Update src/pretix/control/templates/pretixcontrol/event/dashboard_partial_warnings.html

Co-authored-by: pajowu <engelhardt@pretix.eu>

package-lock.json

@@ -2584,9 +2584,9 @@
       }
     },
     "node_modules/immutable": {
-      "version": "5.1.5",
-      "resolved": "https://registry.npmjs.org/immutable/-/immutable-5.1.5.tgz",
-      "integrity": "sha512-t7xcm2siw+hlUM68I+UEOK+z84RzmN59as9DZ7P1l0994DKUWV7UXBMQZVxaoMSRQ+PBZbHCOoBt7a2wxOMt+A==",
+      "version": "5.1.9",
+      "resolved": "https://registry.npmjs.org/immutable/-/immutable-5.1.9.tgz",
+      "integrity": "sha512-m8nVez3rwrgmWxtLMt1ZYXB2Lv7OKYn/disyxAlSDYAlKSlFoPPfIAmAM/M5xqL4m4C/wAPw7S2/CNaUii1Hxg==",
       "dev": true,
       "license": "MIT"
     },

pyproject.toml

@@ -40,7 +40,7 @@ dependencies = [
   "Django[argon2]==5.2.*",
   "django-bootstrap3==26.1",
   "django-compressor==4.6.0",
-  "django-countries==8.2.*",
+  "django-countries==9.0.*",
   "django-filter==26.1",
   "django-formset-js-improved==0.5.0.5",
   "django-formtools==2.7",
@@ -55,7 +55,7 @@ dependencies = [
   "django-phonenumber-field==8.4.*",
   "django-querytagger==0.0.3",
   "django-redis==7.0.*",
-  "django-scopes==2.0.*",
+  "django-scopes==2.1.*",
   "django-statici18n==2.7.*",
   "djangorestframework==3.17.*",
   "dnspython==2.8.*",
@@ -112,7 +112,7 @@ dev = [
   "aiohttp==3.14.*",
   "coverage",
   "coveralls",
-  "fakeredis==2.36.*",
+  "fakeredis==2.37.*",
   "flake8==7.3.*",
   "freezegun",
   "isort==8.0.*",

src/pretix/api/auth/devicesecurity.py

@@ -108,6 +108,7 @@ class PretixScanSecurityProfile(AllowListSecurityProfile):
         ('GET', 'api-v1:event.settings'),
         ('POST', 'api-v1:upload'),
         ('POST', 'api-v1:checkinrpc.redeem'),
+        ('POST', 'api-v1:checkinrpc.annull'),
         ('GET', 'api-v1:checkinrpc.search'),
         ('GET', 'api-v1:reusablemedium-list'),
         ('POST', 'api-v1:reusablemedium-lookup'),
@@ -146,6 +147,7 @@ class PretixScanNoSyncNoSearchSecurityProfile(AllowListSecurityProfile):
         ('GET', 'api-v1:event.settings'),
         ('POST', 'api-v1:upload'),
         ('POST', 'api-v1:checkinrpc.redeem'),
+        ('POST', 'api-v1:checkinrpc.annull'),
         ('GET', 'api-v1:checkinrpc.search'),
     )
 
@@ -182,6 +184,7 @@ class PretixScanNoSyncSecurityProfile(AllowListSecurityProfile):
         ('GET', 'api-v1:event.settings'),
         ('POST', 'api-v1:upload'),
         ('POST', 'api-v1:checkinrpc.redeem'),
+        ('POST', 'api-v1:checkinrpc.annull'),
         ('GET', 'api-v1:checkinrpc.search'),
     )
 

src/pretix/base/email.py

@@ -19,7 +19,6 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-import ipaddress
 import logging
 import smtplib
 import socket
@@ -43,6 +42,7 @@ from pretix.base.templatetags.rich_text import (
     markdown_compile_email, truelink_callback,
 )
 from pretix.helpers.format import FormattedString, SafeFormatter, format_map
+from pretix.helpers.ssrf import should_block_access
 
 from pretix.base.services.placeholders import (  # noqa
     get_available_placeholders, PlaceholderContext
@@ -57,8 +57,6 @@ logger = logging.getLogger('pretix.base.email')
 
 T = TypeVar("T", bound=EmailBackend)
 
-_cgnat_net = ipaddress.ip_network('100.64.0.0/10')
-
 
 def test_custom_smtp_backend(backend: T, from_addr: str) -> None:
     try:
@@ -254,16 +252,9 @@ def create_connection(address, timeout=socket.getdefaulttimeout(),
         af, socktype, proto, canonname, sa = res
 
         if not getattr(settings, "MAIL_CUSTOM_SMTP_ALLOW_PRIVATE_NETWORKS", False):
-            ip_addr = ipaddress.ip_address(sa[0])
-            check_ip4 = ip_addr.ipv4_mapped if getattr(ip_addr, "ipv4_mapped", None) else ip_addr
-            if ip_addr.is_multicast:
-                raise socket.error(f"Request to multicast address {sa[0]} blocked")
-            if ip_addr.is_loopback or ip_addr.is_link_local:
-                raise socket.error(f"Request to local address {sa[0]} blocked")
-            if ip_addr.is_private:
-                raise socket.error(f"Request to private address {sa[0]} blocked")
-            if check_ip4 in _cgnat_net:
-                raise socket.error(f"Request to RFC 6598 address {sa[0]} blocked")
+            is_private, msg = should_block_access(sa)
+            if is_private:
+                raise socket.error(msg)
 
         sock = None
         try:

src/pretix/base/forms/widgets.py

@@ -314,18 +314,3 @@ class BusinessBooleanRadio(forms.RadioSelect):
             'False': False,
             False: False,
         }.get(value)
-
-
-class OptionAttrsSelect(forms.Select):
-    def __init__(self, *args, option_attrs=None, **kwargs):
-        super().__init__(*args, **kwargs)
-        self.option_attrs = option_attrs or {}
-
-    def create_option(self, name, value, label, selected, index, subindex=None, attrs=None):
-        option = super().create_option(
-            name, value, label, selected, index, subindex=subindex, attrs=attrs
-        )
-        extra = self.option_attrs.get(str(value))
-        if extra:
-            option["attrs"].update(extra)
-        return option

src/pretix/base/middleware.py

@@ -19,6 +19,8 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
+import base64
+import hashlib
 import logging
 import re
 from collections import OrderedDict
@@ -312,7 +314,28 @@ def _merge_csp(a, b):
     for k, v in a.items():
         if "'unsafe-inline'" in v:
             # If we need unsafe-inline, drop any hashes or nonce as they will be ignored otherwise
-            a[k] = [i for i in v if not i.startswith("'nonce-") and not i.startswith("'sha-")]
+            a[k] = [i for i in v if not i.startswith("'nonce-") and not i.startswith("'sha256-")]
+
+
+def add_to_response_csp(response, csp_to_merge):
+    if "Content-Security-Policy" in response:
+        csp = _parse_csp(response["Content-Security-Policy"])
+    else:
+        csp = {}
+
+    _merge_csp(csp, csp_to_merge)
+
+    if csp:
+        response["Content-Security-Policy"] = _render_csp(csp)
+
+
+def add_to_response_csp_via_request(request, csp_to_merge):
+    _merge_csp(request._csp_to_merge, csp_to_merge)
+
+
+def calculate_csp_hash(data):
+    hash_str = base64.b64encode(hashlib.sha256(data.encode("utf-8")).digest()).decode("ascii")
+    return f"'sha256-{hash_str}'"
 
 
 class SecurityMiddleware(MiddlewareMixin):
@@ -332,6 +355,9 @@ class SecurityMiddleware(MiddlewareMixin):
         # but at the moment it does not seem to be an issue to just send it.
     )
 
+    def process_request(self, request):
+        request._csp_to_merge = {}
+
     def process_response(self, request, resp):
         if settings.DEBUG and resp.status_code >= 400:
             # Don't use CSP on debug error page as it breaks of Django's fancy error
@@ -343,18 +369,22 @@ class SecurityMiddleware(MiddlewareMixin):
         # https://github.com/pretix/pretix/issues/765
         resp['P3P'] = 'CP=\"ALL DSP COR CUR ADM TAI OUR IND COM NAV INT\"'
 
-        if "Content-Type" in resp and resp["Content-Type"].split(";")[0] in self.SAFE_TYPES:
-            if 'Content-Security-Policy' in resp:
-                del resp['Content-Security-Policy']
-            return resp
-
-        if not getattr(resp, '_csp_ignore', False):
+        if self._needs_csp(request, resp):
             resp['Content-Security-Policy'] = _render_csp(self._build_csp(request, resp))
         elif 'Content-Security-Policy' in resp:
             del resp['Content-Security-Policy']
 
         return resp
 
+    def _needs_csp(self, request, resp):
+        if "Content-Type" in resp and resp["Content-Type"].split(";")[0] in self.SAFE_TYPES:
+            return False
+
+        if getattr(resp, '_csp_ignore', False):
+            return False
+
+        return True
+
     def _build_csp(self, request, resp):
         url = resolve(request.path_info)
 
@@ -387,13 +417,6 @@ class SecurityMiddleware(MiddlewareMixin):
             h['style-src'] += ["'unsafe-inline'"]
             h['connect-src'] += ["http://localhost:5173", "ws://localhost:5173"]
 
-        if hasattr(request, 'csp_nonce'):
-            nonce = f"'nonce-{request.csp_nonce}'"
-            h['script-src'].append(nonce)
-            if not settings.VITE_DEV_MODE:
-                # can't have 'unsafe-inline' and nonce at the same time
-                h['style-src'].append(nonce)
-
         # Only include pay.google.com for wallet detection purposes on the Payment selection page
         if (
                 url.url_name == "event.order.pay.change" or
@@ -406,6 +429,9 @@ class SecurityMiddleware(MiddlewareMixin):
         if settings.LOG_CSP:
             h['report-uri'] = ["/csp_report/"]
 
+        if request._csp_to_merge:
+            _merge_csp(h, request._csp_to_merge)
+
         if 'Content-Security-Policy' in resp:
             _merge_csp(h, _parse_csp(resp['Content-Security-Policy']))
 

src/pretix/base/models/event.py

@@ -238,6 +238,9 @@ class EventMixin:
 
     @property
     def timezone(self):
+        # If we get rid of the shim, verify that
+        # https://github.com/py-vobject/vobject/issues/117#issuecomment-5045645314
+        # has been released and included
         return pytz_deprecation_shim.timezone(self.settings.timezone)
 
     @property

src/pretix/base/models/orders.py

@@ -508,20 +508,20 @@ class Order(LockModel, LoggedModel):
 
     @classmethod
     def annotate_overpayments(cls, qs, results=True, refunds=True, sums=False):
-        payment_sum = OrderPayment.objects.filter(
+        payment_sum = OrderPayment.objects.with_scopes_disabled().filter(
             state__in=(OrderPayment.PAYMENT_STATE_CONFIRMED, OrderPayment.PAYMENT_STATE_REFUNDED),
             order=OuterRef('pk')
         ).order_by().values('order').annotate(s=Sum('amount')).values('s')
-        refund_sum = OrderRefund.objects.filter(
+        refund_sum = OrderRefund.objects.with_scopes_disabled().filter(
             state__in=(OrderRefund.REFUND_STATE_DONE, OrderRefund.REFUND_STATE_TRANSIT,
                        OrderRefund.REFUND_STATE_CREATED),
             order=OuterRef('pk')
         ).order_by().values('order').annotate(s=Sum('amount')).values('s')
-        external_refund = OrderRefund.objects.filter(
+        external_refund = OrderRefund.objects.with_scopes_disabled().filter(
             state=OrderRefund.REFUND_STATE_EXTERNAL,
             order=OuterRef('pk')
         )
-        pending_refund = OrderRefund.objects.filter(
+        pending_refund = OrderRefund.objects.with_scopes_disabled().filter(
             state__in=(OrderRefund.REFUND_STATE_CREATED, OrderRefund.REFUND_STATE_TRANSIT),
             order=OuterRef('pk')
         )
@@ -2286,9 +2286,12 @@ class OrderRefund(models.Model):
         super().save(*args, **kwargs)
 
 
-class ActivePositionManager(ScopedManager(organizer='order__event__organizer').__class__):
-    def get_queryset(self):
-        return super().get_queryset().filter(canceled=False)
+def ActivePositionManager(**scope):
+    class InnerClass(ScopedManager(**scope).__class__):
+        def get_queryset(self):
+            return super().get_queryset().filter(canceled=False)
+
+    return InnerClass()
 
 
 class OrderFee(RoundingCorrectionMixin, models.Model):
@@ -2378,7 +2381,7 @@ class OrderFee(RoundingCorrectionMixin, models.Model):
     canceled = models.BooleanField(default=False)
 
     all = ScopedManager(organizer='order__event__organizer')
-    objects = ActivePositionManager()
+    objects = ActivePositionManager(organizer='order__event__organizer')
 
     @property
     def net_value(self):
@@ -2597,7 +2600,7 @@ class OrderPosition(AbstractPosition):
     )
 
     all = ScopedManager(organizer='organizer')
-    objects = ActivePositionManager()
+    objects = ActivePositionManager(organizer='organizer')
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)

src/pretix/base/reldate.py

@@ -19,245 +19,30 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-import copy
 import datetime
-import os
-import warnings
 from collections import namedtuple
-from dataclasses import dataclass
-from typing import (
-    TYPE_CHECKING, Iterable, List, Literal, Optional, Tuple, Union, cast,
-)
+from typing import Union
 from zoneinfo import ZoneInfo
 
 from dateutil import parser
 from django import forms
 from django.core.exceptions import ValidationError
 from django.db import models
-from django.forms.widgets import Widget
 from django.utils.formats import get_format
-from django.utils.functional import Promise, lazy
+from django.utils.functional import lazy
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 from rest_framework import serializers
 
-from pretix.base.forms.widgets import OptionAttrsSelect
+BASE_CHOICES = (
+    ('date_from', _('Event start')),
+    ('date_to', _('Event end')),
+    ('date_admission', _('Event admission')),
+    ('presale_start', _('Presale start')),
+    ('presale_end', _('Presale end')),
+)
 
-if TYPE_CHECKING:
-    from .models import Event, Order, SubEvent
-
-
-@dataclass(frozen=True)
-class BaseChoice:
-    base: Literal["event", "order"]
-    attribute: str
-    text: Promise
-    supports_before: bool
-    supports_after: bool
-
-    @property
-    def key(self) -> str:
-        key = f"{self.base}__{self.attribute}"
-        return key
-
-    @staticmethod
-    def find(objects: Iterable["BaseChoice"], key: str) -> "BaseChoice":
-        if "__" in key:
-            choice = next((obj for obj in objects if obj.key == key), None)
-        else:
-            # fallback for RelativeDateFields stored, before support for bases other than event was added
-            choice = next((obj for obj in objects if obj.attribute == key and obj.base == "event"), None)
-
-        if choice is None:
-            raise TypeError(f"key {key} must be a valid key in BASE_CHOICES")
-
-        return choice
-
-
-BASE_CHOICES: List[BaseChoice] = [
-    BaseChoice('event', 'date_from', _('Event start'), True, True),
-    BaseChoice('event', 'date_to', _('Event end'), True, True),
-    BaseChoice('event', 'date_admission', _('Event admission'), True, True),
-    BaseChoice('event', 'presale_start', _('Presale start'), True, True),
-    BaseChoice('event', 'presale_end', _('Presale end'), True, True),
-    BaseChoice('order', 'datetime', _('Order creation'), False, True),
-    BaseChoice('order', 'expires', _('Order expiry'), True, True),
-]
-
-EVENT_BASE_CHOICES = [
-    x for x in BASE_CHOICES if x.base == 'event'
-]
-
-ORDER_BASE_CHOICES = [
-    x for x in BASE_CHOICES if x.base == 'order'
-]
-
-
-@dataclass(frozen=True)
-class RelativeDate:
-    """
-    This contains information on a date that is defined in relation to a fixed base point.
-    This means that the underlying data is a fixed date as the base point and a number of days or a time interval
-    to calculate the date.
-
-    The list of valid base date choices is defined in BASE_CHOICES.
-    If the base_date_name is not set, the date_from attribute of Event is used.
-    """
-
-    days: int = 0
-    minutes: Optional[int] = None
-    time: Optional[datetime.time] = None
-    is_after: bool = False
-    base_date_name: str = 'event__date_from__'
-
-    def __post_init__(self) -> None:
-        if self.is_after and not self._choice.supports_after:
-            raise ValueError(
-                "The selected base date and attribute combination does not support relative dates placed after the base date"
-            )
-        if not self.is_after and not self._choice.supports_before:
-            raise ValueError(
-                "The selected base date and attribute combination does not support relative dates placed before the base date")
-
-    @property
-    def _choice(self):
-        return BaseChoice.find(BASE_CHOICES, self.base_date_name)
-
-    @property
-    def key(self):
-        return self._choice.key
-
-    def __eq__(self, o: object) -> bool:
-        if not isinstance(o, RelativeDate):
-            return False
-        return self.to_string() == o.to_string()
-
-    def _resolve_date(self, base: "Event | Order | SubEvent") -> Tuple[datetime.datetime, ZoneInfo]:
-        """
-        Resolves the datetime and timezone information of this RelativeDate object in relation to the provided reference.
-
-        :param base: the reference which should be used to resolve the relative date
-        :return:
-        """
-        from .models import Event, Order, SubEvent
-
-        choice = self._choice
-
-        if choice.base == "order" and isinstance(base, Order):
-            event = base.event
-            base_date = getattr(base, choice.attribute)
-        elif choice.base == "event" and isinstance(base, SubEvent):
-            event = base.event
-            base_date = (getattr(base, choice.attribute) or
-                         getattr(base.event, choice.attribute) or
-                         base.date_from)
-        elif choice.base == "event" and isinstance(base, Event):
-            event = base
-            base_date = getattr(base, choice.attribute) or event.date_from
-        else:
-            raise TypeError("The base defined by data does not match the passed in base")
-
-        tz = ZoneInfo(event.settings.timezone)
-        return base_date, tz
-
-    def date(self, base: "Event | Order | SubEvent") -> datetime.date:
-        """
-        Resolves the effective date of this RelativeDate object in relation to the provided reference.
-
-        :param base: the reference which should be used to resolve the date
-        :return: datetime.date
-        """
-        if self.minutes is not None:
-            raise ValueError('A minute-based relative datetime can not be used as a date')
-
-        base_date, tz = self._resolve_date(base)
-
-        if self.is_after:
-            new_date = base_date.astimezone(tz) + datetime.timedelta(days=self.days)
-        else:
-            new_date = base_date.astimezone(tz) - datetime.timedelta(days=self.days)
-        return new_date.date()
-
-    def datetime(self, base: "Event | Order | SubEvent") -> datetime.datetime:
-        """
-        Resolves the effective datetime of this RelativeDate object in relation to the provided reference.
-
-        :param base: the reference which should be used to resolve the datetime
-        :return: datetime.datetime
-        """
-        base_date, tz = self._resolve_date(base)
-
-        if self.minutes is not None:
-            if self.is_after:
-                return base_date.astimezone(tz) + datetime.timedelta(minutes=self.minutes)
-            else:
-                return base_date.astimezone(tz) - datetime.timedelta(minutes=self.minutes)
-        else:
-            if self.is_after:
-                new_date = (base_date.astimezone(tz) + datetime.timedelta(days=self.days)).astimezone(tz)
-            else:
-                new_date = (base_date.astimezone(tz) - datetime.timedelta(days=self.days)).astimezone(tz)
-            if self.time:
-                new_date = new_date.replace(
-                    hour=self.time.hour,
-                    minute=self.time.minute,
-                    second=self.time.second
-                )
-            new_date = new_date.astimezone(tz)
-            return new_date
-
-    def to_string(self) -> str:
-        if self.minutes is not None:
-            return 'RELDATE/minutes/{}/{}/{}'.format(  #
-                self.minutes,
-                self._choice.key,
-                'after' if self.is_after else '',
-            )
-        return 'RELDATE/{}/{}/{}/{}'.format(  #
-            self.days,
-            self.time.strftime('%H:%M:%S') if self.time else '-',
-            self._choice.key,
-            'after' if self.is_after else '',
-        )
-
-    @classmethod
-    def from_string(cls, input: str):
-        if not input.startswith('RELDATE/'):
-            raise TypeError("Invalid input for RelativeDate.from_string()")
-
-        parts = input.split('/')
-        if parts[1] == 'minutes':
-            data = RelativeDate(
-                days=0,
-                minutes=int(parts[2]),
-                base_date_name=parts[3],
-                time=None,
-                is_after=len(parts) > 4 and parts[4] == "after",
-            )
-        else:
-            if parts[2] == '-':
-                time = None
-            else:
-                timeparts = parts[2].split(':')
-                time = datetime.time(hour=int(timeparts[0]), minute=int(timeparts[1]), second=int(timeparts[2]))
-            try:
-                data = RelativeDate(
-                    days=int(parts[1] or 0),
-                    base_date_name=parts[3],
-                    time=time,
-                    minutes=None,
-                    is_after=len(parts) > 4 and parts[4] == "after",
-                )
-            except ValueError:
-                data = RelativeDate(
-                    days=0,
-                    base_date_name=parts[3],
-                    time=time,
-                    minutes=None,
-                    is_after=len(parts) > 4 and parts[4] == "after",
-                )
-
-        return data
+RelativeDate = namedtuple('RelativeDate', ['days', 'minutes', 'time', 'is_after', 'base_date_name'], defaults=(0, None, None, False, 'date_from'))
 
 
 class RelativeDateWrapper:
@@ -265,53 +50,130 @@ class RelativeDateWrapper:
     This contains information on a date that might be relative to an event. This means
     that the underlying data is either a fixed date or a number of days and a wall clock
     time to calculate the date based on a base point.
+
+    The base point can be the date_from, date_to, date_admission, presale_start or presale_end
+    attribute of an event or subevent. If the respective attribute is not set, ``date_from``
+    will be used.
     """
 
     def __init__(self, data: Union[datetime.datetime, RelativeDate]):
         self.data = data
 
-    def date(self, base: "Event | Order | SubEvent") -> datetime.date:
-        """
-        If the RelativeDateWrapper wraps a RelativeDate object:
-            Resolves the effective date of this object in relation to the provided reference.
-        If the RelativeDateWrapper wraps an absolute date or datetime:
-            Returns the wrapped absolute date.
+    def date(self, event) -> datetime.date:
+        from .models import SubEvent
 
-        :param base: the reference which should be used to resolve the date in case it is a relative date.
-        :return: datetime.date
-        """
         if isinstance(self.data, datetime.datetime):
             return self.data.date()
         elif isinstance(self.data, datetime.date):
             return self.data
         else:
-            return self.data.date(base)
+            if self.data.minutes is not None:
+                raise ValueError('A minute-based relative datetime can not be used as a date')
 
-    def datetime(self, base: "Event | Order | SubEvent") -> datetime.datetime:
-        """
-        If the RelativeDateWrapper wraps a RelativeDate object:
-            Resolves the effective datetime of this object in relation to the provided reference.
-        If the RelativeDateWrapper wraps an absolute date or datetime:
-            Returns the wrapped absolute datetime.
+            tz = ZoneInfo(event.settings.timezone)
+            if isinstance(event, SubEvent):
+                base_date = (
+                    getattr(event, self.data.base_date_name)
+                    or getattr(event.event, self.data.base_date_name)
+                    or event.date_from
+                )
+            else:
+                base_date = getattr(event, self.data.base_date_name) or event.date_from
+
+            if self.data.is_after:
+                new_date = base_date.astimezone(tz) + datetime.timedelta(days=self.data.days)
+            else:
+                new_date = base_date.astimezone(tz) - datetime.timedelta(days=self.data.days)
+            return new_date.date()
+
+    def datetime(self, event) -> datetime.datetime:
+        from .models import SubEvent
 
-        :param base: the reference which should be used to resolve the datetime in case it is a relative datetime.
-        :return: datetime.datetime
-        """
         if isinstance(self.data, (datetime.datetime, datetime.date)):
             return self.data
         else:
-            return self.data.datetime(base)
+            tz = ZoneInfo(event.settings.timezone)
+            if isinstance(event, SubEvent):
+                base_date = (
+                    getattr(event, self.data.base_date_name)
+                    or getattr(event.event, self.data.base_date_name)
+                    or event.date_from
+                )
+            else:
+                base_date = getattr(event, self.data.base_date_name) or event.date_from
+
+            if self.data.minutes is not None:
+                if self.data.is_after:
+                    return base_date.astimezone(tz) + datetime.timedelta(minutes=self.data.minutes)
+                else:
+                    return base_date.astimezone(tz) - datetime.timedelta(minutes=self.data.minutes)
+            else:
+                if self.data.is_after:
+                    new_date = (base_date.astimezone(tz) + datetime.timedelta(days=self.data.days)).astimezone(tz)
+                else:
+                    new_date = (base_date.astimezone(tz) - datetime.timedelta(days=self.data.days)).astimezone(tz)
+                if self.data.time:
+                    new_date = new_date.replace(
+                        hour=self.data.time.hour,
+                        minute=self.data.time.minute,
+                        second=self.data.time.second
+                    )
+                new_date = new_date.astimezone(tz)
+                return new_date
 
     def to_string(self) -> str:
         if isinstance(self.data, (datetime.datetime, datetime.date)):
             return self.data.isoformat()
         else:
-            return self.data.to_string()
+            if self.data.minutes is not None:
+                return 'RELDATE/minutes/{}/{}/{}'.format(  #
+                    self.data.minutes,
+                    self.data.base_date_name,
+                    'after' if self.data.is_after else '',
+                )
+            return 'RELDATE/{}/{}/{}/{}'.format(  #
+                self.data.days,
+                self.data.time.strftime('%H:%M:%S') if self.data.time else '-',
+                self.data.base_date_name,
+                'after' if self.data.is_after else '',
+            )
 
     @classmethod
     def from_string(cls, input: str):
         if input.startswith('RELDATE/'):
-            data = RelativeDate.from_string(input)
+            parts = input.split('/')
+            if parts[1] == 'minutes':
+                data = RelativeDate(
+                    days=0,
+                    minutes=int(parts[2]),
+                    base_date_name=parts[3],
+                    time=None,
+                    is_after=len(parts) > 4 and parts[4] == "after",
+                )
+            else:
+                if parts[2] == '-':
+                    time = None
+                else:
+                    timeparts = parts[2].split(':')
+                    time = datetime.time(hour=int(timeparts[0]), minute=int(timeparts[1]), second=int(timeparts[2]))
+                try:
+                    data = RelativeDate(
+                        days=int(parts[1] or 0),
+                        base_date_name=parts[3],
+                        time=time,
+                        minutes=None,
+                        is_after=len(parts) > 4 and parts[4] == "after",
+                    )
+                except ValueError:
+                    data = RelativeDate(
+                        days=0,
+                        base_date_name=parts[3],
+                        time=time,
+                        minutes=None,
+                        is_after=len(parts) > 4 and parts[4] == "after",
+                    )
+            if data.base_date_name not in [k[0] for k in BASE_CHOICES]:
+                raise ValueError('{} is not a valid base date'.format(data.base_date_name))
         else:
             data = parser.parse(input)
         return RelativeDateWrapper(data)
@@ -325,6 +187,7 @@ BEFORE_AFTER_CHOICE = (
     ('after', _('after')),
 )
 
+
 reldatetimeparts = namedtuple('reldatetimeparts', (
     "status",  # 0
     "absolute",  # 1
@@ -339,14 +202,6 @@ reldatetimeparts = namedtuple('reldatetimeparts', (
 reldatetimeparts.indizes = reldatetimeparts(*range(9))
 
 
-def _get_choices(base_choices: List[BaseChoice]) -> List[Tuple[str, Promise]]:
-    return [(c.key, c.text) for c in base_choices]
-
-
-def _get_choice_validation_obj(choices: List[BaseChoice]):
-    return {c.key: {"data-supports-before": c.supports_before, "data-supports-after": c.supports_after} for c in choices}
-
-
 class RelativeDateTimeWidget(forms.MultiWidget):
     template_name = 'pretixbase/forms/widgets/reldatetime.html'
     parts = reldatetimeparts
@@ -354,7 +209,6 @@ class RelativeDateTimeWidget(forms.MultiWidget):
     def __init__(self, *args, **kwargs):
         self.status_choices = kwargs.pop('status_choices')
         base_choices = kwargs.pop('base_choices')
-        choices = _get_choices(base_choices)
 
         def placeholder_datetime_format():
             df = get_format('DATETIME_INPUT_FORMATS')[0]
@@ -366,29 +220,21 @@ class RelativeDateTimeWidget(forms.MultiWidget):
             tf = get_format('TIME_INPUT_FORMATS')[0]
             return datetime.time(8, 30, 0).strftime(tf)
 
-        widgets = cast(dict[str, Widget | type[Widget]], cast(object, reldatetimeparts(
+        widgets = reldatetimeparts(
             status=forms.RadioSelect(choices=self.status_choices),
             absolute=forms.DateTimeInput(
                 attrs={'placeholder': lazy(placeholder_datetime_format, str), 'class': 'datetimepicker'}
             ),
             rel_days_number=forms.NumberInput(),
-            rel_mins_relationto=OptionAttrsSelect(
-                attrs={'data-relative-choice': True},
-                choices=choices,
-                option_attrs=_get_choice_validation_obj(base_choices)
-            ),
+            rel_mins_relationto=forms.Select(choices=base_choices),
             rel_days_timeofday=forms.TimeInput(
                 attrs={'placeholder': lazy(placeholder_time_format, str), 'class': 'timepickerfield'}
             ),
             rel_mins_number=forms.NumberInput(),
-            rel_days_relationto=OptionAttrsSelect(
-                attrs={'data-relative-choice': True},
-                choices=choices,
-                option_attrs=_get_choice_validation_obj(base_choices)
-            ),
-            rel_mins_relation=forms.Select(attrs={'data-relation-choice': True}, choices=BEFORE_AFTER_CHOICE),
-            rel_days_relation=forms.Select(attrs={'data-relation-choice': True}, choices=BEFORE_AFTER_CHOICE),
-        )))
+            rel_days_relationto=forms.Select(choices=base_choices),
+            rel_mins_relation=forms.Select(choices=BEFORE_AFTER_CHOICE),
+            rel_days_relation=forms.Select(choices=BEFORE_AFTER_CHOICE),
+        )
         super().__init__(widgets=widgets, *args, **kwargs)
 
     def decompress(self, value):
@@ -401,10 +247,10 @@ class RelativeDateTimeWidget(forms.MultiWidget):
                 status="unset",
                 absolute=None,
                 rel_days_number=1,
-                rel_mins_relationto="event__date_from",
+                rel_mins_relationto="date_from",
                 rel_days_timeofday=None,
                 rel_mins_number=0,
-                rel_days_relationto="event__date_from",
+                rel_days_relationto="date_from",
                 rel_mins_relation="before",
                 rel_days_relation="before"
             )
@@ -413,10 +259,10 @@ class RelativeDateTimeWidget(forms.MultiWidget):
                 status="absolute",
                 absolute=value.data,
                 rel_days_number=1,
-                rel_mins_relationto="event__date_from",
+                rel_mins_relationto="date_from",
                 rel_days_timeofday=None,
                 rel_mins_number=0,
-                rel_days_relationto="event__date_from",
+                rel_days_relationto="date_from",
                 rel_mins_relation="before",
                 rel_days_relation="before"
             )
@@ -425,10 +271,10 @@ class RelativeDateTimeWidget(forms.MultiWidget):
                 status="relative_minutes",
                 absolute=None,
                 rel_days_number=None,
-                rel_mins_relationto=value.data.key,
+                rel_mins_relationto=value.data.base_date_name,
                 rel_days_timeofday=None,
                 rel_mins_number=value.data.minutes,
-                rel_days_relationto=value.data.key,
+                rel_days_relationto=value.data.base_date_name,
                 rel_mins_relation="after" if value.data.is_after else "before",
                 rel_days_relation="after" if value.data.is_after else "before"
             )
@@ -436,10 +282,10 @@ class RelativeDateTimeWidget(forms.MultiWidget):
             status="relative",
             absolute=None,
             rel_days_number=value.data.days,
-            rel_mins_relationto=value.data.key,
+            rel_mins_relationto=value.data.base_date_name,
             rel_days_timeofday=value.data.time,
             rel_mins_number=0,
-            rel_days_relationto=value.data.key,
+            rel_days_relationto=value.data.base_date_name,
             rel_mins_relation="after" if value.data.is_after else "before",
             rel_days_relation="after" if value.data.is_after else "before"
         )
@@ -463,41 +309,17 @@ class RelativeDateTimeField(forms.MultiValueField):
             ('relative', _('Relative date:')),
             ('relative_minutes', _('Relative time:')),
         ]
-        self.relative_to_order = kwargs.pop('relative_to_order', False)
-
-        possible_choices = copy.deepcopy(EVENT_BASE_CHOICES)
-        if self.relative_to_order:
-            possible_choices.extend(ORDER_BASE_CHOICES)
-
         if kwargs.get('limit_choices'):
             limit = kwargs.pop('limit_choices')
-            if any(["__" not in l for l in limit]):
-                _warn_skips = (str(os.path.dirname(__file__)),)
-
-                warnings.warn(
-                    message="Please prefix limit_choices with the base the attributes refer to, for example event__date_from",
-                    category=DeprecationWarning,
-                    skip_file_prefixes=_warn_skips
-                )
-
-            possible_choices = [
-                c for c in possible_choices if
-                # new base case as we want limit_choices to be expressed as base__attribute
-                (c.key in limit) or
-                # fallback for old event based entries
-                # if the base is an event, then using only attribute is fine
-                (c.base == "event" and c.attribute in limit)
-            ]
-
+            choices = [(k, v) for k, v in BASE_CHOICES if k in limit]
+        else:
+            choices = BASE_CHOICES
         if not kwargs.get('required', True):
             status_choices.insert(0, ('unset', _('Not set')))
-
-        choices = _get_choices(possible_choices)
-
         fields = reldatetimeparts(
             status=forms.ChoiceField(
                 choices=status_choices,
-                required=True,
+                required=True
             ),
             absolute=forms.DateTimeField(
                 required=False
@@ -507,7 +329,7 @@ class RelativeDateTimeField(forms.MultiValueField):
             ),
             rel_mins_relationto=forms.ChoiceField(
                 choices=choices,
-                required=False,
+                required=False
             ),
             rel_days_timeofday=forms.TimeField(
                 required=False,
@@ -517,7 +339,7 @@ class RelativeDateTimeField(forms.MultiValueField):
             ),
             rel_days_relationto=forms.ChoiceField(
                 choices=choices,
-                required=False,
+                required=False
             ),
             rel_mins_relation=forms.ChoiceField(
                 choices=BEFORE_AFTER_CHOICE,
@@ -528,9 +350,8 @@ class RelativeDateTimeField(forms.MultiValueField):
                 required=False
             ),
         )
-
         if 'widget' not in kwargs:
-            kwargs['widget'] = RelativeDateTimeWidget(status_choices=status_choices, base_choices=possible_choices)
+            kwargs['widget'] = RelativeDateTimeWidget(status_choices=status_choices, base_choices=choices)
         kwargs.pop('max_length', 0)
         kwargs.pop('empty_value', 0)
         super().__init__(
@@ -538,24 +359,21 @@ class RelativeDateTimeField(forms.MultiValueField):
         )
 
     def set_event(self, event):
-        possible_choices = copy.deepcopy(EVENT_BASE_CHOICES)
-        if self.relative_to_order:
-            possible_choices.extend(ORDER_BASE_CHOICES)
-
-        possible_choices = possible_choices
-        choices = _get_choices(possible_choices)
-
-        self.widget.widgets[reldatetimeparts.indizes.rel_days_relationto].choices = choices
-        self.widget.widgets[reldatetimeparts.indizes.rel_mins_relationto].choices = choices
+        self.widget.widgets[reldatetimeparts.indizes.rel_days_relationto].choices = [
+            (k, v) for k, v in BASE_CHOICES if getattr(event, k, None)
+        ]
+        self.widget.widgets[reldatetimeparts.indizes.rel_mins_relationto].choices = [
+            (k, v) for k, v in BASE_CHOICES if getattr(event, k, None)
+        ]
 
     def compress(self, data_list):
         if not data_list:
             return None
         data = reldatetimeparts(*data_list)
-        if data.status == 'unset':
-            return None
-        elif data.status == 'absolute':
+        if data.status == 'absolute':
             return RelativeDateWrapper(data.absolute)
+        elif data.status == 'unset':
+            return None
         elif data.status == 'relative_minutes':
             return RelativeDateWrapper(RelativeDate(
                 days=0,
@@ -586,18 +404,6 @@ class RelativeDateTimeField(forms.MultiValueField):
             raise ValidationError(self.error_messages['incomplete'])
         elif data.status == 'relative_minutes' and (data.rel_mins_number is None or not data.rel_mins_relationto):
             raise ValidationError(self.error_messages['incomplete'])
-        elif data.status == 'relative':
-            choice = BaseChoice.find(BASE_CHOICES, data.rel_days_relationto)
-            if data.rel_days_relation == "before" and not choice.supports_before:
-                raise ValidationError(_('A relative date cannot be expressed as "before" for "{}"'.format(choice.text)))
-            elif data.status == 'relative' and data.rel_days_relation == "after" and not choice.supports_after:
-                raise ValidationError(_('A relative date cannot be expressed as "after" for "{}"'.format(choice.text)))
-        elif data.status == 'relative_minutes':
-            choice = BaseChoice.find(BASE_CHOICES, data.rel_days_relationto)
-            if data.rel_days_relation == "before" and not choice.supports_before:
-                raise ValidationError(_('A relative time cannot be expressed as "before" for "{}"'.format(choice.text)))
-            elif data.rel_days_relation == "after" and not choice.supports_after:
-                raise ValidationError(_('A relative time cannot be expressed as "after" for "{}"'.format(choice.text)))
 
         return super().clean(value)
 
@@ -618,20 +424,15 @@ class RelativeDateWidget(RelativeDateTimeWidget):
 
     def __init__(self, *args, **kwargs):
         self.status_choices = kwargs.pop('status_choices')
-        self.base_choices = kwargs.pop('base_choices')
-        widgets = cast(dict[str, Widget | type[Widget]], cast(object, reldateparts(
+        widgets = reldateparts(
             status=forms.RadioSelect(choices=self.status_choices),
             absolute=forms.DateInput(
                 attrs={'class': 'datepickerfield'}
             ),
             rel_days_number=forms.NumberInput(),
-            rel_days_relationto=OptionAttrsSelect(
-                choices=self.base_choices,
-                option_attrs=_get_choice_validation_obj(self.base_choices),
-                attrs={'data-relative-choice': True},
-            ),
-            rel_days_relation=forms.Select(choices=BEFORE_AFTER_CHOICE, attrs={'data-relation-choice': True},),
-        )))
+            rel_days_relationto=forms.Select(choices=kwargs.pop('base_choices')),
+            rel_days_relation=forms.Select(choices=BEFORE_AFTER_CHOICE),
+        )
         forms.MultiWidget.__init__(self, widgets=widgets, *args, **kwargs)
 
     def decompress(self, value):
@@ -659,7 +460,7 @@ class RelativeDateWidget(RelativeDateTimeWidget):
             status="relative",
             absolute=None,
             rel_days_number=value.data.days,
-            rel_days_relationto=value.data.key,
+            rel_days_relationto=value.data.base_date_name,
             rel_days_relation="after" if value.data.is_after else "before"
         )
 
@@ -673,15 +474,6 @@ class RelativeDateField(RelativeDateTimeField):
         ]
         if not kwargs.get('required', True):
             status_choices.insert(0, ('unset', _('Not set')))
-
-        self.relative_to_order = kwargs.pop('relative_to_order', False)
-
-        possible_choices = copy.deepcopy(EVENT_BASE_CHOICES)
-        if self.relative_to_order:
-            possible_choices.extend(ORDER_BASE_CHOICES)
-
-        choices = _get_choices(possible_choices)
-
         fields = reldateparts(
             status=forms.ChoiceField(
                 choices=status_choices,
@@ -694,37 +486,33 @@ class RelativeDateField(RelativeDateTimeField):
                 required=False
             ),
             rel_days_relationto=forms.ChoiceField(
-                choices=choices,
-                required=False,
+                choices=BASE_CHOICES,
+                required=False
             ),
             rel_days_relation=forms.ChoiceField(
                 choices=BEFORE_AFTER_CHOICE,
                 required=False
             ),
         )
-
         if 'widget' not in kwargs:
-            kwargs['widget'] = RelativeDateWidget(status_choices=status_choices, base_choices=possible_choices)
+            kwargs['widget'] = RelativeDateWidget(status_choices=status_choices, base_choices=BASE_CHOICES)
         forms.MultiValueField.__init__(
             self, fields=fields, require_all_fields=False, *args, **kwargs
         )
 
     def set_event(self, event):
-        choices = [
-            (c.key, c.text) for c in EVENT_BASE_CHOICES if getattr(event, c.attribute, None)
+        self.widget.widgets[reldateparts.indizes.rel_days_relationto].choices = [
+            (k, v) for k, v in BASE_CHOICES if getattr(event, k, None)
         ]
-        if self.relative_to_order:
-            choices += [(c.key, c.text) for c in ORDER_BASE_CHOICES]
-        self.widget.widgets[reldateparts.indizes.rel_days_relationto].choices = choices
 
     def compress(self, data_list):
         if not data_list:
             return None
         data = reldateparts(*data_list)
-        if data.status == 'unset':
-            return None
-        elif data.status == 'absolute':
+        if data.status == 'absolute':
             return RelativeDateWrapper(data.absolute)
+        elif data.status == 'unset':
+            return None
         else:
             return RelativeDateWrapper(RelativeDate(
                 days=data.rel_days_number,
@@ -737,14 +525,8 @@ class RelativeDateField(RelativeDateTimeField):
         data = reldateparts(*value)
         if data.status == 'absolute' and not data.absolute:
             raise ValidationError(self.error_messages['incomplete'])
-        if data.status == 'relative':
-            choice = BaseChoice.find(BASE_CHOICES, data.rel_days_relationto)
-            if data.rel_days_number is None or not data.rel_days_relationto:
-                raise ValidationError(self.error_messages['incomplete'])
-            elif data.rel_days_relation == "before" and not choice.supports_before:
-                raise ValidationError(_("A relative date cannot be expressed as 'before' for '{}'".format(choice.text)))
-            elif data.rel_days_relation == "after" and not choice.supports_after:
-                raise ValidationError(_("A relative date cannot be expressed as 'after' for '{}'".format(choice.text)))
+        elif data.status == 'relative' and (data.rel_days_number is None or not data.rel_days_relationto):
+            raise ValidationError(self.error_messages['incomplete'])
 
         return forms.MultiValueField.clean(self, value)
 

src/pretix/base/templatetags/vite.py

@@ -19,12 +19,10 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-
 import json
 import logging
 import pathlib
 import re
-import secrets
 from urllib.parse import urljoin
 from urllib.request import urlopen
 
@@ -33,6 +31,10 @@ from django import template
 from django.conf import settings
 from django.utils.safestring import mark_safe
 
+from pretix.base.middleware import (
+    add_to_response_csp_via_request, calculate_csp_hash,
+)
+
 register = template.Library()
 LOGGER = logging.getLogger(__name__)
 _MANIFEST = {}
@@ -234,10 +236,16 @@ def vite_importmap(context):
     if not imports:
         return ""
 
-    # Generate a nonce and store it on the request so the CSP middleware can allow it
-    nonce = secrets.token_urlsafe(16)
+    json_string = json.dumps({"imports": imports})
+
+    # Calculate hash and add it to the CSP info in the request, so that will be merged into the
+    # response header later on by the middleware
     request = context.get('request')
     if request:
-        request.csp_nonce = nonce
+        csp_hash = calculate_csp_hash(json_string)
+        add_to_response_csp_via_request(request, {
+            'style-src': [csp_hash],
+            'script-src': [csp_hash],
+        })
 
-    return f'<script type="importmap" nonce="{nonce}">{json.dumps({"imports": imports})}</script>'
+    return f'<script type="importmap">{json_string}</script>'

src/pretix/control/forms/filter.py

@@ -39,6 +39,7 @@ from urllib.parse import urlencode
 from django import forms
 from django.apps import apps
 from django.conf import settings
+from django.contrib.contenttypes.models import ContentType
 from django.db.models import (
     Count, Exists, F, Max, Model, OrderBy, OuterRef, Q, QuerySet,
 )
@@ -59,7 +60,7 @@ from pretix.base.models import (
     Gate, Invoice, InvoiceAddress, Item, Order, OrderPayment, OrderPosition,
     OrderRefund, Organizer, OutgoingMail, Question, QuestionAnswer, Quota,
     SalesChannel, SubEvent, SubEventMetaValue, Team, TeamAPIToken, TeamInvite,
-    Voucher,
+    User, Voucher,
 )
 from pretix.base.signals import register_payment_providers
 from pretix.base.timeframes import (
@@ -3007,3 +3008,91 @@ class OutgoingMailFilterForm(FilterForm):
             qs = qs.order_by("-created", "-pk")
 
         return qs
+
+
+class LogFilterForm(FilterForm):
+    source = forms.ChoiceField(
+        label=_('Source'),
+        choices=[
+            ('', _('All sources')),
+            ('team', _('Team actions')),
+            ('customer', _('Customer actions')),
+            ('device', _('Device actions')),
+        ],
+        required=False
+    )
+    device = SafeModelChoiceField(
+        label=_('Device'),
+        empty_label=_('All devices'),
+        queryset=Device.objects.none(),
+        required=False
+    )
+    user_email = forms.EmailField(
+        label=_('User email'),
+        widget=forms.EmailInput(
+            attrs={"placeholder": _('All users')}
+        ),
+        required=False
+    )
+    action_type = forms.CharField(
+        widget=forms.HiddenInput,
+        required=False,
+    )
+    content_type = forms.ModelChoiceField(
+        queryset=ContentType.objects.all(),
+        widget=forms.HiddenInput,
+        required=False,
+    )
+    object = forms.IntegerField(
+        widget=forms.HiddenInput,
+        required=False
+    )
+
+    def __init__(self, *args, **kwargs):
+        self.organizer = kwargs.pop('organizer')
+        super().__init__(*args, **kwargs)
+
+        self.fields['device'].queryset = self.organizer.devices.all().order_by('device_id')
+        self.fields['device'].widget = Select2(
+            attrs={
+                'data-model-select2': 'generic',
+                'data-select2-url': reverse('control:organizer.devices.select2', kwargs={
+                    'organizer': self.organizer.slug,
+                }),
+                'data-placeholder': _('All devices'),
+            }
+        )
+        self.fields['device'].widget.choices = self.fields['device'].choices
+        self.fields['device'].label = _('Device')
+
+    def filter_qs(self, qs):
+        fdata = self.cleaned_data
+        if fdata.get('source') == 'team':
+            qs = qs.filter(user__isnull=False)
+        elif fdata.get('source') == 'device':
+            qs = qs.filter(device__isnull=False)
+        elif fdata.get('source') == 'customer':
+            qs = qs.filter(user__isnull=True, device__isnull=True)
+
+        if fdata.get('device'):
+            qs = qs.filter(device_id=fdata['device'].pk)
+
+        if fdata.get('action_type'):
+            qs = qs.filter(action_type__in=fdata['action_type'].split(','))
+
+        if fdata.get('user_email'):
+            try:
+                user = User.objects.get(email=fdata['user_email'].lower())
+                qs = qs.filter(user=user)
+            except User.DoesNotExist:
+                # Do not actively leak info that this user does not exist. Yes, this will likely have a
+                # timing attack possibility, but with the magic that database query planners do,
+                # it's probably impossible to avoid that.
+                qs = qs.none()
+
+        if fdata.get('content_type'):
+            qs = qs.filter(content_type=fdata.get('content_type'))
+
+            if fdata.get('object'):
+                qs = qs.filter(object_id=fdata.get('object'))
+        return qs

src/pretix/control/forms/subevents.py

@@ -94,14 +94,14 @@ class SubEventBulkForm(SubEventForm):
         label=_('Start of presale'),
         help_text=_('Optional. No products will be sold before this date.'),
         required=False,
-        limit_choices=('event__date_from', 'event__date_to'),
+        limit_choices=('date_from', 'date_to'),
     )
     rel_presale_end = RelativeDateTimeField(
         label=_('End of presale'),
         help_text=_('Optional. No products will be sold after this date. If you do not set this value, the presale '
                     'will end after the end date of your event.'),
         required=False,
-        limit_choices=('event__date_from', 'event__date_to'),
+        limit_choices=('date_from', 'date_to'),
     )
     skip_if_overlap = forms.BooleanField(
         label=pgettext_lazy('subevent', 'Skip dates that overlap with any existing date'),
@@ -333,12 +333,12 @@ class BulkSubEventItemForm(SubEventItemForm):
     rel_available_from = RelativeDateTimeField(
         label=_('Available from'),
         required=False,
-        limit_choices=('event__date_from', 'event__date_to'),
+        limit_choices=('date_from', 'date_to'),
     )
     rel_available_until = RelativeDateTimeField(
         label=_('Available until'),
         required=False,
-        limit_choices=('event__date_from', 'event__date_to'),
+        limit_choices=('date_from', 'date_to'),
     )
 
     def __init__(self, *args, **kwargs):
@@ -355,12 +355,12 @@ class BulkSubEventItemVariationForm(SubEventItemVariationForm):
     rel_available_from = RelativeDateTimeField(
         label=_('Available from'),
         required=False,
-        limit_choices=('event__date_from', 'event__date_to'),
+        limit_choices=('date_from', 'date_to'),
     )
     rel_available_until = RelativeDateTimeField(
         label=_('Available_until'),
         required=False,
-        limit_choices=('event__date_from', 'event__date_to'),
+        limit_choices=('date_from', 'date_to'),
     )
 
     def __init__(self, *args, **kwargs):

src/pretix/control/templates/pretixcontrol/base.html

@@ -58,7 +58,6 @@
             <script type="text/javascript" src="{% static "leaflet/leaflet.js" %}"></script>
             <script type="text/javascript" src="{% static "pretixcontrol/js/ui/geo.js" %}"></script>
             <script type="text/javascript" src="{% static "pretixbase/js/details.js" %}"></script>
-            <script type="text/javascript" src="{% static "pretixbase/js/reldate.js" %}"></script>
             <script type="text/javascript" src="{% static "pretixbase/js/asynctask.js" %}"></script>
             <script type="text/javascript" src="{% static "sortable/Sortable.js" %}"></script>
             <script type="text/javascript" src="{% static "colorpicker/bootstrap-colorpicker.js" %}"></script>

src/pretix/control/templates/pretixcontrol/event/dashboard_partial_warnings.html

@@ -0,0 +1,58 @@
+{% load i18n %}
+{% if has_overpaid_orders %}
+    <div class="alert alert-warning">
+        {% blocktrans trimmed %}
+            This event contains <strong>overpaid orders</strong>, for example due to duplicate payment attempts.
+            You should review the cases and consider refunding the overpaid amount to the user.
+        {% endblocktrans %}
+        <a href="{% url "control:event.orders" event=request.event.slug organizer=request.event.organizer.slug %}?status=overpaid"
+                class="btn btn-primary">{% trans "Show overpaid orders" %}</a>
+    </div>
+{% endif %}
+{% if has_pending_refunds %}
+    <div class="alert alert-warning">
+        {% blocktrans trimmed %}
+            This event contains <strong>pending refunds</strong> that you should take care of.
+        {% endblocktrans %}
+        <a href="{% url "control:event.orders.refunds" event=request.event.slug organizer=request.event.organizer.slug %}"
+           class="btn btn-primary">{% trans "Show pending refunds" %}</a>
+    </div>
+{% endif %}
+{% if has_cancellation_requests %}
+    <div class="alert alert-warning">
+        {% blocktrans trimmed %}
+            This event contains <strong>requested cancellations</strong> that you should take care of.
+        {% endblocktrans %}
+        <a href="{% url "control:event.orders" event=request.event.slug organizer=request.event.organizer.slug %}?status=rc"
+           class="btn btn-primary">{% trans "Show orders requesting cancellation" %}</a>
+    </div>
+{% endif %}
+{% if has_pending_approvals %}
+    <div class="alert alert-warning">
+        {% blocktrans trimmed %}
+            This event contains <strong>pending approvals</strong> that you should take care of.
+        {% endblocktrans %}
+        <a href="{% url "control:event.orders" event=request.event.slug organizer=request.event.organizer.slug %}?status=pa"
+           class="btn btn-primary">{% trans "Show orders pending approval" %}</a>
+    </div>
+{% endif %}
+{% if has_pending_orders_with_full_payment %}
+    <div class="alert alert-warning">
+        {% blocktrans trimmed %}
+            This event contains <strong>fully paid orders</strong> that are not marked as paid, probably
+            because no quota was left at the time their payment arrived. You should review the cases and consider
+            either refunding the customer or creating more space.
+        {% endblocktrans %}
+        <a href="{% url "control:event.orders" event=request.event.slug organizer=request.event.organizer.slug %}?status=pendingpaid"
+           class="btn btn-primary">{% trans "Show affected orders" %}</a>
+    </div>
+{% endif %}
+{% if has_sync_problems %}
+    <div class="alert alert-warning">
+        {% blocktrans trimmed %}
+            Orders in this event could not be <strong>synced to an external system</strong> as configured.
+        {% endblocktrans %}
+        <a href="{% url "control:event.datasync.failedjobs" event=request.event.slug organizer=request.event.organizer.slug %}"
+           class="btn btn-primary">{% trans "Show sync problems" %}</a>
+    </div>
+{% endif %}

src/pretix/control/templates/pretixcontrol/event/index.html

@@ -14,6 +14,7 @@
             {% else %}
                 {{ request.event.get_date_range_display }}
             {% endif %}
+            <span id="warnings_loading" class="fa fa-cog fa-spin"></span>
         </small>
     </h1>
     <div class="helper-space-below">
@@ -31,63 +32,7 @@
         </div>
         <div class="clearfix"></div>
     </div>
-    {% if has_overpaid_orders %}
-        <div class="alert alert-warning">
-            {% blocktrans trimmed %}
-                This event contains <strong>overpaid orders</strong>, for example due to duplicate payment attempts.
-                You should review the cases and consider refunding the overpaid amount to the user.
-            {% endblocktrans %}
-            <a href="{% url "control:event.orders" event=request.event.slug organizer=request.event.organizer.slug %}?status=overpaid"
-                    class="btn btn-primary">{% trans "Show overpaid orders" %}</a>
-        </div>
-    {% endif %}
-    {% if has_pending_refunds %}
-        <div class="alert alert-warning">
-            {% blocktrans trimmed %}
-                This event contains <strong>pending refunds</strong> that you should take care of.
-            {% endblocktrans %}
-            <a href="{% url "control:event.orders.refunds" event=request.event.slug organizer=request.event.organizer.slug %}"
-                    class="btn btn-primary">{% trans "Show pending refunds" %}</a>
-        </div>
-    {% endif %}
-    {% if has_cancellation_requests %}
-        <div class="alert alert-warning">
-            {% blocktrans trimmed %}
-                This event contains <strong>requested cancellations</strong> that you should take care of.
-            {% endblocktrans %}
-            <a href="{% url "control:event.orders" event=request.event.slug organizer=request.event.organizer.slug %}?status=rc"
-                    class="btn btn-primary">{% trans "Show orders requesting cancellation" %}</a>
-        </div>
-    {% endif %}
-    {% if has_pending_approvals %}
-        <div class="alert alert-warning">
-            {% blocktrans trimmed %}
-                This event contains <strong>pending approvals</strong> that you should take care of.
-            {% endblocktrans %}
-            <a href="{% url "control:event.orders" event=request.event.slug organizer=request.event.organizer.slug %}?status=pa"
-                    class="btn btn-primary">{% trans "Show orders pending approval" %}</a>
-        </div>
-    {% endif %}
-    {% if has_pending_orders_with_full_payment %}
-        <div class="alert alert-warning">
-            {% blocktrans trimmed %}
-                This event contains <strong>fully paid orders</strong> that are not marked as paid, probably
-                because no quota was left at the time their payment arrived. You should review the cases and consider
-                either refunding the customer or creating more space.
-            {% endblocktrans %}
-            <a href="{% url "control:event.orders" event=request.event.slug organizer=request.event.organizer.slug %}?status=pendingpaid"
-                    class="btn btn-primary">{% trans "Show affected orders" %}</a>
-        </div>
-    {% endif %}
-    {% if has_sync_problems %}
-        <div class="alert alert-warning">
-            {% blocktrans trimmed %}
-                Orders in this event could not be <strong>synced to an external system</strong> as configured.
-            {% endblocktrans %}
-            <a href="{% url "control:event.datasync.failedjobs" event=request.event.slug organizer=request.event.organizer.slug %}"
-                    class="btn btn-primary">{% trans "Show sync problems" %}</a>
-        </div>
-    {% endif %}
+    <div id="warnings_target"></div>
     {% eventsignal request.event "pretix.control.signals.event_dashboard_top" request=request %}
 
     {% if request.event.has_subevents %}

src/pretix/control/templates/pretixcontrol/event/logs.html

@@ -1,41 +1,12 @@
 {% extends "pretixcontrol/items/base.html" %}
 {% load i18n %}
 {% load static %}
+{% load bootstrap3 %}
+{% load icon %}
 {% block title %}{% trans "Event logs" %}{% endblock %}
 {% block inside %}
     <h1>{% trans "Event logs" %}</h1>
-    <form class="form-inline helper-display-inline" action="" method="get">
-        <input type="hidden" name="content_type" value="{{ request.GET.content_type }}">
-        <input type="hidden" name="object" value="{{ request.GET.object }}">
-        <p>
-            <select name="user" class="form-control">
-                <option value="">{% trans "All actions" %}</option>
-                <option value="yes" {% if request.GET.user == "yes" %}selected="selected"{% endif %}>
-                    {% trans "Team actions" %}
-                </option>
-                <option value="no" {% if request.GET.user == "no" %}selected="selected"{% endif %}>
-                    {% trans "Customer actions" %}
-                </option>
-                {% for up in userlist %}
-                    {% if up.user__id %}
-                        <option value="{{ up.user__id }}"
-                                {% if request.GET.user == up.user__id %}selected="selected"{% endif %}>
-                            {{ up.user__email }}
-                        </option>
-                    {% endif %}
-                {% endfor %}
-                {% for d in devicelist %}
-                    {% if d.device__id %}
-                        <option value="d-{{ d.device__id }}"
-                                {% if "d-" in request.GET.user and request.GET.user|slice:"2:" == d.device__id|slugify %}selected="selected"{% endif %}>
-                            {{ d.device__name }}
-                        </option>
-                    {% endif %}
-                {% endfor %}
-            </select>
-            <button class="btn btn-primary" type="submit">{% trans "Filter" %}</button>
-        </p>
-    </form>
+    {% include "pretixcontrol/fragment_log_filter_form.html" %}
     <ul class="list-group">
         {% for log in logs %}
             <li class="list-group-item logentry">
@@ -95,5 +66,5 @@
             </div>
         {% endfor %}
     </ul>
-    {% include "pretixcontrol/pagination.html" %}
+    {% include "pretixcontrol/pagination_huge.html" %}
 {% endblock %}

src/pretix/control/templates/pretixcontrol/fragment_log_filter_form.html

@@ -0,0 +1,38 @@
+{% load i18n %}
+{% load bootstrap3 %}
+{% load icon %}
+<div class="panel panel-default">
+    <div class="panel-heading">
+        <h3 class="panel-title">
+            {% trans "Filter" %}
+        </h3>
+    </div>
+    <form class="panel-body filter-form" action="" method="get">
+        <div class="row">
+            <div class="col-md-3 col-xs-6">
+                {% bootstrap_field filter_form.source %}
+            </div>
+            <div class="col-md-3 col-xs-6">
+                {% bootstrap_field filter_form.device %}
+            </div>
+            <div class="col-md-3 col-xs-6">
+                {% bootstrap_field filter_form.user_email %}
+            </div>
+        </div>
+        {{ filter_form.action_type }}
+        {{ filter_form.content_type }}
+        {{ filter_form.object }}
+        {% if filter_form.is_valid and filter_form.cleaned_data.action_type %}
+            {% icon "filter" %} <code>{{ filter_form.cleaned_data.action_type }}</code>
+        {% endif %}
+        {% if filter_form.is_valid and filter_form.cleaned_data.content_type and filter_form.cleaned_data.object %}
+            {% icon "filter" %} {% trans "Specific object selected" %}
+        {% endif %}
+        <div class="text-right flip">
+            <button class="btn btn-primary btn-lg" type="submit">
+                <span class="fa fa-filter"></span>
+                {% trans "Filter" %}
+            </button>
+        </div>
+    </form>
+</div>

src/pretix/control/templates/pretixcontrol/organizers/logs.html

@@ -4,24 +4,7 @@
 {% block title %}{% trans "Organizer logs" %}{% endblock %}
 {% block inside %}
     <h1>{% trans "Organizer logs" %}</h1>
-    <form class="form-inline helper-display-inline" action="" method="get">
-        <input type="hidden" name="content_type" value="{{ request.GET.content_type }}">
-        <input type="hidden" name="object" value="{{ request.GET.object }}">
-        <p>
-            <select name="user" class="form-control">
-                <option value="">{% trans "All actions" %}</option>
-                {% for up in userlist %}
-                    {% if up.user__id %}
-                        <option value="{{ up.user__id }}"
-                                {% if request.GET.user == up.user__id %}selected="selected"{% endif %}>
-                            {{ up.user__email }}
-                        </option>
-                    {% endif %}
-                {% endfor %}
-            </select>
-            <button class="btn btn-primary" type="submit">{% trans "Filter" %}</button>
-        </p>
-    </form>
+    {% include "pretixcontrol/fragment_log_filter_form.html" %}
     <ul class="list-group">
         {% for log in logs %}
             <li class="list-group-item logentry">
@@ -81,5 +64,5 @@
             </div>
         {% endfor %}
     </ul>
-    {% include "pretixcontrol/pagination.html" %}
+    {% include "pretixcontrol/pagination_huge.html" %}
 {% endblock %}

src/pretix/control/urls.py

@@ -273,7 +273,8 @@ urlpatterns = [
         re_path(r'^$', dashboards.event_index, name='event.index'),
         re_path(r'^qrcode.(?P<filetype>(png|jpeg|gif|svg))$', event.EventQRCode.as_view(), name='event.qrcode'),
         re_path(r'^widgets.json$', dashboards.event_index_widgets_lazy, name='event.index.widgets'),
-        re_path(r'^logs/embed$', dashboards.event_index_log_lazy, name='event.index.logs'),
+        re_path(r'^dashboard/partials/logs$', dashboards.event_index_log_lazy, name='event.index.logs'),
+        re_path(r'^dashboard/partials/warnings$', dashboards.event_index_warnings_lazy, name='event.index.warnings'),
         re_path(r'^live/$', event.EventLive.as_view(), name='event.live'),
         re_path(r'^transfer_session/$', event.EventTransferSession.as_view(), name='event.transfer_session'),
         re_path(r'^logs/$', event.EventLog.as_view(), name='event.log'),

src/pretix/control/views/dashboards.py

@@ -379,6 +379,42 @@ def event_index(request, organizer, event):
         'comment_form': CommentForm(initial={'comment': request.event.comment}, readonly=not can_change_event_settings),
     }
 
+    ctx['timeline'] = [
+        {
+            'date': t.datetime.astimezone(request.event.timezone).date(),
+            'entry': t,
+            'time': t.datetime.astimezone(request.event.timezone)
+        }
+        for t in timeline_for_event(request.event, subevent)
+    ]
+    ctx['today'] = now().astimezone(request.event.timezone).date()
+    ctx['nearly_now'] = now().astimezone(request.event.timezone) - timedelta(seconds=20)
+    resp = render(request, 'pretixcontrol/event/index.html', ctx)
+    return resp
+
+
+def event_index_widgets_lazy(request, organizer, event):
+    subevent = None
+    if request.GET.get("subevent", "") != "" and request.event.has_subevents:
+        i = request.GET.get("subevent", "")
+        try:
+            subevent = request.event.subevents.get(pk=i)
+        except SubEvent.DoesNotExist:
+            pass
+
+    widgets = []
+    for r, result in event_dashboard_widgets.send(sender=request.event, subevent=subevent, lazy=False):
+        widgets.extend(result)
+
+    return build_json_response(widgets)
+
+
+def event_index_warnings_lazy(request, organizer, event):
+    can_view_orders = request.user.has_event_permission(request.organizer, request.event, 'event.orders:read',
+                                                        request=request)
+    can_change_event_settings = request.user.has_event_permission(request.organizer, request.event,
+                                                                  'event.settings.general:write', request=request)
+    ctx = {}
     ctx['has_overpaid_orders'] = can_view_orders and Order.annotate_overpayments(request.event.orders).filter(
         Q(~Q(status=Order.STATUS_CANCELED) & Q(pending_sum_t__lt=0))
         | Q(Q(status=Order.STATUS_CANCELED) & Q(pending_sum_rc__lt=0))
@@ -402,35 +438,11 @@ def event_index(request, organizer, event):
         | Q(failed_attempts__gt=0)
     ).exists()
 
-    ctx['timeline'] = [
-        {
-            'date': t.datetime.astimezone(request.event.timezone).date(),
-            'entry': t,
-            'time': t.datetime.astimezone(request.event.timezone)
-        }
-        for t in timeline_for_event(request.event, subevent)
-    ]
-    ctx['today'] = now().astimezone(request.event.timezone).date()
-    ctx['nearly_now'] = now().astimezone(request.event.timezone) - timedelta(seconds=20)
-    resp = render(request, 'pretixcontrol/event/index.html', ctx)
-    # resp['Content-Security-Policy'] = "style-src 'unsafe-inline'"
-    return resp
-
-
-def event_index_widgets_lazy(request, organizer, event):
-    subevent = None
-    if request.GET.get("subevent", "") != "" and request.event.has_subevents:
-        i = request.GET.get("subevent", "")
-        try:
-            subevent = request.event.subevents.get(pk=i)
-        except SubEvent.DoesNotExist:
-            pass
-
-    widgets = []
-    for r, result in event_dashboard_widgets.send(sender=request.event, subevent=subevent, lazy=False):
-        widgets.extend(result)
-
-    return build_json_response(widgets)
+    return render(
+        request,
+        'pretixcontrol/event/dashboard_partial_warnings.html',
+        ctx
+    )
 
 
 def event_index_log_lazy(request, organizer, event):
@@ -465,7 +477,7 @@ def event_index_log_lazy(request, organizer, event):
 
     return render(
         request,
-        'pretixcontrol/event/logs_embed.html',
+        'pretixcontrol/event/dashboard_partial_logs.html',
         {
             'logs': qs[:5]
         }

src/pretix/control/views/event.py

@@ -60,7 +60,7 @@ from django.http import (
     Http404, HttpResponse, HttpResponseBadRequest, HttpResponseNotAllowed,
     JsonResponse,
 )
-from django.shortcuts import get_object_or_404, redirect
+from django.shortcuts import redirect
 from django.urls import NoReverseMatch, reverse
 from django.utils.functional import cached_property
 from django.utils.html import conditional_escape, format_html
@@ -119,8 +119,9 @@ from ...helpers.compat import CompatDeleteView
 from ...helpers.format import (
     PlainHtmlAlternativeString, SafeFormatter, format_map,
 )
+from ..forms.filter import LogFilterForm
 from ..logdisplay import OVERVIEW_BANLIST
-from . import CreateView, PaginationMixin, UpdateView
+from . import CreateView, LargeResultSetPaginator, PaginationMixin, UpdateView
 
 logger = logging.getLogger(__name__)
 
@@ -1253,6 +1254,7 @@ class EventDelete(RecentAuthenticationRequiredMixin, EventPermissionRequiredMixi
 class EventLog(EventPermissionRequiredMixin, PaginationMixin, ListView):
     template_name = 'pretixcontrol/event/logs.html'
     model = LogEntry
+    paginator_class = LargeResultSetPaginator
     context_object_name = 'logs'
 
     def get_queryset(self):
@@ -1282,32 +1284,20 @@ class EventLog(EventPermissionRequiredMixin, PaginationMixin, ListView):
                 ]
             qs = qs.filter(content_type__in=allowed_types)
 
-        if self.request.GET.get('user') == 'yes':
-            qs = qs.filter(user__isnull=False)
-        elif self.request.GET.get('user') == 'no':
-            qs = qs.filter(user__isnull=True)
-        elif self.request.GET.get('user', '').startswith('d-'):
-            qs = qs.filter(device_id=self.request.GET.get('user')[2:])
-        elif self.request.GET.get('user'):
-            qs = qs.filter(user_id=self.request.GET.get('user'))
-
-        if self.request.GET.get('action_type'):
-            qs = qs.filter(action_type=self.request.GET['action_type'])
-
-        if self.request.GET.get('content_type'):
-            qs = qs.filter(content_type=get_object_or_404(ContentType, pk=self.request.GET.get('content_type')))
-
-            if self.request.GET.get('object'):
-                qs = qs.filter(object_id=self.request.GET.get('object'))
+        if self.filter_form.is_valid():
+            qs = self.filter_form.filter_qs(qs)
 
         return qs
 
     def get_context_data(self, **kwargs):
         ctx = super().get_context_data()
-        ctx['userlist'] = self.request.event.logentry_set.order_by().distinct().values('user__id', 'user__email')
-        ctx['devicelist'] = self.request.event.logentry_set.order_by('device__name').distinct().values('device__id', 'device__name')
+        ctx['filter_form'] = self.filter_form
         return ctx
 
+    @cached_property
+    def filter_form(self):
+        return LogFilterForm(data=self.request.GET, organizer=self.request.organizer)
+
 
 class EventComment(EventPermissionRequiredMixin, View):
     permission = 'event.settings.general:write'

src/pretix/control/views/mail.py

@@ -35,7 +35,7 @@ from django.utils.translation import ngettext
 from django.views import View
 from django.views.generic import DetailView, ListView
 
-from pretix.base.middleware import _merge_csp, _parse_csp, _render_csp
+from pretix.base.middleware import add_to_response_csp
 from pretix.base.models import OutgoingMail
 from pretix.base.services.mail import mail_send_task
 from pretix.control.forms.filter import OutgoingMailFilterForm
@@ -108,18 +108,12 @@ class OutgoingMailDetailView(OrganizerDetailViewMixin, OrganizerPermissionRequir
 
     def dispatch(self, request, *args, **kwargs):
         response = super().dispatch(request, *args, **kwargs)
-        if 'Content-Security-Policy' in response:
-            h = _parse_csp(response['Content-Security-Policy'])
-        else:
-            h = {}
-        csps = {
+        add_to_response_csp(response, {
             'frame-src': ['data:'],
             # Unfortuantely, we can't avoid unsafe-inline for style here.
             # See outgoingmail.js for the protection measures we take.
             'style-src': ["'unsafe-inline'"],
-        }
-        _merge_csp(h, csps)
-        response['Content-Security-Policy'] = _render_csp(h)
+        })
         return response
 
     def get_context_data(self, **kwargs):

src/pretix/control/views/organizer.py

@@ -113,7 +113,8 @@ from pretix.base.views.tasks import AsyncAction
 from pretix.control.forms.exports import ScheduledOrganizerExportForm
 from pretix.control.forms.filter import (
     CustomerFilterForm, DeviceFilterForm, EventFilterForm, GiftCardFilterForm,
-    OrganizerFilterForm, ReusableMediaFilterForm, TeamFilterForm,
+    LogFilterForm, OrganizerFilterForm, ReusableMediaFilterForm,
+    TeamFilterForm,
 )
 from pretix.control.forms.orders import ExporterForm
 from pretix.control.forms.organizer import (
@@ -133,7 +134,7 @@ from pretix.control.permissions import (
     organizer_permission_required,
 )
 from pretix.control.signals import nav_organizer
-from pretix.control.views import PaginationMixin
+from pretix.control.views import LargeResultSetPaginator, PaginationMixin
 from pretix.control.views.mailsetup import MailSettingsSetupView
 from pretix.helpers import OF_SELF, GroupConcat
 from pretix.helpers.compat import CompatDeleteView
@@ -2663,6 +2664,7 @@ class LogView(OrganizerPermissionRequiredMixin, PaginationMixin, ListView):
     template_name = 'pretixcontrol/organizers/logs.html'
     permission = 'organizer.settings.general:write'
     model = LogEntry
+    paginator_class = LargeResultSetPaginator
     context_object_name = 'logs'
 
     def get_queryset(self):
@@ -2672,16 +2674,21 @@ class LogView(OrganizerPermissionRequiredMixin, PaginationMixin, ListView):
             'user', 'content_type', 'api_token', 'oauth_application', 'device'
         ).order_by('-datetime')
         qs = qs.exclude(action_type__in=OVERVIEW_BANLIST)
-        if self.request.GET.get('action_type'):
-            qs = qs.filter(action_type=self.request.GET['action_type'])
-        if self.request.GET.get('user'):
-            qs = qs.filter(user_id=self.request.GET.get('user'))
+
+        if self.filter_form.is_valid():
+            qs = self.filter_form.filter_qs(qs)
+
         return qs
 
     def get_context_data(self, **kwargs):
         ctx = super().get_context_data()
+        ctx['filter_form'] = self.filter_form
         return ctx
 
+    @cached_property
+    def filter_form(self):
+        return LogFilterForm(data=self.request.GET, organizer=self.request.organizer)
+
 
 class MembershipTypeListView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, ListView):
     model = MembershipType

src/pretix/control/views/subevents.py

@@ -431,7 +431,7 @@ class SubEventEditorMixin(MetaDataEditorMixin):
         days = (self.copy_from.date_from.astimezone(tz).date() - value.astimezone(tz).date()).days
         return RelativeDateWrapper(RelativeDate(
             days=abs(days),
-            base_date_name='event__date_from',
+            base_date_name='date_from',
             time=value.astimezone(tz).time(),
             minutes=None,
             is_after=days < 0,

src/pretix/helpers/monkeypatching.py

@@ -19,7 +19,6 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-import ipaddress
 import socket
 import sys
 import types
@@ -42,8 +41,7 @@ from urllib3.util.connection import (
 from urllib3.util.timeout import _DEFAULT_TIMEOUT
 
 from pretix.helpers.reportlab import ThumbnailingImageReader
-
-_cgnat_net = ipaddress.ip_network('100.64.0.0/10')
+from pretix.helpers.ssrf import should_block_access
 
 
 def monkeypatch_vobject_performance():
@@ -150,16 +148,9 @@ def monkeypatch_urllib3_ssrf_protection():
             af, socktype, proto, canonname, sa = res
 
             if not getattr(settings, "ALLOW_HTTP_TO_PRIVATE_NETWORKS", False):
-                ip_addr = ipaddress.ip_address(sa[0])
-                check_ip4 = ip_addr.ipv4_mapped if getattr(ip_addr, "ipv4_mapped", None) else ip_addr
-                if ip_addr.is_multicast:
-                    raise HTTPError(f"Request to multicast address {sa[0]} blocked")
-                if ip_addr.is_loopback or ip_addr.is_link_local:
-                    raise HTTPError(f"Request to local address {sa[0]} blocked")
-                if ip_addr.is_private:
-                    raise HTTPError(f"Request to private address {sa[0]} blocked")
-                if check_ip4 in _cgnat_net:
-                    raise HTTPError(f"Request to RFC 6598 address {sa[0]} blocked")
+                is_private, msg = should_block_access(sa)
+                if is_private:
+                    raise HTTPError(msg)
 
             sock = None
             try:

src/pretix/helpers/ssrf.py

@@ -0,0 +1,40 @@
+#
+# This file is part of pretix (Community Edition).
+#
+# Copyright (C) 2014-2020  Raphael Michel and contributors
+# Copyright (C) 2020-today pretix GmbH and contributors
+#
+# This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
+# Public License as published by the Free Software Foundation in version 3 of the License.
+#
+# ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are
+# applicable granting you additional permissions and placing additional restrictions on your usage of this software.
+# Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive
+# this file, see <https://pretix.eu/about/en/license>.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
+# details.
+#
+# You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
+# <https://www.gnu.org/licenses/>.
+#
+
+import ipaddress
+
+_cgnat_net = ipaddress.ip_network('100.64.0.0/10')
+
+
+def should_block_access(sa):
+    ip_addr = ipaddress.ip_address(sa[0])
+    check_ip4 = ip_addr.ipv4_mapped if getattr(ip_addr, "ipv4_mapped", None) else ip_addr
+    if ip_addr.is_multicast:
+        return True, f"Request to multicast address {sa[0]} blocked"
+    if ip_addr.is_loopback or ip_addr.is_link_local:
+        return True, f"Request to local address {sa[0]} blocked"
+    if ip_addr.is_private:
+        return True, f"Request to private address {sa[0]} blocked"
+    if check_ip4 in _cgnat_net:
+        return True, f"Request to RFC 6598 address {sa[0]} blocked"
+
+    return False, None

src/pretix/locale/ar/LC_MESSAGES/django.po

@@ -8,8 +8,8 @@ msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-07-07 09:30+0000\n"
-"PO-Revision-Date: 2026-07-13 12:35+0000\n"
-"Last-Translator: ahmed badr <ahmedbadr@oma.com.eg>\n"
+"PO-Revision-Date: 2026-07-20 08:01+0000\n"
+"Last-Translator: Raphael Michel <michel@rami.io>\n"
 "Language-Team: Arabic <https://translate.pretix.eu/projects/pretix/pretix/"
 "ar/>\n"
 "Language: ar\n"

src/pretix/plugins/banktransfer/views.py

@@ -73,7 +73,9 @@ from pretix.plugins.banktransfer.payment import BankTransfer
 from pretix.plugins.banktransfer.refund_export import (
     build_sepa_xml, get_refund_export_csv,
 )
-from pretix.plugins.banktransfer.tasks import process_banktransfers
+from pretix.plugins.banktransfer.tasks import (
+    notify_incomplete_payment, process_banktransfers,
+)
 
 logger = logging.getLogger('pretix.plugins.banktransfer')
 
@@ -165,6 +167,11 @@ class ActionView(View):
             provider='banktransfer',
             state__in=(OrderPayment.PAYMENT_STATE_CREATED, OrderPayment.PAYMENT_STATE_PENDING),
         ).update(state=OrderPayment.PAYMENT_STATE_CANCELED)
+
+        trans.order.refresh_from_db()
+        if trans.order.pending_sum > Decimal('0.00') and trans.order.status == Order.STATUS_PENDING:
+            notify_incomplete_payment(trans.order)
+
         return JsonResponse({
             'status': 'ok',
         })

src/pretix/plugins/paypal2/signals.py

@@ -32,7 +32,7 @@ from django.utils.translation import gettext_lazy as _, pgettext_lazy
 
 from pretix.base.forms import SecretKeySettingsField
 from pretix.base.logentrytypes import EventLogEntryType, log_entry_types
-from pretix.base.middleware import _merge_csp, _parse_csp, _render_csp
+from pretix.base.middleware import add_to_response_csp
 from pretix.base.settings import settings_hierarkey
 from pretix.base.signals import (
     register_global_settings, register_payment_providers,
@@ -144,12 +144,7 @@ def signal_process_response(sender, request: HttpRequest, response: HttpResponse
             (url.url_name == "event.checkout" and url.kwargs['step'] == "payment") or
             (url.namespace == "plugins:paypal2" and url.url_name == "pay")
     ):
-        if 'Content-Security-Policy' in response:
-            h = _parse_csp(response['Content-Security-Policy'])
-        else:
-            h = {}
-
-        csps = {
+        add_to_response_csp(response, {
             'script-src': ['https://www.paypal.com', "'nonce-{}'".format(_nonce(request))],
 
             # When the stars align in an unpredictable manner and the temperature is just right, the PayPal SDK might
@@ -164,12 +159,7 @@ def signal_process_response(sender, request: HttpRequest, response: HttpResponse
             'connect-src': ['https://www.paypal.com', 'https://www.sandbox.paypal.com'],  # Or not - seems to only affect PayPal logging...
             'img-src': ['https://t.paypal.com', 'https://www.paypalobjects.com'],
             'style-src': ["'unsafe-inline'"]  # PayPal does not comply with our nonce unfortunately, see Z#23113213
-        }
-
-        _merge_csp(h, csps)
-
-        if h:
-            response['Content-Security-Policy'] = _render_csp(h)
+        })
 
     return response
 

src/pretix/plugins/sendmail/forms.py

@@ -230,10 +230,15 @@ class OrderMailForm(BaseMailForm):
             self.fields['attach_tickets'].help_text = _("Attachment of tickets is disabled in this event's email "
                                                         "settings.")
 
-        choices = [(e, l) for e, l in Order.STATUS_CHOICE if e != 'n']
-        choices.insert(0, ('valid_if_pending', _('payment pending but already confirmed')))
-        choices.insert(0, ('na', _('payment pending (except unapproved or already confirmed)')))
-        choices.insert(0, ('pa', _('approval pending')))
+        choices = [
+            (Order.STATUS_PAID, _('Paid (or canceled with paid fee)')),
+            ('valid_if_pending', _('payment pending but already confirmed')),
+            ('na', _('payment pending (except unapproved or already confirmed)')),
+            ('pa', _('approval pending')),
+            (Order.STATUS_CANCELED, _('Canceled (fully)')),
+            (Order.STATUS_EXPIRED, _("Expired")),
+        ]
+
         if not event.settings.get('payment_term_expire_automatically', as_type=bool):
             choices.append(
                 ('overdue', _('pending with payment overdue'))
@@ -382,11 +387,15 @@ class RuleForm(FormPlaceholderMixin, I18nModelForm):
         self._set_field_placeholders('subject', ['event', 'order', 'event_or_subevent'])
         self._set_field_placeholders('template', ['event', 'order', 'event_or_subevent'], rich=True)
 
-        choices = [(e, l) for e, l in Order.STATUS_CHOICE if e != 'n']
-        choices.insert(0, ('n__valid_if_pending', _('payment pending but already confirmed')))
-        choices.insert(0, ('n__not_pending_approval_and_not_valid_if_pending',
-                           _('payment pending (except unapproved or already confirmed)')))
-        choices.insert(0, ('n__pending_approval', _('approval pending')))
+        choices = [
+            (Order.STATUS_PAID, _('Paid (or canceled with paid fee)')),
+            ('n__valid_if_pending', _('payment pending but already confirmed')),
+            ('n__not_pending_approval_and_not_valid_if_pending',
+                _('payment pending (except unapproved or already confirmed)')),
+            ('n__pending_approval', _('approval pending')),
+            (Order.STATUS_CANCELED, _('Canceled (fully)')),
+            (Order.STATUS_EXPIRED, _("Expired")),
+        ]
         if not self.event.settings.get('payment_term_expire_automatically', as_type=bool):
             choices.append(
                 ('n__pending_overdue', _('pending with payment overdue'))

src/pretix/plugins/stripe/signals.py

@@ -31,7 +31,7 @@ from django.utils.translation import gettext_lazy as _
 from paypalhttp import HttpResponse
 
 from pretix.base.forms import SecretKeySettingsField
-from pretix.base.middleware import _merge_csp, _parse_csp, _render_csp
+from pretix.base.middleware import add_to_response_csp
 from pretix.base.settings import settings_hierarkey
 from pretix.base.signals import (
     logentry_display, register_global_settings, register_payment_providers,
@@ -201,21 +201,10 @@ def signal_process_response(sender, request: HttpRequest, response: HttpResponse
             (url.url_name == "event.checkout" and url.kwargs['step'] == "payment") or
             (url.namespace == "plugins:stripe" and url.url_name in ["sca", "sca.return"])
     ):
-        if 'Content-Security-Policy' in response:
-            h = _parse_csp(response['Content-Security-Policy'])
-        else:
-            h = {}
-
-        # https://stripe.com/docs/security/guide#content-security-policy
-        csps = {
+        add_to_response_csp(response, {
             'connect-src': ['https://api.stripe.com'],
             'frame-src': ['https://js.stripe.com', 'https://hooks.stripe.com'],
             'script-src': ['https://js.stripe.com'],
-        }
-
-        _merge_csp(h, csps)
-
-        if h:
-            response['Content-Security-Policy'] = _render_csp(h)
+        })
 
     return response

src/pretix/static/pretixbase/js/reldate.js

@@ -1,42 +0,0 @@
-$(document).on('pretix:bind-forms', () => {
-	document.querySelectorAll('.reldatetime, .reldate').forEach(container => {
-		const groups = container.querySelectorAll('.radio')
-
-		groups.forEach(group => {
-			const referenceSelect = group.querySelector('select[data-relative-choice]')
-			const beforeAfterSelect = group.querySelector('select[data-relation-choice]')
-			if (!referenceSelect || !beforeAfterSelect) return
-
-			const beforeOption = beforeAfterSelect.querySelector('option[value="before"]')
-			const afterOption = beforeAfterSelect.querySelector('option[value="after"]')
-
-			const updateBeforeOption = () => {
-				let supportsBefore = referenceSelect.selectedOptions[0].hasAttribute('data-supports-before')
-				if (beforeOption) {
-					beforeOption.disabled = !beforeOption.disabled && !supportsBefore
-				}
-
-				let supportsAfter = referenceSelect.selectedOptions[0].hasAttribute('data-supports-after')
-				if (afterOption) {
-					afterOption.disabled = !afterOption.disabled && !supportsAfter
-				}
-
-				let dirty = false
-				if (beforeOption.disabled && beforeAfterSelect.value === 'before') {
-					beforeAfterSelect.value = 'after'
-					dirty = true
-				}
-				if (afterOption.disabled && beforeAfterSelect.value === 'after') {
-					beforeAfterSelect.value = 'before'
-					dirty = true
-				}
-
-				if (dirty) {
-					beforeAfterSelect.dispatchEvent(new Event('change', {bubbles: true}))
-				}
-			}
-			referenceSelect.addEventListener('change', updateBeforeOption)
-			updateBeforeOption()
-		})
-	})
-})

src/pretix/static/pretixcontrol/js/ui/dashboard.js

@@ -15,8 +15,12 @@ $(function () {
     if ($("#logs_target").length == 0) {
         return;
     }
-    $.get("logs/embed", function (data) {
-        $("#logs_target").html(data)
-        add_log_expand_handlers($("#logs_target"))
+	$.get("dashboard/partials/logs", function (data) {
+		$("#logs_target").html(data)
+		add_log_expand_handlers($("#logs_target"))
+	});
+    $.get("dashboard/partials/warnings", function (data) {
+				$("#warnings_loading").remove()
+        $("#warnings_target").html(data)
     });
 });

src/pretix/static/pretixpresale/widget/src/button.ts

@@ -60,8 +60,18 @@ export function createButtonInstance (element: Element, htmlId?: string): App {
 	app.config.errorHandler = (error, _vm, info) => {
 		console.error('[pretix-button]', info, error)
 	}
-	app.mount(element)
-	observer.observe(element, { attributes: true })
+	// Instead of mounting to the element directly, replicate vue2.7 behaviour, where
+	// the HTML-element gets replaced instead of vue3’s behaviour to replace innerHTML.
+	// The latter can cause issues with custom CSS as HTML structure would change.
+	// app.mount(element)
+	// observer.observe(element, { attributes: true })
+	const fragment = document.createDocumentFragment()
+	app.mount(fragment)
+	for (const attr of element.attributes) {
+		fragment.firstChild.setAttribute(attr.name, attr.value)
+	}
+	observer.observe(fragment.firstChild, { attributes: true })
+	element.parentNode.replaceChild(fragment, element)
 
 	return app
 }

src/pretix/static/pretixpresale/widget/src/widget.ts

@@ -56,8 +56,18 @@ export function createWidgetInstance (element: Element, htmlId?: string): App {
 	app.config.errorHandler = (error, _vm, info) => {
 		console.error('[pretix-widget]', info, error)
 	}
-	app.mount(element)
-	observer.observe(element, { attributes: true })
+	// Instead of mounting to the element directly, replicate vue2.7 behaviour, where
+	// the HTML-element gets replaced instead of vue3’s behaviour to replace innerHTML.
+	// The latter can cause issues with custom CSS as HTML structure would change.
+	// app.mount(element)
+	// observer.observe(element, { attributes: true })
+	const fragment = document.createDocumentFragment()
+	app.mount(fragment)
+	for (const attr of element.attributes) {
+		fragment.firstChild.setAttribute(attr.name, attr.value)
+	}
+	observer.observe(fragment.firstChild, { attributes: true })
+	element.parentNode.replaceChild(fragment, element)
 
 	return app
 }

src/tests/base/test_models.py

@@ -473,7 +473,7 @@ class QuotaTestCase(BaseQuotaTestCase):
     @classscope(attr='o')
     def test_waitinglist_auto_disable(self):
         self.event.settings.waiting_list_auto_disable = RelativeDateWrapper(
-            RelativeDate(days=0, time=None, base_date_name='event__date_from', minutes=20, is_after=True)
+            RelativeDate(days=0, time=None, base_date_name='date_from', minutes=20, is_after=True)
         )
         self.quota.items.add(self.item1)
         self.quota.size = 1
@@ -484,7 +484,7 @@ class QuotaTestCase(BaseQuotaTestCase):
         self.assertEqual(self.item1.check_quotas(), (Quota.AVAILABILITY_ORDERED, 0))
         self.assertEqual(self.item1.check_quotas(count_waitinglist=False), (Quota.AVAILABILITY_OK, 1))
         self.event.settings.waiting_list_auto_disable = RelativeDateWrapper(
-            RelativeDate(days=0, time=None, base_date_name='event__date_from', minutes=20, is_after=False)
+            RelativeDate(days=0, time=None, base_date_name='date_from', minutes=20, is_after=False)
         )
         self.assertEqual(self.item1.check_quotas(), (Quota.AVAILABILITY_OK, 1))
         self.assertEqual(self.item1.check_quotas(count_waitinglist=False), (Quota.AVAILABILITY_OK, 1))
@@ -1192,7 +1192,7 @@ class OrderTestCase(BaseQuotaTestCase):
         self.op2.subevent = se2
         self.op2.save()
         self.event.settings.set('payment_term_last', RelativeDateWrapper(
-            RelativeDate(days=2, time=None, base_date_name='event__date_from', minutes=None)
+            RelativeDate(days=2, time=None, base_date_name='date_from', minutes=None)
         ))
 
         self.order.status = Order.STATUS_EXPIRED
@@ -1347,7 +1347,7 @@ class OrderTestCase(BaseQuotaTestCase):
         self.op2.subevent = se2
         self.op2.save()
         self.event.settings.set('last_order_modification_date', RelativeDateWrapper(
-            RelativeDate(days=2, time=None, base_date_name='event__date_from', minutes=None)
+            RelativeDate(days=2, time=None, base_date_name='date_from', minutes=None)
         ))
         assert self.order.can_modify_answers
         self.op2.subevent = se3
@@ -1363,7 +1363,7 @@ class OrderTestCase(BaseQuotaTestCase):
         self.event.date_from = datetime.datetime(2017, 5, 3, 12, 0, 0, tzinfo=datetime.timezone.utc)
         self.event.save()
         self.event.settings.set('payment_term_last', RelativeDateWrapper(
-            RelativeDate(days=2, time=None, base_date_name='event__date_from', minutes=None)
+            RelativeDate(days=2, time=None, base_date_name='date_from', minutes=None)
         ))
         assert self.order.payment_term_last == datetime.datetime(2017, 5, 1, 23, 59, 59, tzinfo=datetime.timezone.utc)
 
@@ -1379,7 +1379,7 @@ class OrderTestCase(BaseQuotaTestCase):
         self.op2.subevent = se2
         self.op2.save()
         self.event.settings.set('payment_term_last', RelativeDateWrapper(
-            RelativeDate(days=2, time=None, base_date_name='event__date_from', minutes=None)
+            RelativeDate(days=2, time=None, base_date_name='date_from', minutes=None)
         ))
         assert self.order.payment_term_last > now()
         self.op2.subevent = se3
@@ -1395,7 +1395,7 @@ class OrderTestCase(BaseQuotaTestCase):
         self.event.date_from = datetime.datetime(2017, 5, 3, 12, 0, 0, tzinfo=datetime.timezone.utc)
         self.event.save()
         self.event.settings.set('ticket_download_date', RelativeDateWrapper(
-            RelativeDate(days=2, time=None, base_date_name='event__date_from', minutes=None)
+            RelativeDate(days=2, time=None, base_date_name='date_from', minutes=None)
         ))
         assert self.order.ticket_download_date == datetime.datetime(2017, 5, 1, 12, 0, 0, tzinfo=datetime.timezone.utc)
 
@@ -1411,7 +1411,7 @@ class OrderTestCase(BaseQuotaTestCase):
         self.op2.subevent = se2
         self.op2.save()
         self.event.settings.set('ticket_download_date', RelativeDateWrapper(
-            RelativeDate(days=2, time=None, base_date_name='event__date_from', minutes=None)
+            RelativeDate(days=2, time=None, base_date_name='date_from', minutes=None)
         ))
         assert self.order.ticket_download_date > now()
         self.op2.subevent = se3
@@ -1582,13 +1582,13 @@ class OrderTestCase(BaseQuotaTestCase):
 
         assert self.order.user_cancel_deadline is None
         self.event.settings.set('cancel_allow_user_until', RelativeDateWrapper(
-            RelativeDate(days=2, time=datetime.time(14, 0, 0), base_date_name='event__date_from', minutes=None)
+            RelativeDate(days=2, time=datetime.time(14, 0, 0), base_date_name='date_from', minutes=None)
         ))
         self.order = Order.objects.get(pk=self.order.pk)
         assert self.order.user_cancel_deadline > now()
         assert self.order.user_cancel_allowed
         self.event.settings.set('cancel_allow_user_until', RelativeDateWrapper(
-            RelativeDate(days=4, time=datetime.time(14, 0, 0), base_date_name='event__date_from', minutes=None)
+            RelativeDate(days=4, time=datetime.time(14, 0, 0), base_date_name='date_from', minutes=None)
         ))
         self.order = Order.objects.get(pk=self.order.pk)
         assert self.order.user_cancel_deadline < now()
@@ -1607,7 +1607,7 @@ class OrderTestCase(BaseQuotaTestCase):
         self.op2.save()
 
         self.event.settings.set('cancel_allow_user_until', RelativeDateWrapper(
-            RelativeDate(days=2, time=datetime.time(14, 0, 0), base_date_name='event__date_from', minutes=None)
+            RelativeDate(days=2, time=datetime.time(14, 0, 0), base_date_name='date_from', minutes=None)
         ))
         self.order = Order.objects.get(pk=self.order.pk)
         assert self.order.user_cancel_deadline < now()
@@ -2018,13 +2018,13 @@ class OrderTestCase(BaseQuotaTestCase):
 
         assert self.order.user_change_deadline is None
         self.event.settings.set('change_allow_user_until', RelativeDateWrapper(
-            RelativeDate(days=2, time=datetime.time(14, 0, 0), base_date_name='event__date_from', minutes=None)
+            RelativeDate(days=2, time=datetime.time(14, 0, 0), base_date_name='date_from', minutes=None)
         ))
         self.order = Order.objects.get(pk=self.order.pk)
         assert self.order.user_change_deadline > now()
         assert self.order.user_change_allowed
         self.event.settings.set('change_allow_user_until', RelativeDateWrapper(
-            RelativeDate(days=4, time=datetime.time(14, 0, 0), base_date_name='event__date_from', minutes=None)
+            RelativeDate(days=4, time=datetime.time(14, 0, 0), base_date_name='date_from', minutes=None)
         ))
         self.order = Order.objects.get(pk=self.order.pk)
         assert self.order.user_change_deadline < now()
@@ -2046,7 +2046,7 @@ class OrderTestCase(BaseQuotaTestCase):
         self.op2.save()
 
         self.event.settings.set('change_allow_user_until', RelativeDateWrapper(
-            RelativeDate(days=2, time=datetime.time(14, 0, 0), base_date_name='event__date_from', minutes=None)
+            RelativeDate(days=2, time=datetime.time(14, 0, 0), base_date_name='date_from', minutes=None)
         ))
         self.order = Order.objects.get(pk=self.order.pk)
         assert self.order.user_change_deadline < now()

src/tests/base/test_orders.py

@@ -204,7 +204,7 @@ def test_expiry_last_relative(event):
     event.date_from = now() + timedelta(days=5)
     event.save()
     event.settings.set('payment_term_last', RelativeDateWrapper(
-        RelativeDate(days=2, time=None, base_date_name='event__date_from', minutes=None)
+        RelativeDate(days=2, time=None, base_date_name='date_from', minutes=None)
     ))
     order = _create_order(event, email='dummy@example.org', positions=[],
                           now_dt=today,
@@ -245,7 +245,7 @@ def test_expiry_last_relative_subevents(event):
     )
 
     event.settings.set('payment_term_last', RelativeDateWrapper(
-        RelativeDate(days=2, time=None, base_date_name='event__date_from', minutes=None)
+        RelativeDate(days=2, time=None, base_date_name='date_from', minutes=None)
     ))
     order = _create_order(event, email='dummy@example.org', positions=[cp1, cp2],
                           now_dt=today,

src/tests/base/test_payment.py

@@ -133,7 +133,7 @@ def test_availability_date_relative(event):
     event.save()
     prov = DummyPaymentProvider(event)
     prov.settings.set('_availability_date', RelativeDateWrapper(
-        RelativeDate(days=2, time=None, base_date_name='event__date_from', minutes=None)
+        RelativeDate(days=2, time=None, base_date_name='date_from', minutes=None)
     ))
 
     utc = datetime.timezone.utc
@@ -150,7 +150,7 @@ def test_availability_start_relative(event):
     event.save()
     prov = DummyPaymentProvider(event)
     prov.settings.set('_availability_start', RelativeDateWrapper(
-        RelativeDate(days=2, time=datetime.time(12, 0), base_date_name='event__date_from', minutes=None)
+        RelativeDate(days=2, time=datetime.time(12, 0), base_date_name='date_from', minutes=None)
     ))
 
     utc = datetime.timezone.utc
@@ -193,12 +193,12 @@ def test_availability_date_cart_relative_subevents(event):
 
     prov = DummyPaymentProvider(event)
     prov.settings.set('_availability_date', RelativeDateWrapper(
-        RelativeDate(days=3, time=None, base_date_name='event__date_from', minutes=None)
+        RelativeDate(days=3, time=None, base_date_name='date_from', minutes=None)
     ))
     assert prov._is_available_by_time(cart_id="123")
 
     prov.settings.set('_availability_date', RelativeDateWrapper(
-        RelativeDate(days=4, time=None, base_date_name='event__date_from', minutes=None)
+        RelativeDate(days=4, time=None, base_date_name='date_from', minutes=None)
     ))
     assert not prov._is_available_by_time(cart_id="123")
 
@@ -233,11 +233,11 @@ def test_availability_date_order_relative_subevents(event):
 
     prov = DummyPaymentProvider(event)
     prov.settings.set('_availability_date', RelativeDateWrapper(
-        RelativeDate(days=3, time=None, base_date_name='event__date_from', minutes=None)
+        RelativeDate(days=3, time=None, base_date_name='date_from', minutes=None)
     ))
     assert prov._is_available_by_time(order=order)
 
     prov.settings.set('_availability_date', RelativeDateWrapper(
-        RelativeDate(days=4, time=None, base_date_name='event__date_from', minutes=None)
+        RelativeDate(days=4, time=None, base_date_name='date_from', minutes=None)
     ))
     assert not prov._is_available_by_time(order=order)

src/tests/base/test_reldate.py

@@ -19,13 +19,13 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-from datetime import datetime, time, timedelta
+from datetime import datetime, time
 from zoneinfo import ZoneInfo
 
 import pytest
 from django_scopes import scope
 
-from pretix.base.models import Event, Order, Organizer
+from pretix.base.models import Event, Organizer
 from pretix.base.reldate import RelativeDate, RelativeDateWrapper
 
 TOKYO = ZoneInfo('Asia/Tokyo')
@@ -40,6 +40,7 @@ def event():
         date_from=datetime(2017, 12, 27, 5, 0, 0, tzinfo=TOKYO),
         presale_start=datetime(2017, 12, 1, 5, 0, 0, tzinfo=TOKYO),
         plugins='pretix.plugins.banktransfer'
+
     )
     event.settings.timezone = "Asia/Tokyo"
     return event
@@ -55,57 +56,57 @@ def test_absolute_date(event):
 
 @pytest.mark.django_db
 def test_relative_date_without_time(event):
-    rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='event__date_from', minutes=None))
+    rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='date_from', minutes=None))
     assert rdw.datetime(event).astimezone(TOKYO) == datetime(2017, 12, 26, 5, 0, 0, tzinfo=TOKYO)
-    assert rdw.to_string() == 'RELDATE/1/-/event__date_from/'
-    rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='event__date_from', minutes=None, is_after=True))
+    assert rdw.to_string() == 'RELDATE/1/-/date_from/'
+    rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='date_from', minutes=None, is_after=True))
     assert rdw.datetime(event).astimezone(TOKYO) == datetime(2017, 12, 28, 5, 0, 0, tzinfo=TOKYO)
-    assert rdw.to_string() == 'RELDATE/1/-/event__date_from/after'
+    assert rdw.to_string() == 'RELDATE/1/-/date_from/after'
 
 
 @pytest.mark.django_db
 def test_relative_date_other_base_point(event):
     with scope(organizer=event.organizer):
-        rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='event__presale_start', minutes=None))
+        rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='presale_start', minutes=None))
         assert rdw.datetime(event) == datetime(2017, 11, 30, 5, 0, 0, tzinfo=TOKYO)
-        assert rdw.to_string() == 'RELDATE/1/-/event__presale_start/'
+        assert rdw.to_string() == 'RELDATE/1/-/presale_start/'
 
         # presale_end is unset, defaults to date_from
-        rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='event__presale_end', minutes=None))
+        rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='presale_end', minutes=None))
         assert rdw.datetime(event) == datetime(2017, 12, 26, 5, 0, 0, tzinfo=TOKYO)
-        assert rdw.to_string() == 'RELDATE/1/-/event__presale_end/'
+        assert rdw.to_string() == 'RELDATE/1/-/presale_end/'
 
         # subevent base
         se = event.subevents.create(name="SE1", date_from=datetime(2017, 11, 27, 5, 0, 0, tzinfo=TOKYO))
-        rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='event__date_from', minutes=None))
+        rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='date_from', minutes=None))
         assert rdw.datetime(se) == datetime(2017, 11, 26, 5, 0, 0, tzinfo=TOKYO)
 
         # presale_start is unset on subevent, default to event
-        rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='event__presale_start', minutes=None))
+        rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='presale_start', minutes=None))
         assert rdw.datetime(se) == datetime(2017, 11, 30, 5, 0, 0, tzinfo=TOKYO)
 
         # presale_end is unset on all, default to date_from of subevent
-        rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='event__presale_end', minutes=None))
+        rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='presale_end', minutes=None))
         assert rdw.datetime(se) == datetime(2017, 11, 26, 5, 0, 0, tzinfo=TOKYO)
 
 
 @pytest.mark.django_db
 def test_relative_date_in_minutes(event):
-    rdw = RelativeDateWrapper(RelativeDate(days=0, time=None, base_date_name='event__date_from', minutes=60))
-    assert rdw.to_string() == 'RELDATE/minutes/60/event__date_from/'
+    rdw = RelativeDateWrapper(RelativeDate(days=0, time=None, base_date_name='date_from', minutes=60))
+    assert rdw.to_string() == 'RELDATE/minutes/60/date_from/'
     assert rdw.datetime(event) == datetime(2017, 12, 27, 4, 0, 0, tzinfo=TOKYO)
-    rdw = RelativeDateWrapper(RelativeDate(days=0, time=None, base_date_name='event__date_from', minutes=60, is_after=True))
-    assert rdw.to_string() == 'RELDATE/minutes/60/event__date_from/after'
+    rdw = RelativeDateWrapper(RelativeDate(days=0, time=None, base_date_name='date_from', minutes=60, is_after=True))
+    assert rdw.to_string() == 'RELDATE/minutes/60/date_from/after'
     assert rdw.datetime(event) == datetime(2017, 12, 27, 6, 0, 0, tzinfo=TOKYO)
 
 
 @pytest.mark.django_db
 def test_relative_date_with_time(event):
-    rdw = RelativeDateWrapper(RelativeDate(days=1, time=time(8, 5, 13), base_date_name='event__date_from', minutes=None))
-    assert rdw.to_string() == 'RELDATE/1/08:05:13/event__date_from/'
+    rdw = RelativeDateWrapper(RelativeDate(days=1, time=time(8, 5, 13), base_date_name='date_from', minutes=None))
+    assert rdw.to_string() == 'RELDATE/1/08:05:13/date_from/'
     assert rdw.datetime(event) == datetime(2017, 12, 26, 8, 5, 13, tzinfo=TOKYO)
-    rdw = RelativeDateWrapper(RelativeDate(days=1, time=time(8, 5, 13), base_date_name='event__date_from', minutes=None, is_after=True))
-    assert rdw.to_string() == 'RELDATE/1/08:05:13/event__date_from/after'
+    rdw = RelativeDateWrapper(RelativeDate(days=1, time=time(8, 5, 13), base_date_name='date_from', minutes=None, is_after=True))
+    assert rdw.to_string() == 'RELDATE/1/08:05:13/date_from/after'
     assert rdw.datetime(event) == datetime(2017, 12, 28, 8, 5, 13, tzinfo=TOKYO)
 
 
@@ -114,94 +115,35 @@ def test_relative_date_with_time_around_dst(event):
     event.settings.timezone = "Europe/Berlin"
     event.date_from = datetime(2020, 3, 29, 18, 0, 0, tzinfo=BERLIN)
 
-    rdw = RelativeDateWrapper(RelativeDate(days=1, time=time(18, 0, 0), base_date_name='event__date_from', minutes=None))
-    assert rdw.to_string() == 'RELDATE/1/18:00:00/event__date_from/'
+    rdw = RelativeDateWrapper(RelativeDate(days=1, time=time(18, 0, 0), base_date_name='date_from', minutes=None))
+    assert rdw.to_string() == 'RELDATE/1/18:00:00/date_from/'
     assert rdw.datetime(event) == datetime(2020, 3, 28, 18, 0, 0, tzinfo=BERLIN)
 
-    rdw = RelativeDateWrapper(RelativeDate(days=0, time=time(2, 30, 0), base_date_name='event__date_from', minutes=None))
-    assert rdw.to_string() == 'RELDATE/0/02:30:00/event__date_from/'
+    rdw = RelativeDateWrapper(RelativeDate(days=0, time=time(2, 30, 0), base_date_name='date_from', minutes=None))
+    assert rdw.to_string() == 'RELDATE/0/02:30:00/date_from/'
     assert rdw.datetime(event) == datetime(2020, 3, 29, 2, 30, 0, tzinfo=BERLIN)
 
     event.date_from = datetime(2020, 10, 25, 18, 0, 0, tzinfo=BERLIN)
 
-    rdw = RelativeDateWrapper(RelativeDate(days=1, time=time(18, 0, 0), base_date_name='event__date_from', minutes=None))
-    assert rdw.to_string() == 'RELDATE/1/18:00:00/event__date_from/'
+    rdw = RelativeDateWrapper(RelativeDate(days=1, time=time(18, 0, 0), base_date_name='date_from', minutes=None))
+    assert rdw.to_string() == 'RELDATE/1/18:00:00/date_from/'
     assert rdw.datetime(event) == datetime(2020, 10, 24, 18, 0, 0, tzinfo=BERLIN)
 
-    rdw = RelativeDateWrapper(RelativeDate(days=0, time=time(2, 30, 0), base_date_name='event__date_from', minutes=None))
-    assert rdw.to_string() == 'RELDATE/0/02:30:00/event__date_from/'
+    rdw = RelativeDateWrapper(RelativeDate(days=0, time=time(2, 30, 0), base_date_name='date_from', minutes=None))
+    assert rdw.to_string() == 'RELDATE/0/02:30:00/date_from/'
     assert rdw.datetime(event) == datetime(2020, 10, 25, 2, 30, 0, tzinfo=BERLIN)
 
 
-def test_unserialize_backwards_compatibility():
+def test_unserialize():
     d = datetime(2017, 12, 25, 10, 0, 0, tzinfo=TOKYO)
     rdw = RelativeDateWrapper.from_string(d.isoformat())
     assert rdw.data == d
 
-    # keeping the test for the old from_string_format to ensure that we don't break anything
     rdw = RelativeDateWrapper.from_string('RELDATE/1/-/date_from/')
     assert rdw.data == RelativeDate(days=1, time=None, base_date_name='date_from', minutes=None)
 
-    # keeping the test for the old from_string_format to ensure that we don't break anything
     rdw = RelativeDateWrapper.from_string('RELDATE/1/18:05:13/date_from/')
     assert rdw.data == RelativeDate(days=1, time=time(18, 5, 13), base_date_name='date_from', minutes=None)
 
-    # keeping the test for the old from_string_format to ensure that we don't break anything
     rdw = RelativeDateWrapper.from_string('RELDATE/minutes/60/date_from/')
     assert rdw.data == RelativeDate(days=0, time=None, base_date_name='date_from', minutes=60)
-
-
-def test_backwards_compatibility():
-    # the data model of RelativeDate had to be extended to support other models as relation target
-    # previously only:
-    # - date_from
-    # - date_to
-    # - date_admission
-    # - presale_start
-    # - presale_end
-    # where valid values for the fourth slot (base_date_names) of the serialized form.
-    # the relationship in this case always pointed at event
-    # so any preexisting base_date_names without __ should continue to work and upgrade to event__{old_base_date_name}
-    d = datetime(2017, 12, 25, 10, 0, 0, tzinfo=TOKYO)
-    rdw = RelativeDateWrapper.from_string(d.isoformat())
-    assert rdw.data == d
-
-    rdw = RelativeDateWrapper.from_string('RELDATE/1/-/date_from/')
-    assert rdw.to_string() == 'RELDATE/1/-/event__date_from/'
-
-    rdw = RelativeDateWrapper.from_string('RELDATE/1/-/date_to/')
-    assert rdw.to_string() == 'RELDATE/1/-/event__date_to/'
-
-    rdw = RelativeDateWrapper.from_string('RELDATE/1/-/date_admission/')
-    assert rdw.to_string() == 'RELDATE/1/-/event__date_admission/'
-
-    rdw = RelativeDateWrapper.from_string('RELDATE/1/-/presale_start/')
-    assert rdw.to_string() == 'RELDATE/1/-/event__presale_start/'
-
-    rdw = RelativeDateWrapper.from_string('RELDATE/1/-/presale_end/')
-    assert rdw.to_string() == 'RELDATE/1/-/event__presale_end/'
-
-    # new order base_date_names should not work without __
-    with pytest.raises(TypeError):
-        RelativeDateWrapper.from_string('RELDATE/1/-/datetime/')
-    with pytest.raises(TypeError):
-        RelativeDateWrapper.from_string('RELDATE/1/-/expires/')
-
-
-@pytest.mark.django_db
-def test_relative_to_order(event):
-    with scope(organizer=event.organizer):
-        order_moment = datetime(2020, 3, 29, 18, 0, 0, tzinfo=TOKYO)
-
-        order = Order.objects.create(
-            code='FOO', event=event, email='dummy@dummy.test',
-            status=Order.STATUS_PENDING, secret="k24fiuwvu8kxz3y1",
-            datetime=order_moment,
-            expires=order_moment + timedelta(days=10),
-            sales_channel=event.organizer.sales_channels.get(identifier="web"),
-            total=23, locale='en'
-        )
-
-        rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='order__datetime', minutes=None, is_after=True))
-        assert rdw.datetime(order).astimezone(TOKYO) == datetime(2020, 3, 30, 18, 0, 0, tzinfo=TOKYO)
-        assert rdw.to_string() == 'RELDATE/1/-/order__datetime/after'

src/tests/base/test_waitinglist.py

@@ -235,7 +235,7 @@ class WaitingListTestCase(TestCase):
         self.event.settings.set('waiting_list_enabled', True)
         self.event.settings.set('waiting_list_auto', True)
         self.event.settings.waiting_list_auto_disable = RelativeDateWrapper(
-            RelativeDate(days=0, time=None, base_date_name='event__date_from', minutes=20, is_after=False)
+            RelativeDate(days=0, time=None, base_date_name='date_from', minutes=20, is_after=False)
         )
         self.event.save()
         with scope(organizer=self.o):

src/tests/control/test_events.py

@@ -481,7 +481,7 @@ class EventsTest(SoupTest):
             'payment_term_last_0': 'absolute',
             'payment_term_last_1': (self.event1.presale_end - datetime.timedelta(1)).strftime('%Y-%m-%d'),
             'payment_term_last_2': '0',
-            'payment_term_last_3': 'event__date_from',
+            'payment_term_last_3': 'date_from',
             'tax_rule_payment': 'default',
         })
         assert doc.select('.alert-danger')
@@ -496,7 +496,7 @@ class EventsTest(SoupTest):
             'payment_term_last_0': 'relative',
             'payment_term_last_1': '',
             'payment_term_last_2': '10',
-            'payment_term_last_3': 'event__date_from',
+            'payment_term_last_3': 'date_from',
             'tax_rule_payment': 'default',
         })
         assert doc.select('.alert-danger')

src/tests/control/test_subevents.py

@@ -230,19 +230,19 @@ class SubEventsTest(SoupTest):
             'rel_presale_start_0': 'unset',
             'rel_presale_start_1': '',
             'rel_presale_start_2': '1',
-            'rel_presale_start_3': 'event__date_from',
+            'rel_presale_start_3': 'date_from',
             'rel_presale_start_4': '',
             'rel_presale_start_5': '',
-            'rel_presale_start_6': 'event__date_from',
+            'rel_presale_start_6': 'date_from',
             'rel_presale_start_7': 'before',
             'rel_presale_start_8': 'before',
             'rel_presale_end_1': '',
             'rel_presale_end_0': 'relative',
             'rel_presale_end_2': '1',
-            'rel_presale_end_3': 'event__date_from',
+            'rel_presale_end_3': 'date_from',
             'rel_presale_end_4': '13:29:31',
             'rel_presale_end_5': '',
-            'rel_presale_end_6': 'event__date_from',
+            'rel_presale_end_6': 'date_from',
             'rel_presale_end_7': 'before',
             'rel_presale_end_8': 'before',
             'quotas-TOTAL_FORMS': '1',
@@ -328,19 +328,19 @@ class SubEventsTest(SoupTest):
             'rel_presale_start_0': 'unset',
             'rel_presale_start_1': '',
             'rel_presale_start_2': '1',
-            'rel_presale_start_3': 'event__date_from',
+            'rel_presale_start_3': 'date_from',
             'rel_presale_start_4': '',
             'rel_presale_start_5': '',
-            'rel_presale_start_6': 'event__date_from',
+            'rel_presale_start_6': 'date_from',
             'rel_presale_start_7': 'before',
             'rel_presale_start_8': 'before',
             'rel_presale_end_1': '',
             'rel_presale_end_0': 'relative',
             'rel_presale_end_2': '1',
-            'rel_presale_end_3': 'event__date_from',
+            'rel_presale_end_3': 'date_from',
             'rel_presale_end_4': '13:29:31',
             'rel_presale_end_5': '',
-            'rel_presale_end_6': 'event__date_from',
+            'rel_presale_end_6': 'date_from',
             'rel_presale_end_7': 'before',
             'rel_presale_end_8': 'before',
             'quotas-TOTAL_FORMS': '1',
@@ -403,19 +403,19 @@ class SubEventsTest(SoupTest):
             'rel_presale_start_0': 'unset',
             'rel_presale_start_1': '',
             'rel_presale_start_2': '1',
-            'rel_presale_start_3': 'event__date_from',
+            'rel_presale_start_3': 'date_from',
             'rel_presale_start_4': '',
             'rel_presale_start_5': '',
-            'rel_presale_start_6': 'event__date_from',
+            'rel_presale_start_6': 'date_from',
             'rel_presale_start_7': 'before',
             'rel_presale_start_8': 'before',
             'rel_presale_end_1': '',
             'rel_presale_end_0': 'relative',
             'rel_presale_end_2': '1',
-            'rel_presale_end_3': 'event__date_from',
+            'rel_presale_end_3': 'date_from',
             'rel_presale_end_4': '13:29:31',
             'rel_presale_end_5': '',
-            'rel_presale_end_6': 'event__date_from',
+            'rel_presale_end_6': 'date_from',
             'rel_presale_end_7': 'before',
             'rel_presale_end_8': 'before',
             'quotas-TOTAL_FORMS': '1',
@@ -479,19 +479,19 @@ class SubEventsTest(SoupTest):
             'rel_presale_start_0': 'unset',
             'rel_presale_start_1': '',
             'rel_presale_start_2': '1',
-            'rel_presale_start_3': 'event__date_from',
+            'rel_presale_start_3': 'date_from',
             'rel_presale_start_4': '',
             'rel_presale_start_5': '',
-            'rel_presale_start_6': 'event__date_from',
+            'rel_presale_start_6': 'date_from',
             'rel_presale_start_7': 'before',
             'rel_presale_start_8': 'before',
             'rel_presale_end_1': '',
             'rel_presale_end_0': 'relative',
             'rel_presale_end_2': '1',
-            'rel_presale_end_3': 'event__date_from',
+            'rel_presale_end_3': 'date_from',
             'rel_presale_end_4': '02:30:00',
             'rel_presale_end_5': '',
-            'rel_presale_end_6': 'event__date_from',
+            'rel_presale_end_6': 'date_from',
             'rel_presale_end_7': 'before',
             'rel_presale_end_8': 'before',
             'quotas-TOTAL_FORMS': '1',
@@ -567,19 +567,19 @@ class SubEventsTest(SoupTest):
             'rel_presale_start_0': 'unset',
             'rel_presale_start_1': '',
             'rel_presale_start_2': '1',
-            'rel_presale_start_3': 'event__date_from',
+            'rel_presale_start_3': 'date_from',
             'rel_presale_start_4': '',
             'rel_presale_start_5': '',
-            'rel_presale_start_6': 'event__date_from',
+            'rel_presale_start_6': 'date_from',
             'rel_presale_start_7': 'before',
             'rel_presale_start_8': 'before',
             'rel_presale_end_1': '',
             'rel_presale_end_0': 'relative',
             'rel_presale_end_2': '1',
-            'rel_presale_end_3': 'event__date_from',
+            'rel_presale_end_3': 'date_from',
             'rel_presale_end_4': '13:29:31',
             'rel_presale_end_5': '',
-            'rel_presale_end_6': 'event__date_from',
+            'rel_presale_end_6': 'date_from',
             'rel_presale_end_7': 'before',
             'rel_presale_end_8': 'before',
             'quotas-TOTAL_FORMS': '1',
@@ -639,19 +639,19 @@ class SubEventsTest(SoupTest):
             'rel_presale_start_0': 'unset',
             'rel_presale_start_1': '',
             'rel_presale_start_2': '1',
-            'rel_presale_start_3': 'event__date_from',
+            'rel_presale_start_3': 'date_from',
             'rel_presale_start_4': '',
             'rel_presale_start_5': '',
-            'rel_presale_start_6': 'event__date_from',
+            'rel_presale_start_6': 'date_from',
             'rel_presale_start_7': 'before',
             'rel_presale_start_8': 'before',
             'rel_presale_end_0': 'unset',
             'rel_presale_end_1': '',
             'rel_presale_end_2': '1',
-            'rel_presale_end_3': 'event__date_from',
+            'rel_presale_end_3': 'date_from',
             'rel_presale_end_4': '13:29:31',
             'rel_presale_end_5': '',
-            'rel_presale_end_6': 'event__date_from',
+            'rel_presale_end_6': 'date_from',
             'rel_presale_end_7': 'before',
             'rel_presale_end_8': 'before',
             'quotas-TOTAL_FORMS': '1',
@@ -711,19 +711,19 @@ class SubEventsTest(SoupTest):
             'rel_presale_start_0': 'unset',
             'rel_presale_start_1': '',
             'rel_presale_start_2': '1',
-            'rel_presale_start_3': 'event__date_from',
+            'rel_presale_start_3': 'date_from',
             'rel_presale_start_4': '',
             'rel_presale_start_5': '',
-            'rel_presale_start_6': 'event__date_from',
+            'rel_presale_start_6': 'date_from',
             'rel_presale_start_7': 'before',
             'rel_presale_start_8': 'before',
             'rel_presale_end_0': 'unset',
             'rel_presale_end_1': '',
             'rel_presale_end_2': '1',
-            'rel_presale_end_3': 'event__date_from',
+            'rel_presale_end_3': 'date_from',
             'rel_presale_end_4': '13:29:31',
             'rel_presale_end_5': '',
-            'rel_presale_end_6': 'event__date_from',
+            'rel_presale_end_6': 'date_from',
             'rel_presale_end_7': 'before',
             'rel_presale_end_8': 'before',
             'quotas-TOTAL_FORMS': '1',

src/tests/plugins/banktransfer/test_actions.py

@@ -50,6 +50,7 @@ def env():
         datetime=now(), expires=now() + timedelta(days=10),
         total=23,
         sales_channel=o.sales_channels.get(identifier="web"),
+        email='dummy@dummy.dummy'
     )
     o2 = Order.objects.create(
         code='6789Z', event=event,
@@ -129,7 +130,7 @@ def test_assign_order_unknown(env, client):
 
 
 @pytest.mark.django_db
-def test_assign_order_amount_incorrect(env, client):
+def test_assign_order_amount_incorrect(env, client, mailoutbox):
     job = BankImportJob.objects.create(event=env[0])
     trans = BankTransaction.objects.create(event=env[0], import_job=job, payer='Foo',
                                            state=BankTransaction.STATE_NOMATCH,
@@ -141,6 +142,7 @@ def test_assign_order_amount_incorrect(env, client):
     assert r['status'] == 'ok'
     trans.refresh_from_db()
     assert trans.state == BankTransaction.STATE_VALID
+    assert len(mailoutbox) == 1
 
 
 @pytest.mark.django_db

src/tests/presale/test_event.py

@@ -1132,7 +1132,7 @@ class WaitingListTest(EventTestMixin, SoupTest):
     def test_auto_disable(self):
         self.event.settings.set('waiting_list_enabled', True)
         self.event.settings.waiting_list_auto_disable = RelativeDateWrapper(
-            RelativeDate(days=900, time=datetime.time(9, 0, 0), base_date_name='event__date_from', minutes=None, is_after=False)
+            RelativeDate(days=900, time=datetime.time(9, 0, 0), base_date_name='date_from', minutes=None, is_after=False)
         )
         response = self.client.get(
             '/%s/%s/' % (self.orga.slug, self.event.slug)

src/tests/presale/test_order_change.py

@@ -1527,7 +1527,7 @@ class OrderChangeAddonsTest(BaseOrdersTest):
         self.order.save()
         self._subevent_setup()
         self.event.settings.set('payment_term_last', RelativeDateWrapper(
-            RelativeDate(days=2, time=None, base_date_name='event__date_from', minutes=None)
+            RelativeDate(days=2, time=None, base_date_name='date_from', minutes=None)
         ))
 
         response = self.client.get(

src/tests/presale/test_orders.py

@@ -1076,7 +1076,7 @@ class OrdersTest(BaseOrdersTest):
         self.event.date_from = now() + datetime.timedelta(days=3)
         self.event.save()
         self.event.settings.set('ticket_download_date', RelativeDateWrapper(RelativeDate(
-            base_date_name='event__date_from', days=2, time=None, minutes=None
+            base_date_name='date_from', days=2, time=None, minutes=None
         )))
         response = self.client.post(
             '/%s/%s/order/%s/%s/download/%d/testdummy' % (self.orga.slug, self.event.slug, self.order.code,