Move dataclass to models.py

Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.13-trixie
+FROM python:3.11-bookworm
 
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \

pyproject.toml

@@ -76,7 +76,7 @@ dependencies = [
   "paypal-checkout-serversdk==1.0.*",
   "PyJWT==2.12.*",
   "phonenumberslite==9.0.*",
-  "Pillow==12.2.*",
+  "Pillow==12.1.*",
   "pretix-plugin-build",
   "protobuf==7.34.*",
   "psycopg2-binary",
@@ -90,10 +90,10 @@ dependencies = [
   "pytz-deprecation-shim==0.1.*",
   "pyuca",
   "qrcode==8.2",
-  "redis==7.4.*",
+  "redis==7.1.*",
   "reportlab==4.4.*",
   "requests==2.32.*",
-  "sentry-sdk==2.57.*",
+  "sentry-sdk==2.56.*",
   "sepaxml==2.7.*",
   "stripe==7.9.*",
   "text-unidecode==1.*",

src/pretix/__init__.py

@@ -19,4 +19,4 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-__version__ = "2026.4.0.dev0"
+__version__ = "2026.3.0.dev0"

src/pretix/base/exporter.py

@@ -47,7 +47,6 @@ from django.utils.formats import localize
 from django.utils.translation import gettext, gettext_lazy as _
 
 from pretix.base.models import Event
-from pretix.base.models.auth import PermissionHolder
 from pretix.helpers.safe_openpyxl import (  # NOQA: backwards compatibility for plugins using excel_safe
     SafeWorkbook, remove_invalid_excel_chars as excel_safe,
 )
@@ -60,20 +59,11 @@ class BaseExporter:
     This is the base class for all data exporters
     """
 
-    def __init__(self, event, organizer, permission_holder: PermissionHolder=None, progress_callback=lambda v: None):
-        """
-        :param event: Event context, can also be a queryset of events for multi-event exports
-        :param organizer: Organizer context
-        :param user: The user who triggered the export (or None).
-        :param token: The API token that triggered the export (or None).
-        :param device: The device that triggered the export (or None)
-        :param progress_callback: Callback function with progress
-        """
+    def __init__(self, event, organizer, progress_callback=lambda v: None):
         self.event = event
         self.organizer = organizer
         self.progress_callback = progress_callback
         self.is_multievent = isinstance(event, QuerySet)
-        self.permission_holder = permission_holder
         if isinstance(event, QuerySet):
             self.events = event
             self.event = None
@@ -190,7 +180,7 @@ class BaseExporter:
         return True
 
     @classmethod
-    def get_required_event_permission(cls) -> Optional[str]:
+    def get_required_event_permission(cls) -> str:
         """
         The permission level required to use this exporter for events. For multi-event-exports, this will be used
         to limit the selection of events. Will be ignored if the ``OrganizerLevelExportMixin`` mixin is used.
@@ -205,7 +195,7 @@ class OrganizerLevelExportMixin:
         raise TypeError("required_event_permission may not be called on OrganizerLevelExportMixin")
 
     @classmethod
-    def get_required_organizer_permission(cls) -> Optional[str]:
+    def get_required_organizer_permission(cls) -> str:
         """
         The permission level required to use this exporter. Must be set for organizer-level exports. Set to `None` to
         allow everyone with any access to the organizer.

src/pretix/base/forms/auth.py

@@ -196,7 +196,8 @@ class RegistrationForm(forms.Form):
     def clean_password(self):
         password1 = self.cleaned_data.get('password', '')
         user = User(email=self.cleaned_data.get('email'))
-        validate_password(password1, user=user)
+        if validate_password(password1, user=user) is not None:
+            raise forms.ValidationError(_(password_validators_help_texts()), code='pw_invalid')
         return password1
 
     def clean_email(self):

src/pretix/base/models/_transactions.py

@@ -29,9 +29,7 @@ import inspect
 import logging
 import os
 import threading
-from pathlib import Path
 
-import django
 from django.conf import settings
 from django.db import transaction
 
@@ -76,14 +74,10 @@ def _transactions_mark_order_dirty(order_id, using=None):
     if "PYTEST_CURRENT_TEST" in os.environ:
         # We don't care about Order.objects.create() calls in test code so let's try to figure out if this is test code
         # or not.
-        for frame in inspect.stack()[1:]:
-            if (
-                'pretix/base/models/orders' in frame.filename
-                or Path(frame.filename).is_relative_to(Path(django.__file__).parent)
-            ):
-                # Ignore model- and django-internal code
+        for frame in inspect.stack():
+            if 'pretix/base/models/orders' in frame.filename:
                 continue
-            elif 'test_' in frame.filename or 'conftest.py' in frame.filename:
+            elif 'test_' in frame.filename or 'conftest.py in frame.filename':
                 return
             elif 'pretix/' in frame.filename or 'pretix_' in frame.filename:
                 # This went through non-test code, let's consider it non-test

src/pretix/base/models/auth.py

@@ -38,7 +38,6 @@ import operator
 import secrets
 from datetime import timedelta
 from functools import reduce
-from typing import Protocol
 
 from django.conf import settings
 from django.contrib.auth.models import (
@@ -68,14 +67,6 @@ class EmailAddressTakenError(IntegrityError):
     pass
 
 
-class PermissionHolder(Protocol):
-    def has_event_permission(self, organizer, event, perm_name=None, request=None, session_key=None) -> bool:
-        ...
-
-    def has_organizer_permission(self, organizer, perm_name=None, request=None):
-        ...
-
-
 class UserManager(BaseUserManager):
     """
     This is the user manager for our custom user model. See the User
@@ -705,18 +696,6 @@ class User(AbstractBaseUser, PermissionsMixin, LoggingMixin):
         return self.teams.exists()
 
 
-class UserWithStaffSession:
-    # Wrapper around a User object with a staff session, implementing the PermissionHolder Protocol
-    def __init__(self, user):
-        self.user = user
-
-    def has_event_permission(self, organizer, event, perm_name=None, request=None, session_key=None) -> bool:
-        return True
-
-    def has_organizer_permission(self, organizer, perm_name=None, request=None):
-        return True
-
-
 class UserKnownLoginSource(models.Model):
     user = models.ForeignKey('User', on_delete=models.CASCADE, related_name="known_login_sources")
     agent_type = models.CharField(max_length=255, null=True, blank=True)

src/pretix/base/models/devices.py

@@ -229,7 +229,7 @@ class Device(LoggedModel):
         """
         return self._organizer_permission_set() if self.organizer == organizer else set()
 
-    def has_event_permission(self, organizer, event, perm_name=None, request=None, session_key=None) -> bool:
+    def has_event_permission(self, organizer, event, perm_name=None, request=None) -> bool:
         """
         Checks if this token is part of a team that grants access of type ``perm_name``
         to the event ``event``.
@@ -238,7 +238,6 @@ class Device(LoggedModel):
         :param event: The event to check
         :param perm_name: The permission, e.g. ``event.orders:read``
         :param request: This parameter is ignored and only defined for compatibility reasons.
-        :param session_key: This parameter is ignored and only defined for compatibility reasons.
         :return: bool
         """
         has_event_access = (self.all_events and organizer == self.organizer) or (

src/pretix/base/models/orders.py

@@ -590,7 +590,7 @@ class Order(LockModel, LoggedModel):
             not kwargs.get('force_save_with_deferred_fields', None) and
             (not update_fields or ('require_approval' not in update_fields and 'status' not in update_fields))
         ):
-            _fail("It is unsafe to call save() on an Order with deferred fields since we can't check if you missed "
+            _fail("It is unsafe to call save() on an OrderFee with deferred fields since we can't check if you missed "
                   "creating a transaction. Call save(force_save_with_deferred_fields=True) if you really want to do "
                   "this.")
 
@@ -2841,7 +2841,7 @@ class OrderPosition(AbstractPosition):
             if Transaction.key(self) != self.__initial_transaction_key or self.canceled != self.__initial_canceled or not self.pk:
                 _transactions_mark_order_dirty(self.order_id, using=kwargs.get('using', None))
         elif not kwargs.get('force_save_with_deferred_fields', None):
-            _fail("It is unsafe to call save() on an OrderPosition with deferred fields since we can't check if you missed "
+            _fail("It is unsafe to call save() on an OrderFee with deferred fields since we can't check if you missed "
                   "creating a transaction. Call save(force_save_with_deferred_fields=True) if you really want to do "
                   "this.")
 

src/pretix/base/models/organizer.py

@@ -319,9 +319,6 @@ class TeamQuerySet(models.QuerySet):
     def event_permission_q(cls, perm_name):
         from ..permissions import assert_valid_event_permission
 
-        if perm_name is None:
-            return Q()
-
         if perm_name.startswith('can_') and perm_name in OLD_TO_NEW_EVENT_COMPAT:  # legacy
             return reduce(operator.and_, [cls.event_permission_q(p) for p in OLD_TO_NEW_EVENT_COMPAT[perm_name]])
         assert_valid_event_permission(perm_name, allow_legacy=False)
@@ -334,9 +331,6 @@ class TeamQuerySet(models.QuerySet):
     def organizer_permission_q(cls, perm_name):
         from ..permissions import assert_valid_organizer_permission
 
-        if perm_name is None:
-            return Q()
-
         if perm_name.startswith('can_') and perm_name in OLD_TO_NEW_ORGANIZER_COMPAT:  # legacy
             return reduce(operator.and_, [cls.organizer_permission_q(p) for p in OLD_TO_NEW_ORGANIZER_COMPAT[perm_name]])
         assert_valid_organizer_permission(perm_name, allow_legacy=False)
@@ -556,7 +550,7 @@ class TeamAPIToken(models.Model):
         """
         return self.team.organizer_permission_set() if self.team.organizer == organizer else set()
 
-    def has_event_permission(self, organizer, event, perm_name=None, request=None, session_key=None) -> bool:
+    def has_event_permission(self, organizer, event, perm_name=None, request=None) -> bool:
         """
         Checks if this token is part of a team that grants access of type ``perm_name``
         to the event ``event``.
@@ -565,7 +559,6 @@ class TeamAPIToken(models.Model):
         :param event: The event to check
         :param perm_name: The permission, e.g. ``event.orders:read``
         :param request: This parameter is ignored and only defined for compatibility reasons.
-        :param session_key: This parameter is ignored and only defined for compatibility reasons.
         :return: bool
         """
         has_event_access = (self.team.all_events and organizer == self.team.organizer) or (

src/pretix/base/models/vouchers.py

@@ -19,7 +19,8 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-
+import datetime
+from dataclasses import dataclass
 # This file is based on an earlier version of pretix which was released under the Apache License 2.0. The full text of
 # the Apache License 2.0 can be obtained at <http://www.apache.org/licenses/LICENSE-2.0>.
 #
@@ -34,6 +35,7 @@
 # License for the specific language governing permissions and limitations under the License.
 
 from decimal import ROUND_HALF_UP, Decimal
+from typing import Union
 
 from django.conf import settings
 from django.core.exceptions import ValidationError
@@ -421,27 +423,33 @@ class Voucher(LoggedModel):
         return False
 
     @staticmethod
-    def clean_quota_get_ignored(old_instance):
-        quotas = set()
-        was_valid = old_instance and (
-            old_instance.valid_until is None or old_instance.valid_until >= now()
-        )
-        if old_instance and old_instance.block_quota and was_valid:
-            if old_instance.quota:
-                quotas.add(old_instance.quota)
-            elif old_instance.variation:
-                quotas |= set(old_instance.variation.quotas.filter(subevent=old_instance.subevent))
-            elif old_instance.item:
-                if old_instance.item.has_variations:
-                    quotas |= set(
-                        Quota.objects.filter(pk__in=Quota.variations.through.objects.filter(
-                            itemvariation__item=old_instance.item,
-                            quota__subevent=old_instance.subevent,
-                        ).values('quota_id'))
-                    )
-                else:
-                    quotas |= set(old_instance.item.quotas.filter(subevent=old_instance.subevent))
-        return quotas
+    def get_affected_quotas(quota, item, variation, subevent):
+        if quota:
+            return {quota}
+        elif item and variation:
+            return set(variation.quotas.filter(subevent=subevent))
+        elif item and not item.has_variations:
+            return set(item.quotas.filter(subevent=subevent))
+        elif item and item.has_variations:
+            return set(
+                Quota.objects.filter(
+                    pk__in=Quota.variations.through.objects.filter(
+                        itemvariation__item=item,
+                        quota__subevent=subevent,
+                    ).values('quota_id')
+                )
+            )
+        else:
+            return set()
+
+    @staticmethod
+    def clean_quota_get_ignored(voucher_data: Union["VoucherBulkData", "Voucher"]):
+        if voucher_data:
+            valid = voucher_data.valid_until is None or voucher_data.valid_until >= now()
+            if valid and voucher_data.block_quota and voucher_data.max_usages > voucher_data.redeemed:
+                return Voucher.get_affected_quotas(voucher_data.quota, voucher_data.item, voucher_data.variation, voucher_data.subevent)
+
+        return set()
 
     @staticmethod
     def clean_quota_check(data, cnt, old_instance, event, quota, item, variation):
@@ -453,22 +461,8 @@ class Voucher(LoggedModel):
         if event.has_subevents and data.get('block_quota') and not data.get('subevent'):
             raise ValidationError(_('If you want this voucher to block quota, you need to select a specific date.'))
 
-        if quota:
-            new_quotas = {quota}
-        elif item and variation:
-            new_quotas = set(variation.quotas.filter(subevent=data.get('subevent')))
-        elif item and not item.has_variations:
-            new_quotas = set(item.quotas.filter(subevent=data.get('subevent')))
-        elif item and item.has_variations:
-            new_quotas = set(
-                Quota.objects.filter(
-                    pk__in=Quota.variations.through.objects.filter(
-                        itemvariation__item=item,
-                        quota__subevent=data.get('subevent'),
-                    ).values('quota_id')
-                )
-            )
-        else:
+        new_quotas = Voucher.get_affected_quotas(quota, item, variation, data.get('subevent'))
+        if not new_quotas:
             raise ValidationError(_('You need to select a specific product or quota if this voucher should reserve '
                                     'tickets.'))
 
@@ -644,3 +638,16 @@ class Voucher(LoggedModel):
             ]
         ).aggregate(s=Sum('voucher_budget_use'))['s'] or Decimal('0.00')
         return ops
+
+
+@dataclass
+class VoucherBulkData:
+    item: object
+    variation: object
+    quota: object
+    block_quota: bool
+    valid_until: datetime.datetime
+    subevent: object
+    redeemed: int
+    max_usages: int
+    allow_ignore_quota: bool

src/pretix/base/pdf.py

@@ -54,7 +54,7 @@ from bidi import get_display
 from django.conf import settings
 from django.contrib.staticfiles import finders
 from django.core.exceptions import ValidationError
-from django.db.models import Exists, Max, Min, OuterRef
+from django.db.models import Max, Min
 from django.db.models.fields.files import FieldFile
 from django.dispatch import receiver
 from django.utils.deconstruct import deconstructible
@@ -76,7 +76,7 @@ from reportlab.pdfgen.canvas import Canvas
 from reportlab.platypus import Paragraph
 
 from pretix.base.i18n import language
-from pretix.base.models import Checkin, Event, Order, OrderPosition, Question
+from pretix.base.models import Event, Order, OrderPosition, Question
 from pretix.base.settings import PERSON_NAME_SCHEMES
 from pretix.base.signals import layout_image_variables, layout_text_variables
 from pretix.base.templatetags.money import money_filter
@@ -379,13 +379,6 @@ DEFAULT_VARIABLES = OrderedDict((
             str(p) for p in generate_compressed_addon_list(op, order, ev)
         ])
     }),
-    ("checked_in_addons", {
-        "label": _("List of Checked-In Add-Ons"),
-        "editor_sample": _("Add-on 1\n2x Add-on 2"),
-        "evaluate": lambda op, order, ev: "\n".join([
-            str(p) for p in generate_compressed_addon_list(op, order, ev, only_checked_in=True)
-        ])
-    }),
     ("organizer", {
         "label": _("Organizer name"),
         "editor_sample": _("Event organizer company"),
@@ -757,16 +750,12 @@ def get_program_times(op: OrderPosition, ev: Event):
     ])
 
 
-def generate_compressed_addon_list(op, order, event, only_checked_in=False):
+def generate_compressed_addon_list(op, order, event):
     itemcount = defaultdict(int)
-    addon_qs = (
+    addons = [p for p in (
         op.addons.all() if 'addons' in getattr(op, '_prefetched_objects_cache', {})
         else op.addons.select_related('item', 'variation')
-    )
-    if only_checked_in:
-        addon_qs = addon_qs.filter(Exists(Checkin.objects.filter(position=OuterRef('pk'))), canceled=False)
-    addons = [p for p in addon_qs if not p.canceled]
-
+    ) if not p.canceled]
     for pos in addons:
         itemcount[pos.item, pos.variation] += 1
 

src/pretix/base/services/export.py

@@ -40,7 +40,6 @@ from pretix.base.models import (
     CachedFile, Device, Event, Organizer, ScheduledEventExport, TeamAPIToken,
     User, cachedfile_name,
 )
-from pretix.base.models.auth import UserWithStaffSession
 from pretix.base.models.exports import ScheduledOrganizerExport
 from pretix.base.services.mail import mail
 from pretix.base.services.tasks import (
@@ -212,12 +211,7 @@ def init_event_exporters(event, user=None, token=None, device=None, request=None
         if not perm_holder.has_event_permission(event.organizer, event, permission_name, request) and not staff_session:
             continue
 
-        exporter: BaseExporter = response(
-            event=event,
-            organizer=event.organizer,
-            permission_holder=token or device or (UserWithStaffSession(user) if staff_session else user),
-            **kwargs
-        )
+        exporter: BaseExporter = response(event=event, organizer=event.organizer, **kwargs)
 
         if not exporter.available_for_user(user if user and user.is_authenticated else None):
             continue
@@ -249,12 +243,7 @@ def init_organizer_exporters(
             continue
 
         if issubclass(response, OrganizerLevelExportMixin):
-            exporter: BaseExporter = response(
-                event=Event.objects.none(),
-                organizer=organizer,
-                permission_holder=token or device or (UserWithStaffSession(user) if staff_session else user),
-                **kwargs,
-            )
+            exporter: BaseExporter = response(event=Event.objects.none(), organizer=organizer, **kwargs)
 
             try:
                 if not perm_holder.has_organizer_permission(organizer, response.get_required_organizer_permission(), request) and not staff_session:
@@ -306,12 +295,7 @@ def init_organizer_exporters(
             if not _has_permission_on_any_team_cache[permission_name] and not staff_session:
                 continue
 
-            exporter: BaseExporter = response(
-                event=_event_list_cache[permission_name],
-                organizer=organizer,
-                permission_holder=token or device or (UserWithStaffSession(user) if staff_session else user),
-                **kwargs,
-            )
+            exporter: BaseExporter = response(event=_event_list_cache[permission_name], organizer=organizer, **kwargs)
 
         if not exporter.available_for_user(user if user and user.is_authenticated else None):
             continue

src/pretix/base/services/mail.py

@@ -411,7 +411,7 @@ def mail_send_task(self, **kwargs) -> bool:
         try:
             outgoing_mail = OutgoingMail.objects.select_for_update(of=OF_SELF).get(pk=outgoing_mail)
         except OutgoingMail.DoesNotExist:
-            logger.info(f"Ignoring job for non existing email {outgoing_mail}")
+            logger.info(f"Ignoring job for non existing email {outgoing_mail.guid}")
             return False
         if outgoing_mail.status == OutgoingMail.STATUS_INFLIGHT:
             logger.info(f"Ignoring job for inflight email {outgoing_mail.guid}")

src/pretix/base/services/orders.py

@@ -67,9 +67,9 @@ from pretix.base.email import get_email_context
 from pretix.base.i18n import get_language_without_region, language
 from pretix.base.media import MEDIA_TYPES
 from pretix.base.models import (
-    CartPosition, Device, Event, GiftCard, Item, ItemVariation, LogEntry,
-    Membership, Order, OrderPayment, OrderPosition, Quota, Seat,
-    SeatCategoryMapping, User, Voucher,
+    CartPosition, Device, Event, GiftCard, Item, ItemVariation, Membership,
+    Order, OrderPayment, OrderPosition, Quota, Seat, SeatCategoryMapping, User,
+    Voucher,
 )
 from pretix.base.models.event import SubEvent
 from pretix.base.models.orders import (
@@ -1618,7 +1618,7 @@ class OrderChangeManager:
     MembershipOperation = namedtuple('MembershipOperation', ('position', 'membership'))
     CancelOperation = namedtuple('CancelOperation', ('position', 'price_diff'))
     AddOperation = namedtuple('AddOperation', ('item', 'variation', 'price', 'addon_to', 'subevent', 'seat', 'membership',
-                                               'valid_from', 'valid_until', 'is_bundled', 'result', 'count'))
+                                               'valid_from', 'valid_until', 'is_bundled', 'result'))
     SplitOperation = namedtuple('SplitOperation', ('position',))
     FeeValueOperation = namedtuple('FeeValueOperation', ('fee', 'value', 'price_diff'))
     AddFeeOperation = namedtuple('AddFeeOperation', ('fee', 'price_diff'))
@@ -1632,24 +1632,16 @@ class OrderChangeManager:
     ForceRecomputeOperation = namedtuple('ForceRecomputeOperation', tuple())
 
     class AddPositionResult:
-        _positions: Optional[List[OrderPosition]]
+        _position: Optional[OrderPosition]
 
         def __init__(self):
-            self._positions = None
+            self._position = None
 
         @property
         def position(self) -> OrderPosition:
-            if self._positions is None:
+            if self._position is None:
                 raise RuntimeError("Order position has not been created yet. Call commit() first on OrderChangeManager.")
-            if len(self._positions) != 1:
-                raise RuntimeError("More than one position created.")
-            return self._positions[0]
-
-        @property
-        def positions(self) -> List[OrderPosition]:
-            if self._positions is None:
-                raise RuntimeError("Order position has not been created yet. Call commit() first on OrderChangeManager.")
-            return self._positions
+            return self._position
 
     def __init__(self, order: Order, user=None, auth=None, notify=True, reissue_invoice=True, allow_blocked_seats=False):
         self.order = order
@@ -1856,12 +1848,8 @@ class OrderChangeManager:
 
     def add_position(self, item: Item, variation: ItemVariation, price: Decimal, addon_to: OrderPosition = None,
                      subevent: SubEvent = None, seat: Seat = None, membership: Membership = None,
-                     valid_from: datetime = None, valid_until: datetime = None, count: int = 1) -> 'OrderChangeManager.AddPositionResult':
-        if count < 1:
-            raise ValueError("Count must be positive")
+                     valid_from: datetime = None, valid_until: datetime = None) -> 'OrderChangeManager.AddPositionResult':
         if isinstance(seat, str):
-            if count > 1:
-                raise ValueError("Cannot combine count > 1 with seat")
             if not seat:
                 seat = None
             else:
@@ -1915,14 +1903,14 @@ class OrderChangeManager:
         if self.order.event.settings.invoice_include_free or price.gross != Decimal('0.00'):
             self._invoice_dirty = True
 
-        self._totaldiff_guesstimate += price.gross * count
-        self._quotadiff.update({q: count for q in new_quotas})
+        self._totaldiff_guesstimate += price.gross
+        self._quotadiff.update(new_quotas)
         if seat:
             self._seatdiff.update([seat])
 
         result = self.AddPositionResult()
         self._operations.append(self.AddOperation(item, variation, price, addon_to, subevent, seat, membership,
-                                                  valid_from, valid_until, is_bundled, result, count))
+                                                  valid_from, valid_until, is_bundled, result))
         return result
 
     def split(self, position: OrderPosition):
@@ -2542,35 +2530,29 @@ class OrderChangeManager:
                     secret_dirty.remove(position)
                 position.save(update_fields=['canceled', 'secret'])
             elif isinstance(op, self.AddOperation):
-                new_pos = []
-                new_logs = []
-                for i in range(op.count):
-                    pos = OrderPosition.objects.create(
-                        item=op.item, variation=op.variation, addon_to=op.addon_to,
-                        price=op.price.gross, order=self.order, tax_rate=op.price.rate, tax_code=op.price.code,
-                        tax_value=op.price.tax, tax_rule=op.item.tax_rule,
-                        positionid=nextposid, subevent=op.subevent, seat=op.seat,
-                        used_membership=op.membership, valid_from=op.valid_from, valid_until=op.valid_until,
-                        is_bundled=op.is_bundled,
-                    )
-                    nextposid += 1
-                    new_pos.append(pos)
-                    new_logs.append(self.order.log_action('pretix.event.order.changed.add', user=self.user, auth=self.auth, data={
-                        'position': pos.pk,
-                        'item': op.item.pk,
-                        'variation': op.variation.pk if op.variation else None,
-                        'addon_to': op.addon_to.pk if op.addon_to else None,
-                        'price': op.price.gross,
-                        'positionid': pos.positionid,
-                        'membership': pos.used_membership_id,
-                        'subevent': op.subevent.pk if op.subevent else None,
-                        'seat': op.seat.pk if op.seat else None,
-                        'valid_from': op.valid_from.isoformat() if op.valid_from else None,
-                        'valid_until': op.valid_until.isoformat() if op.valid_until else None,
-                    }, save=False))
-
-                op.result._positions = new_pos
-                LogEntry.bulk_create_and_postprocess(new_logs)
+                pos = OrderPosition.objects.create(
+                    item=op.item, variation=op.variation, addon_to=op.addon_to,
+                    price=op.price.gross, order=self.order, tax_rate=op.price.rate, tax_code=op.price.code,
+                    tax_value=op.price.tax, tax_rule=op.item.tax_rule,
+                    positionid=nextposid, subevent=op.subevent, seat=op.seat,
+                    used_membership=op.membership, valid_from=op.valid_from, valid_until=op.valid_until,
+                    is_bundled=op.is_bundled,
+                )
+                nextposid += 1
+                self.order.log_action('pretix.event.order.changed.add', user=self.user, auth=self.auth, data={
+                    'position': pos.pk,
+                    'item': op.item.pk,
+                    'variation': op.variation.pk if op.variation else None,
+                    'addon_to': op.addon_to.pk if op.addon_to else None,
+                    'price': op.price.gross,
+                    'positionid': pos.positionid,
+                    'membership': pos.used_membership_id,
+                    'subevent': op.subevent.pk if op.subevent else None,
+                    'seat': op.seat.pk if op.seat else None,
+                    'valid_from': op.valid_from.isoformat() if op.valid_from else None,
+                    'valid_until': op.valid_until.isoformat() if op.valid_until else None,
+                })
+                op.result._position = pos
             elif isinstance(op, self.SplitOperation):
                 position = position_cache.setdefault(op.position.pk, op.position)
                 split_positions.append(position)
@@ -2895,7 +2877,7 @@ class OrderChangeManager:
         return total
 
     def _check_order_size(self):
-        if (len(self.order.positions.all()) + sum([op.count for op in self._operations if isinstance(op, self.AddOperation)])) > settings.PRETIX_MAX_ORDER_SIZE:
+        if (len(self.order.positions.all()) + len([op for op in self._operations if isinstance(op, self.AddOperation)])) > settings.PRETIX_MAX_ORDER_SIZE:
             raise OrderError(
                 self.error_messages['max_order_size'] % {
                     'max': settings.PRETIX_MAX_ORDER_SIZE,
@@ -2956,7 +2938,7 @@ class OrderChangeManager:
         ]) + len([
             o for o in self._operations if isinstance(o, self.SplitOperation)
         ])
-        adds = sum([o.count for o in self._operations if isinstance(o, self.AddOperation)])
+        adds = len([o for o in self._operations if isinstance(o, self.AddOperation)])
         if current > 0 and current - cancels + adds < 1:
             raise OrderError(self.error_messages['complete_cancel'])
 
@@ -3003,18 +2985,17 @@ class OrderChangeManager:
             elif isinstance(op, self.CancelOperation) and op.position in positions_to_fake_cart:
                 fake_cart.remove(positions_to_fake_cart[op.position])
             elif isinstance(op, self.AddOperation):
-                for i in range(op.count):
-                    cp = CartPosition(
-                        event=self.event,
-                        item=op.item,
-                        variation=op.variation,
-                        used_membership=op.membership,
-                        subevent=op.subevent,
-                        seat=op.seat,
-                    )
-                    cp.override_valid_from = op.valid_from
-                    cp.override_valid_until = op.valid_until
-                    fake_cart.append(cp)
+                cp = CartPosition(
+                    event=self.event,
+                    item=op.item,
+                    variation=op.variation,
+                    used_membership=op.membership,
+                    subevent=op.subevent,
+                    seat=op.seat,
+                )
+                cp.override_valid_from = op.valid_from
+                cp.override_valid_until = op.valid_until
+                fake_cart.append(cp)
         try:
             validate_memberships_in_order(self.order.customer, fake_cart, self.event, lock=True, ignored_order=self.order, testmode=self.order.testmode)
         except ValidationError as e:

src/pretix/control/forms/orders.py

@@ -331,10 +331,6 @@ class OtherOperationsForm(forms.Form):
 
 
 class OrderPositionAddForm(forms.Form):
-    count = forms.IntegerField(
-        label=_('Number of products to add'),
-        initial=1,
-    )
     itemvar = forms.ChoiceField(
         label=_('Product')
     )
@@ -436,10 +432,6 @@ class OrderPositionAddForm(forms.Form):
             d['used_membership'] = [m for m in self.memberships if str(m.pk) == d['used_membership']][0]
         else:
             d['used_membership'] = None
-        if d.get("count", 1) and d.get("seat"):
-            raise ValidationError({
-                "seat": _("You can not choose a seat when adding multiple products at once.")
-            })
         return d
 
 

src/pretix/control/forms/vouchers.py

@@ -32,16 +32,20 @@
 # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 # License for the specific language governing permissions and limitations under the License.
 
+import copy
 import csv
-from collections import namedtuple
+from collections import Counter, namedtuple
 from io import StringIO
 
 from django import forms
 from django.core.exceptions import ObjectDoesNotExist, ValidationError
 from django.core.validators import EmailValidator
+from django.db.models import Count, F, Max
 from django.db.models.functions import Upper
+from django.forms.utils import ErrorDict
 from django.urls import reverse
-from django.utils.translation import gettext_lazy as _
+from django.utils.timezone import now
+from django.utils.translation import gettext_lazy as _, pgettext_lazy
 from django_scopes.forms import SafeModelChoiceField
 
 from pretix.base.email import get_available_placeholders
@@ -50,7 +54,10 @@ from pretix.base.forms import (
 )
 from pretix.base.forms.widgets import format_placeholders_help_text
 from pretix.base.i18n import language
-from pretix.base.models import Item, Voucher
+from pretix.base.models import Item, ItemVariation, Quota, SubEvent, Voucher
+from pretix.base.models.vouchers import VoucherBulkData
+from pretix.base.services.locking import lock_objects
+from pretix.base.services.quotas import QuotaAvailability
 from pretix.control.forms import SplitDateTimeField, SplitDateTimePickerWidget
 from pretix.control.forms.widgets import Select2, Select2ItemVarQuota
 from pretix.control.signals import voucher_form_validation
@@ -105,15 +112,17 @@ class VoucherForm(I18nModelForm):
             except Item.DoesNotExist:
                 pass
         super().__init__(*args, **kwargs)
+        if not self.event and self.instance:
+            self.event = self.instance.event
 
-        if instance.event.has_subevents:
-            self.fields['subevent'].queryset = instance.event.subevents.all()
+        if self.event.has_subevents:
+            self.fields['subevent'].queryset = self.event.subevents.all()
             self.fields['subevent'].widget = Select2(
                 attrs={
                     'data-model-select2': 'event',
                     'data-select2-url': reverse('control:event.subevents.select2', kwargs={
-                        'event': instance.event.slug,
-                        'organizer': instance.event.organizer.slug,
+                        'event': self.event.slug,
+                        'organizer': self.event.organizer.slug,
                     }),
                 }
             )
@@ -123,18 +132,19 @@ class VoucherForm(I18nModelForm):
             del self.fields['subevent']
 
         choices = []
-        if 'itemvar' in initial or (self.data and 'itemvar' in self.data):
-            iv = self.data.get('itemvar') or initial.get('itemvar', '')
+        prefix = (self.prefix + '-') if self.prefix else ''
+        if 'itemvar' in initial or (self.data and prefix + 'itemvar' in self.data):
+            iv = self.data.get(prefix + 'itemvar', '') or initial.get('itemvar', '') or ''
             if iv.startswith('q-'):
-                q = self.instance.event.quotas.get(pk=iv[2:])
+                q = self.event.quotas.get(pk=iv[2:])
                 choices.append(('q-%d' % q.pk, _('Any product in quota "{quota}"').format(quota=q)))
             elif '-' in iv:
                 itemid, varid = iv.split('-')
-                i = self.instance.event.items.get(pk=itemid)
+                i = self.event.items.get(pk=itemid)
                 v = i.variations.get(pk=varid)
                 choices.append(('%d-%d' % (i.pk, v.pk), '%s – %s' % (str(i), v.value)))
             elif iv:
-                i = self.instance.event.items.get(pk=iv)
+                i = self.event.items.get(pk=iv)
                 if i.variations.exists():
                     choices.append((str(i.pk), _('{product} – Any variation').format(product=i)))
                 else:
@@ -145,8 +155,8 @@ class VoucherForm(I18nModelForm):
             attrs={
                 'data-model-select2': 'generic',
                 'data-select2-url': reverse('control:event.vouchers.itemselect2', kwargs={
-                    'event': instance.event.slug,
-                    'organizer': instance.event.organizer.slug,
+                    'event': self.event.slug,
+                    'organizer': self.event.organizer.slug,
                 }),
                 'data-placeholder': _('All products')
             }
@@ -154,7 +164,7 @@ class VoucherForm(I18nModelForm):
         self.fields['itemvar'].required = False
         self.fields['itemvar'].widget.choices = self.fields['itemvar'].choices
 
-        if self.instance.event.seating_plan or self.instance.event.subevents.filter(seating_plan__isnull=False).exists():
+        if self.event.seating_plan or self.event.subevents.filter(seating_plan__isnull=False).exists():
             self.fields['seat'] = forms.CharField(
                 label=_("Specific seat ID"),
                 max_length=255,
@@ -164,40 +174,45 @@ class VoucherForm(I18nModelForm):
                 help_text=str(self.instance.seat) if self.instance.seat else '',
             )
 
+    def parse_itemvar(self, data):
+        try:
+            itemid = quotaid = None
+            iv = data.get('itemvar', '')
+            if iv.startswith('q-'):
+                quotaid = iv[2:]
+            elif '-' in iv:
+                itemid, varid = iv.split('-')
+            elif iv:
+                itemid, varid = iv, None
+            else:
+                itemid, varid = None, None
+
+            if itemid:
+                item = self.event.items.get(pk=itemid)
+                if varid:
+                    variation = item.variations.get(pk=varid)
+                else:
+                    variation = None
+                quota = None
+            elif quotaid:
+                quota = self.event.quotas.get(pk=quotaid)
+                item = None
+                variation = None
+            else:
+                quota = None
+                item = None
+                variation = None
+
+            return (item, variation, quota)
+
+        except ObjectDoesNotExist:
+            raise ValidationError(_("Invalid product selected."))
+
     def clean(self):
         data = super().clean()
 
         if not self._errors:
-            try:
-                itemid = quotaid = None
-                iv = self.data.get('itemvar', '')
-                if iv.startswith('q-'):
-                    quotaid = iv[2:]
-                elif '-' in iv:
-                    itemid, varid = iv.split('-')
-                elif iv:
-                    itemid, varid = iv, None
-                else:
-                    itemid, varid = None, None
-
-                if itemid:
-                    self.instance.item = self.instance.event.items.get(pk=itemid)
-                    if varid:
-                        self.instance.variation = self.instance.item.variations.get(pk=varid)
-                    else:
-                        self.instance.variation = None
-                    self.instance.quota = None
-                elif quotaid:
-                    self.instance.quota = self.instance.event.quotas.get(pk=quotaid)
-                    self.instance.item = None
-                    self.instance.variation = None
-                else:
-                    self.instance.quota = None
-                    self.instance.item = None
-                    self.instance.variation = None
-
-            except ObjectDoesNotExist:
-                raise ValidationError(_("Invalid product selected."))
+            self.instance.item, self.instance.variation, self.instance.quota = self.parse_itemvar(self.data)
 
         if 'codes' in data:
             data['codes'] = [a.strip() for a in data.get('codes', '').strip().split("\n") if a]
@@ -209,7 +224,7 @@ class VoucherForm(I18nModelForm):
 
         try:
             Voucher.clean_item_properties(
-                data, self.instance.event,
+                data, self.event,
                 self.instance.quota, self.instance.item, self.instance.variation,
                 seats_given=data.get('seat') or data.get('seats'),
                 block_quota=data.get('block_quota')
@@ -229,7 +244,7 @@ class VoucherForm(I18nModelForm):
 
         try:
             Voucher.clean_subevent(
-                data, self.instance.event
+                data, self.event
             )
         except ValidationError as e:
             raise ValidationError({"subevent": e.message})
@@ -245,19 +260,19 @@ class VoucherForm(I18nModelForm):
         if check_quota:
             Voucher.clean_quota_check(
                 data, cnt, self.initial_instance_data,
-                self.instance.event, self.instance.quota, self.instance.item, self.instance.variation
+                self.event, self.instance.quota, self.instance.item, self.instance.variation
             )
-        Voucher.clean_voucher_code(data, self.instance.event, self.instance.pk)
+        Voucher.clean_voucher_code(data, self.event, self.instance.pk)
         if 'seat' in self.fields:
             if data.get('seat'):
                 self.instance.seat = Voucher.clean_seat_id(
-                    data, self.instance.item, self.instance.quota, self.instance.event, self.instance.pk
+                    data, self.instance.item, self.instance.quota, self.event, self.instance.pk
                 )
                 self.instance.item = self.instance.seat.product
             else:
                 self.instance.seat = None
 
-        voucher_form_validation.send(sender=self.instance.event, form=self, data=data)
+        voucher_form_validation.send(sender=self.event, form=self, data=data)
 
         return data
 
@@ -265,6 +280,215 @@ class VoucherForm(I18nModelForm):
         return super().save(commit)
 
 
+class VoucherBulkEditForm(VoucherForm):
+    def __init__(self, *args, **kwargs):
+        self.mixed_values = kwargs.pop('mixed_values')
+        self.queryset = kwargs.pop('queryset')
+        super().__init__(**kwargs)
+        del self.fields["code"]
+        self.fields.pop("seat", None)
+
+    def is_bulk_checked(self, fieldname):
+        return self.prefix + fieldname in self.data.getlist('_bulk')
+
+    def clean(self):
+        # We skip the parent class because it's not suited for bulk editing and implement custom validation here.
+        # This does not validate *everything* we validate in VoucherForm. For example, we skip validation that one does
+        # not create a voucher for an add-on product or that the seat matches the product to save on complexity.
+        # This is a UX validation only anyway, since one could first create the voucher and then make the product an
+        # add-on product. However, we need to validate everything that we don't want violated in the database.
+        data = super(VoucherForm, self).clean()
+
+        if self.is_bulk_checked("itemvar"):
+            data["item"], data["variation"], data["quota"] = self.parse_itemvar(data)
+
+        if self.is_bulk_checked("max_usages") and "max_usages" in data:
+            max_redeemed = self.queryset.aggregate(m=Max("redeemed"))["m"]
+            if data["max_usages"] < max_redeemed:
+                raise ValidationError(_(
+                    "You cannot reduce the maximum number of redemptions to %(max_usages)s, because at least one "
+                    "of the selected vouchers has already been redeemed %(max_redeemed)s times."
+                ) % {"max_usages": data["max_usages"], "max_redeemed": max_redeemed})
+
+        # Check diff on product and quota usage based on old groups of vouchers
+        if any(self.is_bulk_checked(k) for k in ("max_usages", "itemvar", "block_quota", "valid_until", "subevent")):
+            quota_diff = Counter()
+
+            current_vouchers = self.queryset.order_by().values(
+                "item", "variation", "quota", "block_quota", "valid_until", "subevent", "redeemed", "max_usages",
+                "allow_ignore_quota",
+            ).annotate(c=Count("*"))
+            item_cache = {i.pk: i for i in Item.objects.filter(pk__in=[c["item"] for c in current_vouchers])}
+            var_cache = {v.pk: v for v in ItemVariation.objects.filter(pk__in=[c["variation"] for c in current_vouchers])}
+            quota_cache = {q.pk: q for q in Quota.objects.filter(pk__in=[c["quota"] for c in current_vouchers])}
+            subevent_cache = {s.pk: s for s in SubEvent.objects.filter(pk__in=[c["subevent"] for c in current_vouchers])}
+
+            for current in current_vouchers:
+                bulk_count = current.pop('c')
+                current = VoucherBulkData(**current)
+                # Get quotas that are currently used
+                if current.item:
+                    current.item = item_cache[current.item]
+                if current.variation:
+                    current.variation = var_cache[current.variation]
+                if current.quota:
+                    current.quota = quota_cache[current.quota]
+                if current.subevent:
+                    current.subevent = subevent_cache[current.subevent]
+
+                old_quotas = Voucher.clean_quota_get_ignored(current)
+                old_amount = max(current.max_usages - current.redeemed, 0) * bulk_count
+
+                # Predict state after change
+                after_change = copy.copy(current)
+                if self.is_bulk_checked("itemvar") and "itemvar" in data:
+                    after_change.item = data["item"]
+                    after_change.variation = data["variation"]
+                    after_change.quota = data["quota"]
+                if self.is_bulk_checked("subevent") and "subevent" in data:
+                    after_change.subevent = data["subevent"]
+                if self.is_bulk_checked("max_usages") and "max_usages" in data:
+                    after_change.max_usages = data["max_usages"]
+                if self.is_bulk_checked("block_quota") and "block_quota" in data:
+                    after_change.block_quota = data["block_quota"]
+                if self.is_bulk_checked("valid_until") and "valid_until" in data:
+                    after_change.valid_until = data["valid_until"]
+                if self.is_bulk_checked("allow_ignore_quota") and "allow_ignore_quota" in data:
+                    after_change.allow_ignore_quota = data["allow_ignore_quota"]
+
+                if after_change.quota and self.event.has_subevents and not after_change.subevent:
+                    raise ValidationError(_("You cannot create a voucher that allows selection of a quota but has no date selected."))
+
+                if after_change.quota and after_change.subevent and after_change.quota.subevent_id != after_change.subevent.pk:
+                    raise ValidationError(_("The selected quota does not match the selected subevent."))
+
+                if after_change.block_quota and self.event.has_subevents and not after_change.subevent:
+                    raise ValidationError(
+                        _('If you want this voucher to block quota, you need to select a specific date.'))
+
+                if after_change.block_quota and not after_change.item and not after_change.quota:
+                    raise ValidationError(
+                        _('You need to select a specific product or quota if this voucher should reserve '
+                          'tickets.')
+                    )
+
+                if after_change.allow_ignore_quota:
+                    # todo: is this the most useful way to do this?
+                    continue
+
+                new_quotas = Voucher.clean_quota_get_ignored(after_change)
+                new_amount = max(after_change.max_usages - after_change.redeemed, 0) * bulk_count
+
+                if new_quotas != old_quotas or new_amount != old_amount:
+                    for q in old_quotas:
+                        quota_diff[q] -= old_amount
+                    for q in new_quotas:
+                        quota_diff[q] += new_amount
+
+            if any(v > 0 for q, v in quota_diff.items()):
+                lock_objects([q for q, v in quota_diff.items() if q.size is not None and v > 0], shared_lock_objects=[self.event])
+                qa = QuotaAvailability(count_waitinglist=False)
+                qa.queue(*(q for q, v in quota_diff.items() if v > 0))
+                qa.compute()
+
+                if any(qa.results[q][0] != Quota.AVAILABILITY_OK or (qa.results[q][1] is not None and qa.results[q][1] < required)
+                       for q, required in quota_diff.items() if required > 0):
+                    raise ValidationError(_(
+                        'There is no sufficient quota available to perform this change.'
+                    ))
+
+        has_seat = self.queryset.filter(seat__isnull=False).exists()
+        if has_seat:
+            if self.is_bulk_checked("max_usages"):
+                raise ValidationError(_(
+                    'Changing the maximum number of usages in bulk is not supported if any of the selected vouchers '
+                    'is assigned a seat.'
+                ))
+            if self.is_bulk_checked("subevent"):
+                raise ValidationError(pgettext_lazy(
+                    'subevent',
+                    'Changing the date in bulk is not supported if any of the selected vouchers '
+                    'is assigned a seat.'
+                ))
+            if self.is_bulk_checked("itemvar") and data["quota"]:
+                raise ValidationError(_(
+                    'Changing the product to a quota is not supported if any of the selected vouchers '
+                    'is assigned a seat.'
+                ))
+
+            if self.is_bulk_checked("valid_until"):
+                if data["valid_until"] is None or data["valid_until"] >= now():
+                    currently_not_blocked_seats = self.queryset.filter(
+                        seat__isnull=False,
+                        max_usages__gt=F("redeemed"),
+                        valid_until__lt=now(),
+                    )
+                    if self.event.has_subevents:
+                        subevents = self.event.subevents.filter(pk__in=currently_not_blocked_seats.values_list("subevent"))
+                        for se in subevents:
+                            conflicts = currently_not_blocked_seats.filter(
+                                subevent=se
+                            ).exclude(
+                                seat_id__in=se.free_seats().values("pk")
+                            )
+                            if conflicts:
+                                raise ValidationError(_(
+                                    'This change cannot be completed because not all assigned seats of the vouchers are '
+                                    'still available'
+                                ))
+                    else:
+                        conflicts = currently_not_blocked_seats.exclude(
+                            seat_id__in=self.event.free_seats().values("pk")
+                        )
+                        if conflicts:
+                            raise ValidationError(_(
+                                'This change cannot be completed because not all assigned seats of the vouchers are '
+                                'still available'
+                            ))
+
+        return data
+
+    def save(self, commit=True):
+        objs = list(self.queryset)
+        fields = set()
+
+        check_map = {
+            'price_mode': '__price',
+            'value': '__price',
+        }
+        for k in self.fields:
+            if not self.is_bulk_checked(check_map.get(k, k)):
+                continue
+
+            if k == 'itemvar':
+                fields.add("item")
+                fields.add("variation")
+                fields.add("quota")
+            else:
+                fields.add(k)
+            for obj in objs:
+                if k == 'itemvar':
+                    obj.item = self.cleaned_data["item"]
+                    obj.variation = self.cleaned_data["variation"]
+                    obj.quota = self.cleaned_data["quota"]
+                else:
+                    setattr(obj, k, self.cleaned_data[k])
+
+        fields = [f for f in fields if f != 'itemvars']
+        if fields:
+            Voucher.objects.bulk_update(objs, fields, 200)
+
+    def full_clean(self):
+        if len(self.data) == 0:
+            # form wasn't submitted
+            self._errors = ErrorDict()
+            return
+        super().full_clean()
+
+    def _post_clean(self):
+        pass  # skip model-level clean
+
+
 class VoucherBulkForm(VoucherForm):
     codes = forms.CharField(
         widget=forms.Textarea,

src/pretix/control/templates/pretixcontrol/order/change.html

@@ -329,7 +329,6 @@
                                         {{ add_form.custom_error }}
                                     </div>
                                 {% endif %}
-                                {% bootstrap_field add_form.count layout="control" %}
                                 {% bootstrap_field add_form.itemvar layout="control" %}
                                 {% bootstrap_field add_form.price addon_after=request.event.currency layout="control" %}
                                 {% if add_form.addon_to %}
@@ -365,7 +364,6 @@
                         </div>
                         <div class="panel-body">
                             <div class="form-horizontal">
-                                {% bootstrap_field add_position_formset.empty_form.count layout="control" %}
                                 {% bootstrap_field add_position_formset.empty_form.itemvar layout="control" %}
                                 {% bootstrap_field add_position_formset.empty_form.price addon_after=request.event.currency layout="control" %}
                                 {% if add_position_formset.empty_form.addon_to %}

src/pretix/control/templates/pretixcontrol/vouchers/bulk_edit.html

@@ -0,0 +1,83 @@
+{% extends "pretixcontrol/items/base.html" %}
+{% load i18n %}
+{% load bootstrap3 %}
+{% load eventsignal %}
+{% load eventurl %}
+{% block title %}{% trans "Change multiple vouchers" %}{% endblock %}
+{% block inside %}
+    <h1>
+        {% trans "Change multiple vouchers" %}
+        <small>
+            {% blocktrans trimmed with number=vouchers.count %}
+                {{ number }} selected
+            {% endblocktrans %}
+        </small>
+    </h1>
+    <form action="" method="post" class="form-horizontal">
+        {% csrf_token %}
+        <div class="hidden">
+            {% for v in vouchers %}
+                <input type="hidden" name="voucher" value="{{ v.pk }}">
+            {% endfor %}
+        </div>
+        {% bootstrap_form_errors form %}
+            <fieldset>
+                <legend>{% trans "Voucher details" %}</legend>
+                {% bootstrap_field form.max_usages layout="bulkedit" %}
+                {% bootstrap_field form.valid_until layout="bulkedit" %}
+                {% bootstrap_field form.itemvar layout="bulkedit" %}
+
+                <div class="bulk-edit-field-group">
+                    <label class="field-toggle">
+                        <input type="checkbox" name="_bulk" value="{{ form.prefix }}__price" {% if form.prefix|add:"__price" in bulk_selected %}checked{% endif %}>
+                        {% trans "change" context "form_bulk" %}
+                    </label>
+                    <div class="field-content">
+                        <div class="form-group">
+                            <label class="col-md-3 control-label" for="id_tag">{% trans "Price effect" %}</label>
+                            <div class="col-md-5">
+                                {% bootstrap_field form.price_mode show_label=False form_group_class="" %}
+                            </div>
+                            <div class="col-md-4">
+                                {% bootstrap_field form.value show_label=False form_group_class="" %}
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="form-group">
+                    <div class="col-md-9 col-md-offset-3">
+                        <div class="controls">
+                            <div class="alert alert-info">
+                                {% blocktrans trimmed %}
+                                    If you choose "any product" for a specific quota and choose to reserve quota for this
+                                    voucher above, the product can still be unavailable to the voucher holder if another quota
+                                    associated with the product is sold out!
+                                {% endblocktrans %}
+                            </div>
+                        </div>
+                    </div>
+                </div>
+                {% if form.subevent %}
+                    {% bootstrap_field form.subevent layout="bulkedit" %}
+                {% endif %}
+            </fieldset>
+            <fieldset>
+                <legend>{% trans "Advanced settings" %}</legend>
+                {% bootstrap_field form.block_quota layout="bulkedit" %}
+                {% bootstrap_field form.allow_ignore_quota layout="bulkedit" %}
+                {% bootstrap_field form.min_usages layout="bulkedit" %}
+                {% bootstrap_field form.budget addon_after=request.event.currency layout="bulkedit" %}
+                {% bootstrap_field form.tag layout="bulkedit" %}
+                {% bootstrap_field form.comment layout="bulkedit" %}
+                {% bootstrap_field form.show_hidden_items layout="bulkedit" %}
+                {% bootstrap_field form.all_addons_included layout="bulkedit" %}
+                {% bootstrap_field form.all_bundles_included layout="bulkedit" %}
+            </fieldset>
+            <div class="form-group submit-group">
+                <button type="submit" class="btn btn-primary btn-save">
+                    {% trans "Save" %}
+                </button>
+            </div>
+    </form>
+{% endblock %}

src/pretix/control/templates/pretixcontrol/vouchers/index.html

@@ -99,6 +99,9 @@
         </p>
         <form action="{% url "control:event.vouchers.bulkaction"  organizer=request.event.organizer.slug event=request.event.slug %}" method="post">
             {% csrf_token %}
+            {% for field in filter_form %}
+                {{ field.as_hidden }}
+            {% endfor %}
             <div class="table-responsive">
                 <table class="table table-hover table-quotas">
                     <thead>
@@ -144,6 +147,18 @@
                         {% endif %}
                         <th></th>
                     </tr>
+                    {% if "event.vouchers:write" in request.eventpermset and page_obj.paginator.num_pages > 1 %}
+                        <tr class="table-select-all warning hidden">
+                            <td>
+                                <input type="checkbox" name="__ALL" id="__all" data-results-total="{{ page_obj.paginator.count }}">
+                            </td>
+                            <td colspan="5">
+                                <label for="__all">
+                                    {% trans "Select all results on other pages as well" %}
+                                </label>
+                            </td>
+                        </tr>
+                    {% endif %}
                     </thead>
                     <tbody>
                     {% for v in vouchers %}
@@ -211,6 +226,10 @@
                         <i class="fa fa-trash" aria-hidden="true"></i>
                         {% trans "Delete selected" %}
                     </button>
+                    <button type="submit" class="btn btn-primary btn-save" name="action" value="edit"
+                            formaction="{% url "control:event.vouchers.bulkedit"  organizer=request.event.organizer.slug event=request.event.slug %}">
+                        <i class="fa fa-edit"></i>{% trans "Edit selected" %}
+                    </button>
                 </div>
             {% endif %}
         </form>

src/pretix/control/urls.py

@@ -379,6 +379,7 @@ urlpatterns = [
         re_path(r'^vouchers/bulk_add$', vouchers.VoucherBulkCreate.as_view(), name='event.vouchers.bulk'),
         re_path(r'^vouchers/bulk_add/mail_preview$', vouchers.VoucherBulkMailPreview.as_view(), name='event.vouchers.bulk.mail_preview'),
         re_path(r'^vouchers/bulk_action$', vouchers.VoucherBulkAction.as_view(), name='event.vouchers.bulkaction'),
+        re_path(r'^vouchers/bulk_edit$', vouchers.VoucherBulkUpdateView.as_view(), name='event.vouchers.bulkedit'),
         re_path(r'^vouchers/import/$', modelimport.VoucherImportView.as_view(), name='event.vouchers.import'),
         re_path(r'^vouchers/import/(?P<file>[^/]+)/$', modelimport.VoucherProcessView.as_view(), name='event.vouchers.import.process'),
         re_path(r'^orders/(?P<code>[0-9A-Z]+)/transition$', orders.OrderTransition.as_view(),

src/pretix/control/views/orders.py

@@ -2059,13 +2059,12 @@ class OrderChange(OrderView):
                 else:
                     variation = None
                 try:
-                    for i in range(f.cleaned_data.get("count", 1)):
-                        ocm.add_position(item, variation,
-                                         f.cleaned_data['price'],
-                                         f.cleaned_data.get('addon_to'),
-                                         f.cleaned_data.get('subevent'),
-                                         f.cleaned_data.get('seat'),
-                                         f.cleaned_data.get('used_membership'))
+                    ocm.add_position(item, variation,
+                                     f.cleaned_data['price'],
+                                     f.cleaned_data.get('addon_to'),
+                                     f.cleaned_data.get('subevent'),
+                                     f.cleaned_data.get('seat'),
+                                     f.cleaned_data.get('used_membership'))
                 except OrderError as e:
                     f.custom_error = str(e)
                     return False

src/pretix/control/views/vouchers.py

@@ -40,9 +40,9 @@ import bleach
 from defusedcsv import csv
 from django.conf import settings
 from django.contrib import messages
-from django.core.exceptions import PermissionDenied, ValidationError
+from django.core.exceptions import PermissionDenied, ValidationError, BadRequest
 from django.db import connection, transaction
-from django.db.models import Exists, OuterRef, Sum
+from django.db.models import Count, Exists, OuterRef, Sum
 from django.http import (
     Http404, HttpResponse, HttpResponseBadRequest, HttpResponseRedirect,
     JsonResponse,
@@ -55,7 +55,7 @@ from django.utils.safestring import mark_safe
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 from django.views.generic import (
-    CreateView, ListView, TemplateView, UpdateView, View,
+    CreateView, FormView, ListView, TemplateView, UpdateView, View,
 )
 from django_scopes import scopes_disabled
 
@@ -70,7 +70,9 @@ from pretix.base.services.vouchers import vouchers_send
 from pretix.base.templatetags.rich_text import markdown_compile_email
 from pretix.base.views.tasks import AsyncFormView
 from pretix.control.forms.filter import VoucherFilterForm, VoucherTagFilterForm
-from pretix.control.forms.vouchers import VoucherBulkForm, VoucherForm
+from pretix.control.forms.vouchers import (
+    VoucherBulkEditForm, VoucherBulkForm, VoucherForm,
+)
 from pretix.control.permissions import EventPermissionRequiredMixin
 from pretix.control.signals import voucher_form_class
 from pretix.control.views import PaginationMixin
@@ -80,7 +82,37 @@ from pretix.helpers.models import modelcopy
 from pretix.multidomain.urlreverse import build_absolute_uri
 
 
-class VoucherList(PaginationMixin, EventPermissionRequiredMixin, ListView):
+class VoucherQueryMixin:
+
+    @cached_property
+    def request_data(self):
+        if self.request.method == "POST":
+            return self.request.POST
+        return self.request.GET
+
+    @scopes_disabled()  # we have an event check here, and we can save some performance on subqueries
+    def get_queryset(self):
+        qs = self.request.event.vouchers.exclude(
+            Exists(WaitingListEntry.objects.filter(voucher_id=OuterRef('pk')))
+        )
+        if 'voucher' in self.request_data and '__ALL' not in self.request_data:
+            qs = qs.filter(
+                id__in=self.request_data.getlist('voucher')
+            )
+        elif self.request.method == 'GET' or '__ALL' in self.request_data:
+            if self.filter_form.is_valid():
+                qs = self.filter_form.filter_qs(qs)
+        else:
+            raise BadRequest("No vouchers selected")
+
+        return qs
+
+    @cached_property
+    def filter_form(self):
+        return VoucherFilterForm(data=self.request_data, prefix='filter', event=self.request.event)
+
+
+class VoucherList(VoucherQueryMixin, PaginationMixin, EventPermissionRequiredMixin, ListView):
     model = Voucher
     context_object_name = 'vouchers'
     template_name = 'pretixcontrol/vouchers/index.html'
@@ -88,25 +120,15 @@ class VoucherList(PaginationMixin, EventPermissionRequiredMixin, ListView):
 
     @scopes_disabled()  # we have an event check here, and we can save some performance on subqueries
     def get_queryset(self):
-        qs = Voucher.annotate_budget_used(self.request.event.vouchers.exclude(
-            Exists(WaitingListEntry.objects.filter(voucher_id=OuterRef('pk')))
-        ).select_related(
+        return Voucher.annotate_budget_used(super().get_queryset().select_related(
             'item', 'variation', 'seat'
         ))
-        if self.filter_form.is_valid():
-            qs = self.filter_form.filter_qs(qs)
-
-        return qs
 
     def get_context_data(self, **kwargs):
         ctx = super().get_context_data(**kwargs)
         ctx['filter_form'] = self.filter_form
         return ctx
 
-    @cached_property
-    def filter_form(self):
-        return VoucherFilterForm(data=self.request.GET, event=self.request.event)
-
     def get(self, request, *args, **kwargs):
         if request.GET.get("download", "") == "yes":
             return self._download_csv()
@@ -293,6 +315,12 @@ class VoucherUpdate(EventPermissionRequiredMixin, UpdateView):
                 f.disabled = True
         return form
 
+    def get_form_kwargs(self):
+        return {
+            **super().get_form_kwargs(),
+            "event": self.request.event,
+        }
+
     def get_object(self, queryset=None) -> VoucherForm:
         url = resolve(self.request.path_info)
         try:
@@ -603,26 +631,21 @@ class VoucherRNG(EventPermissionRequiredMixin, View):
         })
 
 
-class VoucherBulkAction(EventPermissionRequiredMixin, View):
+class VoucherBulkAction(VoucherQueryMixin, EventPermissionRequiredMixin, View):
     permission = 'event.vouchers:write'
 
-    @cached_property
-    def objects(self):
-        return self.request.event.vouchers.filter(
-            id__in=self.request.POST.getlist('voucher')
-        )
-
     @transaction.atomic
     def post(self, request, *args, **kwargs):
         if request.POST.get('action') == 'delete':
             return render(request, 'pretixcontrol/vouchers/delete_bulk.html', {
-                'allowed': self.objects.filter(redeemed=0),
-                'forbidden': self.objects.exclude(redeemed=0),
+                'allowed': self.get_queryset().filter(redeemed=0),
+                'forbidden': self.get_queryset().exclude(redeemed=0),
             })
         elif request.POST.get('action') == 'delete_confirm':
             log_entries = []
             to_delete = []
-            for obj in self.objects:
+            to_update = []
+            for obj in self.get_queryset():
                 if obj.allow_delete():
                     log_entries.append(obj.log_action('pretix.voucher.deleted', user=self.request.user, save=False))
                     to_delete.append(obj.pk)
@@ -632,12 +655,14 @@ class VoucherBulkAction(EventPermissionRequiredMixin, View):
                         'bulk': True
                     }, save=False))
                     obj.max_usages = min(obj.redeemed, obj.max_usages)
-                    obj.save(update_fields=['max_usages'])
+                    to_update.append(obj)
 
             if to_delete:
                 CartPosition.objects.filter(addon_to__voucher_id__in=to_delete).delete()
                 CartPosition.objects.filter(voucher_id__in=to_delete).delete()
                 Voucher.objects.filter(pk__in=to_delete).delete()
+            if to_update:
+                Voucher.objects.bulk_update(to_update, ['max_usages'])
 
             LogEntry.bulk_create_and_postprocess(log_entries)
             messages.success(request, _('The selected vouchers have been deleted or disabled.'))
@@ -648,3 +673,117 @@ class VoucherBulkAction(EventPermissionRequiredMixin, View):
             'organizer': self.request.event.organizer.slug,
             'event': self.request.event.slug,
         })
+
+
+class VoucherBulkUpdateView(VoucherQueryMixin, EventPermissionRequiredMixin, FormView):
+    template_name = 'pretixcontrol/vouchers/bulk_edit.html'
+    permission = 'event.vouchers:write'
+    context_object_name = 'vouchers'
+    form_class = VoucherBulkEditForm
+
+    def get_queryset(self):
+        return super().get_queryset().prefetch_related(None).order_by()
+
+    def get(self, request, *args, **kwargs):
+        return HttpResponse(status=405)
+
+    @cached_property
+    def is_submitted(self):
+        # Usually, django considers a form "bound" / "submitted" on every POST request. However, this view is always
+        # called with POST method, even if just to pass the selection of objects to work on, so we want to modify
+        # that behavior
+        return '_bulk' in self.request.POST
+
+    def get_form_kwargs(self):
+        initial = {}
+        mixed_values = set()
+        qs = self.get_queryset().annotate()
+
+        fields = (
+            'valid_until', 'block_quota', 'allow_ignore_quota', 'value', 'tag', 'comment', 'max_usages',
+            'min_usages', 'price_mode', 'subevent', 'show_hidden_items', 'all_addons_included', 'all_bundles_included',
+            'budget',
+        )
+        for f in fields:
+            existing_values = list(qs.order_by(f).values(f).annotate(c=Count('*')))
+            if len(existing_values) == 1:
+                initial[f] = existing_values[0][f]
+            elif len(existing_values) > 1:
+                mixed_values.add(f)
+                if f == "max_usages":
+                    initial[f] = 1
+                else:
+                    initial[f] = None
+
+        existing_values = list(qs.order_by("item", "variation", "quota").values("item", "variation", "quota").annotate(c=Count('*')))
+        if len(existing_values) == 1:
+            i = existing_values[0]
+            if i["quota"]:
+                initial["itemvar"] = f'q-{i["quota"]}'
+            elif i["variation"]:
+                initial["itemvar"] = f'{i["item"]}-{i["variation"]}'
+            elif i["item"]:
+                initial["itemvar"] = f'{i["item"]}'
+            else:
+                initial["itemvar"] = None
+        elif len(existing_values) > 1:
+            mixed_values.add("itemvar")
+            initial["itemvar"] = None
+
+        kwargs = super().get_form_kwargs()
+        kwargs['event'] = self.request.event
+        kwargs['prefix'] = 'bulkedit'
+        kwargs['initial'] = initial
+        kwargs['queryset'] = self.get_queryset()
+        kwargs['mixed_values'] = mixed_values
+        if not self.is_submitted:
+            kwargs['data'] = None
+            kwargs['files'] = None
+        return kwargs
+
+    def get_success_url(self):
+        return reverse('control:event.vouchers', kwargs={
+            'organizer': self.request.event.organizer.slug,
+            'event': self.request.event.slug,
+        })
+
+    def form_valid(self, form):
+        log_entries = []
+
+        # Main form
+        form.save()
+        data = {
+            k: v
+            for k, v in form.cleaned_data.items()
+            if k in form.changed_data
+        }
+        data['_raw_bulk_data'] = self.request.POST.dict()
+        for obj in self.get_queryset():
+            log_entries.append(
+                obj.log_action('pretix.voucher.changed', data=data, user=self.request.user, save=False)
+            )
+
+        LogEntry.bulk_create_and_postprocess(log_entries)
+
+        messages.success(self.request, _('Your changes have been saved.'))
+        return super().form_valid(form)
+
+    def get_context_data(self, **kwargs):
+        ctx = super().get_context_data(**kwargs)
+        ctx['vouchers'] = self.get_queryset()
+        ctx['bulk_selected'] = self.request.POST.getlist("_bulk")
+        return ctx
+
+    @transaction.atomic
+    def post(self, request, *args, **kwargs):
+        form = self.get_form()
+        is_valid = (
+            self.is_submitted and
+            form.is_valid()
+        )
+        if is_valid:
+            return self.form_valid(form)
+        else:
+            if self.is_submitted:
+                messages.error(self.request, _('We could not save your changes. See below for details.'))
+            return self.form_invalid(form)

src/pretix/locale/de/wordlist.txt

@@ -32,7 +32,6 @@ ausgecheckt
 ausgeklappt
 auswahl
 Authentication
-Authenticator
 Authenticator-App
 Autorisierungscode
 Autorisierungs-Endpunktes
@@ -131,7 +130,6 @@ Eingangsscan
 Einlassbuchung
 Einlassdatum
 Einlasskontrolle
-Einmalpasswörter
 einzuchecken
 email
 E-Mail-Renderer
@@ -165,7 +163,6 @@ Explorer
 FA
 Favicon
 F-Droid
-freeOTP
 Footer
 Footer-Link
 Footer-Text
@@ -560,7 +557,6 @@ Zahlungs-ID
 Zahlungspflichtig
 Zehnerkarten
 Zeitbasiert
-zeitbasierte
 Zeitslotbuchung
 Zimpler
 ZIP-Datei

src/pretix/locale/de_Informal/wordlist.txt

@@ -32,7 +32,6 @@ ausgecheckt
 ausgeklappt
 auswahl
 Authentication
-Authenticator
 Authenticator-App
 Autorisierungscode
 Autorisierungs-Endpunktes
@@ -131,7 +130,6 @@ Eingangsscan
 Einlassbuchung
 Einlassdatum
 Einlasskontrolle
-Einmalpasswörter
 einzuchecken
 email
 E-Mail-Renderer
@@ -165,7 +163,6 @@ Explorer
 FA
 Favicon
 F-Droid
-freeOTP
 Footer
 Footer-Link
 Footer-Text
@@ -560,7 +557,6 @@ Zahlungs-ID
 Zahlungspflichtig
 Zehnerkarten
 Zeitbasiert
-zeitbasierte
 Zeitslotbuchung
 Zimpler
 ZIP-Datei

src/pretix/locale/djangojs.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-03-30 11:25+0000\n"
+"POT-Creation-Date: 2026-03-17 14:06+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"

src/pretix/locale/es/LC_MESSAGES/djangojs.po

@@ -8,7 +8,7 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-03-17 14:06+0000\n"
-"PO-Revision-Date: 2026-03-30 03:00+0000\n"
+"PO-Revision-Date: 2026-03-18 12:23+0000\n"
 "Last-Translator: CVZ-es <damien.bremont@casadevelazquez.org>\n"
 "Language-Team: Spanish <https://translate.pretix.eu/projects/pretix/pretix-"
 "js/es/>\n"
@@ -329,7 +329,7 @@ msgstr "Pedido no aprobado"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:68
 msgid "Checked-in Tickets"
-msgstr "Billetes registrados"
+msgstr "Registro de código QR"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:69
 msgid "Valid Tickets"

src/pretix/locale/wordlist.txt

@@ -12,7 +12,6 @@ anonymized
 Auth
 authentification
 authenticator
-Authenticator
 automatical
 availabilities
 backend
@@ -23,7 +22,6 @@ barcodes
 Bcc
 BCC
 BezahlCode
-biometric
 BLIK
 blocklist
 BN
@@ -58,7 +56,6 @@ EPS
 eps
 favicon
 filetype
-freeOTP
 frontend
 frontpage
 Galician

src/pretix/presale/forms/customer.py

@@ -28,7 +28,7 @@ from django import forms
 from django.conf import settings
 from django.contrib.auth.hashers import check_password
 from django.contrib.auth.password_validation import (
-    MinimumLengthValidator, get_password_validators, validate_password,
+    get_password_validators, password_validators_help_texts, validate_password,
 )
 from django.contrib.auth.tokens import PasswordResetTokenGenerator
 from django.core import signing
@@ -296,17 +296,17 @@ class SetPasswordForm(forms.Form):
     }
     email = forms.EmailField(
         label=_('Email'),
-        widget=forms.EmailInput(attrs={'autocomplete': 'username', 'readonly': 'readonly'}),
-        required=False,
+        disabled=True
     )
     password = forms.CharField(
         label=_('Password'),
-        widget=forms.PasswordInput(attrs={'autocomplete': 'new-password'}),
+        widget=forms.PasswordInput(attrs={'minlength': '8', 'autocomplete': 'new-password'}),
         max_length=4096,
+        required=True
     )
     password_repeat = forms.CharField(
         label=_('Repeat password'),
-        widget=forms.PasswordInput(attrs={'autocomplete': 'new-password'}),
+        widget=forms.PasswordInput(attrs={'minlength': '8', 'autocomplete': 'new-password'}),
         max_length=4096,
     )
 
@@ -316,14 +316,6 @@ class SetPasswordForm(forms.Form):
         kwargs['initial']['email'] = self.customer.email
         super().__init__(*args, **kwargs)
 
-        pw_min_len_validators = [v for v in get_customer_password_validators() if isinstance(v, MinimumLengthValidator)]
-        if pw_min_len_validators:
-            self.fields['password'].widget.attrs['minlength'] = max(v.min_length for v in pw_min_len_validators)
-            self.fields['password_repeat'].widget.attrs['minlength'] = max(v.min_length for v in pw_min_len_validators)
-
-        if 'password' not in self.data:
-            self.fields['password'].help_text = ' '.join(v.get_help_text() for v in pw_min_len_validators)
-
     def clean(self):
         password1 = self.cleaned_data.get('password', '')
         password2 = self.cleaned_data.get('password_repeat')
@@ -337,7 +329,8 @@ class SetPasswordForm(forms.Form):
 
     def clean_password(self):
         password1 = self.cleaned_data.get('password', '')
-        validate_password(password1, user=self.customer, password_validators=get_customer_password_validators())
+        if validate_password(password1, user=self.customer, password_validators=get_customer_password_validators()) is not None:
+            raise forms.ValidationError(_(password_validators_help_texts()), code='pw_invalid')
         return password1
 
 
@@ -402,13 +395,13 @@ class ChangePasswordForm(forms.Form):
     )
     password = forms.CharField(
         label=_('New password'),
-        widget=forms.PasswordInput(attrs={'autocomplete': 'new-password'}),
+        widget=forms.PasswordInput(attrs={'minlength': '8', 'autocomplete': 'new-password'}),
         max_length=4096,
         required=True
     )
     password_repeat = forms.CharField(
         label=_('Repeat password'),
-        widget=forms.PasswordInput(attrs={'autocomplete': 'new-password'}),
+        widget=forms.PasswordInput(attrs={'minlength': '8', 'autocomplete': 'new-password'}),
         max_length=4096,
     )
 
@@ -418,14 +411,6 @@ class ChangePasswordForm(forms.Form):
         kwargs['initial']['email'] = self.customer.email
         super().__init__(*args, **kwargs)
 
-        pw_min_len_validators = [v for v in get_customer_password_validators() if isinstance(v, MinimumLengthValidator)]
-        if pw_min_len_validators:
-            self.fields['password'].widget.attrs['minlength'] = max(v.min_length for v in pw_min_len_validators)
-            self.fields['password_repeat'].widget.attrs['minlength'] = max(v.min_length for v in pw_min_len_validators)
-
-        if 'password' not in self.data:
-            self.fields['password'].help_text = ' '.join(v.get_help_text() for v in pw_min_len_validators)
-
     def clean(self):
         password1 = self.cleaned_data.get('password', '')
         password2 = self.cleaned_data.get('password_repeat')
@@ -439,7 +424,8 @@ class ChangePasswordForm(forms.Form):
 
     def clean_password(self):
         password1 = self.cleaned_data.get('password', '')
-        validate_password(password1, user=self.customer, password_validators=get_customer_password_validators())
+        if validate_password(password1, user=self.customer, password_validators=get_customer_password_validators()) is not None:
+            raise forms.ValidationError(_(password_validators_help_texts()), code='pw_invalid')
         return password1
 
     def clean_password_current(self):

src/pretix/presale/views/__init__.py

@@ -70,21 +70,18 @@ def cached_invoice_address(request):
             # do not create a session, if we don't have a session we also don't have an invoice address ;)
             request._checkout_flow_invoice_address = InvoiceAddress()
             return request._checkout_flow_invoice_address
-        cs = cart_session(request, create=False)
-        if cs is None:
+        cs = cart_session(request)
+        iapk = cs.get('invoice_address')
+        if not iapk:
             request._checkout_flow_invoice_address = InvoiceAddress()
         else:
-            iapk = cs.get('invoice_address')
-            if not iapk:
+            try:
+                with scopes_disabled():
+                    request._checkout_flow_invoice_address = InvoiceAddress.objects.get(
+                        pk=iapk, order__isnull=True
+                    )
+            except InvoiceAddress.DoesNotExist:
                 request._checkout_flow_invoice_address = InvoiceAddress()
-            else:
-                try:
-                    with scopes_disabled():
-                        request._checkout_flow_invoice_address = InvoiceAddress.objects.get(
-                            pk=iapk, order__isnull=True
-                        )
-                except InvoiceAddress.DoesNotExist:
-                    request._checkout_flow_invoice_address = InvoiceAddress()
     return request._checkout_flow_invoice_address
 
 
@@ -114,12 +111,6 @@ class CartMixin:
         return cached_invoice_address(self.request)
 
     def get_cart(self, answers=False, queryset=None, order=None, downloads=False, payments=None):
-        if not self.request.session.session_key and not order:
-            # The user has not even a session ID yet, so they can't have a cart and we can save a lot of work
-            return {
-                'positions': [],
-                # Other keys are not used on non-checkout pages
-            }
         if queryset is not None:
             prefetch = []
             if answers:
@@ -175,8 +166,7 @@ class CartMixin:
         else:
             fees = []
 
-        if not order and lcp:
-            # Do not re-round for empty cart (useless) or confirmed order (incorrect)
+        if not order:
             apply_rounding(self.request.event.settings.tax_rounding, self.invoice_address, self.request.event.currency, [*lcp, *fees])
 
         total = sum([c.price for c in lcp]) + sum([f.value for f in fees])
@@ -287,12 +277,6 @@ class CartMixin:
         }
 
     def current_selected_payments(self, positions, fees, invoice_address, *, warn=False):
-        from pretix.presale.views.cart import get_or_create_cart_id
-
-        if not get_or_create_cart_id(self.request, create=False):
-            # No active cart ID, no payments there
-            return []
-
         raw_payments = copy.deepcopy(self.cart_session.get('payments', []))
         fees = [f for f in fees if f.fee_type != OrderFee.FEE_TYPE_PAYMENT]  # we re-compute these here
 

src/pretix/presale/views/cart.py

@@ -417,7 +417,7 @@ def get_or_create_cart_id(request, create=True):
     return new_id
 
 
-def cart_session(request, create=True):
+def cart_session(request):
     """
     Before pretix 1.8.0, all checkout-related information (like the entered email address) was stored
     in the user's regular session dictionary. This led to data interference and leaks for example if a
@@ -428,9 +428,7 @@ def cart_session(request, create=True):
     active cart session sub-dictionary for read and write access.
     """
     request.session.modified = True
-    cart_id = get_or_create_cart_id(request, create=create)
-    if not cart_id and not create:
-        return None
+    cart_id = get_or_create_cart_id(request)
     return request.session['carts'][cart_id]
 
 

src/pretix/settings.py

@@ -157,7 +157,7 @@ DATABASES = {
         'HOST': config.get('database', 'host', fallback=''),
         'PORT': config.get('database', 'port', fallback=''),
         'CONN_MAX_AGE': 0 if db_backend == 'sqlite3' else 120,
-        'CONN_HEALTH_CHECKS': db_backend != 'sqlite3',
+        'CONN_HEALTH_CHECKS': db_backend != 'sqlite3',  # Will only be used from Django 4.1 onwards
         'DISABLE_SERVER_SIDE_CURSORS': db_disable_server_side_cursors,
         'OPTIONS': db_options,
         'TEST': {}
@@ -179,21 +179,6 @@ if config.has_section('replica'):
     }
     DATABASE_ROUTERS = ['pretix.helpers.database.ReplicaRouter']
 
-if config.has_section('dbreadonly'):
-    DATABASES['readonly'] = {
-        'ENGINE': 'django.db.backends.' + db_backend,
-        'NAME': config.get('dbreadonly', 'name', fallback=DATABASES['default']['NAME']),
-        'USER': config.get('dbreadonly', 'user', fallback=DATABASES['default']['USER']),
-        'PASSWORD': config.get('dbreadonly', 'password', fallback=DATABASES['default']['PASSWORD']),
-        'HOST': config.get('dbreadonly', 'host', fallback=DATABASES['default']['HOST']),
-        'PORT': config.get('dbreadonly', 'port', fallback=DATABASES['default']['PORT']),
-        'CONN_MAX_AGE': 0,  # do not spam primary with open connections as long as readonly is only used occasionally
-        'CONN_HEALTH_CHECKS': db_backend != 'sqlite3',
-        'DISABLE_SERVER_SIDE_CURSORS': db_disable_server_side_cursors,
-        'OPTIONS': db_options,
-        'TEST': {}
-    }
-
 STATIC_URL = config.get('urls', 'static', fallback='/static/')
 
 MEDIA_URL = config.get('urls', 'media', fallback='/media/')

src/tests/api/test_orders.py

@@ -2053,7 +2053,7 @@ def test_pdf_data(token_client, organizer, event, order, django_assert_max_num_q
     assert not resp.data['positions'][0].get('pdf_data')
 
     # order list
-    with django_assert_max_num_queries(34):
+    with django_assert_max_num_queries(33):
         resp = token_client.get('/api/v1/organizers/{}/events/{}/orders/?pdf_data=true'.format(
             organizer.slug, event.slug
         ))
@@ -2068,7 +2068,7 @@ def test_pdf_data(token_client, organizer, event, order, django_assert_max_num_q
     assert not resp.data['results'][0]['positions'][0].get('pdf_data')
 
     # position list
-    with django_assert_max_num_queries(36):
+    with django_assert_max_num_queries(35):
         resp = token_client.get('/api/v1/organizers/{}/events/{}/orderpositions/?pdf_data=true'.format(
             organizer.slug, event.slug
         ))

src/tests/base/test_notifications.py

@@ -24,6 +24,7 @@ from decimal import Decimal
 
 import pytest
 from django.core import mail as djmail
+from django.db import transaction
 from django.utils.timezone import now
 from django_scopes import scope
 
@@ -74,42 +75,47 @@ def user(team):
     return user
 
 
+@pytest.fixture
+def monkeypatch_on_commit(monkeypatch):
+    monkeypatch.setattr("django.db.transaction.on_commit", lambda t: t())
+
+
 @pytest.mark.django_db
-def test_notification_trigger_event_specific(event, order, user, django_capture_on_commit_callbacks):
+def test_notification_trigger_event_specific(event, order, user, monkeypatch_on_commit):
     djmail.outbox = []
     user.notification_settings.create(
         method='mail', event=event, action_type='pretix.event.order.paid', enabled=True
     )
-    with django_capture_on_commit_callbacks(execute=True):
+    with transaction.atomic():
         order.log_action('pretix.event.order.paid', {})
     assert len(djmail.outbox) == 1
     assert djmail.outbox[0].subject.endswith("DUMMY: Order FOO has been marked as paid.")
 
 
 @pytest.mark.django_db
-def test_notification_trigger_global(event, order, user, django_capture_on_commit_callbacks):
+def test_notification_trigger_global(event, order, user, monkeypatch_on_commit):
     djmail.outbox = []
     user.notification_settings.create(
         method='mail', event=None, action_type='pretix.event.order.paid', enabled=True
     )
-    with django_capture_on_commit_callbacks(execute=True):
+    with transaction.atomic():
         order.log_action('pretix.event.order.paid', {})
     assert len(djmail.outbox) == 1
 
 
 @pytest.mark.django_db
-def test_notification_trigger_global_wildcard(event, order, user, django_capture_on_commit_callbacks):
+def test_notification_trigger_global_wildcard(event, order, user, monkeypatch_on_commit):
     djmail.outbox = []
     user.notification_settings.create(
         method='mail', event=None, action_type='pretix.event.order.changed.*', enabled=True
     )
-    with django_capture_on_commit_callbacks(execute=True):
+    with transaction.atomic():
         order.log_action('pretix.event.order.changed.item', {})
     assert len(djmail.outbox) == 1
 
 
 @pytest.mark.django_db
-def test_notification_enabled_global_ignored_specific(event, order, user, django_capture_on_commit_callbacks):
+def test_notification_enabled_global_ignored_specific(event, order, user, monkeypatch_on_commit):
     djmail.outbox = []
     user.notification_settings.create(
         method='mail', event=None, action_type='pretix.event.order.paid', enabled=True
@@ -117,24 +123,24 @@ def test_notification_enabled_global_ignored_specific(event, order, user, django
     user.notification_settings.create(
         method='mail', event=event, action_type='pretix.event.order.paid', enabled=False
     )
-    with django_capture_on_commit_callbacks(execute=True):
+    with transaction.atomic():
         order.log_action('pretix.event.order.paid', {})
     assert len(djmail.outbox) == 0
 
 
 @pytest.mark.django_db
-def test_notification_ignore_same_user(event, order, user, django_capture_on_commit_callbacks):
+def test_notification_ignore_same_user(event, order, user, monkeypatch_on_commit):
     djmail.outbox = []
     user.notification_settings.create(
         method='mail', event=event, action_type='pretix.event.order.paid', enabled=True
     )
-    with django_capture_on_commit_callbacks(execute=True):
+    with transaction.atomic():
         order.log_action('pretix.event.order.paid', {}, user=user)
     assert len(djmail.outbox) == 0
 
 
 @pytest.mark.django_db
-def test_notification_ignore_insufficient_permissions(event, order, user, team, django_capture_on_commit_callbacks):
+def test_notification_ignore_insufficient_permissions(event, order, user, team, monkeypatch_on_commit):
     djmail.outbox = []
     team.all_event_permissions = False
     team.limit_event_permissions = {"event.vouchers:read": True}
@@ -142,7 +148,7 @@ def test_notification_ignore_insufficient_permissions(event, order, user, team,
     user.notification_settings.create(
         method='mail', event=event, action_type='pretix.event.order.paid', enabled=True
     )
-    with django_capture_on_commit_callbacks(execute=True):
+    with transaction.atomic():
         order.log_action('pretix.event.order.paid', {})
     assert len(djmail.outbox) == 0
 

src/tests/base/test_orders.py

@@ -28,9 +28,8 @@ from zoneinfo import ZoneInfo
 import pytest
 from django.conf import settings
 from django.core import mail as djmail
-from django.db import transaction
 from django.db.models import F, Sum
-from django.test import TestCase, TransactionTestCase, override_settings
+from django.test import TestCase, override_settings
 from django.utils.timezone import make_aware, now
 from django_countries.fields import Country
 from django_scopes import scope
@@ -1226,6 +1225,12 @@ class DownloadReminderTests(TestCase):
         assert len(djmail.outbox) == 0
 
 
+@pytest.fixture
+def class_monkeypatch(request, monkeypatch):
+    request.cls.monkeypatch = monkeypatch
+
+
+@pytest.mark.usefixtures("class_monkeypatch")
 class OrderCancelTests(TestCase):
     def setUp(self):
         super().setUp()
@@ -1253,6 +1258,7 @@ class OrderCancelTests(TestCase):
             self.order.create_transactions()
             generate_invoice(self.order)
             djmail.outbox = []
+        self.monkeypatch.setattr("django.db.transaction.on_commit", lambda t: t())
 
     @classscope(attr='o')
     def test_cancel_canceled(self):
@@ -1345,14 +1351,14 @@ class OrderCancelTests(TestCase):
         self.order.status = Order.STATUS_PAID
         self.order.save()
         djmail.outbox = []
-        with self.captureOnCommitCallbacks(execute=True):
-            cancel_order(self.order.pk, send_mail=True)
-
+        cancel_order(self.order.pk, send_mail=True)
+        print([s.subject for s in djmail.outbox])
+        print([s.to for s in djmail.outbox])
         assert len(djmail.outbox) == 2
-        assert ["dummy@dummy.test"] == djmail.outbox[0].to
-        assert not any(["Invoice_" in a[0] for a in djmail.outbox[0].attachments])
-        assert ["invoice@example.org"] == djmail.outbox[1].to
-        assert any(["Invoice_" in a[0] for a in djmail.outbox[1].attachments])
+        assert ["invoice@example.org"] == djmail.outbox[0].to
+        assert any(["Invoice_" in a[0] for a in djmail.outbox[0].attachments])
+        assert ["dummy@dummy.test"] == djmail.outbox[1].to
+        assert not any(["Invoice_" in a[0] for a in djmail.outbox[1].attachments])
 
     @classscope(attr='o')
     def test_cancel_paid_with_too_high_fee(self):
@@ -1482,7 +1488,8 @@ class OrderCancelTests(TestCase):
         assert self.order.all_logentries().filter(action_type='pretix.event.order.refund.requested').exists()
 
 
-class BaseOrderChangeManagerTestCase:
+@pytest.mark.usefixtures("class_monkeypatch")
+class OrderChangeManagerTests(TestCase):
     def setUp(self):
         super().setUp()
         self.o = Organizer.objects.create(name='Dummy', slug='dummy', plugins='pretix.plugins.banktransfer')
@@ -1545,6 +1552,7 @@ class BaseOrderChangeManagerTestCase:
             self.seat_a1 = self.event.seats.create(seat_number="A1", product=self.stalls, seat_guid="A1")
             self.seat_a2 = self.event.seats.create(seat_number="A2", product=self.stalls, seat_guid="A2")
             self.seat_a3 = self.event.seats.create(seat_number="A3", product=self.stalls, seat_guid="A3")
+        self.monkeypatch.setattr("django.db.transaction.on_commit", lambda t: t())
 
     def _enable_reverse_charge(self):
         self.tr7.eu_reverse_charge = True
@@ -1558,8 +1566,6 @@ class BaseOrderChangeManagerTestCase:
             country=Country('AT')
         )
 
-
-class OrderChangeManagerTests(BaseOrderChangeManagerTestCase, TestCase):
     @classscope(attr='o')
     def test_multiple_commits_forbidden(self):
         self.ocm.change_price(self.op1, Decimal('10.00'))
@@ -2400,15 +2406,6 @@ class OrderChangeManagerTests(BaseOrderChangeManagerTestCase, TestCase):
             self.ocm.commit()
         assert self.order.positions.count() == 2
 
-    @classscope(attr='o')
-    def test_add_item_quota_partial(self):
-        q1 = self.event.quotas.create(name='Test', size=1)
-        q1.items.add(self.shirt)
-        self.ocm.add_position(self.shirt, None, None, None, count=2)
-        with self.assertRaises(OrderError):
-            self.ocm.commit()
-        assert self.order.positions.count() == 2
-
     @classscope(attr='o')
     def test_add_item_addon(self):
         self.shirt.category = self.event.categories.create(name='Add-ons', is_addon=True)
@@ -3898,16 +3895,15 @@ class OrderChangeManagerTests(BaseOrderChangeManagerTestCase, TestCase):
 
     @classscope(attr='o')
     def test_set_valid_until(self):
-        with transaction.atomic():
-            self.event.settings.ticket_secret_generator = "pretix_sig1"
-            assign_ticket_secret(self.event, self.op1, force_invalidate=True, save=True)
-            old_secret = self.op1.secret
+        self.event.settings.ticket_secret_generator = "pretix_sig1"
+        assign_ticket_secret(self.event, self.op1, force_invalidate=True, save=True)
+        old_secret = self.op1.secret
 
-            dt = make_aware(datetime(2022, 9, 20, 15, 0, 0, 0))
-            self.ocm.change_valid_until(self.op1, dt)
-            self.ocm.commit()
-            self.op1.refresh_from_db()
-            assert self.op1.secret != old_secret
+        dt = make_aware(datetime(2022, 9, 20, 15, 0, 0, 0))
+        self.ocm.change_valid_until(self.op1, dt)
+        self.ocm.commit()
+        self.op1.refresh_from_db()
+        assert self.op1.secret != old_secret
 
     @classscope(attr='o')
     def test_unset_valid_from_until(self):
@@ -3932,8 +3928,6 @@ class OrderChangeManagerTests(BaseOrderChangeManagerTestCase, TestCase):
         assert len(djmail.outbox) == 1
         assert len(["Invoice_" in a[0] for a in djmail.outbox[0].attachments]) == 2
 
-
-class OrderChangeManagerTransactionalTests(BaseOrderChangeManagerTestCase, TransactionTestCase):
     @classscope(attr='o')
     def test_new_invoice_send_somewhere_else(self):
         generate_invoice(self.order)

src/tests/base/test_webhooks.py

@@ -25,6 +25,7 @@ from decimal import Decimal
 
 import pytest
 import responses
+from django.db import transaction
 from django.utils.timezone import now
 from django_scopes import scopes_disabled
 
@@ -81,9 +82,14 @@ def force_str(v):
     return v.decode() if isinstance(v, bytes) else str(v)
 
 
+@pytest.fixture
+def monkeypatch_on_commit(monkeypatch):
+    monkeypatch.setattr("django.db.transaction.on_commit", lambda t: t())
+
+
 @pytest.mark.django_db
 @responses.activate
-def test_webhook_trigger_event_specific(event, order, webhook, django_capture_on_commit_callbacks):
+def test_webhook_trigger_event_specific(event, order, webhook, monkeypatch_on_commit):
     responses.add_callback(
         responses.POST, 'https://google.com',
         callback=lambda r: (200, {}, 'ok'),
@@ -91,7 +97,7 @@ def test_webhook_trigger_event_specific(event, order, webhook, django_capture_on
         match_querystring=None,  # https://github.com/getsentry/responses/issues/464
     )
 
-    with django_capture_on_commit_callbacks(execute=True):
+    with transaction.atomic():
         le = order.log_action('pretix.event.order.paid', {})
     assert len(responses.calls) == 1
     assert json.loads(force_str(responses.calls[0].request.body)) == {
@@ -113,12 +119,12 @@ def test_webhook_trigger_event_specific(event, order, webhook, django_capture_on
 
 @pytest.mark.django_db
 @responses.activate
-def test_webhook_trigger_global(event, order, webhook, django_capture_on_commit_callbacks):
+def test_webhook_trigger_global(event, order, webhook, monkeypatch_on_commit):
     webhook.limit_events.clear()
     webhook.all_events = True
     webhook.save()
     responses.add(responses.POST, 'https://google.com', status=200)
-    with django_capture_on_commit_callbacks(execute=True):
+    with transaction.atomic():
         le = order.log_action('pretix.event.order.paid', {})
     assert len(responses.calls) == 1
     assert json.loads(force_str(responses.calls[0].request.body)) == {
@@ -132,13 +138,13 @@ def test_webhook_trigger_global(event, order, webhook, django_capture_on_commit_
 
 @pytest.mark.django_db
 @responses.activate
-def test_webhook_trigger_global_wildcard(event, order, webhook, django_capture_on_commit_callbacks):
+def test_webhook_trigger_global_wildcard(event, order, webhook, monkeypatch_on_commit):
     webhook.listeners.create(action_type="pretix.event.order.changed.*")
     webhook.limit_events.clear()
     webhook.all_events = True
     webhook.save()
     responses.add(responses.POST, 'https://google.com', status=200)
-    with django_capture_on_commit_callbacks(execute=True):
+    with transaction.atomic():
         le = order.log_action('pretix.event.order.changed.item', {})
     assert len(responses.calls) == 1
     assert json.loads(force_str(responses.calls[0].request.body)) == {
@@ -152,30 +158,30 @@ def test_webhook_trigger_global_wildcard(event, order, webhook, django_capture_o
 
 @pytest.mark.django_db
 @responses.activate
-def test_webhook_ignore_wrong_action_type(event, order, webhook, django_capture_on_commit_callbacks):
+def test_webhook_ignore_wrong_action_type(event, order, webhook, monkeypatch_on_commit):
     responses.add(responses.POST, 'https://google.com', status=200)
-    with django_capture_on_commit_callbacks(execute=True):
+    with transaction.atomic():
         order.log_action('pretix.event.order.changed.item', {})
     assert len(responses.calls) == 0
 
 
 @pytest.mark.django_db
 @responses.activate
-def test_webhook_ignore_disabled(event, order, webhook, django_capture_on_commit_callbacks):
+def test_webhook_ignore_disabled(event, order, webhook, monkeypatch_on_commit):
     webhook.enabled = False
     webhook.save()
     responses.add(responses.POST, 'https://google.com', status=200)
-    with django_capture_on_commit_callbacks(execute=True):
+    with transaction.atomic():
         order.log_action('pretix.event.order.changed.item', {})
     assert len(responses.calls) == 0
 
 
 @pytest.mark.django_db
 @responses.activate
-def test_webhook_ignore_wrong_event(event, order, webhook, django_capture_on_commit_callbacks):
+def test_webhook_ignore_wrong_event(event, order, webhook, monkeypatch_on_commit):
     webhook.limit_events.clear()
     responses.add(responses.POST, 'https://google.com', status=200)
-    with django_capture_on_commit_callbacks(execute=True):
+    with transaction.atomic():
         order.log_action('pretix.event.order.changed.item', {})
     assert len(responses.calls) == 0
 
@@ -183,10 +189,10 @@ def test_webhook_ignore_wrong_event(event, order, webhook, django_capture_on_com
 @pytest.mark.django_db
 @pytest.mark.xfail(reason="retries can't be tested with celery_always_eager")
 @responses.activate
-def test_webhook_retry(event, order, webhook, django_capture_on_commit_callbacks):
+def test_webhook_retry(event, order, webhook, monkeypatch_on_commit):
     responses.add(responses.POST, 'https://google.com', status=500)
     responses.add(responses.POST, 'https://google.com', status=200)
-    with django_capture_on_commit_callbacks(execute=True):
+    with transaction.atomic():
         order.log_action('pretix.event.order.paid', {})
     assert len(responses.calls) == 2
     with scopes_disabled():
@@ -210,9 +216,9 @@ def test_webhook_retry(event, order, webhook, django_capture_on_commit_callbacks
 
 @pytest.mark.django_db
 @responses.activate
-def test_webhook_disable_gone(event, order, webhook, django_capture_on_commit_callbacks):
+def test_webhook_disable_gone(event, order, webhook, monkeypatch_on_commit):
     responses.add(responses.POST, 'https://google.com', status=410)
-    with django_capture_on_commit_callbacks(execute=True):
+    with transaction.atomic():
         order.log_action('pretix.event.order.paid', {})
     assert len(responses.calls) == 1
     webhook.refresh_from_db()

src/tests/conftest.py

@@ -131,8 +131,3 @@ def set_lock_namespaces(request):
             yield
     else:
         yield
-
-
-@pytest.fixture
-def class_monkeypatch(request, monkeypatch):
-    request.cls.monkeypatch = monkeypatch

src/tests/control/test_auth.py

@@ -385,6 +385,11 @@ class RegistrationFormTest(TestCase):
         self.assertEqual(response.status_code, 403)
 
 
+@pytest.fixture
+def class_monkeypatch(request, monkeypatch):
+    request.cls.monkeypatch = monkeypatch
+
+
 @pytest.mark.usefixtures("class_monkeypatch")
 class Login2FAFormTest(TestCase):
 

src/tests/control/test_events.py

@@ -49,6 +49,11 @@ from tests.base import SoupTest, extract_form_fields
 from pretix.base.models import Event, LogEntry, Order, Organizer, Team, User
 
 
+@pytest.fixture
+def class_monkeypatch(request, monkeypatch):
+    request.cls.monkeypatch = monkeypatch
+
+
 @pytest.mark.usefixtures("class_monkeypatch")
 class EventsTest(SoupTest):
     @scopes_disabled()

src/tests/control/test_orders.py

@@ -1584,11 +1584,10 @@ class OrderChangeTests(SoupTest):
             'add_position-MAX_NUM_FORMS': '100',
             'add_position-0-itemvar': str(self.shirt.pk),
             'add_position-0-do': 'on',
-            'add_position-0-count': '2',
             'add_position-0-price': '14.00',
         })
         with scopes_disabled():
-            assert self.order.positions.count() == 4
+            assert self.order.positions.count() == 3
             assert self.order.positions.last().item == self.shirt
             assert self.order.positions.last().price == 14
 

src/tests/control/test_organizer.py

@@ -33,6 +33,11 @@ from tests.base import SoupTest, extract_form_fields
 from pretix.base.models import Event, Organizer, OutgoingMail, Team, User
 
 
+@pytest.fixture
+def class_monkeypatch(request, monkeypatch):
+    request.cls.monkeypatch = monkeypatch
+
+
 @pytest.mark.usefixtures("class_monkeypatch")
 class OrganizerTest(SoupTest):
     @scopes_disabled()

src/tests/control/test_user.py

@@ -286,6 +286,11 @@ class UserPasswordChangeTest(SoupTest):
         assert self.user.needs_password_change is False
 
 
+@pytest.fixture
+def class_monkeypatch(request, monkeypatch):
+    request.cls.monkeypatch = monkeypatch
+
+
 @pytest.mark.usefixtures("class_monkeypatch")
 class UserSettings2FATest(SoupTest):
     def setUp(self):

src/tests/control/test_vouchers.py

@@ -35,6 +35,7 @@
 import datetime
 import decimal
 import json
+from decimal import Decimal
 
 from django.core import mail as djmail
 from django.test import TransactionTestCase
@@ -43,8 +44,8 @@ from django_scopes import scopes_disabled
 from tests.base import SoupTestMixin, extract_form_fields
 
 from pretix.base.models import (
-    Event, Item, ItemVariation, Order, OrderPosition, Organizer, Quota, Team,
-    User, Voucher,
+    Event, Item, ItemVariation, Order, OrderPosition, Organizer, Quota,
+    SeatingPlan, Team, User, Voucher,
 )
 
 
@@ -134,49 +135,49 @@ class VoucherFormTest(SoupTestMixin, TransactionTestCase):
     def test_filter_status_valid(self):
         with scopes_disabled():
             v = self.event.vouchers.create(item=self.ticket)
-        doc = self.client.get('/control/event/%s/%s/vouchers/?status=v' % (self.orga.slug, self.event.slug))
+        doc = self.client.get('/control/event/%s/%s/vouchers/?filter-status=v' % (self.orga.slug, self.event.slug))
         assert v.code in doc.content.decode()
         v.redeemed = 1
         v.save()
-        doc = self.client.get('/control/event/%s/%s/vouchers/?status=v' % (self.orga.slug, self.event.slug))
+        doc = self.client.get('/control/event/%s/%s/vouchers/?filter-status=v' % (self.orga.slug, self.event.slug))
         assert v.code not in doc.content.decode()
 
     def test_filter_status_redeemed(self):
         with scopes_disabled():
             v = self.event.vouchers.create(item=self.ticket, redeemed=1)
-        doc = self.client.get('/control/event/%s/%s/vouchers/?status=r' % (self.orga.slug, self.event.slug))
+        doc = self.client.get('/control/event/%s/%s/vouchers/?filter-status=r' % (self.orga.slug, self.event.slug))
         assert v.code in doc.content.decode()
         v.redeemed = 0
         v.save()
-        doc = self.client.get('/control/event/%s/%s/vouchers/?status=r' % (self.orga.slug, self.event.slug))
+        doc = self.client.get('/control/event/%s/%s/vouchers/?filter-status=r' % (self.orga.slug, self.event.slug))
         assert v.code not in doc.content.decode()
 
     def test_filter_status_expired(self):
         with scopes_disabled():
             v = self.event.vouchers.create(item=self.ticket, valid_until=now() + datetime.timedelta(days=1))
-        doc = self.client.get('/control/event/%s/%s/vouchers/?status=e' % (self.orga.slug, self.event.slug))
+        doc = self.client.get('/control/event/%s/%s/vouchers/?filter-status=e' % (self.orga.slug, self.event.slug))
         assert v.code not in doc.content.decode()
         v.valid_until = now() - datetime.timedelta(days=1)
         v.save()
-        doc = self.client.get('/control/event/%s/%s/vouchers/?status=e' % (self.orga.slug, self.event.slug))
+        doc = self.client.get('/control/event/%s/%s/vouchers/?filter-status=e' % (self.orga.slug, self.event.slug))
         assert v.code in doc.content.decode()
 
     def test_filter_tag(self):
         with scopes_disabled():
             self.event.vouchers.create(item=self.ticket, code='ABCDEFG', comment='Foo', tag='bar')
-        doc = self.client.get('/control/event/%s/%s/vouchers/?tag=bar' % (self.orga.slug, self.event.slug))
+        doc = self.client.get('/control/event/%s/%s/vouchers/?filter-tag=bar' % (self.orga.slug, self.event.slug))
         assert 'ABCDEFG' in doc.content.decode()
-        doc = self.client.get('/control/event/%s/%s/vouchers/?tag=baz' % (self.orga.slug, self.event.slug))
+        doc = self.client.get('/control/event/%s/%s/vouchers/?filter-tag=baz' % (self.orga.slug, self.event.slug))
         assert 'ABCDEFG' not in doc.content.decode()
 
     def test_search_code(self):
         with scopes_disabled():
             self.event.vouchers.create(item=self.ticket, code='ABCDEFG', comment='Foo')
-        doc = self.client.get('/control/event/%s/%s/vouchers/?search=ABCDEFG' % (self.orga.slug, self.event.slug))
+        doc = self.client.get('/control/event/%s/%s/vouchers/?filter-search=ABCDEFG' % (self.orga.slug, self.event.slug))
         assert 'ABCDEFG' in doc.content.decode()
-        doc = self.client.get('/control/event/%s/%s/vouchers/?search=Foo' % (self.orga.slug, self.event.slug))
+        doc = self.client.get('/control/event/%s/%s/vouchers/?filter-search=Foo' % (self.orga.slug, self.event.slug))
         assert 'ABCDEFG' in doc.content.decode()
-        doc = self.client.get('/control/event/%s/%s/vouchers/?search=12345' % (self.orga.slug, self.event.slug))
+        doc = self.client.get('/control/event/%s/%s/vouchers/?filter-search=12345' % (self.orga.slug, self.event.slug))
         assert 'ABCDEFG' not in doc.content.decode()
 
     def test_bulk_rng(self):
@@ -771,3 +772,426 @@ class VoucherFormTest(SoupTestMixin, TransactionTestCase):
 
         assert len(doc.select('.alert-warning ul li')) == 1  # Check that there's exactly 1 item in the warning list
         assert doc.text.count('Order DEDUP') == 1  # Check that the order is listed exactly once
+
+
+class VoucherBulkEditFormTest(SoupTestMixin, TransactionTestCase):
+    @scopes_disabled()
+    def setUp(self):
+        super().setUp()
+        self.user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
+        self.orga = Organizer.objects.create(name='CCC', slug='ccc')
+        self.event = Event.objects.create(
+            organizer=self.orga, name='30C3', slug='30c3',
+            date_from=datetime.datetime(2013, 12, 26, tzinfo=datetime.timezone.utc),
+        )
+        t = Team.objects.create(organizer=self.orga, all_event_permissions=True)
+        t.members.add(self.user)
+        t.limit_events.add(self.event)
+        self.client.login(email='dummy@dummy.dummy', password='dummy')
+
+        self.quota_shirts = Quota.objects.create(event=self.event, name='Shirts', size=2)
+        self.shirt = Item.objects.create(event=self.event, name='T-Shirt', default_price=12)
+        self.quota_shirts.items.add(self.shirt)
+        self.shirt_red = ItemVariation.objects.create(item=self.shirt, default_price=14, value='Red')
+        self.shirt_blue = ItemVariation.objects.create(item=self.shirt, value='Blue')
+        self.quota_shirts.variations.add(self.shirt_red)
+        self.quota_shirts.variations.add(self.shirt_blue)
+
+        self.quota_tickets = Quota.objects.create(event=self.event, name='Tickets', size=2)
+        self.ticket = Item.objects.create(event=self.event, name='Early-bird ticket',
+                                          default_price=23)
+        self.quota_tickets.items.add(self.ticket)
+        self.url = f'/control/event/{self.orga.slug}/{self.event.slug}/vouchers/bulk_edit'
+
+    def test_simple_edit(self):
+        with scopes_disabled():
+            self.event.vouchers.create(
+                quota=self.quota_tickets,
+                max_usages=10,
+                price_mode="set",
+                value=13,
+            )
+            self.event.vouchers.create(
+                item=self.ticket,
+                max_usages=10,
+                price_mode="set",
+                value=12,
+            )
+
+        doc = self.post_doc(self.url, {
+            '__ALL': 'on',
+        }, follow=True)
+        fields = extract_form_fields(doc)
+        assert fields.get('bulkedit-max_usages') == '10'
+        assert fields.get('bulkedit-price_mode') == 'set'
+        assert not fields.get('bulkedit-value')
+        fields.update({
+            '_bulk': ['bulkedit__price', 'bulkeditmin_usages', 'bulkedittag', 'bulkeditshow_hidden_items'],
+            'bulkedit-price_mode': 'percent',
+            'bulkedit-value': '15',
+            'bulkedit-min_usages': '3',
+            'bulkedit-tag': 'tagged',
+            'bulkedit-comment': 'This is a comment',  # will be ignored, as not included in _bulk
+            'bulkedit-show_hidden_items': '',
+        })
+        doc = self.post_doc(self.url, fields, follow=True)
+        assert doc.select(".alert-success")
+        with scopes_disabled():
+            for v in self.event.vouchers.all():
+                assert v.price_mode == "percent"
+                assert v.value == Decimal("15.00")
+                assert v.min_usages == 3
+                assert v.tag == "tagged"
+                assert v.comment == ""
+                assert v.show_hidden_items is False
+
+    def _update_all(self, data: dict, expect_error: str=None):
+        doc = self.post_doc(self.url, {
+            '__ALL': 'on',
+        }, follow=True)
+        fields = extract_form_fields(doc)
+        fields.update(data)
+        doc = self.post_doc(self.url, fields, follow=True)
+        error_texts = [el.text for el in doc.select(".alert-danger, .has-error")]
+        if expect_error:
+            assert doc.select(".alert-danger")
+            assert any(expect_error in t for t in error_texts), error_texts
+        else:
+            assert doc.select(".alert-success"), error_texts
+
+    def test_change_itemvar_to_product(self):
+        with scopes_disabled():
+            self.event.vouchers.create(quota=self.quota_tickets)
+            self.event.vouchers.create(item=self.ticket)
+
+        self._update_all({
+            '_bulk': ['bulkedititemvar'],
+            'bulkedit-itemvar': f'{self.ticket.pk}',
+        })
+        with scopes_disabled():
+            for v in self.event.vouchers.all():
+                assert v.item == self.ticket
+                assert not v.variation
+                assert not v.quota
+
+    def test_change_itemvar_to_variation(self):
+        with scopes_disabled():
+            self.event.vouchers.create(quota=self.quota_tickets)
+            self.event.vouchers.create(item=self.ticket)
+
+        self._update_all({
+            '_bulk': ['bulkedititemvar'],
+            'bulkedit-itemvar': f'{self.shirt.pk}-{self.shirt_red.pk}',
+        })
+        with scopes_disabled():
+            for v in self.event.vouchers.all():
+                assert v.item == self.shirt
+                assert v.variation == self.shirt_red
+                assert not v.quota
+
+    def test_change_itemvar_to_quota(self):
+        with scopes_disabled():
+            self.event.vouchers.create(quota=self.quota_tickets)
+            self.event.vouchers.create(item=self.ticket)
+
+        self._update_all({
+            '_bulk': ['bulkedititemvar'],
+            'bulkedit-itemvar': f'q-{self.quota_tickets.pk}',
+        })
+        with scopes_disabled():
+            for v in self.event.vouchers.all():
+                assert not v.item
+                assert not v.variation
+                assert v.quota == self.quota_tickets
+
+    def test_change_itemvar_to_all(self):
+        with scopes_disabled():
+            self.event.vouchers.create(quota=self.quota_tickets)
+            self.event.vouchers.create(item=self.ticket)
+
+        self._update_all({
+            '_bulk': ['bulkedititemvar'],
+            'bulkedit-itemvar': '',
+        })
+        with scopes_disabled():
+            for v in self.event.vouchers.all():
+                assert not v.item
+                assert not v.variation
+                assert not v.quota
+
+    def test_change_max_usages(self):
+        with scopes_disabled():
+            self.event.vouchers.create(quota=self.quota_tickets, max_usages=15, redeemed=4)
+            self.event.vouchers.create(item=self.ticket, max_usages=15, redeemed=2)
+
+        self._update_all({
+            '_bulk': ['bulkeditmax_usages'],
+            'bulkedit-max_usages': '3',
+        }, expect_error="already been redeemed 4 times")
+        self._update_all({
+            '_bulk': ['bulkeditmax_usages'],
+            'bulkedit-max_usages': '4',
+        })
+        with scopes_disabled():
+            for v in self.event.vouchers.all():
+                assert v.max_usages == 4
+
+    def _requires_one_more_quota(self, data: dict, quota=None):
+        self._update_all(data, expect_error="no sufficient quota")
+        quota = quota or self.quota_tickets
+        quota.size += 1
+        quota.save()
+        self._update_all(data)
+
+    def test_quota_check_change_item(self):
+        with scopes_disabled():
+            self.event.vouchers.create(item=self.shirt, block_quota=True, max_usages=2, redeemed=1)
+            self.event.vouchers.create(item=self.shirt, block_quota=True, max_usages=3, redeemed=1)
+        self._requires_one_more_quota({
+            '_bulk': ['bulkedititemvar'],
+            'bulkedit-itemvar': f'{self.ticket.pk}',
+        })
+        with scopes_disabled():
+            for v in self.event.vouchers.all():
+                assert v.item == self.ticket
+
+    def test_quota_check_change_variation(self):
+        with scopes_disabled():
+            self.event.vouchers.create(item=self.ticket, block_quota=True, max_usages=2, redeemed=1)
+            self.event.vouchers.create(item=self.ticket, block_quota=True, max_usages=3, redeemed=1)
+        self._requires_one_more_quota({
+            '_bulk': ['bulkedititemvar'],
+            'bulkedit-itemvar': f'{self.shirt.pk}-{self.shirt_red.pk}',
+        }, quota=self.quota_shirts)
+        with scopes_disabled():
+            for v in self.event.vouchers.all():
+                assert v.item == self.shirt
+                assert v.variation == self.shirt_red
+
+    def test_quota_check_change_item_with_variations(self):
+        with scopes_disabled():
+            self.event.vouchers.create(item=self.ticket, block_quota=True, max_usages=2, redeemed=1)
+            self.event.vouchers.create(item=self.ticket, block_quota=True, max_usages=3, redeemed=1)
+        self._requires_one_more_quota({
+            '_bulk': ['bulkedititemvar'],
+            'bulkedit-itemvar': f'{self.shirt.pk}',
+        }, quota=self.quota_shirts)
+        with scopes_disabled():
+            for v in self.event.vouchers.all():
+                assert v.item == self.shirt
+                assert not v.variation
+
+    def test_quota_check_change_expired_to_valid(self):
+        with scopes_disabled():
+            self.event.vouchers.create(item=self.ticket, block_quota=True, max_usages=2)
+            self.event.vouchers.create(item=self.ticket, block_quota=True, max_usages=1, valid_until=now() - datetime.timedelta(days=1))
+        self._requires_one_more_quota({
+            '_bulk': ['bulkeditvalid_until'],
+            'bulkedit-valid_until_0': '',
+            'bulkedit-valid_until_1': '',
+        })
+        with scopes_disabled():
+            for v in self.event.vouchers.all():
+                assert not v.valid_until
+
+    def test_quota_check_change_max_usages(self):
+        with scopes_disabled():
+            self.event.vouchers.create(item=self.ticket, block_quota=True, max_usages=2)
+            self.event.vouchers.create(item=self.ticket, block_quota=True, max_usages=1, redeemed=1)
+        self._requires_one_more_quota({
+            '_bulk': ['bulkeditmax_usages'],
+            'bulkedit-max_usages': '2',
+        })
+        with scopes_disabled():
+            for v in self.event.vouchers.all():
+                assert v.max_usages == 2
+
+    def test_quota_check_no_change(self):
+        with scopes_disabled():
+            # Technically overbooked, but we don't have a diff in quota
+            self.event.vouchers.create(item=self.shirt, variation=self.shirt_red, block_quota=True)
+            self.event.vouchers.create(item=self.shirt, variation=self.shirt_red, block_quota=True)
+            self.event.vouchers.create(item=self.shirt, variation=self.shirt_red, block_quota=True)
+        self._update_all({
+            '_bulk': ['bulkedititemvar'],
+            'bulkedit-itemvar': f'{self.shirt.pk}-{self.shirt_blue.pk}',
+        })
+        with scopes_disabled():
+            for v in self.event.vouchers.all():
+                assert v.variation == self.shirt_blue
+
+    def test_quota_check_change_subevent(self):
+        with scopes_disabled():
+            self.event.has_subevents = True
+            self.event.save()
+            se1 = self.event.subevents.create(name="Foo", date_from=now())
+            se2 = self.event.subevents.create(name="Bar", date_from=now())
+            self.quota_tickets.subevent = se1
+            self.quota_tickets.save()
+            Quota.objects.create(event=self.event, subevent=se2, name='Tickets', size=3)
+            self.event.vouchers.create(item=self.ticket, block_quota=True, subevent=se2)
+            self.event.vouchers.create(item=self.ticket, block_quota=True, subevent=se2)
+            self.event.vouchers.create(item=self.ticket, block_quota=True, subevent=se2)
+        self._requires_one_more_quota({
+            '_bulk': ['bulkeditsubevent'],
+            'bulkedit-subevent': f'{se1.pk}',
+        })
+        with scopes_disabled():
+            for v in self.event.vouchers.all():
+                assert v.subevent == se1
+
+    def test_change_subevent_quota_invalid(self):
+        with scopes_disabled():
+            self.event.has_subevents = True
+            self.event.save()
+            se1 = self.event.subevents.create(name="Foo", date_from=now())
+            se2 = self.event.subevents.create(name="Bar", date_from=now())
+            self.quota_tickets.subevent = se1
+            self.quota_tickets.save()
+            v1 = self.event.vouchers.create(quota=self.quota_tickets, block_quota=True, subevent=se1)
+        self._update_all({
+            '_bulk': ['bulkeditsubevent'],
+            'bulkedit-subevent': f'{se2.pk}',
+        }, expect_error="selected quota does not match the selected subevent")
+        self._update_all({
+            '_bulk': ['bulkeditsubevent'],
+            'bulkedit-subevent': '',
+        }, expect_error="has no date selected")
+        v1.quota = None
+        v1.item = self.ticket
+        v1.save()
+        self._update_all({
+            '_bulk': ['bulkeditsubevent'],
+            'bulkedit-subevent': '',
+        }, expect_error="If you want this voucher to block quota, you need to select a specific date")
+        with scopes_disabled():
+            for v in self.event.vouchers.all():
+                assert v.subevent == se1
+
+    def test_change_missing_itemvar_with_block_quota(self):
+        with scopes_disabled():
+            self.event.vouchers.create(quota=self.quota_tickets, block_quota=True)
+            self.event.vouchers.create(quota=self.quota_tickets, block_quota=True)
+        self._update_all({
+            '_bulk': ['bulkedititemvar'],
+            'bulkedit-itemvar': '',
+        }, expect_error="You need to select a specific product or quota if this voucher should reserve")
+        self._update_all({
+            '_bulk': ['bulkedititemvar', 'bulkeditblock_quota'],
+            'bulkedit-itemvar': '',
+            'bulkedit-block_quota': '',
+        })
+        with scopes_disabled():
+            for v in self.event.vouchers.all():
+                assert not v.subevent
+                assert not v.block_quota
+
+    def test_change_subevent_and_quota(self):
+        with scopes_disabled():
+            self.event.has_subevents = True
+            self.event.save()
+            se1 = self.event.subevents.create(name="Foo", date_from=now())
+            se2 = self.event.subevents.create(name="Bar", date_from=now())
+            self.quota_tickets.subevent = se1
+            self.quota_tickets.save()
+            q2 = Quota.objects.create(event=self.event, subevent=se2, name='Tickets', size=3)
+            self.event.vouchers.create(quota=self.quota_tickets, block_quota=True, subevent=se1)
+        self._update_all({
+            '_bulk': ['bulkedititemvar', 'bulkeditsubevent'],
+            'bulkedit-subevent': f'{se2.pk}',
+            'bulkedit-itemvar': f'q-{q2.pk}',
+        })
+        with scopes_disabled():
+            for v in self.event.vouchers.all():
+                assert v.subevent == se2
+                assert v.quota == q2
+
+    def test_quota_check_change_block_quota(self):
+        with scopes_disabled():
+            self.event.vouchers.create(item=self.ticket, max_usages=3)
+        self._requires_one_more_quota({
+            '_bulk': ['bulkeditblock_quota'],
+            'bulkedit-block_quota': 'on',
+        })
+        with scopes_disabled():
+            for v in self.event.vouchers.all():
+                assert v.block_quota
+
+    def test_ignore_quota(self):
+        with scopes_disabled():
+            self.event.vouchers.create(item=self.ticket, max_usages=3)
+        self._update_all({
+            '_bulk': ['bulkeditblock_quota', 'bulkeditallow_ignore_quota'],
+            'bulkedit-block_quota': 'on',
+            'bulkedit-allow_ignore_quota': 'on',
+        })
+        with scopes_disabled():
+            for v in self.event.vouchers.all():
+                assert v.block_quota
+                assert v.allow_ignore_quota
+
+    @scopes_disabled()
+    def _create_seat(self, **kwargs):
+        plan = SeatingPlan.objects.create(
+            name="Plan", organizer=self.orga, layout="{}"
+        )
+        self.event.seating_plan = plan
+        self.event.save()
+        return self.event.seats.create(seat_number="A1", product=self.ticket, seat_guid="A1", **kwargs)
+
+    def test_seated_unsupported(self):
+        with scopes_disabled():
+            self.event.vouchers.create(item=self.ticket, max_usages=1, seat=self._create_seat())
+        self._update_all({
+            '_bulk': ['bulkeditmax_usages'],
+            'bulkedit-max_usages': '2',
+        }, expect_error="Changing the maximum number of usages in bulk is not supported")
+        self._update_all({
+            '_bulk': ['bulkeditsubevent'],
+            'bulkedit-subevent': '',
+        }, expect_error="Changing the date in bulk is not supported")
+        self._update_all({
+            '_bulk': ['bulkedititemvar'],
+            'bulkedit-itemvar': f'q-{self.quota_tickets.pk}',
+        }, expect_error="Changing the product to a quota is not supported")
+
+    def test_seat_changed_to_valid_needs_to_be_available(self):
+        with scopes_disabled():
+            seat = self._create_seat(blocked=True)
+            self.event.vouchers.create(item=self.ticket, max_usages=1, valid_until=now() - datetime.timedelta(days=1), seat=seat)
+
+        self._update_all({
+            '_bulk': ['bulkeditvalid_until'],
+            'bulkedit-valid_until_0': '',
+            'bulkedit-valid_until_1': '',
+        }, expect_error="not all assigned seats of the vouchers are still available")
+
+        seat.blocked = False
+        seat.save()
+        self._update_all({
+            '_bulk': ['bulkeditvalid_until'],
+            'bulkedit-valid_until_0': '',
+            'bulkedit-valid_until_1': '',
+        })
+
+    def test_seat_changed_to_valid_needs_to_be_available_subevents(self):
+        with scopes_disabled():
+            self.event.has_subevents = True
+            self.event.save()
+            se1 = self.event.subevents.create(name="Foo", date_from=now())
+            seat = self._create_seat(subevent=se1, blocked=True)
+            self.event.vouchers.create(item=self.ticket, max_usages=1, valid_until=now() - datetime.timedelta(days=1), seat=seat, subevent=se1)
+
+        self._update_all({
+            '_bulk': ['bulkeditvalid_until'],
+            'bulkedit-valid_until_0': '',
+            'bulkedit-valid_until_1': '',
+        }, expect_error="not all assigned seats of the vouchers are still available")
+
+        seat.blocked = False
+        seat.save()
+        self._update_all({
+            '_bulk': ['bulkeditvalid_until'],
+            'bulkedit-valid_until_0': '',
+            'bulkedit-valid_until_1': '',
+        })

src/tests/presale/test_checkout.py

@@ -33,7 +33,7 @@ from django.conf import settings
 from django.core import mail as djmail
 from django.core.files.uploadedfile import SimpleUploadedFile
 from django.core.signing import dumps
-from django.test import TestCase, TransactionTestCase
+from django.test import TestCase
 from django.utils.crypto import get_random_string
 from django.utils.timezone import now
 from django_countries.fields import Country
@@ -60,6 +60,12 @@ from pretix.testutils.sessions import get_cart_session_key
 from .test_timemachine import TimemachineTestMixin
 
 
+@pytest.fixture
+def class_monkeypatch(request, monkeypatch):
+    request.cls.monkeypatch = monkeypatch
+
+
+@pytest.mark.usefixtures("class_monkeypatch")
 class BaseCheckoutTestCase:
     @scopes_disabled()
     def setUp(self):
@@ -98,6 +104,7 @@ class BaseCheckoutTestCase:
         self.workshopquota.items.add(self.workshop2)
         self.workshopquota.variations.add(self.workshop2a)
         self.workshopquota.variations.add(self.workshop2b)
+        self.monkeypatch.setattr("django.db.transaction.on_commit", lambda t: t())
 
     def _set_session(self, key, value):
         session = self.client.session
@@ -4413,8 +4420,6 @@ class CheckoutTestCase(BaseCheckoutTestCase, TimemachineTestMixin, TestCase):
             assert len(djmail.outbox) == 1
             assert any(["Invoice_" in a[0] for a in djmail.outbox[0].attachments])
 
-
-class CheckoutTransactionTestCase(BaseCheckoutTestCase, TransactionTestCase):
     def test_order_confirmation_mail_invoice_sent_somewhere_else(self):
         self.event.settings.invoice_address_asked = True
         self.event.settings.invoice_address_required = True

src/tests/presale/test_event.py

@@ -36,7 +36,6 @@
 import datetime
 import re
 from decimal import Decimal
-from importlib import import_module
 from json import loads
 from zoneinfo import ZoneInfo
 
@@ -81,34 +80,6 @@ class EventMiddlewareTest(EventTestMixin, SoupTest):
         doc = self.get_doc('/%s/%s/' % (self.orga.slug, self.event.slug))
         self.assertIn(str(self.event.name), doc.find("h1").text)
 
-    def test_no_session_cookie_set_on_event_index_view(self):
-        resp = self.client.get('/%s/%s/' % (self.orga.slug, self.event.slug))
-        self.assertEqual(resp.status_code, 200)
-        assert settings.SESSION_COOKIE_NAME not in self.client.cookies
-
-    def test_no_cart_session_added_on_event_index_view(self):
-        # Make sure a session is present by doing a cart op on another event
-        event2 = Event.objects.create(
-            organizer=self.orga, name='30C3b', slug='30c3b',
-            date_from=datetime.datetime(now().year + 1, 12, 26, 14, 0, tzinfo=datetime.timezone.utc),
-            live=True,
-        )
-        self.client.post('/%s/%s/cart/add' % (self.orga.slug, event2.slug), {
-            'item_%d' % 1337: '1',  # item does not need to exist
-            'ajax': 1
-        })
-        assert settings.SESSION_COOKIE_NAME in self.client.cookies
-
-        # Visit shop, make sure no session is created
-        resp = self.client.get('/%s/%s/' % (self.orga.slug, self.event.slug))
-        self.assertEqual(resp.status_code, 200)
-
-        SessionStore = import_module(settings.SESSION_ENGINE).SessionStore
-        session = SessionStore(self.client.cookies[settings.SESSION_COOKIE_NAME].value).load()
-        assert set(session.keys()) == {
-            f"current_cart_event_{event2.pk}", "carts"
-        }
-
     def test_not_found(self):
         resp = self.client.get('/%s/%s/' % ('foo', 'bar'))
         self.assertEqual(resp.status_code, 404)