Add reset button

* Money representation in templates: Allow more precision

When rendering money in templates, we used to have the following logic:

- When the decimal places fit the currency, render with Babel
- When they don't, e.g. we stored 123.67 JPY, even though there are no
  fractional Yens, render without Babel with a custom format, but render
  the fractional Yens because we'd rather *show* wrong data and make the
  bug obvious than hide it.

However, we only did that up to a prevision of two places, we never
showed more. This is still sufficient for core pretix, but we have
plugins that need to operate in fractional cents. Also, we CAN render
everything through babel for consistent formatting.

There is one **risk**: This might cause weird results on SQLite. Since
SQLite has no concept of precise decimal math, results of in-SQL
computations can sometimes experience floating point errors and show
with A LOT of decimal palces. This used to be invisible since the UI
performed the rounding. With this PR – not any more. We'll need to see
how annoying it is, but it should only affect development mode.

This PR also fixes a bug in tax_rate_format that for some reason did not
do what it was supposed to do, even though I tested it back then, weird.
Might even be a Python version thing?

* Update src/pretix/base/templatetags/money.py

Co-authored-by: pajowu <engelhardt@pretix.eu>

* Apply suggestion from @pajowu

Co-authored-by: pajowu <engelhardt@pretix.eu>

* Fix typing stuff

* Fix precision issue

---------

Co-authored-by: pajowu <engelhardt@pretix.eu>

.git-blame-ignore-revs

@@ -0,0 +1,2 @@
+# Format pre-vue code with eslint where possible (2026-09-10)
+d85e52c83ed3639e040372fd0052e842e4899d90

eslint.config.mjs

@@ -49,6 +49,7 @@ const ignores = globalIgnores([
 	'src/pretix/static/pretixcontrol/js/ui/editor.js',
 	'src/pretix/static/pretixcontrol/js/ui/geo.js',
 	'src/pretix/static/pretixcontrol/js/ui/main.js',
+	'src/pretix/static/pretixcontrol/js/ui/plugins.js',
 	'src/pretix/static/pretixcontrol/js/ui/subevent.js',
 	'src/pretix/static/pretixcontrol/js/ui/variations.js',
 	'src/pretix/static/pretixcontrol/js/ui/webauthn.js',

package-lock.json

@@ -4148,9 +4148,9 @@
       }
     },
     "node_modules/smol-toml": {
-      "version": "1.6.1",
-      "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.6.1.tgz",
-      "integrity": "sha512-dWUG8F5sIIARXih1DTaQAX4SsiTXhInKf1buxdY9DIg4ZYPZK5nGM1VRIYmEbDbsHt7USo99xSLFu5Q1IqTmsg==",
+      "version": "1.7.1",
+      "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.7.1.tgz",
+      "integrity": "sha512-PPlsspAZ4jbMBu5DMFhfUGDQLu/vrL4SyBROVS37x8ynnVmFIs1VPBz1Co8Xks3TvpIaZXmU85y4DrQ+UyVFoQ==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {

pyproject.toml

@@ -37,10 +37,10 @@ dependencies = [
   "css-inline==0.21.*",
   "defusedcsv>=3.0.0",
   "dnspython==2.*",
-  "Django[argon2]==5.2.*",
+  "Django[argon2]==5.2.*,>=5.2.17",
   "django-bootstrap3==26.2",
   "django-compressor==4.6.0",
-  "django-countries==9.0.*",
+  "django-countries==9.1.*",
   "django-filter==26.1",
   "django-formset-js-improved==0.5.0.5",
   "django-formtools==2.7",
@@ -75,7 +75,7 @@ dependencies = [
   "packaging",
   "paypalrestsdk==1.13.*",
   "paypal-checkout-serversdk==1.0.*",
-  "PyJWT==2.13.*",
+  "PyJWT==2.14.*",
   "phonenumberslite==9.0.*",
   "Pillow==12.3.*",
   "pretix-plugin-build",
@@ -84,7 +84,7 @@ dependencies = [
   "pycountry",
   "pycparser==3.0",
   "pycryptodome==3.23.*",
-  "pypdf==6.5.*",
+  "pypdf==6.11.*",
   "python-bidi==0.6.*",  # Support for Arabic in reportlab
   "python-dateutil==2.9.*",
   "pytz",
@@ -94,7 +94,7 @@ dependencies = [
   "redis==7.4.*",
   "reportlab==5.0.*",
   "requests==2.34.*",
-  "sentry-sdk==2.68.*",
+  "sentry-sdk==2.69.*",
   "sepaxml==2.7.*",
   "stripe==7.9.*",
   "text-unidecode==1.*",

src/pretix/base/exporters/invoices.py

@@ -54,6 +54,7 @@ from ...control.forms.filter import get_all_payment_providers
 from ...helpers import GroupConcat
 from ...helpers.iter import chunked_iterable
 from ..exporter import BaseExporter, MultiSheetListExporter
+from ..invoicing.transmission import get_transmission_types
 from ..services.export import ExportError
 from ..services.invoices import invoice_pdf_task
 from ..signals import (
@@ -197,7 +198,7 @@ class InvoiceDataExporter(InvoiceExporterMixin, MultiSheetListExporter):
     def iterate_sheet(self, form_data, sheet):
         _ = gettext
         if sheet == 'invoices':
-            yield [
+            headers = [
                 _('Invoice number'),
                 _('Date'),
                 _('Order code'),
@@ -230,8 +231,18 @@ class InvoiceDataExporter(InvoiceExporterMixin, MultiSheetListExporter):
                 _('Total value (without taxes)'),
                 _('Payment matching IDs'),
                 _('Payment providers'),
+                _('Transmission type'),
+                _('Transmission status'),
+                _('Transmission date'),
             ]
 
+            transmission_types = get_transmission_types()
+            for tt in transmission_types:
+                for c in tt.describe_info_columns():
+                    headers.append(str(tt.verbose_name) + ': ' + str(c))
+
+            yield headers
+
             p_providers = OrderPayment.objects.filter(
                 order=OuterRef('order'),
                 state__in=(OrderPayment.PAYMENT_STATE_CONFIRMED, OrderPayment.PAYMENT_STATE_REFUNDED,
@@ -242,7 +253,7 @@ class InvoiceDataExporter(InvoiceExporterMixin, MultiSheetListExporter):
                 'm'
             ).order_by()
 
-            base_qs = self.invoices_queryset(form_data)\
+            base_qs = self.invoices_queryset(form_data)
 
             qs = base_qs.select_related(
                 'order', 'refers'
@@ -280,7 +291,7 @@ class InvoiceDataExporter(InvoiceExporterMixin, MultiSheetListExporter):
                                 if mid:
                                     pmis.append(mid)
                     pmi = '\n'.join(pmis)
-                    yield [
+                    line = [
                         i.full_invoice_no,
                         date_format(i.date, "SHORT_DATE_FORMAT"),
                         i.order.code,
@@ -315,8 +326,20 @@ class InvoiceDataExporter(InvoiceExporterMixin, MultiSheetListExporter):
                         ', '.join([
                             str(self.providers.get(p, p)) for p in sorted(set((i.payment_providers or '').split(',')))
                             if p and p != 'free'
-                        ])
+                        ]),
+                        i.transmission_type_instance.verbose_name,
+                        i.get_transmission_status_display(),
+                        date_format(i.transmission_date, "SHORT_DATETIME_FORMAT") if i.transmission_date else "",
                     ]
+                    for tt in transmission_types:
+                        if tt.identifier == i.transmission_type:
+                            described = dict(tt.describe_info(i.invoice_to_transmission_info, i.invoice_to_country, i.invoice_to_is_business))
+                            for c in tt.describe_info_columns():
+                                line.append(described.get(c, ""))
+                        else:
+                            for c in tt.describe_info_columns():
+                                line.append("")
+                    yield line
         elif sheet == 'lines':
             yield [
                 _('Invoice number'),

src/pretix/base/forms/questions.py

@@ -350,16 +350,22 @@ class WrappedPhonePrefixSelect(Select):
         return super().render(name, value or self.initial, *args, **kwargs)
 
     def get_context(self, name, value, attrs):
-        if value and self.choices[1][0] != value:
-            matching_choices = len([1 for p, c in self.choices if p == value])
+        # self.choices is lazy evaluated, needs to be realized to be modifiable
+        choices = list(self.choices)
+        if value and choices[1][0] != value:
+            matching_choices = len([1 for p, c in choices if p == value])
             if matching_choices > 1:
                 # Some countries share a phone prefix, for example +1 is used all over the Americas.
                 # This causes a UX problem: If the default value or the existing data is +12125552368,
                 # the widget will just show the first <option> entry with value="+1" as selected,
                 # which alphabetically is America Samoa, although most numbers statistically are from
-                # the US. As a workaround, we detect this case and add an aditional choice value with
+                # the US. As a workaround, we detect this case and add an additional choice value with
                 # just <option value="+1">+1</option> without an explicit country.
-                self.choices.insert(1, (value, value))
+                self.choices = [
+                    choices[0],
+                    (value, value),
+                    *choices[1:],
+                ]
         context = super().get_context(name, value, attrs)
         return context
 

src/pretix/base/invoicing/transmission.py

@@ -107,6 +107,9 @@ class TransmissionType:
     def transmission_info_to_form_data(self, transmission_info: dict) -> dict:
         return transmission_info
 
+    def describe_info_columns(self):
+        return [f.label for f in self.invoice_address_form_fields.values()]
+
     def describe_info(self, transmission_info: dict, country: Country, is_business: bool):
         form_data = self.transmission_info_to_form_data(transmission_info)
         data = []

src/pretix/base/models/devices.py

@@ -166,6 +166,7 @@ class Device(LoggedModel):
     )
     security_profile = models.CharField(
         max_length=190,
+        verbose_name=_('Security profile'),
         default='full',
         null=True,
         blank=False

src/pretix/base/pdf.py

@@ -801,6 +801,18 @@ def generate_compressed_addon_list(op, order, event, only_checked_in=False):
     return addonlist
 
 
+def get_sizebox(page: pypdf.PageObject):
+    mediabox = page.mediabox
+    cropbox = page.cropbox
+
+    return pypdf.generic.RectangleObject((
+        max(mediabox[0], cropbox[0]),
+        max(mediabox[1], cropbox[1]),
+        min(mediabox[2], cropbox[2]),
+        min(mediabox[3], cropbox[3]),
+    ))
+
+
 class Renderer:
 
     def __init__(self, event, layout, background_file):
@@ -1153,11 +1165,10 @@ class Renderer:
                 elif o['type'] == "poweredby":
                     self._draw_poweredby(canvas, op, o)
                 if self.bg_pdf:
-                    page_size = (
-                        self.bg_pdf.pages[0].mediabox[2] - self.bg_pdf.pages[0].mediabox[0],
-                        self.bg_pdf.pages[0].mediabox[3] - self.bg_pdf.pages[0].mediabox[1]
-                    )
-                    if self.bg_pdf.pages[0].get('/Rotate') in (90, 270):
+                    first_page = self.bg_pdf.pages[0]
+                    sizebox = get_sizebox(first_page)
+                    page_size = (sizebox.width, sizebox.height)
+                    if first_page.rotation in (90, 270):
                         # swap dimensions due to pdf being rotated
                         page_size = page_size[::-1]
                     canvas.setPageSize(page_size)
@@ -1232,9 +1243,7 @@ class Renderer:
 
             for i, page in enumerate(fg_pdf.pages):
                 bg_page = self.bg_pdf.pages[i]
-                _correct_page_media_box(bg_page)
-                page.merge_page(bg_page, over=False)
-                output.add_page(page)
+                _merge_with_correct_page_media_box(output, page, bg_page)
 
             # pdf_header is a string like "%pdf-X.X"
             if float(self.bg_pdf.pdf_header[5:]) > float(fg_pdf.pdf_header[5:]):
@@ -1299,39 +1308,36 @@ def merge_background(fg_pdf: PdfWriter, bg_pdf: PdfWriter, out_file, compress):
             bg_pdf.write(bg_filename)
             subprocess.run(pdftk_cmd, check=True, stdout=out_file)
     else:
+        output = PdfWriter()
         for i, page in enumerate(fg_pdf.pages):
             bg_page = bg_pdf.pages[i]
-            _correct_page_media_box(bg_page)
-            page.merge_page(bg_page, over=False)
+            _merge_with_correct_page_media_box(output, page, bg_page)
 
         # pdf_header is a string like "%pdf-X.X"
-        if float(bg_pdf.pdf_header[5:]) > float(fg_pdf.pdf_header[5:]):
-            fg_pdf.pdf_header = bg_pdf.pdf_header
-
-        fg_pdf.write(out_file)
+        output.pdf_header = (
+            bg_pdf.pdf_header
+            if float(bg_pdf.pdf_header[5:]) > float(fg_pdf.pdf_header[5:])
+            else fg_pdf.pdf_header
+        )
+        output.write(out_file)
 
 
-def _correct_page_media_box(page: pypdf.PageObject):
-    if page.rotation != 0:
-        page.transfer_rotation_to_content()
-    media_box = page.mediabox
+def _merge_with_correct_page_media_box(output: pypdf.PdfWriter, fg_page: pypdf.PageObject, bg_page: pypdf.PageObject):
+    """
+    Adds fg_page to output, merging bg_page behind it.
+
+    If bg_page has a non-zero mergebox/cropbox or is rotated via /Rotate, a transformation is applied to fix this."""
     trsf = pypdf.Transformation()
-    if media_box.bottom != 0:
-        trsf = trsf.translate(0, -media_box.bottom)
-    if media_box.left != 0:
-        trsf = trsf.translate(-media_box.left, 0)
-    page.add_transformation(trsf, False)
-    for b in ["/MediaBox", "/CropBox", "/BleedBox", "/TrimBox", "/ArtBox"]:
-        if b in page:
-            rr = pypdf.generic.RectangleObject(page[b])
-            pt1 = trsf.apply_on(rr.lower_left)
-            pt2 = trsf.apply_on(rr.upper_right)
-            page[pypdf.generic.NameObject(b)] = pypdf.generic.RectangleObject((
-                min(pt1[0], pt2[0]),
-                min(pt1[1], pt2[1]),
-                max(pt1[0], pt2[0]),
-                max(pt1[1], pt2[1]),
-            ))
+    if bg_page.rotation != 0:
+        trsf = trsf.rotate(-bg_page.rotation)
+
+    mb = get_sizebox(bg_page)
+    pt1 = trsf.apply_on(mb.lower_left)
+    pt2 = trsf.apply_on(mb.upper_right)
+    trsf = trsf.translate(-min(pt1[0], pt2[0]), -min(pt1[1], pt2[1]))
+
+    fg_page = output.add_page(fg_page)
+    fg_page.merge_transformed_page(bg_page, trsf, over=False, expand=False)
 
 
 @deconstructible

src/pretix/base/templatetags/money.py

@@ -20,6 +20,7 @@
 # <https://www.gnu.org/licenses/>.
 #
 from decimal import ROUND_HALF_UP, Decimal
+from typing import Optional
 
 from babel import Locale, UnknownLocaleError
 from babel.numbers import format_currency
@@ -35,32 +36,32 @@ register = template.Library()
 
 
 @register.filter("money")
-def money_filter(value: Decimal, arg='', hide_currency=False):
-    if isinstance(value, (float, int)):
+def money_filter(value: Optional[Decimal | float | int | str], arg='', hide_currency=False):
+    if isinstance(value, (float, int, str)):
+        if value == '':
+            return value
         value = Decimal(value)
     if value is None:
         value = Decimal('0.00')
     if not isinstance(value, Decimal):
-        if value == '':
-            return value
         raise TypeError("Invalid data type passed to money filter: %r" % type(value))
     if not arg:
         raise ValueError("No currency passed.")
     arg = arg.upper()
 
-    places = settings.CURRENCY_PLACES.get(arg, 2)
-    rounded = value.quantize(Decimal('1') / 10 ** places, ROUND_HALF_UP)
-    if places < 2 and rounded != value:
-        # We display decimal places even if we shouldn't for this currency if rounding
-        # would make the numbers incorrect. If this branch executes, it's likely a bug in
-        # pretix, but we won't show wrong numbers!
-        if hide_currency:
-            return floatformat(value, "2g")
-        else:
-            return '{} {}'.format(arg, floatformat(value, "2g"))
+    if value.normalize().as_tuple().exponent < -9:
+        # Heuristic: It's unlikely we'll ever see values of less than 0.000000001 in any currency. Therefore, if we
+        # do see them, we very likely deal with a floating point error. This happens mostly in dev mode when computations
+        # are made in SQLite, which uses REAL precision, but it can also happen when we naively pass a float from Python
+        # land to this filter (even though it should not happen).
+        value = value.quantize(Decimal('1e-9'), ROUND_HALF_UP).normalize()
+
+    currency_places = settings.CURRENCY_PLACES.get(arg, 2)
+    required_places = -value.normalize().as_tuple().exponent
+    render_places = max(currency_places, required_places)
 
     if hide_currency:
-        return floatformat(value, f"{places}g")
+        return floatformat(value, f"{render_places}g")
 
     try:
         locale = Locale(get_babel_locale())
@@ -68,14 +69,29 @@ def money_filter(value: Decimal, arg='', hide_currency=False):
         locale = "en"
 
     try:
-        return format_currency(value, arg, locale=locale)
+        return format_currency(
+            value,
+            arg,
+            locale=locale,
+            # We only allow Babel to restrict the digits to the digits defined by the currency if this does not remove any
+            # precision in case we have sub-currency precision (which we shouldn't have in most places, but it's still
+            # better than showing wrong data). Note: Weird precision effects can occur after in-database arithmetic
+            # on SQLite, since SQLite does not have fixed-decimal computation.
+            currency_digits=currency_places >= required_places,
+            decimal_quantization=currency_places >= required_places,
+        )
     except:
-        return '{} {}'.format(arg, floatformat(value, f"{places}g"))
+        return '{} {}'.format(arg, floatformat(value, f"{render_places}g"))
+
+
+@register.filter("money_without_currency")
+def money_filter_without_currency(value: Optional[Decimal | float | int | str], arg=''):
+    return money_filter(value, arg, hide_currency=True)
 
 
 @register.filter("money_numberfield")
-def money_numberfield_filter(value: Decimal, arg=''):
-    if isinstance(value, (float, int)):
+def money_numberfield_filter(value: Optional[Decimal | float | int | str], arg=''):
+    if isinstance(value, (float, int, str)):
         value = Decimal(value)
     if not isinstance(value, Decimal):
         raise TypeError("Invalid data type passed to money filter: %r" % type(value))
@@ -87,15 +103,28 @@ def money_numberfield_filter(value: Decimal, arg=''):
 
 
 @register.filter(is_safe=True)
-def tax_rate_format(number):
+def tax_rate_format(number: Optional[Decimal | float | int | str]):
     """
     Display a Decimal to its significant decimal places, used for tax rates.
     """
-    assert isinstance(number, Decimal)
+    if isinstance(number, (float, int, str)):
+        if number == '':
+            return number
+        number = Decimal(number)
+    if number is None:
+        number = Decimal('0.00')
+    if not isinstance(number, Decimal):
+        raise TypeError("Invalid data type passed to tax rate format filter: %r" % type(number))
+    if number.normalize().as_tuple().exponent < -9:
+        # Heuristic: It's unlikely we'll ever see values of less than 0.000000001 in any currency. Therefore, if we
+        # do see them, we very likely deal with a floating point error. This happens mostly in dev mode when computations
+        # are made in SQLite, which uses REAL precision, but it can also happen when we naively pass a float from Python
+        # land to this filter (even though it should not happen).
+        number = number.quantize(Decimal('1e-9'), ROUND_HALF_UP).normalize()
     return mark_safe(
         formats.number_format(
-            number.normalize(),
-            -number.as_tuple().exponent,
+            number,
+            -number.normalize().as_tuple().exponent,
             use_l10n=True,
             force_grouping=False,
         )

src/pretix/control/forms/global_settings.py

@@ -105,12 +105,12 @@ class GlobalSettingsForm(SettingsForm):
                     domain=settings.SITE_URL
                 )
             )),
-            ('widget_vite_origins', forms.CharField(
+            ('widget_vue2_origins', forms.CharField(
                 widget=forms.Textarea(attrs={'rows': '3'}),
                 required=False,
                 # Not translated on purpose, this is a temporary feature and contains too many special case words
-                label="Vite widget origins",
-                help_text="One origin per line (e.g. https://example.com). Requests from these origins will be served the new vite-based widget.",
+                label="Vue2 widget origins",
+                help_text="One origin per line (e.g. https://example.com). Requests from these origins will be served the old vue2-based widget.",
             ))
         ])
         responses = register_global_settings.send(self)

src/pretix/control/logdisplay.py

@@ -774,6 +774,7 @@ class CoreUserImpersonatedLogEntryType(UserImpersonatedLogEntryType):
     'pretix.user.settings.2fa.disabled': _('Two-factor authentication has been disabled.'),
     'pretix.user.settings.2fa.regenemergency': _('Your two-factor emergency codes have been regenerated.'),
     'pretix.user.settings.2fa.emergency': _('A two-factor emergency code has been generated.'),
+    'pretix.user.settings.2fa.resetdrift': _('TOTP drift has been reset.'),
     'pretix.user.settings.2fa.device.added': _('A new two-factor authentication device "{name}" has been added to '
                                                'your account.'),
     'pretix.user.settings.2fa.device.deleted': _('The two-factor authentication device "{name}" has been removed '

src/pretix/control/templates/pretixcontrol/users/form.html

@@ -1,6 +1,7 @@
 {% extends "pretixcontrol/base.html" %}
 {% load i18n %}
 {% load bootstrap3 %}
+{% load icon %}
 {% block title %}{% trans "User" %}{% endblock %}
 {% block content %}
     <h1>{% trans "User" %} {{ user.email }}</h1>
@@ -16,6 +17,10 @@
                 {% csrf_token %}
                 <button class="btn btn-default">{% trans "Generate 2FA emergency token" %}</button>
             </form>
+            <form action="{% url "control:users.resetdrift" id=user.pk %}" method="post" class="form-inline helper-display-inline">
+                {% csrf_token %}
+                <button class="btn btn-default">{% trans "Reset 2FA drift" %}</button>
+            </form>
         {% endif %}
         <form action="{% url "control:users.impersonate" id=user.pk %}" method="post" class="form-inline helper-display-inline">
             {% csrf_token %}
@@ -59,8 +64,72 @@
                         {% bootstrap_field form.is_verified layout='control' %}
                     {% endif %}
                     {% bootstrap_field form.last_login layout='control' %}
-                    {% bootstrap_field form.require_2fa layout='control' %}
                     {% bootstrap_field form.needs_password_change layout='control' %}
+                    {% bootstrap_field form.require_2fa layout='control' %}
+                    <div class="form-group">
+                        <div class="col-md-9 col-md-offset-3">
+                            <div class="panel panel-default">
+                                <div class="panel-heading">
+                                    <h3 class="panel-title">
+                                        {% trans "Available two-factor authentication methods" %}
+                                    </h3>
+                                </div>
+                                <table class="panel-body table table-hover">
+                                    {% for d in devices %}
+                                    <tr>
+                                        <td>
+                                            {% if d.devicetype == 'totp' %}
+                                                TOTP
+                                            {% elif d.devicetype == 'u2f' %}
+                                                U2F
+                                            {% elif d.devicetype == 'webauthn' %}
+                                                WebAuthn
+                                            {% elif d.devicetype == 'emergency' %}
+                                                {% trans "Emergency tokens" %}
+                                            {% endif %}
+                                            {% if d.confirmed %}
+                                                {% icon "check" %}
+                                            {% else %}
+                                                {% icon "warning" %}
+                                            {% endif %}
+                                        </td>
+                                        <td>
+                                            {{ d.name }}
+                                        </td>
+                                        <td>
+                                            {% if d.throttling_failure_timestamp %}
+                                                {% blocktrans trimmed with date=d.throttling_failure_timestamp|date:"SHORT_DATETIME_FORMAT" count cnt=d.throttling_failure_count %}
+                                                    1 failed attempt since {{ date }}
+                                                {% plural %}
+                                                    {{ cnt }} failed attempts since {{ date }}
+                                                {% endblocktrans %}
+                                                <br>
+                                            {% endif %}
+                                            {% if d.devicetype == 'totp' %}
+                                                <small>
+                                                    <code>step = {{ d.step }},
+                                                    t0 = {{ d.t0 }},
+                                                    digits = {{ d.digits }},
+                                                    tolerance = {{ d.tolerance }},
+                                                    drift = {{ d.drift }},
+                                                    last_t = {{ d.last_t }}</code>
+                                                </small>
+                                            {% elif d.devicetype == 'u2f' %}
+                                                <small>
+                                                    <code>sign_count = {{ d.sign_count }}</code>
+                                                </small>
+                                            {% elif d.devicetype == 'emergency' %}
+                                                <small>
+                                                    <code>token_count = {{ d.token_set.count }}</code>
+                                                </small>
+                                            {% endif %}
+                                        </td>
+                                    </tr>
+                                    {% endfor %}
+                                </table>
+                            </div>
+                        </div>
+                    </div>
                 </fieldset>
                 <fieldset>
                     <legend>{% trans "Team memberships" %}</legend>

src/pretix/control/urls.py

@@ -78,6 +78,7 @@ urlpatterns = [
     re_path(r'^users/(?P<id>\d+)/impersonate$', users.UserImpersonateView.as_view(), name='users.impersonate'),
     re_path(r'^users/(?P<id>\d+)/anonymize$', users.UserAnonymizeView.as_view(), name='users.anonymize'),
     re_path(r'^users/(?P<id>\d+)/emergencytoken$', users.UserEmergencyTokenView.as_view(), name='users.emergencytoken'),
+    re_path(r'^users/(?P<id>\d+)/resetdrift$', users.Reset2FADriftView.as_view(), name='users.resetdrift'),
     re_path(r'^pdf/editor/webfonts.css', pdf.FontsCSSView.as_view(), name='pdf.css'),
     re_path(r'^settings/?$', user.UserSettings.as_view(), name='user.settings'),
     re_path(r'^settings/history/$', user.UserHistoryView.as_view(), name='user.settings.history'),

src/pretix/control/views/discounts.py

@@ -163,6 +163,9 @@ class DiscountCreate(EventPermissionRequiredMixin, CreateView):
             i = modelcopy(self.copy_from)
             i.pk = None
             kwargs['instance'] = i
+            kwargs["initial"]["limit_sales_channels"] = self.copy_from.limit_sales_channels.all()
+            kwargs["initial"]["condition_limit_products"] = self.copy_from.condition_limit_products.all()
+            kwargs["initial"]["benefit_limit_products"] = self.copy_from.benefit_limit_products.all()
         else:
             kwargs['instance'] = Discount(event=self.request.event)
 

src/pretix/control/views/users.py

@@ -41,15 +41,18 @@ from django.utils.translation import gettext_lazy as _
 from django.views import View
 from django.views.generic import ListView, TemplateView
 from django_otp.plugins.otp_static.models import StaticDevice
+from django_otp.plugins.otp_totp.models import TOTPDevice
 from hijack import signals
 
 from pretix.base.auth import get_auth_backends
-from pretix.base.models import User
+from pretix.base.models import U2FDevice, User, WebAuthnDevice
 from pretix.control.forms.filter import UserFilterForm
 from pretix.control.forms.users import UserEditForm
 from pretix.control.permissions import AdministratorPermissionRequiredMixin
 from pretix.control.views import CreateView, UpdateView
-from pretix.control.views.user import RecentAuthenticationRequiredMixin
+from pretix.control.views.user import (
+    REAL_DEVICE_TYPES, RecentAuthenticationRequiredMixin,
+)
 
 
 def get_used_backend(request):
@@ -107,6 +110,21 @@ class UserEditView(AdministratorPermissionRequiredMixin, RecentAuthenticationReq
         ctx['backend'] = (
             b[self.object.auth_backend].verbose_name if self.object.auth_backend in b else self.object.auth_backend
         )
+
+        ctx['devices'] = []
+        for dt in [*REAL_DEVICE_TYPES, StaticDevice]:
+            objs = list(dt.objects.filter(user=self.request.user, confirmed=True))
+            for obj in objs:
+                if dt == TOTPDevice:
+                    obj.devicetype = 'totp'
+                elif dt == U2FDevice:
+                    obj.devicetype = 'u2f'
+                elif dt == WebAuthnDevice:
+                    obj.devicetype = 'webauthn'
+                elif dt == StaticDevice:
+                    obj.devicetype = 'emergency'
+            ctx['devices'] += objs
+
         return ctx
 
     def get_success_url(self):
@@ -183,6 +201,24 @@ class UserEmergencyTokenView(AdministratorPermissionRequiredMixin, RecentAuthent
         return reverse('control:users.edit', kwargs=self.kwargs)
 
 
+class Reset2FADriftView(AdministratorPermissionRequiredMixin, RecentAuthenticationRequiredMixin, View):
+
+    def get(self, request, *args, **kwargs):
+        return redirect(reverse('control:users.edit', kwargs=self.kwargs))
+
+    def post(self, request, *args, **kwargs):
+        self.object = get_object_or_404(User, pk=self.kwargs.get("id"))
+        self.object.totpdevice_set.update(drift=0)
+        self.object.log_action('pretix.user.settings.2fa.resetdrift', user=self.request.user)
+        messages.success(request, _(
+            'The drift values for TOTP devices have been reset.'
+        ))
+        return redirect(self.get_success_url())
+
+    def get_success_url(self):
+        return reverse('control:users.edit', kwargs=self.kwargs)
+
+
 class UserAnonymizeView(AdministratorPermissionRequiredMixin, RecentAuthenticationRequiredMixin, TemplateView):
     template_name = "pretixcontrol/users/anonymize.html"
 

src/pretix/control/views/vouchers.py

@@ -144,7 +144,7 @@ class VoucherList(VoucherQueryMixin, PaginationMixin, EventPermissionRequiredMix
         headers = [
             _('Voucher code'), _('Valid until'), _('Product'), _('Reserve quota'), _('Bypass quota'),
             _('Price effect'), _('Value'), _('Tag'), _('Redeemed'), _('Maximum usages'), _('Seat'),
-            _('Comment')
+            _('Comment'), _('Budget'), _('Budget used')
         ]
         writer.writerow(headers)
 
@@ -170,7 +170,9 @@ class VoucherList(VoucherQueryMixin, PaginationMixin, EventPermissionRequiredMix
                 str(v.redeemed),
                 str(v.max_usages),
                 str(v.seat) if v.seat else "",
-                str(v.comment) if v.comment else ""
+                str(v.comment) if v.comment else "",
+                str(v.budget) if v.budget is not None else "",
+                str(v.budget_used) if v.budget is not None else "",
             ]
             writer.writerow(row)
 

src/pretix/locale/de/LC_MESSAGES/django.po

@@ -5,7 +5,7 @@ msgstr ""
 "Project-Id-Version: 1\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-08-24 15:35+0000\n"
-"PO-Revision-Date: 2026-08-25 00:00+0000\n"
+"PO-Revision-Date: 2026-09-14 23:00+0000\n"
 "Last-Translator: Raphael Michel <michel@rami.io>\n"
 "Language-Team: German <https://translate.pretix.eu/projects/pretix/pretix/"
 "de/>\n"
@@ -14,7 +14,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 2026.8.1\n"
+"X-Generator: Weblate 2026.9.1\n"
 "X-Poedit-Bookmarks: -1,-1,904,-1,-1,-1,-1,-1,-1,-1\n"
 
 #: pretix/_base_settings.py
@@ -11708,7 +11708,7 @@ msgid ""
 msgstr ""
 "Hallo,\n"
 "\n"
-"Sie erhalten diese Nachricht weil Sie einen neuen Link zu Ihrer Bestellung "
+"Sie erhalten diese Nachricht, weil Sie einen neuen Link zu Ihrer Bestellung "
 "für\n"
 "{event} angefordert haben.\n"
 "\n"
@@ -11738,8 +11738,8 @@ msgid ""
 msgstr ""
 "Hallo,\n"
 "\n"
-"Sie erhalten diese Nachricht weil Sie einen neuen Link zu Ihren Bestellungen "
-"für\n"
+"Sie erhalten diese Nachricht, weil Sie einen neuen Link zu Ihren "
+"Bestellungen für\n"
 "{event} angefordert haben. Sie finden Ihre Bestellungen unter folgenden "
 "Links:\n"
 "\n"

src/pretix/plugins/badges/exporters.py

@@ -55,7 +55,6 @@ from django.db.models.functions import Cast, Coalesce
 from django.utils.timezone import make_aware
 from django.utils.translation import gettext as _, gettext_lazy, pgettext_lazy
 from pypdf import PageObject, PdfReader, PdfWriter, Transformation
-from pypdf.generic import RectangleObject
 from reportlab.lib import pagesizes
 from reportlab.lib.units import inch, mm
 from reportlab.pdfgen import canvas
@@ -238,15 +237,8 @@ def _render_nup_page(nup_pdf: PdfWriter, input_pages: PageObject, opt: dict) ->
         di = i % badges_per_page
         tx = opt['margins'][3] + (di % opt['cols']) * opt['offsets'][0]
         ty = opt['margins'][2] + (opt['rows'] - 1 - (di // opt['cols'])) * opt['offsets'][1]
-        page.add_transformation(Transformation().translate(tx, ty))
-        page.mediabox = RectangleObject((
-            Decimal('%.5f' % (page.mediabox.left.as_numeric() + tx)),
-            Decimal('%.5f' % (page.mediabox.bottom.as_numeric() + ty)),
-            Decimal('%.5f' % (page.mediabox.right.as_numeric() + tx)),
-            Decimal('%.5f' % (page.mediabox.top.as_numeric() + ty))
-        ))
         page.trimbox = page.cropbox = page.mediabox
-        nup_page.merge_page(page)
+        nup_page.merge_transformed_page(page, Transformation().translate(tx, ty))
     return nup_page
 
 

src/pretix/plugins/reports/exporters.py

@@ -55,6 +55,8 @@ from django_countries.fields import Country
 from reportlab.lib import colors
 from reportlab.lib.enums import TA_CENTER
 from reportlab.lib.units import mm
+from reportlab.lib.utils import simpleSplit
+from reportlab.pdfbase.pdfmetrics import stringWidth
 from reportlab.pdfgen.canvas import Canvas
 from reportlab.platypus import PageBreak, Spacer, Table, TableStyle
 
@@ -226,10 +228,20 @@ class ReportlabExportMixin:
     def page_header(self, canvas, doc):
         from reportlab.lib.units import mm
 
-        canvas.setFont('OpenSans', 10)
-        canvas.drawString(doc.leftMargin, self.pagesize[1] - 15 * mm, self.get_left_header_string())
+        font_name = 'OpenSans'
+        font_size = 10
+        left_string = self.get_left_header_string()
+        right_string = self.get_right_header_string()
+        right_width = stringWidth(right_string, font_name, font_size)
+        max_left_width = self.pagesize[0] - doc.leftMargin - doc.rightMargin - right_width - 5 * mm
+        left_string_lines = simpleSplit(left_string, font_name, font_size, max_left_width)
+        if len(left_string_lines) > 1:
+            left_string = left_string_lines[0] + " …"
+
+        canvas.setFont(font_name, font_size)
+        canvas.drawString(doc.leftMargin, self.pagesize[1] - 15 * mm, left_string)
         canvas.drawRightString(self.pagesize[0] - doc.rightMargin, self.pagesize[1] - 15 * mm,
-                               self.get_right_header_string())
+                               right_string)
         canvas.setStrokeColorRGB(0, 0, 0)
         canvas.line(doc.leftMargin, self.pagesize[1] - 17 * mm,
                     self.pagesize[0] - doc.rightMargin, self.pagesize[1] - 17 * mm)

src/pretix/plugins/sendmail/views.py

@@ -355,9 +355,9 @@ class OrderSendView(BaseSenderView):
             statusq |= Q(status=Order.STATUS_PENDING, require_approval=False, valid_if_pending=True)
         orders = qs.filter(statusq)
 
-        opq = OrderPosition.objects.filter(
+        opq = OrderPosition.objects.with_scopes_disabled().filter(
             Q(item_id__in=[i.pk for i in form.cleaned_data.get('items')]) | Q(Exists(
-                OrderPosition.objects.filter(
+                OrderPosition.objects.with_scopes_disabled().filter(
                     addon_to_id=OuterRef('pk'),
                     item_id__in=[i.pk for i in form.cleaned_data.get('items')]
                 )

src/pretix/presale/templates/pretixpresale/event/payment_qr_codes.html

@@ -3,7 +3,7 @@
 {% load escapejson %}
 
 {% if payment_qr_codes %}
-    <div class="tabcontainer col-md-6 col-sm-6 hidden-xs text-center js-only blank-after">
+    <div class="tabcontainer col-md-6 col-sm-6 col-xs-12 text-center js-only blank-after">
         <div id="banktransfer_qrcodes_tabs_content" class="tabpanels blank-after">
             {% for code_info in payment_qr_codes %}
                 <div id="banktransfer_qrcodes_{{ code_info.id }}"

src/pretix/presale/views/widget.py

@@ -122,19 +122,20 @@ def widget_css_etag(request, version, **kwargs):
         return f'{_get_source_cache_key(version)}-{request.organizer.cache.get_or_set("css_version", default=lambda: int(time.time()))}'
 
 
+# use vite by default, serve old vue2-based widget only for widget_vue2_origins
 def _use_vite(request):
-    if getattr(settings, 'PRETIX_WIDGET_VITE', False) or "beta" in request.GET:
-        return True
+    if getattr(settings, 'PRETIX_WIDGET_VUE', False) or "legacy" in request.GET:
+        return False
     origin = request.META.get('HTTP_ORIGIN', '')
     gs = GlobalSettingsObject()
-    vite_origins = gs.settings.get('widget_vite_origins', as_type=str, default='')
-    if vite_origins and not origin:
+    vue_origins = gs.settings.get('widget_vue2_origins', as_type=str, default='')
+    if vue_origins and not origin:
         referer = request.META.get('HTTP_REFERER', '')
         origin = '/'.join(referer.split('/', 3)[:3])
-    if origin and vite_origins:
-        origins_list = [o.strip() for o in vite_origins.strip().splitlines() if o.strip()]
-        return origin in origins_list
-    return False
+    if origin and vue_origins:
+        origins_list = [o.strip() for o in vue_origins.strip().splitlines() if o.strip()]
+        return origin not in origins_list
+    return True
 
 
 def widget_js_etag(request, version, lang, **kwargs):

src/pretix/settings.py

@@ -913,7 +913,7 @@ VITE_DEV_SERVER_PORT = 5173
 VITE_DEV_SERVER = f"http://localhost:{VITE_DEV_SERVER_PORT}"
 VITE_DEV_MODE = DEBUG
 VITE_IGNORE = False  # Used to ignore `collectstatic`/`rebuild`
-PRETIX_WIDGET_VITE = os.environ.get('PRETIX_WIDGET_VITE', '') not in ('', '0')
+PRETIX_WIDGET_VUE = os.environ.get('PRETIX_WIDGET_VUE', '') not in ('', '0')
 
 if DEBUG:
     # Reload if settings file changes

src/pretix/static/pretixbase/js/deanonymize_email.js

@@ -1,7 +1,7 @@
 document.addEventListener('DOMContentLoaded', function () {
 	document.querySelectorAll('a[href^="mailto:"]').forEach(function (link) {
 		// Replace [at] with @ and the [dot] with . in both the href and the displayed text (if needed)
-		link.href = link.href.replace('[at]', '@').replace('[dot]', '.')
-		link.textContent = link.textContent.replace('[at]', '@').replace('[dot]', '.')
+		link.href = link.href.replace('[at]', '@').replaceAll('[dot]', '.')
+		link.textContent = link.textContent.replace('[at]', '@').replaceAll('[dot]', '.')
 	})
 })

src/pretix/static/pretixcontrol/js/ui/plugins.js

@@ -67,14 +67,13 @@ $(function () {
 				continue
 			matches.push([rank, plugin])
 		}
-		matches.sort((a, b) => ((b[0] - a[0]) || strcmp(a[1].sortName, b[1].sortName)))
-		$results.append(matches.map((res) => $(res[1].html).prepend('<span class="pull-right">' + res[1].categoryLabel + '</span>')))
+		matches.sort(function (a, b) { return (b[0] - a[0]) || strcmp(a[1].sortName, b[1].sortName) })
+		$results.append(matches.map(function (res) { return $(res[1].html).prepend('<span class="pull-right">' + res[1].categoryLabel + '</span>') }))
 		$results.find('.panel-body, .panel, .featured-plugin, .btn-lg').removeClass('panel-body panel featured-plugin btn-lg')
 		if (matches.length === 0) {
 			$results.append(gettext('No results'))
 		}
 	}
-	search() // if pre-filled by browser (e.g. after reload)
 	$('#plugin_search_input').on('input', search)
 	$('input[name=plugin_state_filter]').on('change', search)
 	$results_box.find('button.close').on('click', function () {
@@ -82,9 +81,9 @@ $(function () {
 		$('#plugin_search_input').val('').trigger('input')
 	})
 	if (location.search) {
-		const search_params = new URLSearchParams(location.search)
-		if (search_params.has('q')) {
-			$('#plugin_search_input').val(search_params.get('q')).trigger('input')
+		var search = new URLSearchParams(location.search)
+		if (search.has('q')) {
+			$('#plugin_search_input').val(search.get('q')).trigger('input')
 		}
 	}
 })

src/pretix/static/pretixpresale/js/ui/main.js

@@ -233,6 +233,7 @@ let form_handlers = function (el) {
 
 function setup_basics (el) {
 	el.find('form').attr('novalidate', true).on('submit', function (e) {
+		if (e.originalEvent && e.originalEvent.submitter && e.originalEvent.submitter.formNoValidate) return;
 		if (!this.checkValidity()) {
 			let input = this.querySelector(':invalid:not(fieldset)');
 			(input.labels[0] || input).scrollIntoView()

src/pretix/static/pretixpresale/widget/src/sharedStore.ts

@@ -514,10 +514,6 @@ export function createWidgetStore (config: {
 					// button with subevent but no items
 					redirectUrl += `${this.subevent}/`
 				}
-				if (this.subevent && !this.cartId) {
-					// button with subevent but no items
-					redirectUrl += `${this.subevent}/`
-				}
 				redirectUrl += `?iframe=1&locale=${LANG}`
 				if (this.cartId) {
 					// ajax to make sure the cart-id is used, even if the cart is currently empty

src/tests/base/test_templatetag.py

@@ -26,7 +26,7 @@ from django.template import Context, Template
 from django.test import RequestFactory
 from django.utils import translation
 
-from pretix.base.templatetags.money import money_filter
+from pretix.base.templatetags.money import money_filter, tax_rate_format
 
 TEMPLATE_REPLACE_PAGE = Template(
     "{% load urlreplace %}{% url_replace request 'page' 3 %}"
@@ -60,7 +60,9 @@ def test_urlreplace_replace_parameter():
     "locale,amount,currency,expected",
     [
         ("en", None, "USD", "$0.00"),
+        ("en", "", "USD", ""),
         ("en", 1000000, "USD", "$1,000,000.00"),
+        ("en", 2.23, "USD", "$2.23"),
         ("en", Decimal("1000.00"), "USD", "$1,000.00"),
         ("de", Decimal("1.23"), "EUR", "1,23" + NBSP + "€"),
         ("de", Decimal("1000.00"), "EUR", "1.000,00" + NBSP + "€"),
@@ -70,11 +72,14 @@ def test_urlreplace_replace_parameter():
 
         # unknown currency
         ("de", Decimal("1234.56"), "FOO", "1.234,56" + NBSP + "FOO"),
-        ("de", Decimal("1234.567"), "FOO", "1.234,57" + NBSP + "FOO"),
+        ("de", Decimal("1234.567"), "FOO", "1.234,567" + NBSP + "FOO"),
 
-        # rounding errors
-        ("de", Decimal("1.234"), "EUR", "1,23" + NBSP + "€"),
-        ("de", Decimal("1023.1"), "JPY", "JPY 1.023,10"),
+        # deal with precision that is higher than the currency
+        ("de", Decimal("1.234"), "EUR", "1,234" + NBSP + "€"),
+        ("de", 1.234, "EUR", "1,234" + NBSP + "€"),
+        ("de", Decimal("1.2340"), "EUR", "1,234" + NBSP + "€"),
+        ("de", Decimal("1.2300"), "EUR", "1,23" + NBSP + "€"),
+        ("de", Decimal("1023.1"), "JPY", "1.023,10" + NBSP + "¥"),
     ]
 )
 def test_money_filter(locale, amount, currency, expected):
@@ -98,9 +103,31 @@ def test_money_filter(locale, amount, currency, expected):
     [
         ("de", Decimal("1000.00"), "EUR", "1.000,00"),
         ("en", Decimal("1000.00"), "EUR", "1,000.00"),
-        ("de", Decimal("1023.1"), "JPY", "1.023,10"),
+        ("de", Decimal("1023.1"), "JPY", "1.023,1"),
     ]
 )
 def test_money_filter_hidecurrency(locale, amount, currency, expected):
     translation.activate(locale)
     assert money_filter(amount, currency, hide_currency=True) == expected
+
+
+@pytest.mark.parametrize(
+    "locale,rate,expected",
+    [
+        ("de", Decimal("2.00"), "2"),
+        ("de", Decimal("2.50"), "2,5"),
+        ("de", Decimal("2.2340"), "2,234"),
+        ("en", Decimal("2.00"), "2"),
+        ("en", Decimal("2.50"), "2.5"),
+        ("en", Decimal("4.3e7"), "43000000"),
+        ("en", Decimal("2.2340"), "2.234"),
+        ("en", "2.23", "2.23"),
+        ("en", 2.23, "2.23"),
+        ("en", 2, "2"),
+        ("en", "", ""),
+        ("en", None, "0"),
+    ]
+)
+def test_tax_rate_format(locale, rate, expected):
+    translation.activate(locale)
+    assert tax_rate_format(rate) == expected

src/tests/control/test_vouchers.py

@@ -128,9 +128,9 @@ class VoucherFormTest(SoupTestMixin, TransactionTestCase):
         doc = self.client.get('/control/event/%s/%s/vouchers/?download=yes' % (self.orga.slug, self.event.slug))
         assert doc.content.decode().strip() == '"Voucher code","Valid until","Product","Reserve quota",' \
                                                '"Bypass quota","Price effect","Value","Tag","Redeemed",' \
-                                               '"Maximum usages","Seat","Comment"' \
+                                               '"Maximum usages","Seat","Comment","Budget","Budget used"' \
                                                '\r\n"ABCDEFG","","Early-bird ticket","No","No","No effect","","","0",' \
-                                               '"1","",""'
+                                               '"1","","","",""'
 
     def test_filter_status_valid(self):
         with scopes_disabled():

src/tests/e2e/conftest.py

@@ -89,11 +89,11 @@ def _widget_assets():
                 f'Start it with: npm run dev:widget'
             )
         yield
-    elif os.environ.get("PRETIX_WIDGET_VITE"):
+    elif os.environ.get("PRETIX_WIDGET_VUE"):
+        yield  # Old widget, no build needed
+    else:
         subprocess.check_call(['npm', 'run', 'build:widget'], cwd=PROJECT_ROOT)
         yield
-    else:
-        yield  # Old widget, no build needed
 
 
 # ============================================================================
@@ -155,10 +155,6 @@ def live_server_url(live_server, settings):
 
     settings.SITE_URL = live_server.url
 
-    # Enable Vite widget if requested via env var
-    if os.environ.get("PRETIX_WIDGET_VITE") or os.environ.get("PRETIX_WIDGET_VITE_DEV"):
-        settings.PRETIX_WIDGET_VITE = True
-
     return live_server.url