Update src/pretix/control/views/orders.py

There is one I couldn't fix: Loading the list of tax rules for every
select box on the OrderChange page. Unfortunately, Django has a
cache-breaking .all() in ModelChoiceField and that would need nasty
patching that didn't feel worth it

package-lock.json

@@ -2584,9 +2584,9 @@
       }
     },
     "node_modules/immutable": {
-      "version": "5.1.9",
-      "resolved": "https://registry.npmjs.org/immutable/-/immutable-5.1.9.tgz",
-      "integrity": "sha512-m8nVez3rwrgmWxtLMt1ZYXB2Lv7OKYn/disyxAlSDYAlKSlFoPPfIAmAM/M5xqL4m4C/wAPw7S2/CNaUii1Hxg==",
+      "version": "5.1.5",
+      "resolved": "https://registry.npmjs.org/immutable/-/immutable-5.1.5.tgz",
+      "integrity": "sha512-t7xcm2siw+hlUM68I+UEOK+z84RzmN59as9DZ7P1l0994DKUWV7UXBMQZVxaoMSRQ+PBZbHCOoBt7a2wxOMt+A==",
       "dev": true,
       "license": "MIT"
     },

pyproject.toml

@@ -55,7 +55,7 @@ dependencies = [
   "django-phonenumber-field==8.4.*",
   "django-querytagger==0.0.3",
   "django-redis==7.0.*",
-  "django-scopes==2.1.*",
+  "django-scopes==2.0.*",
   "django-statici18n==2.7.*",
   "djangorestframework==3.17.*",
   "dnspython==2.8.*",
@@ -112,7 +112,7 @@ dev = [
   "aiohttp==3.14.*",
   "coverage",
   "coveralls",
-  "fakeredis==2.37.*",
+  "fakeredis==2.36.*",
   "flake8==7.3.*",
   "freezegun",
   "isort==8.0.*",

src/pretix/base/models/orders.py

@@ -508,20 +508,20 @@ class Order(LockModel, LoggedModel):
 
     @classmethod
     def annotate_overpayments(cls, qs, results=True, refunds=True, sums=False):
-        payment_sum = OrderPayment.objects.with_scopes_disabled().filter(
+        payment_sum = OrderPayment.objects.filter(
             state__in=(OrderPayment.PAYMENT_STATE_CONFIRMED, OrderPayment.PAYMENT_STATE_REFUNDED),
             order=OuterRef('pk')
         ).order_by().values('order').annotate(s=Sum('amount')).values('s')
-        refund_sum = OrderRefund.objects.with_scopes_disabled().filter(
+        refund_sum = OrderRefund.objects.filter(
             state__in=(OrderRefund.REFUND_STATE_DONE, OrderRefund.REFUND_STATE_TRANSIT,
                        OrderRefund.REFUND_STATE_CREATED),
             order=OuterRef('pk')
         ).order_by().values('order').annotate(s=Sum('amount')).values('s')
-        external_refund = OrderRefund.objects.with_scopes_disabled().filter(
+        external_refund = OrderRefund.objects.filter(
             state=OrderRefund.REFUND_STATE_EXTERNAL,
             order=OuterRef('pk')
         )
-        pending_refund = OrderRefund.objects.with_scopes_disabled().filter(
+        pending_refund = OrderRefund.objects.filter(
             state__in=(OrderRefund.REFUND_STATE_CREATED, OrderRefund.REFUND_STATE_TRANSIT),
             order=OuterRef('pk')
         )

src/pretix/control/forms/filter.py

@@ -39,7 +39,6 @@ from urllib.parse import urlencode
 from django import forms
 from django.apps import apps
 from django.conf import settings
-from django.contrib.contenttypes.models import ContentType
 from django.db.models import (
     Count, Exists, F, Max, Model, OrderBy, OuterRef, Q, QuerySet,
 )
@@ -60,7 +59,7 @@ from pretix.base.models import (
     Gate, Invoice, InvoiceAddress, Item, Order, OrderPayment, OrderPosition,
     OrderRefund, Organizer, OutgoingMail, Question, QuestionAnswer, Quota,
     SalesChannel, SubEvent, SubEventMetaValue, Team, TeamAPIToken, TeamInvite,
-    User, Voucher,
+    Voucher,
 )
 from pretix.base.signals import register_payment_providers
 from pretix.base.timeframes import (
@@ -3008,91 +3007,3 @@ class OutgoingMailFilterForm(FilterForm):
             qs = qs.order_by("-created", "-pk")
 
         return qs
-
-
-class LogFilterForm(FilterForm):
-    source = forms.ChoiceField(
-        label=_('Source'),
-        choices=[
-            ('', _('All sources')),
-            ('team', _('Team actions')),
-            ('customer', _('Customer actions')),
-            ('device', _('Device actions')),
-        ],
-        required=False
-    )
-    device = SafeModelChoiceField(
-        label=_('Device'),
-        empty_label=_('All devices'),
-        queryset=Device.objects.none(),
-        required=False
-    )
-    user_email = forms.EmailField(
-        label=_('User email'),
-        widget=forms.EmailInput(
-            attrs={"placeholder": _('All users')}
-        ),
-        required=False
-    )
-    action_type = forms.CharField(
-        widget=forms.HiddenInput,
-        required=False,
-    )
-    content_type = forms.ModelChoiceField(
-        queryset=ContentType.objects.all(),
-        widget=forms.HiddenInput,
-        required=False,
-    )
-    object = forms.IntegerField(
-        widget=forms.HiddenInput,
-        required=False
-    )
-
-    def __init__(self, *args, **kwargs):
-        self.organizer = kwargs.pop('organizer')
-        super().__init__(*args, **kwargs)
-
-        self.fields['device'].queryset = self.organizer.devices.all().order_by('device_id')
-        self.fields['device'].widget = Select2(
-            attrs={
-                'data-model-select2': 'generic',
-                'data-select2-url': reverse('control:organizer.devices.select2', kwargs={
-                    'organizer': self.organizer.slug,
-                }),
-                'data-placeholder': _('All devices'),
-            }
-        )
-        self.fields['device'].widget.choices = self.fields['device'].choices
-        self.fields['device'].label = _('Device')
-
-    def filter_qs(self, qs):
-        fdata = self.cleaned_data
-        if fdata.get('source') == 'team':
-            qs = qs.filter(user__isnull=False)
-        elif fdata.get('source') == 'device':
-            qs = qs.filter(device__isnull=False)
-        elif fdata.get('source') == 'customer':
-            qs = qs.filter(user__isnull=True, device__isnull=True)
-
-        if fdata.get('device'):
-            qs = qs.filter(device_id=fdata['device'].pk)
-
-        if fdata.get('action_type'):
-            qs = qs.filter(action_type__in=fdata['action_type'].split(','))
-
-        if fdata.get('user_email'):
-            try:
-                user = User.objects.get(email=fdata['user_email'].lower())
-                qs = qs.filter(user=user)
-            except User.DoesNotExist:
-                # Do not actively leak info that this user does not exist. Yes, this will likely have a
-                # timing attack possibility, but with the magic that database query planners do,
-                # it's probably impossible to avoid that.
-                qs = qs.none()
-
-        if fdata.get('content_type'):
-            qs = qs.filter(content_type=fdata.get('content_type'))
-
-            if fdata.get('object'):
-                qs = qs.filter(object_id=fdata.get('object'))
-        return qs

src/pretix/control/forms/orders.py

@@ -562,9 +562,7 @@ class OrderPositionChangeForm(forms.Form):
         if instance.addon_to_id:
             del self.fields['operation_split']
 
-        if not instance.seat and not (
-                instance.item.seat_category_mappings.filter(subevent=instance.subevent).exists()
-        ):
+        if not instance.seat and not instance._seat_allowed:
             del self.fields['seat']
 
         choices = [

src/pretix/control/logdisplay.py

@@ -33,6 +33,7 @@
 # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 # License for the specific language governing permissions and limitations under the License.
 
+import functools
 from collections import defaultdict
 from datetime import datetime
 from decimal import Decimal
@@ -69,6 +70,15 @@ OVERVIEW_BANLIST = [
 ]
 
 
+@functools.lru_cache(maxsize=32)
+def object_id_to_string(model_class, **kwargs):
+    # The cache is thread-local and persists requests, but it's small enough that we can accept that
+    try:
+        return str(model_class.objects.get(**kwargs))
+    except model_class.DoesNotExist:
+        return "?"
+
+
 class OrderChangeLogEntryType(OrderLogEntryType):
     prefix = _('The order has been changed:')
 
@@ -93,10 +103,10 @@ class OrderItemChanged(OrderChangeLogEntryType):
     def display_prefixed(self, event: Event, logentry: LogEntry, data):
         old_item = str(event.items.get(pk=data['old_item']))
         if data['old_variation']:
-            old_item += ' - ' + str(ItemVariation.objects.get(item__event=event, pk=data['old_variation']))
+            old_item += ' - ' + str(object_id_to_string(ItemVariation, item__event_id=event.pk, pk=data['old_variation']))
         new_item = str(event.items.get(pk=data['new_item']))
         if data['new_variation']:
-            new_item += ' - ' + str(ItemVariation.objects.get(item__event=event, pk=data['new_variation']))
+            new_item += ' - ' + str(object_id_to_string(ItemVariation, item__event_id=event.pk, pk=data['new_variation']))
         return _('Position #{posid}: {old_item} ({old_price}) changed to {new_item} ({new_price}).').format(
             posid=data.get('positionid', '?'),
             old_item=old_item, new_item=new_item,
@@ -153,14 +163,14 @@ class OrderTaxRuleChanged(OrderChangeLogEntryType):
         if 'positionid' in data:
             return _('Tax rule of position #{posid} changed from {old_rule} to {new_rule}.').format(
                 posid=data.get('positionid', '?'),
-                old_rule=TaxRule.objects.get(pk=data['old_taxrule']) if data['old_taxrule'] else '–',
-                new_rule=TaxRule.objects.get(pk=data['new_taxrule']),
+                old_rule=object_id_to_string(TaxRule, pk=data['old_taxrule']) if data['old_taxrule'] else '–',
+                new_rule=object_id_to_string(TaxRule, pk=data['new_taxrule']),
             )
         elif 'fee' in data:
             return _('Tax rule of fee #{fee} changed from {old_rule} to {new_rule}.').format(
                 fee=data.get('fee', '?'),
-                old_rule=TaxRule.objects.get(pk=data['old_taxrule']) if data['old_taxrule'] else '–',
-                new_rule=TaxRule.objects.get(pk=data['new_taxrule']),
+                old_rule=object_id_to_string(TaxRule, pk=data['old_taxrule']) if data['old_taxrule'] else '–',
+                new_rule=object_id_to_string(TaxRule, pk=data['new_taxrule']),
             )
 
 
@@ -204,7 +214,7 @@ class OrderCanceled(OrderChangeLogEntryType):
     def display_prefixed(self, event: Event, logentry: LogEntry, data):
         old_item = str(event.items.get(pk=data['old_item']))
         if data['old_variation']:
-            old_item += ' - ' + str(ItemVariation.objects.get(pk=data['old_variation']))
+            old_item += ' - ' + object_id_to_string(ItemVariation, pk=data['old_variation'])
         return _('Position #{posid} ({old_item}, {old_price}) canceled.').format(
             posid=data.get('positionid', '?'),
             old_item=old_item,
@@ -219,7 +229,7 @@ class OrderPositionAdded(OrderChangeLogEntryType):
     def display_prefixed(self, event: Event, logentry: LogEntry, data):
         item = str(event.items.get(pk=data['item']))
         if data['variation']:
-            item += ' - ' + str(ItemVariation.objects.get(item__event=event, pk=data['variation']))
+            item += ' - ' + object_id_to_string(ItemVariation, item__event_id=event.pk, pk=data['variation'])
         if data['addon_to']:
             addon_to = OrderPosition.objects.get(order__event=event, pk=data['addon_to'])
             return _('Position #{posid} created: {item} ({price}) as an add-on to position #{addon_to}.').format(
@@ -283,7 +293,7 @@ class OrderChangedSplit(OrderChangeLogEntryType):
     def display_prefixed(self, event: Event, logentry: LogEntry, data):
         old_item = str(event.items.get(pk=data['old_item']))
         if data['old_variation']:
-            old_item += ' - ' + str(ItemVariation.objects.get(pk=data['old_variation']))
+            old_item += ' - ' + object_id_to_string(ItemVariation, pk=data['old_variation'])
         url = reverse('control:event.order', kwargs={
             'event': event.slug,
             'organizer': event.organizer.slug,
@@ -339,6 +349,7 @@ class OrderChangedSplitFrom(OrderLogEntryType):
     'pretix.event.checkin.reverted': _('The check-in of position #{posid} on list "{list}" has been reverted.'),
 })
 class CheckinErrorLogEntryType(OrderLogEntryType):
+
     def display(self, logentry: LogEntry, data):
         return self.display_plain(self.plain, logentry, data)
 
@@ -353,10 +364,7 @@ class CheckinErrorLogEntryType(OrderLogEntryType):
         event = logentry.event
 
         if 'list' in data and event:
-            try:
-                data['list'] = event.checkin_lists.get(pk=data.get('list')).name
-            except CheckinList.DoesNotExist:
-                data['list'] = _("(unknown)")
+            data['list'] = object_id_to_string(CheckinList, event_id=event.id, pk=data['list'])
         else:
             data['list'] = _("(unknown)")
 

src/pretix/control/templates/pretixcontrol/event/logs.html

@@ -1,12 +1,41 @@
 {% extends "pretixcontrol/items/base.html" %}
 {% load i18n %}
 {% load static %}
-{% load bootstrap3 %}
-{% load icon %}
 {% block title %}{% trans "Event logs" %}{% endblock %}
 {% block inside %}
     <h1>{% trans "Event logs" %}</h1>
-    {% include "pretixcontrol/fragment_log_filter_form.html" %}
+    <form class="form-inline helper-display-inline" action="" method="get">
+        <input type="hidden" name="content_type" value="{{ request.GET.content_type }}">
+        <input type="hidden" name="object" value="{{ request.GET.object }}">
+        <p>
+            <select name="user" class="form-control">
+                <option value="">{% trans "All actions" %}</option>
+                <option value="yes" {% if request.GET.user == "yes" %}selected="selected"{% endif %}>
+                    {% trans "Team actions" %}
+                </option>
+                <option value="no" {% if request.GET.user == "no" %}selected="selected"{% endif %}>
+                    {% trans "Customer actions" %}
+                </option>
+                {% for up in userlist %}
+                    {% if up.user__id %}
+                        <option value="{{ up.user__id }}"
+                                {% if request.GET.user == up.user__id %}selected="selected"{% endif %}>
+                            {{ up.user__email }}
+                        </option>
+                    {% endif %}
+                {% endfor %}
+                {% for d in devicelist %}
+                    {% if d.device__id %}
+                        <option value="d-{{ d.device__id }}"
+                                {% if "d-" in request.GET.user and request.GET.user|slice:"2:" == d.device__id|slugify %}selected="selected"{% endif %}>
+                            {{ d.device__name }}
+                        </option>
+                    {% endif %}
+                {% endfor %}
+            </select>
+            <button class="btn btn-primary" type="submit">{% trans "Filter" %}</button>
+        </p>
+    </form>
     <ul class="list-group">
         {% for log in logs %}
             <li class="list-group-item logentry">
@@ -66,5 +95,5 @@
             </div>
         {% endfor %}
     </ul>
-    {% include "pretixcontrol/pagination_huge.html" %}
+    {% include "pretixcontrol/pagination.html" %}
 {% endblock %}

src/pretix/control/templates/pretixcontrol/fragment_log_filter_form.html

@@ -1,38 +0,0 @@
-{% load i18n %}
-{% load bootstrap3 %}
-{% load icon %}
-<div class="panel panel-default">
-    <div class="panel-heading">
-        <h3 class="panel-title">
-            {% trans "Filter" %}
-        </h3>
-    </div>
-    <form class="panel-body filter-form" action="" method="get">
-        <div class="row">
-            <div class="col-md-3 col-xs-6">
-                {% bootstrap_field filter_form.source %}
-            </div>
-            <div class="col-md-3 col-xs-6">
-                {% bootstrap_field filter_form.device %}
-            </div>
-            <div class="col-md-3 col-xs-6">
-                {% bootstrap_field filter_form.user_email %}
-            </div>
-        </div>
-        {{ filter_form.action_type }}
-        {{ filter_form.content_type }}
-        {{ filter_form.object }}
-        {% if filter_form.is_valid and filter_form.cleaned_data.action_type %}
-            {% icon "filter" %} <code>{{ filter_form.cleaned_data.action_type }}</code>
-        {% endif %}
-        {% if filter_form.is_valid and filter_form.cleaned_data.content_type and filter_form.cleaned_data.object %}
-            {% icon "filter" %} {% trans "Specific object selected" %}
-        {% endif %}
-        <div class="text-right flip">
-            <button class="btn btn-primary btn-lg" type="submit">
-                <span class="fa fa-filter"></span>
-                {% trans "Filter" %}
-            </button>
-        </div>
-    </form>
-</div>

src/pretix/control/templates/pretixcontrol/order/index.html

@@ -833,7 +833,7 @@
                                 <strong>{% trans "Pending total" %}</strong>
                             </div>
                             <div class="col-md-3 col-xs-6 col-md-offset-5 price">
-                                <strong>{{ order.pending_sum|money:event.currency }}</strong>
+                                <strong>{{ pending_sum|money:event.currency }}</strong>
                             </div>
                             <div class="clearfix"></div>
                         </div>

src/pretix/control/templates/pretixcontrol/organizers/logs.html

@@ -4,7 +4,24 @@
 {% block title %}{% trans "Organizer logs" %}{% endblock %}
 {% block inside %}
     <h1>{% trans "Organizer logs" %}</h1>
-    {% include "pretixcontrol/fragment_log_filter_form.html" %}
+    <form class="form-inline helper-display-inline" action="" method="get">
+        <input type="hidden" name="content_type" value="{{ request.GET.content_type }}">
+        <input type="hidden" name="object" value="{{ request.GET.object }}">
+        <p>
+            <select name="user" class="form-control">
+                <option value="">{% trans "All actions" %}</option>
+                {% for up in userlist %}
+                    {% if up.user__id %}
+                        <option value="{{ up.user__id }}"
+                                {% if request.GET.user == up.user__id %}selected="selected"{% endif %}>
+                            {{ up.user__email }}
+                        </option>
+                    {% endif %}
+                {% endfor %}
+            </select>
+            <button class="btn btn-primary" type="submit">{% trans "Filter" %}</button>
+        </p>
+    </form>
     <ul class="list-group">
         {% for log in logs %}
             <li class="list-group-item logentry">
@@ -64,5 +81,5 @@
             </div>
         {% endfor %}
     </ul>
-    {% include "pretixcontrol/pagination_huge.html" %}
+    {% include "pretixcontrol/pagination.html" %}
 {% endblock %}

src/pretix/control/views/event.py

@@ -60,7 +60,7 @@ from django.http import (
     Http404, HttpResponse, HttpResponseBadRequest, HttpResponseNotAllowed,
     JsonResponse,
 )
-from django.shortcuts import redirect
+from django.shortcuts import get_object_or_404, redirect
 from django.urls import NoReverseMatch, reverse
 from django.utils.functional import cached_property
 from django.utils.html import conditional_escape, format_html
@@ -119,9 +119,8 @@ from ...helpers.compat import CompatDeleteView
 from ...helpers.format import (
     PlainHtmlAlternativeString, SafeFormatter, format_map,
 )
-from ..forms.filter import LogFilterForm
 from ..logdisplay import OVERVIEW_BANLIST
-from . import CreateView, LargeResultSetPaginator, PaginationMixin, UpdateView
+from . import CreateView, PaginationMixin, UpdateView
 
 logger = logging.getLogger(__name__)
 
@@ -1254,7 +1253,6 @@ class EventDelete(RecentAuthenticationRequiredMixin, EventPermissionRequiredMixi
 class EventLog(EventPermissionRequiredMixin, PaginationMixin, ListView):
     template_name = 'pretixcontrol/event/logs.html'
     model = LogEntry
-    paginator_class = LargeResultSetPaginator
     context_object_name = 'logs'
 
     def get_queryset(self):
@@ -1284,20 +1282,32 @@ class EventLog(EventPermissionRequiredMixin, PaginationMixin, ListView):
                 ]
             qs = qs.filter(content_type__in=allowed_types)
 
-        if self.filter_form.is_valid():
-            qs = self.filter_form.filter_qs(qs)
+        if self.request.GET.get('user') == 'yes':
+            qs = qs.filter(user__isnull=False)
+        elif self.request.GET.get('user') == 'no':
+            qs = qs.filter(user__isnull=True)
+        elif self.request.GET.get('user', '').startswith('d-'):
+            qs = qs.filter(device_id=self.request.GET.get('user')[2:])
+        elif self.request.GET.get('user'):
+            qs = qs.filter(user_id=self.request.GET.get('user'))
+
+        if self.request.GET.get('action_type'):
+            qs = qs.filter(action_type=self.request.GET['action_type'])
+
+        if self.request.GET.get('content_type'):
+            qs = qs.filter(content_type=get_object_or_404(ContentType, pk=self.request.GET.get('content_type')))
+
+            if self.request.GET.get('object'):
+                qs = qs.filter(object_id=self.request.GET.get('object'))
 
         return qs
 
     def get_context_data(self, **kwargs):
         ctx = super().get_context_data()
-        ctx['filter_form'] = self.filter_form
+        ctx['userlist'] = self.request.event.logentry_set.order_by().distinct().values('user__id', 'user__email')
+        ctx['devicelist'] = self.request.event.logentry_set.order_by('device__name').distinct().values('device__id', 'device__name')
         return ctx
 
-    @cached_property
-    def filter_form(self):
-        return LogFilterForm(data=self.request.GET, organizer=self.request.organizer)
-
 
 class EventComment(EventPermissionRequiredMixin, View):
     permission = 'event.settings.general:write'

src/pretix/control/views/orders.py

@@ -81,7 +81,7 @@ from pretix.base.i18n import language
 from pretix.base.models import (
     CachedFile, CachedTicket, Checkin, GiftCard, Invoice, InvoiceAddress, Item,
     ItemVariation, LogEntry, Order, QuestionAnswer, Quota,
-    ScheduledEventExport, generate_secret,
+    ScheduledEventExport, SeatCategoryMapping, generate_secret,
 )
 from pretix.base.models.orders import (
     CancellationRequest, OrderFee, OrderPayment, OrderPosition, OrderRefund,
@@ -564,10 +564,11 @@ class OrderDetail(OrderView):
         })
         ctx['display_locale'] = dict(settings.LANGUAGES)[self.object.locale or self.request.event.settings.locale]
 
-        ctx['overpaid'] = self.order.pending_sum * -1
+        pending_sum = self.order.pending_sum
+        ctx['overpaid'] = pending_sum * -1
         ctx['download_buttons'] = self.download_buttons
         ctx['payment_refund_sum'] = self.order.payment_refund_sum
-        ctx['pending_sum'] = self.order.pending_sum
+        ctx['pending_sum'] = pending_sum
         ctx['uncancelled_invoice'] = self.order.invoices.exclude(
             Exists(self.order.invoices.filter(refers=OuterRef('pk'), is_cancellation=True))
         ).exclude(is_cancellation=True).first()
@@ -601,8 +602,9 @@ class OrderDetail(OrderView):
         ).prefetch_related(
             'item__questions', 'issued_gift_cards', 'owned_gift_cards', 'linked_media',
             Prefetch('answers', queryset=QuestionAnswer.objects.prefetch_related('options').select_related('question')),
-            Prefetch('all_checkins', queryset=Checkin.all.select_related('list').order_by('datetime')),
+            Prefetch('all_checkins', queryset=Checkin.all.select_related('list', 'gate').order_by('datetime')),
             Prefetch('print_logs', queryset=PrintLog.objects.select_related('device').order_by('datetime')),
+            Prefetch('subevent', queryset=self.request.event.subevents.all()),
         ).order_by('positionid')
 
         positions = []
@@ -1985,20 +1987,37 @@ class OrderChange(OrderView):
     def fees(self):
         fees = list(self.order.fees.all())
         for f in fees:
-            f.form = OrderFeeChangeForm(prefix='of-{}'.format(f.pk), instance=f,
-                                        data=self.request.POST if self.request.method == "POST" else None)
+            f.form = OrderFeeChangeForm(
+                prefix='of-{}'.format(f.pk),
+                instance=f,
+                data=self.request.POST if self.request.method == "POST" else None
+            )
         return fees
 
     @cached_property
     def positions(self):
         positions = list(self.order.positions.select_related(
             'item', 'item__tax_rule', 'used_membership', 'used_membership__membership_type', 'tax_rule',
-            'seat', 'subevent',
-        ).prefetch_related('granted_memberships', 'issued_gift_cards'))
+            'seat',
+        ).prefetch_related(
+            Prefetch(
+                'subevent',
+                queryset=self.request.event.subevents.all(),
+            ),
+            'granted_memberships',
+            'issued_gift_cards',
+            'addons',
+        ).annotate(
+            _seat_allowed=Exists(SeatCategoryMapping.objects.filter(subevent=OuterRef("subevent"), product=OuterRef("item")))
+        ))
         for p in positions:
-            p.form = OrderPositionChangeForm(prefix='op-{}'.format(p.pk), instance=p, items=self.items,
-                                             initial={'seat': p.seat.seat_guid if p.seat else None},
-                                             data=self.request.POST if self.request.method == "POST" else None)
+            p.form = OrderPositionChangeForm(
+                prefix='op-{}'.format(p.pk),
+                instance=p,
+                items=self.items,
+                initial={'seat': p.seat.seat_guid if p.seat else None},
+                data=self.request.POST if self.request.method == "POST" else None
+            )
         return positions
 
     def get_context_data(self, **kwargs):

src/pretix/control/views/organizer.py

@@ -113,8 +113,7 @@ from pretix.base.views.tasks import AsyncAction
 from pretix.control.forms.exports import ScheduledOrganizerExportForm
 from pretix.control.forms.filter import (
     CustomerFilterForm, DeviceFilterForm, EventFilterForm, GiftCardFilterForm,
-    LogFilterForm, OrganizerFilterForm, ReusableMediaFilterForm,
-    TeamFilterForm,
+    OrganizerFilterForm, ReusableMediaFilterForm, TeamFilterForm,
 )
 from pretix.control.forms.orders import ExporterForm
 from pretix.control.forms.organizer import (
@@ -134,7 +133,7 @@ from pretix.control.permissions import (
     organizer_permission_required,
 )
 from pretix.control.signals import nav_organizer
-from pretix.control.views import LargeResultSetPaginator, PaginationMixin
+from pretix.control.views import PaginationMixin
 from pretix.control.views.mailsetup import MailSettingsSetupView
 from pretix.helpers import OF_SELF, GroupConcat
 from pretix.helpers.compat import CompatDeleteView
@@ -2664,7 +2663,6 @@ class LogView(OrganizerPermissionRequiredMixin, PaginationMixin, ListView):
     template_name = 'pretixcontrol/organizers/logs.html'
     permission = 'organizer.settings.general:write'
     model = LogEntry
-    paginator_class = LargeResultSetPaginator
     context_object_name = 'logs'
 
     def get_queryset(self):
@@ -2674,21 +2672,16 @@ class LogView(OrganizerPermissionRequiredMixin, PaginationMixin, ListView):
             'user', 'content_type', 'api_token', 'oauth_application', 'device'
         ).order_by('-datetime')
         qs = qs.exclude(action_type__in=OVERVIEW_BANLIST)
-
-        if self.filter_form.is_valid():
-            qs = self.filter_form.filter_qs(qs)
-
+        if self.request.GET.get('action_type'):
+            qs = qs.filter(action_type=self.request.GET['action_type'])
+        if self.request.GET.get('user'):
+            qs = qs.filter(user_id=self.request.GET.get('user'))
         return qs
 
     def get_context_data(self, **kwargs):
         ctx = super().get_context_data()
-        ctx['filter_form'] = self.filter_form
         return ctx
 
-    @cached_property
-    def filter_form(self):
-        return LogFilterForm(data=self.request.GET, organizer=self.request.organizer)
-
 
 class MembershipTypeListView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, ListView):
     model = MembershipType

src/pretix/helpers/monkeypatching.py

@@ -27,7 +27,6 @@ from http import cookies
 
 from django.conf import settings
 from django.core.exceptions import SuspiciousFileOperation
-from django.middleware.csrf import CsrfViewMiddleware as BaseCsrfMiddleware
 from PIL import Image
 from requests.adapters import HTTPAdapter
 from urllib3.connection import HTTPConnection, HTTPSConnection
@@ -43,7 +42,6 @@ from urllib3.util.timeout import _DEFAULT_TIMEOUT
 
 from pretix.helpers.reportlab import ThumbnailingImageReader
 from pretix.helpers.ssrf import should_block_access
-from pretix.multidomain.middlewares import CsrfViewMiddleware
 
 
 def monkeypatch_vobject_performance():
@@ -244,13 +242,6 @@ def monkeypatch_reportlab_imagereader():
     utils.ImageReader.__init__ = new_init
 
 
-def monkeypatch_csrf_middleware():
-    # Some views from django or plugins use the middleware or the derived decorators directly,
-    # so we have to also patch the stock middleware
-    BaseCsrfMiddleware._get_secret = CsrfViewMiddleware._get_secret
-    BaseCsrfMiddleware._set_csrf_cookie = CsrfViewMiddleware._set_csrf_cookie
-
-
 def monkeypatch_all_at_ready():
     monkeypatch_vobject_performance()
     monkeypatch_pillow_safer()
@@ -258,4 +249,3 @@ def monkeypatch_all_at_ready():
     monkeypatch_urllib3_ssrf_protection()
     monkeypatch_cookie_morsel()
     monkeypatch_reportlab_imagereader()
-    monkeypatch_csrf_middleware()

src/pretix/multidomain/middlewares.py

@@ -302,6 +302,19 @@ class CsrfViewMiddleware(BaseCsrfMiddleware):
             # Content varies with the CSRF cookie, so set the Vary header.
             patch_vary_headers(response, ('Cookie',))
 
+    def process_response(self, request, response):
+        if (
+            not settings.CSRF_USE_SESSIONS
+            and request.is_secure()
+            and settings.CSRF_COOKIE_NAME in response.cookies
+            and response.cookies[settings.CSRF_COOKIE_NAME].value
+        ):
+            logger.warning("Usage of djangos CsrfViewMiddleware detected (legacy cookie found in response). "
+                           "This may be caused by using csrf_project or requires_csrf_token from django.views.decorators.csrf. "
+                           "Use the pretix.multidomain.middlewares equivalent instead.")
+
+        return super().process_response(request, response)
+
 
 def handle_duplicated_csrftoken(request, response):
     # Due to a Safari bug, in some browser, two csrftoken cookies can exist:

src/pretix/static/pretixpresale/widget/src/button.ts

@@ -60,18 +60,8 @@ export function createButtonInstance (element: Element, htmlId?: string): App {
 	app.config.errorHandler = (error, _vm, info) => {
 		console.error('[pretix-button]', info, error)
 	}
-	// Instead of mounting to the element directly, replicate vue2.7 behaviour, where
-	// the HTML-element gets replaced instead of vue3’s behaviour to replace innerHTML.
-	// The latter can cause issues with custom CSS as HTML structure would change.
-	// app.mount(element)
-	// observer.observe(element, { attributes: true })
-	const fragment = document.createDocumentFragment()
-	app.mount(fragment)
-	for (const attr of element.attributes) {
-		fragment.firstChild.setAttribute(attr.name, attr.value)
-	}
-	observer.observe(fragment.firstChild, { attributes: true })
-	element.parentNode.replaceChild(fragment, element)
+	app.mount(element)
+	observer.observe(element, { attributes: true })
 
 	return app
 }

src/pretix/static/pretixpresale/widget/src/widget.ts

@@ -56,18 +56,8 @@ export function createWidgetInstance (element: Element, htmlId?: string): App {
 	app.config.errorHandler = (error, _vm, info) => {
 		console.error('[pretix-widget]', info, error)
 	}
-	// Instead of mounting to the element directly, replicate vue2.7 behaviour, where
-	// the HTML-element gets replaced instead of vue3’s behaviour to replace innerHTML.
-	// The latter can cause issues with custom CSS as HTML structure would change.
-	// app.mount(element)
-	// observer.observe(element, { attributes: true })
-	const fragment = document.createDocumentFragment()
-	app.mount(fragment)
-	for (const attr of element.attributes) {
-		fragment.firstChild.setAttribute(attr.name, attr.value)
-	}
-	observer.observe(fragment.firstChild, { attributes: true })
-	element.parentNode.replaceChild(fragment, element)
+	app.mount(element)
+	observer.observe(element, { attributes: true })
 
 	return app
 }