Bump to 2026.9.1

pyproject.toml

@@ -46,7 +46,7 @@ dependencies = [
   "django-formtools==2.7",
   "django-hierarkey==2.0.*,>=2.0.2",
   "django-hijack==3.7.*",
-  "django-i18nfield==1.12.*",
+  "django-i18nfield==1.11.*",
   "django-libsass==0.9",
   "django-localflavor==5.1",
   "django-markup",

src/pretix/__init__.py

@@ -19,4 +19,4 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-__version__ = "2026.10.0.dev0"
+__version__ = "2026.9.1"

src/pretix/base/models/base.py

@@ -151,29 +151,12 @@ class LoggingMixin:
         logentry = LogEntry(content_object=self, user=user, action_type=action, event=event,
                             organizer_id=organizer_id, **kwargs)
         if isinstance(data, dict):
-            # sensitivekeys are matched whether contained, not exactly
-            sensitivekeys = [
-                'auth',
-                'key',
-                'token',
-                'password',
-                'Password',
-                '_pass',
-                'salt',
-                'secret',
-            ]
+            sensitivekeys = ['password', 'secret', 'api_key']
 
-            def clean_recursive(d):
-                data = d
-                data_iterator = d.items() if isinstance(d, dict) else enumerate(d)
-                for k, v in data_iterator:
-                    if v and any([sensitivekey in str(k) for sensitivekey in sensitivekeys]):
+            for sensitivekey in sensitivekeys:
+                for k, v in data.items():
+                    if (sensitivekey in k) and v:
                         data[k] = "********"
-                    elif isinstance(v, (list, dict)):
-                        data[k] = clean_recursive(v)
-                return data
-
-            data = clean_recursive(data)
 
             logentry.data = json.dumps(data, cls=CustomJSONEncoder, sort_keys=True)
         elif data:

src/pretix/base/services/placeholders.py

@@ -361,7 +361,7 @@ def base_placeholders(sender, **kwargs):
             'currency', ['event'], lambda event: event.currency, lambda event: event.currency
         ),
         SimpleFunctionalTextPlaceholder(
-            'order_email', ['order'], lambda order: order.email or _('anonymous user'), 'john@example.org'
+            'order_email', ['order'], lambda order: order.email, 'john@example.org'
         ),
         SimpleFunctionalTextPlaceholder(
             'invoice_number', ['invoice'],

src/pretix/plugins/banktransfer/views.py

@@ -239,7 +239,7 @@ class ActionView(View):
             })
 
     def get(self, request, *args, **kwargs):
-        u = request.GET.get('query', '').strip()
+        u = request.GET.get('query', '')
         if len(u) < 2:
             return JsonResponse({'results': []})
 

src/pretix/plugins/ticketoutputpdf/api.py

@@ -111,6 +111,7 @@ class TicketLayoutViewSet(viewsets.ModelViewSet):
     serializer_class = TicketLayoutSerializer
     queryset = TicketLayout.objects.none()
     lookup_field = 'id'
+    write_permission = 'event.settings.general:write'
 
     def get_queryset(self):
         return self.request.event.ticket_layouts.all()

src/tests/base/test_shredders.py

@@ -94,83 +94,6 @@ def question(event, item):
     return q
 
 
-@pytest.mark.django_db
-def test_log_action_filter(event, order):
-    sensitivekeys = [
-        'auth',
-        'key',
-        'token',
-        'password',
-        'Password',
-        '_pass',
-        'salt',
-        'secret',
-    ]
-    log_data = log_data_filtered = {
-        'foo': 'bar',
-    }
-    for d in (log_data, log_data_filtered):
-        value = '********' if d == log_data_filtered else '__sensitive_info__'
-        for k in sensitivekeys:
-            d[k] = d['prefix' + k] = d['prefix' + k + 'suffix'] = d[k + 'suffix'] = value
-
-        d['recursive_dict'] = {
-            'test': 'dummy',
-            'test_token': value,
-            'd': {
-                'baz': 'foo',
-                'mypassword': value,
-                'l': [
-                    'foo',
-                    'bar',
-                    {
-                        'baz': True,
-                        'superkey': value,
-                    },
-                ],
-            },
-            'l': [
-                'okay',
-                {
-                    'salt_to_secret': value,
-                    'name': 'okay'
-                },
-                'element',
-                [
-                    'another',
-                    {
-                        'api_password': value,
-                    },
-                    'list'
-                ]
-            ]
-        }
-        d['recursive_list'] = [
-            'foo',
-            'bar',
-            [
-                'foo',
-                'bar',
-                {
-                    'foo': 'bar',
-                    'api_token': value,
-                },
-                'baz',
-            ],
-            {
-                'foo': 'bar',
-                'MyPassword': value,
-            }
-        ]
-    l1 = order.log_action(
-        'dummy.log',
-        data=log_data,
-    )
-
-    l1.refresh_from_db()
-    assert json.loads(l1.data) == log_data_filtered
-
-
 @pytest.mark.django_db
 def test_email_shredder(event, order):
     l1 = order.log_action(

src/tests/plugins/ticketoutputpdf/test_api.py

@@ -327,3 +327,22 @@ def test_renderer_batch_invalid(env, token_client, position):
     )
     assert resp.status_code == 400
     assert resp.data == {"parts": ["Please do not submit more than 1000 parts."]}
+
+
+@pytest.mark.django_db
+def test_api_permission(env, token_client):
+    t = env[0].organizer.teams.get()
+    t.limit_event_permissions = {"event.orders:read": True}
+    t.all_event_permissions = False
+    t.save()
+    resp = token_client.patch(
+        '/api/v1/organizers/{}/events/{}/ticketlayouts/{}/'.format(env[0].slug, env[0].slug, env[1].pk),
+        {
+            "name": "Bar",
+            "layout": [
+                {"type": "barcodearea", "left": "7.00", "bottom": "11.15", "size": "45.00", "content": "secret"}
+            ]
+        },
+        format='json'
+    )
+    assert resp.status_code == 403