from pretix.base.forms.questions import (
 from pretix.base.i18n import get_language_without_region
 from pretix.base.models import Customer
 from pretix.helpers.http import get_client_ip
+from pretix.helpers.ratelimit import rate_limit
 from pretix.multidomain.urlreverse import eventreverse_absolute
 
 
@@ -205,23 +203,6 @@ class RegistrationForm(forms.Form):
                 min_value=0,
             )
 
-    @cached_property
-    def ratelimit_key(self):
-        if not settings.HAS_REDIS:
-            return None
-        client_ip = get_client_ip(self.request)
-        if not client_ip:
-            return None
-        try:
-            client_ip = ipaddress.ip_address(client_ip)
-        except ValueError:
-            # Web server not set up correctly
-            return None
-        if client_ip.is_private:
-            # This is the private IP of the server, web server not set up correctly
-            return None
-        return 'pretix_customer_registration_{}'.format(hashlib.sha1(str(client_ip).encode()).hexdigest())
-
     def clean(self):
         email = self.cleaned_data.get('email')
 
@@ -255,17 +236,11 @@ class RegistrationForm(forms.Form):
                 code='incomplete'
             )
         else:
-            if self.ratelimit_key:
-                from django_redis import get_redis_connection
-
-                rc = get_redis_connection("redis")
-                cnt = rc.incr(self.ratelimit_key)
-                rc.expire(self.ratelimit_key, 600)
-                if cnt > 10:
-                    raise forms.ValidationError(
-                        self.error_messages['rate_limit'],
-                        code='rate_limit',
-                    )
+            if rate_limit("customer_signup", include_ip_from_request=self.request, max_num=10, expire_time=600):
+                raise forms.ValidationError(
+                    self.error_messages['rate_limit'],
+                    code='rate_limit',
+                )
         return self.cleaned_data
 
     def create(self):
@@ -359,6 +334,11 @@ class ResetPasswordForm(forms.Form):
     def clean_email(self):
         if 'email' not in self.cleaned_data:
             return
+        if rate_limit("customer_pwreset_check", max_num=10, expire_time=600):
+            raise forms.ValidationError(
+                self.error_messages['rate_limit'],
+                code='rate_limit',
+            )
         try:
             self.customer = self.request.organizer.customers.get(email=self.cleaned_data['email'].lower(), provider__isnull=True)
             return self.customer.email
@@ -370,13 +350,8 @@ class ResetPasswordForm(forms.Form):
 
     def clean(self):
         d = super().clean()
-        if d.get('email') and settings.HAS_REDIS:
-            from django_redis import get_redis_connection
-
-            rc = get_redis_connection("redis")
-            cnt = rc.incr('pretix_pwreset_customer_%s' % self.customer.pk)
-            rc.expire('pretix_pwreset_customer_%s' % self.customer.pk, 600)
-            if cnt > 2:
+        if d.get('email'):
+            if rate_limit("customer_pwreset", self.customer.pk, max_num=2, expire_time=600):
                 raise forms.ValidationError(
                     self.error_messages['rate_limit'],
                     code='rate_limit',
@@ -445,13 +420,8 @@ class ChangePasswordForm(forms.Form):
     def clean_password_current(self):
         old_pw = self.cleaned_data.get('password_current')
 
-        if old_pw and settings.HAS_REDIS:
-            from django_redis import get_redis_connection
-
-            rc = get_redis_connection("redis")
-            cnt = rc.incr('pretix_pwchange_customer_%s' % self.customer.pk)
-            rc.expire('pretix_pwchange_customer_%s' % self.customer.pk, 300)
-            if cnt > 10:
+        if old_pw:
+            if rate_limit("customer_pwchange", self.customer.pk, max_num=10, expire_time=300):
                 raise forms.ValidationError(
                     self.error_messages['rate_limit'],
                     code='rate_limit',
@@ -521,17 +491,11 @@ class ChangeInfoForm(forms.ModelForm):
         old_pw = self.cleaned_data.get('password_current')
 
         if old_pw:
-            if settings.HAS_REDIS:
-                from django_redis import get_redis_connection
-
-                rc = get_redis_connection("redis")
-                cnt = rc.incr('pretix_pwchange_customer_%s' % self.instance.pk)
-                rc.expire('pretix_pwchange_customer_%s' % self.instance.pk, 300)
-                if cnt > 10:
-                    raise forms.ValidationError(
-                        self.error_messages['rate_limit'],
-                        code='rate_limit',
-                    )
+            if rate_limit("customer_pwchange", self.instance.pk, max_num=10, expire_time=300):
+                raise forms.ValidationError(
+                    self.error_messages['rate_limit'],
+                    code='rate_limit',
+                )
 
             if not check_password(old_pw, self.instance.password):
                 raise forms.ValidationError(

src/pretix/presale/productlist.py

@@ -0,0 +1,460 @@
+#
+# This file is part of pretix (Community Edition).
+#
+# Copyright (C) 2014-2020  Raphael Michel and contributors
+# Copyright (C) 2020-today pretix GmbH and contributors
+#
+# This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
+# Public License as published by the Free Software Foundation in version 3 of the License.
+#
+# ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are
+# applicable granting you additional permissions and placing additional restrictions on your usage of this software.
+# Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive
+# this file, see <https://pretix.eu/about/en/license>.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
+# details.
+#
+# You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
+# <https://www.gnu.org/licenses/>.
+#
+import sys
+from datetime import datetime
+from typing import Optional
+
+from django.conf import settings
+from django.db.models import (
+    Count, Exists, IntegerField, OuterRef, Prefetch, Q, Value,
+)
+from django.db.models.lookups import Exact
+
+from pretix.base.models import (
+    ItemVariation, Quota, SalesChannel, SeatCategoryMapping,
+)
+from pretix.base.models.items import (
+    Item, ItemAddOn, ItemBundle, SubEventItem, SubEventItemVariation,
+)
+from pretix.base.services.quotas import QuotaAvailability
+from pretix.base.timemachine import time_machine_now
+from pretix.presale.signals import item_description
+
+
+def item_group_by_category(items):
+    return sorted(
+        [
+            # a group is a tuple of a category and a list of items
+            (cat, [i for i in items if i.category == cat])
+            for cat in set([i.category for i in items])
+            # insert categories into a set for uniqueness
+            # a set is unsorted, so sort again by category
+        ],
+        key=lambda group: (group[0].position, group[0].id) if (
+            group[0] is not None and group[0].id is not None) else (0, 0)
+    )
+
+
+def prepare_item_list_for_shop(event, *, channel: SalesChannel, subevent=None, voucher=None, require_seat=0, base_qs=None,
+                               allow_addons=False, allow_cross_sell=False,
+                               quota_cache=None, filter_items=None, filter_categories=None, memberships=None,
+                               ignore_hide_sold_out_for_item_ids=None):
+    base_qs_set = base_qs is not None
+    base_qs = base_qs if base_qs is not None else event.items
+
+    requires_seat = Exists(
+        SeatCategoryMapping.objects.filter(
+            product_id=OuterRef('pk'),
+            subevent=subevent
+        )
+    )
+    if not event.settings.seating_choice:
+        requires_seat = Value(0, output_field=IntegerField())
+
+    variation_q = (
+        Q(Q(available_from__isnull=True) | Q(available_from__lte=time_machine_now()) | Q(available_from_mode='info')) &
+        Q(Q(available_until__isnull=True) | Q(available_until__gte=time_machine_now()) | Q(available_until_mode='info'))
+    )
+    if not voucher or not voucher.show_hidden_items:
+        variation_q &= Q(hide_without_voucher=False)
+
+    if memberships is not None:
+        prefetch_membership_types = ['require_membership_types']
+    else:
+        prefetch_membership_types = []
+
+    prefetch_var = Prefetch(
+        'variations',
+        to_attr='available_variations',
+        queryset=ItemVariation.objects.using(settings.DATABASE_REPLICA).annotate(
+            subevent_disabled=Exists(
+                SubEventItemVariation.objects.filter(
+                    Q(disabled=True)
+                    | (Exact(OuterRef('available_from_mode'), 'hide') & Q(available_from__gt=time_machine_now()))
+                    | (Exact(OuterRef('available_until_mode'), 'hide') & Q(available_until__lt=time_machine_now())),
+                    variation_id=OuterRef('pk'),
+                    subevent=subevent,
+                )
+            ),
+        ).filter(
+            variation_q,
+            Q(all_sales_channels=True) | Q(limit_sales_channels=channel),
+            Exists(Quota.variations.through.objects.filter(quota__subevent_id=subevent, itemvariation_id=OuterRef("pk"))),
+            active=True,
+            subevent_disabled=False
+        ).prefetch_related(
+            *prefetch_membership_types,
+            Prefetch('quotas',
+                     to_attr='_subevent_quotas',
+                     queryset=event.quotas.using(settings.DATABASE_REPLICA).filter(
+                         subevent=subevent).select_related("subevent"))
+        ).distinct()
+    )
+    prefetch_quotas = Prefetch(
+        'quotas',
+        to_attr='_subevent_quotas',
+        queryset=event.quotas.using(settings.DATABASE_REPLICA).filter(subevent=subevent).select_related("subevent")
+    )
+    prefetch_bundles = Prefetch(
+        'bundles',
+        queryset=ItemBundle.objects.using(settings.DATABASE_REPLICA).prefetch_related(
+            Prefetch('bundled_item',
+                     queryset=event.items.using(settings.DATABASE_REPLICA).select_related(
+                         'tax_rule').prefetch_related(
+                         Prefetch('quotas',
+                                  to_attr='_subevent_quotas',
+                                  queryset=event.quotas.using(settings.DATABASE_REPLICA).filter(
+                                      subevent=subevent)),
+                     )),
+            Prefetch('bundled_variation',
+                     queryset=ItemVariation.objects.using(
+                         settings.DATABASE_REPLICA
+                     ).select_related('item', 'item__tax_rule').filter(item__event=event).prefetch_related(
+                         Prefetch('quotas',
+                                  to_attr='_subevent_quotas',
+                                  queryset=event.quotas.using(settings.DATABASE_REPLICA).filter(
+                                      subevent=subevent)),
+                     )),
+        )
+    )
+
+    items = base_qs.using(settings.DATABASE_REPLICA).filter_available(
+        channel=channel.identifier, voucher=voucher, allow_addons=allow_addons, allow_cross_sell=allow_cross_sell
+    ).select_related(
+        'category', 'tax_rule',  # for re-grouping
+        'hidden_if_available',
+    ).prefetch_related(
+        *prefetch_membership_types,
+        Prefetch(
+            'hidden_if_item_available',
+            queryset=event.items.annotate(
+                has_variations=Count('variations'),
+            ).prefetch_related(
+                prefetch_var,
+                prefetch_quotas,
+                prefetch_bundles,
+            )
+        ),
+        prefetch_quotas,
+        prefetch_var,
+        prefetch_bundles,
+    ).annotate(
+        has_variations=Count('variations'),
+        subevent_disabled=Exists(
+            SubEventItem.objects.filter(
+                Q(disabled=True)
+                | (Exact(OuterRef('available_from_mode'), 'hide') & Q(available_from__gt=time_machine_now()))
+                | (Exact(OuterRef('available_until_mode'), 'hide') & Q(available_until__lt=time_machine_now())),
+                item_id=OuterRef('pk'),
+                subevent=subevent,
+            )
+        ),
+        mandatory_priced_addons=Exists(
+            ItemAddOn.objects.filter(
+                base_item_id=OuterRef('pk'),
+                min_count__gte=1,
+                price_included=False
+            )
+        ),
+        requires_seat=requires_seat,
+    ).filter(
+        Exists(Quota.items.through.objects.filter(quota__subevent_id=subevent, item_id=OuterRef("pk"))),
+        subevent_disabled=False,
+    ).order_by('category__position', 'category_id', 'position', 'name')
+    if require_seat:
+        items = items.filter(requires_seat__gt=0)
+    elif require_seat is not None:
+        items = items.filter(requires_seat=0)
+
+    if filter_items:
+        items = items.filter(pk__in=[a for a in filter_items if a.isdigit()])
+    if filter_categories:
+        items = items.filter(category_id__in=[a for a in filter_categories if a.isdigit()])
+
+    display_add_to_cart = False
+    quota_cache_key = f'item_quota_cache:{subevent.id if subevent else 0}:{channel.identifier}:{bool(require_seat)}'
+    quota_cache = quota_cache or event.cache.get(quota_cache_key) or {}
+    quota_cache_existed = bool(quota_cache)
+
+    if subevent:
+        item_price_override = subevent.item_price_overrides
+        var_price_override = subevent.var_price_overrides
+    else:
+        item_price_override = {}
+        var_price_override = {}
+
+    restrict_vars = set()
+    if voucher and voucher.quota_id:
+        # If a voucher is set to a specific quota, we need to filter out on that level
+        restrict_vars = set(voucher.quota.variations.all())
+
+    quotas_to_compute = []
+    for item in items:
+        assert item.event_id == event.pk
+        item.event = event  # save a database query if this is looked up
+        if item.has_variations:
+            for v in item.available_variations:
+                for q in v._subevent_quotas:
+                    if q.pk not in quota_cache:
+                        quotas_to_compute.append(q)
+        else:
+            for q in item._subevent_quotas:
+                if q.pk not in quota_cache:
+                    quotas_to_compute.append(q)
+
+    if quotas_to_compute:
+        qa = QuotaAvailability()
+        qa.queue(*quotas_to_compute)
+        qa.compute()
+        quota_cache.update({q.pk: r for q, r in qa.results.items()})
+
+    for item in items:
+        if voucher and voucher.item_id and voucher.variation_id:
+            # Restrict variations if the voucher only allows one
+            item.available_variations = [v for v in item.available_variations
+                                         if v.pk == voucher.variation_id]
+
+        if channel.type_instance.unlimited_items_per_order:
+            max_per_order = sys.maxsize
+        else:
+            max_per_order = item.max_per_order or int(event.settings.max_items_per_order)
+        if voucher:
+            max_per_order = min(max_per_order, voucher.max_usages - voucher.redeemed)
+
+        if item.hidden_if_available:
+            q = item.hidden_if_available.availability(_cache=quota_cache)
+            if q[0] == Quota.AVAILABILITY_OK:
+                item._remove = True
+                continue
+
+        if item.hidden_if_item_available:
+            if item.hidden_if_item_available.has_variations:
+                item._dependency_available = any(
+                    var.check_quotas(subevent=subevent, _cache=quota_cache, include_bundled=True)[0] == Quota.AVAILABILITY_OK
+                    for var in item.hidden_if_item_available.available_variations
+                )
+            else:
+                q = item.hidden_if_item_available.check_quotas(subevent=subevent, _cache=quota_cache, include_bundled=True)
+                time_available = item.hidden_if_item_available.is_available()
+                item._dependency_available = (q[0] == Quota.AVAILABILITY_OK) and time_available
+            if item._dependency_available and item.hidden_if_item_available_mode == Item.UNAVAIL_MODE_HIDDEN:
+                item._remove = True
+                continue
+
+        if item.require_membership and item.require_membership_hidden:
+            if not memberships or not any([m.membership_type in item.require_membership_types.all() for m in memberships]):
+                item._remove = True
+                continue
+
+        item.current_unavailability_reason = _get_item_unavailability_reason(item, has_voucher=voucher, subevent=subevent)
+
+        item.description = str(item.description)
+        for recv, resp in item_description.send(sender=event, item=item, variation=None, subevent=subevent):
+            if resp:
+                item.description += ("<br/>" if item.description else "") + resp
+
+        if not item.has_variations:
+            item._remove = False
+            if not bool(item._subevent_quotas):
+                item._remove = True
+                continue
+
+            if voucher and (voucher.allow_ignore_quota or voucher.block_quota):
+                item.cached_availability = (
+                    Quota.AVAILABILITY_OK, voucher.max_usages - voucher.redeemed
+                )
+            else:
+                item.cached_availability = list(
+                    item.check_quotas(subevent=subevent, _cache=quota_cache, include_bundled=True)
+                )
+
+            if not (
+                    ignore_hide_sold_out_for_item_ids and item.pk in ignore_hide_sold_out_for_item_ids
+            ) and event.settings.hide_sold_out and item.cached_availability[0] < Quota.AVAILABILITY_RESERVED:
+                item._remove = True
+                continue
+
+            item.order_max = min(
+                item.cached_availability[1]
+                if item.cached_availability[1] is not None else sys.maxsize,
+                max_per_order
+            )
+
+            original_price = item_price_override.get(item.pk, item.default_price)
+            voucher_reduced = False
+            if voucher:
+                price = voucher.calculate_price(original_price)
+                voucher_reduced = price < original_price
+                include_bundled = not voucher.all_bundles_included
+            else:
+                price = original_price
+                include_bundled = True
+
+            item.display_price = item.tax(price, currency=event.currency, include_bundled=include_bundled)
+            if item.free_price and item.free_price_suggestion is not None and not voucher_reduced:
+                item.suggested_price = item.tax(max(price, item.free_price_suggestion), currency=event.currency, include_bundled=include_bundled)
+            else:
+                item.suggested_price = item.display_price
+
+            if price != original_price:
+                item.original_price = item.tax(original_price, currency=event.currency, include_bundled=True)
+            else:
+                item.original_price = (
+                    item.tax(item.original_price, currency=event.currency, include_bundled=True,
+                             base_price_is='net' if event.settings.display_net_prices else 'gross')  # backwards-compat
+                    if item.original_price else None
+                )
+            if not display_add_to_cart:
+                display_add_to_cart = not item.requires_seat and item.order_max > 0
+        else:
+            for var in item.available_variations:
+                if var.require_membership and var.require_membership_hidden:
+                    if not memberships or not any([m.membership_type in var.require_membership_types.all() for m in memberships]):
+                        var._remove = True
+                        continue
+
+                var.description = str(var.description)
+                for recv, resp in item_description.send(sender=event, item=item, variation=var, subevent=subevent):
+                    if resp:
+                        var.description += ("<br/>" if var.description else "") + resp
+
+                if voucher and (voucher.allow_ignore_quota or voucher.block_quota):
+                    var.cached_availability = (
+                        Quota.AVAILABILITY_OK, voucher.max_usages - voucher.redeemed
+                    )
+                else:
+                    var.cached_availability = list(
+                        var.check_quotas(subevent=subevent, _cache=quota_cache, include_bundled=True)
+                    )
+
+                var.order_max = min(
+                    var.cached_availability[1]
+                    if var.cached_availability[1] is not None else sys.maxsize,
+                    max_per_order
+                )
+
+                original_price = var_price_override.get(var.pk, var.price)
+                voucher_reduced = False
+                if voucher:
+                    price = voucher.calculate_price(original_price)
+                    voucher_reduced = price < original_price
+                    include_bundled = not voucher.all_bundles_included
+                else:
+                    price = original_price
+                    include_bundled = True
+
+                var.display_price = var.tax(price, currency=event.currency, include_bundled=include_bundled)
+
+                if item.free_price and var.free_price_suggestion is not None and not voucher_reduced:
+                    var.suggested_price = item.tax(max(price, var.free_price_suggestion), currency=event.currency,
+                                                   include_bundled=include_bundled)
+                elif item.free_price and item.free_price_suggestion is not None and not voucher_reduced:
+                    var.suggested_price = item.tax(max(price, item.free_price_suggestion), currency=event.currency,
+                                                   include_bundled=include_bundled)
+                else:
+                    var.suggested_price = var.display_price
+
+                if price != original_price:
+                    var.original_price = var.tax(original_price, currency=event.currency, include_bundled=True)
+                else:
+                    var.original_price = (
+                        var.tax(var.original_price or item.original_price, currency=event.currency,
+                                include_bundled=True,
+                                base_price_is='net' if event.settings.display_net_prices else 'gross')  # backwards-compat
+                    ) if var.original_price or item.original_price else None
+
+                var.current_unavailability_reason = _get_variant_unavailability_reason(var, has_voucher=voucher, subevent=subevent)
+
+            item.original_price = (
+                item.tax(item.original_price, currency=event.currency, include_bundled=True,
+                         base_price_is='net' if event.settings.display_net_prices else 'gross')  # backwards-compat
+                if item.original_price else None
+            )
+
+            item.available_variations = [
+                v for v in item.available_variations if v._subevent_quotas and (
+                    not voucher or not voucher.quota_id or v in restrict_vars
+                ) and not getattr(v, '_remove', False)
+            ]
+
+            if not (ignore_hide_sold_out_for_item_ids and item.pk in ignore_hide_sold_out_for_item_ids) and event.settings.hide_sold_out:
+                item.available_variations = [v for v in item.available_variations
+                                             if v.cached_availability[0] >= Quota.AVAILABILITY_RESERVED]
+
+            if voucher and voucher.variation_id:
+                item.available_variations = [v for v in item.available_variations
+                                             if v.pk == voucher.variation_id]
+
+            if len(item.available_variations) > 0:
+                item.min_price = min([v.display_price.net if event.settings.display_net_prices else
+                                      v.display_price.gross for v in item.available_variations])
+                item.max_price = max([v.display_price.net if event.settings.display_net_prices else
+                                      v.display_price.gross for v in item.available_variations])
+                item.best_variation_availability = max([v.cached_availability[0] for v in item.available_variations])
+
+            item._remove = not bool(item.available_variations)
+            if not item._remove and not display_add_to_cart:
+                display_add_to_cart = not item.requires_seat and any(v.order_max > 0 for v in item.available_variations)
+
+    if not quota_cache_existed and not voucher and not allow_addons and not base_qs_set and not filter_items and not filter_categories:
+        event.cache.set(quota_cache_key, quota_cache, 5)
+    items = [item for item in items
+             if (len(item.available_variations) > 0 or not item.has_variations) and not item._remove]
+    return items, display_add_to_cart
+
+
+def _get_item_unavailability_reason(item, now_dt: Optional[datetime]=None, has_voucher=False, subevent=None) -> Optional[str]:
+    now_dt = now_dt or time_machine_now()
+    subevent_item = subevent and subevent.item_overrides.get(item.pk)
+    if not item.active:
+        return 'active'
+    elif item.available_from and item.available_from > now_dt:
+        return 'available_from'
+    elif item.available_until and item.available_until < now_dt:
+        return 'available_until'
+    elif (item.require_voucher or item.hide_without_voucher) and not has_voucher:
+        return 'require_voucher'
+    elif subevent_item and subevent_item.available_from and subevent_item.available_from > now_dt:
+        return 'available_from'
+    elif subevent_item and subevent_item.available_until and subevent_item.available_until < now_dt:
+        return 'available_until'
+    elif item.hidden_if_item_available and item._dependency_available:
+        return 'hidden_if_item_available'
+    else:
+        return None
+
+
+def _get_variant_unavailability_reason(variant, now_dt: Optional[datetime]=None, has_voucher=False, subevent=None) -> Optional[str]:
+    now_dt = now_dt or time_machine_now()
+    subevent_var = subevent and subevent.var_overrides.get(variant.pk)
+    if not variant.active:
+        return 'active'
+    elif variant.available_from and variant.available_from > now_dt:
+        return 'available_from'
+    elif variant.available_until and variant.available_until < now_dt:
+        return 'available_until'
+    elif subevent_var and subevent_var.available_from and subevent_var.available_from > now_dt:
+        return 'available_from'
+    elif subevent_var and subevent_var.available_until and subevent_var.available_until < now_dt:
+        return 'available_until'
+    else:
+        return None

src/pretix/presale/templates/pretixpresale/event/fragment_addon_choice.html

@@ -173,11 +173,11 @@
                                                 <small>{% trans "incl. taxes" %}</small>
                                             {% endif %}
                                         {% elif var.display_price.rate and var.display_price.gross and event.settings.display_net_prices %}
-                                            <small>{% blocktrans trimmed with rate=var.display_price.rate|floatformat:-2 name=var.display_price.name %}
+                                            <small>{% blocktrans trimmed with rate=var.display_price.rate|tax_rate_format name=var.display_price.name %}
                                                 <strong>plus</strong> {{ rate }}% {{ name }}
                                             {% endblocktrans %}</small>
                                         {% elif var.display_price.rate and var.display_price.gross %}
-                                            <small>{% blocktrans trimmed with rate=var.display_price.rate|floatformat:-2 name=var.display_price.name %}
+                                            <small>{% blocktrans trimmed with rate=var.display_price.rate|tax_rate_format name=var.display_price.name %}
                                                 incl. {{ rate }}% {{ name }}
                                             {% endblocktrans %}</small>
                                         {% endif %}
@@ -313,11 +313,11 @@
                                         <small>{% trans "incl. taxes" %}</small>
                                     {% endif %}
                                 {% elif item.display_price.rate and item.display_price.gross and event.settings.display_net_prices %}
-                                    <small>{% blocktrans trimmed with rate=item.display_price.rate|floatformat:-2 name=item.display_price.name %}
+                                    <small>{% blocktrans trimmed with rate=item.display_price.rate|tax_rate_format name=item.display_price.name %}
                                         <strong>plus</strong> {{ rate }}% {{ name }}
                                     {% endblocktrans %}</small>
                                 {% elif item.display_price.rate and item.display_price.gross %}
-                                    <small>{% blocktrans trimmed with rate=item.display_price.rate|floatformat:-2 name=item.display_price.name %}
+                                    <small>{% blocktrans trimmed with rate=item.display_price.rate|tax_rate_format name=item.display_price.name %}
                                         incl. {{ rate }}% {{ name }}
                                     {% endblocktrans %}</small>
                                 {% endif %}

src/pretix/presale/templates/pretixpresale/event/fragment_cart.html

@@ -357,7 +357,7 @@
                         {% if line.tax_rate and line.total %}
                             <br />
                             <small>
-                                {% blocktrans trimmed with rate=line.tax_rate|floatformat:-2 taxname=line.tax_rule.name|default:s_taxes %}
+                                {% blocktrans trimmed with rate=line.tax_rate|tax_rate_format taxname=line.tax_rule.name|default:s_taxes %}
                                     <strong>plus</strong> {{ rate }}% {{ taxname }}
                                 {% endblocktrans %}
                             </small>
@@ -367,7 +367,7 @@
                         {% if line.tax_rate and line.total %}
                             <br />
                             <small>
-                                {% blocktrans trimmed with rate=line.tax_rate|floatformat:-2 taxname=line.tax_rule.name|default:s_taxes %}
+                                {% blocktrans trimmed with rate=line.tax_rate|tax_rate_format taxname=line.tax_rule.name|default:s_taxes %}
                                     incl. {{ rate }}% {{ taxname }}
                                 {% endblocktrans %}
                             </small>
@@ -416,7 +416,7 @@
                         {% if fee.tax_rate %}
                             <br />
                             <small>
-                                {% blocktrans trimmed with rate=fee.tax_rate|floatformat:-2 taxname=fee.tax_rule.name|default:s_taxes %}
+                                {% blocktrans trimmed with rate=fee.tax_rate|tax_rate_format taxname=fee.tax_rule.name|default:s_taxes %}
                                     <strong>plus</strong> {{ rate }}% {{ taxname }}
                                 {% endblocktrans %}
                             </small>
@@ -426,7 +426,7 @@
                         {% if fee.tax_rate %}
                             <br />
                             <small>
-                                {% blocktrans trimmed with rate=fee.tax_rate|floatformat:-2 taxname=fee.tax_rule.name|default:s_taxes %}
+                                {% blocktrans trimmed with rate=fee.tax_rate|tax_rate_format taxname=fee.tax_rule.name|default:s_taxes %}
                                     incl. {{ rate }}% {{ taxname }}
                                 {% endblocktrans %}
                             </small>

src/pretix/presale/templates/pretixpresale/event/fragment_product_list.html

@@ -207,13 +207,13 @@
                                         {% endif %}
                                     {% elif var.display_price.rate and var.display_price.gross and event.settings.display_net_prices %}
                                         <small data-toggle="tooltip" title="{% blocktrans trimmed with value=var.display_price.gross|money:event.currency %}{{ value }} incl. taxes{% endblocktrans %}" data-placement="bottom">
-                                            {% blocktrans trimmed with rate=var.display_price.rate|floatformat:-2 name=var.display_price.name %}
+                                            {% blocktrans trimmed with rate=var.display_price.rate|tax_rate_format name=var.display_price.name %}
                                                 <strong>plus</strong> {{ rate }}% {{ name }}
                                             {% endblocktrans %}
                                         </small>
                                     {% elif var.display_price.rate and var.display_price.gross %}
                                         <small data-toggle="tooltip" title="{% blocktrans trimmed with value=var.display_price.net|money:event.currency %}{{ value }} without taxes{% endblocktrans %}" data-placement="bottom">
-                                            {% blocktrans trimmed with rate=var.display_price.rate|floatformat:-2 name=var.display_price.name %}
+                                            {% blocktrans trimmed with rate=var.display_price.rate|tax_rate_format name=var.display_price.name %}
                                                 incl. {{ rate }}% {{ name }}
                                             {% endblocktrans %}
                                         </small>
@@ -372,13 +372,13 @@
                             {% endif %}
                         {% elif item.display_price.rate and item.display_price.gross and event.settings.display_net_prices %}
                             <small data-toggle="tooltip" title="{% blocktrans trimmed with value=item.display_price.gross|money:event.currency %}{{ value }} incl. taxes{% endblocktrans %}" data-placement="bottom">
-                                {% blocktrans trimmed with rate=item.display_price.rate|floatformat:-2 name=item.display_price.name %}
+                                {% blocktrans trimmed with rate=item.display_price.rate|tax_rate_format name=item.display_price.name %}
                                     <strong>plus</strong> {{ rate }}% {{ name }}
                                 {% endblocktrans %}
                             </small>
                         {% elif item.display_price.rate and item.display_price.gross %}
                             <small data-toggle="tooltip" title="{% blocktrans trimmed with value=item.display_price.net|money:event.currency %}{{ value }} without taxes{% endblocktrans %}" data-placement="bottom">
-                                {% blocktrans trimmed with rate=item.display_price.rate|floatformat:-2 name=item.display_price.name %}
+                                {% blocktrans trimmed with rate=item.display_price.rate|tax_rate_format name=item.display_price.name %}
                                     incl. {{ rate }}% {{ name }}
                                 {% endblocktrans %}
                             </small>

src/pretix/presale/templates/pretixpresale/event/fragment_subevent_list.html

@@ -1,6 +1,7 @@
 {% load i18n %}
 {% load icon %}
 {% load eventurl %}
+{% load date_fast %}
 
 <div class="event-list full-width-list alternating-rows">
 {% for subev in subevent_list.subevent_list %}
@@ -17,8 +18,14 @@
                 <span data-time="{{ subev.date_from.isoformat }}" data-timezone="{{ event.timezone }}" data-time-short>
                     {% icon "clock-o" %}
                     <span class="sr-only">{% trans "Time of day" %}</span>
-                    <time datetime="{{ subev.date_from.isoformat }}">{{ subev.date_from|date:"TIME_FORMAT" }}</time>
+                    <time datetime="{{ subev.date_from|date_fast:"H:i" }}">{{ subev.date_from|date_fast:"TIME_FORMAT" }}</time>
                 </span>
+                {% if event.settings.show_date_to and subev.date_to and subev.is_same_day %}
+                    <span data-time="{{ subev.date_to.isoformat }}" data-timezone="{{ event.timezone }}" data-time-short>
+                        <span aria-hidden="true">–</span><span class="sr-only">{% trans "until" context "timerange" %}</span>
+                        <time datetime="{{ subev.date_to|date_fast:"H:i" }}">{{ subev.date_to|date_fast:"TIME_FORMAT" }}</time>
+                    </span>
+                {% endif %}
             {% endif %}
         </p>
         <p class="col-md-3 col-xs-6">

src/pretix/presale/templates/pretixpresale/event/voucher.html

@@ -201,13 +201,13 @@
                                                 {% endif %}
                                                 {% elif var.display_price.rate and var.display_price.gross and event.settings.display_net_prices %}
                                                     <small data-toggle="tooltip" title="{% blocktrans trimmed with value=var.display_price.gross|money:event.currency %}{{ value }} incl. taxes{% endblocktrans %}" data-placement="bottom">
-                                                        {% blocktrans trimmed with rate=var.display_price.rate|floatformat:-2 name=var.display_price.name %}
+                                                        {% blocktrans trimmed with rate=var.display_price.rate|tax_rate_format name=var.display_price.name %}
                                                             <strong>plus</strong> {{ rate }}% {{ name }}
                                                         {% endblocktrans %}
                                                     </small>
                                                 {% elif var.display_price.rate and var.display_price.gross %}
                                                     <small data-toggle="tooltip" title="{% blocktrans trimmed with value=var.display_price.net|money:event.currency %}{{ value }} without taxes{% endblocktrans %}" data-placement="bottom">
-                                                        {% blocktrans trimmed with rate=var.display_price.rate|floatformat:-2 name=var.display_price.name %}
+                                                        {% blocktrans trimmed with rate=var.display_price.rate|tax_rate_format name=var.display_price.name %}
                                                             incl. {{ rate }}% {{ name }}
                                                         {% endblocktrans %}
                                                     </small>
@@ -356,13 +356,13 @@
                                         {% endif %}
                                     {% elif item.display_price.rate and item.display_price.gross and event.settings.display_net_prices %}
                                         <small data-toggle="tooltip" title="{% blocktrans trimmed with value=item.display_price.gross|money:event.currency %}{{ value }} incl. taxes{% endblocktrans %}" data-placement="bottom">
-                                            {% blocktrans trimmed with rate=item.display_price.rate|floatformat:-2 name=item.display_price.name %}
+                                            {% blocktrans trimmed with rate=item.display_price.rate|tax_rate_format name=item.display_price.name %}
                                                 <strong>plus</strong> {{ rate }}% {{ name }}
                                             {% endblocktrans %}
                                         </small>
                                     {% elif item.display_price.rate and item.display_price.gross %}
                                         <small data-toggle="tooltip" title="{% blocktrans trimmed with value=item.display_price.net|money:event.currency %}{{ value }} without taxes{% endblocktrans %}" data-placement="bottom">
-                                            {% blocktrans trimmed with rate=item.display_price.rate|floatformat:-2 name=item.display_price.name %}
+                                            {% blocktrans trimmed with rate=item.display_price.rate|tax_rate_format name=item.display_price.name %}
                                                 incl. {{ rate }}% {{ name }}
                                             {% endblocktrans %}
                                         </small>

src/pretix/presale/templates/pretixpresale/organizers/index.html

@@ -67,7 +67,7 @@
                                             {% icon "clock-o" %}
                                             <span class="sr-only">{% trans "Time of day" %}</span>
                                             <time datetime="{{ e.date_from|date_fast:"H:i" }}">{{ e.date_from|date:"TIME_FORMAT" }}</time>
-                                            {% if e.settings.show_date_to and e.date_to and e.date_to.date == e.date_from.date %}
+                                            {% if e.settings.show_date_to and e.date_to and e.is_same_day %}
                                                 <span aria-hidden="true">–</span><span class="sr-only">{% trans "until" context "timerange" %}</span>
                                                 <time datetime="{{ e.date_to|date_fast:"H:i" }}">{{ e.date_to|date:"TIME_FORMAT" }}</time>
                                             {% endif %}

src/pretix/presale/views/cart.py

@@ -68,13 +68,13 @@ from pretix.base.timemachine import time_machine_now
 from pretix.base.views.tasks import AsyncAction
 from pretix.helpers.http import redirect_to_url
 from pretix.multidomain.urlreverse import eventreverse
+from pretix.presale.productlist import (
+    item_group_by_category, prepare_item_list_for_shop,
+)
 from pretix.presale.views import (
     CartMixin, EventViewMixin, allow_cors_if_namespaced,
     allow_frame_if_namespaced, get_cart, iframe_entry_view_wrapper,
 )
-from pretix.presale.views.event import (
-    get_grouped_items, item_group_by_category,
-)
 from pretix.presale.views.robots import NoSearchIndexViewMixin
 
 try:
@@ -669,7 +669,7 @@ class RedeemView(NoSearchIndexViewMixin, EventViewMixin, CartMixin, TemplateView
         context['max_times'] = self.voucher.max_usages - self.voucher.redeemed
 
         # Fetch all items
-        items, display_add_to_cart = get_grouped_items(
+        items, display_add_to_cart = prepare_item_list_for_shop(
             self.request.event,
             subevent=self.subevent,
             voucher=self.voucher,

src/pretix/presale/views/customer.py

@@ -44,7 +44,6 @@ from django.utils.http import url_has_allowed_host_and_scheme
 from django.utils.safestring import mark_safe
 from django.utils.translation import gettext_lazy as _
 from django.views.decorators.cache import never_cache
-from django.views.decorators.csrf import csrf_protect
 from django.views.decorators.debug import sensitive_post_parameters
 from django.views.generic import FormView, ListView, View
 
@@ -101,7 +100,6 @@ class LoginView(RedirectBackMixin, FormView):
     redirect_authenticated_user = True
 
     @method_decorator(sensitive_post_parameters())
-    @method_decorator(csrf_protect)
     @method_decorator(never_cache)
     def dispatch(self, request, *args, **kwargs):
         if not request.organizer.settings.customer_accounts:
@@ -213,7 +211,6 @@ class RegistrationView(RedirectBackMixin, FormView):
     redirect_authenticated_user = True
 
     @method_decorator(sensitive_post_parameters())
-    @method_decorator(csrf_protect)
     @method_decorator(never_cache)
     def dispatch(self, request, *args, **kwargs):
         if not request.organizer.settings.customer_accounts:
@@ -257,7 +254,6 @@ class SetPasswordView(FormView):
     template_name = 'pretixpresale/organizers/customer_setpassword.html'
 
     @method_decorator(sensitive_post_parameters())
-    @method_decorator(csrf_protect)
     @method_decorator(never_cache)
     def dispatch(self, request, *args, **kwargs):
         if not request.organizer.settings.customer_accounts:
@@ -301,7 +297,6 @@ class ResetPasswordView(FormView):
     template_name = 'pretixpresale/organizers/customer_resetpw.html'
 
     @method_decorator(sensitive_post_parameters())
-    @method_decorator(csrf_protect)
     @method_decorator(never_cache)
     def dispatch(self, request, *args, **kwargs):
         if not request.organizer.settings.customer_accounts:
@@ -527,7 +522,6 @@ class ChangePasswordView(CustomerAccountBaseMixin, FormView):
     form_class = ChangePasswordForm
 
     @method_decorator(sensitive_post_parameters())
-    @method_decorator(csrf_protect)
     @method_decorator(never_cache)
     def dispatch(self, request, *args, **kwargs):
         if not request.organizer.settings.customer_accounts:
@@ -561,7 +555,6 @@ class ChangeInformationView(CustomerAccountBaseMixin, FormView):
     form_class = ChangeInfoForm
 
     @method_decorator(sensitive_post_parameters())
-    @method_decorator(csrf_protect)
     @method_decorator(never_cache)
     def dispatch(self, request, *args, **kwargs):
         if not request.organizer.settings.customer_accounts:
@@ -669,7 +662,6 @@ class SSOLoginView(RedirectBackMixin, View):
     redirect_authenticated_user = True
 
     @method_decorator(sensitive_post_parameters())
-    @method_decorator(csrf_protect)
     @method_decorator(never_cache)
     def dispatch(self, request, *args, **kwargs):
         if not request.organizer.settings.customer_accounts:
@@ -732,7 +724,6 @@ class SSOLoginReturnView(RedirectBackMixin, View):
     redirect_authenticated_user = True
 
     @method_decorator(sensitive_post_parameters())
-    @method_decorator(csrf_protect)
     @method_decorator(never_cache)
     def dispatch(self, request, *args, **kwargs):
         if not request.organizer.settings.customer_accounts:

src/pretix/presale/views/event.py

@@ -34,7 +34,6 @@
 
 import calendar
 import hashlib
-import sys
 from collections import defaultdict
 from datetime import date, datetime, timedelta
 from decimal import Decimal
@@ -47,10 +46,7 @@ from django import forms
 from django.conf import settings
 from django.contrib import messages
 from django.core.exceptions import PermissionDenied
-from django.db.models import (
-    Count, Exists, IntegerField, OuterRef, Prefetch, Q, Value,
-)
-from django.db.models.lookups import Exact
+from django.db.models import Count
 from django.http import Http404, HttpResponse
 from django.shortcuts import get_object_or_404, redirect, render
 from django.utils.decorators import method_decorator
@@ -65,15 +61,9 @@ from django.views.generic import TemplateView
 
 from pretix.base.auth import has_event_access_permission
 from pretix.base.forms.widgets import SplitDateTimePickerWidget
-from pretix.base.models import (
-    ItemVariation, Quota, SalesChannel, SeatCategoryMapping, Voucher,
-)
+from pretix.base.models import Quota, Voucher
 from pretix.base.models.event import Event, SubEvent
-from pretix.base.models.items import (
-    Item, ItemAddOn, ItemBundle, SubEventItem, SubEventItemVariation,
-)
 from pretix.base.services.placeholders import PlaceholderContext
-from pretix.base.services.quotas import QuotaAvailability
 from pretix.base.timemachine import time_machine_now
 from pretix.helpers.compat import date_fromisocalendar
 from pretix.helpers.formats.en.formats import (
@@ -82,7 +72,10 @@ from pretix.helpers.formats.en.formats import (
 from pretix.helpers.http import redirect_to_url
 from pretix.multidomain.urlreverse import eventreverse
 from pretix.presale.ical import get_public_ical
-from pretix.presale.signals import item_description, seatingframe_html_head
+from pretix.presale.productlist import (
+    item_group_by_category, prepare_item_list_for_shop,
+)
+from pretix.presale.signals import seatingframe_html_head
 from pretix.presale.views.organizer import (
     EventListMixin, add_subevents_for_days, days_for_template,
     filter_qs_by_attr, filter_subevents_with_plugins, has_before_after,
@@ -94,391 +87,12 @@ from . import (
     iframe_entry_view_wrapper,
 )
 
+from pretix.presale.productlist import prepare_item_list_for_shop as get_grouped_items  # noqa
+
+
 SessionStore = import_module(settings.SESSION_ENGINE).SessionStore
 
 
-def item_group_by_category(items):
-    return sorted(
-        [
-            # a group is a tuple of a category and a list of items
-            (cat, [i for i in items if i.category == cat])
-            for cat in set([i.category for i in items])
-            # insert categories into a set for uniqueness
-            # a set is unsorted, so sort again by category
-        ],
-        key=lambda group: (group[0].position, group[0].id) if (
-            group[0] is not None and group[0].id is not None) else (0, 0)
-    )
-
-
-def get_grouped_items(event, *, channel: SalesChannel, subevent=None, voucher=None, require_seat=0, base_qs=None,
-                      allow_addons=False, allow_cross_sell=False,
-                      quota_cache=None, filter_items=None, filter_categories=None, memberships=None,
-                      ignore_hide_sold_out_for_item_ids=None):
-    base_qs_set = base_qs is not None
-    base_qs = base_qs if base_qs is not None else event.items
-
-    requires_seat = Exists(
-        SeatCategoryMapping.objects.filter(
-            product_id=OuterRef('pk'),
-            subevent=subevent
-        )
-    )
-    if not event.settings.seating_choice:
-        requires_seat = Value(0, output_field=IntegerField())
-
-    variation_q = (
-        Q(Q(available_from__isnull=True) | Q(available_from__lte=time_machine_now()) | Q(available_from_mode='info')) &
-        Q(Q(available_until__isnull=True) | Q(available_until__gte=time_machine_now()) | Q(available_until_mode='info'))
-    )
-    if not voucher or not voucher.show_hidden_items:
-        variation_q &= Q(hide_without_voucher=False)
-
-    if memberships is not None:
-        prefetch_membership_types = ['require_membership_types']
-    else:
-        prefetch_membership_types = []
-
-    prefetch_var = Prefetch(
-        'variations',
-        to_attr='available_variations',
-        queryset=ItemVariation.objects.using(settings.DATABASE_REPLICA).annotate(
-            subevent_disabled=Exists(
-                SubEventItemVariation.objects.filter(
-                    Q(disabled=True)
-                    | (Exact(OuterRef('available_from_mode'), 'hide') & Q(available_from__gt=time_machine_now()))
-                    | (Exact(OuterRef('available_until_mode'), 'hide') & Q(available_until__lt=time_machine_now())),
-                    variation_id=OuterRef('pk'),
-                    subevent=subevent,
-                )
-            ),
-        ).filter(
-            variation_q,
-            Q(all_sales_channels=True) | Q(limit_sales_channels=channel),
-            Exists(Quota.variations.through.objects.filter(quota__subevent_id=subevent, itemvariation_id=OuterRef("pk"))),
-            active=True,
-            subevent_disabled=False
-        ).prefetch_related(
-            *prefetch_membership_types,
-            Prefetch('quotas',
-                     to_attr='_subevent_quotas',
-                     queryset=event.quotas.using(settings.DATABASE_REPLICA).filter(
-                         subevent=subevent).select_related("subevent"))
-        ).distinct()
-    )
-    prefetch_quotas = Prefetch(
-        'quotas',
-        to_attr='_subevent_quotas',
-        queryset=event.quotas.using(settings.DATABASE_REPLICA).filter(subevent=subevent).select_related("subevent")
-    )
-    prefetch_bundles = Prefetch(
-        'bundles',
-        queryset=ItemBundle.objects.using(settings.DATABASE_REPLICA).prefetch_related(
-            Prefetch('bundled_item',
-                     queryset=event.items.using(settings.DATABASE_REPLICA).select_related(
-                         'tax_rule').prefetch_related(
-                         Prefetch('quotas',
-                                  to_attr='_subevent_quotas',
-                                  queryset=event.quotas.using(settings.DATABASE_REPLICA).filter(
-                                      subevent=subevent)),
-                     )),
-            Prefetch('bundled_variation',
-                     queryset=ItemVariation.objects.using(
-                         settings.DATABASE_REPLICA
-                     ).select_related('item', 'item__tax_rule').filter(item__event=event).prefetch_related(
-                         Prefetch('quotas',
-                                  to_attr='_subevent_quotas',
-                                  queryset=event.quotas.using(settings.DATABASE_REPLICA).filter(
-                                      subevent=subevent)),
-                     )),
-        )
-    )
-
-    items = base_qs.using(settings.DATABASE_REPLICA).filter_available(
-        channel=channel.identifier, voucher=voucher, allow_addons=allow_addons, allow_cross_sell=allow_cross_sell
-    ).select_related(
-        'category', 'tax_rule',  # for re-grouping
-        'hidden_if_available',
-    ).prefetch_related(
-        *prefetch_membership_types,
-        Prefetch(
-            'hidden_if_item_available',
-            queryset=event.items.annotate(
-                has_variations=Count('variations'),
-            ).prefetch_related(
-                prefetch_var,
-                prefetch_quotas,
-                prefetch_bundles,
-            )
-        ),
-        prefetch_quotas,
-        prefetch_var,
-        prefetch_bundles,
-    ).annotate(
-        has_variations=Count('variations'),
-        subevent_disabled=Exists(
-            SubEventItem.objects.filter(
-                Q(disabled=True)
-                | (Exact(OuterRef('available_from_mode'), 'hide') & Q(available_from__gt=time_machine_now()))
-                | (Exact(OuterRef('available_until_mode'), 'hide') & Q(available_until__lt=time_machine_now())),
-                item_id=OuterRef('pk'),
-                subevent=subevent,
-            )
-        ),
-        mandatory_priced_addons=Exists(
-            ItemAddOn.objects.filter(
-                base_item_id=OuterRef('pk'),
-                min_count__gte=1,
-                price_included=False
-            )
-        ),
-        requires_seat=requires_seat,
-    ).filter(
-        Exists(Quota.items.through.objects.filter(quota__subevent_id=subevent, item_id=OuterRef("pk"))),
-        subevent_disabled=False,
-    ).order_by('category__position', 'category_id', 'position', 'name')
-    if require_seat:
-        items = items.filter(requires_seat__gt=0)
-    elif require_seat is not None:
-        items = items.filter(requires_seat=0)
-
-    if filter_items:
-        items = items.filter(pk__in=[a for a in filter_items if a.isdigit()])
-    if filter_categories:
-        items = items.filter(category_id__in=[a for a in filter_categories if a.isdigit()])
-
-    display_add_to_cart = False
-    quota_cache_key = f'item_quota_cache:{subevent.id if subevent else 0}:{channel.identifier}:{bool(require_seat)}'
-    quota_cache = quota_cache or event.cache.get(quota_cache_key) or {}
-    quota_cache_existed = bool(quota_cache)
-
-    if subevent:
-        item_price_override = subevent.item_price_overrides
-        var_price_override = subevent.var_price_overrides
-    else:
-        item_price_override = {}
-        var_price_override = {}
-
-    restrict_vars = set()
-    if voucher and voucher.quota_id:
-        # If a voucher is set to a specific quota, we need to filter out on that level
-        restrict_vars = set(voucher.quota.variations.all())
-
-    quotas_to_compute = []
-    for item in items:
-        assert item.event_id == event.pk
-        item.event = event  # save a database query if this is looked up
-        if item.has_variations:
-            for v in item.available_variations:
-                for q in v._subevent_quotas:
-                    if q.pk not in quota_cache:
-                        quotas_to_compute.append(q)
-        else:
-            for q in item._subevent_quotas:
-                if q.pk not in quota_cache:
-                    quotas_to_compute.append(q)
-
-    if quotas_to_compute:
-        qa = QuotaAvailability()
-        qa.queue(*quotas_to_compute)
-        qa.compute()
-        quota_cache.update({q.pk: r for q, r in qa.results.items()})
-
-    for item in items:
-        if voucher and voucher.item_id and voucher.variation_id:
-            # Restrict variations if the voucher only allows one
-            item.available_variations = [v for v in item.available_variations
-                                         if v.pk == voucher.variation_id]
-
-        if channel.type_instance.unlimited_items_per_order:
-            max_per_order = sys.maxsize
-        else:
-            max_per_order = item.max_per_order or int(event.settings.max_items_per_order)
-        if voucher:
-            max_per_order = min(max_per_order, voucher.max_usages - voucher.redeemed)
-
-        if item.hidden_if_available:
-            q = item.hidden_if_available.availability(_cache=quota_cache)
-            if q[0] == Quota.AVAILABILITY_OK:
-                item._remove = True
-                continue
-
-        if item.hidden_if_item_available:
-            if item.hidden_if_item_available.has_variations:
-                item._dependency_available = any(
-                    var.check_quotas(subevent=subevent, _cache=quota_cache, include_bundled=True)[0] == Quota.AVAILABILITY_OK
-                    for var in item.hidden_if_item_available.available_variations
-                )
-            else:
-                q = item.hidden_if_item_available.check_quotas(subevent=subevent, _cache=quota_cache, include_bundled=True)
-                time_available = item.hidden_if_item_available.is_available()
-                item._dependency_available = (q[0] == Quota.AVAILABILITY_OK) and time_available
-            if item._dependency_available and item.hidden_if_item_available_mode == Item.UNAVAIL_MODE_HIDDEN:
-                item._remove = True
-                continue
-
-        if item.require_membership and item.require_membership_hidden:
-            if not memberships or not any([m.membership_type in item.require_membership_types.all() for m in memberships]):
-                item._remove = True
-                continue
-
-        item.current_unavailability_reason = item.unavailability_reason(has_voucher=voucher, subevent=subevent)
-
-        item.description = str(item.description)
-        for recv, resp in item_description.send(sender=event, item=item, variation=None, subevent=subevent):
-            if resp:
-                item.description += ("<br/>" if item.description else "") + resp
-
-        if not item.has_variations:
-            item._remove = False
-            if not bool(item._subevent_quotas):
-                item._remove = True
-                continue
-
-            if voucher and (voucher.allow_ignore_quota or voucher.block_quota):
-                item.cached_availability = (
-                    Quota.AVAILABILITY_OK, voucher.max_usages - voucher.redeemed
-                )
-            else:
-                item.cached_availability = list(
-                    item.check_quotas(subevent=subevent, _cache=quota_cache, include_bundled=True)
-                )
-
-            if not (
-                    ignore_hide_sold_out_for_item_ids and item.pk in ignore_hide_sold_out_for_item_ids
-            ) and event.settings.hide_sold_out and item.cached_availability[0] < Quota.AVAILABILITY_RESERVED:
-                item._remove = True
-                continue
-
-            item.order_max = min(
-                item.cached_availability[1]
-                if item.cached_availability[1] is not None else sys.maxsize,
-                max_per_order
-            )
-
-            original_price = item_price_override.get(item.pk, item.default_price)
-            voucher_reduced = False
-            if voucher:
-                price = voucher.calculate_price(original_price)
-                voucher_reduced = price < original_price
-                include_bundled = not voucher.all_bundles_included
-            else:
-                price = original_price
-                include_bundled = True
-
-            item.display_price = item.tax(price, currency=event.currency, include_bundled=include_bundled)
-            if item.free_price and item.free_price_suggestion is not None and not voucher_reduced:
-                item.suggested_price = item.tax(max(price, item.free_price_suggestion), currency=event.currency, include_bundled=include_bundled)
-            else:
-                item.suggested_price = item.display_price
-
-            if price != original_price:
-                item.original_price = item.tax(original_price, currency=event.currency, include_bundled=True)
-            else:
-                item.original_price = (
-                    item.tax(item.original_price, currency=event.currency, include_bundled=True,
-                             base_price_is='net' if event.settings.display_net_prices else 'gross')  # backwards-compat
-                    if item.original_price else None
-                )
-            if not display_add_to_cart:
-                display_add_to_cart = not item.requires_seat and item.order_max > 0
-        else:
-            for var in item.available_variations:
-                if var.require_membership and var.require_membership_hidden:
-                    if not memberships or not any([m.membership_type in var.require_membership_types.all() for m in memberships]):
-                        var._remove = True
-                        continue
-
-                var.description = str(var.description)
-                for recv, resp in item_description.send(sender=event, item=item, variation=var, subevent=subevent):
-                    if resp:
-                        var.description += ("<br/>" if var.description else "") + resp
-
-                if voucher and (voucher.allow_ignore_quota or voucher.block_quota):
-                    var.cached_availability = (
-                        Quota.AVAILABILITY_OK, voucher.max_usages - voucher.redeemed
-                    )
-                else:
-                    var.cached_availability = list(
-                        var.check_quotas(subevent=subevent, _cache=quota_cache, include_bundled=True)
-                    )
-
-                var.order_max = min(
-                    var.cached_availability[1]
-                    if var.cached_availability[1] is not None else sys.maxsize,
-                    max_per_order
-                )
-
-                original_price = var_price_override.get(var.pk, var.price)
-                voucher_reduced = False
-                if voucher:
-                    price = voucher.calculate_price(original_price)
-                    voucher_reduced = price < original_price
-                    include_bundled = not voucher.all_bundles_included
-                else:
-                    price = original_price
-                    include_bundled = True
-
-                var.display_price = var.tax(price, currency=event.currency, include_bundled=include_bundled)
-
-                if item.free_price and var.free_price_suggestion is not None and not voucher_reduced:
-                    var.suggested_price = item.tax(max(price, var.free_price_suggestion), currency=event.currency,
-                                                   include_bundled=include_bundled)
-                elif item.free_price and item.free_price_suggestion is not None and not voucher_reduced:
-                    var.suggested_price = item.tax(max(price, item.free_price_suggestion), currency=event.currency,
-                                                   include_bundled=include_bundled)
-                else:
-                    var.suggested_price = var.display_price
-
-                if price != original_price:
-                    var.original_price = var.tax(original_price, currency=event.currency, include_bundled=True)
-                else:
-                    var.original_price = (
-                        var.tax(var.original_price or item.original_price, currency=event.currency,
-                                include_bundled=True,
-                                base_price_is='net' if event.settings.display_net_prices else 'gross')  # backwards-compat
-                    ) if var.original_price or item.original_price else None
-
-                var.current_unavailability_reason = var.unavailability_reason(has_voucher=voucher, subevent=subevent)
-
-            item.original_price = (
-                item.tax(item.original_price, currency=event.currency, include_bundled=True,
-                         base_price_is='net' if event.settings.display_net_prices else 'gross')  # backwards-compat
-                if item.original_price else None
-            )
-
-            item.available_variations = [
-                v for v in item.available_variations if v._subevent_quotas and (
-                    not voucher or not voucher.quota_id or v in restrict_vars
-                ) and not getattr(v, '_remove', False)
-            ]
-
-            if not (ignore_hide_sold_out_for_item_ids and item.pk in ignore_hide_sold_out_for_item_ids) and event.settings.hide_sold_out:
-                item.available_variations = [v for v in item.available_variations
-                                             if v.cached_availability[0] >= Quota.AVAILABILITY_RESERVED]
-
-            if voucher and voucher.variation_id:
-                item.available_variations = [v for v in item.available_variations
-                                             if v.pk == voucher.variation_id]
-
-            if len(item.available_variations) > 0:
-                item.min_price = min([v.display_price.net if event.settings.display_net_prices else
-                                      v.display_price.gross for v in item.available_variations])
-                item.max_price = max([v.display_price.net if event.settings.display_net_prices else
-                                      v.display_price.gross for v in item.available_variations])
-                item.best_variation_availability = max([v.cached_availability[0] for v in item.available_variations])
-
-            item._remove = not bool(item.available_variations)
-            if not item._remove and not display_add_to_cart:
-                display_add_to_cart = not item.requires_seat and any(v.order_max > 0 for v in item.available_variations)
-
-    if not quota_cache_existed and not voucher and not allow_addons and not base_qs_set and not filter_items and not filter_categories:
-        event.cache.set(quota_cache_key, quota_cache, 5)
-    items = [item for item in items
-             if (len(item.available_variations) > 0 or not item.has_variations) and not item._remove]
-    return items, display_add_to_cart
-
-
 @method_decorator(allow_frame_if_namespaced, 'dispatch')
 @method_decorator(iframe_entry_view_wrapper, 'dispatch')
 class EventIndex(EventViewMixin, EventListMixin, CartMixin, TemplateView):
@@ -582,7 +196,7 @@ class EventIndex(EventViewMixin, EventListMixin, CartMixin, TemplateView):
 
         if not self.request.event.has_subevents or self.subevent:
             # Fetch all items
-            items, display_add_to_cart = get_grouped_items(
+            items, display_add_to_cart = prepare_item_list_for_shop(
                 self.request.event,
                 subevent=self.subevent,
                 filter_items=self.request.GET.getlist('item'),
@@ -634,10 +248,6 @@ class EventIndex(EventViewMixin, EventListMixin, CartMixin, TemplateView):
         context['has_addon_choices'] = any(cp.has_addon_choices for cp in get_cart(self.request))
 
         templating_context = PlaceholderContext(event_or_subevent=self.subevent or self.request.event, event=self.request.event)
-
-        for field in ('presale_has_ended_text',):
-            context[field] = templating_context.format(str(self.request.event.settings[field]))
-
         if self.subevent:
             context['frontpage_text'] = templating_context.format(str(self.subevent.frontpage_text))
         else:

src/pretix/presale/views/order.py

@@ -79,7 +79,7 @@ from pretix.base.services.invoices import (
 )
 from pretix.base.services.orders import (
     OrderChangeManager, OrderError, _try_auto_refund, cancel_order,
-    change_payment_provider, error_messages,
+    change_payment_provider,
 )
 from pretix.base.services.pricing import get_price
 from pretix.base.services.tickets import generate, invalidate_cache
@@ -92,11 +92,11 @@ from pretix.helpers.safedownload import check_token
 from pretix.multidomain.urlreverse import eventreverse, eventreverse_absolute
 from pretix.presale.forms.checkout import InvoiceAddressForm, QuestionsForm
 from pretix.presale.forms.order import OrderPositionChangeForm
+from pretix.presale.productlist import prepare_item_list_for_shop
 from pretix.presale.signals import question_form_fields_overrides
 from pretix.presale.views import (
     CartMixin, EventViewMixin, iframe_entry_view_wrapper,
 )
-from pretix.presale.views.event import get_grouped_items
 from pretix.presale.views.robots import NoSearchIndexViewMixin
 
 logger = logging.getLogger(__name__)
@@ -1452,7 +1452,7 @@ class OrderChangeMixin:
 
                     if ckey not in item_cache:
                         # Get all items to possibly show
-                        items, _btn = get_grouped_items(
+                        items, _btn = prepare_item_list_for_shop(
                             self.request.event,
                             subevent=p.subevent,
                             voucher=None,
@@ -1592,30 +1592,6 @@ class OrderChangeMixin:
                 if val:
                     selected[i, None] = val, price
 
-        if sum(a[0] for a in selected.values()) > category['max_count']:
-            raise ValidationError(
-                error_messages['addon_max_count'] % {
-                    'base': str(form['pos'].item.name),
-                    'max': category['max_count'],
-                    'cat': str(category['category'].name),
-                }
-            )
-        elif sum(a[0] for a in selected.values()) < category['min_count']:
-            raise ValidationError(
-                error_messages['addon_min_count'] % {
-                    'base': str(form['pos'].item.name),
-                    'min': category['min_count'],
-                    'cat': str(category['category'].name),
-                }
-            )
-        elif any(sum(v[0] for k, v in selected.items() if k[0] == i) > 1 for i in category['items']) and not category['multi_allowed']:
-            raise ValidationError(
-                error_messages['addon_no_multi'] % {
-                    'base': str(form['pos'].item.name),
-                    'cat': str(category['category'].name),
-                }
-            )
-
         return selected
 
     def post(self, request, *args, **kwargs):