Update sentry-sdk requirement from ==2.66.* to ==2.68.*

Updates the requirements on [sentry-sdk](https://github.com/getsentry/sentry-python) to permit the latest version.
- [Release notes](https://github.com/getsentry/sentry-python/releases)
- [Changelog](https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md)
- [Commits](https://github.com/getsentry/sentry-python/compare/2.66.0...2.68.0)

---
updated-dependencies:
- dependency-name: sentry-sdk
  dependency-version: 2.68.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/sbom.yml

@@ -1,45 +0,0 @@
-name: SBOM
-
-on:
-  push:
-    branches: [ master, sbom ]
-    tags: [ 'v.*' ]
-
-permissions:
-  contents: read  #  to fetch code (actions/checkout)
-
-env:
-  FORCE_COLOR: 1
-
-jobs:
-  test:
-    runs-on: ubuntu-22.04
-    name: Submission
-    steps:
-      - uses: actions/checkout@v4
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.13"
-      - name: Use Node.js
-        uses: actions/setup-node@v7
-        with:
-          node-version: '24.x'
-      - uses: actions/cache@v4
-        with:
-          path: ~/.cache/pip
-          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }}
-          restore-keys: |
-            ${{ runner.os }}-pip-
-      - name: Install system dependencies
-        run: sudo apt update && sudo apt install -y gettext unzip
-      - name: Install Python dependencies
-        run: pip3 install -U "prisma-sbom-submit[python]"
-      - name: Test
-        run: /opt/hostedtoolcache/node/24.18.0/x64/bin/npm install --global @cyclonedx/cyclonedx-npm
-      - name: Create SBOM
-        run: NPM=$(which npm) prisma-sbom-submit collect . sbom.json
-      - name: Submit SBOM
-        run: prisma-sbom-submit upload --server https://prisma.pretix.com sbom.json
-        env:
-          PRISMA_UPLOAD_TOKEN: ${{ secrets.PRISMA_UPLOAD_TOKEN }}

doc/api/resources/checkin.rst

@@ -71,6 +71,8 @@ Checking a ticket in
    :>json object questions: List of questions to be answered for check-in, only set on status ``"incomplete"``.
    :>json object media_policy: Reusable media policy (see documentation on items), only set on status ``"exchange"``.
    :>json object media_type: Reusable media type (see documentation on items), only set on status ``"exchange"``.
+   :>json boolean simulate: Do not actually perform the check-in, only simulate the response. The ``position`` response
+                            object will not reflect the simulated changes.
 
    **Example request**:
 

doc/api/resources/orders.rst

@@ -2038,7 +2038,7 @@ Manipulating individual positions
 
    * ``order`` (mandatory, specified as a string mapping to a ``code``)
 
-   * ``addon_to`` (optional, specified as an integer mapping to the ``positionid`` of the parent position)
+   * ``addon_to`` (optional, specified as an integer mapping to ``positionid`` - the number of the position within the order, see :ref:`_order-position-resource` - of the parent position)
 
    * ``item`` (mandatory)
 
@@ -2348,7 +2348,7 @@ otherwise, such as splitting an order or changing fees.
             "subevent": 562,
             "seat": "seat-guid-2",
             "price": "99.99",
-            "addon_to": 12374,
+            "addon_to": 1,
             "attendee_name": "Peter",
           }
         ],

pyproject.toml

@@ -33,12 +33,12 @@ dependencies = [
   "bleach==6.4.*",
   "celery==5.6.*",
   "chardet==5.2.*",
-  "cryptography>=49.0.0",
+  "cryptography>=50.0.0",
   "css-inline==0.21.*",
   "defusedcsv>=3.0.0",
   "dnspython==2.*",
   "Django[argon2]==5.2.*",
-  "django-bootstrap3==26.1",
+  "django-bootstrap3==26.2",
   "django-compressor==4.6.0",
   "django-countries==9.0.*",
   "django-filter==26.1",
@@ -48,7 +48,7 @@ dependencies = [
   "django-hijack==3.7.*",
   "django-i18nfield==1.11.*",
   "django-libsass==0.9",
-  "django-localflavor==5.0",
+  "django-localflavor==5.1",
   "django-markup",
   "django-oauth-toolkit==2.3.*",
   "django-otp==1.7.*",
@@ -67,7 +67,7 @@ dependencies = [
   "kombu==5.6.*",
   "libsass==0.23.*",
   "lxml",
-  "markdown==3.10.2",  # 3.3.5 requires importlib-metadata>=4.4, but django-bootstrap3 requires importlib-metadata<3.
+  "markdown==3.10.3",  # 3.3.5 requires importlib-metadata>=4.4, but django-bootstrap3 requires importlib-metadata<3.
   # We can upgrade markdown again once django-bootstrap3 upgrades or once we drop Python 3.6 and 3.7
   "mt-940==4.30.*",
   "oauthlib==3.3.*",
@@ -94,7 +94,7 @@ dependencies = [
   "redis==7.4.*",
   "reportlab==5.0.*",
   "requests==2.34.*",
-  "sentry-sdk==2.66.*",
+  "sentry-sdk==2.68.*",
   "sepaxml==2.7.*",
   "stripe==7.9.*",
   "text-unidecode==1.*",

src/pretix/_base_settings.py

@@ -104,6 +104,7 @@ ALL_LANGUAGES = [
     ('gl', _('Galician')),
     ('el', _('Greek')),
     ('he', _('Hebrew')),
+    ('hu', _('Hungarian')),
     ('id', _('Indonesian')),
     ('it', _('Italian')),
     ('ja', _('Japanese')),

src/pretix/api/auth/device.py

@@ -20,8 +20,11 @@
 # <https://www.gnu.org/licenses/>.
 #
 import logging
+from datetime import timedelta
 
 from django.contrib.auth.models import AnonymousUser
+from django.db import DatabaseError
+from django.utils.timezone import now
 from django_scopes import scopes_disabled
 from rest_framework import exceptions
 from rest_framework.authentication import TokenAuthentication
@@ -30,6 +33,7 @@ from pretix.api.auth.devicesecurity import (
     FullAccessSecurityProfile, get_all_security_profiles,
 )
 from pretix.base.models import Device
+from pretix.base.models.devices import DeviceLastSeen
 
 logger = logging.getLogger(__name__)
 
@@ -42,7 +46,7 @@ class DeviceTokenAuthentication(TokenAuthentication):
         model = self.get_model()
         try:
             with scopes_disabled():
-                device = model.objects.select_related('organizer').get(api_token=key)
+                device = model.objects.select_related('organizer', 'last_seen').get(api_token=key)
         except model.DoesNotExist:
             raise exceptions.AuthenticationFailed('Invalid token.')
 
@@ -53,6 +57,7 @@ class DeviceTokenAuthentication(TokenAuthentication):
             logging.warning(f'Connection attempt of revoked device {device.pk}.')
             raise exceptions.AuthenticationFailed('Device access has been revoked.')
 
+        self._update_last_seen(device)
         return AnonymousUser(), device
 
     def authenticate(self, request):
@@ -63,3 +68,22 @@ class DeviceTokenAuthentication(TokenAuthentication):
             if not profile.is_allowed(request):
                 raise exceptions.PermissionDenied('Request denied by device security profile.')
         return r
+
+    def _update_last_seen(self, device: Device):
+        try:
+            try:
+                last_seen_obj = device.last_seen
+            except DeviceLastSeen.DoesNotExist:
+                # First request from device, create model, ignore result. Use get_or_create to be safe
+                # against concurrent create requests
+                DeviceLastSeen.objects.get_or_create(device=device, last_seen=now())
+            else:
+                if now() - last_seen_obj.last_seen < timedelta(seconds=10):
+                    # We don't need to know the last seen info of a device to more precision than this,
+                    # so we can avoid some database writes if the device is bursting a lot of requests.
+                    return
+                last_seen_obj.last_seen = now()
+                last_seen_obj.save(update_fields=["last_seen"])
+        except DatabaseError:
+            # Do not stop the request from happening
+            logger.exception("Database error while updating last_seen")

src/pretix/api/auth/devicesecurity.py

@@ -115,7 +115,7 @@ class PretixScanSecurityProfile(AllowListSecurityProfile):
         ('GET', 'api-v1:event.settings'),
         ('POST', 'api-v1:upload'),
         ('POST', 'api-v1:checkinrpc.redeem'),
-        ('POST', 'api-v1:checkinrpc.annull'),
+        ('POST', 'api-v1:checkinrpc.annul'),
         ('GET', 'api-v1:checkinrpc.search'),
         ('GET', 'api-v1:reusablemedium-list'),
         ('POST', 'api-v1:reusablemedium-lookup'),
@@ -154,7 +154,7 @@ class PretixScanNoSyncNoSearchSecurityProfile(AllowListSecurityProfile):
         ('GET', 'api-v1:event.settings'),
         ('POST', 'api-v1:upload'),
         ('POST', 'api-v1:checkinrpc.redeem'),
-        ('POST', 'api-v1:checkinrpc.annull'),
+        ('POST', 'api-v1:checkinrpc.annul'),
         ('GET', 'api-v1:checkinrpc.search'),
     )
 
@@ -191,7 +191,7 @@ class PretixScanNoSyncSecurityProfile(AllowListSecurityProfile):
         ('GET', 'api-v1:event.settings'),
         ('POST', 'api-v1:upload'),
         ('POST', 'api-v1:checkinrpc.redeem'),
-        ('POST', 'api-v1:checkinrpc.annull'),
+        ('POST', 'api-v1:checkinrpc.annul'),
         ('GET', 'api-v1:checkinrpc.search'),
     )
 

src/pretix/api/serializers/checkin.py

@@ -90,6 +90,7 @@ class CheckinRPCRedeemInputSerializer(serializers.Serializer):
     answers = serializers.JSONField(required=False, allow_null=True)
     exchange_medium_type = serializers.ChoiceField(required=False, choices=MEDIA_TYPES)
     exchange_medium_identifier = serializers.CharField(required=False)
+    simulate = serializers.BooleanField(default=False, required=False)
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)

src/pretix/api/serializers/item.py

@@ -619,7 +619,7 @@ class QuestionSerializer(I18nAwareModelSerializer):
         options_data = validated_data.pop('options') if 'options' in validated_data else []
         items = validated_data.pop('items', [])
 
-        question = Question.objects.create(**validated_data)
+        question = Question.objects.create(**validated_data, container_type=Question.ContainerType.ORDERPOSITION)
         question.items.set(items)
         for opt_data in options_data:
             QuestionOption.objects.create(question=question, **opt_data)

src/pretix/api/views/checkin.py

@@ -139,6 +139,7 @@ class CheckinListViewSet(viewsets.ModelViewSet):
             )
         return qs
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.log_action(
@@ -153,6 +154,7 @@ class CheckinListViewSet(viewsets.ModelViewSet):
         ctx['event'] = self.request.event
         return ctx
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.log_action(
@@ -837,6 +839,11 @@ def _redeem_process(*, checkinlists, raw_barcode, answers_data, datetime, force,
             )
 
             if exchange_medium_identifier:  # other fields are filled, see CheckinRPCRedeemInputSerializer.validate
+                if simulate:
+                    raise CheckInError(
+                        gettext('You cannot simulate a medium exchange.'),
+                        'error'
+                    )
                 with transaction.atomic():
                     # Do exchange and check-in atomically, i.e. both succeed or both fail
                     medium = perform_media_exchange(
@@ -1064,6 +1071,7 @@ class CheckinRPCRedeemView(views.APIView):
             legacy_url_support=False,
             exchange_medium_type=s.validated_data.get('exchange_medium_type'),
             exchange_medium_identifier=s.validated_data.get('exchange_medium_identifier'),
+            simulate=s.validated_data.get('simulate'),
         )
 
 

src/pretix/api/views/discount.py

@@ -32,6 +32,7 @@
 # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 # License for the specific language governing permissions and limitations under the License.
 
+from django.db import transaction
 from django_filters.rest_framework import DjangoFilterBackend, FilterSet
 from django_scopes import scopes_disabled
 from rest_framework import viewsets
@@ -64,6 +65,7 @@ class DiscountViewSet(ConditionalListView, viewsets.ModelViewSet):
             'limit_sales_channels',
         )
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.log_action(
@@ -78,6 +80,7 @@ class DiscountViewSet(ConditionalListView, viewsets.ModelViewSet):
         ctx['event'] = self.request.event
         return ctx
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.log_action(
@@ -87,6 +90,7 @@ class DiscountViewSet(ConditionalListView, viewsets.ModelViewSet):
             data=self.request.data
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         if not instance.allow_delete():
             raise PermissionDenied('You cannot delete this discount because it already has '

src/pretix/api/views/event.py

@@ -257,6 +257,7 @@ class EventViewSet(viewsets.ModelViewSet):
                 data=self.request.data
             )
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         copy_from = None
         if 'clone_from' in self.request.GET:
@@ -320,6 +321,7 @@ class EventViewSet(viewsets.ModelViewSet):
             data=self.request.data
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         if not instance.allow_delete():
             raise PermissionDenied('The event can not be deleted as it already contains orders. Please set \'live\''
@@ -355,6 +357,7 @@ class CloneEventViewSet(viewsets.ModelViewSet):
         ctx['organizer'] = self.request.organizer
         return ctx
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         # Weird edge case: Requires settings permission on the event (to read) but also on the organizer (two write)
         perm_holder = (self.request.auth if isinstance(self.request.auth, (Device, TeamAPIToken))
@@ -513,6 +516,7 @@ class SubEventViewSet(ConditionalListView, viewsets.ModelViewSet):
         resp['X-Page-Generated'] = date
         return resp
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         original_data = self.get_serializer(instance=serializer.instance).data
         super().perform_update(serializer)
@@ -529,6 +533,7 @@ class SubEventViewSet(ConditionalListView, viewsets.ModelViewSet):
             data=self.request.data
         )
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.log_action(
@@ -538,6 +543,7 @@ class SubEventViewSet(ConditionalListView, viewsets.ModelViewSet):
             data=self.request.data
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         if not instance.allow_delete():
             raise PermissionDenied('The sub-event can not be deleted as it has already been used in orders. Please set'
@@ -566,6 +572,7 @@ class TaxRuleViewSet(ConditionalListView, viewsets.ModelViewSet):
     def get_queryset(self):
         return self.request.event.tax_rules.all()
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         super().perform_update(serializer)
         serializer.instance.log_action(
@@ -575,6 +582,7 @@ class TaxRuleViewSet(ConditionalListView, viewsets.ModelViewSet):
             data=self.request.data
         )
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.log_action(
@@ -584,6 +592,7 @@ class TaxRuleViewSet(ConditionalListView, viewsets.ModelViewSet):
             data=self.request.data
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         if not instance.allow_delete():
             raise PermissionDenied('This tax rule can not be deleted as it is currently in use.')
@@ -757,6 +766,7 @@ class SeatViewSet(ConditionalListView, UpdateModelMixin, viewsets.ReadOnlyModelV
         }
         return ctx
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         super().perform_update(serializer)
         serializer.instance.event.log_action(
@@ -766,6 +776,7 @@ class SeatViewSet(ConditionalListView, UpdateModelMixin, viewsets.ReadOnlyModelV
             data={"seats": [serializer.instance.pk]},
         )
 
+    @transaction.atomic()
     def bulk_change_blocked(self, blocked):
         s = SeatBulkBlockInputSerializer(
             data=self.request.data,

src/pretix/api/views/exporters.py

@@ -23,6 +23,7 @@ from datetime import timedelta
 
 from celery.result import AsyncResult
 from django.conf import settings
+from django.db import transaction
 from django.http import Http404
 from django.shortcuts import get_object_or_404
 from django.utils.functional import cached_property
@@ -45,7 +46,8 @@ from pretix.base.models import (
 )
 from pretix.base.models.organizer import TeamQuerySet
 from pretix.base.services.export import (
-    export, init_event_exporters, init_organizer_exporters, multiexport,
+    ExportError, export, init_event_exporters, init_organizer_exporters,
+    multiexport,
 )
 from pretix.helpers.http import ChunkBasedFileResponse
 
@@ -149,8 +151,11 @@ class EventExportersViewSet(ExportersMixin, viewsets.ViewSet):
         ))
         exporters = []
         for ex in sorted(raw_exporters, key=lambda ex: str(ex.verbose_name)):
-            ex._serializer = JobRunSerializer(exporter=ex)
-            exporters.append(ex)
+            try:
+                ex._serializer = JobRunSerializer(exporter=ex)
+                exporters.append(ex)
+            except ExportError:
+                pass
         return exporters
 
     def do_export(self, cf, instance, data):
@@ -180,8 +185,11 @@ class OrganizerExportersViewSet(ExportersMixin, viewsets.ViewSet):
         ))
         exporters = []
         for ex in sorted(raw_exporters, key=lambda ex: str(ex.verbose_name)):
-            ex._serializer = JobRunSerializer(exporter=ex)
-            exporters.append(ex)
+            try:
+                ex._serializer = JobRunSerializer(exporter=ex)
+                exporters.append(ex)
+            except ExportError:
+                pass
         return exporters
 
     def do_export(self, cf, instance, data):
@@ -220,6 +228,7 @@ class ScheduledEventExportViewSet(ScheduledExportersViewSet):
             qs = self.request.event.scheduled_exports
         return qs.select_related("owner")
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         if not self.request.user.is_authenticated:
             raise PermissionDenied('Creation of exports requires user-specific API access.')
@@ -250,6 +259,7 @@ class ScheduledEventExportViewSet(ScheduledExportersViewSet):
         ))
         return {e.identifier: e for e in exporters}
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         if not self.request.user.is_authenticated or self.request.user != serializer.instance.owner:
             # This is to prevent a possible privilege escalation where user A creates a scheduled export and
@@ -275,6 +285,7 @@ class ScheduledEventExportViewSet(ScheduledExportersViewSet):
             data=self.request.data
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         self.request.event.log_action(
             'pretix.event.export.schedule.deleted',
@@ -302,6 +313,7 @@ class ScheduledOrganizerExportViewSet(ScheduledExportersViewSet):
             qs = self.request.organizer.scheduled_exports
         return qs.select_related("owner")
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         if not self.request.user.is_authenticated:
             raise PermissionDenied('Creation of exports requires user-specific API access.')
@@ -332,6 +344,7 @@ class ScheduledOrganizerExportViewSet(ScheduledExportersViewSet):
         ))
         return {e.identifier: e for e in exporters}
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         if not self.request.user.is_authenticated or self.request.user != serializer.instance.owner:
             # This is to prevent a possible privilege escalation where user A creates a scheduled export and
@@ -382,6 +395,7 @@ class ScheduledOrganizerExportViewSet(ScheduledExportersViewSet):
             data=self.request.data
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         self.request.organizer.log_action(
             'pretix.organizer.export.schedule.deleted',

src/pretix/api/views/item.py

@@ -33,6 +33,7 @@
 # License for the specific language governing permissions and limitations under the License.
 
 import django_filters
+from django.db import transaction
 from django.db.models import Q
 from django.shortcuts import get_object_or_404
 from django.utils.functional import cached_property
@@ -109,6 +110,7 @@ class ItemViewSet(ConditionalListView, viewsets.ModelViewSet):
             'limit_sales_channels', 'variations__limit_sales_channels', 'program_times'
         ).all()
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.log_action(
@@ -123,6 +125,7 @@ class ItemViewSet(ConditionalListView, viewsets.ModelViewSet):
         ctx['event'] = self.request.event
         return ctx
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         original_data = self.get_serializer(instance=serializer.instance).data
 
@@ -139,6 +142,7 @@ class ItemViewSet(ConditionalListView, viewsets.ModelViewSet):
             data=self.request.data
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         if not instance.allow_delete():
             raise PermissionDenied('This item cannot be deleted because it has already been ordered '
@@ -183,6 +187,7 @@ class ItemVariationViewSet(viewsets.ModelViewSet):
         ctx['event'] = self.request.event
         return ctx
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         item = self.item
         if not item.has_variations:
@@ -197,6 +202,7 @@ class ItemVariationViewSet(viewsets.ModelViewSet):
                              {'value': serializer.instance.value})
         )
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.item.log_action(
@@ -207,6 +213,7 @@ class ItemVariationViewSet(viewsets.ModelViewSet):
                              {'value': serializer.instance.value})
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         if not instance.allow_delete():
             raise PermissionDenied('This variation cannot be deleted because it has already been ordered '
@@ -249,6 +256,7 @@ class ItemBundleViewSet(viewsets.ModelViewSet):
         ctx['item'] = self.item
         return ctx
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         item = get_object_or_404(Item, pk=self.kwargs['item'], event=self.request.event)
         serializer.save(base_item=item)
@@ -259,6 +267,7 @@ class ItemBundleViewSet(viewsets.ModelViewSet):
             data=merge_dicts(self.request.data, {'id': serializer.instance.pk})
         )
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.base_item.log_action(
@@ -268,6 +277,7 @@ class ItemBundleViewSet(viewsets.ModelViewSet):
             data=merge_dicts(self.request.data, {'id': serializer.instance.pk})
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         super().perform_destroy(instance)
         instance.base_item.log_action(
@@ -303,6 +313,7 @@ class ItemProgramTimeViewSet(viewsets.ModelViewSet):
         ctx['item'] = self.item
         return ctx
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         item = get_object_or_404(Item, pk=self.kwargs['item'], event=self.request.event)
         serializer.save(item=item)
@@ -313,6 +324,7 @@ class ItemProgramTimeViewSet(viewsets.ModelViewSet):
             data=merge_dicts(self.request.data, {'id': serializer.instance.pk})
         )
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.item.log_action(
@@ -322,6 +334,7 @@ class ItemProgramTimeViewSet(viewsets.ModelViewSet):
             data=merge_dicts(self.request.data, {'id': serializer.instance.pk})
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         super().perform_destroy(instance)
         instance.item.log_action(
@@ -354,6 +367,7 @@ class ItemAddOnViewSet(viewsets.ModelViewSet):
         ctx['item'] = self.item
         return ctx
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         item = self.item
         category = get_object_or_404(ItemCategory, pk=self.request.data['addon_category'])
@@ -365,6 +379,7 @@ class ItemAddOnViewSet(viewsets.ModelViewSet):
             data=merge_dicts(self.request.data, {'ORDER': serializer.instance.position}, {'id': serializer.instance.pk})
         )
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.base_item.log_action(
@@ -374,6 +389,7 @@ class ItemAddOnViewSet(viewsets.ModelViewSet):
             data=merge_dicts(self.request.data, {'ORDER': serializer.instance.position}, {'id': serializer.instance.pk})
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         super().perform_destroy(instance)
         instance.base_item.log_action(
@@ -403,6 +419,7 @@ class ItemCategoryViewSet(ConditionalListView, viewsets.ModelViewSet):
     def get_queryset(self):
         return self.request.event.categories.all()
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.log_action(
@@ -417,6 +434,7 @@ class ItemCategoryViewSet(ConditionalListView, viewsets.ModelViewSet):
         ctx['event'] = self.request.event
         return ctx
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.log_action(
@@ -426,6 +444,7 @@ class ItemCategoryViewSet(ConditionalListView, viewsets.ModelViewSet):
             data=self.request.data
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         for item in instance.items.all():
             item.category = None
@@ -456,8 +475,12 @@ class QuestionViewSet(ConditionalListView, viewsets.ModelViewSet):
     write_permission = 'event.items:write'
 
     def get_queryset(self):
-        return self.request.event.questions.prefetch_related('options').all()
+        return self.request.event.questions.filter(
+            # the container_type parameter is undocumented, this API is going to change in a later release
+            container_type=self.request.GET.get('container_type', Question.ContainerType.ORDERPOSITION),
+        ).prefetch_related('options').all()
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.log_action(
@@ -472,6 +495,7 @@ class QuestionViewSet(ConditionalListView, viewsets.ModelViewSet):
         ctx['event'] = self.request.event
         return ctx
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.log_action(
@@ -481,6 +505,7 @@ class QuestionViewSet(ConditionalListView, viewsets.ModelViewSet):
             data=self.request.data
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         instance.log_action(
             'pretix.event.question.deleted',
@@ -509,6 +534,7 @@ class QuestionOptionViewSet(viewsets.ModelViewSet):
         ctx['question'] = get_object_or_404(Question, pk=self.kwargs['question'], event=self.request.event)
         return ctx
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         q = get_object_or_404(Question, pk=self.kwargs['question'], event=self.request.event)
         serializer.save(question=q)
@@ -519,6 +545,7 @@ class QuestionOptionViewSet(viewsets.ModelViewSet):
             data=merge_dicts(self.request.data, {'ORDER': serializer.instance.position}, {'id': serializer.instance.pk})
         )
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.question.log_action(
@@ -528,6 +555,7 @@ class QuestionOptionViewSet(viewsets.ModelViewSet):
             data=merge_dicts(self.request.data, {'ORDER': serializer.instance.position}, {'id': serializer.instance.pk})
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         instance.question.log_action(
             'pretix.event.question.option.deleted',
@@ -586,6 +614,7 @@ class QuotaViewSet(ConditionalListView, viewsets.ModelViewSet):
         serializer = self.get_serializer(page, many=True)
         return self.get_paginated_response(serializer.data)
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.log_action(
@@ -608,6 +637,7 @@ class QuotaViewSet(ConditionalListView, viewsets.ModelViewSet):
         ctx['request'] = self.request
         return ctx
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         original_data = self.get_serializer(instance=serializer.instance).data
 
@@ -663,6 +693,7 @@ class QuotaViewSet(ConditionalListView, viewsets.ModelViewSet):
                 )
         serializer.instance.rebuild_cache()
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         instance.log_action(
             'pretix.event.quota.deleted',

src/pretix/api/views/organizer.py

@@ -394,6 +394,7 @@ class TeamViewSet(viewsets.ModelViewSet):
         )
         return inst
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         instance.log_action('pretix.team.deleted', user=self.request.user, auth=self.request.auth)
         instance.delete()
@@ -693,6 +694,7 @@ class MembershipTypeViewSet(viewsets.ModelViewSet):
         ctx['organizer'] = self.request.organizer
         return ctx
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         if not instance.allow_delete():
             raise PermissionDenied("Can only be deleted if unused.")
@@ -833,6 +835,7 @@ class SalesChannelViewSet(viewsets.ModelViewSet):
         )
         return inst
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         if not instance.allow_delete():
             raise PermissionDenied("Can only be deleted if unused.")

src/pretix/api/views/waitinglist.py

@@ -20,6 +20,7 @@
 # <https://www.gnu.org/licenses/>.
 #
 import django_filters
+from django.db import transaction
 from django_filters.rest_framework import DjangoFilterBackend, FilterSet
 from django_scopes import scopes_disabled
 from rest_framework import viewsets
@@ -62,6 +63,7 @@ class WaitingListViewSet(viewsets.ModelViewSet):
         ctx['event'] = self.request.event
         return ctx
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.log_action(
@@ -70,6 +72,7 @@ class WaitingListViewSet(viewsets.ModelViewSet):
             auth=self.request.auth,
         )
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         if serializer.instance.voucher:
             raise PermissionDenied('This entry can not be changed as it has already been assigned a voucher.')
@@ -80,6 +83,7 @@ class WaitingListViewSet(viewsets.ModelViewSet):
             auth=self.request.auth,
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         if instance.voucher:
             raise PermissionDenied('This entry can not be deleted as it has already been assigned a voucher.')

src/pretix/api/views/webhooks.py

@@ -20,6 +20,7 @@
 # <https://www.gnu.org/licenses/>.
 #
 import django_filters
+from django.db import transaction
 from django_filters.rest_framework import DjangoFilterBackend, FilterSet
 from rest_framework import viewsets
 
@@ -48,6 +49,7 @@ class WebHookViewSet(viewsets.ModelViewSet):
         ctx['organizer'] = self.request.organizer
         return ctx
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         inst = serializer.save(organizer=self.request.organizer)
         self.request.organizer.log_action(
@@ -57,6 +59,7 @@ class WebHookViewSet(viewsets.ModelViewSet):
             data=merge_dicts(self.request.data, {'id': inst.pk})
         )
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         inst = serializer.save(organizer=self.request.organizer)
         self.request.organizer.log_action(
@@ -67,6 +70,7 @@ class WebHookViewSet(viewsets.ModelViewSet):
         )
         return inst
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         self.request.organizer.log_action(
             'pretix.webhook.changed',

src/pretix/base/forms/questions.py

@@ -36,6 +36,7 @@ import copy
 import json
 import logging
 import re
+from collections import namedtuple
 from datetime import timedelta
 from decimal import Decimal
 from io import BytesIO
@@ -636,449 +637,271 @@ class PortraitImageField(SizeValidationMixin, ExtValidationMixin, forms.FileFiel
         super().__init__(*args, **kwargs)
 
 
+FakeQuestion = namedtuple(
+    'FakeQuestion', 'id question position required help_text container_type', defaults=('', Question.ContainerType.ORDERPOSITION)
+)
+
+
+def get_fake_attendee_questions(settings):
+    fq = []
+    sqo = settings.system_question_order
+
+    if settings.attendee_names_asked:
+        fq.append(FakeQuestion('attendee_name_parts', _('Attendee name'), sqo.get('attendee_name_parts', 0), settings.attendee_names_required))
+
+    if settings.attendee_emails_asked:
+        fq.append(FakeQuestion('attendee_email', _('Attendee email'), sqo.get('attendee_email', 0), settings.attendee_emails_required))
+
+    if settings.attendee_company_asked:
+        fq.append(FakeQuestion('company', _('Company'), sqo.get('company', 0), settings.attendee_company_required))
+
+    if settings.attendee_addresses_asked:
+        fq.append(FakeQuestion('street', _('Street'), sqo.get('street', 0), settings.attendee_addresses_required))
+        fq.append(FakeQuestion('zipcode', _('ZIP code'), sqo.get('zipcode', 0), settings.attendee_addresses_required))
+        fq.append(FakeQuestion('city', _('City'), sqo.get('city', 0), settings.attendee_addresses_required))
+        fq.append(FakeQuestion('state', _('State'), sqo.get('country', 0), settings.attendee_addresses_required))
+        fq.append(FakeQuestion('country', _('Country'), sqo.get('country', 0), settings.attendee_addresses_required))
+    return fq
+
+
 class BaseQuestionsForm(forms.Form):
     """
-    This form class is responsible for asking order-related questions. This includes
-    the attendee name for admission tickets, if the corresponding setting is enabled,
-    as well as additional questions defined by the organizer.
+    This is the base form class responsible for asking order- or ticket-related questions.
     """
     address_validation = False
 
-    def __init__(self, *args, **kwargs):
-        """
-        Takes two additional keyword arguments:
-
-        :param cartpos: The cart position the form should be for
-        :param event: The event this belongs to
-        """
-        request = kwargs.pop('request', None)
-        cartpos = self.cartpos = kwargs.pop('cartpos', None)
-        orderpos = self.orderpos = kwargs.pop('orderpos', None)
-        pos = cartpos or orderpos
-        item = pos.item
-        questions = pos.item.questions_to_ask
-        event = kwargs.pop('event')
-        self.all_optional = kwargs.pop('all_optional', False)
-        self.attendee_addresses_required = event.settings.attendee_addresses_required and not self.all_optional
-
-        super().__init__(*args, **kwargs)
-
-        if cartpos and item.validity_mode == Item.VALIDITY_MODE_DYNAMIC and item.validity_dynamic_start_choice:
-            if item.validity_dynamic_start_choice_day_limit:
-                max_date = time_machine_now().astimezone(event.timezone) + timedelta(days=item.validity_dynamic_start_choice_day_limit)
-            else:
-                max_date = None
-            min_date = time_machine_now()
+    def build_user_question_field(self, request, event, answerlist, q):
+        # Do we already have an answer? Provide it as the initial value
+        answers = [a for a in answerlist if a.question_id == q.id]
+        if answers:
+            initial = answers[0]
+        else:
             initial = None
-            if (item.require_membership or (pos.variation and pos.variation.require_membership)) and pos.used_membership:
-                if pos.used_membership.date_start >= time_machine_now():
-                    initial = min_date = pos.used_membership.date_start
-                max_date = min(max_date, pos.used_membership.date_end) if max_date else pos.used_membership.date_end
-            if item.validity_dynamic_duration_months or item.validity_dynamic_duration_days:
-                attrs = {}
-                if max_date:
-                    attrs['data-max'] = max_date.date().isoformat()
-                if min_date:
-                    attrs['data-min'] = min_date.date().isoformat()
-                self.fields['requested_valid_from'] = forms.DateField(
-                    label=_('Start date'),
-                    help_text='' if initial else _('If you keep this empty, the ticket will be valid starting at the time of purchase.'),
-                    required=bool(initial),
-                    initial=pos.requested_valid_from or initial,
-                    widget=DatePickerWidget(attrs),
-                    validators=([MaxDateValidator(max_date.date())] if max_date else []) + [MinDateValidator(min_date.date())]
-                )
+        tz = ZoneInfo(event.settings.timezone)
+        required = q.required and not self.all_optional
+        if q.type == Question.TYPE_BOOLEAN:
+            if required:
+                # For some reason, django-bootstrap3 does not set the required attribute
+                # itself.
+                widget = forms.CheckboxInput(attrs={'required': 'required'})
             else:
-                self.fields['requested_valid_from'] = forms.SplitDateTimeField(
-                    label=_('Start date'),
-                    help_text='' if initial else _('If you keep this empty, the ticket will be valid starting at the time of purchase.'),
-                    required=bool(initial),
-                    initial=pos.requested_valid_from or initial,
-                    widget=SplitDateTimePickerWidget(
-                        time_format=get_format_without_seconds('TIME_INPUT_FORMATS'),
-                        min_date=min_date,
-                        max_date=max_date
-                    ),
-                    validators=([MaxDateTimeValidator(max_date)] if max_date else []) + [MinDateTimeValidator(min_date)]
-                )
+                widget = forms.CheckboxInput()
 
-        add_fields = {}
+            if initial:
+                initialbool = (initial.answer == "True")
+            else:
+                initialbool = False
 
-        if item.ask_attendee_data and event.settings.attendee_names_asked:
-            add_fields['attendee_name_parts'] = NamePartsFormField(
-                max_length=255,
-                required=event.settings.attendee_names_required and not self.all_optional,
-                scheme=event.settings.name_scheme,
-                titles=event.settings.name_scheme_titles,
-                label=_('Attendee name'),
-                initial=(cartpos.attendee_name_parts if cartpos else orderpos.attendee_name_parts),
+            field = forms.BooleanField(
+                label=escape(q.question), required=required,
+                help_text=rich_text(q.help_text),
+                initial=initialbool, widget=widget,
             )
-        if item.ask_attendee_data and event.settings.attendee_emails_asked:
-            add_fields['attendee_email'] = forms.EmailField(
-                required=event.settings.attendee_emails_required and not self.all_optional,
-                label=_('Attendee email'),
-                initial=(cartpos.attendee_email if cartpos else orderpos.attendee_email),
-                widget=forms.EmailInput(
-                    attrs={
-                        'autocomplete': 'email'
-                    }
-                )
+        elif q.type == Question.TYPE_NUMBER:
+            field = forms.DecimalField(
+                label=escape(q.question), required=required,
+                min_value=q.valid_number_min or Decimal('0.00'),
+                max_value=q.valid_number_max,
+                help_text=rich_text(q.help_text),
+                initial=initial.answer if initial else None,
             )
-        if item.ask_attendee_data and event.settings.attendee_company_asked:
-            add_fields['company'] = forms.CharField(
-                required=event.settings.attendee_company_required and not self.all_optional,
-                label=_('Company'),
-                max_length=255,
-                initial=(cartpos.company if cartpos else orderpos.company),
+        elif q.type == Question.TYPE_STRING:
+            field = forms.CharField(
+                label=escape(q.question), required=required,
+                max_length=q.valid_string_length_max,
+                help_text=rich_text(q.help_text),
+                initial=initial.answer if initial else None,
             )
-
-        if item.ask_attendee_data and event.settings.attendee_addresses_asked:
-            add_fields['street'] = forms.CharField(
-                required=self.attendee_addresses_required,
-                label=_('Address'),
-                widget=forms.Textarea(attrs={
-                    'rows': 2,
-                    'placeholder': _('Street and Number'),
-                    'autocomplete': 'street-address'
-                }),
-                initial=(cartpos.street if cartpos else orderpos.street),
+        elif q.type == Question.TYPE_TEXT:
+            field = forms.CharField(
+                label=escape(q.question), required=required,
+                max_length=q.valid_string_length_max,
+                help_text=rich_text(q.help_text),
+                widget=forms.Textarea,
+                initial=initial.answer if initial else None,
             )
-            add_fields['zipcode'] = forms.CharField(
-                required=False,
-                max_length=30,
-                label=_('ZIP code'),
-                initial=(cartpos.zipcode if cartpos else orderpos.zipcode),
-                widget=forms.TextInput(attrs={
-                    'autocomplete': 'postal-code',
-                }),
-            )
-            add_fields['city'] = forms.CharField(
-                required=False,
-                label=_('City'),
-                max_length=255,
-                initial=(cartpos.city if cartpos else orderpos.city),
-                widget=forms.TextInput(attrs={
-                    'autocomplete': 'address-level2',
-                }),
-            )
-            country = (cartpos.country if cartpos else orderpos.country) or guess_country_from_request(request, event)
-            add_fields['country'] = CountryField(
-                countries=CachedCountries
+        elif q.type == Question.TYPE_COUNTRYCODE:
+            field = CountryField(
+                countries=CachedCountries,
+                blank=True, null=True, blank_label=' ',
             ).formfield(
-                required=self.attendee_addresses_required,
-                label=_('Country'),
-                initial=country,
-                widget=forms.Select(attrs={
-                    'autocomplete': 'country',
-                    'data-trigger-address-info': 'on',
-                }),
+                label=escape(q.question), required=required,
+                help_text=rich_text(q.help_text),
+                widget=forms.Select,
+                empty_label=' ',
+                initial=initial.answer if initial else (
+                    guess_country_from_request(request, event) if required else None),
             )
-            c = [('', '---')]
-            fprefix = str(self.prefix) + '-' if self.prefix is not None and self.prefix != '-' else ''
-            cc = None
-            state = None
-            if fprefix + 'country' in self.data:
-                cc = str(self.data[fprefix + 'country'])
-            elif country:
-                cc = str(country)
-            if cc and cc in COUNTRIES_WITH_STATE_IN_ADDRESS:
-                types, form = COUNTRIES_WITH_STATE_IN_ADDRESS[cc]
-                statelist = [s for s in pycountry.subdivisions.get(country_code=cc) if s.type in types]
-                c += sorted([(s.code[3:], s.name) for s in statelist], key=lambda s: s[1])
-                state = (cartpos.state if cartpos else orderpos.state)
-            elif fprefix + 'state' in self.data:
-                self.data = self.data.copy()
-                del self.data[fprefix + 'state']
-
-            add_fields['state'] = forms.ChoiceField(
-                label=pgettext_lazy('address', 'State'),
-                required=False,
-                choices=c,
-                initial=state,
-                widget=forms.Select(attrs={
-                    'autocomplete': 'address-level1',
-                }),
+        elif q.type == Question.TYPE_CHOICE:
+            field = forms.ModelChoiceField(
+                queryset=q.options,
+                label=escape(q.question), required=required,
+                help_text=rich_text(q.help_text),
+                widget=forms.Select,
+                to_field_name='identifier',
+                empty_label='',
+                initial=initial.options.first() if initial else None,
             )
-            add_fields['state'].widget.is_required = True
-
-        field_positions = list(
-            [
-                (n, event.settings.system_question_order.get(n if n != 'state' else 'country', 0))
-                for n in add_fields.keys()
-            ]
-        )
-
-        for q in questions:
-            # Do we already have an answer? Provide it as the initial value
-            answers = [a for a in pos.answerlist if a.question_id == q.id]
-            if answers:
-                initial = answers[0]
+        elif q.type == Question.TYPE_CHOICE_MULTIPLE:
+            field = forms.ModelMultipleChoiceField(
+                queryset=q.options,
+                label=escape(q.question), required=required,
+                help_text=rich_text(q.help_text),
+                to_field_name='identifier',
+                widget=QuestionCheckboxSelectMultiple,
+                initial=initial.options.all() if initial else None,
+            )
+        elif q.type == Question.TYPE_FILE:
+            if q.valid_file_portrait:
+                field = PortraitImageField(
+                    label=escape(q.question), required=required,
+                    help_text=rich_text(q.help_text),
+                    initial=initial.file if initial else None,
+                    widget=PortraitImageWidget(answer=initial, request=request,
+                                               attrs={'data-portrait-photo': 'true'}),
+                )
             else:
-                initial = None
-            tz = ZoneInfo(event.settings.timezone)
-            help_text = rich_text(q.help_text)
-            label = escape(q.question)  # django-bootstrap3 calls mark_safe
-            required = q.required and not self.all_optional
-            if q.type == Question.TYPE_BOOLEAN:
-                if required:
-                    # For some reason, django-bootstrap3 does not set the required attribute
-                    # itself.
-                    widget = forms.CheckboxInput(attrs={'required': 'required'})
-                else:
-                    widget = forms.CheckboxInput()
-
-                if initial:
-                    initialbool = (initial.answer == "True")
-                else:
-                    initialbool = False
-
-                field = forms.BooleanField(
-                    label=label, required=required,
-                    help_text=help_text,
-                    initial=initialbool, widget=widget,
+                field = ExtFileField(
+                    label=escape(q.question), required=required,
+                    help_text=rich_text(q.help_text),
+                    initial=initial.file if initial else None,
+                    widget=UploadedFileWidget(answer=initial, request=request),
+                    ext_whitelist=settings.FILE_UPLOAD_EXTENSIONS_OTHER,
+                    max_size=settings.FILE_UPLOAD_MAX_SIZE_OTHER,
                 )
-            elif q.type == Question.TYPE_NUMBER:
-                field = forms.DecimalField(
-                    label=label, required=required,
-                    min_value=q.valid_number_min or Decimal('0.00'),
-                    max_value=q.valid_number_max,
-                    help_text=help_text,
-                    initial=initial.answer if initial else None,
-                )
-            elif q.type == Question.TYPE_STRING:
-                field = forms.CharField(
-                    label=label, required=required,
-                    max_length=q.valid_string_length_max,
-                    help_text=help_text,
-                    initial=initial.answer if initial else None,
-                )
-            elif q.type == Question.TYPE_TEXT:
-                field = forms.CharField(
-                    label=label, required=required,
-                    max_length=q.valid_string_length_max,
-                    help_text=help_text,
-                    widget=forms.Textarea,
-                    initial=initial.answer if initial else None,
-                )
-            elif q.type == Question.TYPE_COUNTRYCODE:
-                field = CountryField(
-                    countries=CachedCountries,
-                    blank=True, null=True, blank_label=' ',
-                ).formfield(
-                    label=label, required=required,
-                    help_text=help_text,
-                    widget=forms.Select,
-                    empty_label=' ',
-                    initial=initial.answer if initial else (guess_country_from_request(request, event) if required else None),
-                )
-            elif q.type == Question.TYPE_CHOICE:
-                field = forms.ModelChoiceField(
-                    queryset=q.options,
-                    label=label, required=required,
-                    help_text=help_text,
-                    widget=forms.Select,
-                    to_field_name='identifier',
-                    empty_label='',
-                    initial=initial.options.first() if initial else None,
-                )
-            elif q.type == Question.TYPE_CHOICE_MULTIPLE:
-                field = forms.ModelMultipleChoiceField(
-                    queryset=q.options,
-                    label=label, required=required,
-                    help_text=help_text,
-                    to_field_name='identifier',
-                    widget=QuestionCheckboxSelectMultiple,
-                    initial=initial.options.all() if initial else None,
-                )
-            elif q.type == Question.TYPE_FILE:
-                if q.valid_file_portrait:
-                    field = PortraitImageField(
-                        label=label, required=required,
-                        help_text=help_text,
-                        initial=initial.file if initial else None,
-                        widget=PortraitImageWidget(position=pos, event=event, answer=initial, attrs={'data-portrait-photo': 'true'}),
+        elif q.type == Question.TYPE_DATE:
+            attrs = {}
+            if q.valid_date_min:
+                attrs['data-min'] = q.valid_date_min.isoformat()
+            if q.valid_date_max:
+                attrs['data-max'] = q.valid_date_max.isoformat()
+            help_text = q.help_text
+            if not help_text:
+                if q.valid_date_min and q.valid_date_max:
+                    help_text = format_lazy(
+                        _('Please enter a date between {min} and {max}.'),
+                        min=date_format(q.valid_date_min, "SHORT_DATE_FORMAT"),
+                        max=date_format(q.valid_date_max, "SHORT_DATE_FORMAT"),
                     )
-                else:
-                    field = ExtFileField(
-                        label=label, required=required,
-                        help_text=help_text,
-                        initial=initial.file if initial else None,
-                        widget=UploadedFileWidget(position=pos, event=event, answer=initial),
-                        ext_whitelist=settings.FILE_UPLOAD_EXTENSIONS_OTHER,
-                        max_size=settings.FILE_UPLOAD_MAX_SIZE_OTHER,
+                elif q.valid_date_min:
+                    help_text = format_lazy(
+                        _('Please enter a date no earlier than {min}.'),
+                        min=date_format(q.valid_date_min, "SHORT_DATE_FORMAT"),
                     )
-            elif q.type == Question.TYPE_DATE:
-                attrs = {}
-                if q.valid_date_min:
-                    attrs['data-min'] = q.valid_date_min.isoformat()
-                if q.valid_date_max:
-                    attrs['data-max'] = q.valid_date_max.isoformat()
-                if not help_text:
-                    if q.valid_date_min and q.valid_date_max:
-                        help_text = format_lazy(
-                            _('Please enter a date between {min} and {max}.'),
-                            min=date_format(q.valid_date_min, "SHORT_DATE_FORMAT"),
-                            max=date_format(q.valid_date_max, "SHORT_DATE_FORMAT"),
-                        )
-                    elif q.valid_date_min:
-                        help_text = format_lazy(
-                            _('Please enter a date no earlier than {min}.'),
-                            min=date_format(q.valid_date_min, "SHORT_DATE_FORMAT"),
-                        )
-                    elif q.valid_date_max:
-                        help_text = format_lazy(
-                            _('Please enter a date no later than {max}.'),
-                            max=date_format(q.valid_date_max, "SHORT_DATE_FORMAT"),
-                        )
-                if initial and initial.answer:
-                    try:
-                        _initial = dateutil.parser.parse(initial.answer).date()
-                    except dateutil.parser.ParserError:
-                        _initial = None
-                else:
+                elif q.valid_date_max:
+                    help_text = format_lazy(
+                        _('Please enter a date no later than {max}.'),
+                        max=date_format(q.valid_date_max, "SHORT_DATE_FORMAT"),
+                    )
+            if initial and initial.answer:
+                try:
+                    _initial = dateutil.parser.parse(initial.answer).date()
+                except dateutil.parser.ParserError:
                     _initial = None
-                field = forms.DateField(
-                    label=label, required=required,
-                    help_text=help_text,
-                    initial=_initial,
-                    widget=DatePickerWidget(attrs),
-                )
-                if q.valid_date_min:
-                    field.validators.append(MinDateValidator(q.valid_date_min))
-                if q.valid_date_max:
-                    field.validators.append(MaxDateValidator(q.valid_date_max))
-            elif q.type == Question.TYPE_TIME:
-                if initial and initial.answer:
-                    try:
-                        _initial = dateutil.parser.parse(initial.answer).time()
-                    except dateutil.parser.ParserError:
-                        _initial = None
-                else:
+            else:
+                _initial = None
+            field = forms.DateField(
+                label=escape(q.question), required=required,
+                help_text=rich_text(help_text),
+                initial=_initial,
+                widget=DatePickerWidget(attrs),
+            )
+            if q.valid_date_min:
+                field.validators.append(MinDateValidator(q.valid_date_min))
+            if q.valid_date_max:
+                field.validators.append(MaxDateValidator(q.valid_date_max))
+        elif q.type == Question.TYPE_TIME:
+            if initial and initial.answer:
+                try:
+                    _initial = dateutil.parser.parse(initial.answer).time()
+                except dateutil.parser.ParserError:
                     _initial = None
-                field = forms.TimeField(
-                    label=label, required=required,
-                    help_text=help_text,
-                    initial=_initial,
-                    widget=TimePickerWidget(without_seconds=True),
-                )
-            elif q.type == Question.TYPE_DATETIME:
-                if not help_text:
-                    if q.valid_datetime_min and q.valid_datetime_max:
-                        help_text = format_lazy(
-                            _('Please enter a date and time between {min} and {max}.'),
-                            min=date_format(q.valid_datetime_min, "SHORT_DATETIME_FORMAT"),
-                            max=date_format(q.valid_datetime_max, "SHORT_DATETIME_FORMAT"),
-                        )
-                    elif q.valid_datetime_min:
-                        help_text = format_lazy(
-                            _('Please enter a date and time no earlier than {min}.'),
-                            min=date_format(q.valid_datetime_min, "SHORT_DATETIME_FORMAT"),
-                        )
-                    elif q.valid_datetime_max:
-                        help_text = format_lazy(
-                            _('Please enter a date and time no later than {max}.'),
-                            max=date_format(q.valid_datetime_max, "SHORT_DATETIME_FORMAT"),
-                        )
+            else:
+                _initial = None
+            field = forms.TimeField(
+                label=escape(q.question), required=required,
+                help_text=rich_text(q.help_text),
+                initial=_initial,
+                widget=TimePickerWidget(without_seconds=True),
+            )
+        elif q.type == Question.TYPE_DATETIME:
+            help_text = q.help_text
+            if not help_text:
+                if q.valid_datetime_min and q.valid_datetime_max:
+                    help_text = format_lazy(
+                        _('Please enter a date and time between {min} and {max}.'),
+                        min=date_format(q.valid_datetime_min, "SHORT_DATETIME_FORMAT"),
+                        max=date_format(q.valid_datetime_max, "SHORT_DATETIME_FORMAT"),
+                    )
+                elif q.valid_datetime_min:
+                    help_text = format_lazy(
+                        _('Please enter a date and time no earlier than {min}.'),
+                        min=date_format(q.valid_datetime_min, "SHORT_DATETIME_FORMAT"),
+                    )
+                elif q.valid_datetime_max:
+                    help_text = format_lazy(
+                        _('Please enter a date and time no later than {max}.'),
+                        max=date_format(q.valid_datetime_max, "SHORT_DATETIME_FORMAT"),
+                    )
 
-                if initial and initial.answer:
-                    try:
-                        _initial = dateutil.parser.parse(initial.answer).astimezone(tz)
-                    except dateutil.parser.ParserError:
-                        _initial = None
-                else:
+            if initial and initial.answer:
+                try:
+                    _initial = dateutil.parser.parse(initial.answer).astimezone(tz)
+                except dateutil.parser.ParserError:
                     _initial = None
+            else:
+                _initial = None
 
-                field = SplitDateTimeField(
-                    label=label, required=required,
-                    help_text=help_text,
-                    initial=_initial,
-                    widget=SplitDateTimePickerWidget(
-                        time_format=get_format_without_seconds('TIME_INPUT_FORMATS'),
-                        min_date=q.valid_datetime_min,
-                        max_date=q.valid_datetime_max
-                    ),
-                )
-                if q.valid_datetime_min:
-                    field.validators.append(MinDateTimeValidator(q.valid_datetime_min))
-                if q.valid_datetime_max:
-                    field.validators.append(MaxDateTimeValidator(q.valid_datetime_max))
-            elif q.type == Question.TYPE_PHONENUMBER:
-                if initial:
-                    try:
-                        initial = PhoneNumber().from_string(initial.answer)
-                    except NumberParseException:
-                        initial = None
+            field = SplitDateTimeField(
+                label=escape(q.question), required=required,
+                help_text=rich_text(help_text),
+                initial=_initial,
+                widget=SplitDateTimePickerWidget(
+                    time_format=get_format_without_seconds('TIME_INPUT_FORMATS'),
+                    min_date=q.valid_datetime_min,
+                    max_date=q.valid_datetime_max
+                ),
+            )
+            if q.valid_datetime_min:
+                field.validators.append(MinDateTimeValidator(q.valid_datetime_min))
+            if q.valid_datetime_max:
+                field.validators.append(MaxDateTimeValidator(q.valid_datetime_max))
+        elif q.type == Question.TYPE_PHONENUMBER:
+            if initial:
+                try:
+                    initial = PhoneNumber().from_string(initial.answer)
+                except NumberParseException:
+                    initial = None
 
-                if not initial:
-                    phone_prefix = guess_phone_prefix_from_request(request, event)
-                    if phone_prefix:
-                        initial = "+{}.".format(phone_prefix)
+            if not initial:
+                phone_prefix = guess_phone_prefix_from_request(request, event)
+                if phone_prefix:
+                    initial = "+{}.".format(phone_prefix)
 
-                field = PhoneNumberField(
-                    label=label, required=required,
-                    help_text=help_text,
-                    # We now exploit an implementation detail in PhoneNumberPrefixWidget to allow us to pass just
-                    # a country code but no number as an initial value. It's a bit hacky, but should be stable for
-                    # the future.
-                    initial=initial,
-                    widget=WrappedPhoneNumberPrefixWidget()
-                )
-            field.question = q
-            if answers:
-                # Cache the answer object for later use
-                field.answer = answers[0]
+            field = PhoneNumberField(
+                label=escape(q.question), required=required,
+                help_text=rich_text(q.help_text),
+                # We now exploit an implementation detail in PhoneNumberPrefixWidget to allow us to pass just
+                # a country code but no number as an initial value. It's a bit hacky, but should be stable for
+                # the future.
+                initial=initial,
+                widget=WrappedPhoneNumberPrefixWidget()
+            )
+        field.question = q
+        if answers:
+            # Cache the answer object for later use
+            field.answer = answers[0]
 
-            if q.dependency_question_id:
-                field.widget.attrs['data-question-dependency'] = q.dependency_question_id
-                field.widget.attrs['data-question-dependency-values'] = escapejson_attr(json.dumps(q.dependency_values))
-                if q.type != 'M':
-                    field.widget.attrs['required'] = q.required and not self.all_optional
-                    field._required = q.required and not self.all_optional
-                field.required = False
-
-            add_fields['question_%s' % q.id] = field
-            field_positions.append(('question_%s' % q.id, q.position))
-
-        field_positions.sort(key=lambda e: e[1])
-        for fname, p in field_positions:
-            self.fields[fname] = add_fields[fname]
-
-        responses = question_form_fields.send(sender=event, position=pos)
-        data = pos.meta_info_data
-        for r, response in sorted(responses, key=lambda r: str(r[0])):
-            for key, value in response.items():
-                # We need to be this explicit, since OrderedDict.update does not retain ordering
-                self.fields[key] = value
-                value.initial = data.get('question_form_data', {}).get(key)
-
-        for k, v in self.fields.items():
-            if isinstance(v.widget, forms.MultiWidget):
-                for w in v.widget.widgets:
-                    autocomplete = w.attrs.get('autocomplete', '')
-                    if autocomplete.strip() == "off":
-                        w.attrs['autocomplete'] = 'off'
-                    else:
-                        w.attrs['autocomplete'] = 'section-{} '.format(self.prefix) + autocomplete
-            if v.widget.attrs.get('autocomplete') or k == 'attendee_name_parts':
-                autocomplete = v.widget.attrs.get('autocomplete', '')
-                if autocomplete.strip() == "off":
-                    v.widget.attrs['autocomplete'] = 'off'
-                else:
-                    v.widget.attrs['autocomplete'] = 'section-{} '.format(self.prefix) + autocomplete
-
-    def clean(self):
-        from pretix.base.addressvalidation import \
-            validate_address  # local import to prevent impact on startup time
-
-        d = super().clean()
-
-        if self.address_validation:
-            self.cleaned_data = d = validate_address(d, all_optional=not self.attendee_addresses_required)
-
-        if d.get('street') and d.get('country') and str(d['country']) in COUNTRIES_WITH_STATE_IN_ADDRESS:
-            if not d.get('state'):
-                self.add_error('state', _('This field is required.'))
+        if q.dependency_question_id:
+            field.widget.attrs['data-question-dependency'] = q.dependency_question_id
+            field.widget.attrs['data-question-dependency-values'] = escapejson_attr(json.dumps(q.dependency_values))
+            if q.type != 'M':
+                field.widget.attrs['required'] = q.required and not self.all_optional
+                field._required = q.required and not self.all_optional
+            field.required = False
+        return field
 
+    def check_user_questions(self, d):
         question_cache = {f.question.pk: f.question for f in self.fields.values() if getattr(f, 'question', None)}
 
         def question_is_visible(parentid, qvals):
@@ -1123,6 +946,268 @@ class BaseQuestionsForm(forms.Form):
                 if 'question_%d' % q.pk in d and d['question_%d' % q.pk] is False:
                     d['question_%d' % q.pk] = None
 
+
+class OrderLevelQuestionsForm(BaseQuestionsForm):
+    def __init__(self, container, *args, **kwargs):
+        """
+        Takes two additional keyword arguments:
+
+        :param checkoutsession: The checkout session the form should be for
+        :param order: The order the form should be for
+        :param event: The event this belongs to
+        """
+        request = kwargs.pop('request', None)
+        event = kwargs.pop('event')
+        self.all_optional = kwargs.pop('all_optional', False)
+
+        super().__init__(*args, **kwargs)
+
+        questions = Question.objects.filter(
+            event=event, container_type=Question.ContainerType.ORDER,
+            ask_during_checkin=False, hidden=False,
+        ).order_by('position')
+        answerlist = container.answers.prefetch_related('options')
+
+        for q in questions:
+            self.fields['question_%s' % q.id] = self.build_user_question_field(request, event, answerlist, q)
+
+    def clean(self):
+        d = super().clean()
+        self.check_user_questions(d)
+        return d
+
+
+class TicketLevelQuestionsForm(BaseQuestionsForm):
+    """
+    This form class is responsible for asking ticket-related questions. This includes
+    the attendee name for admission tickets, if the corresponding setting is enabled,
+    as well as additional questions defined by the organizer.
+    """
+
+    def __init__(self, *args, **kwargs):
+        """
+        Takes two additional keyword arguments:
+
+        :param cartpos: The cart position the form should be for
+        :param event: The event this belongs to
+        """
+        request = kwargs.pop('request', None)
+        cartpos = self.cartpos = kwargs.pop('cartpos', None)
+        orderpos = self.orderpos = kwargs.pop('orderpos', None)
+        pos = cartpos or orderpos
+        item = pos.item
+        event = kwargs.pop('event')
+        self.all_optional = kwargs.pop('all_optional', False)
+        self.attendee_addresses_required = event.settings.attendee_addresses_required and not self.all_optional
+
+        super().__init__(*args, **kwargs)
+
+        if cartpos and item.validity_mode == Item.VALIDITY_MODE_DYNAMIC and item.validity_dynamic_start_choice:
+            self.fields['requested_valid_from'] = self.build_requested_valid_from_field(event, pos, item)
+
+        questions = []
+        if item.ask_attendee_data:
+            questions += get_fake_attendee_questions(event.settings)
+        questions += pos.item.questions_to_ask
+
+        questions.sort(key=lambda q: q.position)
+
+        for q in questions:
+            if isinstance(q, FakeQuestion):
+                self.fields[q.id] = self.build_system_question_field(request, event, pos, q)
+            else:
+                self.fields['question_%s' % q.id] = self.build_user_question_field(request, event, pos.answerlist, q)
+
+        responses = question_form_fields.send(sender=event, position=pos)
+        data = pos.meta_info_data
+        for r, response in sorted(responses, key=lambda r: str(r[0])):
+            for key, value in response.items():
+                # We need to be this explicit, since OrderedDict.update does not retain ordering
+                self.fields[key] = value
+                value.initial = data.get('question_form_data', {}).get(key)
+
+        for k, v in self.fields.items():
+            if isinstance(v.widget, forms.MultiWidget):
+                for w in v.widget.widgets:
+                    autocomplete = w.attrs.get('autocomplete', '')
+                    if autocomplete.strip() == "off":
+                        w.attrs['autocomplete'] = 'off'
+                    else:
+                        w.attrs['autocomplete'] = 'section-{} '.format(self.prefix) + autocomplete
+            if v.widget.attrs.get('autocomplete') or k == 'attendee_name_parts':
+                autocomplete = v.widget.attrs.get('autocomplete', '')
+                if autocomplete.strip() == "off":
+                    v.widget.attrs['autocomplete'] = 'off'
+                else:
+                    v.widget.attrs['autocomplete'] = 'section-{} '.format(self.prefix) + autocomplete
+
+    def build_requested_valid_from_field(self, event, pos, item):
+        if item.validity_dynamic_start_choice_day_limit:
+            max_date = time_machine_now().astimezone(event.timezone) + timedelta(days=item.validity_dynamic_start_choice_day_limit)
+        else:
+            max_date = None
+        min_date = time_machine_now()
+        initial = None
+        if (item.require_membership or (pos.variation and pos.variation.require_membership)) and pos.used_membership:
+            if pos.used_membership.date_start >= time_machine_now():
+                initial = min_date = pos.used_membership.date_start
+            max_date = min(max_date, pos.used_membership.date_end) if max_date else pos.used_membership.date_end
+        if item.validity_dynamic_duration_months or item.validity_dynamic_duration_days:
+            attrs = {}
+            if max_date:
+                attrs['data-max'] = max_date.date().isoformat()
+            if min_date:
+                attrs['data-min'] = min_date.date().isoformat()
+            return forms.DateField(
+                label=_('Start date'),
+                help_text='' if initial else _('If you keep this empty, the ticket will be valid starting at the time of purchase.'),
+                required=bool(initial),
+                initial=pos.requested_valid_from or initial,
+                widget=DatePickerWidget(attrs),
+                validators=([MaxDateValidator(max_date.date())] if max_date else []) + [MinDateValidator(min_date.date())]
+            )
+        else:
+            return forms.SplitDateTimeField(
+                label=_('Start date'),
+                help_text='' if initial else _('If you keep this empty, the ticket will be valid starting at the time of purchase.'),
+                required=bool(initial),
+                initial=pos.requested_valid_from or initial,
+                widget=SplitDateTimePickerWidget(
+                    time_format=get_format_without_seconds('TIME_INPUT_FORMATS'),
+                    min_date=min_date,
+                    max_date=max_date
+                ),
+                validators=([MaxDateTimeValidator(max_date)] if max_date else []) + [MinDateTimeValidator(min_date)]
+            )
+
+    def build_system_question_field(self, request, event, pos, qc):
+        field_name = qc.id
+        if field_name == 'attendee_name_parts':
+            return NamePartsFormField(
+                max_length=255,
+                required=qc.required and not self.all_optional,
+                scheme=event.settings.name_scheme,
+                titles=event.settings.name_scheme_titles,
+                label=escape(qc.question),
+                help_text=rich_text(qc.help_text),
+                initial=pos.attendee_name_parts,
+            )
+        if field_name == 'attendee_email':
+            return forms.EmailField(
+                required=qc.required and not self.all_optional,
+                label=escape(qc.question),
+                help_text=rich_text(qc.help_text),
+                initial=pos.attendee_email,
+                widget=forms.EmailInput(
+                    attrs={
+                        'autocomplete': 'email'
+                    }
+                )
+            )
+        if field_name == 'company':
+            return forms.CharField(
+                required=qc.required and not self.all_optional,
+                label=escape(qc.question),
+                help_text=rich_text(qc.help_text),
+                max_length=255,
+                initial=pos.company,
+            )
+
+        if field_name == 'street':
+            return forms.CharField(
+                required=qc.required and not self.all_optional,
+                label=escape(qc.question),
+                help_text=rich_text(qc.help_text),
+                widget=forms.Textarea(attrs={
+                    'rows': 2,
+                    'placeholder': _('Street and Number'),
+                    'autocomplete': 'street-address'
+                }),
+                initial=pos.street,
+            )
+        if field_name == 'zipcode':
+            return forms.CharField(
+                required=False,
+                max_length=30,
+                label=escape(qc.question),
+                help_text=rich_text(qc.help_text),
+                initial=pos.zipcode,
+                widget=forms.TextInput(attrs={
+                    'autocomplete': 'postal-code',
+                }),
+            )
+        if field_name == 'city':
+            return forms.CharField(
+                required=False,
+                label=escape(qc.question),
+                help_text=rich_text(qc.help_text),
+                max_length=255,
+                initial=pos.city,
+                widget=forms.TextInput(attrs={
+                    'autocomplete': 'address-level2',
+                }),
+            )
+        if field_name == 'country':
+            country = pos.country or guess_country_from_request(request, event)
+            return CountryField(
+                countries=CachedCountries
+            ).formfield(
+                required=qc.required and not self.all_optional,
+                label=escape(qc.question),
+                help_text=rich_text(qc.help_text),
+                initial=country,
+                widget=forms.Select(attrs={
+                    'autocomplete': 'country',
+                    'data-trigger-address-info': 'on',
+                }),
+            )
+        if field_name == 'state':
+            country = pos.country or guess_country_from_request(request, event)
+            c = [('', '---')]
+            fprefix = str(self.prefix) + '-' if self.prefix is not None and self.prefix != '-' else ''
+            cc = None
+            state = None
+            if fprefix + 'country' in self.data:
+                cc = str(self.data[fprefix + 'country'])
+            elif country:
+                cc = str(country)
+            if cc and cc in COUNTRIES_WITH_STATE_IN_ADDRESS:
+                types, form = COUNTRIES_WITH_STATE_IN_ADDRESS[cc]
+                statelist = [s for s in pycountry.subdivisions.get(country_code=cc) if s.type in types]
+                c += sorted([(s.code[3:], s.name) for s in statelist], key=lambda s: s[1])
+                state = (pos.state)
+            elif fprefix + 'state' in self.data:
+                self.data = self.data.copy()
+                del self.data[fprefix + 'state']
+
+            field = forms.ChoiceField(
+                label=escape(qc.question),
+                help_text=rich_text(qc.help_text),
+                required=False,
+                choices=c,
+                initial=state,
+                widget=forms.Select(attrs={
+                    'autocomplete': 'address-level1',
+                }),
+            )
+            field.widget.is_required = True
+            return field
+
+    def clean(self):
+        from pretix.base.addressvalidation import \
+            validate_address  # local import to prevent impact on startup time
+
+        d = super().clean()
+
+        if self.address_validation:
+            self.cleaned_data = d = validate_address(d, all_optional=not self.attendee_addresses_required)
+
+        if d.get('street') and d.get('country') and str(d['country']) in COUNTRIES_WITH_STATE_IN_ADDRESS:
+            if not d.get('state'):
+                self.add_error('state', _('This field is required.'))
+
+        self.check_user_questions(d)
+
         return d
 
 
@@ -1201,15 +1286,15 @@ class BaseInvoiceAddressForm(forms.ModelForm):
         if not self.ask_vat_id:
             del self.fields['vat_id']
         elif self.validate_vat_id:
-            self.fields['vat_id'].help_text = '<br/>'.join([
-                str(_('Optional, but depending on the country you reside in we might need to charge you '
-                      'additional taxes if you do not enter it.')),
-            ])
+            self.fields['vat_id'].help_text = _(
+                'Optional, but depending on the country you reside in we might need to charge you '
+                'additional taxes if you do not enter it.'
+            )
         else:
-            self.fields['vat_id'].help_text = '<br/>'.join([
-                str(_('Optional, but it might be required for you to claim tax benefits on your invoice '
-                      'depending on your and the seller’s country of residence.')),
-            ])
+            self.fields['vat_id'].help_text = _(
+                'Optional, but it might be required for you to claim tax benefits on your invoice '
+                'depending on your and the seller’s country of residence.'
+            )
 
         transmission_type_choices = [
             (t.identifier, t.public_name) for t in get_transmission_types()
@@ -1295,8 +1380,8 @@ class BaseInvoiceAddressForm(forms.ModelForm):
             del self.fields['beneficiary']
 
         if event.settings.invoice_address_custom_field:
-            self.fields['custom_field'].label = event.settings.invoice_address_custom_field
-            self.fields['custom_field'].help_text = event.settings.invoice_address_custom_field_helptext
+            self.fields['custom_field'].label = escape(event.settings.invoice_address_custom_field)
+            self.fields['custom_field'].help_text = rich_text(event.settings.invoice_address_custom_field_helptext)
         else:
             del self.fields['custom_field']
 

src/pretix/base/forms/widgets.py

@@ -47,6 +47,7 @@ from pretix.helpers.i18n import (
     get_format_without_seconds, get_javascript_format,
     get_javascript_format_without_seconds,
 )
+from pretix.helpers.safedownload import get_token
 
 
 def replace_arabic_numbers(inp):
@@ -157,36 +158,26 @@ class TimePickerWidget(forms.TimeInput):
 
 class UploadedFileWidget(forms.ClearableFileInput):
     def __init__(self, *args, **kwargs):
-        self.position = kwargs.pop('position')
-        self.event = kwargs.pop('event')
         self.answer = kwargs.pop('answer')
+        self.request = kwargs.pop('request')
         super().__init__(*args, **kwargs)
 
     class FakeFile:
-        def __init__(self, file, position, event, answer):
+        def __init__(self, file, answer, request):
             self.file = file
-            self.position = position
-            self.event = event
             self.answer = answer
+            self.request = request
 
         def __str__(self):
             return os.path.basename(self.file.name).split('.', 1)[-1]
 
         @property
         def url(self):
-            from pretix.base.models import OrderPosition
-            from pretix.multidomain.urlreverse import eventreverse
-
-            if isinstance(self.position, OrderPosition):
-                return eventreverse(self.event, 'presale:event.order.download.answer', kwargs={
-                    'order': self.position.order.code,
-                    'secret': self.position.order.secret,
-                    'answer': self.answer.pk,
-                })
+            token = get_token(self.request, self.answer)
+            if self.request.resolver_match.namespace == 'control':
+                return self.answer.backend_file_url + '?token=' + token
             else:
-                return eventreverse(self.event, 'presale:event.cart.download.answer', kwargs={
-                    'answer': self.answer.pk,
-                })
+                return self.answer.frontend_file_url + '?token=' + token
 
     def get_context(self, name, value, attrs):
         # Browsers can't recognize that the server already has a file uploaded
@@ -199,7 +190,7 @@ class UploadedFileWidget(forms.ClearableFileInput):
 
     def format_value(self, value):
         if self.is_initial(value):
-            return self.FakeFile(value, self.position, self.event, self.answer)
+            return self.FakeFile(value, self.answer, self.request)
 
 
 class SplitDateTimePickerWidget(forms.SplitDateTimeWidget):
@@ -314,3 +305,18 @@ class BusinessBooleanRadio(forms.RadioSelect):
             'False': False,
             False: False,
         }.get(value)
+
+
+class OptionAttrsSelect(forms.Select):
+    def __init__(self, *args, option_attrs=None, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.option_attrs = option_attrs or {}
+
+    def create_option(self, name, value, label, selected, index, subindex=None, attrs=None):
+        option = super().create_option(
+            name, value, label, selected, index, subindex=subindex, attrs=attrs
+        )
+        extra = self.option_attrs.get(str(value))
+        if extra:
+            option["attrs"].update(extra)
+        return option

src/pretix/base/migrations/0307_devicelastseen.py

@@ -0,0 +1,43 @@
+# Generated by Django 5.2.16 on 2026-08-05 08:00
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+import pretix.helpers.database
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("pretixbase", "0306_alter_eventmetaproperty_unique_together"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="DeviceLastSeen",
+            fields=[
+                (
+                    "id",
+                    models.BigAutoField(
+                        auto_created=True, primary_key=True, serialize=False
+                    ),
+                ),
+                ("last_seen", models.DateTimeField(auto_now=True)),
+                (
+                    "device",
+                    models.OneToOneField(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        to="pretixbase.device",
+                    ),
+                ),
+            ],
+        ),
+        migrations.AddIndex(
+            model_name="devicelastseen",
+            index=pretix.helpers.database.BrinIndexIgnoredOnSQLite(
+                models.F("last_seen"),
+                autosummarize=True,
+                name="pretixbase_device_last_seen",
+            ),
+        ),
+    ]

src/pretix/base/migrations/0308_checkoutsession_invoiceaddress_checkout_session.py

@@ -0,0 +1,63 @@
+# Generated by Django 4.2.17 on 2025-01-01 20:25
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("pretixbase", "0307_devicelastseen"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="CheckoutSession",
+            fields=[
+                (
+                    "id",
+                    models.BigAutoField(
+                        auto_created=True, primary_key=True, serialize=False
+                    ),
+                ),
+                ("cart_id", models.CharField(max_length=255, unique=True)),
+                ("created", models.DateTimeField(auto_now_add=True)),
+                ("testmode", models.BooleanField(default=False)),
+                ("session_data", models.JSONField(default=dict)),
+                (
+                    "customer",
+                    models.ForeignKey(
+                        null=True,
+                        on_delete=django.db.models.deletion.SET_NULL,
+                        related_name="checkout_sessions",
+                        to="pretixbase.customer",
+                    ),
+                ),
+                (
+                    "event",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="checkout_sessions",
+                        to="pretixbase.event",
+                    ),
+                ),
+                (
+                    "sales_channel",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        to="pretixbase.saleschannel",
+                    ),
+                ),
+            ],
+        ),
+        migrations.AddField(
+            model_name="invoiceaddress",
+            name="checkout_session",
+            field=models.OneToOneField(
+                null=True,
+                on_delete=django.db.models.deletion.CASCADE,
+                related_name="invoice_address",
+                to="pretixbase.checkoutsession",
+            ),
+        ),
+    ]

src/pretix/base/migrations/0309_alter_questionanswer_unique_together_and_more.py

@@ -0,0 +1,33 @@
+# Generated by Django 5.2.15 on 2026-08-07 20:01
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0308_checkoutsession_invoiceaddress_checkout_session'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='question',
+            name='container_type',
+            field=models.CharField(default='P', max_length=5),
+        ),
+        migrations.AddField(
+            model_name='questionanswer',
+            name='checkoutsession',
+            field=models.ForeignKey(null=True, on_delete=django.db.models.deletion.CASCADE, related_name='answers', to='pretixbase.checkoutsession'),
+        ),
+        migrations.AddField(
+            model_name='questionanswer',
+            name='order',
+            field=models.ForeignKey(null=True, on_delete=django.db.models.deletion.CASCADE, related_name='answers', to='pretixbase.order'),
+        ),
+        migrations.AlterUniqueTogether(
+            name='questionanswer',
+            unique_together={('cartposition', 'question'), ('checkoutsession', 'question'), ('order', 'question'), ('orderposition', 'question')},
+        ),
+    ]

src/pretix/base/models/customers.py

@@ -33,6 +33,7 @@ from django.db.models.aggregates import Sum
 from django.db.models.expressions import OuterRef, Subquery
 from django.db.models.functions.comparison import Coalesce
 from django.utils.crypto import get_random_string, salted_hmac
+from django.utils.functional import cached_property
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _, pgettext_lazy
 from django_scopes import ScopedManager, scopes_disabled
@@ -409,6 +410,17 @@ class AttendeeProfile(models.Model):
 
         return '\n'.join([str(p).strip() for p in parts if p and str(p).strip()])
 
+    @cached_property
+    def answers_key_to_index(self):
+        return {a.get('field_name'): i for i, a in enumerate(self.answers)}
+
+    def store_answer(self, answer_dict):
+        k = answer_dict['field_name']
+        if k in self.answers_key_to_index:
+            self.answers[self.answers_key_to_index[k]] = answer_dict
+        else:
+            self.answers.append(answer_dict)
+
 
 def generate_client_id():
     return get_random_string(40)

src/pretix/base/models/devices.py

@@ -20,11 +20,13 @@
 # <https://www.gnu.org/licenses/>.
 #
 import string
+from datetime import timedelta
 
 from django.core.exceptions import ValidationError
 from django.db import models
 from django.db.models import Max
 from django.utils.crypto import get_random_string
+from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 from django_scopes import ScopedManager, scopes_disabled
 
@@ -32,6 +34,7 @@ from pretix.base.models import LoggedModel
 from pretix.base.permissions import (
     AnyPermissionOf, assert_valid_event_permission,
 )
+from pretix.helpers import BrinIndexIgnoredOnSQLite
 
 
 @scopes_disabled()
@@ -287,3 +290,27 @@ class Device(LoggedModel):
             return self.get_events_with_any_permission()
         else:
             return self.organizer.events.none()
+
+
+class DeviceLastSeen(models.Model):
+    # This is a separate model since we expect it to get A LOT of writes and PostgreSQL always
+    # writes full rows and then needs to update all indexes on the row, so this is going to save a
+    # lot of write traffic on the databse
+    device = models.OneToOneField("Device", on_delete=models.CASCADE, related_name="last_seen")
+    last_seen = models.DateTimeField(auto_now=True)
+
+    class Meta:
+        indexes = [
+            BrinIndexIgnoredOnSQLite(
+                # BRIN indexes are highly efficient on lots of updates, especially of chronological data
+                # and especially if we later want to query them by range, as we likely want to.
+                "last_seen",
+                name="pretixbase_device_last_seen",
+                autosummarize=True
+            )
+        ]
+
+    @property
+    def is_recent(self):
+        # pretixSCAN/pretixPOS sync every 5 minutes, so 7 minutes can be considered "offline"
+        return now() - self.last_seen < timedelta(minutes=7)

src/pretix/base/models/event.py

@@ -736,7 +736,7 @@ class Event(EventMixin, LoggedModel):
         self.settings.mail_send_order_paid_attendee = True
         self.settings.mail_send_order_approved_attendee = True
         self.settings.mail_send_order_approved_free_attendee = True
-        self.settings.mail_text_download_reminder_attendee = True
+        self.settings.mail_send_download_reminder_attendee = True
 
     @property
     def social_image(self):

src/pretix/base/models/items.py

@@ -1606,6 +1606,9 @@ class Question(LoggedModel):
     :param dependency_values: The values that `dependency_question` needs to be set to for this question to be applicable.
     :type dependency_values: list[str]
     """
+    class ContainerType(models.TextChoices):
+        ORDER = "O", _("Order")
+        ORDERPOSITION = "P", _("Order position")
     TYPE_NUMBER = "N"
     TYPE_STRING = "S"
     TYPE_TEXT = "T"
@@ -1641,6 +1644,12 @@ class Question(LoggedModel):
         related_name="questions",
         on_delete=models.CASCADE
     )
+    container_type = models.CharField(
+        max_length=5,
+        choices=ContainerType.choices,
+        verbose_name=_("Asked on"),
+        default=ContainerType.ORDERPOSITION,
+    )
     question = I18nTextField(
         verbose_name=_("Question")
     )

src/pretix/base/models/orders.py

@@ -1304,10 +1304,9 @@ class Order(LockModel, LoggedModel):
 
 def answerfile_name(instance, filename: str) -> str:
     secret = get_random_string(length=32, allowed_chars=string.ascii_letters + string.digits)
-    event = (instance.cartposition if instance.cartposition else instance.orderposition.order).event
     return 'cachedfiles/answers/{org}/{ev}/{secret}.{filename}'.format(
-        org=event.organizer.slug,
-        ev=event.slug,
+        org=instance.event.organizer.slug,
+        ev=instance.event.slug,
         secret=secret,
         filename=escape_uri_path(filename),
     )
@@ -1336,6 +1335,14 @@ class QuestionAnswer(models.Model):
         'CartPosition', null=True, blank=True,
         related_name='answers', on_delete=models.CASCADE
     )
+    order = models.ForeignKey(
+        'Order', null=True, blank=True,
+        related_name='answers', on_delete=models.CASCADE
+    )
+    checkoutsession = models.ForeignKey(
+        'CheckoutSession', null=True, blank=True,
+        related_name='answers', on_delete=models.CASCADE
+    )
     question = models.ForeignKey(
         Question, related_name='answers', on_delete=models.CASCADE
     )
@@ -1351,16 +1358,21 @@ class QuestionAnswer(models.Model):
     objects = ScopedManager(organizer='question__event__organizer')
 
     class Meta:
-        unique_together = [['orderposition', 'question'], ['cartposition', 'question']]
+        unique_together = [
+            ['orderposition', 'question'],
+            ['cartposition', 'question'],
+            ['order', 'question'],
+            ['checkoutsession', 'question'],
+        ]
 
     @property
     def backend_file_url(self):
         if self.file:
-            if self.orderposition:
+            if self.associated_order:
                 return reverse('control:event.order.download.answer', kwargs={
-                    'code': self.orderposition.order.code,
-                    'event': self.orderposition.order.event.slug,
-                    'organizer': self.orderposition.order.event.organizer.slug,
+                    'code': self.associated_order.code,
+                    'event': self.associated_order.event.slug,
+                    'organizer': self.associated_order.event.organizer.slug,
                     'answer': self.pk,
                 })
         return ""
@@ -1370,14 +1382,14 @@ class QuestionAnswer(models.Model):
         from pretix.multidomain.urlreverse import eventreverse
 
         if self.file:
-            if self.orderposition:
-                url = eventreverse(self.orderposition.order.event, 'presale:event.order.download.answer', kwargs={
-                    'order': self.orderposition.order.code,
-                    'secret': self.orderposition.order.secret,
+            if self.associated_order:
+                url = eventreverse(self.associated_order.event, 'presale:event.order.download.answer', kwargs={
+                    'order': self.associated_order.code,
+                    'secret': self.associated_order.secret,
                     'answer': self.pk,
                 })
             else:
-                url = eventreverse(self.cartposition.event, 'presale:event.cart.download.answer', kwargs={
+                url = eventreverse(self.event, 'presale:event.cart.download.answer', kwargs={
                     'answer': self.pk,
                 })
 
@@ -1392,6 +1404,24 @@ class QuestionAnswer(models.Model):
     def file_name(self):
         return self.file.name.split('.', 1)[-1]
 
+    @property
+    def associated_order(self):
+        if self.orderposition:
+            return self.orderposition.order
+        elif self.order:
+            return self.order
+
+    @property
+    def event(self):
+        if self.orderposition:
+            return self.orderposition.order.event
+        elif self.cartposition:
+            return self.cartposition.event
+        elif self.order:
+            return self.order.event
+        elif self.checkoutsession:
+            return self.checkoutsession.event
+
     def __str__(self):
         return self.to_string(use_cached=True)
 
@@ -3177,6 +3207,39 @@ class Transaction(models.Model):
         return self.tax_value_includes_rounding_correction * self.count
 
 
+class CheckoutSession(models.Model):
+    """
+    A checkout session optionally bundles cart positions with additional information. This is historically
+    not required in pretix and currently only used in the Storefront API.
+    """
+    event = models.ForeignKey(
+        Event,
+        verbose_name=_("Event"),
+        related_name="checkout_sessions",
+        on_delete=models.CASCADE,
+    )
+    cart_id = models.CharField(
+        max_length=255, unique=True,
+        verbose_name=_("Cart ID (e.g. session key)"),
+    )
+    created = models.DateTimeField(
+        verbose_name=_("Date"),
+        auto_now_add=True,
+    )
+    customer = models.ForeignKey(
+        Customer,
+        related_name='checkout_sessions',
+        null=True, blank=True,
+        on_delete=models.SET_NULL,
+    )
+    sales_channel = models.ForeignKey(
+        "SalesChannel",
+        on_delete=models.CASCADE,
+    )
+    testmode = models.BooleanField(default=False)
+    session_data = models.JSONField(default=dict)
+
+
 class CartPosition(AbstractPosition):
     """
     A cart position is similar to an order line, except that it is not
@@ -3381,6 +3444,13 @@ class CartPosition(AbstractPosition):
 
 class InvoiceAddress(models.Model):
     last_modified = models.DateTimeField(auto_now=True)
+    checkout_session = models.OneToOneField(
+        CheckoutSession,
+        null=True,
+        blank=True,
+        related_name='invoice_address',
+        on_delete=models.CASCADE
+    )
     order = models.OneToOneField(Order, null=True, blank=True, related_name='invoice_address', on_delete=models.CASCADE)
     customer = models.ForeignKey(
         Customer,

src/pretix/base/payment.py

@@ -330,9 +330,24 @@ class BasePaymentProvider:
         payment method. This returns ``False`` by default which is no guarantee that
         aborting a pending payment can never happen, it just hides the frontend button
         to avoid users accidentally committing double payments.
+        If the decision doesn't depend on the specific payment, then only implementing
+        ``abort_pending_allowed`` is enough, ``payment_abort_pending_allowed(payment: OrderPayment)``
+        is expected to take this into account.
+        As a consumer only evaluate ``payment_abort_pending_allowed(payment: OrderPayment)``
+        to check if aborting this pending payment is possible.
         """
         return False
 
+    def _payment_abort_pending_allowed(self, payment: OrderPayment) -> bool:
+        """
+        Experimental: This might change during upcomming releases.
+        Whether or not a user can abort a payment in pending state to switch to another
+        payment method. This returns ``self.abort_pending_allowed`` by default which is
+        no guarantee that aborting a pending payment can never happen, it just hides the
+        frontend button to avoid users accidentally committing double payments.
+        """
+        return self.abort_pending_allowed
+
     @property
     def requires_invoice_immediately(self):
         """
@@ -1019,10 +1034,12 @@ class BasePaymentProvider:
         On success, you should set ``payment.state = OrderPayment.PAYMENT_STATE_CANCELED`` (or call the super method).
         On failure, you should raise a PaymentException.
         """
-        if payment.state == OrderPayment.PAYMENT_STATE_PENDING and not self.abort_pending_allowed:
-            raise PaymentException(_(
-                "This payment is already being processed and can not be canceled any more."
-            ))
+
+        if payment.state == OrderPayment.PAYMENT_STATE_PENDING:
+            if not self._payment_abort_pending_allowed(payment):
+                raise PaymentException(_(
+                    "This payment is already being processed and cannot be canceled any more."
+                ))
 
         payment.state = OrderPayment.PAYMENT_STATE_CANCELED
         payment.save(update_fields=['state'])

src/pretix/base/reldate.py

@@ -19,30 +19,245 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
+import copy
 import datetime
+import os
+import warnings
 from collections import namedtuple
-from typing import Union
+from dataclasses import dataclass
+from typing import (
+    TYPE_CHECKING, Iterable, List, Literal, Optional, Tuple, Union, cast,
+)
 from zoneinfo import ZoneInfo
 
 from dateutil import parser
 from django import forms
 from django.core.exceptions import ValidationError
 from django.db import models
+from django.forms.widgets import Widget
 from django.utils.formats import get_format
-from django.utils.functional import lazy
+from django.utils.functional import Promise, lazy
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 from rest_framework import serializers
 
-BASE_CHOICES = (
-    ('date_from', _('Event start')),
-    ('date_to', _('Event end')),
-    ('date_admission', _('Event admission')),
-    ('presale_start', _('Presale start')),
-    ('presale_end', _('Presale end')),
-)
+from pretix.base.forms.widgets import OptionAttrsSelect
 
-RelativeDate = namedtuple('RelativeDate', ['days', 'minutes', 'time', 'is_after', 'base_date_name'], defaults=(0, None, None, False, 'date_from'))
+if TYPE_CHECKING:
+    from .models import Event, Order, SubEvent
+
+
+@dataclass(frozen=True)
+class BaseChoice:
+    base: Literal["event", "order"]
+    attribute: str
+    text: Promise
+    supports_before: bool
+    supports_after: bool
+
+    @property
+    def key(self) -> str:
+        key = f"{self.base}__{self.attribute}"
+        return key
+
+    @staticmethod
+    def find(objects: Iterable["BaseChoice"], key: str) -> "BaseChoice":
+        if "__" in key:
+            choice = next((obj for obj in objects if obj.key == key), None)
+        else:
+            # fallback for RelativeDateFields stored, before support for bases other than event was added
+            choice = next((obj for obj in objects if obj.attribute == key and obj.base == "event"), None)
+
+        if choice is None:
+            raise TypeError(f"key {key} must be a valid key in BASE_CHOICES")
+
+        return choice
+
+
+BASE_CHOICES: List[BaseChoice] = [
+    BaseChoice('event', 'date_from', _('Event start'), True, True),
+    BaseChoice('event', 'date_to', _('Event end'), True, True),
+    BaseChoice('event', 'date_admission', _('Event admission'), True, True),
+    BaseChoice('event', 'presale_start', _('Presale start'), True, True),
+    BaseChoice('event', 'presale_end', _('Presale end'), True, True),
+    BaseChoice('order', 'datetime', _('Order creation'), False, True),
+    BaseChoice('order', 'expires', _('Order expiry'), True, True),
+]
+
+EVENT_BASE_CHOICES = [
+    x for x in BASE_CHOICES if x.base == 'event'
+]
+
+ORDER_BASE_CHOICES = [
+    x for x in BASE_CHOICES if x.base == 'order'
+]
+
+
+@dataclass(frozen=True)
+class RelativeDate:
+    """
+    This contains information on a date that is defined in relation to a fixed base point.
+    This means that the underlying data is a fixed date as the base point and a number of days or a time interval
+    to calculate the date.
+
+    The list of valid base date choices is defined in BASE_CHOICES.
+    If the base_date_name is not set, the date_from attribute of Event is used.
+    """
+
+    days: int = 0
+    minutes: Optional[int] = None
+    time: Optional[datetime.time] = None
+    is_after: bool = False
+    base_date_name: str = 'event__date_from__'
+
+    def __post_init__(self) -> None:
+        if self.is_after and not self._choice.supports_after:
+            raise ValueError(
+                "The selected base date and attribute combination does not support relative dates placed after the base date"
+            )
+        if not self.is_after and not self._choice.supports_before:
+            raise ValueError(
+                "The selected base date and attribute combination does not support relative dates placed before the base date")
+
+    @property
+    def _choice(self):
+        return BaseChoice.find(BASE_CHOICES, self.base_date_name)
+
+    @property
+    def key(self):
+        return self._choice.key
+
+    def __eq__(self, o: object) -> bool:
+        if not isinstance(o, RelativeDate):
+            return False
+        return self.to_string() == o.to_string()
+
+    def _resolve_date(self, base: "Event | Order | SubEvent") -> Tuple[datetime.datetime, ZoneInfo]:
+        """
+        Resolves the datetime and timezone information of this RelativeDate object in relation to the provided reference.
+
+        :param base: the reference which should be used to resolve the relative date
+        :return:
+        """
+        from .models import Event, Order, SubEvent
+
+        choice = self._choice
+
+        if choice.base == "order" and isinstance(base, Order):
+            event = base.event
+            base_date = getattr(base, choice.attribute)
+        elif choice.base == "event" and isinstance(base, SubEvent):
+            event = base.event
+            base_date = (getattr(base, choice.attribute) or
+                         getattr(base.event, choice.attribute) or
+                         base.date_from)
+        elif choice.base == "event" and isinstance(base, Event):
+            event = base
+            base_date = getattr(base, choice.attribute) or event.date_from
+        else:
+            raise TypeError("The base defined by data does not match the passed in base")
+
+        tz = ZoneInfo(event.settings.timezone)
+        return base_date, tz
+
+    def date(self, base: "Event | Order | SubEvent") -> datetime.date:
+        """
+        Resolves the effective date of this RelativeDate object in relation to the provided reference.
+
+        :param base: the reference which should be used to resolve the date
+        :return: datetime.date
+        """
+        if self.minutes is not None:
+            raise ValueError('A minute-based relative datetime can not be used as a date')
+
+        base_date, tz = self._resolve_date(base)
+
+        if self.is_after:
+            new_date = base_date.astimezone(tz) + datetime.timedelta(days=self.days)
+        else:
+            new_date = base_date.astimezone(tz) - datetime.timedelta(days=self.days)
+        return new_date.date()
+
+    def datetime(self, base: "Event | Order | SubEvent") -> datetime.datetime:
+        """
+        Resolves the effective datetime of this RelativeDate object in relation to the provided reference.
+
+        :param base: the reference which should be used to resolve the datetime
+        :return: datetime.datetime
+        """
+        base_date, tz = self._resolve_date(base)
+
+        if self.minutes is not None:
+            if self.is_after:
+                return base_date.astimezone(tz) + datetime.timedelta(minutes=self.minutes)
+            else:
+                return base_date.astimezone(tz) - datetime.timedelta(minutes=self.minutes)
+        else:
+            if self.is_after:
+                new_date = (base_date.astimezone(tz) + datetime.timedelta(days=self.days)).astimezone(tz)
+            else:
+                new_date = (base_date.astimezone(tz) - datetime.timedelta(days=self.days)).astimezone(tz)
+            if self.time:
+                new_date = new_date.replace(
+                    hour=self.time.hour,
+                    minute=self.time.minute,
+                    second=self.time.second
+                )
+            new_date = new_date.astimezone(tz)
+            return new_date
+
+    def to_string(self) -> str:
+        if self.minutes is not None:
+            return 'RELDATE/minutes/{}/{}/{}'.format(  #
+                self.minutes,
+                self._choice.key,
+                'after' if self.is_after else '',
+            )
+        return 'RELDATE/{}/{}/{}/{}'.format(  #
+            self.days,
+            self.time.strftime('%H:%M:%S') if self.time else '-',
+            self._choice.key,
+            'after' if self.is_after else '',
+        )
+
+    @classmethod
+    def from_string(cls, input: str):
+        if not input.startswith('RELDATE/'):
+            raise TypeError("Invalid input for RelativeDate.from_string()")
+
+        parts = input.split('/')
+        if parts[1] == 'minutes':
+            data = RelativeDate(
+                days=0,
+                minutes=int(parts[2]),
+                base_date_name=parts[3],
+                time=None,
+                is_after=len(parts) > 4 and parts[4] == "after",
+            )
+        else:
+            if parts[2] == '-':
+                time = None
+            else:
+                timeparts = parts[2].split(':')
+                time = datetime.time(hour=int(timeparts[0]), minute=int(timeparts[1]), second=int(timeparts[2]))
+            try:
+                data = RelativeDate(
+                    days=int(parts[1] or 0),
+                    base_date_name=parts[3],
+                    time=time,
+                    minutes=None,
+                    is_after=len(parts) > 4 and parts[4] == "after",
+                )
+            except ValueError:
+                data = RelativeDate(
+                    days=0,
+                    base_date_name=parts[3],
+                    time=time,
+                    minutes=None,
+                    is_after=len(parts) > 4 and parts[4] == "after",
+                )
+
+        return data
 
 
 class RelativeDateWrapper:
@@ -50,130 +265,53 @@ class RelativeDateWrapper:
     This contains information on a date that might be relative to an event. This means
     that the underlying data is either a fixed date or a number of days and a wall clock
     time to calculate the date based on a base point.
-
-    The base point can be the date_from, date_to, date_admission, presale_start or presale_end
-    attribute of an event or subevent. If the respective attribute is not set, ``date_from``
-    will be used.
     """
 
     def __init__(self, data: Union[datetime.datetime, RelativeDate]):
         self.data = data
 
-    def date(self, event) -> datetime.date:
-        from .models import SubEvent
+    def date(self, base: "Event | Order | SubEvent") -> datetime.date:
+        """
+        If the RelativeDateWrapper wraps a RelativeDate object:
+            Resolves the effective date of this object in relation to the provided reference.
+        If the RelativeDateWrapper wraps an absolute date or datetime:
+            Returns the wrapped absolute date.
 
+        :param base: the reference which should be used to resolve the date in case it is a relative date.
+        :return: datetime.date
+        """
         if isinstance(self.data, datetime.datetime):
             return self.data.date()
         elif isinstance(self.data, datetime.date):
             return self.data
         else:
-            if self.data.minutes is not None:
-                raise ValueError('A minute-based relative datetime can not be used as a date')
+            return self.data.date(base)
 
-            tz = ZoneInfo(event.settings.timezone)
-            if isinstance(event, SubEvent):
-                base_date = (
-                    getattr(event, self.data.base_date_name)
-                    or getattr(event.event, self.data.base_date_name)
-                    or event.date_from
-                )
-            else:
-                base_date = getattr(event, self.data.base_date_name) or event.date_from
-
-            if self.data.is_after:
-                new_date = base_date.astimezone(tz) + datetime.timedelta(days=self.data.days)
-            else:
-                new_date = base_date.astimezone(tz) - datetime.timedelta(days=self.data.days)
-            return new_date.date()
-
-    def datetime(self, event) -> datetime.datetime:
-        from .models import SubEvent
+    def datetime(self, base: "Event | Order | SubEvent") -> datetime.datetime:
+        """
+        If the RelativeDateWrapper wraps a RelativeDate object:
+            Resolves the effective datetime of this object in relation to the provided reference.
+        If the RelativeDateWrapper wraps an absolute date or datetime:
+            Returns the wrapped absolute datetime.
 
+        :param base: the reference which should be used to resolve the datetime in case it is a relative datetime.
+        :return: datetime.datetime
+        """
         if isinstance(self.data, (datetime.datetime, datetime.date)):
             return self.data
         else:
-            tz = ZoneInfo(event.settings.timezone)
-            if isinstance(event, SubEvent):
-                base_date = (
-                    getattr(event, self.data.base_date_name)
-                    or getattr(event.event, self.data.base_date_name)
-                    or event.date_from
-                )
-            else:
-                base_date = getattr(event, self.data.base_date_name) or event.date_from
-
-            if self.data.minutes is not None:
-                if self.data.is_after:
-                    return base_date.astimezone(tz) + datetime.timedelta(minutes=self.data.minutes)
-                else:
-                    return base_date.astimezone(tz) - datetime.timedelta(minutes=self.data.minutes)
-            else:
-                if self.data.is_after:
-                    new_date = (base_date.astimezone(tz) + datetime.timedelta(days=self.data.days)).astimezone(tz)
-                else:
-                    new_date = (base_date.astimezone(tz) - datetime.timedelta(days=self.data.days)).astimezone(tz)
-                if self.data.time:
-                    new_date = new_date.replace(
-                        hour=self.data.time.hour,
-                        minute=self.data.time.minute,
-                        second=self.data.time.second
-                    )
-                new_date = new_date.astimezone(tz)
-                return new_date
+            return self.data.datetime(base)
 
     def to_string(self) -> str:
         if isinstance(self.data, (datetime.datetime, datetime.date)):
             return self.data.isoformat()
         else:
-            if self.data.minutes is not None:
-                return 'RELDATE/minutes/{}/{}/{}'.format(  #
-                    self.data.minutes,
-                    self.data.base_date_name,
-                    'after' if self.data.is_after else '',
-                )
-            return 'RELDATE/{}/{}/{}/{}'.format(  #
-                self.data.days,
-                self.data.time.strftime('%H:%M:%S') if self.data.time else '-',
-                self.data.base_date_name,
-                'after' if self.data.is_after else '',
-            )
+            return self.data.to_string()
 
     @classmethod
     def from_string(cls, input: str):
         if input.startswith('RELDATE/'):
-            parts = input.split('/')
-            if parts[1] == 'minutes':
-                data = RelativeDate(
-                    days=0,
-                    minutes=int(parts[2]),
-                    base_date_name=parts[3],
-                    time=None,
-                    is_after=len(parts) > 4 and parts[4] == "after",
-                )
-            else:
-                if parts[2] == '-':
-                    time = None
-                else:
-                    timeparts = parts[2].split(':')
-                    time = datetime.time(hour=int(timeparts[0]), minute=int(timeparts[1]), second=int(timeparts[2]))
-                try:
-                    data = RelativeDate(
-                        days=int(parts[1] or 0),
-                        base_date_name=parts[3],
-                        time=time,
-                        minutes=None,
-                        is_after=len(parts) > 4 and parts[4] == "after",
-                    )
-                except ValueError:
-                    data = RelativeDate(
-                        days=0,
-                        base_date_name=parts[3],
-                        time=time,
-                        minutes=None,
-                        is_after=len(parts) > 4 and parts[4] == "after",
-                    )
-            if data.base_date_name not in [k[0] for k in BASE_CHOICES]:
-                raise ValueError('{} is not a valid base date'.format(data.base_date_name))
+            data = RelativeDate.from_string(input)
         else:
             data = parser.parse(input)
         return RelativeDateWrapper(data)
@@ -187,7 +325,6 @@ BEFORE_AFTER_CHOICE = (
     ('after', _('after')),
 )
 
-
 reldatetimeparts = namedtuple('reldatetimeparts', (
     "status",  # 0
     "absolute",  # 1
@@ -202,6 +339,14 @@ reldatetimeparts = namedtuple('reldatetimeparts', (
 reldatetimeparts.indizes = reldatetimeparts(*range(9))
 
 
+def _get_choices(base_choices: List[BaseChoice]) -> List[Tuple[str, Promise]]:
+    return [(c.key, c.text) for c in base_choices]
+
+
+def _get_choice_validation_obj(choices: List[BaseChoice]):
+    return {c.key: {"data-supports-before": c.supports_before, "data-supports-after": c.supports_after} for c in choices}
+
+
 class RelativeDateTimeWidget(forms.MultiWidget):
     template_name = 'pretixbase/forms/widgets/reldatetime.html'
     parts = reldatetimeparts
@@ -209,6 +354,7 @@ class RelativeDateTimeWidget(forms.MultiWidget):
     def __init__(self, *args, **kwargs):
         self.status_choices = kwargs.pop('status_choices')
         base_choices = kwargs.pop('base_choices')
+        choices = _get_choices(base_choices)
 
         def placeholder_datetime_format():
             df = get_format('DATETIME_INPUT_FORMATS')[0]
@@ -220,21 +366,29 @@ class RelativeDateTimeWidget(forms.MultiWidget):
             tf = get_format('TIME_INPUT_FORMATS')[0]
             return datetime.time(8, 30, 0).strftime(tf)
 
-        widgets = reldatetimeparts(
+        widgets = cast(dict[str, Widget | type[Widget]], cast(object, reldatetimeparts(
             status=forms.RadioSelect(choices=self.status_choices),
             absolute=forms.DateTimeInput(
                 attrs={'placeholder': lazy(placeholder_datetime_format, str), 'class': 'datetimepicker'}
             ),
             rel_days_number=forms.NumberInput(),
-            rel_mins_relationto=forms.Select(choices=base_choices),
+            rel_mins_relationto=OptionAttrsSelect(
+                attrs={'data-relative-choice': True},
+                choices=choices,
+                option_attrs=_get_choice_validation_obj(base_choices)
+            ),
             rel_days_timeofday=forms.TimeInput(
                 attrs={'placeholder': lazy(placeholder_time_format, str), 'class': 'timepickerfield'}
             ),
             rel_mins_number=forms.NumberInput(),
-            rel_days_relationto=forms.Select(choices=base_choices),
-            rel_mins_relation=forms.Select(choices=BEFORE_AFTER_CHOICE),
-            rel_days_relation=forms.Select(choices=BEFORE_AFTER_CHOICE),
-        )
+            rel_days_relationto=OptionAttrsSelect(
+                attrs={'data-relative-choice': True},
+                choices=choices,
+                option_attrs=_get_choice_validation_obj(base_choices)
+            ),
+            rel_mins_relation=forms.Select(attrs={'data-relation-choice': True}, choices=BEFORE_AFTER_CHOICE),
+            rel_days_relation=forms.Select(attrs={'data-relation-choice': True}, choices=BEFORE_AFTER_CHOICE),
+        )))
         super().__init__(widgets=widgets, *args, **kwargs)
 
     def decompress(self, value):
@@ -247,10 +401,10 @@ class RelativeDateTimeWidget(forms.MultiWidget):
                 status="unset",
                 absolute=None,
                 rel_days_number=1,
-                rel_mins_relationto="date_from",
+                rel_mins_relationto="event__date_from",
                 rel_days_timeofday=None,
                 rel_mins_number=0,
-                rel_days_relationto="date_from",
+                rel_days_relationto="event__date_from",
                 rel_mins_relation="before",
                 rel_days_relation="before"
             )
@@ -259,10 +413,10 @@ class RelativeDateTimeWidget(forms.MultiWidget):
                 status="absolute",
                 absolute=value.data,
                 rel_days_number=1,
-                rel_mins_relationto="date_from",
+                rel_mins_relationto="event__date_from",
                 rel_days_timeofday=None,
                 rel_mins_number=0,
-                rel_days_relationto="date_from",
+                rel_days_relationto="event__date_from",
                 rel_mins_relation="before",
                 rel_days_relation="before"
             )
@@ -271,10 +425,10 @@ class RelativeDateTimeWidget(forms.MultiWidget):
                 status="relative_minutes",
                 absolute=None,
                 rel_days_number=None,
-                rel_mins_relationto=value.data.base_date_name,
+                rel_mins_relationto=value.data.key,
                 rel_days_timeofday=None,
                 rel_mins_number=value.data.minutes,
-                rel_days_relationto=value.data.base_date_name,
+                rel_days_relationto=value.data.key,
                 rel_mins_relation="after" if value.data.is_after else "before",
                 rel_days_relation="after" if value.data.is_after else "before"
             )
@@ -282,10 +436,10 @@ class RelativeDateTimeWidget(forms.MultiWidget):
             status="relative",
             absolute=None,
             rel_days_number=value.data.days,
-            rel_mins_relationto=value.data.base_date_name,
+            rel_mins_relationto=value.data.key,
             rel_days_timeofday=value.data.time,
             rel_mins_number=0,
-            rel_days_relationto=value.data.base_date_name,
+            rel_days_relationto=value.data.key,
             rel_mins_relation="after" if value.data.is_after else "before",
             rel_days_relation="after" if value.data.is_after else "before"
         )
@@ -309,17 +463,41 @@ class RelativeDateTimeField(forms.MultiValueField):
             ('relative', _('Relative date:')),
             ('relative_minutes', _('Relative time:')),
         ]
+        self.relative_to_order = kwargs.pop('relative_to_order', False)
+
+        possible_choices = copy.deepcopy(EVENT_BASE_CHOICES)
+        if self.relative_to_order:
+            possible_choices.extend(ORDER_BASE_CHOICES)
+
         if kwargs.get('limit_choices'):
             limit = kwargs.pop('limit_choices')
-            choices = [(k, v) for k, v in BASE_CHOICES if k in limit]
-        else:
-            choices = BASE_CHOICES
+            if any(["__" not in l for l in limit]):
+                _warn_skips = (str(os.path.dirname(__file__)),)
+
+                warnings.warn(
+                    message="Please prefix limit_choices with the base the attributes refer to, for example event__date_from",
+                    category=DeprecationWarning,
+                    skip_file_prefixes=_warn_skips
+                )
+
+            possible_choices = [
+                c for c in possible_choices if
+                # new base case as we want limit_choices to be expressed as base__attribute
+                (c.key in limit) or
+                # fallback for old event based entries
+                # if the base is an event, then using only attribute is fine
+                (c.base == "event" and c.attribute in limit)
+            ]
+
         if not kwargs.get('required', True):
             status_choices.insert(0, ('unset', _('Not set')))
+
+        choices = _get_choices(possible_choices)
+
         fields = reldatetimeparts(
             status=forms.ChoiceField(
                 choices=status_choices,
-                required=True
+                required=True,
             ),
             absolute=forms.DateTimeField(
                 required=False
@@ -329,7 +507,7 @@ class RelativeDateTimeField(forms.MultiValueField):
             ),
             rel_mins_relationto=forms.ChoiceField(
                 choices=choices,
-                required=False
+                required=False,
             ),
             rel_days_timeofday=forms.TimeField(
                 required=False,
@@ -339,7 +517,7 @@ class RelativeDateTimeField(forms.MultiValueField):
             ),
             rel_days_relationto=forms.ChoiceField(
                 choices=choices,
-                required=False
+                required=False,
             ),
             rel_mins_relation=forms.ChoiceField(
                 choices=BEFORE_AFTER_CHOICE,
@@ -350,8 +528,9 @@ class RelativeDateTimeField(forms.MultiValueField):
                 required=False
             ),
         )
+
         if 'widget' not in kwargs:
-            kwargs['widget'] = RelativeDateTimeWidget(status_choices=status_choices, base_choices=choices)
+            kwargs['widget'] = RelativeDateTimeWidget(status_choices=status_choices, base_choices=possible_choices)
         kwargs.pop('max_length', 0)
         kwargs.pop('empty_value', 0)
         super().__init__(
@@ -359,21 +538,24 @@ class RelativeDateTimeField(forms.MultiValueField):
         )
 
     def set_event(self, event):
-        self.widget.widgets[reldatetimeparts.indizes.rel_days_relationto].choices = [
-            (k, v) for k, v in BASE_CHOICES if getattr(event, k, None)
-        ]
-        self.widget.widgets[reldatetimeparts.indizes.rel_mins_relationto].choices = [
-            (k, v) for k, v in BASE_CHOICES if getattr(event, k, None)
-        ]
+        possible_choices = copy.deepcopy(EVENT_BASE_CHOICES)
+        if self.relative_to_order:
+            possible_choices.extend(ORDER_BASE_CHOICES)
+
+        possible_choices = possible_choices
+        choices = _get_choices(possible_choices)
+
+        self.widget.widgets[reldatetimeparts.indizes.rel_days_relationto].choices = choices
+        self.widget.widgets[reldatetimeparts.indizes.rel_mins_relationto].choices = choices
 
     def compress(self, data_list):
         if not data_list:
             return None
         data = reldatetimeparts(*data_list)
-        if data.status == 'absolute':
-            return RelativeDateWrapper(data.absolute)
-        elif data.status == 'unset':
+        if data.status == 'unset':
             return None
+        elif data.status == 'absolute':
+            return RelativeDateWrapper(data.absolute)
         elif data.status == 'relative_minutes':
             return RelativeDateWrapper(RelativeDate(
                 days=0,
@@ -404,6 +586,18 @@ class RelativeDateTimeField(forms.MultiValueField):
             raise ValidationError(self.error_messages['incomplete'])
         elif data.status == 'relative_minutes' and (data.rel_mins_number is None or not data.rel_mins_relationto):
             raise ValidationError(self.error_messages['incomplete'])
+        elif data.status == 'relative':
+            choice = BaseChoice.find(BASE_CHOICES, data.rel_days_relationto)
+            if data.rel_days_relation == "before" and not choice.supports_before:
+                raise ValidationError(_('A relative date cannot be expressed as "before" for "{}"'.format(choice.text)))
+            elif data.status == 'relative' and data.rel_days_relation == "after" and not choice.supports_after:
+                raise ValidationError(_('A relative date cannot be expressed as "after" for "{}"'.format(choice.text)))
+        elif data.status == 'relative_minutes':
+            choice = BaseChoice.find(BASE_CHOICES, data.rel_days_relationto)
+            if data.rel_days_relation == "before" and not choice.supports_before:
+                raise ValidationError(_('A relative time cannot be expressed as "before" for "{}"'.format(choice.text)))
+            elif data.rel_days_relation == "after" and not choice.supports_after:
+                raise ValidationError(_('A relative time cannot be expressed as "after" for "{}"'.format(choice.text)))
 
         return super().clean(value)
 
@@ -424,15 +618,20 @@ class RelativeDateWidget(RelativeDateTimeWidget):
 
     def __init__(self, *args, **kwargs):
         self.status_choices = kwargs.pop('status_choices')
-        widgets = reldateparts(
+        self.base_choices = kwargs.pop('base_choices')
+        widgets = cast(dict[str, Widget | type[Widget]], cast(object, reldateparts(
             status=forms.RadioSelect(choices=self.status_choices),
             absolute=forms.DateInput(
                 attrs={'class': 'datepickerfield'}
             ),
             rel_days_number=forms.NumberInput(),
-            rel_days_relationto=forms.Select(choices=kwargs.pop('base_choices')),
-            rel_days_relation=forms.Select(choices=BEFORE_AFTER_CHOICE),
-        )
+            rel_days_relationto=OptionAttrsSelect(
+                choices=self.base_choices,
+                option_attrs=_get_choice_validation_obj(self.base_choices),
+                attrs={'data-relative-choice': True},
+            ),
+            rel_days_relation=forms.Select(choices=BEFORE_AFTER_CHOICE, attrs={'data-relation-choice': True},),
+        )))
         forms.MultiWidget.__init__(self, widgets=widgets, *args, **kwargs)
 
     def decompress(self, value):
@@ -460,7 +659,7 @@ class RelativeDateWidget(RelativeDateTimeWidget):
             status="relative",
             absolute=None,
             rel_days_number=value.data.days,
-            rel_days_relationto=value.data.base_date_name,
+            rel_days_relationto=value.data.key,
             rel_days_relation="after" if value.data.is_after else "before"
         )
 
@@ -474,6 +673,15 @@ class RelativeDateField(RelativeDateTimeField):
         ]
         if not kwargs.get('required', True):
             status_choices.insert(0, ('unset', _('Not set')))
+
+        self.relative_to_order = kwargs.pop('relative_to_order', False)
+
+        possible_choices = copy.deepcopy(EVENT_BASE_CHOICES)
+        if self.relative_to_order:
+            possible_choices.extend(ORDER_BASE_CHOICES)
+
+        choices = _get_choices(possible_choices)
+
         fields = reldateparts(
             status=forms.ChoiceField(
                 choices=status_choices,
@@ -486,33 +694,37 @@ class RelativeDateField(RelativeDateTimeField):
                 required=False
             ),
             rel_days_relationto=forms.ChoiceField(
-                choices=BASE_CHOICES,
-                required=False
+                choices=choices,
+                required=False,
             ),
             rel_days_relation=forms.ChoiceField(
                 choices=BEFORE_AFTER_CHOICE,
                 required=False
             ),
         )
+
         if 'widget' not in kwargs:
-            kwargs['widget'] = RelativeDateWidget(status_choices=status_choices, base_choices=BASE_CHOICES)
+            kwargs['widget'] = RelativeDateWidget(status_choices=status_choices, base_choices=possible_choices)
         forms.MultiValueField.__init__(
             self, fields=fields, require_all_fields=False, *args, **kwargs
         )
 
     def set_event(self, event):
-        self.widget.widgets[reldateparts.indizes.rel_days_relationto].choices = [
-            (k, v) for k, v in BASE_CHOICES if getattr(event, k, None)
+        choices = [
+            (c.key, c.text) for c in EVENT_BASE_CHOICES if getattr(event, c.attribute, None)
         ]
+        if self.relative_to_order:
+            choices += [(c.key, c.text) for c in ORDER_BASE_CHOICES]
+        self.widget.widgets[reldateparts.indizes.rel_days_relationto].choices = choices
 
     def compress(self, data_list):
         if not data_list:
             return None
         data = reldateparts(*data_list)
-        if data.status == 'absolute':
-            return RelativeDateWrapper(data.absolute)
-        elif data.status == 'unset':
+        if data.status == 'unset':
             return None
+        elif data.status == 'absolute':
+            return RelativeDateWrapper(data.absolute)
         else:
             return RelativeDateWrapper(RelativeDate(
                 days=data.rel_days_number,
@@ -525,8 +737,14 @@ class RelativeDateField(RelativeDateTimeField):
         data = reldateparts(*value)
         if data.status == 'absolute' and not data.absolute:
             raise ValidationError(self.error_messages['incomplete'])
-        elif data.status == 'relative' and (data.rel_days_number is None or not data.rel_days_relationto):
-            raise ValidationError(self.error_messages['incomplete'])
+        if data.status == 'relative':
+            choice = BaseChoice.find(BASE_CHOICES, data.rel_days_relationto)
+            if data.rel_days_number is None or not data.rel_days_relationto:
+                raise ValidationError(self.error_messages['incomplete'])
+            elif data.rel_days_relation == "before" and not choice.supports_before:
+                raise ValidationError(_("A relative date cannot be expressed as 'before' for '{}'".format(choice.text)))
+            elif data.rel_days_relation == "after" and not choice.supports_after:
+                raise ValidationError(_("A relative date cannot be expressed as 'after' for '{}'".format(choice.text)))
 
         return forms.MultiValueField.clean(self, value)
 

src/pretix/base/services/cart.py

@@ -53,6 +53,7 @@ from django.utils.translation import (
 )
 from django_scopes import scopes_disabled
 
+from pretix.base.decimal import round_decimal
 from pretix.base.i18n import language
 from pretix.base.media import MEDIA_TYPES
 from pretix.base.models import (
@@ -60,7 +61,7 @@ from pretix.base.models import (
     Seat, SeatCategoryMapping, Voucher,
 )
 from pretix.base.models.event import SubEvent
-from pretix.base.models.orders import OrderFee
+from pretix.base.models.orders import CheckoutSession, OrderFee
 from pretix.base.models.tax import TaxRule
 from pretix.base.reldate import RelativeDateWrapper
 from pretix.base.services.checkin import _save_answers
@@ -471,6 +472,16 @@ class CartManager:
                 if term_last < time_machine_now(self.real_now_dt):
                     raise CartError(error_messages['payment_ended'])
 
+    def _ensure_checkout_session(self):
+        CheckoutSession.objects.get_or_create(
+            event=self.event,
+            cart_id=self.cart_id,
+            defaults={
+                "sales_channel": self._sales_channel,
+                "testmode": self.event.testmode,
+            },
+        )
+
     def _extend_expiry_of_valid_existing_positions(self):
         # real_now_dt is initialized at CartManager instantiation, so it's slightly in the past. Add a small
         # delta to reduce risk of extending already expired CartPositions.
@@ -916,6 +927,8 @@ class CartManager:
                 if custom_price > 99_999_999_999:
                     raise CartError(error_messages['price_too_high'])
 
+                custom_price = round_decimal(custom_price, currency=self.event.currency)
+
             op = self.AddOperation(
                 count=i['count'],
                 item=item,
@@ -1038,6 +1051,8 @@ class CartManager:
                 if custom_price > 99_999_999_999:
                     raise CartError(error_messages['price_too_high'])
 
+                custom_price = round_decimal(custom_price, currency=self.event.currency)
+
             # Fix positions with wrong price (TODO: happens out-of-cartmanager-transaction and therefore a little hacky)
             for ca in current_addons[cp][a['item'], a['variation']]:
                 if ca.listed_price != listed_price:
@@ -1554,6 +1569,7 @@ class CartManager:
 
     def commit(self):
         self._check_presale_dates()
+        self._ensure_checkout_session()
         self._check_max_cart_size()
 
         err = self._delete_out_of_timeframe()

src/pretix/base/services/checkin.py

@@ -40,7 +40,7 @@ import dateutil
 import dateutil.parser
 from dateutil.tz import datetime_exists
 from django.core.files import File
-from django.db import IntegrityError, transaction
+from django.db import IntegrityError
 from django.db.models import (
     BooleanField, Case, Count, ExpressionWrapper, F, IntegerField, Max, Min,
     OuterRef, Q, Subquery, TextField, Value, When,
@@ -59,6 +59,7 @@ from pretix.base.models import (
 )
 from pretix.base.signals import checkin_created, periodic_task
 from pretix.helpers import OF_SELF
+from pretix.helpers.database import conditional_atomic
 from pretix.helpers.jsonlogic import Logic
 from pretix.helpers.jsonlogic_boolalg import convert_to_dnf
 from pretix.helpers.jsonlogic_query import (
@@ -891,6 +892,7 @@ def _save_answers(op, answers, given_answers):
             qa.answer = answer
             qa.save(update_fields=['answer'])
             qa.options.clear()
+            return qa
 
     written = False
     for q, a in given_answers.items():
@@ -1043,10 +1045,10 @@ def perform_checkin(op: OrderPosition, clist: CheckinList, given_answers: dict,
         if not simulate:
             _save_answers(op, answers, given_answers)
 
-    with transaction.atomic():
+    with conditional_atomic(not simulate):
         # Lock order positions, if it is an entry. We don't need it for exits, as a race condition wouldn't be problematic
         opqs = OrderPosition.all.select_related("order", "item")
-        if type != Checkin.TYPE_EXIT:
+        if type != Checkin.TYPE_EXIT and not simulate:
             opqs = opqs.select_for_update(of=OF_SELF)
         op = opqs.get(pk=op.pk)
 

src/pretix/base/services/cleanup.py

@@ -33,6 +33,7 @@ from pretix.base.models.customers import CustomerSSOGrant
 
 from ..models import CachedFile, CartPosition, InvoiceAddress
 from ..models.auth import UserKnownLoginSource
+from ..models.orders import CheckoutSession
 from ..signals import periodic_task
 
 
@@ -43,6 +44,10 @@ def clean_cart_positions(sender, **kwargs):
         cp.delete()
     for cp in CartPosition.objects.filter(expires__lt=now() - timedelta(days=14), addon_to__isnull=True):
         cp.delete()
+    for cs in CheckoutSession.objects.filter(created__lt=now() - timedelta(days=14)).exclude(
+        Exists(CartPosition.objects.filter(cart_id=OuterRef("cart_id")))
+    ):
+        cs.delete()
     for ia in InvoiceAddress.objects.filter(order__isnull=True, customer__isnull=True, last_modified__lt=now() - timedelta(days=14)):
         ia.delete()
 

src/pretix/base/services/orders.py

@@ -48,12 +48,12 @@ from celery.exceptions import MaxRetriesExceededError
 from django.conf import settings
 from django.core.cache import cache
 from django.core.exceptions import ValidationError
-from django.db import transaction
+from django.db import models, transaction
 from django.db.models import (
-    Count, Exists, F, IntegerField, Max, Min, OuterRef, Q, QuerySet, Sum,
-    Value,
+    Count, Exists, F, IntegerField, Max, Min, OuterRef, Q, QuerySet, Subquery,
+    Sum, Value,
 )
-from django.db.models.functions import Coalesce, Greatest
+from django.db.models.functions import Cast, Greatest
 from django.db.transaction import get_connection
 from django.dispatch import receiver
 from django.utils.functional import cached_property
@@ -71,10 +71,10 @@ from pretix.base.models import (
     Membership, Order, OrderPayment, OrderPosition, Quota, Seat,
     SeatCategoryMapping, User, Voucher,
 )
-from pretix.base.models.event import SubEvent
+from pretix.base.models.event import Event_SettingsStore, SubEvent
 from pretix.base.models.orders import (
-    BlockedTicketSecret, InvoiceAddress, OrderFee, OrderRefund,
-    generate_secret,
+    BlockedTicketSecret, CheckoutSession, InvoiceAddress, OrderFee,
+    OrderRefund, generate_secret,
 )
 from pretix.base.models.organizer import SalesChannel, TeamAPIToken
 from pretix.base.models.tax import TAXED_ZERO, TaxedPrice, TaxRule
@@ -1030,7 +1030,8 @@ def _apply_rounding_and_fees(positions: List[CartPosition], payment_requests: Li
 def _create_order(event: Event, *, email: str, positions: List[CartPosition], now_dt: datetime,
                   payment_requests: List[dict], sales_channel: SalesChannel, locale: str=None,
                   address: InvoiceAddress=None, meta_info: dict=None, shown_total=None,
-                  customer=None, valid_if_pending=False, api_meta: dict=None, tax_rounding_mode=None):
+                  customer=None, valid_if_pending=False, api_meta: dict=None, tax_rounding_mode=None,
+                  cart_id: str=None):
     payments = []
 
     try:
@@ -1113,6 +1114,14 @@ def _create_order(event: Event, *, email: str, positions: List[CartPosition], no
     if meta_info:
         for msg in meta_info.get('confirm_messages', []):
             order.log_action('pretix.event.order.consent', data={'msg': msg})
+    if cart_id:
+        try:
+            session = CheckoutSession.objects.get(event=event, cart_id=cart_id)
+        except CheckoutSession.DoesNotExist:
+            pass
+        else:
+            session.answers.update(order=order, checkoutsession=None)
+            session.delete()
 
     order_placed.send(event, order=order, bulk=False)
     return order, payments
@@ -1160,7 +1169,7 @@ def _order_placed_email_attendee(event: Event, order: Order, position: OrderPosi
 
 def _perform_order(event: Event, payment_requests: List[dict], position_ids: List[str],
                    email: str, locale: str, address: int, meta_info: dict=None, sales_channel: str='web',
-                   shown_total=None, customer=None, api_meta: dict=None, tax_rounding_mode=None):
+                   shown_total=None, customer=None, api_meta: dict=None, tax_rounding_mode=None, cart_id: str=None):
     for p in payment_requests:
         p['pprov'] = event.get_payment_providers(cached=True)[p['provider']]
         if not p['pprov']:
@@ -1267,6 +1276,7 @@ def _perform_order(event: Event, payment_requests: List[dict], position_ids: Lis
                 valid_if_pending=valid_if_pending,
                 api_meta=api_meta,
                 tax_rounding_mode=tax_rounding_mode,
+                cart_id=cart_id,
             )
 
             try:
@@ -1494,83 +1504,104 @@ def send_expiry_warnings(sender, **kwargs):
 @scopes_disabled()
 def send_download_reminders(sender, **kwargs):
     today = now().replace(hour=0, minute=0, second=0, microsecond=0)
-    qs = Order.objects.annotate(
-        first_date=Coalesce(
-            Min('all_positions__subevent__date_from'),
-            F('event__date_from')
+
+    events = Event.objects.filter(
+        Q(has_subevents=False, date_from__gte=now()) |
+        (Q(has_subevents=True) & Q(Exists(
+            SubEvent.objects.filter(event_id=OuterRef('id'), date_from__gte=now())
+        )))
+    ).annotate(
+        reminder_days=Subquery(
+            Event_SettingsStore.objects.filter(
+                object=OuterRef('id'),
+                key='mail_days_download_reminder'
+            ).exclude(
+                value="None"
+            ).annotate(
+                val=Cast(F("value"), output_field=models.IntegerField()),
+            ).values("val")
         )
     ).filter(
-        download_reminder_sent=False,
-        datetime__lte=now() - timedelta(hours=2),
-        first_date__gte=today,
-    ).only(
-        'pk', 'event_id', 'sales_channel', 'datetime',
-    ).order_by('event_id')
-    event_id = None
-    days = None
-    event = None
+        reminder_days__isnull=False,
+    ).order_by()
 
-    for o in qs:
-        if o.event_id != event_id:
-            days = o.event.settings.get('mail_days_download_reminder', as_type=int)
-            event = o.event
-            event_id = o.event_id
+    for event in events.iterator(chunk_size=10_000):
+        qs = event.orders.filter(
+            download_reminder_sent=False,
+            datetime__lte=now() - timedelta(hours=2),
+        )
 
-        if days is None:
-            continue
-
-        if o.sales_channel.identifier not in event.settings.mail_sales_channel_download_reminder:
-            continue
-
-        reminder_date = (o.first_date - timedelta(days=days)).replace(hour=0, minute=0, second=0, microsecond=0)
-        if now() < reminder_date or o.datetime > reminder_date:
-            continue
-
-        with transaction.atomic():
-            o = Order.objects.select_for_update(of=OF_SELF).get(pk=o.pk)
-            if o.download_reminder_sent:
-                # Race condition
-                continue
-            positions = list(o.positions_with_tickets)
-            if not positions:
+        if event.has_subevents:
+            qs = qs.annotate(
+                first_date=Min('all_positions__subevent__date_from')
+            ).filter(
+                Q(first_date__gte=today)
+            )
+        else:
+            event_reminder_date = (event.date_from - timedelta(days=event.reminder_days)).replace(hour=0, minute=0, second=0, microsecond=0)
+            if now() < event_reminder_date:
                 continue
 
-            if not o.ticket_download_available:
+        qs = qs.only(
+            'pk', 'event_id', 'sales_channel', 'datetime',
+        ).order_by()
+
+        for o in qs:
+            if o.sales_channel.identifier not in event.settings.mail_sales_channel_download_reminder:
                 continue
 
-            if o.status != Order.STATUS_PAID:
-                if o.status != Order.STATUS_PENDING or o.require_approval or (not o.valid_if_pending and not o.event.settings.ticket_download_pending):
+            if event.has_subevents:
+                reminder_date = ((o.first_date or event.date_from) - timedelta(days=event.reminder_days)).replace(hour=0, minute=0, second=0, microsecond=0)
+            else:
+                reminder_date = event_reminder_date
+            if now() < reminder_date or o.datetime > reminder_date:
+                continue
+
+            with transaction.atomic():
+                o = Order.objects.select_for_update(of=OF_SELF).get(pk=o.pk)
+                if o.download_reminder_sent:
+                    # Race condition
+                    continue
+                positions = list(o.positions_with_tickets)
+                if not positions:
                     continue
 
-            with language(o.locale, o.event.settings.region):
-                o.download_reminder_sent = True
-                o.save(update_fields=['download_reminder_sent'])
-                email_template = event.settings.mail_text_download_reminder
-                email_subject = event.settings.mail_subject_download_reminder
-                email_context = get_email_context(event=event, order=o)
-                o.send_mail(
-                    email_subject, email_template, email_context,
-                    'pretix.event.order.email.download_reminder_sent',
-                    attach_tickets=True
-                )
+                if not o.ticket_download_available:
+                    continue
 
-                if event.settings.mail_send_download_reminder_attendee:
-                    for p in positions:
-                        if p.subevent_id:
-                            reminder_date = (p.subevent.date_from - timedelta(days=days)).replace(
-                                hour=0, minute=0, second=0, microsecond=0
-                            )
-                            if now() < reminder_date:
-                                continue
-                        if p.addon_to_id is None and p.attendee_email and p.attendee_email != o.email:
-                            email_template = event.settings.mail_text_download_reminder_attendee
-                            email_subject = event.settings.mail_subject_download_reminder_attendee
-                            email_context = get_email_context(event=event, order=o, position=p)
-                            o.send_mail(
-                                email_subject, email_template, email_context,
-                                'pretix.event.order.email.download_reminder_sent',
-                                attach_tickets=True, position=p
-                            )
+                if o.status != Order.STATUS_PAID:
+                    if o.status != Order.STATUS_PENDING or o.require_approval or (not o.valid_if_pending and not o.event.settings.ticket_download_pending):
+                        continue
+
+                with language(o.locale, o.event.settings.region):
+                    o.download_reminder_sent = True
+                    o.save(update_fields=['download_reminder_sent'])
+                    email_template = event.settings.mail_text_download_reminder
+                    email_subject = event.settings.mail_subject_download_reminder
+                    email_context = get_email_context(event=event, order=o)
+                    o.send_mail(
+                        email_subject, email_template, email_context,
+                        'pretix.event.order.email.download_reminder_sent',
+                        attach_tickets=True
+                    )
+
+                    if event.settings.mail_send_download_reminder_attendee:
+                        for p in positions:
+                            if p.subevent_id:
+                                reminder_date = (p.subevent.date_from - timedelta(days=event.reminder_days)).replace(
+                                    hour=0, minute=0, second=0, microsecond=0
+                                )
+                                if now() < reminder_date:
+                                    continue
+                            if p.addon_to_id is None and p.attendee_email and p.attendee_email != o.email:
+                                email_template = event.settings.mail_text_download_reminder_attendee
+                                email_subject = event.settings.mail_subject_download_reminder_attendee
+                                email_context = get_email_context(event=event, order=o, position=p)
+                                o.send_mail(
+                                    email_subject, email_template, email_context,
+                                    'pretix.event.order.email.download_reminder_sent',
+                                    attach_tickets=True, position=p
+                                )
 
 
 def notify_user_changed_order(order, user=None, auth=None, invoices=[]):
@@ -3169,12 +3200,12 @@ class OrderChangeManager:
 def perform_order(self, event: Event, payments: List[dict], positions: List[str],
                   email: str=None, locale: str=None, address: int=None, meta_info: dict=None,
                   sales_channel: str='web', shown_total=None, customer=None, override_now_dt: datetime=None,
-                  api_meta: dict=None):
+                  api_meta: dict=None, cart_id: str=None):
     with language(locale), time_machine_now_assigned(override_now_dt):
         try:
             try:
                 return _perform_order(event, payments, positions, email, locale, address, meta_info,
-                                      sales_channel, shown_total, customer, api_meta)
+                                      sales_channel, shown_total, customer, api_meta, cart_id=cart_id)
             except LockTimeoutException:
                 self.retry()
         except (MaxRetriesExceededError, LockTimeoutException):

src/pretix/base/services/placeholders.py

@@ -801,11 +801,10 @@ def get_available_placeholders(event, base_parameters, rich=False):
     return params
 
 
-def get_sample_context(event, context_parameters, rich=True):
+def prepare_sample_context_for_preview(placeholder_to_sample):
     context_dict = {}
     lbl = _('This value will be replaced based on dynamic parameters.')
-    for k, v in get_available_placeholders(event, context_parameters, rich=rich).items():
-        sample = v.render_sample(event)
+    for k, sample in placeholder_to_sample.items():
         if isinstance(sample, PlainHtmlAlternativeString):
             context_dict[k] = PlainHtmlAlternativeString(
                 '<{el} class="placeholder" title="{title}">{plain}</{el}>'.format(
@@ -830,3 +829,12 @@ def get_sample_context(event, context_parameters, rich=True):
                 escape(sample)
             ))
     return context_dict
+
+
+def get_sample_context(event, context_parameters, rich=True):
+    return prepare_sample_context_for_preview(
+        {
+            k: v.render_sample(event)
+            for k, v in get_available_placeholders(event, context_parameters, rich=rich).items()
+        }
+    )

src/pretix/base/services/quotas.py

@@ -193,7 +193,7 @@ class QuotaAvailability:
         lock_name = '_'.join([str(p) for p in sorted([q.pk for q in quotas])])
         if rc.exists(f'quotas:availabilitycachewrite:{lock_name}{self._cache_key_suffix}'):
             return
-        rc.setex(f'quotas:availabilitycachewrite:{lock_name}{self._cache_key_suffix}', '1', 10)
+        rc.set(f'quotas:availabilitycachewrite:{lock_name}{self._cache_key_suffix}', '1', ex=10)
 
         update = defaultdict(list)
         for q in quotas:

src/pretix/base/settings.py

@@ -2930,7 +2930,7 @@ Your {event} team"""))  # noqa: W291
     },
     'mail_days_download_reminder': {
         'type': int,
-        'default': None
+        'default': None  # when this default is changed, send_download_reminders needs to change
     },
     'mail_send_download_reminder_attendee': {
         'type': bool,

src/pretix/base/views/mixins.py

@@ -32,18 +32,21 @@ from django.utils.functional import cached_property
 from django.utils.timezone import make_aware
 
 from pretix.base.forms.questions import (
-    BaseInvoiceAddressForm, BaseInvoiceNameForm, BaseQuestionsForm,
+    BaseInvoiceAddressForm, BaseInvoiceNameForm, OrderLevelQuestionsForm,
+    TicketLevelQuestionsForm,
 )
 from pretix.base.models import (
     CartPosition, InvoiceAddress, OrderPosition, Question, QuestionAnswer,
     QuestionOption,
 )
 from pretix.base.models.customers import AttendeeProfile
+from pretix.base.models.orders import CheckoutSession, Order
 from pretix.presale.signals import contact_form_fields_overrides
 
 
 class BaseQuestionsViewMixin:
-    form_class = BaseQuestionsForm
+    order_form_class = OrderLevelQuestionsForm
+    orderposition_form_class = TicketLevelQuestionsForm
     all_optional = False
 
     @cached_property
@@ -56,6 +59,28 @@ class BaseQuestionsViewMixin:
     def question_form_kwargs(self, cr):
         return {}
 
+    @property
+    def order_question_container(self):
+        raise NotImplementedError()
+
+    @cached_property
+    def order_questions_form(self):
+        container = self.order_question_container
+        if container is None:
+            return None
+        kwargs = {}  # self.question_form_kwargs(cr)
+        form = self.order_form_class(
+            event=self.request.event,
+            prefix='order',
+            request=self.request,
+            container=container,
+            all_optional=self.all_optional,
+            data=(self.request.POST if self.request.method == 'POST' else None),
+            files=(self.request.FILES if self.request.method == 'POST' else None),
+            **kwargs
+        )
+        return form
+
     @cached_property
     def forms(self):
         """
@@ -69,15 +94,17 @@ class BaseQuestionsViewMixin:
             orderpos = cr if isinstance(cr, OrderPosition) else None
 
             kwargs = self.question_form_kwargs(cr)
-            form = self.form_class(event=self.request.event,
-                                   prefix=cr.id,
-                                   request=self.request,
-                                   cartpos=cartpos,
-                                   orderpos=orderpos,
-                                   all_optional=self.all_optional,
-                                   data=(self.request.POST if self.request.method == 'POST' else None),
-                                   files=(self.request.FILES if self.request.method == 'POST' else None),
-                                   **kwargs)
+            form = self.orderposition_form_class(
+                event=self.request.event,
+                prefix=cr.id,
+                request=self.request,
+                cartpos=cartpos,
+                orderpos=orderpos,
+                all_optional=self.all_optional,
+                data=(self.request.POST if self.request.method == 'POST' else None),
+                files=(self.request.FILES if self.request.method == 'POST' else None),
+                **kwargs
+            )
             form.pos = cartpos or orderpos
             form.show_copy_answers_to_addon_button = form.pos.addon_to and (
                 set(form.pos.addon_to.item.questions.all()) & set(form.pos.item.questions.all()) or
@@ -130,8 +157,38 @@ class BaseQuestionsViewMixin:
 
     def save(self):
         failed = False
+        if self.order_questions_form:
+            if not self.order_questions_form.is_valid():
+                failed = True
+            else:
+                checkoutsession = self.order_question_container if isinstance(self.order_question_container, CheckoutSession) else None
+                order = self.order_question_container if isinstance(self.order_question_container, Order) else None
+                for k, v in self.order_questions_form.cleaned_data.items():
+                    if k.startswith('question_'):
+                        field = self.order_questions_form.fields[k]
+                        if hasattr(field, 'answer'):
+                            # We already have a cached answer object, so we don't
+                            # have to create a new one
+                            if v == '' or v is None or (isinstance(field, forms.FileField) and v is False) \
+                                    or (isinstance(v, QuerySet) and not v.exists()):
+                                if field.answer.file:
+                                    field.answer.file.delete()
+                                field.answer.delete()
+                            else:
+                                self._save_to_answer(field, field.answer, v)
+                                field.answer.save()
+                        elif v != '' and v is not None:
+                            self._upsert_answer(
+                                field, v,
+                                checkoutsession=checkoutsession,
+                                order=order,
+                                question=field.question,
+                            )
+
         for form in self.forms:
             meta_info = form.pos.meta_info_data
+            cartposition = form.pos if isinstance(form.pos, CartPosition) else None
+            orderposition = form.pos if isinstance(form.pos, OrderPosition) else None
             # Every form represents a CartPosition or OrderPosition with questions attached
             if not form.is_valid():
                 failed = True
@@ -140,10 +197,8 @@ class BaseQuestionsViewMixin:
                     prof = AttendeeProfile.objects.filter(
                         customer=self.cart_customer, pk=form.cleaned_data.get('saved_id')
                     ).first() or AttendeeProfile(customer=getattr(self, 'cart_customer', None))
-                    answers_key_to_index = {a.get('field_name'): i for i, a in enumerate(prof.answers)}
                 else:
                     prof = AttendeeProfile(customer=getattr(self, 'cart_customer', None))
-                    answers_key_to_index = {}
 
                 # This form was correctly filled, so we store the data as
                 # answers to the questions / in the CartPosition object
@@ -181,64 +236,19 @@ class BaseQuestionsViewMixin:
                             else:
                                 self._save_to_answer(field, field.answer, v)
                                 field.answer.save()
-                                if isinstance(field, forms.ModelMultipleChoiceField) or isinstance(field, forms.ModelChoiceField):
-                                    answer_value = {o.identifier: str(o) for o in field.answer.options.all()}
-                                elif isinstance(field, forms.BooleanField):
-                                    answer_value = bool(field.answer.answer)
-                                else:
-                                    answer_value = str(field.answer.answer)
-                                answer_dict = {
-                                    'field_name': k,
-                                    'field_label': str(field.label),
-                                    'value': answer_value,
-                                    'question_type': field.question.type,
-                                    'question_identifier': field.question.identifier,
-                                }
-                                if k in answers_key_to_index:
-                                    prof.answers[answers_key_to_index[k]] = answer_dict
-                                else:
-                                    prof.answers.append(answer_dict)
+
+                                answer_dict = self._build_answer_dict(field, field.answer, k)
+                                prof.store_answer(answer_dict)
                         elif v != '' and v is not None:
-                            answer = QuestionAnswer(
-                                cartposition=(form.pos if isinstance(form.pos, CartPosition) else None),
-                                orderposition=(form.pos if isinstance(form.pos, OrderPosition) else None),
+                            answer = self._upsert_answer(
+                                field, v,
+                                cartposition=cartposition,
+                                orderposition=orderposition,
                                 question=field.question,
                             )
-                            try:
-                                self._save_to_answer(field, answer, v)
-                                answer.save()
-                            except IntegrityError:
-                                # Since we prefill ``field.answer`` at form creation time, there's a possible race condition
-                                # here if the users submits their save request a second time while the first one is still running,
-                                # thus leading to duplicate QuestionAnswer objects. Since Django doesn't support UPSERT, the "proper"
-                                # fix would be a transaction with select_for_update(), or at least fetching using get_or_create here
-                                # again. However, both of these approaches have a significant performance overhead for *all* requests,
-                                # while the issue happens very very rarely. So we opt for just catching the error and retrying properly.
-                                answer = QuestionAnswer.objects.get(
-                                    cartposition=(form.pos if isinstance(form.pos, CartPosition) else None),
-                                    orderposition=(form.pos if isinstance(form.pos, OrderPosition) else None),
-                                    question=field.question,
-                                )
-                                self._save_to_answer(field, answer, v)
-                                answer.save()
 
-                            if isinstance(field, forms.ModelMultipleChoiceField) or isinstance(field, forms.ModelChoiceField):
-                                answer_value = {o.identifier: str(o) for o in answer.options.all()}
-                            elif isinstance(field, forms.BooleanField):
-                                answer_value = bool(answer.answer)
-                            else:
-                                answer_value = str(answer.answer)
-                            answer_dict = {
-                                'field_name': k,
-                                'field_label': str(field.label),
-                                'value': answer_value,
-                                'question_type': field.question.type,
-                                'question_identifier': field.question.identifier,
-                            }
-                            if k in answers_key_to_index:
-                                prof.answers[answers_key_to_index[k]] = answer_dict
-                            else:
-                                prof.answers.append(answer_dict)
+                            answer_dict = self._build_answer_dict(field, answer, k)
+                            prof.store_answer(answer_dict)
 
                     else:
                         field = form.fields[k]
@@ -257,10 +267,7 @@ class BaseQuestionsViewMixin:
                             'question_type': None,
                             'question_identifier': None,
                         }
-                        if k in answers_key_to_index:
-                            prof.answers[answers_key_to_index[k]] = answer_dict
-                        else:
-                            prof.answers.append(answer_dict)
+                        prof.store_answer(answer_dict)
 
             form.pos.meta_info = json.dumps(meta_info)
             form.pos.save()
@@ -271,6 +278,23 @@ class BaseQuestionsViewMixin:
 
         return not failed
 
+    def _upsert_answer(self, field, v, **answer_kwargs):
+        answer = QuestionAnswer(**answer_kwargs)
+        try:
+            self._save_to_answer(field, answer, v)
+            answer.save()
+        except IntegrityError:
+            # Since we prefill ``field.answer`` at form creation time, there's a possible race condition
+            # here if the users submits their save request a second time while the first one is still running,
+            # thus leading to duplicate QuestionAnswer objects. Since Django doesn't support UPSERT, the "proper"
+            # fix would be a transaction with select_for_update(), or at least fetching using get_or_create here
+            # again. However, both of these approaches have a significant performance overhead for *all* requests,
+            # while the issue happens very very rarely. So we opt for just catching the error and retrying properly.
+            answer = QuestionAnswer.objects.get(**answer_kwargs)
+            self._save_to_answer(field, answer, v)
+            answer.save()
+        return answer
+
     def _save_to_answer(self, field, answer, value):
         if isinstance(field, forms.ModelMultipleChoiceField):
             answstr = ", ".join([str(o) for o in value])
@@ -294,6 +318,21 @@ class BaseQuestionsViewMixin:
         else:
             answer.answer = value
 
+    def _build_answer_dict(self, field, answer, k):
+        if isinstance(field, forms.ModelMultipleChoiceField) or isinstance(field, forms.ModelChoiceField):
+            answer_value = {o.identifier: str(o) for o in answer.options.all()}
+        elif isinstance(field, forms.BooleanField):
+            answer_value = bool(answer.answer)
+        else:
+            answer_value = str(answer.answer)
+        return {
+            'field_name': k,
+            'field_label': str(field.label),
+            'value': answer_value,
+            'question_type': field.question.type,
+            'question_identifier': field.question.identifier,
+        }
+
 
 class OrderQuestionsViewMixin(BaseQuestionsViewMixin):
     invoice_form_class = BaseInvoiceAddressForm
@@ -309,7 +348,7 @@ class OrderQuestionsViewMixin(BaseQuestionsViewMixin):
     def positions(self):
         qqs = self.request.event.questions.all()
         if self.only_user_visible:
-            qqs = qqs.filter(ask_during_checkin=False, hidden=False)
+            qqs = qqs.filter(ask_during_checkin=False, hidden=False, container_type=Question.ContainerType.ORDERPOSITION)
         return list(self.order.positions.select_related(
             'item', 'variation'
         ).prefetch_related(
@@ -397,6 +436,7 @@ class OrderQuestionsViewMixin(BaseQuestionsViewMixin):
     def get_context_data(self, **kwargs):
         ctx = super().get_context_data(**kwargs)
         ctx['order'] = self.order
+        ctx['order_questions_form'] = self.order_questions_form
         ctx['formgroups'] = self.formdict.items()
         ctx['invoice_form'] = self.invoice_form
         ctx['invoice_address_asked'] = self.address_asked

src/pretix/control/forms/item.py

@@ -153,11 +153,19 @@ class QuestionForm(I18nModelForm):
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
-        self.fields['items'].queryset = self.instance.event.items.all()
-        self.fields['items'].required = True
+        if self.instance.container_type == Question.ContainerType.ORDERPOSITION:
+            self.fields['items'].queryset = self.instance.event.items.all()
+            self.fields['items'].required = True
+        else:
+            del self.fields['items']
+            del self.fields['ask_during_checkin']
+            del self.fields['show_during_checkin']
+            del self.fields['print_on_invoice']
+        self.fields['dependency_question'].widget.attrs['data-container-type'] = self.instance.container_type
         self.fields['dependency_question'].queryset = self.instance.event.questions.filter(
             type__in=(Question.TYPE_BOOLEAN, Question.TYPE_CHOICE, Question.TYPE_CHOICE_MULTIPLE),
-            ask_during_checkin=False
+            ask_during_checkin=False,
+            container_type=self.instance.container_type,
         )
         if self.instance.pk:
             self.fields['dependency_question'].queryset = self.fields['dependency_question'].queryset.exclude(

src/pretix/control/forms/subevents.py

@@ -94,14 +94,14 @@ class SubEventBulkForm(SubEventForm):
         label=_('Start of presale'),
         help_text=_('Optional. No products will be sold before this date.'),
         required=False,
-        limit_choices=('date_from', 'date_to'),
+        limit_choices=('event__date_from', 'event__date_to'),
     )
     rel_presale_end = RelativeDateTimeField(
         label=_('End of presale'),
         help_text=_('Optional. No products will be sold after this date. If you do not set this value, the presale '
                     'will end after the end date of your event.'),
         required=False,
-        limit_choices=('date_from', 'date_to'),
+        limit_choices=('event__date_from', 'event__date_to'),
     )
     skip_if_overlap = forms.BooleanField(
         label=pgettext_lazy('subevent', 'Skip dates that overlap with any existing date'),
@@ -333,12 +333,12 @@ class BulkSubEventItemForm(SubEventItemForm):
     rel_available_from = RelativeDateTimeField(
         label=_('Available from'),
         required=False,
-        limit_choices=('date_from', 'date_to'),
+        limit_choices=('event__date_from', 'event__date_to'),
     )
     rel_available_until = RelativeDateTimeField(
         label=_('Available until'),
         required=False,
-        limit_choices=('date_from', 'date_to'),
+        limit_choices=('event__date_from', 'event__date_to'),
     )
 
     def __init__(self, *args, **kwargs):
@@ -355,12 +355,12 @@ class BulkSubEventItemVariationForm(SubEventItemVariationForm):
     rel_available_from = RelativeDateTimeField(
         label=_('Available from'),
         required=False,
-        limit_choices=('date_from', 'date_to'),
+        limit_choices=('event__date_from', 'event__date_to'),
     )
     rel_available_until = RelativeDateTimeField(
         label=_('Available_until'),
         required=False,
-        limit_choices=('date_from', 'date_to'),
+        limit_choices=('event__date_from', 'event__date_to'),
     )
 
     def __init__(self, *args, **kwargs):

src/pretix/control/templates/pretixcontrol/base.html

@@ -58,6 +58,7 @@
             <script type="text/javascript" src="{% static "leaflet/leaflet.js" %}"></script>
             <script type="text/javascript" src="{% static "pretixcontrol/js/ui/geo.js" %}"></script>
             <script type="text/javascript" src="{% static "pretixbase/js/details.js" %}"></script>
+            <script type="text/javascript" src="{% static "pretixbase/js/reldate.js" %}"></script>
             <script type="text/javascript" src="{% static "pretixbase/js/asynctask.js" %}"></script>
             <script type="text/javascript" src="{% static "sortable/Sortable.js" %}"></script>
             <script type="text/javascript" src="{% static "colorpicker/bootstrap-colorpicker.js" %}"></script>

src/pretix/control/templates/pretixcontrol/items/question_delete.html

@@ -13,9 +13,11 @@
 					{% blocktrans with url=edit_url|add:"#tab-0-1-open" %}If you want to keep the answers, <a href="{{url}}">edit the question</a> and set it to hidden.{% endblocktrans %}
 				</p>
 			</div>
-			{% for item in dependent %}
-				<li><a href="{% url "control:event.item" organizer=request.event.organizer.slug event=request.event.slug item=item.pk %}">{{ item }}</a></li>
-			{% endfor %}
+            <ul>
+                {% for item in dependent %}
+                    <li><a href="{% url "control:event.item" organizer=request.event.organizer.slug event=request.event.slug item=item.pk %}">{{ item }}</a></li>
+                {% endfor %}
+            </ul>
 		{% endif %}
 		<div class="form-group submit-group">
             <a href="{% url "control:event.items.questions" organizer=request.event.organizer.slug event=request.event.slug %}" class="btn btn-default btn-cancel">

src/pretix/control/templates/pretixcontrol/items/question_edit.html

@@ -24,7 +24,9 @@
                 <legend>{% trans "General" %}</legend>
                 {% bootstrap_field form.question layout="control" %}
                 {% bootstrap_field form.type layout="control" %}
-                {% bootstrap_field form.items layout="control" %}
+                {% if form.items %}
+                    {% bootstrap_field form.items layout="control" %}
+                {% endif %}
                 {% bootstrap_field form.required layout="control" %}
                 <div class="alert alert-info alert-required-boolean">
                     {% blocktrans trimmed %}
@@ -128,10 +130,16 @@
                 <legend>{% trans "Advanced" %}</legend>
                 {% bootstrap_field form.help_text layout="control" %}
                 {% bootstrap_field form.identifier layout="control" %}
-                {% bootstrap_field form.ask_during_checkin layout="control" %}
-                {% bootstrap_field form.show_during_checkin layout="control" %}
+                {% if form.ask_during_checkin %}
+                    {% bootstrap_field form.ask_during_checkin layout="control" %}
+                {% endif %}
+                {% if form.show_during_checkin %}
+                    {% bootstrap_field form.show_during_checkin layout="control" %}
+                {% endif %}
                 {% bootstrap_field form.hidden layout="control" %}
-                {% bootstrap_field form.print_on_invoice layout="control" %}
+                {% if form.print_on_invoice %}
+                    {% bootstrap_field form.print_on_invoice layout="control" %}
+                {% endif %}
 
                 <div class="form-group">
                     <label class="col-md-3 control-label" for="id_dependency_question">

src/pretix/control/templates/pretixcontrol/items/questions.html

@@ -10,11 +10,26 @@
         {% endblocktrans %}
     </p>
     {% csrf_token %}
-    {% if 'event.items:write' in request.eventpermset %}
-        <p>
-            <a href="{% url "control:event.items.questions.add" organizer=request.event.organizer.slug event=request.event.slug %}" class="btn btn-default"><i class="fa fa-plus"></i> {% trans "Create a new question" %}
-            </a>
-        </p>
+
+    {% if request.event.settings.feature_flag_order_level_questions %}
+        {% if 'event.items:write' in request.eventpermset %}
+            <p>
+                <a href="{% url "control:event.items.questions.add" organizer=request.event.organizer.slug event=request.event.slug %}?container_type=P" class="btn btn-default"><i class="fa fa-plus"></i> {% trans "Create a new per-ticket question" %}
+                </a>
+                <a href="{% url "control:event.items.questions.add" organizer=request.event.organizer.slug event=request.event.slug %}?container_type=O" class="btn btn-default"><i class="fa fa-plus"></i> {% trans "Create a new order-level question" %}
+                </a>
+            </p>
+        {% endif %}
+
+        <h2>{% trans "Per-ticket questions" %}</h2>
+        <p>{% trans "These questions are asked for every ticket, so possibly multiple times in the same order." %}</p>
+    {% else %}
+        {% if 'event.items:write' in request.eventpermset %}
+            <p>
+                <a href="{% url "control:event.items.questions.add" organizer=request.event.organizer.slug event=request.event.slug %}?container_type=P" class="btn btn-default"><i class="fa fa-plus"></i> {% trans "Create a new question" %}
+                </a>
+            </p>
+        {% endif %}
     {% endif %}
     <div class="table-responsive">
         <table class="table table-hover table-quotas">
@@ -32,8 +47,8 @@
                 <th class="action-col-2"></th>
             </tr>
             </thead>
-            <tbody data-dnd-url="{% url "control:event.items.questions.reorder" organizer=request.event.organizer.slug event=request.event.slug %}">
-            {% for q in questions %}
+            <tbody data-dnd-url="{% url "control:event.items.questions.reorder" organizer=request.event.organizer.slug event=request.event.slug %}?container_type=P">
+            {% for q in questions %}{% if q.container_type == "P" %}
                 <tr data-dnd-id="{{ q.id }}">
                     <td>
                         <strong>
@@ -63,7 +78,6 @@
                         {% if q.pk and q.ask_during_checkin %}
                             <span class="fa fa-check-square text-muted" data-toggle="tooltip" title="{% trans "Ask during check-in" %}"></span>
                         {% endif %}
-
                     </td>
                     <td>
                         {% if q.pk and q.hidden %}
@@ -102,8 +116,90 @@
                         {% endif %}
                     </td>
                 </tr>
-            {% endfor %}
+            {% endif %}{% endfor %}
             </tbody>
         </table>
     </div>
+
+    {% if request.event.settings.feature_flag_order_level_questions %}
+        <h2>
+            {% trans "Per-order questions" %}
+            <small><span class="label label-info" title="
+                {% trans "This functionality is in active development and expected to change significantly over the coming months." %}
+                {% trans "Per-order questions are currently not supported and will not be displayed in pretixPOS." %}
+            " data-toggle="tooltip">
+                <span class="fa fa-flask" aria-hidden="true"></span>
+                {% trans "Experimental feature" %}
+            </span></small>
+        </h2>
+        <p>{% trans "These questions are asked once per order." %}</p>
+        <div class="table-responsive">
+            <table class="table table-hover table-quotas">
+                <thead>
+                <tr>
+                    <th>{% trans "Question" %}</th>
+                    <th>{% trans "Type" %}</th>
+                    <th class="iconcol"></th>
+                    <th class="iconcol"></th>
+                    <th class="iconcol"></th>
+                    {% if 'event.items:write' in request.eventpermset %}
+                        <th class="action-col-2"></th>
+                    {% endif %}
+                    <th class="action-col-2"></th>
+                </tr>
+                </thead>
+                <tbody data-dnd-url="{% url "control:event.items.questions.reorder" organizer=request.event.organizer.slug event=request.event.slug %}?container_type=O">
+                {% for q in questions %}{% if q.container_type == "O" %}
+                    <tr data-dnd-id="{{ q.id }}">
+                        <td>
+                            <strong>
+                                {{ q.question }}
+                            </strong><br>
+                            <small class="text-muted">{{ q.identifier }}</small>
+                        </td>
+                        <td>
+                            {% if q.pk %}
+                                {{ q.get_type_display }}
+                            {% else %}
+                                {% trans "System question" %}
+                            {% endif %}
+                        </td>
+                        <td>
+                            {% if q.required %}
+                                <span class="fa fa-exclamation-circle text-muted" data-toggle="tooltip" title="{% trans "Required question" %}"></span>
+                            {% endif %}
+                        </td>
+                        <td>
+                            {% if q.pk and q.ask_during_checkin %}
+                                <span class="fa fa-check-square text-muted" data-toggle="tooltip" title="{% trans "Ask during check-in" %}"></span>
+                            {% endif %}
+                        </td>
+                        <td>
+                            {% if q.pk and q.hidden %}
+                                <span class="fa fa-eye-slash text-muted" data-toggle="tooltip" title="{% trans "Hidden question" %}"></span>
+                            {% endif %}
+                        </td>
+                        {% if 'event.items:write' in request.eventpermset %}
+                            <td class="dnd-container">
+                            </td>
+                        {% endif %}
+                        <td class="text-right flip">
+                            {% if q.pk %}
+                                {% if 'event.items:write' in request.eventpermset %}
+                                    <a href="{% url "control:event.items.questions.edit" organizer=request.event.organizer.slug event=request.event.slug question=q.id %}" class="btn btn-default btn-sm"><i class="fa fa-edit"></i></a>
+                                    <a href="{% url "control:event.items.questions.delete" organizer=request.event.organizer.slug event=request.event.slug question=q.id %}" class="btn btn-danger btn-sm"><i class="fa fa-trash"></i></a>
+                                {% endif %}
+                            {% else %}
+                                {% if 'event.settings.general:write' in request.eventpermset %}
+                                    <a href="{% url "control:event.settings" organizer=request.event.organizer.slug event=request.event.slug %}#tab-0-2-open"
+                                            class="btn btn-default btn-sm"><i class="fa fa-wrench"></i></a>
+                                {% endif %}
+                            {% endif %}
+                        </td>
+                    </tr>
+                {% endif %}{% endfor %}
+                </tbody>
+            </table>
+        </div>
+    {% endif %}
 {% endblock %}

src/pretix/control/templates/pretixcontrol/order/change_questions.html

@@ -35,6 +35,18 @@
                     </div>
                 </details>
             {% endif %}
+            {% if order_questions_form.fields %}
+                <details class="panel panel-default" open>
+                    <summary class="panel-heading">
+                        <h4 class="panel-title">
+                            <strong>{% trans "Additional order information" %}</strong>
+                        </h4>
+                    </summary>
+                    <div class="panel-body">
+                        {% bootstrap_form order_questions_form layout="horizontal" %}
+                    </div>
+                </details>
+            {% endif %}
             {% for pos, forms in formgroups %}
                 <details class="panel panel-default" open>
                     <summary class="panel-heading">

src/pretix/control/templates/pretixcontrol/order/fragment_question_answer.html

@@ -0,0 +1,28 @@
+{% load safelink %}
+{% load i18n %}
+{% load rich_text %}
+{% if answer %}
+    {% if answer.file %}
+        <span class="fa fa-file"></span>
+        <a href="{{ answer.backend_file_url }}?token={% answer_token request answer %}">
+            {{ answer.file_name }}
+        </a>
+        <span class="label label-danger" data-toggle="tooltip"
+                title="{% trans "This file has been uploaded by a user and could contain viruses or other malicious content." %}">
+            {% trans "UNSAFE" %}
+        </span>
+        {% if answer.is_image %}
+            <br>
+            <a href="{{ answer.backend_file_url }}?token={% answer_token request answer %}" data-lightbox="order"
+                class="answer-thumb">
+                <img src="{{ answer.backend_file_url }}?token={% answer_token request answer %}">
+            </a>
+        {% endif %}
+    {% elif question.type == "M" %}
+        {{ answer.to_string_i18n|rich_text_snippet }}
+    {% else %}
+        {{ answer.to_string_i18n|linebreaksbr }}
+    {% endif %}
+{% else %}
+    <em>{% trans "not answered" %}</em>
+{% endif %}

src/pretix/control/templates/pretixcontrol/order/index.html

@@ -427,6 +427,14 @@
                                 </form>
                             </dd>
                         {% endif %}
+
+                        {% if order.answers.all %}
+                            <hr>
+                        {% endif %}
+                        {% for ans in order.answers.all %}
+                            <dt>{{ ans.question.internal_name|default:ans.question.question }}</dt>
+                            <dd>{% include "pretixcontrol/order/fragment_question_answer.html" with request=request question=ans.question answer=ans %}</dd>
+                        {% endfor %}
                     </dl>
                 </div>
             </div>
@@ -664,31 +672,7 @@
                                                 {% endif %}
                                             </dt>
                                             <dd>
-                                                {% if q.answer %}
-                                                    {% if q.answer.file %}
-                                                        <span class="fa fa-file"></span>
-                                                        <a href="{{ q.answer.backend_file_url }}?token={% answer_token request q.answer %}">
-                                                            {{ q.answer.file_name }}
-                                                        </a>
-                                                        <span class="label label-danger" data-toggle="tooltip"
-                                                                title="{% trans "This file has been uploaded by a user and could contain viruses or other malicious content." %}">
-                                                            {% trans "UNSAFE" %}
-                                                        </span>
-                                                        {% if q.answer.is_image %}
-                                                            <br>
-                                                            <a href="{{ q.answer.backend_file_url }}?token={% answer_token request q.answer %}" data-lightbox="order"
-                                                                class="answer-thumb">
-                                                                <img src="{{ q.answer.backend_file_url }}?token={% answer_token request q.answer %}">
-                                                            </a>
-                                                        {% endif %}
-                                                    {% elif q.type == "M" %}
-                                                        {{ q.answer.to_string_i18n|rich_text_snippet }}
-                                                    {% else %}
-                                                        {{ q.answer.to_string_i18n|linebreaksbr }}
-                                                    {% endif %}
-                                                {% else %}
-                                                    <em>{% trans "not answered" %}</em>
-                                                {% endif %}
+                                                {% include "pretixcontrol/order/fragment_question_answer.html" with request=request question=q answer=q.answer %}
                                             </dd>
                                         {% endfor %}
                                         {% for q in line.additional_fields %}

src/pretix/control/templates/pretixcontrol/organizers/devices.html

@@ -118,6 +118,10 @@
                                 </td>
                             {% endif %}
                             <td>
+                                <span class="fa fa-fw {% if d.last_seen and d.last_seen.is_recent %}fa-check-circle text-success{% else %}fa-circle text-danger{% endif %}"
+                                      data-toggle="tooltip"
+                                      title="{% if d.last_seen %}{% blocktrans with time=d.last_seen.last_seen|date:"SHORT_DATETIME_FORMAT" %}Last seen: {{ time }}{% endblocktrans %}{% else %}{% trans "No recent contact" %}{% endif %}"
+                                ></span>
                                 {{ d.device_id }}
                             </td>
                             <td>
@@ -125,6 +129,7 @@
                                     <del>{% endif %}
                                 {{ d.name }}
                                 {% if d.revoked %}</del>{% endif %}
+
                                 {% if d.gate %}
                                     <br>
                                     <small class="text-muted">{{ d.gate.name }}</small>

src/pretix/control/views/item.py

@@ -65,6 +65,7 @@ from pretix.api.serializers.item import (
     ItemVariationSerializer,
 )
 from pretix.base.forms import I18nFormSet
+from pretix.base.forms.questions import get_fake_attendee_questions
 from pretix.base.models import (
     CartPosition, Item, ItemCategory, ItemProgramTime, ItemVariation, LogEntry,
     OrderPosition, Question, QuestionAnswer, QuestionOption, Quota,
@@ -426,7 +427,7 @@ def reorder_categories(request, organizer, event):
 
 
 FakeQuestion = namedtuple(
-    'FakeQuestion', 'id question position required'
+    'FakeQuestion', 'id question position required container_type'
 )
 
 
@@ -440,85 +441,8 @@ class QuestionList(ListView):
 
     def get_context_data(self, **kwargs):
         ctx = super().get_context_data(**kwargs)
-        questions = []
 
-        if self.request.event.settings.attendee_names_asked:
-            questions.append(
-                FakeQuestion(
-                    id='attendee_name_parts',
-                    question=_('Attendee name'),
-                    position=self.request.event.settings.system_question_order.get(
-                        'attendee_name_parts', 0
-                    ),
-                    required=self.request.event.settings.attendee_names_required,
-                )
-            )
-
-        if self.request.event.settings.attendee_emails_asked:
-            questions.append(
-                FakeQuestion(
-                    id='attendee_email',
-                    question=_('Attendee email'),
-                    position=self.request.event.settings.system_question_order.get(
-                        'attendee_email', 0
-                    ),
-                    required=self.request.event.settings.attendee_emails_required,
-                )
-            )
-
-        if self.request.event.settings.attendee_company_asked:
-            questions.append(
-                FakeQuestion(
-                    id='company',
-                    question=_('Company'),
-                    position=self.request.event.settings.system_question_order.get(
-                        'company', 0
-                    ),
-                    required=self.request.event.settings.attendee_company_required,
-                )
-            )
-
-        if self.request.event.settings.attendee_addresses_asked:
-            questions.append(
-                FakeQuestion(
-                    id='street',
-                    question=_('Street'),
-                    position=self.request.event.settings.system_question_order.get(
-                        'street', 0
-                    ),
-                    required=self.request.event.settings.attendee_addresses_required,
-                )
-            )
-            questions.append(
-                FakeQuestion(
-                    id='zipcode',
-                    question=_('ZIP code'),
-                    position=self.request.event.settings.system_question_order.get(
-                        'zipcode', 0
-                    ),
-                    required=self.request.event.settings.attendee_addresses_required,
-                )
-            )
-            questions.append(
-                FakeQuestion(
-                    id='city',
-                    question=_('City'),
-                    position=self.request.event.settings.system_question_order.get(
-                        'city', 0
-                    ),
-                    required=self.request.event.settings.attendee_addresses_required,
-                )
-            )
-            questions.append(
-                FakeQuestion(
-                    id='country',
-                    question=_('Country'),
-                    position=self.request.event.settings.system_question_order.get(
-                        'country', 0
-                    ),
-                    required=self.request.event.settings.attendee_addresses_required,
-                )
-            )
+        questions = get_fake_attendee_questions(self.request.event.settings)
 
         questions += list(ctx['questions'])
         questions.sort(key=lambda q: q.position)
@@ -535,14 +459,16 @@ def reorder_questions(request, organizer, event):
     except (JSONDecodeError, KeyError, ValueError):
         return HttpResponseBadRequest("expected JSON: {ids:[]}")
 
+    qs = request.event.questions.filter(container_type=request.GET['container_type'])
+
     # filter system_questions - normal questions are int/digit, system_questions strings
     custom_question_ids = [i for i in ids if i.isdigit()]
-    input_questions = list(request.event.questions.filter(id__in=custom_question_ids))
+    input_questions = list(qs.filter(id__in=custom_question_ids))
 
     if len(input_questions) != len(custom_question_ids):
         raise Http404(_("Some of the provided object ids are invalid."))
 
-    if len(input_questions) != request.event.questions.count():
+    if len(input_questions) != qs.count():
         raise Http404(_("Not all objects have been selected."))
 
     for q in input_questions:
@@ -556,18 +482,19 @@ def reorder_questions(request, organizer, event):
                 }
             )
 
-    system_question_order = {}
-    for s in ('attendee_name_parts', 'attendee_email', 'company', 'street', 'zipcode', 'city', 'country'):
-        if s in ids:
-            system_question_order[s] = ids.index(s)
-        else:
-            system_question_order[s] = -1
-    request.event.settings.system_question_order = system_question_order
-    request.event.log_action(
-        'pretix.event.settings', user=request.user, data={
-            'system_question_order': system_question_order,
-        }
-    )
+    if request.GET['container_type'] == Question.ContainerType.ORDERPOSITION:
+        system_question_order = {}
+        for s in ('attendee_name_parts', 'attendee_email', 'company', 'street', 'zipcode', 'city', 'country'):
+            if s in ids:
+                system_question_order[s] = ids.index(s)
+            else:
+                system_question_order[s] = -1
+        request.event.settings.system_question_order = system_question_order
+        request.event.log_action(
+            'pretix.event.settings', user=request.user, data={
+                'system_question_order': system_question_order,
+            }
+        )
 
     return HttpResponse()
 
@@ -805,6 +732,9 @@ class QuestionCreate(EventPermissionRequiredMixin, QuestionMixin, CreateView):
     def get_form_kwargs(self):
         kwargs = super().get_form_kwargs()
         kwargs['instance'] = Question(event=self.request.event)
+        kwargs['instance'].container_type = self.request.GET.get('container_type', Question.ContainerType.ORDERPOSITION)
+        if kwargs['instance'].container_type not in Question.ContainerType.values:
+            raise PermissionDenied
         return kwargs
 
     def get_success_url(self) -> str:

src/pretix/control/views/mailsetup.py

@@ -269,8 +269,8 @@ class MailSettingsSetupView(TemplateView):
             if settings.MAIL_CUSTOM_SENDER_DMARC_REQUIRED:
                 dmarc_record = get_dmarc_record(hostname)
                 if not dmarc_record:
-                    spf_warning = _(
-                        'We did not find DMARC record for your domain. This means that there is a very high chance '
+                    dmarc_warning = _(
+                        'We did not find a DMARC record for your domain. This means that there is a very high chance '
                         'most of the emails will be rejected or marked as spam. You should update the DNS settings '
                         'of your domain.'
                     )

src/pretix/control/views/orders.py

@@ -382,7 +382,7 @@ class OrderOverpaidRefundBulkActionView(BaseOrderBulkActionView):
                         'provider': refund.provider,
                     }, user=self.request.user)
                     payment.payment_provider.execute_refund(refund)
-                    return True
+                return bool(proposals)
             except (ValueError, PaymentException):
                 return False
 
@@ -2226,6 +2226,10 @@ class OrderModifyInformation(OrderQuestionsViewMixin, OrderView):
     only_user_visible = False
     all_optional = True
 
+    @property
+    def order_question_container(self):
+        return self.order
+
     def get_context_data(self, **kwargs):
         ctx = super().get_context_data(**kwargs)
         ctx['other_form'] = self.other_form
@@ -2587,7 +2591,11 @@ class AnswerDownload(EventPermissionRequiredMixin, OrderViewMixin, ListView):
         answid = kwargs.get('answer')
         token = request.GET.get('token', '')
 
-        answer = get_object_or_404(QuestionAnswer, orderposition__order=self.order, id=answid)
+        answer = get_object_or_404(
+            QuestionAnswer,
+            Q(orderposition__order=self.order) | Q(order=self.order),
+            id=answid
+        )
         if not answer.file:
             raise Http404()
         if not check_token(request, answer, token):
@@ -2597,7 +2605,7 @@ class AnswerDownload(EventPermissionRequiredMixin, OrderViewMixin, ListView):
         resp = FileResponse(answer.file, content_type=ftype or 'application/binary')
         resp['Content-Disposition'] = 'attachment; filename="{}-{}-{}-{}"'.format(
             self.request.event.slug.upper(), self.order.code,
-            answer.orderposition.positionid,
+            answer.orderposition.positionid if answer.orderposition else '',
             os.path.basename(answer.file.name).split('.', 1)[1]
         )
         return resp

src/pretix/control/views/organizer.py

@@ -108,6 +108,9 @@ from pretix.base.services.export import (
     init_organizer_exporters, multiexport, scheduled_organizer_export,
 )
 from pretix.base.services.mail import mail, prefix_subject
+from pretix.base.services.placeholders import (
+    prepare_sample_context_for_preview,
+)
 from pretix.base.templatetags.rich_text import markdown_compile_email
 from pretix.base.views.tasks import AsyncAction
 from pretix.control.forms.exports import ScheduledOrganizerExportForm
@@ -345,16 +348,11 @@ class MailSettingsPreview(OrganizerPermissionRequiredMixin, View):
 
     # get all supported placeholders with dummy values
     def placeholders(self, item):
-        ctx = {}
-        for p, s in MailSettingsForm(obj=self.request.organizer)._get_sample_context(
-                MailSettingsForm.base_context[item]).items():
-            if s.strip().startswith('*'):
-                ctx[p] = s
-            else:
-                ctx[p] = '<span class="placeholder" title="{}">{}</span>'.format(
-                    _('This value will be replaced based on dynamic parameters.'),
-                    s
-                )
+        ctx = prepare_sample_context_for_preview(
+            MailSettingsForm(obj=self.request.organizer)._get_sample_context(
+                MailSettingsForm.base_context[item]
+            )
+        )
         return self.SafeDict(ctx)
 
     def post(self, request, *args, **kwargs):
@@ -1210,7 +1208,7 @@ class DeviceQueryMixin:
     def get_queryset(self):
         qs = self.request.organizer.devices.prefetch_related(
             'limit_events', 'gate',
-        ).order_by('revoked', '-device_id')
+        ).select_related('last_seen').order_by('revoked', '-device_id')
 
         if 'device' in self.request_data and '__ALL' not in self.request_data:
             qs = qs.filter(

src/pretix/control/views/subevents.py

@@ -431,7 +431,7 @@ class SubEventEditorMixin(MetaDataEditorMixin):
         days = (self.copy_from.date_from.astimezone(tz).date() - value.astimezone(tz).date()).days
         return RelativeDateWrapper(RelativeDate(
             days=abs(days),
-            base_date_name='date_from',
+            base_date_name='event__date_from',
             time=value.astimezone(tz).time(),
             minutes=None,
             is_after=days < 0,

src/pretix/helpers/database.py

@@ -22,6 +22,7 @@
 import contextlib
 
 from django.conf import settings
+from django.contrib.postgres.indexes import BrinIndex
 from django.core.exceptions import FieldDoesNotExist, ImproperlyConfigured
 from django.db import connection, transaction
 from django.db.models import (
@@ -285,3 +286,30 @@ def get_deterministic_ordering(model, ordering):
             # on the primary key to provide total ordering.
             ordering.append("-pk")
     return ordering
+
+
+@contextlib.contextmanager
+def conditional_atomic(do_atomic, **kwargs):
+    if do_atomic:
+        with transaction.atomic(**kwargs):
+            yield
+    else:
+        yield
+
+
+class IgnoreOnSQLiteMixin:
+    # Mixin to allow defining PostgreSQL-specific indexes that will just not be created
+    # on SQLite. SQLite is supported for testing only anyways!
+    def create_sql(self, model, schema_editor, *args, **kwargs):
+        if "sqlite" in settings.DATABASES["default"]["ENGINE"]:
+            return ""
+        return super().create_sql(model, schema_editor, *args, **kwargs)
+
+    def remove_sql(self, model, schema_editor, **kwargs):
+        if "sqlite" in settings.DATABASES["default"]["ENGINE"]:
+            return ""
+        return super().remove_sql(model, schema_editor, **kwargs)
+
+
+class BrinIndexIgnoredOnSQLite(IgnoreOnSQLiteMixin, BrinIndex):
+    pass

src/pretix/helpers/safedownload.py

@@ -24,17 +24,21 @@ import hashlib
 from django.core.signing import BadSignature, TimestampSigner
 
 
+class SafeDownloadSigner(TimestampSigner):
+    pass
+
+
 def get_token(request, answer):
     if not request.session.session_key:
         request.session.create()
     payload = '{}:{}'.format(request.session.session_key, answer.pk)
-    signer = TimestampSigner()
+    signer = SafeDownloadSigner()
     return signer.sign(hashlib.sha1(payload.encode()).hexdigest())
 
 
 def check_token(request, answer, token):
     payload = hashlib.sha1('{}:{}'.format(request.session.session_key, answer.pk).encode()).hexdigest()
-    signer = TimestampSigner()
+    signer = SafeDownloadSigner()
     try:
         return payload == signer.unsign(token, max_age=3600 * 24)
     except BadSignature:

src/pretix/locale/da/LC_MESSAGES/django.po

@@ -4,10 +4,10 @@ msgstr ""
 "Project-Id-Version: 1\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-07-30 13:52+0000\n"
-"PO-Revision-Date: 2026-07-27 17:00+0000\n"
+"PO-Revision-Date: 2026-07-31 18:00+0000\n"
 "Last-Translator: Nikolai <nikolai@lengefeldt.de>\n"
-"Language-Team: Danish <https://translate.pretix.eu/projects/pretix/pretix/da/"
-">\n"
+"Language-Team: Danish <https://translate.pretix.eu/projects/pretix/pretix/"
+"da/>\n"
 "Language: da\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
@@ -1381,10 +1381,8 @@ msgid "Membership type"
 msgstr "Medlemskabstype"
 
 #: pretix/base/exporters/customers.py
-#, fuzzy
-#| msgid "Purchase time"
 msgid "Purchase ticket"
-msgstr "Købsdato"
+msgstr "Køb billet"
 
 #: pretix/base/exporters/customers.py pretix/base/exporters/orderlist.py
 #: pretix/base/exporters/waitinglist.py pretix/base/forms/questions.py
@@ -1401,10 +1399,8 @@ msgid "Start date"
 msgstr "Starttidspunkt"
 
 #: pretix/base/exporters/customers.py
-#, fuzzy
-#| msgid "Start time from"
 msgid "Start time"
-msgstr "Starttidspunkt fra"
+msgstr "Starttidspunkt"
 
 #: pretix/base/exporters/customers.py pretix/base/exporters/orderlist.py
 #: pretix/base/exporters/waitinglist.py pretix/base/models/memberships.py
@@ -1417,10 +1413,8 @@ msgid "End date"
 msgstr "Sluttidspunkt"
 
 #: pretix/base/exporters/customers.py
-#, fuzzy
-#| msgid "End: %(time)s"
 msgid "End time"
-msgstr "Slut: %(time)s"
+msgstr "Sluttidspunkt"
 
 #: pretix/base/exporters/dekodi.py pretix/base/exporters/invoices.py
 msgctxt "export_category"
@@ -4641,16 +4635,12 @@ msgid "This event is remote or partially remote."
 msgstr "Dette arrangement afholdes online eller delvist online."
 
 #: pretix/base/models/event.py
-#, fuzzy
-#| msgid ""
-#| "This will be used to let users know if the event is in a different "
-#| "timezone and let’s us calculate users’ local times."
 msgid ""
 "This will be used to let users know if the event is in a different timezone, "
 "and to let us calculate the local time of a user."
 msgstr ""
 "Dette vil blive brugt til at informere brugerne om, hvorvidt begivenheden "
-"finder sted i en anden tidszone, og til at beregne brugernes lokale tid."
+"finder sted i en anden tidszone, og til at beregne brugerens lokale tid."
 
 #: pretix/base/models/event.py pretix/base/models/organizer.py
 #: pretix/control/navigation.py
@@ -5472,14 +5462,6 @@ msgid "Reusable media policy"
 msgstr "Politik for genanvendelige medier"
 
 #: pretix/base/models/items.py
-#, fuzzy
-#| msgid ""
-#| "If this product should be stored on a re-usable physical medium, you can "
-#| "attach a physical media policy. This is not required for regular tickets, "
-#| "which just use a one-time barcode, but only for products like renewable "
-#| "season tickets or re-chargeable gift card wristbands. This is an advanced "
-#| "feature that also requires specific configuration of ticketing and "
-#| "printing settings."
 msgid ""
 "If this product should be stored on a reusable physical medium, you can "
 "attach a physical media policy. This is not required for regular tickets, "
@@ -5488,12 +5470,12 @@ msgid ""
 "feature that also requires specific configuration of ticketing and printing "
 "settings."
 msgstr ""
-"Hvis dette produkt skal opbevares på et genanvendeligt fysisk medie, kan du "
-"vedhæfte en politik for fysiske medier. Dette er ikke nødvendigt for "
-"almindelige billetter, som bare bruger en engangs-stregkode, men kun for "
-"produkter som f.eks. fornyelige sæsonkort eller genopladelige gavekort-"
-"armbånd. Dette er en avanceret funktion, som også kræver en specifik "
-"konfiguration af billet- og printindstillinger."
+"Hvis dette produkt skal opbevares på et genanvendeligt fysisk medium, kan du "
+"knytte en politik for fysiske medier til det. Dette er ikke påkrævet for "
+"almindelige billetter, som blot bruger en engangsstregkode, men gælder kun "
+"for produkter som sæsonkort, der kan fornyes, eller gavekortarmbånd, som kan "
+"blive genopladet. Dette er en avanceret funktion, der også kræver en "
+"specifik konfiguration af billet- og udskrivningsindstillingerne."
 
 #: pretix/base/models/items.py
 msgid "Reusable media type"
@@ -5537,6 +5519,9 @@ msgid ""
 "prior to their usage. Therefore, the selected media policy does not make "
 "sense for this media type."
 msgstr ""
+"Den valgte medietype kræver, at alle medier registreres i systemet, inden de "
+"tages i brug. Derfor giver den valgte mediepolitik ikke mening for denne "
+"medietype."
 
 #: pretix/base/models/items.py
 msgid ""
@@ -6090,18 +6075,16 @@ msgstr "afvist"
 #: pretix/base/models/media.py
 msgctxt "reusable_medium"
 msgid "Claim token"
-msgstr ""
+msgstr "Hent token"
 
 #: pretix/base/models/media.py
 msgctxt "reusable_medium"
 msgid "Label"
-msgstr ""
+msgstr "Etiket"
 
 #: pretix/base/models/media.py
-#, fuzzy
-#| msgid "Linked ticket"
 msgid "Linked tickets"
-msgstr "Forbundet billet"
+msgstr "Sammenkædede billetter"
 
 #: pretix/base/models/media.py
 msgid ""
@@ -6109,6 +6092,9 @@ msgid ""
 "validity. If multiple tickets are valid at once, this will lead to failed "
 "check-ins."
 msgstr ""
+"Hvis du linker til mere end én billet, skal du sikre dig, at der ikke er "
+"nogen overlapning i gyldighedsperioden. Hvis flere billetter er gyldige på "
+"samme tid, vil det medføre, at check-in mislykkes."
 
 #: pretix/base/models/memberships.py
 #: pretix/presale/templates/pretixpresale/organizers/customer_memberships.html
@@ -7568,6 +7554,8 @@ msgid ""
 "This payment provider exists for historical purposes only and is no longer "
 "usable."
 msgstr ""
+"Denne betalingsudbyder findes udelukkende af historiske årsager og kan ikke "
+"længere benyttes."
 
 #: pretix/base/pdf.py
 msgid "Ticket code (barcode content)"
@@ -7802,15 +7790,12 @@ msgid "Atlantis"
 msgstr "Eksempelland"
 
 #: pretix/base/pdf.py
-#, fuzzy
 msgid "Invoice custom recipient field"
-msgstr "Fakturamodtager:"
+msgstr "Brugerdefineret modtagerfelt på fakturaen"
 
 #: pretix/base/pdf.py
-#, fuzzy
-#| msgid "Custom recipient field label"
 msgid "Custom recipient field"
-msgstr "Brugerdefineret etiket til modtagerfelt"
+msgstr "Brugerdefineret modtagerfelt"
 
 #: pretix/base/pdf.py
 msgid "List of Add-Ons"
@@ -8252,7 +8237,7 @@ msgstr "Arrangement aflyst"
 
 #: pretix/base/services/cancelevent.py
 msgid "Confirm event cancellation and bulk refund"
-msgstr ""
+msgstr "Bekræft aflysning af begivenhed og samlet refusion"
 
 #: pretix/base/services/cart.py pretix/base/services/modelimport.py
 #: pretix/base/services/orders.py
@@ -8781,13 +8766,15 @@ msgstr "Du skal svare på spørgsmål for at gennemføre dette tjek-ind."
 
 #: pretix/base/services/checkin.py
 msgid "Ticket needs to be exchanged to a suitable medium."
-msgstr ""
+msgstr "Billetten skal ombyttes til et passende medium."
 
 #: pretix/base/services/checkin.py
 msgid ""
 "This ticket has already been exchanged for a reusable medium that now needs "
 "to be used instead."
 msgstr ""
+"Denne billet er allerede blevet ombyttet til et genanvendeligt medium, som "
+"nu skal bruges i stedet."
 
 #: pretix/base/services/checkin.py
 msgid "This ticket has already been redeemed."
@@ -8818,9 +8805,8 @@ msgid "Your export did not contain any data."
 msgstr "Din eksport indeholdt ingen data."
 
 #: pretix/base/services/export.py
-#, fuzzy
 msgid "Scheduled export failed"
-msgstr "Start eksport"
+msgstr "Den planlagte eksport mislykkedes"
 
 #: pretix/base/services/export.py
 msgid "Permission denied."
@@ -8947,60 +8933,44 @@ msgid "You are receiving this email because you placed an order for {event}."
 msgstr "Du modtager denne e-mail, fordi du har afgivet en ordre til {event}."
 
 #: pretix/base/services/media.py
-#, fuzzy
-#| msgid "Invalid input type."
 msgid "Invalid medium type."
-msgstr "Ugyldig indtastning."
+msgstr "Ugyldig medietype."
 
 #: pretix/base/services/media.py
-#, fuzzy
-#| msgid "The selected media type is not enabled in your organizer settings."
 msgid "Medium type is not enabled for organizer."
-msgstr "Den valgte medietype er ikke aktiveret i dine arrangør-indstillinger."
+msgstr "Medie-typen er ikke aktiveret for arrangøren."
 
 #: pretix/base/services/media.py
 msgid "Incorrect medium type for product."
-msgstr ""
+msgstr "Forkert medietype for produktet."
 
 #: pretix/base/services/media.py
-#, fuzzy
-#| msgid "This ticket has already been redeemed."
 msgid "Ticket is already exchanged for reusable medium."
-msgstr "Denne billet er allerede blevet indløst."
+msgstr "Billetten er allerede ombyttet til et genanvendeligt medium."
 
 #: pretix/base/services/media.py
-#, fuzzy
-#| msgid "Reusable Medium ID"
 msgid "Reusable medium not found."
-msgstr "ID for genanvendeligt medie"
+msgstr "Genanvendeligt medie blev ikke fundet."
 
 #: pretix/base/services/media.py
-#, fuzzy
-#| msgid "The reusable medium has been created."
 msgid "Reusable medium is inactive or expired."
-msgstr "Det genanvendelige medie er blevet oprettet."
+msgstr "Det genanvendelige medium er inaktivt eller udløbet."
 
 #: pretix/base/services/media.py
-#, fuzzy
-#| msgid "The reusable medium has been created."
 msgid "Reusable medium not found and could not be created."
-msgstr "Det genanvendelige medie er blevet oprettet."
+msgstr "Genanvendeligt medie blev ikke fundet og kunne ikke oprettes."
 
 #: pretix/base/services/media.py
-#, fuzzy
-#| msgid "Reusable media type"
 msgid "Reusable medium already exists."
-msgstr "Genanvendelig medietype"
+msgstr "Det genanvendelige medie findes allerede."
 
 #: pretix/base/services/media.py
-#, fuzzy
-#| msgid "The reusable medium has been created."
 msgid "Reusable medium could not be created."
-msgstr "Det genanvendelige medie er blevet oprettet."
+msgstr "Det var ikke muligt at oprette det genanvendelige medie."
 
 #: pretix/base/services/media.py
 msgid "Product does not support medium exchange."
-msgstr ""
+msgstr "Produktet understøtter ikke udskiftning af medier."
 
 #: pretix/base/services/memberships.py
 #, python-brace-format
@@ -9164,6 +9134,7 @@ msgstr "En voucher kan ikke oprettes uden kode."
 msgid ""
 "Voucher codes must be unique. Code \"{code}\" already exists in this import."
 msgstr ""
+"Kuponkoder skal være unikke. Koden \"{code}\" findes allerede i denne import."
 
 #: pretix/base/services/modelimport.py
 #, python-brace-format
@@ -9172,13 +9143,19 @@ msgid ""
 msgid_plural ""
 "Voucher codes must be unique. Import contains existing voucher codes {code}."
 msgstr[0] ""
+"Rabatkoder skal være unikke. Importen indeholder den eksisterende rabatkode "
+"{code}."
 msgstr[1] ""
+"Rabatkoder skal være unikke. Importen indeholder de eksisterende rabatkoder "
+"{code}."
 
 #: pretix/base/services/modelimport.py
 msgid ""
 "Vouchers could not be imported, probably due to a voucher code already being "
 "in use."
 msgstr ""
+"Rabatkoder kunne ikke importeres, sandsynligvis fordi en kuponkode allerede "
+"var i brug."
 
 #: pretix/base/services/orders.py
 msgid ""
@@ -9462,16 +9439,12 @@ msgstr ""
 "gavekort."
 
 #: pretix/base/services/orders.py
-#, fuzzy
-#| msgid ""
-#| "You cannot change the price of a position that has been used to issue a "
-#| "gift card."
 msgid ""
 "You cannot change the ticket secret of a position that has been used to "
 "issue a gift card."
 msgstr ""
-"Du kan ikke ændre prisen af en post, som er blevet brugt til at udstede et "
-"gavekort."
+"Du kan ikke ændre billetkoden for en position, der er blevet brugt til at "
+"udstede et gavekort."
 
 #: pretix/base/services/orders.py
 #, python-brace-format
@@ -9558,10 +9531,9 @@ msgid "Something happened in your event after the export, please try again."
 msgstr "Der skete noget i din begivenhed efter eksporten, prøv venligst igen."
 
 #: pretix/base/services/shredder.py
-#, fuzzy, python-format
-#| msgid "Data shredding completed"
+#, python-format
 msgid "Data shredding completed for %(event)s"
-msgstr "Makulering af data afsluttet"
+msgstr "Datadestruktion for %(event)s er afsluttet"
 
 #: pretix/base/services/stats.py
 msgid "Uncategorized"
@@ -9738,29 +9710,24 @@ msgstr ""
 "ind under købet."
 
 #: pretix/base/settings.py
-#, fuzzy
-#| msgid "Activate re-usable media"
 msgid "Activate reusable media"
 msgstr "Aktiver genanvendelige medier"
 
 #: pretix/base/settings.py
-#, fuzzy
-#| msgid ""
-#| "The re-usable media feature allows you to connect tickets and gift cards "
-#| "with physical media such as wristbands or chip cards that may be re-used "
-#| "for different tickets or gift cards later."
 msgid ""
 "The reusable media feature allows you to connect tickets and gift cards with "
 "physical media such as wristbands or chip cards that may be reused for "
 "different tickets or gift cards later."
 msgstr ""
-"Funktionen \"Genanvendelige medier\" gør det muligt at forbinde billetter og "
-"voucher med fysiske medier som armbånd eller chipkort, der kan genbruges til "
-"andre billetter eller voucher senere."
+"Med funktionen \"Genanvendelige medier\" kan du knytte billetter og gavekort "
+"til fysiske medier såsom armbånd eller chipkort, som senere kan genbruges "
+"til andre billetter eller gavekort."
 
 #: pretix/base/settings.py
 msgid "Enforce the usage of issued reusable media for check-in"
 msgstr ""
+"Gennemtving, at der udelukkende anvendes de udleverede genanvendelige medier "
+"ved check-in"
 
 #: pretix/base/settings.py
 msgid ""
@@ -9768,6 +9735,10 @@ msgid ""
 "medium has been created and linked to a ticket. Keeping this option turned "
 "off will treat the reusable medium and ticket as equals."
 msgstr ""
+"Hvis denne indstilling er aktiveret, accepteres en billetstregkode ikke "
+"længere, hvis der er oprettet et genanvendeligt medie, som er knyttet til en "
+"billet. Hvis denne indstilling forbliver deaktiveret, behandles det "
+"genanvendelige medie og billetten på samme måde."
 
 #: pretix/base/settings.py
 msgid "Length of barcodes"
@@ -11336,10 +11307,8 @@ msgid "We'll show this publicly to allow attendees to contact you."
 msgstr "Vi vil vise dette offentligt, så deltagerne kan kontakte dig."
 
 #: pretix/base/settings.py
-#, fuzzy
-#| msgid "Contact"
 msgid "Contact URL"
-msgstr "Kontakt"
+msgstr "Kontakt-URL"
 
 #: pretix/base/settings.py
 msgid ""
@@ -11347,6 +11316,9 @@ msgid ""
 "the email address above. Please note that you still need to add a contact "
 "email address that will be shared with all emails you send."
 msgstr ""
+"Hvis du indstiller dette, vil kontaktlinket i sidefoden pege hertil i stedet "
+"for at bruge ovenstående e-mailadresse. Bemærk, at du stadig skal tilføje en "
+"kontakt-e-mailadresse, som vil blive angivet i alle de e-mails, du sender."
 
 #: pretix/base/settings.py pretix/control/forms/event.py
 msgid "Imprint URL"
@@ -13213,30 +13185,19 @@ msgstr ""
 "os."
 
 #: pretix/base/templates/pretixbase/email/cancel_confirm.txt
-#, fuzzy
-#| msgid ""
-#| "You have requested us to cancel an event which includes a larger bulk-"
-#| "refund:"
 msgid "You requested to cancel an event that involves a large bulk refund:"
 msgstr ""
-"Du har bedt os om at aflyse et arrangement, der indebærer en større samlet "
+"Du har anmodet om at annullere en begivenhed, der medfører en stor samlet "
 "refusion:"
 
 #: pretix/base/templates/pretixbase/email/cancel_confirm.txt
-#, fuzzy
-#| msgid "Estimated refund amount"
 msgid "Estimated refund"
-msgstr "Anslået refusionsbeløb"
+msgstr "Anslået tilbagebetaling"
 
 #: pretix/base/templates/pretixbase/email/cancel_confirm.txt
-#, fuzzy
-#| msgid ""
-#| "Please confirm that you want to proceed by coping the following "
-#| "confirmation code into the cancellation form:"
 msgid "To confirm, paste the following code into the cancellation form:"
 msgstr ""
-"Bekræft venligst, at du ønsker at fortsætte ved at indsætte følgende "
-"bekræftelseskode i afmeldingsformularen:"
+"For at bekræfte skal du indsætte følgende kode i afbestillingsformularen:"
 
 #: pretix/base/templates/pretixbase/email/cancel_confirm.txt
 #, python-format
@@ -13244,6 +13205,8 @@ msgid ""
 "Don't share this code with anyone. The %(instance)s team will never ask you "
 "for it."
 msgstr ""
+"Del ikke denne kode med nogen. %(instance)s-teamet vil aldrig bede dig om "
+"den."
 
 #: pretix/base/templates/pretixbase/email/cancel_confirm.txt
 #: pretix/base/templates/pretixbase/email/export_failed.txt
@@ -13252,6 +13215,8 @@ msgid ""
 "Thanks,  \n"
 "The %(instance)s Team"
 msgstr ""
+"Tak,  \n"
+"%(instance)s-teamet"
 
 #: pretix/base/templates/pretixbase/email/email_footer.html
 #, python-format
@@ -13259,51 +13224,38 @@ msgid "powered by <a %(a_attr)s>pretix</a>"
 msgstr "drevet af <a %(a_attr)s>pretix</a>"
 
 #: pretix/base/templates/pretixbase/email/export_failed.txt
-#, fuzzy
-#| msgid "Your export failed."
 msgid "Your scheduled export failed."
-msgstr "Din eksport mislykkedes."
+msgstr "Din planlagte eksport mislykkedes."
 
 #: pretix/base/templates/pretixbase/email/export_failed.txt
 #: pretix/control/templates/pretixcontrol/event/tax_edit.html
-#, fuzzy
 msgid "Reason"
-msgstr "Tilbagebetal bestilling"
+msgstr "Begrundelse"
 
 #: pretix/base/templates/pretixbase/email/export_failed.txt
-#, fuzzy
-#| msgid "If your export fails five times in a row, it will no longer be sent."
 msgid "If an export fails five times in a row, we'll stop sending it."
 msgstr ""
-"Hvis din eksport mislykkes fem gange i træk, vil den ikke længere blive "
-"sendt."
+"Hvis en eksport mislykkes fem gange i træk, vil vi stoppe med at sende den."
 
 #: pretix/base/templates/pretixbase/email/export_failed.txt
-#, fuzzy
-#| msgid "You can request to cancel this order."
 msgid "You can adjust or remove this export here:"
-msgstr "Du kan anmode om at annullere denne bestilling."
+msgstr "Du kan ændre eller fjerne denne eksport her:"
 
 #: pretix/base/templates/pretixbase/email/notification.html
 #: pretix/base/templates/pretixbase/email/notification.txt
-#, fuzzy
-#| msgid "You receive these emails based on your notification settings."
 msgid "You're receiving this email based on your notification settings."
 msgstr ""
-"Du modtager disse e-mails i henhold til dine indstillinger for "
-"notifikationer."
+"Du modtager denne e-mail i henhold til dine indstillinger for meddelelser."
 
 #: pretix/base/templates/pretixbase/email/notification.html
 #: pretix/base/templates/pretixbase/email/notification.txt
-#, fuzzy
 msgid "Manage settings"
-msgstr "Basisindstillinger"
+msgstr "Administrer indstillinger"
 
 #: pretix/base/templates/pretixbase/email/notification.html
 #: pretix/base/templates/pretixbase/email/notification.txt
-#, fuzzy
 msgid "Disable all notifications"
-msgstr "E-mailnotifikationer"
+msgstr "Deaktiver alle notifikationer"
 
 #: pretix/base/templates/pretixbase/email/order_details.html
 msgid ""
@@ -13362,25 +13314,7 @@ msgid "Contact"
 msgstr "Kontakt"
 
 #: pretix/base/templates/pretixbase/email/shred_completed.txt
-#, fuzzy, python-format
-#| msgid ""
-#| "Hello,\n"
-#| "\n"
-#| "we hereby confirm that the following data shredding job has been "
-#| "completed:\n"
-#| "\n"
-#| "Organizer: %(organizer)s\n"
-#| "\n"
-#| "Event: %(event)s\n"
-#| "\n"
-#| "Data selection: %(shredders)s\n"
-#| "\n"
-#| "Start time: %(start_time)s (new data added after this time might not have "
-#| "been deleted)\n"
-#| "\n"
-#| "Best regards,\n"
-#| "\n"
-#| "Your %(instance)s team\n"
+#, python-format
 msgid ""
 "Hello,\n"
 "\n"
@@ -13398,20 +13332,19 @@ msgid ""
 msgstr ""
 "Hej,\n"
 "\n"
-"vi bekræfter hermed, at følgende datadestruktionsopgave er afsluttet:\n"
+"Følgende datadestruktionsopgave er afsluttet:\n"
 "\n"
-"Arrangør: %(organizer)s\n"
+"- Arrangør: %(organizer)s\n"
+"- Begivenhed: %(event)s\n"
+"- Dataudvælgelse: %(shredders)s\n"
+"- Starttidspunkt: %(start_time)s\n"
 "\n"
-"Begivenhed: %(event)s\n"
+"Data, der er tilføjet til begivenheden efter starttidspunktet, er muligvis "
+"ikke blevet slettet.\n"
 "\n"
-"Dataudvælgelse: %(shredders)s\n"
+"Med venlig hilsen,  \n"
 "\n"
-"Starttidspunkt: %(start_time)s (nye data tilføjet efter dette tidspunkt er "
-"muligvis ikke blevet slettet)\n"
-"\n"
-"Med venlig hilsen,\n"
-"\n"
-"Dit %(instance)s-team\n"
+"%(instance)s-teamet\n"
 
 #: pretix/base/templates/pretixbase/forms/widgets/checkbox_sales_channel_option.html
 msgid ""
@@ -13443,22 +13376,23 @@ msgstr "%(number)s dage %(relation)s %(relation_to)s på %(time_of_day)s"
 #: pretix/base/templates/pretixbase/framebreak.html
 #: pretix/presale/templates/pretixpresale/event/cookies.html
 msgid "Please continue in a new tab"
-msgstr ""
+msgstr "Fortsæt venligst i en ny fane"
 
 #: pretix/base/templates/pretixbase/framebreak.html
 msgid "For security reasons, the following step is only possible in a new tab."
 msgstr ""
+"Af sikkerhedsmæssige årsager kan det følgende trin kun udføres i en ny fane."
 
 #: pretix/base/templates/pretixbase/framebreak.html
 msgid ""
 "If the new tab did not open automatically, please click the following button:"
 msgstr ""
+"Hvis den nye fane ikke åbnede automatisk, skal du klikke på følgende knap:"
 
 #: pretix/base/templates/pretixbase/framebreak.html
 #: pretix/presale/templates/pretixpresale/event/cookies.html
-#, fuzzy
 msgid "Continue in new tab"
-msgstr "Opret gruppe"
+msgstr "Fortsæt i en ny fane"
 
 #: pretix/base/templates/pretixbase/redirect.html
 msgid "Redirect"
@@ -15184,13 +15118,11 @@ msgstr "Søg efter e-mailadresse eller emne"
 #: pretix/control/templates/pretixcontrol/order/index.html
 #: pretix/control/templates/pretixcontrol/orders/refunds.html
 msgid "Source"
-msgstr ""
+msgstr "Kilde"
 
 #: pretix/control/forms/filter.py
-#, fuzzy
-#| msgid "All vouchers"
 msgid "All sources"
-msgstr "Alle vouchere"
+msgstr "Alle kilder"
 
 #: pretix/control/forms/filter.py
 msgid "Team actions"
@@ -15201,21 +15133,16 @@ msgid "Customer actions"
 msgstr "Kundehandlinger"
 
 #: pretix/control/forms/filter.py
-#, fuzzy
-#| msgid "Device status"
 msgid "Device actions"
-msgstr "Enhedsstatus"
+msgstr "Enhedshandlinger"
 
 #: pretix/control/forms/filter.py
-#, fuzzy
-#| msgid "Order email"
 msgid "User email"
-msgstr "Bestillings-e-mail"
+msgstr "Brugerens e-mailadresse"
 
 #: pretix/control/forms/filter.py pretix/control/navigation.py
-#, fuzzy
 msgid "All users"
-msgstr "Alle vouchere"
+msgstr "Alle brugere"
 
 #: pretix/control/forms/global_settings.py
 msgid "Additional footer text"
@@ -16724,40 +16651,34 @@ msgid ""
 "because at least one of the selected vouchers has already been redeemed "
 "%(max_redeemed)s times."
 msgstr ""
+"Du kan ikke reducere det maksimale antal indløsninger til %(max_usages)s, da "
+"mindst én af de valgte kuponer allerede er blevet indløst %(max_redeemed)s "
+"gange."
 
 #: pretix/control/forms/vouchers.py
-#, fuzzy
-#| msgid ""
-#| "You cannot create a voucher that blocks quota as the selected product or "
-#| "quota is currently sold out or completely reserved."
 msgid ""
 "You cannot create a voucher that allows selection of a quota but has no date "
 "selected."
 msgstr ""
-"Du kan ikke oprette en rabatkode der blokerer en kvote idet det valgte "
-"produkt eller kvote pt. er udsolgt eller fuldt reserveret."
+"Du kan ikke oprette en kupon, hvor det er muligt at vælge en kvote, men hvor "
+"der ikke er valgt nogen dato."
 
 #: pretix/control/forms/vouchers.py
-#, fuzzy
-#| msgid "The selected product does not allow to select a seat."
 msgid "The selected quota does not match the selected subevent."
-msgstr "Det valgte produkt tillader ikke, at du vælger en plads."
+msgstr "Den valgte kvote stemmer ikke overens med den valgte underbegivenhed."
 
 #: pretix/control/forms/vouchers.py
-#, fuzzy
-#| msgid ""
-#| "There is not enough quota available on quota \"{}\" to perform the "
-#| "operation."
 msgid "There is no sufficient quota available to perform this change."
 msgstr ""
-"Der er ikke enheder nok tilbage på kvoten \"{}\" til at udføre denne "
-"operation."
+"Der er ikke tilstrækkelig kvote til rådighed til at gennemføre denne ændring."
 
 #: pretix/control/forms/vouchers.py
 msgid ""
 "Changing the maximum number of usages in bulk is not supported if any of the "
 "selected vouchers is assigned a seat."
 msgstr ""
+"Det er ikke muligt at ændre det maksimale antal anvendelser samlet, hvis en "
+"af de valgte kuponer er tildelt en plads."
 
 #: pretix/control/forms/vouchers.py
 msgctxt "subevent"
@@ -16765,18 +16686,24 @@ msgid ""
 "Changing the date in bulk is not supported if any of the selected vouchers "
 "is assigned a seat."
 msgstr ""
+"Det er ikke muligt at ændre datoen for flere billetter på én gang, hvis en "
+"af de valgte billetter er tildelt en plads."
 
 #: pretix/control/forms/vouchers.py
 msgid ""
 "Changing the product to a quota is not supported if any of the selected "
 "vouchers is assigned a seat."
 msgstr ""
+"Det er ikke muligt at ændre produktet til en kvote, hvis en af de valgte "
+"kuponer er tildelt en plads."
 
 #: pretix/control/forms/vouchers.py
 msgid ""
 "This change cannot be completed because not all assigned seats of the "
 "vouchers are still available"
 msgstr ""
+"Denne ændring kan ikke gennemføres, da ikke alle de tildelte pladser på "
+"billetterne stadig er ledige"
 
 #: pretix/control/forms/vouchers.py
 msgid "Codes"
@@ -17897,16 +17824,12 @@ msgid "The reusable medium has been changed."
 msgstr "Det genanvendelige medie er blevet udskiftet."
 
 #: pretix/control/logdisplay.py
-#, fuzzy
-#| msgid "The new member has been added to the team."
 msgid "A new ticket has been added to the medium."
-msgstr "Det nye medlem er blevet føjet til gruppen."
+msgstr "Der er blevet tilføjet en ny billet til mediet."
 
 #: pretix/control/logdisplay.py
-#, fuzzy
-#| msgid "{user} has been removed from the team."
 msgid "A ticket has been removed from the medium."
-msgstr "{user} er fjernet fra gruppen."
+msgstr "En billet er blevet fjernet fra mediet."
 
 #: pretix/control/logdisplay.py
 msgid "The medium has been connected to a new ticket."
@@ -17918,6 +17841,8 @@ msgid ""
 "The ticket #{positionid} was exchanged for reusable medium "
 "{medium_identifier}."
 msgstr ""
+"Billetten #{positionid} blev ombyttet til et genanvendeligt medie "
+"{medium_identifier}."
 
 #: pretix/control/logdisplay.py
 msgid "The medium has been connected to a new gift card."
@@ -18328,14 +18253,14 @@ msgid "Payment {local_id} has been confirmed."
 msgstr "Betalingen {local_id} er blevet bekræftet."
 
 #: pretix/control/logdisplay.py
-#, fuzzy, python-brace-format
+#, python-brace-format
 msgid "Payment {local_id} has been canceled."
-msgstr "Bestillingen er blevet annulleret."
+msgstr "Betalingen {local_id} er blevet annulleret."
 
 #: pretix/control/logdisplay.py
-#, fuzzy, python-brace-format
+#, python-brace-format
 msgid "Canceling payment {local_id} has failed."
-msgstr "Bestillingen er blevet annulleret."
+msgstr "Det lykkedes ikke at annullere betalingen {local_id}."
 
 #: pretix/control/logdisplay.py
 #, fuzzy, python-brace-format
@@ -21795,54 +21720,51 @@ msgstr ""
 
 #: pretix/control/templates/pretixcontrol/global_sysreport.html
 msgid "January"
-msgstr ""
+msgstr "januar"
 
 #: pretix/control/templates/pretixcontrol/global_sysreport.html
 msgid "February"
-msgstr ""
+msgstr "februar"
 
 #: pretix/control/templates/pretixcontrol/global_sysreport.html
-#, fuzzy
 msgid "March"
-msgstr "Marts"
+msgstr "marts"
 
 #: pretix/control/templates/pretixcontrol/global_sysreport.html
 msgid "April"
-msgstr ""
+msgstr "april"
 
 #: pretix/control/templates/pretixcontrol/global_sysreport.html
-#, fuzzy
-#| msgid "Day"
 msgid "May"
-msgstr "Dag"
+msgstr "maj"
 
 #: pretix/control/templates/pretixcontrol/global_sysreport.html
 msgid "June"
-msgstr ""
+msgstr "juni"
 
 #: pretix/control/templates/pretixcontrol/global_sysreport.html
 msgid "July"
-msgstr ""
+msgstr "juli"
 
 #: pretix/control/templates/pretixcontrol/global_sysreport.html
 msgid "August"
-msgstr ""
+msgstr "august"
 
 #: pretix/control/templates/pretixcontrol/global_sysreport.html
 msgid "September"
-msgstr "September"
+msgstr "september"
 
 #: pretix/control/templates/pretixcontrol/global_sysreport.html
 msgid "October"
-msgstr ""
+msgstr "oktober"
 
 #: pretix/control/templates/pretixcontrol/global_sysreport.html
 msgid "November"
-msgstr "November"
+msgstr "november"
 
 #: pretix/control/templates/pretixcontrol/global_sysreport.html
 msgid "December"
-msgstr "December"
+msgstr "december"
 
 #: pretix/control/templates/pretixcontrol/global_sysreport.html
 #, fuzzy

src/pretix/locale/da/LC_MESSAGES/djangojs.po

@@ -7,7 +7,7 @@ msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-07-06 15:52+0000\n"
-"PO-Revision-Date: 2026-04-22 18:00+0000\n"
+"PO-Revision-Date: 2026-07-31 18:00+0000\n"
 "Last-Translator: Nikolai <nikolai@lengefeldt.de>\n"
 "Language-Team: Danish <https://translate.pretix.eu/projects/pretix/pretix-js/"
 "da/>\n"
@@ -16,7 +16,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 5.17\n"
+"X-Generator: Weblate 2026.7.1\n"
 
 #: pretix/plugins/banktransfer/static/pretixplugins/banktransfer/ui.js
 msgid "Marked as paid"
@@ -1306,62 +1306,62 @@ msgstr ""
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "January"
-msgstr "Januar"
+msgstr "januar"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "February"
-msgstr "Februar"
+msgstr "februar"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "March"
-msgstr "Marts"
+msgstr "marts"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "April"
-msgstr "April"
+msgstr "april"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "May"
-msgstr "Maj"
+msgstr "maj"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "June"
-msgstr "Juni"
+msgstr "juni"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "July"
-msgstr "Juli"
+msgstr "juli"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "August"
-msgstr "August"
+msgstr "august"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "September"
-msgstr "September"
+msgstr "september"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "October"
-msgstr "Oktober"
+msgstr "oktober"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "November"
-msgstr "November"
+msgstr "november"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "December"
-msgstr "December"
+msgstr "december"
 
 #~ msgid "iDEAL"
 #~ msgstr "iDEAL"

src/pretix/locale/hu/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-07-30 13:52+0000\n"
-"PO-Revision-Date: 2026-07-23 15:35+0000\n"
+"PO-Revision-Date: 2026-08-01 21:00+0000\n"
 "Last-Translator: szurofkamarciidfbe08444ef04788 <szurofkamarcii@gmail.com>\n"
 "Language-Team: Hungarian <https://translate.pretix.eu/projects/pretix/pretix/"
 "hu/>\n"
@@ -1377,10 +1377,8 @@ msgid "Membership type"
 msgstr "Tagságtípus"
 
 #: pretix/base/exporters/customers.py
-#, fuzzy
-#| msgid "Purchase time"
 msgid "Purchase ticket"
-msgstr "Vásárlás időpontja"
+msgstr "Jegy vásárlása"
 
 #: pretix/base/exporters/customers.py pretix/base/exporters/orderlist.py
 #: pretix/base/exporters/waitinglist.py pretix/base/forms/questions.py
@@ -1397,10 +1395,8 @@ msgid "Start date"
 msgstr "Kezdő dátum"
 
 #: pretix/base/exporters/customers.py
-#, fuzzy
-#| msgid "Start time from"
 msgid "Start time"
-msgstr "Kezdési időpont ettől"
+msgstr "Kezdési időpont"
 
 #: pretix/base/exporters/customers.py pretix/base/exporters/orderlist.py
 #: pretix/base/exporters/waitinglist.py pretix/base/models/memberships.py
@@ -1413,10 +1409,8 @@ msgid "End date"
 msgstr "Záró dátum"
 
 #: pretix/base/exporters/customers.py
-#, fuzzy
-#| msgid "End: %(time)s"
 msgid "End time"
-msgstr "Vége: %(time)s"
+msgstr "Záró időpont"
 
 #: pretix/base/exporters/dekodi.py pretix/base/exporters/invoices.py
 msgctxt "export_category"
@@ -4641,10 +4635,6 @@ msgid "This event is remote or partially remote."
 msgstr "Ez az rendezvény távoli vagy részben távoli."
 
 #: pretix/base/models/event.py
-#, fuzzy
-#| msgid ""
-#| "This will be used to let users know if the event is in a different "
-#| "timezone and let’s us calculate users’ local times."
 msgid ""
 "This will be used to let users know if the event is in a different timezone, "
 "and to let us calculate the local time of a user."
@@ -7578,15 +7568,11 @@ msgid "This gift card was used in the meantime. Please try again."
 msgstr "Ezt az ajándékkártyát időközben felhasználták. Kérjük, próbálja újra."
 
 #: pretix/base/payment.py
-#, fuzzy
-#| msgid ""
-#| "This payment provider does not exist or the respective plugin is disabled."
 msgid ""
 "This payment provider exists for historical purposes only and is no longer "
 "usable."
 msgstr ""
-"Ez a fizetési szolgáltató nem létezik, vagy a hozzá tartozó bővítmény le van "
-"tiltva."
+"Ez a fizetési szolgáltató egy korábbi funkció volt, már nem használható."
 
 #: pretix/base/pdf.py
 msgid "Ticket code (barcode content)"

src/pretix/locale/it/LC_MESSAGES/django.po

@@ -8,8 +8,8 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-07-30 13:52+0000\n"
-"PO-Revision-Date: 2026-05-12 04:00+0000\n"
-"Last-Translator: Stefano Campus <stefano.campus@regione.piemonte.it>\n"
+"PO-Revision-Date: 2026-08-03 23:00+0000\n"
+"Last-Translator: \"Luca Sorace \\\"Stranck\\\"\" <strdjn@gmail.com>\n"
 "Language-Team: Italian <https://translate.pretix.eu/projects/pretix/pretix/"
 "it/>\n"
 "Language: it\n"
@@ -17,7 +17,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 5.17.1\n"
+"X-Generator: Weblate 2026.7.1\n"
 
 #: pretix/_base_settings.py
 msgid "English"
@@ -149,7 +149,7 @@ msgstr "Spagnolo (America Latina)"
 
 #: pretix/_base_settings.py
 msgid "Thai"
-msgstr ""
+msgstr "Tailandese"
 
 #: pretix/_base_settings.py
 msgid "Turkish"
@@ -413,7 +413,7 @@ msgstr ""
 #: pretix/api/serializers/organizer.py pretix/control/views/organizer.py
 #, python-format
 msgid "You've been invited to join %(organizer)s"
-msgstr ""
+msgstr "Sei stato invitato ad entrare in %(organizer)s"
 
 #: pretix/api/serializers/organizer.py pretix/control/views/organizer.py
 msgid "This user already has been invited for this team."
@@ -605,6 +605,9 @@ msgid ""
 "This includes related events like creation, deletion, opening or closing of "
 "quotas. No webhook is sent for changes to the resulting availability."
 msgstr ""
+"Questo include gli eventi relativi quali la creazione, cancellazione, "
+"apertura o chiusura delle quote. Nessun webhook verrà inviato per modifiche "
+"alla disponibilità."
 
 #: pretix/api/webhooks.py
 msgid "Shop taken live"
@@ -1234,8 +1237,9 @@ msgstr "Indirizzi Email (file di testo)"
 #: pretix/control/templates/pretixcontrol/organizers/customer.html
 #: pretix/presale/templates/pretixpresale/organizers/customer_memberships.html
 #: pretix/presale/views/customer.py
+#, fuzzy
 msgid "Memberships"
-msgstr ""
+msgstr "Membership"
 
 #: pretix/base/exporters/customers.py pretix/base/models/customers.py
 #: pretix/control/templates/pretixcontrol/organizers/customer.html
@@ -3030,11 +3034,12 @@ msgid ""
 "The field \"%(label)s\" may not contain special characters such as "
 "\"%(chars)s\"."
 msgstr ""
+"Il campo \"%(label)s\" non può contenere i caratteri speciali \"%(chars)s\"."
 
 #: pretix/base/forms/questions.py
 #, python-format
 msgid "The field \"%(label)s\" may not contain an URL (%(url)s)."
-msgstr ""
+msgstr "Il campo \"%(label)s\" non può contenere un URL (%(url)s)."
 
 #: pretix/base/forms/questions.py
 msgctxt "phonenumber"
@@ -4272,8 +4277,9 @@ msgid "Ticket type not allowed here"
 msgstr "Biglietto non consentito qui"
 
 #: pretix/base/models/checkin.py
+#, fuzzy
 msgid "Ticket code is ambiguous on list"
-msgstr "Codice biglietto ambiguo nella lista"
+msgstr "Il codice del biglietto è ambiguo sulla lista"
 
 #: pretix/base/models/checkin.py
 msgid "Server error"
@@ -6167,14 +6173,15 @@ msgid "bounced"
 msgstr "rimbalzato"
 
 #: pretix/base/models/media.py
+#, fuzzy
 msgctxt "reusable_medium"
 msgid "Claim token"
-msgstr ""
+msgstr "Applica token"
 
 #: pretix/base/models/media.py
 msgctxt "reusable_medium"
 msgid "Label"
-msgstr ""
+msgstr "Etichetta"
 
 #: pretix/base/models/media.py
 #, fuzzy
@@ -6188,6 +6195,9 @@ msgid ""
 "validity. If multiple tickets are valid at once, this will lead to failed "
 "check-ins."
 msgstr ""
+"Se colleghi più di un biglietto, assicurati che la loro validità non si "
+"sovrapponga. Se più biglietti sono validi contemporaneamente i check-in "
+"andranno in errore."
 
 #: pretix/base/models/memberships.py
 #: pretix/presale/templates/pretixpresale/organizers/customer_memberships.html
@@ -7676,6 +7686,8 @@ msgid ""
 "This payment provider exists for historical purposes only and is no longer "
 "usable."
 msgstr ""
+"Questo provider di pagamenti esiste per ragioni storiche e non ne è più "
+"possibile l'utilizzo."
 
 #: pretix/base/pdf.py
 msgid "Ticket code (barcode content)"
@@ -7843,7 +7855,7 @@ msgstr "Giorno di inizio evento"
 #: pretix/base/pdf.py pretix/base/services/checkin.py
 #: pretix/control/forms/filter.py
 msgid "Friday"
-msgstr "venerdì"
+msgstr "Venerdì"
 
 #: pretix/base/pdf.py
 msgid "Event end date and time"
@@ -8387,7 +8399,7 @@ msgstr "Evento annullato"
 
 #: pretix/base/services/cancelevent.py
 msgid "Confirm event cancellation and bulk refund"
-msgstr ""
+msgstr "Conferma la cancellazione dell'evento e i rimborsi di tutti gli ordini"
 
 #: pretix/base/services/cart.py pretix/base/services/modelimport.py
 #: pretix/base/services/orders.py
@@ -9333,6 +9345,8 @@ msgstr "Non è possibile creare un buono senza un codice."
 msgid ""
 "Voucher codes must be unique. Code \"{code}\" already exists in this import."
 msgstr ""
+"Il codice del voucher deve essere univoco. \"{code}\" esiste già in questo "
+"import."
 
 #: pretix/base/services/modelimport.py
 #, python-brace-format
@@ -9341,13 +9355,19 @@ msgid ""
 msgid_plural ""
 "Voucher codes must be unique. Import contains existing voucher codes {code}."
 msgstr[0] ""
+"Il codice del voucher deve essere univoco. \"{code}\" esiste già in questo "
+"import."
 msgstr[1] ""
+"Il codice dei voucher deve essere univoco. \"{code}\" esiste già in questo "
+"import."
 
 #: pretix/base/services/modelimport.py
 msgid ""
 "Vouchers could not be imported, probably due to a voucher code already being "
 "in use."
 msgstr ""
+"Non è stato possibile importare i voucher, probabilmente perché il codice di "
+"un voucher è già in uso."
 
 #: pretix/base/services/orders.py
 msgid ""
@@ -10267,6 +10287,10 @@ msgid ""
 "ID in all countries. VAT ID will be required for all business addresses in "
 "the selected countries."
 msgstr ""
+"La partita IVA è opzionale di default, perché non tutte le aziende la "
+"posseggono in tutte le nazioni. Il codice della partita IVA sarà "
+"obbligatorio per tutti gli indirizzi aziendali locati nelle nazioni "
+"selezionate."
 
 #: pretix/base/settings.py
 msgid "Invoice address explanation"
@@ -11316,50 +11340,60 @@ msgstr ""
 
 #: pretix/base/settings.py
 msgid "Customers can change the variation of the products they purchased"
-msgstr ""
+msgstr "I clienti potranno cambiare la variation dei prodotti già acquistati"
 
 #: pretix/base/settings.py
-#, fuzzy
 msgid "Customers can change their selected add-on products"
-msgstr "I clienti non possono più modificare i loro ordini"
+msgstr "I clienti non potranno più modificare i gli add-on selezionati"
 
 #: pretix/base/settings.py
 msgid ""
 "Only allow changes if the resulting price is higher or equal than the "
 "previous price."
 msgstr ""
+"Permetti le modifiche solamente se il prezzo finale è maggiore o uguale al "
+"prezzo precedente."
 
 #: pretix/base/settings.py
 msgid ""
 "Only allow changes if the resulting price is higher than the previous price."
 msgstr ""
+"Permetti le modifiche solamente se il prezzo finale è maggiore del prezzo "
+"precedente."
 
 #: pretix/base/settings.py
 msgid ""
 "Only allow changes if the resulting price is equal to the previous price."
 msgstr ""
+"Permetti le modifiche solamente se il prezzo finale è uguale al prezzo "
+"precedente."
 
 #: pretix/base/settings.py
 msgid ""
 "Allow changes regardless of price, as long as no refund is required (i.e. "
 "the resulting price is not lower than what has already been paid)."
 msgstr ""
+"Permetti le modifiche a prescindere del prezzo, a meno che non sia "
+"necessario un rimborso (Il prezzo finale non è inferiore a quanto il cliente "
+"ha già pagato)."
 
 #: pretix/base/settings.py
 msgid "Allow changes regardless of price, even if this results in a refund."
 msgstr ""
+"Permetti le modifiche a prescindere del prezzo, anche se portano ad un "
+"rimborso."
 
 #: pretix/base/settings.py
 msgid "Requirement for changed prices"
-msgstr ""
+msgstr "Requisiti per il cambiamento di prezzi"
 
 #: pretix/base/settings.py
 msgid "Do not allow changes after"
-msgstr ""
+msgstr "Non permettere modifiche dopo il"
 
 #: pretix/base/settings.py
 msgid "Allow change even though the ticket has already been checked in"
-msgstr ""
+msgstr "Permetti modifiche anche se il biglietto ha già effettuato il check-in"
 
 #: pretix/base/settings.py
 msgid ""
@@ -11369,10 +11403,16 @@ msgid ""
 "in individually. Use with care, and preferably only in combination with a "
 "limitation on price changes above."
 msgstr ""
+"Di default, le modifiche degli ordini sono disabilitate dopo che è stato "
+"effettuato il check-in con qualsiasi biglietto contenuto nell'ordine. "
+"Abilitando questa opzione, disabiliterai questo controllo. Non sarà comunque "
+"possibile rimuovere un add-on con cui è già stato effettuato un check-in. "
+"Usa questa opzione con attenzione e, preferibilmente, solamente in "
+"combinazione con una delle limitazioni sul prezzo elencate sopra."
 
 #: pretix/base/settings.py
 msgid "Allow individual attendees to change their ticket"
-msgstr ""
+msgstr "Permetti ai singoli partecipanti di modificare il proprio biglietto"
 
 #: pretix/base/settings.py
 msgid ""
@@ -11382,15 +11422,20 @@ msgid ""
 "total price of the order. Such changes can always only be made by the main "
 "customer."
 msgstr ""
+"Di default, solo la persona che ha effettuato l'ordine di questo biglietto "
+"può eseguire modifiche. Selezionando questa opzione, anche i singoli "
+"partecipanti potranno fare cambiamenti. In ogni caso, i singoli partecipanti "
+"non potranno effettuare operazioni che cambiano il costo dell'ordine. Queste "
+"operazioni sono possibili solamente per chi originariamente ha creato "
+"l'ordine."
 
 #: pretix/base/settings.py
 msgid "Customers can cancel their unpaid orders"
-msgstr ""
+msgstr "I clienti possono annullare i loro ordini non pagati"
 
 #: pretix/base/settings.py
-#, fuzzy
 msgid "Charge a fixed cancellation fee"
-msgstr "Cancellazione di"
+msgstr "Addebita una quota di cancellazione fissa"
 
 #: pretix/base/settings.py
 msgid ""
@@ -11398,50 +11443,58 @@ msgid ""
 "never charged. Note that it will be your responsibility to claim the "
 "cancellation fee from the user."
 msgstr ""
+"Interessa solamente gli ordini con pagamenti in attesa, la quota di "
+"cancellazione non viene mai addebitata sugli ordini gratuiti. Nota: è tua "
+"responsabilità collezionare la quota di cancellazione dall'utente."
 
 #: pretix/base/settings.py
 msgid "Charge payment, shipping and service fees"
-msgstr ""
+msgstr "Addebita la quota di spedizione, pagamento e servizio"
 
 #: pretix/base/settings.py
 msgid "Charge a percentual cancellation fee"
-msgstr ""
+msgstr "Addebita una quota di quota di cancellazione in percentuale"
 
 #: pretix/base/settings.py
 msgid "Do not allow cancellations after"
-msgstr ""
+msgstr "Non permettere di annullare gli ordine dopo il"
 
 #: pretix/base/settings.py
 msgid "Customers can cancel their paid orders"
-msgstr ""
+msgstr "I clienti possono annullare i loro ordini già pagati"
 
 #: pretix/base/settings.py
 msgid ""
 "Paid money will be automatically paid back if the payment method allows it. "
 "Otherwise, a manual refund will be created for you to process manually."
 msgstr ""
+"Il denaro già incassato sarà automaticamente restituito se il metodo di "
+"pagamento lo permette. Altrimenti, un rimborso manuale verrà creato così che "
+"tu possa processarlo manualmente."
 
 #: pretix/base/settings.py pretix/control/forms/orders.py
 msgid "Keep a fixed cancellation fee"
-msgstr ""
+msgstr "Trattieni una quota di cancellazione fissa"
 
 #: pretix/base/settings.py
 msgid "Keep payment, shipping and service fees"
-msgstr ""
+msgstr "Trattieni la quota di spedizione, pagamento e servizio"
 
 #: pretix/base/settings.py pretix/control/forms/orders.py
 msgid "Keep a percentual cancellation fee"
-msgstr ""
+msgstr "Trattieni una quota di cancellazione in percentuale"
 
 #: pretix/base/settings.py
 msgid "Allow customers to voluntarily choose a lower refund"
-msgstr ""
+msgstr "Permetti si clienti di scegliere volontariamente un rimborso minore"
 
 #: pretix/base/settings.py
 msgid ""
 "With this option enabled, your customers can choose to get a smaller refund "
 "to support you."
 msgstr ""
+"Con questa opzione attiva, i tuoi clienti potranno scegliere di ottenere un "
+"rimborso minore al dovuto, per effettuare una donazione nei vostri confronti."
 
 #: pretix/base/settings.py
 msgid ""
@@ -20421,7 +20474,7 @@ msgstr "Abilita webhook"
 #: pretix/control/templates/pretixcontrol/organizers/device_logs.html
 #: pretix/control/templates/pretixcontrol/organizers/logs.html
 msgid "No results"
-msgstr ""
+msgstr "Nessun risultato"
 
 #: pretix/control/templates/pretixcontrol/event/mail.html
 #: pretix/control/templates/pretixcontrol/organizers/mail.html
@@ -20462,7 +20515,7 @@ msgstr ""
 #: pretix/control/templates/pretixcontrol/vouchers/bulk.html
 #: pretix/plugins/sendmail/templates/pretixplugins/sendmail/send_form.html
 msgid "Edit"
-msgstr ""
+msgstr "Modifica"
 
 #: pretix/control/templates/pretixcontrol/event/mail.html
 #, fuzzy
@@ -25479,7 +25532,7 @@ msgstr ""
 
 #: pretix/control/templates/pretixcontrol/pdf/index.html
 msgid "Text box"
-msgstr ""
+msgstr "Riquadro testo"
 
 #: pretix/control/templates/pretixcontrol/pdf/index.html
 #, fuzzy
@@ -25520,7 +25573,7 @@ msgstr ""
 
 #: pretix/control/templates/pretixcontrol/pdf/index.html
 msgid "Duplicate"
-msgstr ""
+msgstr "Duplicato"
 
 #: pretix/control/templates/pretixcontrol/pdf/index.html
 msgid "Undo"
@@ -27145,11 +27198,11 @@ msgstr ""
 
 #: pretix/control/views/dashboards.py
 msgid "Attendees (ordered)"
-msgstr ""
+msgstr "Partecipanti (ordini effettuati)"
 
 #: pretix/control/views/dashboards.py
 msgid "Attendees (paid)"
-msgstr ""
+msgstr "Partecipanti (ordini pagati)"
 
 #: pretix/control/views/dashboards.py
 #, python-brace-format
@@ -31650,11 +31703,11 @@ msgstr ""
 
 #: pretix/plugins/stripe/payment.py
 msgid "Bancontact"
-msgstr ""
+msgstr "Bancontact"
 
 #: pretix/plugins/stripe/payment.py
 msgid "SEPA Direct Debit"
-msgstr ""
+msgstr "Addebito diretto SEPA"
 
 #: pretix/plugins/stripe/payment.py
 msgid ""
@@ -31684,7 +31737,7 @@ msgstr ""
 
 #: pretix/plugins/stripe/payment.py
 msgid "Przelewy24"
-msgstr ""
+msgstr "Przelewy24"
 
 #: pretix/plugins/stripe/payment.py
 #, fuzzy
@@ -31700,7 +31753,7 @@ msgstr ""
 
 #: pretix/plugins/stripe/payment.py
 msgid "WeChat Pay"
-msgstr ""
+msgstr "WeChat Pay"
 
 #: pretix/plugins/stripe/payment.py
 msgid "Swish"
@@ -31853,7 +31906,7 @@ msgstr ""
 
 #: pretix/plugins/stripe/payment.py
 msgid "giropay"
-msgstr ""
+msgstr "giropay"
 
 #: pretix/plugins/stripe/payment.py
 msgid ""
@@ -31877,7 +31930,7 @@ msgstr ""
 
 #: pretix/plugins/stripe/payment.py
 msgid "iDEAL | Wero"
-msgstr ""
+msgstr "iDEAL | Wero"
 
 #: pretix/plugins/stripe/payment.py
 msgid ""
@@ -33621,9 +33674,8 @@ msgstr ""
 
 #: pretix/presale/templates/pretixpresale/event/fragment_cart.html
 #: pretix/presale/templates/pretixpresale/fragment_modals.html
-#, fuzzy
 msgid "Renew reservation"
-msgstr "Descrizione"
+msgstr "Rinnova scadenza"
 
 #: pretix/presale/templates/pretixpresale/event/fragment_cart.html
 #, fuzzy

src/pretix/locale/it/LC_MESSAGES/djangojs.po

@@ -8,8 +8,8 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-07-06 15:52+0000\n"
-"PO-Revision-Date: 2026-03-25 14:14+0000\n"
-"Last-Translator: Pietro Isotti <isottipietro@gmail.com>\n"
+"PO-Revision-Date: 2026-08-02 22:00+0000\n"
+"Last-Translator: \"Luca Sorace \\\"Stranck\\\"\" <strdjn@gmail.com>\n"
 "Language-Team: Italian <https://translate.pretix.eu/projects/pretix/pretix-"
 "js/it/>\n"
 "Language: it\n"
@@ -17,7 +17,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 5.16.2\n"
+"X-Generator: Weblate 2026.7.1\n"
 
 #: pretix/plugins/banktransfer/static/pretixplugins/banktransfer/ui.js
 msgid "Marked as paid"
@@ -42,93 +42,91 @@ msgstr "Apple Pay"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "Itaú"
-msgstr ""
+msgstr "Ita"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
-#, fuzzy
 msgid "PayPal Credit"
-msgstr "PayPal"
+msgstr "PayPal (Pagamento a rate)"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "Credit Card"
-msgstr ""
+msgstr "Carta di credito"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "PayPal Pay Later"
-msgstr ""
+msgstr "PayPal (Acquista ora, paga dopo)"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "iDEAL | Wero"
-msgstr ""
+msgstr "iDEAL | Wero"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "SEPA Direct Debit"
-msgstr ""
+msgstr "Addebito diretto SEPA"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "Bancontact"
-msgstr ""
+msgstr "Bancontact"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "giropay"
-msgstr ""
+msgstr "giropay"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "SOFORT"
-msgstr ""
+msgstr "SOFORT"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
-#, fuzzy
 msgid "eps"
-msgstr "Si"
+msgstr "eps"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "MyBank"
-msgstr ""
+msgstr "MyBank"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "Przelewy24"
-msgstr ""
+msgstr "Przelewy24"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "Verkkopankki"
-msgstr ""
+msgstr "Verkkopankki"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "PayU"
-msgstr ""
+msgstr "PayU"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "BLIK"
-msgstr ""
+msgstr "BLIK"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "Trustly"
-msgstr ""
+msgstr "Trustly"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "Zimpler"
-msgstr ""
+msgstr "Zimpler"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "Maxima"
-msgstr ""
+msgstr "Maxima"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "OXXO"
-msgstr ""
+msgstr "OXXO"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "Boleto"
-msgstr ""
+msgstr "Boleto"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "WeChat Pay"
-msgstr ""
+msgstr "WeChat Pay"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "Mercado Pago"
-msgstr ""
+msgstr "Mercado Pago"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
@@ -143,7 +141,7 @@ msgstr "Stiamo processando il tuo pagamento …"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js
 msgid "Payment method unavailable"
-msgstr ""
+msgstr "Metodo di pagamento non disponibile"
 
 #: pretix/plugins/statistics/static/pretixplugins/statistics/statistics.js
 msgid "Placed orders"
@@ -155,11 +153,11 @@ msgstr "Ordini pagati"
 
 #: pretix/plugins/statistics/static/pretixplugins/statistics/statistics.js
 msgid "Attendees (ordered)"
-msgstr ""
+msgstr "Partecipanti (ordini effettuati)"
 
 #: pretix/plugins/statistics/static/pretixplugins/statistics/statistics.js
 msgid "Attendees (paid)"
-msgstr ""
+msgstr "Partecipanti (ordini pagati)"
 
 #: pretix/plugins/statistics/static/pretixplugins/statistics/statistics.js
 msgid "Total revenue"
@@ -239,11 +237,11 @@ msgstr "Eliminato"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
 msgid "Confirmed"
-msgstr ""
+msgstr "Confermato"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
 msgid "Approval pending"
-msgstr ""
+msgstr "In attesa di approvazione"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
 msgid "Redeemed"
@@ -310,12 +308,13 @@ msgid "Order canceled"
 msgstr "Ordine cancellato"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
+#, fuzzy
 msgid "Ticket code is ambiguous on list"
-msgstr ""
+msgstr "Il codice del biglietto è ambiguo sulla lista"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
 msgid "Order not approved"
-msgstr ""
+msgstr "Ordine non approvato"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/i18n.ts
 msgid "Checked-in Tickets"
@@ -430,11 +429,11 @@ msgstr "Usa i tasti Ctrl-C per copiare!"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/App.vue
 msgid "Edit"
-msgstr ""
+msgstr "Modifica"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/App.vue
 msgid "Visualize"
-msgstr ""
+msgstr "Visualizza"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/App.vue
 msgid ""
@@ -442,10 +441,13 @@ msgid ""
 "or variations are not contained in any of your rule parts so people with "
 "these tickets will not get in:"
 msgstr ""
+"La tua regola filtra sempre per prodotto o variation, ma i seguenti prodotti "
+"o variation non sono presenti in nessuna parte delle tue regole. Questo "
+"impedirà alle persone con questi biglietti di poter accedere all'evento:"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/App.vue
 msgid "Please double-check if this was intentional."
-msgstr ""
+msgstr "Per favore, controlla se è stato intenzionale."
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "All of the conditions below (AND)"
@@ -489,17 +491,17 @@ msgstr "minuti"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "Duplicate"
-msgstr ""
+msgstr "Duplicato"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgctxt "entry_status"
 msgid "present"
-msgstr ""
+msgstr "Presente"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgctxt "entry_status"
 msgid "absent"
-msgstr ""
+msgstr "Assente"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "is one of"
@@ -515,7 +517,7 @@ msgstr "è dopo"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "="
-msgstr ""
+msgstr "="
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "Product"
@@ -535,63 +537,55 @@ msgstr "Data e orario corrente"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "Current day of the week (1 = Monday, 7 = Sunday)"
-msgstr ""
+msgstr "Giorno corrente della settimana (1 = Lunedì, 7 = Domenica)"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "Current entry status"
-msgstr ""
+msgstr "Stato dell'ingresso corrente"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "Number of previous entries"
-msgstr "Numero di inserimenti precedenti"
+msgstr "Numero di precedenti ingressi"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "Number of previous entries since midnight"
-msgstr "Numero di inserimenti precedenti fino a mezzanotte"
+msgstr "Numero di precedenti ingressi fino a mezzanotte"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
-#, fuzzy
-#| msgid "Number of previous entries"
 msgid "Number of previous entries since"
-msgstr "Numero di inserimenti precedenti"
+msgstr "Numero di precedenti ingressi dal"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
-#, fuzzy
-#| msgid "Number of previous entries"
 msgid "Number of previous entries before"
-msgstr "Numero di inserimenti precedenti"
+msgstr "Numero di precedenti ingressi prima del"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "Number of days with a previous entry"
-msgstr "Nunmero di giorni con un inserimento precedente"
+msgstr "Numero di giorni con un precedente ingresso"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
-#, fuzzy
-#| msgid "Number of days with a previous entry"
 msgid "Number of days with a previous entry since"
-msgstr "Nunmero di giorni con un inserimento precedente"
+msgstr "Numero di giorni con un precedente ingresso dal"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
-#, fuzzy
-#| msgid "Number of days with a previous entry"
 msgid "Number of days with a previous entry before"
-msgstr "Nunmero di giorni con un inserimento precedente"
+msgstr "Numero di giorni con un precedente ingresso prima del"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "Minutes since last entry (-1 on first entry)"
-msgstr ""
+msgstr "Minuti dall'ultimo ingresso (-1 al primo ingresso)"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts
 msgid "Minutes since first entry (-1 on first entry)"
-msgstr ""
+msgstr "Minuti dal primo ingresso (-1 al primo ingresso)"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/django-interop.ts
 msgid "Error: Product not found!"
-msgstr ""
+msgstr "Errore: Prodotto non trovato!"
 
 #: pretix/static/pretixcontrol/js/ui/checkinrules/django-interop.ts
 msgid "Error: Variation not found!"
-msgstr ""
+msgstr "Errore: Variation non trovata!"
 
 #: pretix/static/pretixcontrol/js/ui/editor.js
 msgid "Check-in QR"
@@ -606,16 +600,12 @@ msgid "Group of objects"
 msgstr "Gruppo di oggetti"
 
 #: pretix/static/pretixcontrol/js/ui/editor.js
-#, fuzzy
-#| msgid "Text object"
 msgid "Text object (deprecated)"
-msgstr "Oggetto testo"
+msgstr "Oggetto testo (deprecato)"
 
 #: pretix/static/pretixcontrol/js/ui/editor.js
-#, fuzzy
-#| msgid "Text object"
 msgid "Text box"
-msgstr "Oggetto testo"
+msgstr "Riquadro testo"
 
 #: pretix/static/pretixcontrol/js/ui/editor.js
 msgid "Barcode area"
@@ -662,25 +652,24 @@ msgid "Unknown error."
 msgstr "Errore sconosciuto."
 
 #: pretix/static/pretixcontrol/js/ui/main.js
-#, fuzzy
-#| msgid "Your color has great contrast and is very easy to read!"
 msgid "Your color has great contrast and will provide excellent accessibility."
-msgstr "Il colore scelto ha un ottimo contrasto ed è molto leggibile!"
+msgstr "Il colore scelto ha un ottimo contrasto ed è molto leggibile."
 
 #: pretix/static/pretixcontrol/js/ui/main.js
-#, fuzzy
-#| msgid "Your color has decent contrast and is probably good-enough to read!"
 msgid ""
 "Your color has decent contrast and is sufficient for minimum accessibility "
 "requirements."
 msgstr ""
-"Il colore scelto ha un buon contrasto e probabilmente è abbastanza leggibile!"
+"Il colore scelto ha un buon contrasto ed è sufficiente per i requisiti di "
+"accessibilità."
 
 #: pretix/static/pretixcontrol/js/ui/main.js
 msgid ""
 "Your color has insufficient contrast to white. Accessibility of your site "
 "will be impacted."
 msgstr ""
+"Il colore scelto ha un contrasto insufficiente rispetto al bianco. "
+"L'accessibilità nel tuo sito sarà ridotta."
 
 #: pretix/static/pretixcontrol/js/ui/main.js
 msgid "Search query"
@@ -700,11 +689,11 @@ msgstr "Solo i selezionati"
 
 #: pretix/static/pretixcontrol/js/ui/main.js
 msgid "Enter page number between 1 and %(max)s."
-msgstr ""
+msgstr "Inserisci il numero di pagina tra 1 e %(max)s."
 
 #: pretix/static/pretixcontrol/js/ui/main.js
 msgid "Invalid page number."
-msgstr ""
+msgstr "Numero di pagina invalido."
 
 #: pretix/static/pretixcontrol/js/ui/main.js
 msgid "Use a different name internally"
@@ -723,10 +712,8 @@ msgid "Calculating default price…"
 msgstr "Calcolando il prezzo di default…"
 
 #: pretix/static/pretixcontrol/js/ui/plugins.js
-#, fuzzy
-#| msgid "Search results"
 msgid "No results"
-msgstr "Risultati ricerca"
+msgstr "Nessun risultato"
 
 #: pretix/static/pretixcontrol/js/ui/question.js
 msgid "Others"
@@ -756,39 +743,33 @@ msgstr "Carrello scaduto"
 
 #: pretix/static/pretixpresale/js/ui/cart.js
 msgid "Your cart is about to expire."
-msgstr ""
+msgstr "La selezione nel tuo carrello sta per scadere."
 
 #: pretix/static/pretixpresale/js/ui/cart.js
 msgid "The items in your cart are reserved for you for one minute."
 msgid_plural "The items in your cart are reserved for you for {num} minutes."
-msgstr[0] "Gli elementi nel tuo carrello sono riservati per 1 minuto."
+msgstr[0] "Gli elementi nel tuo carrello sono riservati per un minuto."
 msgstr[1] "Gli elementi nel tuo carrello sono riservati per {num} minuti."
 
 #: pretix/static/pretixpresale/js/ui/cart.js
-#, fuzzy
-#| msgid "Cart expired"
 msgid "Your cart has expired."
-msgstr "Carrello scaduto"
+msgstr "Il tuo carrello è scaduto."
 
 #: pretix/static/pretixpresale/js/ui/cart.js
-#, fuzzy
-#| msgid ""
-#| "The items in your cart are no longer reserved for you. You can still "
-#| "complete your order as long as they’re available."
 msgid ""
 "The items in your cart are no longer reserved for you. You can still "
 "complete your order as long as they're available."
 msgstr ""
-"Gli articoli nel tuo carrello non sono più riservati per te. Puoi ancora "
+"Gli articoli nel tuo carrello non sono più riservati a te. Puoi ancora "
 "completare il tuo ordine finché sono disponibili."
 
 #: pretix/static/pretixpresale/js/ui/cart.js
 msgid "Do you want to renew the reservation period?"
-msgstr ""
+msgstr "Vuoi rinnovare la scadenza del tuo carrello?"
 
 #: pretix/static/pretixpresale/js/ui/cart.js
 msgid "Renew reservation"
-msgstr ""
+msgstr "Rinnova scadenza"
 
 #: pretix/static/pretixpresale/js/ui/main.js
 msgid "The organizer keeps %(currency)s %(amount)s"
@@ -807,69 +788,64 @@ msgid "Your local time:"
 msgstr "Ora locale:"
 
 #: pretix/static/pretixpresale/js/walletdetection.js
-#, fuzzy
-#| msgid "Apple Pay"
 msgid "Google Pay"
-msgstr "Apple Pay"
+msgstr "Google Pay"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgctxt "widget"
 msgid "Quantity"
-msgstr ""
+msgstr "Quantità"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgctxt "widget"
 msgid "Decrease quantity"
-msgstr ""
+msgstr "Diminuisci quantità"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgctxt "widget"
 msgid "Increase quantity"
-msgstr ""
+msgstr "Aumenta quantità"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgctxt "widget"
 msgid "Filter events by"
-msgstr ""
+msgstr "Filtra eventi per"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgctxt "widget"
 msgid "Filter"
-msgstr ""
+msgstr "Filtra"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgctxt "widget"
 msgid "Price"
-msgstr ""
+msgstr "Prezzo"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 #, javascript-format
 msgctxt "widget"
 msgid "Original price: %s"
-msgstr ""
+msgstr "Prezzo originale: %s"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 #, javascript-format
 msgctxt "widget"
 msgid "New price: %s"
-msgstr ""
+msgstr "Nuovo prezzo: %s"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
-#, fuzzy
-#| msgctxt "widget"
-#| msgid "Select %s"
 msgctxt "widget"
 msgid "Select"
-msgstr "Seleziona %s"
+msgstr "Seleziona"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
@@ -926,7 +902,7 @@ msgstr "da %(currency)s %(price)s"
 #, javascript-format
 msgctxt "widget"
 msgid "Image of %s"
-msgstr ""
+msgstr "Immagine di %s"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
@@ -967,27 +943,21 @@ msgstr "Disponibile solo con voucher"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
-#, fuzzy
-#| msgctxt "widget"
-#| msgid "currently available: %s"
 msgctxt "widget"
 msgid "Not yet available"
-msgstr "attualmente disponibile: %s"
+msgstr "Ancora non disponibile"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgctxt "widget"
 msgid "Not available anymore"
-msgstr ""
+msgstr "Non più disponibile"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
-#, fuzzy
-#| msgctxt "widget"
-#| msgid "currently available: %s"
 msgctxt "widget"
 msgid "Currently not available"
-msgstr "attualmente disponibile: %s"
+msgstr "Attualmente non disponibile"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
@@ -1095,18 +1065,17 @@ msgstr "Chiudi"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
-#, fuzzy
-#| msgctxt "widget"
-#| msgid "Resume checkout"
 msgctxt "widget"
 msgid "Close checkout"
-msgstr "Ricarica checkout"
+msgstr "Finisci checkout"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgctxt "widget"
 msgid "You cannot cancel this operation. Please wait for loading to finish."
 msgstr ""
+"Non puoi annullare questa operazione. Per favore, aspetta che il caricamento "
+"finisca."
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
@@ -1116,21 +1085,15 @@ msgstr "Continua"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
-#, fuzzy
-#| msgctxt "widget"
-#| msgid "Select variant %s"
 msgctxt "widget"
 msgid "Show variants"
-msgstr "Seleziona variante %s"
+msgstr "Mostra varianti"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
-#, fuzzy
-#| msgctxt "widget"
-#| msgid "Select variant %s"
 msgctxt "widget"
 msgid "Hide variants"
-msgstr "Seleziona variante %s"
+msgstr "Nascondi varianti"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
@@ -1236,37 +1199,37 @@ msgstr "Do"
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "Monday"
-msgstr ""
+msgstr "Lunedì"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "Tuesday"
-msgstr ""
+msgstr "Martedì"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "Wednesday"
-msgstr ""
+msgstr "Mercoledì"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "Thursday"
-msgstr ""
+msgstr "Giovedì"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "Friday"
-msgstr ""
+msgstr "Venerdì"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "Saturday"
-msgstr ""
+msgstr "Sabato"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgid "Sunday"
-msgstr ""
+msgstr "Domenica"
 
 #: pretix/static/pretixpresale/js/widget/widget.js
 #: pretix/static/pretixpresale/widget/src/i18n.ts

src/pretix/plugins/paypal2/payment.py

@@ -23,7 +23,7 @@ import json
 import logging
 import urllib.parse
 from collections import OrderedDict
-from datetime import timedelta
+from datetime import datetime, timedelta, timezone
 from decimal import Decimal
 
 from django import forms
@@ -193,6 +193,31 @@ class PaypalSettingsHolder(BasePaymentProvider):
                      }
                  )
              )),
+            ('allow_retries_during_compliance_hold',
+             forms.BooleanField(
+                 label=_('Allow further payments during compliance hold'),
+                 help_text=_(
+                     'PayPals fraud prevention might block processing of individual payments for a considerable amount '
+                     'of time. The payment is marked as "pending" during this time window. You can allow your customers to '
+                     'start another payment attempts during that window. This might result in them being charged twice if the'
+                     'original payment is approved.'
+                 ),
+                 required=False
+             )),
+            ('timeout_payment_during_compliance_hold',
+             forms.IntegerField(
+                 label=_('Timeout further payment attempts'),
+                 help_text=_(
+                     'Time duration in minutes after which another payment attempt is possible, while the last payment is '
+                     'still under investigation.'
+                 ),
+                 required=False,
+                 widget=forms.NumberInput(
+                     attrs={
+                         'data-checkbox-dependency': '#id_payment_paypal_allow_retries_during_compliance_hold',
+                     }
+                 )
+             )),
 
         ]
 
@@ -515,8 +540,16 @@ class PaypalMethod(BasePaymentProvider):
             'XPF': 0,
         }))
 
-    @property
-    def abort_pending_allowed(self):
+    def _payment_abort_pending_allowed(self, payment) -> bool:
+        if not self.settings.get('allow_retries_during_compliance_hold', as_type=bool, default=True):
+            return False
+
+        if payment.info_data.get('create_time', False):
+            create_time = datetime.fromisoformat(payment.info_data['create_time'])
+            duration = self.settings.get('timeout_payment_during_compliance_hold', as_type=int, default=10)
+            if datetime.now(tz=timezone.utc) - create_time > timedelta(minutes=duration):
+                return True
+
         return False
 
     def _create_paypal_order(self, request, payment=None, cart_total=None):
@@ -645,7 +678,7 @@ class PaypalMethod(BasePaymentProvider):
     def _execute_payment(self, request: HttpRequest, payment: OrderPayment):
         payment = OrderPayment.objects.select_for_update(of=OF_SELF).get(pk=payment.pk)
         if payment.state == OrderPayment.PAYMENT_STATE_CONFIRMED:
-            logger.warning('payment is already confirmed; possible return-view/webhook race-condition')
+            # payment is already confirmed; possible return-view/webhook race-condition
             return
 
         try:
@@ -677,6 +710,10 @@ class PaypalMethod(BasePaymentProvider):
                 raise PaymentException(_('We had trouble communicating with PayPal'))
             else:
                 pp_captured_order = response.result
+                payment.info = json.dumps(pp_captured_order.dict())
+                if pp_captured_order.status == 'APPROVED':
+                    payment.state = OrderPayment.PAYMENT_STATE_PENDING
+                payment.save()
 
             try:
                 ReferencedPayPalObject.objects.get_or_create(order=payment.order, payment=payment, reference=pp_captured_order.id)
@@ -830,6 +867,7 @@ class PaypalMethod(BasePaymentProvider):
                     payment.info = json.dumps(pp_captured_order.dict())
                     payment.save(update_fields=['info'])
                     payment.confirm()
+                    self.log_payment_duration(payment)
                 except Quota.QuotaExceededException as e:
                     raise PaymentException(str(e))
             # Payment has not any captures yet - so it's probably in created status
@@ -839,15 +877,35 @@ class PaypalMethod(BasePaymentProvider):
             if 'payment_paypal_oid' in request.session:
                 del request.session['payment_paypal_oid']
 
-    def payment_pending_render(self, request, payment) -> str:
-        retry = True
+    @staticmethod
+    def log_payment_duration(payment: OrderPayment):
         try:
-            if (
-                    payment.info
-                    and payment.info_data['purchase_units'][0]['payments']['captures'][0]['status'] == 'PENDING'
-            ):
-                retry = False
-        except (KeyError, IndexError):
+            capture = payment.info_data["purchase_units"][0]["payments"]["captures"][0]
+            create_time: str | None = capture["create_time"]
+            update_time: str | None = capture["update_time"]
+        except (KeyError, IndexError, TypeError):
+            create_time = None
+            update_time = None
+
+        if create_time is not None and update_time is not None:
+            duration = datetime.fromisoformat(update_time) - datetime.fromisoformat(create_time)
+            logger.info('{}: {} - paypal payment processing time'.format(str(payment.global_id), str(duration)))
+
+    def payment_pending_render(self, request, payment) -> str:
+        stuck_in_compliance = False
+        retry = self._payment_abort_pending_allowed(payment)
+        try:
+            for purchase_unit in payment.info_data['purchase_units']:
+                for capture in purchase_unit['payments']['captures']:
+                    if capture['status'] == "PENDING":
+                        stuck_in_compliance = True
+        except KeyError:
+            pass
+
+        try:
+            if payment.info_data.get('status') == "APPROVED":
+                stuck_in_compliance = True
+        except (KeyError):
             pass
 
         error = payment.info_data.get("error", {})
@@ -855,7 +913,8 @@ class PaypalMethod(BasePaymentProvider):
 
         template = get_template('pretixplugins/paypal2/pending.html')
         ctx = {'request': request, 'event': self.event, 'settings': self.settings,
-               'retry': retry, 'order': payment.order, 'is_known_issue': is_known_issue}
+               'stuck_in_compliance': stuck_in_compliance, 'retry': retry, 'order': payment.order,
+               'is_known_issue': is_known_issue}
         return template.render(ctx)
 
     def matching_id(self, payment: OrderPayment):

src/pretix/plugins/paypal2/signals.py

@@ -166,6 +166,8 @@ def signal_process_response(sender, request: HttpRequest, response: HttpResponse
 
 settings_hierarkey.add_default('payment_paypal_debug_buyer_country', '', str)
 settings_hierarkey.add_default('payment_paypal_method_wallet', True, bool)
+settings_hierarkey.add_default('payment_paypal_allow_retries_during_compliance_hold', True, bool)
+settings_hierarkey.add_default('payment_paypal_timeout_payment_during_compliance_hold', 10, int)
 
 
 def _nonce(request):

src/pretix/plugins/paypal2/templates/pretixplugins/paypal2/pending.html

@@ -6,9 +6,12 @@
             Your payment has failed due to a known issue within PayPal. Please try again, there is a high chance of the
             payment succeeding on a second or third attempt. You can also try other payment methods, if available.
         {% endblocktrans %}</div>
-    {% else %}
+{% elif stuck_in_compliance %}
         <p>{% blocktrans trimmed %}
-            Our attempt to execute your payment via PayPal has failed. Please try again or contact us.
+            Your payment is being processed by PayPal. This takes longer than usual. You can wait until PayPal
+            acknowledges the payment or you can try paying again with this or another payment method.
+            This might result in you being charged twice in case PayPal allows your initial payment attempt.
+            Please contact us to resolve this case.
         {% endblocktrans %}</p>
     {% endif %}
 {% else %}

src/pretix/plugins/paypal2/views.py

@@ -357,14 +357,13 @@ def webhook(request, *args, **kwargs):
     if 'resource_type' not in event_json:
         return HttpResponse("Invalid body, no resource_type given", status=400)
 
-    if event_json['resource_type'] not in ["checkout-order", "refund", "capture"]:
-        return HttpResponse("Not interested in this resource type", status=200)
-
     # Retrieve the Charge ID of the refunded payment
-    if event_json['resource_type'] == 'refund':
+    if event_json['resource_type'] == 'checkout-order':
+        payloadid = event_json['resource']['id']
+    elif event_json['resource_type'] == 'refund' or event_json['resource_type'] == 'capture':
         payloadid = get_link(event_json['resource']['links'], 'up')['href'].split('/')[-1]
     else:
-        payloadid = event_json['resource']['id']
+        return HttpResponse("Not interested in this resource type", status=200)
 
     refs = [payloadid]
     if event_json['resource'].get('supplementary_data', {}).get('related_ids', {}).get('order_id'):
@@ -424,6 +423,8 @@ def webhook(request, *args, **kwargs):
         **event_json,
         '_order_state': sale.dict(),
     })
+    payment.info = json.dumps(sale.dict())
+    payment.save()
 
     if payment.state == OrderPayment.PAYMENT_STATE_CONFIRMED and sale['status'] in ('PARTIALLY_REFUNDED', 'REFUNDED', 'COMPLETED'):
         if event_json['resource_type'] == 'refund':
@@ -470,8 +471,8 @@ def webhook(request, *args, **kwargs):
     elif payment.state in (OrderPayment.PAYMENT_STATE_PENDING, OrderPayment.PAYMENT_STATE_CREATED,
                            OrderPayment.PAYMENT_STATE_CANCELED, OrderPayment.PAYMENT_STATE_FAILED):
         if sale['status'] == 'COMPLETED':
-            any_captures = False
             all_captures_completed = True
+            any_pending_review = False
             for purchaseunit in sale['purchase_units']:
                 for capture in purchaseunit['payments']['captures']:
                     try:
@@ -482,15 +483,19 @@ def webhook(request, *args, **kwargs):
 
                     if capture['status'] not in ('COMPLETED', 'REFUNDED', 'PARTIALLY_REFUNDED'):
                         all_captures_completed = False
-                    else:
-                        any_captures = True
-            if any_captures and all_captures_completed:
+                        if capture['status_details']['reason'] == "PENDING_REVIEW":
+                            any_pending_review = True
+            if all_captures_completed:
                 try:
                     payment.info = json.dumps(sale.dict())
                     payment.save(update_fields=['info'])
                     payment.confirm()
+                    prov.log_payment_duration(payment)
                 except Quota.QuotaExceededException:
                     pass
+            if any_pending_review and payment.state != OrderPayment.PAYMENT_STATE_PENDING:
+                payment.state = OrderPayment.PAYMENT_STATE_PENDING
+                payment.save(update_fields=['state'])
         elif sale['status'] == 'APPROVED':
             try:
                 request.session['payment_paypal_oid'] = payment.info_data['id']

src/pretix/plugins/sendmail/api.py

@@ -20,6 +20,7 @@
 # <https://www.gnu.org/licenses/>.
 #
 from django.core.exceptions import ValidationError
+from django.db import transaction
 from django_filters.rest_framework import DjangoFilterBackend, FilterSet
 from django_scopes import scopes_disabled
 from rest_framework import viewsets
@@ -118,6 +119,7 @@ class RuleViewSet(viewsets.ModelViewSet):
     def get_queryset(self):
         return Rule.objects.filter(event=self.request.event)
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         super().perform_create(serializer)
         serializer.instance.log_action(
@@ -128,6 +130,7 @@ class RuleViewSet(viewsets.ModelViewSet):
 
         )
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         super().perform_update(serializer)
         serializer.instance.log_action(
@@ -137,6 +140,7 @@ class RuleViewSet(viewsets.ModelViewSet):
             data=self.request.data
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         instance.log_action(
             'pretix.plugins.sendmail.rule.deleted',

src/pretix/presale/checkoutflow.py

@@ -100,7 +100,7 @@ from pretix.presale.views.cart import (
     _items_from_post_data, cart_session, create_empty_cart_id,
     get_or_create_cart_id,
 )
-from pretix.presale.views.questions import QuestionsViewMixin
+from pretix.presale.views.questions import CartQuestionsViewMixin
 
 
 class BaseCheckoutFlowStep:
@@ -772,7 +772,7 @@ class AddOnsStep(CartMixin, AsyncAction, TemplateFlowStep):
                        sales_channel=request.sales_channel.identifier, override_now_dt=time_machine_now(default=None))
 
 
-class QuestionsStep(QuestionsViewMixin, CartMixin, TemplateFlowStep):
+class QuestionsStep(CartQuestionsViewMixin, CartMixin, TemplateFlowStep):
     priority = 50
     identifier = "questions"
     template_name = "pretixpresale/event/checkout_questions.html"
@@ -1125,6 +1125,7 @@ class QuestionsStep(QuestionsViewMixin, CartMixin, TemplateFlowStep):
 
     def get_context_data(self, **kwargs):
         ctx = super().get_context_data(**kwargs)
+        ctx['order_questions_form'] = self.order_questions_form
         ctx['formgroups'] = self.formdict.items()
         ctx['contact_form'] = self.contact_form
         ctx['invoice_form'] = self.invoice_form
@@ -1563,6 +1564,7 @@ class ConfirmStep(CartMixin, AsyncAction, TemplateFlowStep):
         ctx['addr'] = self.invoice_address
         ctx['confirm_messages'] = self.confirm_messages
         ctx['cart_session'] = self.cart_session
+        ctx['checkout_session'] = self.checkout_session
         ctx['invoice_address_asked'] = self.address_asked
         ctx['customer'] = self.cart_customer
 
@@ -1660,6 +1662,7 @@ class ConfirmStep(CartMixin, AsyncAction, TemplateFlowStep):
             customer=self.cart_session.get('customer'),
             override_now_dt=time_machine_now(default=None),
             api_meta=api_meta,
+            cart_id=get_or_create_cart_id(request),
         )
 
     def get_success_message(self, value):

src/pretix/presale/forms/checkout.py

@@ -41,8 +41,8 @@ from django.utils.translation import gettext_lazy as _
 from phonenumber_field.formfields import PhoneNumberField
 
 from pretix.base.forms.questions import (
-    BaseInvoiceAddressForm, BaseQuestionsForm, WrappedPhoneNumberPrefixWidget,
-    guess_phone_prefix_from_request,
+    BaseInvoiceAddressForm, TicketLevelQuestionsForm,
+    WrappedPhoneNumberPrefixWidget, guess_phone_prefix_from_request,
 )
 from pretix.base.templatetags.rich_text import rich_text
 from pretix.base.validators import EmailBanlistValidator
@@ -139,11 +139,14 @@ class InvoiceNameForm(InvoiceAddressForm):
                 del self.fields[f]
 
 
-class QuestionsForm(BaseQuestionsForm):
+class CustomerAwareQuestionsForm(TicketLevelQuestionsForm):
     """
-    This form class is responsible for asking order-related questions. This includes
+    The base class is responsible for asking order-related questions. This includes
     the attendee name for admission tickets, if the corresponding setting is enabled,
     as well as additional questions defined by the organizer.
+
+    This class adds support for pre-filling data like name and address from a
+    customer profile, in case the user is logged-in with a customer account.
     """
     required_css_class = 'required'
     address_validation = True

src/pretix/presale/style.py

@@ -147,7 +147,7 @@ def get_font_stylesheet(font_name, organizer: Organizer = None, event: Event = N
     stylesheet = []
     font = get_fonts(event)[font_name]
     for sty, formats in font.items():
-        if sty == 'sample':
+        if sty in ['sample', 'pdf_only']:
             continue
         stylesheet.append('@font-face { ')
         stylesheet.append('font-family: "{}";'.format(font_name))

src/pretix/presale/templates/pretixpresale/event/checkout_confirm.html

@@ -162,6 +162,26 @@
                         {% endfor %}
                     </div>
                 </div>
+                {% if checkout_session.answers.all %}
+                    <div class="panel panel-default panel-contact">
+                        <div class="panel-heading">
+                            <h3 class="panel-title">
+                                {% trans "Additional order information" %}
+                                <a href="{% eventurl request.event "presale:event.checkout" step="questions" cart_namespace=cart_namespace|default_if_none:"" %}" aria-label="{% trans "Modify contact information" %}" class="h6">
+                                    <span class="fa fa-edit" aria-hidden="true"></span>{% trans "Modify" %}
+                                </a>
+                            </h3>
+                        </div>
+                        <div class="panel-body">
+                            <dl class="dl-horizontal">
+                                {% for ans in checkout_session.answers.all %}
+                                    <dt>{{ ans.question.question }}</dt>
+                                    <dd>{% include "pretixpresale/event/fragment_question_answer.html" with request=request question=ans.question answer=ans %}</dd>
+                                {% endfor %}
+                            </dl>
+                        </div>
+                    </div>
+                {% endif %}
             </div>
         </div>
         {% if confirm_messages %}

src/pretix/presale/templates/pretixpresale/event/checkout_questions.html

@@ -68,6 +68,18 @@
                     </div>
                 </details>
             {% endif %}
+            {% if order_questions_form.fields %}
+                <details class="panel panel-default" open>
+                    <summary class="panel-heading">
+                        <h3 class="panel-title">
+                            <strong>{% trans "Additional order information" %}</strong>
+                        </h3>
+                    </summary>
+                    <div class="panel-body">
+                        {% bootstrap_form order_questions_form layout="checkout" %}
+                    </div>
+                </details>
+            {% endif %}
 
             {% for pos, forms in formgroups %}
                 <details class="panel panel-default" open>

src/pretix/presale/templates/pretixpresale/event/fragment_cart.html

@@ -206,27 +206,7 @@
                         {% for q in line.questions %}
                             <dt>{{ q.question }}</dt>
                             <dd>
-                                {% if q.answer %}
-                                    {% if q.answer.file %}
-                                        <span class="fa fa-file" aria-hidden="true"></span>
-                                        <a href="{{ q.answer.frontend_file_url }}?token={% answer_token request q.answer %}">
-                                            {{ q.answer.file_name }}
-                                        </a>
-                                        {% if q.answer.is_image %}
-                                            <br>
-                                            <a href="{{ q.answer.frontend_file_url }}?token={% answer_token request q.answer %}" data-lightbox="order"
-                                                    class="answer-thumb">
-                                                <img src="{{ q.answer.frontend_file_url }}?token={% answer_token request q.answer %}" alt="{% trans "The image you previously uploaded" %}">
-                                            </a>
-                                        {% endif %}
-                                    {% elif q.type == "M" %}
-                                        {{ q.answer|rich_text_snippet }}
-                                    {% else %}
-                                        {{ q.answer|linebreaksbr }}
-                                    {% endif %}
-                                {% else %}
-                                    <em class="text-muted">{% trans "not answered" %}</em>
-                                {% endif %}
+                                {% include "pretixpresale/event/fragment_question_answer.html" with request=request question=q answer=q.answer %}
                             </dd>
                         {% endfor %}
                         {% for q in line.additional_answers %}

src/pretix/presale/templates/pretixpresale/event/fragment_question_answer.html

@@ -0,0 +1,24 @@
+{% load safelink %}
+{% load i18n %}
+{% load rich_text %}
+{% if answer %}
+    {% if answer.file %}
+        <span class="fa fa-file" aria-hidden="true"></span>
+        <a href="{{ answer.frontend_file_url }}?token={% answer_token request answer %}">
+            {{ answer.file_name }}
+        </a>
+        {% if answer.is_image %}
+            <br>
+            <a href="{{ answer.frontend_file_url }}?token={% answer_token request answer %}" data-lightbox="order"
+                    class="answer-thumb">
+                <img src="{{ answer.frontend_file_url }}?token={% answer_token request answer %}" alt="{% trans "The image you previously uploaded" %}">
+            </a>
+        {% endif %}
+    {% elif question.type == "M" %}
+        {{ answer|rich_text_snippet }}
+    {% else %}
+        {{ answer|linebreaksbr }}
+    {% endif %}
+{% else %}
+    <em class="text-muted">{% trans "not answered" %}</em>
+{% endif %}

src/pretix/presale/templates/pretixpresale/event/order.html

@@ -346,6 +346,16 @@
                             {% endfor %}
                         {% endif %}
                     </dl>
+
+                    {% if order.answers.all %}
+                        <hr>
+                        <dl class="dl-horizontal">
+                            {% for ans in order.answers.all %}
+                                <dt>{{ ans.question.question }}</dt>
+                                <dd>{% include "pretixpresale/event/fragment_question_answer.html" with request=request question=ans.question answer=ans %}</dd>
+                            {% endfor %}
+                        </dl>
+                    {% endif %}
                 </div>
             </div>
         </div>

src/pretix/presale/templates/pretixpresale/event/order_modify.html

@@ -48,6 +48,18 @@
                     </div>
                 </details>
             {% endif %}
+            {% if order_questions_form.fields %}
+                <details class="panel panel-default" open>
+                    <summary class="panel-heading">
+                        <h3 class="panel-title">
+                            <strong>{% trans "Additional order information" %}</strong>
+                        </h3>
+                    </summary>
+                    <div class="panel-body">
+                        {% bootstrap_form order_questions_form layout="checkout" %}
+                    </div>
+                </details>
+            {% endif %}
             {% for pos, forms in formgroups %}
                 <details class="panel panel-default" open>
                     <summary class="panel-heading">

src/pretix/presale/views/__init__.py

@@ -54,6 +54,7 @@ from pretix.base.models import (
     CartPosition, Customer, InvoiceAddress, ItemAddOn, OrderFee, Question,
     QuestionAnswer, QuestionOption, TaxRule,
 )
+from pretix.base.models.orders import CheckoutSession
 from pretix.base.services.cart import get_fees
 from pretix.base.services.pricing import apply_rounding
 from pretix.base.templatetags.money import money_filter
@@ -101,6 +102,15 @@ class CartMixin:
         from pretix.presale.views.cart import cart_session
         return cart_session(self.request)
 
+    @cached_property
+    def checkout_session(self):
+        from pretix.presale.views.cart import get_or_create_cart_id
+
+        return CheckoutSession.objects.filter(
+            event=self.request.event,
+            cart_id=get_or_create_cart_id(self.request, create=False),
+        ).first()
+
     @cached_property
     def cart_customer(self):
         if self.cart_session.get('customer_mode', 'guest') == 'login':
@@ -398,7 +408,7 @@ def get_cart(request):
             request._cart_cache = CartPosition.objects.none()
         else:
             qqs = request.event.questions.all()
-            qqs = qqs.filter(ask_during_checkin=False, hidden=False)
+            qqs = qqs.filter(ask_during_checkin=False, hidden=False, container_type=Question.ContainerType.ORDERPOSITION)
             request._cart_cache = CartPosition.objects.filter(
                 cart_id=cart_id, event=request.event
             ).annotate(

src/pretix/presale/views/cart.py

@@ -67,6 +67,7 @@ from pretix.base.services.cart import (
 from pretix.base.timemachine import time_machine_now
 from pretix.base.views.tasks import AsyncAction
 from pretix.helpers.http import redirect_to_url
+from pretix.helpers.safedownload import check_token
 from pretix.multidomain.urlreverse import eventreverse
 from pretix.presale.productlist import (
     item_group_by_category, prepare_item_list_for_shop,
@@ -388,6 +389,7 @@ def get_or_create_cart_id(request, create=True):
             if 'carts' in request.session:
                 request.session['carts'][current_id] = {}
         else:
+            # We found a valid, existing cart.
             return current_id
 
     cart_data = {}
@@ -398,6 +400,7 @@ def get_or_create_cart_id(request, create=True):
             cart_data['widget_data'] = cached_widget_data
     else:
         if not create:
+            # There is no existing cart for this request and we're not supposed to create a new one.
             return None
         new_id = generate_cart_id(request, prefix=prefix)
 
@@ -846,15 +849,19 @@ class RedeemView(NoSearchIndexViewMixin, EventViewMixin, CartMixin, TemplateView
 class AnswerDownload(EventViewMixin, View):
     def get(self, request, *args, **kwargs):
         answid = kwargs.get('answer')
+        token = request.GET.get('token', '')
+        cart_id = get_or_create_cart_id(self.request)
         answer = get_object_or_404(
             QuestionAnswer,
-            cartposition__cart_id=get_or_create_cart_id(self.request),
+            Q(cartposition__cart_id=cart_id) | Q(checkoutsession__cart_id=cart_id),
             id=answid
         )
         if not answer.file:
             return Http404()
+        if not check_token(request, answer, token):
+            raise Http404(_("This link is no longer valid. Please go back, refresh the page, and try again."))
 
-        ftype, _ = mimetypes.guess_type(answer.file.name)
+        ftype, _1 = mimetypes.guess_type(answer.file.name)
         filename = '{}-cart-{}'.format(
             self.request.event.slug.upper(),
             os.path.basename(answer.file.name).split('.', 1)[1]
@@ -862,6 +869,7 @@ class AnswerDownload(EventViewMixin, View):
         resp = FileResponse(
             answer.file,
             filename=filename,
+            as_attachment=True,
             content_type=ftype or 'application/binary'
         )
         return resp

src/pretix/presale/views/order.py

@@ -90,7 +90,9 @@ from pretix.base.views.tasks import AsyncAction
 from pretix.helpers.http import redirect_to_url
 from pretix.helpers.safedownload import check_token
 from pretix.multidomain.urlreverse import eventreverse, eventreverse_absolute
-from pretix.presale.forms.checkout import InvoiceAddressForm, QuestionsForm
+from pretix.presale.forms.checkout import (
+    CustomerAwareQuestionsForm, InvoiceAddressForm,
+)
 from pretix.presale.forms.order import OrderPositionChangeForm
 from pretix.presale.productlist import prepare_item_list_for_shop
 from pretix.presale.signals import question_form_fields_overrides
@@ -349,7 +351,7 @@ class OrderDetails(EventViewMixin, OrderDetailMixin, CartMixin, TicketPageMixin,
                 pp = lp.payment_provider
                 ctx['last_payment_info'] = pp.payment_pending_render(self.request, ctx['last_payment'])
 
-                if lp.state == OrderPayment.PAYMENT_STATE_PENDING and not pp.abort_pending_allowed:
+                if lp.state == OrderPayment.PAYMENT_STATE_PENDING and not pp._payment_abort_pending_allowed(lp):
                     ctx['can_pay'] = False
 
             ctx['can_pay'] = ctx['can_pay'] and self.order._can_be_paid() is True
@@ -611,7 +613,8 @@ class OrderPayChangeMethod(EventViewMixin, OrderDetailMixin, TemplateView):
 
         if self.open_payment:
             pp = self.open_payment.payment_provider
-            if self.open_payment.state == OrderPayment.PAYMENT_STATE_PENDING and not pp.abort_pending_allowed:
+            if self.open_payment.state == OrderPayment.PAYMENT_STATE_PENDING and not pp._payment_abort_pending_allowed(
+                    self.open_payment):
                 messages.error(request, _('A payment is currently pending for this order.'))
                 return redirect(self.get_order_url())
 
@@ -806,10 +809,14 @@ class OrderInvoiceCreate(EventViewMixin, OrderDetailMixin, View):
 
 @method_decorator(xframe_options_exempt, 'dispatch')
 class OrderModify(EventViewMixin, OrderDetailMixin, OrderQuestionsViewMixin, TemplateView):
-    form_class = QuestionsForm
+    orderposition_form_class = CustomerAwareQuestionsForm
     invoice_form_class = InvoiceAddressForm
     template_name = "pretixpresale/event/order_modify.html"
 
+    @property
+    def order_question_container(self):
+        return self.order
+
     @cached_property
     def positions(self):
         if self.request.GET.get('generate_invoice') == 'true':
@@ -940,7 +947,7 @@ class OrderModify(EventViewMixin, OrderDetailMixin, OrderQuestionsViewMixin, Tem
 
 @method_decorator(xframe_options_exempt, 'dispatch')
 class OrderPositionModify(EventViewMixin, OrderPositionDetailMixin, OrderQuestionsViewMixin, TemplateView):
-    form_class = QuestionsForm
+    orderposition_form_class = CustomerAwareQuestionsForm
     invoice_form_class = None
     template_name = "pretixpresale/event/position_modify.html"
 
@@ -948,6 +955,10 @@ class OrderPositionModify(EventViewMixin, OrderPositionDetailMixin, OrderQuestio
     def invoice_form(self):
         return None
 
+    @property
+    def order_question_container(self):
+        return None
+
     @cached_property
     def positions(self):
         return [p for p in super().positions if p.pk == self.position.pk or p.addon_to_id == self.position.pk]
@@ -1144,7 +1155,11 @@ class AnswerDownload(EventViewMixin, OrderDetailMixin, View):
         answid = kwargs.get('answer')
         token = request.GET.get('token', '')
 
-        answer = get_object_or_404(QuestionAnswer, orderposition__order=self.order, id=answid)
+        answer = get_object_or_404(
+            QuestionAnswer,
+            Q(orderposition__order=self.order) | Q(order=self.order),
+            id=answid,
+        )
         if not answer.file:
             raise Http404()
         if not check_token(request, answer, token):
@@ -1154,7 +1169,7 @@ class AnswerDownload(EventViewMixin, OrderDetailMixin, View):
         resp = FileResponse(answer.file, content_type=ftype or 'application/binary')
         resp['Content-Disposition'] = 'attachment; filename="{}-{}-{}-{}"'.format(
             self.request.event.slug.upper(), self.order.code,
-            answer.orderposition.positionid,
+            answer.orderposition.positionid if answer.orderposition else '',
             os.path.basename(answer.file.name).split('.', 1)[1]
         )
         return resp
@@ -1718,7 +1733,7 @@ class OrderChangeMixin:
 
         if totaldiff > Decimal('0.00') and self.order.status == Order.STATUS_PENDING:
             for p in self.order.payments.filter(state=OrderPayment.PAYMENT_STATE_PENDING):
-                if not p.payment_provider.abort_pending_allowed:
+                if not p.payment_provider._payment_abort_pending_allowed(p):
                     raise OrderError(_('You may not change your order in a way that requires additional payment while '
                                        'we are processing your current payment. Please check back after your current '
                                        'payment has been accepted.'))

src/pretix/presale/views/questions.py

@@ -35,14 +35,18 @@
 from django.utils.functional import cached_property
 
 from pretix.base.views.mixins import BaseQuestionsViewMixin
-from pretix.presale.forms.checkout import QuestionsForm
+from pretix.presale.forms.checkout import CustomerAwareQuestionsForm
 from pretix.presale.views import get_cart
 
 
-class QuestionsViewMixin(BaseQuestionsViewMixin):
-    form_class = QuestionsForm
+class CartQuestionsViewMixin(BaseQuestionsViewMixin):
+    orderposition_form_class = CustomerAwareQuestionsForm
     only_user_visible = True
 
+    @property
+    def order_question_container(self):
+        return self.checkout_session
+
     @cached_property
     def _positions_for_questions(self):
         cart = get_cart(self.request)

src/pretix/presale/views/widget.py

@@ -795,6 +795,7 @@ class WidgetAPIProductList(EventListMixin, View):
             'target_url': eventreverse_absolute(request.event, 'presale:event.index'),
             'subevent': self.subevent.pk if self.subevent else None,
             'currency': request.event.currency,
+            'currency_places': settings.CURRENCY_PLACES.get(request.event.currency, 2),
             'display_net_prices': request.event.settings.display_net_prices,
             'use_native_spinners': request.event.settings.widget_use_native_spinners,
             'show_variations_expanded': request.event.settings.show_variations_expanded,

src/pretix/static/pretixbase/js/reldate.js

@@ -0,0 +1,42 @@
+$(document).on('pretix:bind-forms', () => {
+	document.querySelectorAll('.reldatetime, .reldate').forEach(container => {
+		const groups = container.querySelectorAll('.radio')
+
+		groups.forEach(group => {
+			const referenceSelect = group.querySelector('select[data-relative-choice]')
+			const beforeAfterSelect = group.querySelector('select[data-relation-choice]')
+			if (!referenceSelect || !beforeAfterSelect) return
+
+			const beforeOption = beforeAfterSelect.querySelector('option[value="before"]')
+			const afterOption = beforeAfterSelect.querySelector('option[value="after"]')
+
+			const updateBeforeOption = () => {
+				let supportsBefore = referenceSelect.selectedOptions[0].hasAttribute('data-supports-before')
+				if (beforeOption) {
+					beforeOption.disabled = !beforeOption.disabled && !supportsBefore
+				}
+
+				let supportsAfter = referenceSelect.selectedOptions[0].hasAttribute('data-supports-after')
+				if (afterOption) {
+					afterOption.disabled = !afterOption.disabled && !supportsAfter
+				}
+
+				let dirty = false
+				if (beforeOption.disabled && beforeAfterSelect.value === 'before') {
+					beforeAfterSelect.value = 'after'
+					dirty = true
+				}
+				if (afterOption.disabled && beforeAfterSelect.value === 'after') {
+					beforeAfterSelect.value = 'before'
+					dirty = true
+				}
+
+				if (dirty) {
+					beforeAfterSelect.dispatchEvent(new Event('change', {bubbles: true}))
+				}
+			}
+			referenceSelect.addEventListener('change', updateBeforeOption)
+			updateBeforeOption()
+		})
+	})
+})

src/pretix/static/pretixcontrol/js/ui/question.js

@@ -131,7 +131,8 @@ $(function () {
         $val.parent().append("<div class=\"help-block loading-indicator\"><span class=\"fa" +
             " fa-cog fa-spin\"></span></div>");
 
-        apiGET('/api/v1/organizers/' + $("body").attr("data-organizer") + '/events/' + $("body").attr("data-event") + '/questions/' + val + '/', function (data) {
+				// the container_type parameter is undocumented. this API is going to change in a later release.
+        apiGET('/api/v1/organizers/' + $("body").attr("data-organizer") + '/events/' + $("body").attr("data-event") + '/questions/' + val + '/?container_type=' + encodeURIComponent($dq.data('container-type')), function (data) {
             if (data.type === "B") {
                 $val.append($("<option>").attr("value", "True").text(gettext("Yes")));
                 $val.append($("<option>").attr("value", "False").text(gettext("No")));

src/pretix/static/pretixpresale/js/widget/widget.js

@@ -262,7 +262,7 @@ Vue.component('availbox', {
     },
     mounted: function() {
         if (!this.$root.cart_exists && this.$root.itemnum === 1 && (!this.$root.categories[0].items[0].has_variations || this.$root.categories[0].items[0].variations.length < 2) && !this.$root.has_seating_plan ? 1 : 0) {
-            this.$refs.quantity.value = 1;    
+            this.$refs.quantity.value = 1;
             if (this.order_max === 1) {
                 this.$refs.quantity.checked = true;
             }
@@ -310,7 +310,7 @@ Vue.component('availbox', {
             return this.avail[0] < 100 && this.$root.waiting_list_enabled && this.item.allow_waitinglist;
         },
         waiting_list_url: function () {
-            var u = this.$root.target_url + 'w/' + widget_id + '/waitinglist/?locale=' + lang + '&item=' + this.item.id 
+            var u = this.$root.target_url + 'w/' + widget_id + '/waitinglist/?locale=' + lang + '&item=' + this.item.id
             if (this.item.has_variations) {
                 u += '&var=' + this.variation.id
             }
@@ -380,16 +380,16 @@ Vue.component('pricebox', {
         },
         display_price: function () {
             if (this.$root.display_net_prices) {
-                return floatformat(parseFloat(this.price.net), 2);
+                return floatformat(this.price.net, this.$root.currency_places);
             } else {
-                return floatformat(parseFloat(this.price.gross), 2);
+                return floatformat(this.price.gross, this.$root.currency_places);
             }
         },
         display_price_nonlocalized: function () {
             if (this.$root.display_net_prices) {
-                return parseFloat(this.price.net).toFixed(2);
+                return parseFloat(this.price.net).toFixed(this.$root.currency_places);
             } else {
-                return parseFloat(this.price.gross).toFixed(2);
+                return parseFloat(this.price.gross).toFixed(this.$root.currency_places);
             }
         },
         suggested_price_nonlocalized: function () {
@@ -398,9 +398,9 @@ Vue.component('pricebox', {
                 price = this.price;
             }
             if (this.$root.display_net_prices) {
-                return parseFloat(price.net).toFixed(2);
+                return parseFloat(price.net).toFixed(this.$root.currency_places);
             } else {
-                return parseFloat(price.gross).toFixed(2);
+                return parseFloat(price.gross).toFixed(this.$root.currency_places);
             }
         },
         original_price_aria_label: function () {
@@ -410,7 +410,7 @@ Vue.component('pricebox', {
             return django.interpolate(strings.new_price, [this.stripHTML(this.priceline)]);
         },
         original_line: function () {
-            return '<span class="pretix-widget-pricebox-currency">' + this.$root.currency + "</span> " + floatformat(parseFloat(this.original_price), 2);
+            return '<span class="pretix-widget-pricebox-currency">' + this.$root.currency + "</span> " + floatformat(this.original_price, this.$root.currency_places);
         },
         priceline: function () {
             if (this.price.gross === "0.00") {
@@ -645,19 +645,19 @@ Vue.component('item', {
             if (this.item.free_price) {
                 return django.interpolate(strings.price_from, {
                     'currency': this.$root.currency,
-                    'price': floatformat(this.item.min_price, 2)
+                    'price': floatformat(this.item.min_price, this.$root.currency_places)
                 }, true).replace(this.$root.currency, '<span class="pretix-widget-pricebox-currency">' + this.$root.currency + '</span>');
             } else if (this.item.min_price !== this.item.max_price) {
-                return '<span class="pretix-widget-pricebox-currency">' + this.$root.currency + "</span> " 
-                    + floatformat(this.item.min_price, 2) + " – "
-                    + floatformat(this.item.max_price, 2);
+                return '<span class="pretix-widget-pricebox-currency">' + this.$root.currency + "</span> "
+                    + floatformat(this.item.min_price, this.$root.currency_places) + " – "
+                    + floatformat(this.item.max_price, this.$root.currency_places);
             } else if (this.item.min_price === "0.00" && this.item.max_price === "0.00") {
                 if (this.item.mandatory_priced_addons) {
                     return "\xA0"; // nbsp, because an empty string would cause the HTML element to collapse
                 }
                 return strings.free;
             } else {
-                return '<span class="pretix-widget-pricebox-currency">' + this.$root.currency + "</span> " + floatformat(this.item.min_price, 2);
+                return '<span class="pretix-widget-pricebox-currency">' + this.$root.currency + "</span> " + floatformat(this.item.min_price, this.$root.currency_places);
             }
         },
         variationsToggleLabel: function () {
@@ -863,7 +863,7 @@ var shared_alert_fragment = (
     '<dialog :class="alertClasses" role="alertdialog" v-bind:aria-labelledby="$root.parent.html_id + \'-error-message\'" @close="errorClose">'
     + '<form class="pretix-widget-alert-box" method="dialog">'
     + '<p :id="$root.parent.html_id + \'-error-message\'">{{ $root.error_message }}</p>'
-    + '<p><button v-if="$root.error_url_after" value="continue" autofocus v-bind:aria-describedby="$root.parent.html_id + \'-error-message\'">' + strings.continue + '</button>'
+    + '<p><button v-if="$root.error_url_after" @click="errorContinue" autofocus v-bind:aria-describedby="$root.parent.html_id + \'-error-message\'">' + strings.continue + '</button>'
     + '<button v-else autofocus v-bind:aria-describedby="$root.parent.html_id + \'-error-message\'">' + strings.close + '</button></p>'
     + '</form>'
     + '<transition name="bounce">'
@@ -952,7 +952,7 @@ Vue.component('pretix-overlay', {
         cancelBlockedClasses: function () {
             return {
                 'pretix-widget-visibility-hidden': !this.cancelBlocked,
-            }  
+            }
         },
     },
     mounted () {
@@ -974,19 +974,18 @@ Vue.component('pretix-overlay', {
             this.$root.lightbox.loading = false;
         },
         errorClose: function (e) {
-            var dialog = e.target;
-            if (dialog.returnValue == "continue" && this.$root.error_url_after) {
-                if (this.$root.error_url_after_new_tab) {
-                    window.open(this.$root.error_url_after);
-                } else if (this.$root.overlay) {
-                    this.$root.overlay.frame_src = this.$root.error_url_after;
-                    this.$root.frame_loading = true;
-                }
-            }
             this.$root.error_message = null;
             this.$root.error_url_after = null;
             this.$root.error_url_after_new_tab = false;
         },
+        errorContinue: function () {
+            if (this.$root.error_url_after_new_tab) {
+                window.open(this.$root.error_url_after);
+            } else if (this.$root.overlay) {
+                this.$root.overlay.frame_src = this.$root.error_url_after;
+                this.$root.frame_loading = true;
+            }
+        },
         close: function (e) {
             if (this.$root.frame_loading) {
                 // Chrome does not allow blocking dialog.cancel event more than once
@@ -1949,6 +1948,7 @@ var shared_root_methods = {
                 root.location = data.location;
                 root.categories = data.items_by_category;
                 root.currency = data.currency;
+                root.currency_places = data.currency_places;
                 root.display_net_prices = data.display_net_prices;
                 root.voucher_explanation_text = data.voucher_explanation_text;
                 root.error = data.error;
@@ -1983,6 +1983,7 @@ var shared_root_methods = {
         }, function (error) {
             root.categories = [];
             root.currency = '';
+            root.currency_places = 2;
             if (error.status === 429) {
                 root.error = strings['loading_error_429'];
                 root.connection_error = true;
@@ -2339,6 +2340,7 @@ var create_widget = function (element, html_id=null) {
                 is_button: false,
                 categories: null,
                 currency: null,
+                currency_places: 2,
                 name: null,
                 date_range: null,
                 location: null,

src/pretix/static/pretixpresale/widget/src/api.ts

@@ -22,6 +22,7 @@ export interface ProductListResponse {
 	location?: string
 	items_by_category?: Category[]
 	currency?: string
+	currency_places?: number
 	display_net_prices?: boolean
 	voucher_explanation_text?: string
 	error?: string

src/pretix/static/pretixpresale/widget/src/components/Item.vue

@@ -72,7 +72,7 @@ const pricerange = computed(() => {
 			STRINGS.price_from,
 			{
 				currency: store.currency,
-				price: floatformat(props.item.min_price || '0', 2),
+				price: floatformat(props.item.min_price || '0', store.currency_places),
 			},
 			true
 		).replace(
@@ -80,14 +80,14 @@ const pricerange = computed(() => {
 			`<span class="pretix-widget-pricebox-currency">${store.currency}</span>`
 		)
 	} else if (props.item.min_price !== props.item.max_price) {
-		return `<span class="pretix-widget-pricebox-currency">${store.currency}</span> ${floatformat(props.item.min_price || '0', 2)} – ${floatformat(props.item.max_price || '0', 2)}`
+		return `<span class="pretix-widget-pricebox-currency">${store.currency}</span> ${floatformat(props.item.min_price || '0', store.currency_places)} – ${floatformat(props.item.max_price || '0', store.currency_places)}`
 	} else if (props.item.min_price === '0.00' && props.item.max_price === '0.00') {
 		if (props.item.mandatory_priced_addons) {
 			return '\xA0' // nbsp, because an empty string would cause the HTML element to collapse
 		}
 		return STRINGS.free
 	} else {
-		return `<span class="pretix-widget-pricebox-currency">${store.currency}</span> ${floatformat(props.item.min_price || '0', 2)}`
+		return `<span class="pretix-widget-pricebox-currency">${store.currency}</span> ${floatformat(props.item.min_price || '0', store.currency_places)}`
 	}
 })
 

src/pretix/static/pretixpresale/widget/src/components/Overlay.vue

@@ -54,16 +54,16 @@ function lightboxLoaded () {
 	}
 }
 
-function errorClose (e: Event) {
-	const dialog = e.target as HTMLDialogElement
-	if (dialog.returnValue === 'continue' && store.overlay.errorUrlAfter) {
-		if (store.overlay.errorUrlAfterNewTab) {
-			window.open(store.overlay.errorUrlAfter)
-		} else {
-			store.overlay.frameSrc = store.overlay.errorUrlAfter
-			store.overlay.frameLoading = true
-		}
+function errorContinue () {
+	if (store.overlay.errorUrlAfterNewTab) {
+		window.open(store.overlay.errorUrlAfter)
+	} else {
+		store.overlay.frameSrc = store.overlay.errorUrlAfter
+		store.overlay.frameLoading = true
 	}
+}
+
+function errorClose () {
 	store.overlay.errorMessage = null
 	store.overlay.errorUrlAfter = null
 	store.overlay.errorUrlAfterNewTab = false
@@ -168,6 +168,10 @@ onMounted(() => {
 onUnmounted(() => {
 	window.removeEventListener('message', onMessage, false)
 })
+
+const vAutofocus = {
+	mounted: (el) => el.focus()
+}
 </script>
 
 <template lang="pug">
@@ -181,7 +185,7 @@ Teleport(to="body")
 					strong {{ STRINGS.cancel_blocked }}
 			.pretix-widget-frame-inner(v-show="store.overlay.frameShown")
 				form.pretix-widget-frame-close(method="dialog")
-					button(ref="closeButton", :aria-label="STRINGS.close_checkout", autofocus)
+					button(ref="closeButton", v-autofocus, :aria-label="STRINGS.close_checkout")
 						svg(:alt="STRINGS.close", height="16", viewBox="0 0 512 512", width="16", xmlns="http://www.w3.org/2000/svg")
 							path(fill="#fff", d="M437.5,386.6L306.9,256l130.6-130.6c14.1-14.1,14.1-36.8,0-50.9c-14.1-14.1-36.8-14.1-50.9,0L256,205.1L125.4,74.5 c-14.1-14.1-36.8-14.1-50.9,0c-14.1,14.1-14.1,36.8,0,50.9L205.1,256L74.5,386.6c-14.1,14.1-14.1,36.8,0,50.9 c14.1,14.1,36.8,14.1,50.9,0L256,306.9l130.6,130.6c14.1,14.1,36.8,14.1,50.9,0C451.5,423.4,451.5,400.6,437.5,386.6z")
 				iframe(
@@ -200,9 +204,9 @@ Teleport(to="body")
 			form.pretix-widget-alert-box(method="dialog")
 				p(:id="errorMessageId") {{ store.overlay.errorMessage }}
 				p
-					button(v-if="store.overlay.errorUrlAfter", value="continue", autofocus, :aria-describedby="errorMessageId")
+					button(v-if="store.overlay.errorUrlAfter", v-autofocus, :aria-describedby="errorMessageId", @click="errorContinue")
 						| {{ STRINGS.continue }}
-					button(v-else, autofocus, :aria-describedby="errorMessageId") {{ STRINGS.close }}
+					button(v-else, v-autofocus, :aria-describedby="errorMessageId") {{ STRINGS.close }}
 			transition(name="bounce")
 				svg.pretix-widget-alert-icon(v-if="store.overlay.errorMessage", width="64", height="64", viewBox="0 0 1792 1792", xmlns="http://www.w3.org/2000/svg")
 					path(style="fill:#ffffff;", d="M 599.86438,303.72882 H 1203.5254 V 1503.4576 H 599.86438 Z")
@@ -214,7 +218,7 @@ Teleport(to="body")
 					path.pretix-widget-primary-color(d="M1152 896q0-106-75-181t-181-75-181 75-75 181 75 181 181 75 181-75 75-181zm512-109v222q0 12-8 23t-20 13l-185 28q-19 54-39 91 35 50 107 138 10 12 10 25t-9 23q-27 37-99 108t-94 71q-12 0-26-9l-138-108q-44 23-91 38-16 136-29 186-7 28-36 28h-222q-14 0-24.5-8.5t-11.5-21.5l-28-184q-49-16-90-37l-141 107q-10 9-25 9-14 0-25-11-126-114-165-168-7-10-7-23 0-12 8-23 15-21 51-66.5t54-70.5q-27-50-41-99l-183-27q-13-2-21-12.5t-8-23.5v-222q0-12 8-23t19-13l186-28q14-46 39-92-40-57-107-138-10-12-10-24 0-10 9-23 26-36 98.5-107.5t94.5-71.5q13 0 26 10l138 107q44-23 91-38 16-136 29-186 7-28 36-28h222q14 0 24.5 8.5t11.5 21.5l28 184q49 16 90 37l142-107q9-9 24-9 13 0 25 10 129 119 165 170 7 8 7 22 0 12-8 23-15 21-51 66.5t-54 70.5q26 50 41 98l183 28q13 2 21 12.5t8 23.5z")
 			.pretix-widget-lightbox-inner(v-if="store.overlay.lightbox")
 				form.pretix-widget-lightbox-close(method="dialog")
-					button(:aria-label="STRINGS.close", autofocus)
+					button(v-autofocus, :aria-label="STRINGS.close")
 						svg(:alt="STRINGS.close", height="16", viewBox="0 0 512 512", width="16", xmlns="http://www.w3.org/2000/svg")
 							path(fill="#fff", d="M437.5,386.6L306.9,256l130.6-130.6c14.1-14.1,14.1-36.8,0-50.9c-14.1-14.1-36.8-14.1-50.9,0L256,205.1L125.4,74.5 c-14.1-14.1-36.8-14.1-50.9,0c-14.1,14.1-14.1,36.8,0,50.9L205.1,256L74.5,386.6c-14.1,14.1-14.1,36.8,0,50.9 c14.1,14.1,36.8,14.1,50.9,0L256,306.9l130.6,130.6c14.1,14.1,36.8,14.1,50.9,0C451.5,423.4,451.5,400.6,437.5,386.6z")
 				figure.pretix-widget-lightbox-image

src/pretix/static/pretixpresale/widget/src/components/PriceBox.vue

@@ -25,9 +25,9 @@ const ariaLabelledby = computed(() => `${store.htmlId}-item-label-${props.itemId
 
 const displayPrice = computed(() => {
 	if (store.displayNetPrices) {
-		return floatformat(parseFloat(props.price.net), 2)
+		return floatformat(props.price.net, store.currency_places)
 	}
-	return floatformat(parseFloat(props.price.gross), 2)
+	return floatformat(props.price.gross, store.currency_places)
 })
 
 const displayPriceNonlocalized = computed(() => {
@@ -40,15 +40,15 @@ const displayPriceNonlocalized = computed(() => {
 const suggestedPriceNonlocalized = computed(() => {
 	const price = props.suggestedPrice ?? props.price
 	if (store.displayNetPrices) {
-		return parseFloat(price.net).toFixed(2)
+		return parseFloat(price.net).toFixed(store.currency_places)
 	}
-	return parseFloat(price.gross).toFixed(2)
+	return parseFloat(price.gross).toFixed(store.currency_places)
 })
 
 // TODO BAD
 const originalLine = computed(() => {
 	if (!props.originalPrice) return ''
-	return `<span class="pretix-widget-pricebox-currency">${store.currency}</span> ${floatformat(parseFloat(props.originalPrice), 2)}`
+	return `<span class="pretix-widget-pricebox-currency">${store.currency}</span> ${floatformat(props.originalPrice, store.currency_places)}`
 })
 
 // TODO BAD

src/pretix/static/pretixpresale/widget/src/sharedStore.ts

@@ -71,6 +71,7 @@ export function createWidgetStore (config: {
 			frontpageText: null as string | null,
 			categories: [] as Category[],
 			currency: '',
+			currency_places: 2,
 			displayNetPrices: false,
 			voucherExplanationText: null as string | null,
 			displayAddToCart: false,
@@ -299,6 +300,7 @@ export function createWidgetStore (config: {
 						this.location = data.location ?? null
 						this.categories = data.items_by_category ?? []
 						this.currency = data.currency ?? ''
+						this.currency_places = data.currency_places ?? 2
 						this.displayNetPrices = data.display_net_prices ?? false
 						this.voucherExplanationText = data.voucher_explanation_text ?? null
 						this.error = data.error ?? null
@@ -338,6 +340,7 @@ export function createWidgetStore (config: {
 				} catch (e) {
 					this.categories = []
 					this.currency = ''
+					this.currency_places = 2
 					if (e instanceof ApiError && e.status === 429) {
 						this.error = STRINGS.loading_error_429
 					} else {

src/pretix/testutils/db.py

@@ -0,0 +1,25 @@
+#
+# This file is part of pretix (Community Edition).
+#
+# Copyright (C) 2014-2020  Raphael Michel and contributors
+# Copyright (C) 2020-today pretix GmbH and contributors
+#
+# This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
+# Public License as published by the Free Software Foundation in version 3 of the License.
+#
+# ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are
+# applicable granting you additional permissions and placing additional restrictions on your usage of this software.
+# Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive
+# this file, see <https://pretix.eu/about/en/license>.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
+# details.
+#
+# You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
+# <https://www.gnu.org/licenses/>.
+#
+def readonly_db(execute, sql, params, many, context):
+    if not sql.lower().startswith("select"):
+        raise Exception(f"Should not write anything to the database, but detected query: {sql}")
+    return execute(sql, params, many, context)

src/tests/api/test_checkinrpc.py

@@ -25,6 +25,7 @@ from unittest import mock
 
 import pytest
 from django.core.files.base import ContentFile
+from django.db import connection
 from django.utils.timezone import now
 from django_countries.fields import Country
 from django_scopes import scopes_disabled
@@ -36,6 +37,7 @@ from pretix.api.serializers.item import QuestionSerializer
 from pretix.base.models import (
     Checkin, InvoiceAddress, Item, Order, OrderPosition, ReusableMedium,
 )
+from pretix.testutils.db import readonly_db
 
 # Lots of this code is overlapping with test_checkin.py, and some of it is arguably redundant since it's triggering
 # the same backend code paths (for now). However, this is SUCH a critical part of pretix that we don't want to take
@@ -1739,3 +1741,41 @@ def test_exchange_create_gift_card(token_client, organizer, clist, event, order,
     with scopes_disabled():
         rm = ReusableMedium.objects.get(identifier="0412345")
         assert rm.linked_giftcard.currency == "EUR"
+
+
+@pytest.mark.django_db
+def test_simulate(token_client, organizer, clist, event, order):
+    with scopes_disabled():
+        p = order.positions.first()
+    with connection.execute_wrapper(readonly_db):
+        resp = _redeem(token_client, organizer, clist, p.secret, {"simulate": True})
+    assert resp.status_code == 201
+    assert resp.data['status'] == 'ok'
+    with scopes_disabled():
+        assert not p.checkins.exists()
+
+
+@pytest.mark.django_db
+def test_simulate_no_exchange(token_client, organizer, clist, event, order, item):
+    organizer.settings.reusable_media_type_nfc_uid = True
+    item.media_type = "nfc_uid"
+    item.media_policy = Item.MEDIA_POLICY_NEW
+    item.save()
+    with scopes_disabled():
+        rm = ReusableMedium.objects.create(
+            type="nfc_uid",
+            identifier="12345678",
+            organizer=organizer,
+        )
+    with connection.execute_wrapper(readonly_db):
+        resp = _redeem(token_client, organizer, clist, "z3fsn8jyufm5kpk768q69gkbyr5f4h6w", {
+            "source_type": "barcode",
+            "exchange_medium_type": "nfc_uid",
+            "exchange_medium_identifier": "12345678",
+            "simulate": True,
+        })
+    assert resp.status_code == 400
+    assert resp.data['status'] == 'error'
+    assert resp.data['reason'] == 'error'
+    with scopes_disabled():
+        assert not rm.linked_orderpositions.exists()

src/tests/api/test_deviceauth.py

@@ -20,13 +20,16 @@
 # <https://www.gnu.org/licenses/>.
 #
 import base64
+from datetime import datetime, timezone
 
 import pytest
 from cryptography.hazmat.primitives.asymmetric import padding
 from cryptography.hazmat.primitives.serialization import load_pem_private_key
 from django_scopes import scopes_disabled
+from freezegun import freeze_time
 
 from pretix.base.models import Device
+from pretix.base.models.devices import DeviceLastSeen
 
 
 @pytest.fixture
@@ -386,3 +389,26 @@ def test_device_info_key_sets(device_client, device: Device):
         base64.b64decode(ks['diversification_key']),
         padding.PKCS1v15()
     )
+
+
+@pytest.mark.django_db
+def test_update_last_seen(device_client, device: Device):
+    assert not DeviceLastSeen.objects.exists()
+
+    with freeze_time("2020-01-10T14:30:00+00:00"):
+        resp = device_client.get('/api/v1/device/info')
+        assert resp.status_code == 200
+        assert device.last_seen.last_seen == datetime(2020, 1, 10, 14, 30, tzinfo=timezone.utc)
+
+    with freeze_time("2020-01-10T14:30:05+00:00"):
+        resp = device_client.get('/api/v1/device/info')
+        assert resp.status_code == 200
+        # No update, interal too short
+        device.last_seen.refresh_from_db()
+        assert device.last_seen.last_seen == datetime(2020, 1, 10, 14, 30, tzinfo=timezone.utc)
+
+    with freeze_time("2020-01-10T14:30:30+00:00"):
+        resp = device_client.get('/api/v1/device/info')
+        assert resp.status_code == 200
+        device.last_seen.refresh_from_db()
+        assert device.last_seen.last_seen == datetime(2020, 1, 10, 14, 30, 30, tzinfo=timezone.utc)

src/tests/base/test_models.py

@@ -473,7 +473,7 @@ class QuotaTestCase(BaseQuotaTestCase):
     @classscope(attr='o')
     def test_waitinglist_auto_disable(self):
         self.event.settings.waiting_list_auto_disable = RelativeDateWrapper(
-            RelativeDate(days=0, time=None, base_date_name='date_from', minutes=20, is_after=True)
+            RelativeDate(days=0, time=None, base_date_name='event__date_from', minutes=20, is_after=True)
         )
         self.quota.items.add(self.item1)
         self.quota.size = 1
@@ -484,7 +484,7 @@ class QuotaTestCase(BaseQuotaTestCase):
         self.assertEqual(self.item1.check_quotas(), (Quota.AVAILABILITY_ORDERED, 0))
         self.assertEqual(self.item1.check_quotas(count_waitinglist=False), (Quota.AVAILABILITY_OK, 1))
         self.event.settings.waiting_list_auto_disable = RelativeDateWrapper(
-            RelativeDate(days=0, time=None, base_date_name='date_from', minutes=20, is_after=False)
+            RelativeDate(days=0, time=None, base_date_name='event__date_from', minutes=20, is_after=False)
         )
         self.assertEqual(self.item1.check_quotas(), (Quota.AVAILABILITY_OK, 1))
         self.assertEqual(self.item1.check_quotas(count_waitinglist=False), (Quota.AVAILABILITY_OK, 1))
@@ -1192,7 +1192,7 @@ class OrderTestCase(BaseQuotaTestCase):
         self.op2.subevent = se2
         self.op2.save()
         self.event.settings.set('payment_term_last', RelativeDateWrapper(
-            RelativeDate(days=2, time=None, base_date_name='date_from', minutes=None)
+            RelativeDate(days=2, time=None, base_date_name='event__date_from', minutes=None)
         ))
 
         self.order.status = Order.STATUS_EXPIRED
@@ -1347,7 +1347,7 @@ class OrderTestCase(BaseQuotaTestCase):
         self.op2.subevent = se2
         self.op2.save()
         self.event.settings.set('last_order_modification_date', RelativeDateWrapper(
-            RelativeDate(days=2, time=None, base_date_name='date_from', minutes=None)
+            RelativeDate(days=2, time=None, base_date_name='event__date_from', minutes=None)
         ))
         assert self.order.can_modify_answers
         self.op2.subevent = se3
@@ -1363,7 +1363,7 @@ class OrderTestCase(BaseQuotaTestCase):
         self.event.date_from = datetime.datetime(2017, 5, 3, 12, 0, 0, tzinfo=datetime.timezone.utc)
         self.event.save()
         self.event.settings.set('payment_term_last', RelativeDateWrapper(
-            RelativeDate(days=2, time=None, base_date_name='date_from', minutes=None)
+            RelativeDate(days=2, time=None, base_date_name='event__date_from', minutes=None)
         ))
         assert self.order.payment_term_last == datetime.datetime(2017, 5, 1, 23, 59, 59, tzinfo=datetime.timezone.utc)
 
@@ -1379,7 +1379,7 @@ class OrderTestCase(BaseQuotaTestCase):
         self.op2.subevent = se2
         self.op2.save()
         self.event.settings.set('payment_term_last', RelativeDateWrapper(
-            RelativeDate(days=2, time=None, base_date_name='date_from', minutes=None)
+            RelativeDate(days=2, time=None, base_date_name='event__date_from', minutes=None)
         ))
         assert self.order.payment_term_last > now()
         self.op2.subevent = se3
@@ -1395,7 +1395,7 @@ class OrderTestCase(BaseQuotaTestCase):
         self.event.date_from = datetime.datetime(2017, 5, 3, 12, 0, 0, tzinfo=datetime.timezone.utc)
         self.event.save()
         self.event.settings.set('ticket_download_date', RelativeDateWrapper(
-            RelativeDate(days=2, time=None, base_date_name='date_from', minutes=None)
+            RelativeDate(days=2, time=None, base_date_name='event__date_from', minutes=None)
         ))
         assert self.order.ticket_download_date == datetime.datetime(2017, 5, 1, 12, 0, 0, tzinfo=datetime.timezone.utc)
 
@@ -1411,7 +1411,7 @@ class OrderTestCase(BaseQuotaTestCase):
         self.op2.subevent = se2
         self.op2.save()
         self.event.settings.set('ticket_download_date', RelativeDateWrapper(
-            RelativeDate(days=2, time=None, base_date_name='date_from', minutes=None)
+            RelativeDate(days=2, time=None, base_date_name='event__date_from', minutes=None)
         ))
         assert self.order.ticket_download_date > now()
         self.op2.subevent = se3
@@ -1582,13 +1582,13 @@ class OrderTestCase(BaseQuotaTestCase):
 
         assert self.order.user_cancel_deadline is None
         self.event.settings.set('cancel_allow_user_until', RelativeDateWrapper(
-            RelativeDate(days=2, time=datetime.time(14, 0, 0), base_date_name='date_from', minutes=None)
+            RelativeDate(days=2, time=datetime.time(14, 0, 0), base_date_name='event__date_from', minutes=None)
         ))
         self.order = Order.objects.get(pk=self.order.pk)
         assert self.order.user_cancel_deadline > now()
         assert self.order.user_cancel_allowed
         self.event.settings.set('cancel_allow_user_until', RelativeDateWrapper(
-            RelativeDate(days=4, time=datetime.time(14, 0, 0), base_date_name='date_from', minutes=None)
+            RelativeDate(days=4, time=datetime.time(14, 0, 0), base_date_name='event__date_from', minutes=None)
         ))
         self.order = Order.objects.get(pk=self.order.pk)
         assert self.order.user_cancel_deadline < now()
@@ -1607,7 +1607,7 @@ class OrderTestCase(BaseQuotaTestCase):
         self.op2.save()
 
         self.event.settings.set('cancel_allow_user_until', RelativeDateWrapper(
-            RelativeDate(days=2, time=datetime.time(14, 0, 0), base_date_name='date_from', minutes=None)
+            RelativeDate(days=2, time=datetime.time(14, 0, 0), base_date_name='event__date_from', minutes=None)
         ))
         self.order = Order.objects.get(pk=self.order.pk)
         assert self.order.user_cancel_deadline < now()
@@ -2018,13 +2018,13 @@ class OrderTestCase(BaseQuotaTestCase):
 
         assert self.order.user_change_deadline is None
         self.event.settings.set('change_allow_user_until', RelativeDateWrapper(
-            RelativeDate(days=2, time=datetime.time(14, 0, 0), base_date_name='date_from', minutes=None)
+            RelativeDate(days=2, time=datetime.time(14, 0, 0), base_date_name='event__date_from', minutes=None)
         ))
         self.order = Order.objects.get(pk=self.order.pk)
         assert self.order.user_change_deadline > now()
         assert self.order.user_change_allowed
         self.event.settings.set('change_allow_user_until', RelativeDateWrapper(
-            RelativeDate(days=4, time=datetime.time(14, 0, 0), base_date_name='date_from', minutes=None)
+            RelativeDate(days=4, time=datetime.time(14, 0, 0), base_date_name='event__date_from', minutes=None)
         ))
         self.order = Order.objects.get(pk=self.order.pk)
         assert self.order.user_change_deadline < now()
@@ -2046,7 +2046,7 @@ class OrderTestCase(BaseQuotaTestCase):
         self.op2.save()
 
         self.event.settings.set('change_allow_user_until', RelativeDateWrapper(
-            RelativeDate(days=2, time=datetime.time(14, 0, 0), base_date_name='date_from', minutes=None)
+            RelativeDate(days=2, time=datetime.time(14, 0, 0), base_date_name='event__date_from', minutes=None)
         ))
         self.order = Order.objects.get(pk=self.order.pk)
         assert self.order.user_change_deadline < now()

src/tests/base/test_orders.py

@@ -204,7 +204,7 @@ def test_expiry_last_relative(event):
     event.date_from = now() + timedelta(days=5)
     event.save()
     event.settings.set('payment_term_last', RelativeDateWrapper(
-        RelativeDate(days=2, time=None, base_date_name='date_from', minutes=None)
+        RelativeDate(days=2, time=None, base_date_name='event__date_from', minutes=None)
     ))
     order = _create_order(event, email='dummy@example.org', positions=[],
                           now_dt=today,
@@ -245,7 +245,7 @@ def test_expiry_last_relative_subevents(event):
     )
 
     event.settings.set('payment_term_last', RelativeDateWrapper(
-        RelativeDate(days=2, time=None, base_date_name='date_from', minutes=None)
+        RelativeDate(days=2, time=None, base_date_name='event__date_from', minutes=None)
     ))
     order = _create_order(event, email='dummy@example.org', positions=[cp1, cp2],
                           now_dt=today,

src/tests/base/test_payment.py

@@ -133,7 +133,7 @@ def test_availability_date_relative(event):
     event.save()
     prov = DummyPaymentProvider(event)
     prov.settings.set('_availability_date', RelativeDateWrapper(
-        RelativeDate(days=2, time=None, base_date_name='date_from', minutes=None)
+        RelativeDate(days=2, time=None, base_date_name='event__date_from', minutes=None)
     ))
 
     utc = datetime.timezone.utc
@@ -150,7 +150,7 @@ def test_availability_start_relative(event):
     event.save()
     prov = DummyPaymentProvider(event)
     prov.settings.set('_availability_start', RelativeDateWrapper(
-        RelativeDate(days=2, time=datetime.time(12, 0), base_date_name='date_from', minutes=None)
+        RelativeDate(days=2, time=datetime.time(12, 0), base_date_name='event__date_from', minutes=None)
     ))
 
     utc = datetime.timezone.utc
@@ -193,12 +193,12 @@ def test_availability_date_cart_relative_subevents(event):
 
     prov = DummyPaymentProvider(event)
     prov.settings.set('_availability_date', RelativeDateWrapper(
-        RelativeDate(days=3, time=None, base_date_name='date_from', minutes=None)
+        RelativeDate(days=3, time=None, base_date_name='event__date_from', minutes=None)
     ))
     assert prov._is_available_by_time(cart_id="123")
 
     prov.settings.set('_availability_date', RelativeDateWrapper(
-        RelativeDate(days=4, time=None, base_date_name='date_from', minutes=None)
+        RelativeDate(days=4, time=None, base_date_name='event__date_from', minutes=None)
     ))
     assert not prov._is_available_by_time(cart_id="123")
 
@@ -233,11 +233,11 @@ def test_availability_date_order_relative_subevents(event):
 
     prov = DummyPaymentProvider(event)
     prov.settings.set('_availability_date', RelativeDateWrapper(
-        RelativeDate(days=3, time=None, base_date_name='date_from', minutes=None)
+        RelativeDate(days=3, time=None, base_date_name='event__date_from', minutes=None)
     ))
     assert prov._is_available_by_time(order=order)
 
     prov.settings.set('_availability_date', RelativeDateWrapper(
-        RelativeDate(days=4, time=None, base_date_name='date_from', minutes=None)
+        RelativeDate(days=4, time=None, base_date_name='event__date_from', minutes=None)
     ))
     assert not prov._is_available_by_time(order=order)

src/tests/base/test_reldate.py

@@ -19,13 +19,13 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-from datetime import datetime, time
+from datetime import datetime, time, timedelta
 from zoneinfo import ZoneInfo
 
 import pytest
 from django_scopes import scope
 
-from pretix.base.models import Event, Organizer
+from pretix.base.models import Event, Order, Organizer
 from pretix.base.reldate import RelativeDate, RelativeDateWrapper
 
 TOKYO = ZoneInfo('Asia/Tokyo')
@@ -40,7 +40,6 @@ def event():
         date_from=datetime(2017, 12, 27, 5, 0, 0, tzinfo=TOKYO),
         presale_start=datetime(2017, 12, 1, 5, 0, 0, tzinfo=TOKYO),
         plugins='pretix.plugins.banktransfer'
-
     )
     event.settings.timezone = "Asia/Tokyo"
     return event
@@ -56,57 +55,57 @@ def test_absolute_date(event):
 
 @pytest.mark.django_db
 def test_relative_date_without_time(event):
-    rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='date_from', minutes=None))
+    rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='event__date_from', minutes=None))
     assert rdw.datetime(event).astimezone(TOKYO) == datetime(2017, 12, 26, 5, 0, 0, tzinfo=TOKYO)
-    assert rdw.to_string() == 'RELDATE/1/-/date_from/'
-    rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='date_from', minutes=None, is_after=True))
+    assert rdw.to_string() == 'RELDATE/1/-/event__date_from/'
+    rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='event__date_from', minutes=None, is_after=True))
     assert rdw.datetime(event).astimezone(TOKYO) == datetime(2017, 12, 28, 5, 0, 0, tzinfo=TOKYO)
-    assert rdw.to_string() == 'RELDATE/1/-/date_from/after'
+    assert rdw.to_string() == 'RELDATE/1/-/event__date_from/after'
 
 
 @pytest.mark.django_db
 def test_relative_date_other_base_point(event):
     with scope(organizer=event.organizer):
-        rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='presale_start', minutes=None))
+        rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='event__presale_start', minutes=None))
         assert rdw.datetime(event) == datetime(2017, 11, 30, 5, 0, 0, tzinfo=TOKYO)
-        assert rdw.to_string() == 'RELDATE/1/-/presale_start/'
+        assert rdw.to_string() == 'RELDATE/1/-/event__presale_start/'
 
         # presale_end is unset, defaults to date_from
-        rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='presale_end', minutes=None))
+        rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='event__presale_end', minutes=None))
         assert rdw.datetime(event) == datetime(2017, 12, 26, 5, 0, 0, tzinfo=TOKYO)
-        assert rdw.to_string() == 'RELDATE/1/-/presale_end/'
+        assert rdw.to_string() == 'RELDATE/1/-/event__presale_end/'
 
         # subevent base
         se = event.subevents.create(name="SE1", date_from=datetime(2017, 11, 27, 5, 0, 0, tzinfo=TOKYO))
-        rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='date_from', minutes=None))
+        rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='event__date_from', minutes=None))
         assert rdw.datetime(se) == datetime(2017, 11, 26, 5, 0, 0, tzinfo=TOKYO)
 
         # presale_start is unset on subevent, default to event
-        rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='presale_start', minutes=None))
+        rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='event__presale_start', minutes=None))
         assert rdw.datetime(se) == datetime(2017, 11, 30, 5, 0, 0, tzinfo=TOKYO)
 
         # presale_end is unset on all, default to date_from of subevent
-        rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='presale_end', minutes=None))
+        rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='event__presale_end', minutes=None))
         assert rdw.datetime(se) == datetime(2017, 11, 26, 5, 0, 0, tzinfo=TOKYO)
 
 
 @pytest.mark.django_db
 def test_relative_date_in_minutes(event):
-    rdw = RelativeDateWrapper(RelativeDate(days=0, time=None, base_date_name='date_from', minutes=60))
-    assert rdw.to_string() == 'RELDATE/minutes/60/date_from/'
+    rdw = RelativeDateWrapper(RelativeDate(days=0, time=None, base_date_name='event__date_from', minutes=60))
+    assert rdw.to_string() == 'RELDATE/minutes/60/event__date_from/'
     assert rdw.datetime(event) == datetime(2017, 12, 27, 4, 0, 0, tzinfo=TOKYO)
-    rdw = RelativeDateWrapper(RelativeDate(days=0, time=None, base_date_name='date_from', minutes=60, is_after=True))
-    assert rdw.to_string() == 'RELDATE/minutes/60/date_from/after'
+    rdw = RelativeDateWrapper(RelativeDate(days=0, time=None, base_date_name='event__date_from', minutes=60, is_after=True))
+    assert rdw.to_string() == 'RELDATE/minutes/60/event__date_from/after'
     assert rdw.datetime(event) == datetime(2017, 12, 27, 6, 0, 0, tzinfo=TOKYO)
 
 
 @pytest.mark.django_db
 def test_relative_date_with_time(event):
-    rdw = RelativeDateWrapper(RelativeDate(days=1, time=time(8, 5, 13), base_date_name='date_from', minutes=None))
-    assert rdw.to_string() == 'RELDATE/1/08:05:13/date_from/'
+    rdw = RelativeDateWrapper(RelativeDate(days=1, time=time(8, 5, 13), base_date_name='event__date_from', minutes=None))
+    assert rdw.to_string() == 'RELDATE/1/08:05:13/event__date_from/'
     assert rdw.datetime(event) == datetime(2017, 12, 26, 8, 5, 13, tzinfo=TOKYO)
-    rdw = RelativeDateWrapper(RelativeDate(days=1, time=time(8, 5, 13), base_date_name='date_from', minutes=None, is_after=True))
-    assert rdw.to_string() == 'RELDATE/1/08:05:13/date_from/after'
+    rdw = RelativeDateWrapper(RelativeDate(days=1, time=time(8, 5, 13), base_date_name='event__date_from', minutes=None, is_after=True))
+    assert rdw.to_string() == 'RELDATE/1/08:05:13/event__date_from/after'
     assert rdw.datetime(event) == datetime(2017, 12, 28, 8, 5, 13, tzinfo=TOKYO)
 
 
@@ -115,35 +114,94 @@ def test_relative_date_with_time_around_dst(event):
     event.settings.timezone = "Europe/Berlin"
     event.date_from = datetime(2020, 3, 29, 18, 0, 0, tzinfo=BERLIN)
 
-    rdw = RelativeDateWrapper(RelativeDate(days=1, time=time(18, 0, 0), base_date_name='date_from', minutes=None))
-    assert rdw.to_string() == 'RELDATE/1/18:00:00/date_from/'
+    rdw = RelativeDateWrapper(RelativeDate(days=1, time=time(18, 0, 0), base_date_name='event__date_from', minutes=None))
+    assert rdw.to_string() == 'RELDATE/1/18:00:00/event__date_from/'
     assert rdw.datetime(event) == datetime(2020, 3, 28, 18, 0, 0, tzinfo=BERLIN)
 
-    rdw = RelativeDateWrapper(RelativeDate(days=0, time=time(2, 30, 0), base_date_name='date_from', minutes=None))
-    assert rdw.to_string() == 'RELDATE/0/02:30:00/date_from/'
+    rdw = RelativeDateWrapper(RelativeDate(days=0, time=time(2, 30, 0), base_date_name='event__date_from', minutes=None))
+    assert rdw.to_string() == 'RELDATE/0/02:30:00/event__date_from/'
     assert rdw.datetime(event) == datetime(2020, 3, 29, 2, 30, 0, tzinfo=BERLIN)
 
     event.date_from = datetime(2020, 10, 25, 18, 0, 0, tzinfo=BERLIN)
 
-    rdw = RelativeDateWrapper(RelativeDate(days=1, time=time(18, 0, 0), base_date_name='date_from', minutes=None))
-    assert rdw.to_string() == 'RELDATE/1/18:00:00/date_from/'
+    rdw = RelativeDateWrapper(RelativeDate(days=1, time=time(18, 0, 0), base_date_name='event__date_from', minutes=None))
+    assert rdw.to_string() == 'RELDATE/1/18:00:00/event__date_from/'
     assert rdw.datetime(event) == datetime(2020, 10, 24, 18, 0, 0, tzinfo=BERLIN)
 
-    rdw = RelativeDateWrapper(RelativeDate(days=0, time=time(2, 30, 0), base_date_name='date_from', minutes=None))
-    assert rdw.to_string() == 'RELDATE/0/02:30:00/date_from/'
+    rdw = RelativeDateWrapper(RelativeDate(days=0, time=time(2, 30, 0), base_date_name='event__date_from', minutes=None))
+    assert rdw.to_string() == 'RELDATE/0/02:30:00/event__date_from/'
     assert rdw.datetime(event) == datetime(2020, 10, 25, 2, 30, 0, tzinfo=BERLIN)
 
 
-def test_unserialize():
+def test_unserialize_backwards_compatibility():
+    d = datetime(2017, 12, 25, 10, 0, 0, tzinfo=TOKYO)
+    rdw = RelativeDateWrapper.from_string(d.isoformat())
+    assert rdw.data == d
+
+    # keeping the test for the old from_string_format to ensure that we don't break anything
+    rdw = RelativeDateWrapper.from_string('RELDATE/1/-/date_from/')
+    assert rdw.data == RelativeDate(days=1, time=None, base_date_name='date_from', minutes=None)
+
+    # keeping the test for the old from_string_format to ensure that we don't break anything
+    rdw = RelativeDateWrapper.from_string('RELDATE/1/18:05:13/date_from/')
+    assert rdw.data == RelativeDate(days=1, time=time(18, 5, 13), base_date_name='date_from', minutes=None)
+
+    # keeping the test for the old from_string_format to ensure that we don't break anything
+    rdw = RelativeDateWrapper.from_string('RELDATE/minutes/60/date_from/')
+    assert rdw.data == RelativeDate(days=0, time=None, base_date_name='date_from', minutes=60)
+
+
+def test_backwards_compatibility():
+    # the data model of RelativeDate had to be extended to support other models as relation target
+    # previously only:
+    # - date_from
+    # - date_to
+    # - date_admission
+    # - presale_start
+    # - presale_end
+    # where valid values for the fourth slot (base_date_names) of the serialized form.
+    # the relationship in this case always pointed at event
+    # so any preexisting base_date_names without __ should continue to work and upgrade to event__{old_base_date_name}
     d = datetime(2017, 12, 25, 10, 0, 0, tzinfo=TOKYO)
     rdw = RelativeDateWrapper.from_string(d.isoformat())
     assert rdw.data == d
 
     rdw = RelativeDateWrapper.from_string('RELDATE/1/-/date_from/')
-    assert rdw.data == RelativeDate(days=1, time=None, base_date_name='date_from', minutes=None)
+    assert rdw.to_string() == 'RELDATE/1/-/event__date_from/'
 
-    rdw = RelativeDateWrapper.from_string('RELDATE/1/18:05:13/date_from/')
-    assert rdw.data == RelativeDate(days=1, time=time(18, 5, 13), base_date_name='date_from', minutes=None)
+    rdw = RelativeDateWrapper.from_string('RELDATE/1/-/date_to/')
+    assert rdw.to_string() == 'RELDATE/1/-/event__date_to/'
 
-    rdw = RelativeDateWrapper.from_string('RELDATE/minutes/60/date_from/')
-    assert rdw.data == RelativeDate(days=0, time=None, base_date_name='date_from', minutes=60)
+    rdw = RelativeDateWrapper.from_string('RELDATE/1/-/date_admission/')
+    assert rdw.to_string() == 'RELDATE/1/-/event__date_admission/'
+
+    rdw = RelativeDateWrapper.from_string('RELDATE/1/-/presale_start/')
+    assert rdw.to_string() == 'RELDATE/1/-/event__presale_start/'
+
+    rdw = RelativeDateWrapper.from_string('RELDATE/1/-/presale_end/')
+    assert rdw.to_string() == 'RELDATE/1/-/event__presale_end/'
+
+    # new order base_date_names should not work without __
+    with pytest.raises(TypeError):
+        RelativeDateWrapper.from_string('RELDATE/1/-/datetime/')
+    with pytest.raises(TypeError):
+        RelativeDateWrapper.from_string('RELDATE/1/-/expires/')
+
+
+@pytest.mark.django_db
+def test_relative_to_order(event):
+    with scope(organizer=event.organizer):
+        order_moment = datetime(2020, 3, 29, 18, 0, 0, tzinfo=TOKYO)
+
+        order = Order.objects.create(
+            code='FOO', event=event, email='dummy@dummy.test',
+            status=Order.STATUS_PENDING, secret="k24fiuwvu8kxz3y1",
+            datetime=order_moment,
+            expires=order_moment + timedelta(days=10),
+            sales_channel=event.organizer.sales_channels.get(identifier="web"),
+            total=23, locale='en'
+        )
+
+        rdw = RelativeDateWrapper(RelativeDate(days=1, time=None, base_date_name='order__datetime', minutes=None, is_after=True))
+        assert rdw.datetime(order).astimezone(TOKYO) == datetime(2020, 3, 30, 18, 0, 0, tzinfo=TOKYO)
+        assert rdw.to_string() == 'RELDATE/1/-/order__datetime/after'

src/tests/base/test_waitinglist.py

@@ -235,7 +235,7 @@ class WaitingListTestCase(TestCase):
         self.event.settings.set('waiting_list_enabled', True)
         self.event.settings.set('waiting_list_auto', True)
         self.event.settings.waiting_list_auto_disable = RelativeDateWrapper(
-            RelativeDate(days=0, time=None, base_date_name='date_from', minutes=20, is_after=False)
+            RelativeDate(days=0, time=None, base_date_name='event__date_from', minutes=20, is_after=False)
         )
         self.event.save()
         with scope(organizer=self.o):

src/tests/control/test_events.py

@@ -481,7 +481,7 @@ class EventsTest(SoupTest):
             'payment_term_last_0': 'absolute',
             'payment_term_last_1': (self.event1.presale_end - datetime.timedelta(1)).strftime('%Y-%m-%d'),
             'payment_term_last_2': '0',
-            'payment_term_last_3': 'date_from',
+            'payment_term_last_3': 'event__date_from',
             'tax_rule_payment': 'default',
         })
         assert doc.select('.alert-danger')
@@ -496,7 +496,7 @@ class EventsTest(SoupTest):
             'payment_term_last_0': 'relative',
             'payment_term_last_1': '',
             'payment_term_last_2': '10',
-            'payment_term_last_3': 'date_from',
+            'payment_term_last_3': 'event__date_from',
             'tax_rule_payment': 'default',
         })
         assert doc.select('.alert-danger')

src/tests/control/test_subevents.py

@@ -230,19 +230,19 @@ class SubEventsTest(SoupTest):
             'rel_presale_start_0': 'unset',
             'rel_presale_start_1': '',
             'rel_presale_start_2': '1',
-            'rel_presale_start_3': 'date_from',
+            'rel_presale_start_3': 'event__date_from',
             'rel_presale_start_4': '',
             'rel_presale_start_5': '',
-            'rel_presale_start_6': 'date_from',
+            'rel_presale_start_6': 'event__date_from',
             'rel_presale_start_7': 'before',
             'rel_presale_start_8': 'before',
             'rel_presale_end_1': '',
             'rel_presale_end_0': 'relative',
             'rel_presale_end_2': '1',
-            'rel_presale_end_3': 'date_from',
+            'rel_presale_end_3': 'event__date_from',
             'rel_presale_end_4': '13:29:31',
             'rel_presale_end_5': '',
-            'rel_presale_end_6': 'date_from',
+            'rel_presale_end_6': 'event__date_from',
             'rel_presale_end_7': 'before',
             'rel_presale_end_8': 'before',
             'quotas-TOTAL_FORMS': '1',
@@ -328,19 +328,19 @@ class SubEventsTest(SoupTest):
             'rel_presale_start_0': 'unset',
             'rel_presale_start_1': '',
             'rel_presale_start_2': '1',
-            'rel_presale_start_3': 'date_from',
+            'rel_presale_start_3': 'event__date_from',
             'rel_presale_start_4': '',
             'rel_presale_start_5': '',
-            'rel_presale_start_6': 'date_from',
+            'rel_presale_start_6': 'event__date_from',
             'rel_presale_start_7': 'before',
             'rel_presale_start_8': 'before',
             'rel_presale_end_1': '',
             'rel_presale_end_0': 'relative',
             'rel_presale_end_2': '1',
-            'rel_presale_end_3': 'date_from',
+            'rel_presale_end_3': 'event__date_from',
             'rel_presale_end_4': '13:29:31',
             'rel_presale_end_5': '',
-            'rel_presale_end_6': 'date_from',
+            'rel_presale_end_6': 'event__date_from',
             'rel_presale_end_7': 'before',
             'rel_presale_end_8': 'before',
             'quotas-TOTAL_FORMS': '1',
@@ -403,19 +403,19 @@ class SubEventsTest(SoupTest):
             'rel_presale_start_0': 'unset',
             'rel_presale_start_1': '',
             'rel_presale_start_2': '1',
-            'rel_presale_start_3': 'date_from',
+            'rel_presale_start_3': 'event__date_from',
             'rel_presale_start_4': '',
             'rel_presale_start_5': '',
-            'rel_presale_start_6': 'date_from',
+            'rel_presale_start_6': 'event__date_from',
             'rel_presale_start_7': 'before',
             'rel_presale_start_8': 'before',
             'rel_presale_end_1': '',
             'rel_presale_end_0': 'relative',
             'rel_presale_end_2': '1',
-            'rel_presale_end_3': 'date_from',
+            'rel_presale_end_3': 'event__date_from',
             'rel_presale_end_4': '13:29:31',
             'rel_presale_end_5': '',
-            'rel_presale_end_6': 'date_from',
+            'rel_presale_end_6': 'event__date_from',
             'rel_presale_end_7': 'before',
             'rel_presale_end_8': 'before',
             'quotas-TOTAL_FORMS': '1',
@@ -479,19 +479,19 @@ class SubEventsTest(SoupTest):
             'rel_presale_start_0': 'unset',
             'rel_presale_start_1': '',
             'rel_presale_start_2': '1',
-            'rel_presale_start_3': 'date_from',
+            'rel_presale_start_3': 'event__date_from',
             'rel_presale_start_4': '',
             'rel_presale_start_5': '',
-            'rel_presale_start_6': 'date_from',
+            'rel_presale_start_6': 'event__date_from',
             'rel_presale_start_7': 'before',
             'rel_presale_start_8': 'before',
             'rel_presale_end_1': '',
             'rel_presale_end_0': 'relative',
             'rel_presale_end_2': '1',
-            'rel_presale_end_3': 'date_from',
+            'rel_presale_end_3': 'event__date_from',
             'rel_presale_end_4': '02:30:00',
             'rel_presale_end_5': '',
-            'rel_presale_end_6': 'date_from',
+            'rel_presale_end_6': 'event__date_from',
             'rel_presale_end_7': 'before',
             'rel_presale_end_8': 'before',
             'quotas-TOTAL_FORMS': '1',
@@ -567,19 +567,19 @@ class SubEventsTest(SoupTest):
             'rel_presale_start_0': 'unset',
             'rel_presale_start_1': '',
             'rel_presale_start_2': '1',
-            'rel_presale_start_3': 'date_from',
+            'rel_presale_start_3': 'event__date_from',
             'rel_presale_start_4': '',
             'rel_presale_start_5': '',
-            'rel_presale_start_6': 'date_from',
+            'rel_presale_start_6': 'event__date_from',
             'rel_presale_start_7': 'before',
             'rel_presale_start_8': 'before',
             'rel_presale_end_1': '',
             'rel_presale_end_0': 'relative',
             'rel_presale_end_2': '1',
-            'rel_presale_end_3': 'date_from',
+            'rel_presale_end_3': 'event__date_from',
             'rel_presale_end_4': '13:29:31',
             'rel_presale_end_5': '',
-            'rel_presale_end_6': 'date_from',
+            'rel_presale_end_6': 'event__date_from',
             'rel_presale_end_7': 'before',
             'rel_presale_end_8': 'before',
             'quotas-TOTAL_FORMS': '1',
@@ -639,19 +639,19 @@ class SubEventsTest(SoupTest):
             'rel_presale_start_0': 'unset',
             'rel_presale_start_1': '',
             'rel_presale_start_2': '1',
-            'rel_presale_start_3': 'date_from',
+            'rel_presale_start_3': 'event__date_from',
             'rel_presale_start_4': '',
             'rel_presale_start_5': '',
-            'rel_presale_start_6': 'date_from',
+            'rel_presale_start_6': 'event__date_from',
             'rel_presale_start_7': 'before',
             'rel_presale_start_8': 'before',
             'rel_presale_end_0': 'unset',
             'rel_presale_end_1': '',
             'rel_presale_end_2': '1',
-            'rel_presale_end_3': 'date_from',
+            'rel_presale_end_3': 'event__date_from',
             'rel_presale_end_4': '13:29:31',
             'rel_presale_end_5': '',
-            'rel_presale_end_6': 'date_from',
+            'rel_presale_end_6': 'event__date_from',
             'rel_presale_end_7': 'before',
             'rel_presale_end_8': 'before',
             'quotas-TOTAL_FORMS': '1',
@@ -711,19 +711,19 @@ class SubEventsTest(SoupTest):
             'rel_presale_start_0': 'unset',
             'rel_presale_start_1': '',
             'rel_presale_start_2': '1',
-            'rel_presale_start_3': 'date_from',
+            'rel_presale_start_3': 'event__date_from',
             'rel_presale_start_4': '',
             'rel_presale_start_5': '',
-            'rel_presale_start_6': 'date_from',
+            'rel_presale_start_6': 'event__date_from',
             'rel_presale_start_7': 'before',
             'rel_presale_start_8': 'before',
             'rel_presale_end_0': 'unset',
             'rel_presale_end_1': '',
             'rel_presale_end_2': '1',
-            'rel_presale_end_3': 'date_from',
+            'rel_presale_end_3': 'event__date_from',
             'rel_presale_end_4': '13:29:31',
             'rel_presale_end_5': '',
-            'rel_presale_end_6': 'date_from',
+            'rel_presale_end_6': 'event__date_from',
             'rel_presale_end_7': 'before',
             'rel_presale_end_8': 'before',
             'quotas-TOTAL_FORMS': '1',

src/tests/control/test_views.py

@@ -224,3 +224,28 @@ def test_one_view(logged_in_client, url, expected, event, item, item_category, o
         )
     response = logged_in_client.get(url)
     assert response.status_code == expected
+
+    # Do not reintroduce any CSP nonces into control responses, as discussed in PR #6387
+    if response['Content-Type'] != 'application/json':
+        assert 'script-src' in response['Content-Security-Policy']
+        assert 'nonce-' not in response['Content-Security-Policy']
+
+
+@pytest.mark.parametrize('url', [
+    '/control/login',
+    '/',
+    '/{orga}/{event}/',
+])
+@pytest.mark.django_db
+def test_csp_header_unauthenticated(client, url, event):
+    # Do not reintroduce any CSP nonces into most presale responses, as discussed in PR #6387
+    with scope(organizer=event.organizer):
+        url = url.format(
+            event=event.slug, orga=event.organizer.slug,
+        )
+        event.live = True
+        event.save()
+    response = client.get(url)
+    assert response.status_code == 200
+    assert 'script-src' in response['Content-Security-Policy']
+    assert 'nonce-' not in response['Content-Security-Policy']

src/tests/plugins/paypal2/test_webhook.py

@@ -22,6 +22,7 @@
 import json
 from datetime import timedelta
 from decimal import Decimal
+from unittest.mock import MagicMock
 
 import pytest
 from django.utils.timezone import now
@@ -243,6 +244,61 @@ def get_test_refund():
     }
 
 
+def get_test_order_review_pending():
+    return {'id': '806440346Y391300T',
+            'intent': 'CAPTURE',
+            'status': 'COMPLETED',
+            'purchase_units': [{'reference_id': 'default',
+                                'amount': {'currency_code': 'EUR', 'value': '43.59'},
+                                'payee': {'email_address': 'dummy-facilitator@dummy.dummy',
+                                          'merchant_id': 'G6R2B9YXADKWW'},
+                                'description': 'Order JWJGC for PayPal v2',
+                                'custom_id': 'Order PAYPALV2-JWJGC',
+                                'soft_descriptor': 'MARTINFACIL',
+                                'payments': {'captures': [{'id': '22A4162004478570J',
+                                                           'status': 'PENDING',
+                                                           'status_details': {
+                                                               'reason': 'PENDING_REVIEW'
+                                                           },
+                                                           'amount': {'currency_code': 'EUR', 'value': '43.59'},
+                                                           'final_capture': True,
+                                                           'disbursement_mode': 'INSTANT',
+                                                           'seller_protection': {'status': 'ELIGIBLE',
+                                                                                 'dispute_categories': [
+                                                                                     'ITEM_NOT_RECEIVED',
+                                                                                     'UNAUTHORIZED_TRANSACTION']},
+                                                           'seller_receivable_breakdown': {
+                                                               'gross_amount': {'currency_code': 'EUR',
+                                                                                'value': '43.59'},
+                                                               'paypal_fee': {'currency_code': 'EUR', 'value': '1.18'},
+                                                               'net_amount': {'currency_code': 'EUR',
+                                                                              'value': '42.41'}},
+                                                           'custom_id': 'Order PAYPALV2-JWJGC',
+                                                           'links': [{
+                                                               'href': 'https://api.sandbox.paypal.com/v2/payments/captures/22A4162004478570J',
+                                                               'rel': 'self',
+                                                               'method': 'GET'},
+                                                               {
+                                                                   'href': 'https://api.sandbox.paypal.com/v2/payments/captures/22A4162004478570J/refund',
+                                                                   'rel': 'refund',
+                                                                   'method': 'POST'},
+                                                               {
+                                                                   'href': 'https://api.sandbox.paypal.com/v2/checkout/orders/806440346Y391300T',
+                                                                   'rel': 'up',
+                                                                   'method': 'GET'}],
+                                                           'create_time': '2022-04-28T12:00:22Z',
+                                                           'update_time': '2022-04-28T12:00:22Z'}]}}],
+            'payer': {'name': {'given_name': 'test', 'surname': 'buyer'},
+                      'email_address': 'dummy@dummy.dummy',
+                      'payer_id': 'Q739JNKWH67HE',
+                      'address': {'country_code': 'DE'}},
+            'create_time': '2022-04-28T11:59:59Z',
+            'update_time': '2022-04-28T12:00:22Z',
+            'links': [{'href': 'https://api.sandbox.paypal.com/v2/checkout/orders/806440346Y391300T',
+                       'rel': 'self',
+                       'method': 'GET'}]}
+
+
 class Object():
     pass
 
@@ -409,7 +465,8 @@ def test_webhook_mark_paid(env, client, monkeypatch):
         order.payments.update(state=OrderPayment.PAYMENT_STATE_PENDING)
 
     pp_order = Result(get_test_order())
-    monkeypatch.setattr("paypalcheckoutsdk.orders.OrdersGetRequest", lambda *args: pp_order)
+    mock_orders_get_request = MagicMock(return_value=pp_order)
+    monkeypatch.setattr("paypalcheckoutsdk.orders.OrdersGetRequest", mock_orders_get_request)
     monkeypatch.setattr("pretix.plugins.paypal2.payment.PaypalMethod.init_api", init_api)
     with scopes_disabled():
         ReferencedPayPalObject.objects.create(order=order, payment=order.payments.first(),
@@ -497,7 +554,7 @@ def test_webhook_mark_paid(env, client, monkeypatch):
             "resource_version": "2.0"
         }
     ), content_type='application_json')
-
+    mock_orders_get_request.assert_called_once_with('806440346Y391300T')
     order.refresh_from_db()
     assert order.status == Order.STATUS_PAID
 
@@ -688,3 +745,95 @@ def test_webhook_refund2(env, client, monkeypatch):
         assert r.payment == order.payments.first()
         assert r.state == OrderRefund.REFUND_STATE_EXTERNAL
         assert r.source == OrderRefund.REFUND_SOURCE_EXTERNAL
+
+
+@pytest.mark.django_db
+def test_webhook_pending_payment(env, client, monkeypatch):
+    order = env[1]
+    order.status = Order.STATUS_PENDING
+    order.save()
+    with scopes_disabled():
+        order.payments.update(state=OrderPayment.PAYMENT_STATE_CREATED)
+
+    pp_order = Result(get_test_order_review_pending())
+    mock_orders_get_request = MagicMock(return_value=pp_order)
+    monkeypatch.setattr("paypalcheckoutsdk.orders.OrdersGetRequest", mock_orders_get_request)
+    monkeypatch.setattr("pretix.plugins.paypal2.payment.PaypalMethod.init_api", init_api)
+    with scopes_disabled():
+        ReferencedPayPalObject.objects.create(order=order, payment=order.payments.first(),
+                                              reference="806440346Y391300T")
+
+        assert order.payments.first().state == OrderPayment.PAYMENT_STATE_CREATED
+
+    client.post('/_paypal/webhook/', json.dumps(
+        {
+            "id": "WH-0AH02875JL566842H-2AF03788XV8252724",
+            "create_time": "2022-04-28T12:00:37.077Z",
+            "resource_type": "capture",
+            "event_type": "PAYMENT.CAPTURE.PENDING",
+            "summary": "Payment pending for € 43.59 EUR",
+            "resource": {
+                "update_time": "2022-04-28T12:00:22Z",
+                "create_time": "2022-04-28T11:59:59Z",
+                "amount": {
+                    "currency_code": "EUR",
+                    "value": "43.59"
+                },
+                "custom_id": "Order PAYPALV2-JWJGC",
+                "final_capture": True,
+                "id": "22A4162004478570J",
+                "links": [
+                    {
+                        "href": "https://api.sandbox.paypal.com/v2/payments/captures/5M631111V9599860P",
+                        "method": "GET",
+                        "rel": "self"
+                    },
+                    {
+                        "href": "https://api.sandbox.paypal.com/v2/payments/captures/5M631111V9599860P/refund",
+                        "method": "POST",
+                        "rel": "refund"
+                    },
+                    {
+                        "href": "https://api.sandbox.paypal.com/v2/checkout/orders/806440346Y391300T",
+                        "method": "GET",
+                        "rel": "up"
+                    }
+                ],
+                "payee": {
+                    "email_address": "sb-ybfun52428692@business.example.com",
+                    "merchant_id": "DLM8QKDR3CFZW"
+                },
+                "seller_protection": {
+                    "status": "NOT_ELIGIBLE"
+                },
+                "status": "PENDING",
+                "status_details": {
+                    "reason": "PENDING_REVIEW"
+                },
+                "supplementary_data": {
+                    "related_ids": {
+                        "order_id": "9L827155WD164573M"
+                    }
+                }
+            },
+            "links": [
+                {
+                    "href": "https://api.sandbox.paypal.com/v1/notifications/webhooks-events/WH-0AH02875JL566842H-2AF03788XV8252724",
+                    "method": "GET",
+                    "rel": "self"
+                },
+                {
+                    "href": "https://api.sandbox.paypal.com/v1/notifications/webhooks-events/WH-0AH02875JL566842H-2AF03788XV8252724/resend",
+                    "method": "POST",
+                    "rel": "resend"
+                }
+            ],
+            "event_version": "1.0",
+            "resource_version": "2.0"
+        }
+    ), content_type='application_json')
+
+    order = env[1]
+    order.refresh_from_db()
+    with scopes_disabled():
+        assert order.payments.first().state == OrderPayment.PAYMENT_STATE_PENDING

src/tests/presale/test_cart.py

@@ -697,6 +697,42 @@ class CartTest(CartTestMixin, TestCase):
         self.assertIsNone(objs[0].variation)
         self.assertEqual(objs[0].price, 23)
 
+    def test_free_price_rounding(self):
+        self.ticket.free_price = True
+        self.ticket.save()
+
+        response = self.client.post('/%s/%s/cart/add' % (self.orga.slug, self.event.slug), {
+            'item_%d' % self.ticket.id: '1',
+            'price_%d' % self.ticket.id: '40.1234',
+        }, follow=True)
+        self.assertRedirects(response, '/%s/%s/?require_cookie=true' % (self.orga.slug, self.event.slug),
+                             target_status_code=200)
+
+        with scopes_disabled():
+            cr1 = CartPosition.objects.get()
+            assert cr1.listed_price == Decimal('23.00')
+            assert cr1.custom_price_input == Decimal('40.12')
+            assert cr1.price == Decimal('40.12')
+
+    def test_free_price_rounding_jpy(self):
+        self.event.currency = "JPY"
+        self.event.save()
+        self.ticket.free_price = True
+        self.ticket.save()
+
+        response = self.client.post('/%s/%s/cart/add' % (self.orga.slug, self.event.slug), {
+            'item_%d' % self.ticket.id: '1',
+            'price_%d' % self.ticket.id: '40.1234',
+        }, follow=True)
+        self.assertRedirects(response, '/%s/%s/?require_cookie=true' % (self.orga.slug, self.event.slug),
+                             target_status_code=200)
+
+        with scopes_disabled():
+            cr1 = CartPosition.objects.get()
+            assert cr1.listed_price == Decimal('23.00')
+            assert cr1.custom_price_input == Decimal('40.00')
+            assert cr1.price == Decimal('40.00')
+
     def test_variation_inactive(self):
         self.shirt_red.active = False
         self.shirt_red.save()
@@ -3060,6 +3096,31 @@ class CartAddonTest(CartTestMixin, TestCase):
         assert cp1.addons.count() == 3
         assert all(a.price == Decimal('12.00') for a in cp1.addons.all())
 
+    @classscope(attr='orga')
+    def test_free_price_rounding(self):
+        self.event.settings.locales = ['de']
+        self.event.settings.locale = 'de'
+        self.event.currency = "JPY"
+        self.event.save()
+
+        self.workshop1.free_price = True
+        self.workshop1.save()
+        cp1 = CartPosition.objects.create(
+            event=self.event, cart_id=self.session_key, item=self.ticket,
+            price=23, expires=now() - timedelta(minutes=10)
+        )
+
+        response = self.client.post('/%s/%s/checkout/addons/' % (self.orga.slug, self.event.slug), {
+            'cp_{}_item_{}'.format(cp1.pk, self.workshop1.pk): '1',
+            'cp_{}_item_{}_price'.format(cp1.pk, self.workshop1.pk): '99,99',
+        }, follow=True)
+        self.assertRedirects(response, '/%s/%s/checkout/questions/' % (self.orga.slug, self.event.slug),
+                             target_status_code=200)
+        with scopes_disabled():
+            assert cp1.addons.count() == 1
+            assert cp1.addons.first().item == self.workshop1
+            assert cp1.addons.first().price == Decimal('100')
+
     @classscope(attr='orga')
     def test_change_number(self):
         cp1 = CartPosition.objects.create(

src/tests/presale/test_event.py

@@ -1132,7 +1132,7 @@ class WaitingListTest(EventTestMixin, SoupTest):
     def test_auto_disable(self):
         self.event.settings.set('waiting_list_enabled', True)
         self.event.settings.waiting_list_auto_disable = RelativeDateWrapper(
-            RelativeDate(days=900, time=datetime.time(9, 0, 0), base_date_name='date_from', minutes=None, is_after=False)
+            RelativeDate(days=900, time=datetime.time(9, 0, 0), base_date_name='event__date_from', minutes=None, is_after=False)
         )
         response = self.client.get(
             '/%s/%s/' % (self.orga.slug, self.event.slug)