Update src/pretix/presale/templates/pretixpresale/event/fragment_addon_choice.html

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

src/pretix/__init__.py

@@ -19,4 +19,4 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-__version__ = "2026.1.2"
+__version__ = "2026.2.0.dev0"

src/pretix/api/views/checkin.py

@@ -1117,7 +1117,7 @@ class CheckinViewSet(viewsets.ReadOnlyModelViewSet):
     permission = 'can_view_orders'
 
     def get_queryset(self):
-        qs = Checkin.all.filter(list__event=self.request.event).select_related(
+        qs = Checkin.all.filter().select_related(
             "position",
             "device",
         )

src/pretix/base/email.py

@@ -39,7 +39,7 @@ from pretix.base.templatetags.rich_text import (
     DEFAULT_CALLBACKS, EMAIL_RE, URL_RE, abslink_callback,
     markdown_compile_email, truelink_callback,
 )
-from pretix.helpers.format import FormattedString, SafeFormatter, format_map
+from pretix.helpers.format import SafeFormatter, format_map
 
 from pretix.base.services.placeholders import (  # noqa
     get_available_placeholders, PlaceholderContext
@@ -141,7 +141,6 @@ class TemplateBasedMailRenderer(BaseHTMLMailRenderer):
         return markdown_compile_email(plaintext, context=context)
 
     def render(self, plain_body: str, plain_signature: str, subject: str, order, position, context) -> str:
-        apply_format_map = not isinstance(plain_body, FormattedString)
         body_md = self.compile_markdown(plain_body, context)
         if context:
             linker = bleach.Linker(
@@ -150,13 +149,12 @@ class TemplateBasedMailRenderer(BaseHTMLMailRenderer):
                 callbacks=DEFAULT_CALLBACKS + [truelink_callback, abslink_callback],
                 parse_email=True
             )
-            if apply_format_map:
-                body_md = format_map(
-                    body_md,
-                    context=context,
-                    mode=SafeFormatter.MODE_RICH_TO_HTML,
-                    linkifier=linker
-                )
+            body_md = format_map(
+                body_md,
+                context=context,
+                mode=SafeFormatter.MODE_RICH_TO_HTML,
+                linkifier=linker
+            )
         htmlctx = {
             'site': settings.PRETIX_INSTANCE_NAME,
             'site_url': settings.SITE_URL,

src/pretix/base/models/orders.py

@@ -87,7 +87,7 @@ from pretix.base.timemachine import time_machine_now
 
 from ...helpers import OF_SELF
 from ...helpers.countries import CachedCountries, FastCountryField
-from ...helpers.format import FormattedString, format_map
+from ...helpers.format import format_map
 from ...helpers.names import build_name
 from ...testutils.middleware import debugflags_var
 from ._transactions import (
@@ -1181,8 +1181,7 @@ class Order(LockModel, LoggedModel):
 
             try:
                 email_content = render_mail(template, context)
-                if not isinstance(subject, FormattedString):
-                    subject = format_map(subject, context)
+                subject = format_map(subject, context)
                 mail(
                     recipient, subject, template, context,
                     self.event, self.locale, self, headers=headers, sender=sender,
@@ -2927,8 +2926,7 @@ class OrderPosition(AbstractPosition):
             recipient = self.attendee_email
             try:
                 email_content = render_mail(template, context)
-                if not isinstance(subject, FormattedString):
-                    subject = format_map(subject, context)
+                subject = format_map(subject, context)
                 mail(
                     recipient, subject, template, context,
                     self.event, self.order.locale, order=self.order, headers=headers, sender=sender,

src/pretix/base/services/mail.py

@@ -75,9 +75,7 @@ from pretix.base.services.tasks import TransactionAwareTask
 from pretix.base.services.tickets import get_tickets_for_order
 from pretix.base.signals import email_filter, global_email_filter
 from pretix.celery_app import app
-from pretix.helpers.format import (
-    FormattedString, PlainHtmlAlternativeString, SafeFormatter, format_map,
-)
+from pretix.helpers.format import SafeFormatter, format_map
 from pretix.helpers.hierarkey import clean_filename
 from pretix.multidomain.urlreverse import build_absolute_uri
 from pretix.presale.ical import get_private_icals
@@ -201,9 +199,6 @@ def mail(email: Union[str, Sequence[str]], subject: str, template: Union[str, La
     if email == INVALID_ADDRESS:
         return
 
-    if isinstance(template, FormattedString):
-        raise TypeError("Cannot pass an already formatted body template")
-
     if no_order_links and not plain_text_only:
         raise ValueError('If you set no_order_links, you also need to set plain_text_only.')
 
@@ -226,9 +221,8 @@ def mail(email: Union[str, Sequence[str]], subject: str, template: Union[str, La
                     'invoice_company': ''
                 })
         renderer = ClassicMailRenderer(None, organizer)
-        content_plain = render_mail(template, context, placeholder_mode=None)
-        if not isinstance(subject, FormattedString):
-            subject = format_map(subject, context)
+        body_plain = render_mail(template, context, placeholder_mode=SafeFormatter.MODE_RICH_TO_PLAIN)
+        subject = str(subject).format_map(TolerantDict(context))
         sender = (
             sender or
             (event.settings.get('mail_from') if event else None) or
@@ -260,10 +254,6 @@ def mail(email: Union[str, Sequence[str]], subject: str, template: Union[str, La
         else:
             timezone = ZoneInfo(settings.TIME_ZONE)
 
-        if not isinstance(content_plain, FormattedString):
-            body_plain = format_map(content_plain, context, mode=SafeFormatter.MODE_RICH_TO_PLAIN)
-        else:
-            body_plain = content_plain
         if settings_holder:
             if settings_holder.settings.mail_bcc:
                 for bcc_mail in settings_holder.settings.mail_bcc.split(','):
@@ -279,7 +269,7 @@ def mail(email: Union[str, Sequence[str]], subject: str, template: Union[str, La
 
             signature = str(settings_holder.settings.get('mail_text_signature'))
             if signature:
-                signature = format_map(signature, {"event": event.name if event else ''})
+                signature = signature.format(event=event.name if event else '')
                 body_plain += signature
                 body_plain += "\r\n\r\n-- \r\n"
 
@@ -297,7 +287,7 @@ def mail(email: Union[str, Sequence[str]], subject: str, template: Union[str, La
                 body_plain += _(
                     "You can view your order details at the following URL:\n{orderurl}."
                 ).replace("\n", "\r\n").format(
-                    orderurl=build_absolute_uri(
+                    event=event.name, orderurl=build_absolute_uri(
                         order.event, 'presale:event.order.position', kwargs={
                             'order': order.code,
                             'secret': position.web_secret,
@@ -313,7 +303,7 @@ def mail(email: Union[str, Sequence[str]], subject: str, template: Union[str, La
                 body_plain += _(
                     "You can view your order details at the following URL:\n{orderurl}."
                 ).replace("\n", "\r\n").format(
-                    orderurl=build_absolute_uri(
+                    event=event.name, orderurl=build_absolute_uri(
                         order.event, 'presale:event.order.open', kwargs={
                             'order': order.code,
                             'secret': order.secret,
@@ -325,6 +315,7 @@ def mail(email: Union[str, Sequence[str]], subject: str, template: Union[str, La
 
         with override(timezone):
             try:
+                content_plain = render_mail(template, context, placeholder_mode=None)
                 if plain_text_only:
                     body_html = None
                 elif 'context' in inspect.signature(renderer.render).parameters:
@@ -345,6 +336,8 @@ def mail(email: Union[str, Sequence[str]], subject: str, template: Union[str, La
                 logger.exception('Could not render HTML body')
                 body_html = None
 
+        body_plain = format_map(body_plain, context, mode=SafeFormatter.MODE_RICH_TO_PLAIN)
+
         send_task = mail_send_task.si(
             to=[email] if isinstance(email, str) else list(email),
             cc=cc,
@@ -765,12 +758,7 @@ def render_mail(template, context, placeholder_mode=SafeFormatter.MODE_RICH_TO_P
             body = format_map(body, context, mode=placeholder_mode)
     else:
         tpl = get_template(template)
-        context = {
-            # Known bug, should behave differently for plain and HTML but we'll fix after security release
-            k: v.html if isinstance(v, PlainHtmlAlternativeString) else v
-            for k, v in context.items()
-        }
-        body = FormattedString(tpl.render(context))
+        body = tpl.render(context)
     return body
 
 

src/pretix/base/services/orders.py

@@ -2094,6 +2094,43 @@ class OrderChangeManager:
                     )
                     item_counts[item] += 1
 
+        # Detect removed add-ons and create RemoveOperations
+        for cp, al in list(current_addons.items()):
+            for k, v in al.items():
+                input_num = input_addons[cp.id].get(k, 0)
+                current_num = len(current_addons[cp].get(k, []))
+                if input_num < current_num:
+                    for a in current_addons[cp][k][:current_num - input_num]:
+                        if a.canceled:
+                            continue
+                        is_unavailable = (
+                            # If an item is no longer available due to time, it should usually also be no longer
+                            # user-removable, because e.g. the stock has already been ordered.
+                            # We always pass has_voucher=True because if a product now requires a voucher, it usually does
+                            # not mean it should be unremovable for others.
+                            # This also prevents accidental removal through the UI because a hidden product will no longer
+                            # be part of the input.
+                            (a.variation and a.variation.unavailability_reason(has_voucher=True, subevent=a.subevent))
+                            or (a.variation and not a.variation.all_sales_channels and not a.variation.limit_sales_channels.contains(self.order.sales_channel))
+                            or a.item.unavailability_reason(has_voucher=True, subevent=a.subevent)
+                            or (
+                                not a.item.all_sales_channels and
+                                not a.item.limit_sales_channels.contains(self.order.sales_channel)
+                            )
+                        )
+                        if is_unavailable:
+                            # "Re-select" add-on
+                            selected_addons[cp.id, a.item.category_id][a.item_id, a.variation_id] += 1
+                            continue
+                        if a.checkins.filter(list__consider_tickets_used=True).exists():
+                            raise OrderError(
+                                error_messages['addon_already_checked_in'] % {
+                                    'addon': str(a.item.name),
+                                }
+                            )
+                        self.cancel(a)
+                        item_counts[a.item] -= 1
+
         # Check constraints on the add-on combinations
         for op in toplevel_op:
             item = op.item
@@ -2126,41 +2163,6 @@ class OrderChangeManager:
                         }
                     )
 
-        # Detect removed add-ons and create RemoveOperations
-        for cp, al in list(current_addons.items()):
-            for k, v in al.items():
-                input_num = input_addons[cp.id].get(k, 0)
-                current_num = len(current_addons[cp].get(k, []))
-                if input_num < current_num:
-                    for a in current_addons[cp][k][:current_num - input_num]:
-                        if a.canceled:
-                            continue
-                        is_unavailable = (
-                            # If an item is no longer available due to time, it should usually also be no longer
-                            # user-removable, because e.g. the stock has already been ordered.
-                            # We always pass has_voucher=True because if a product now requires a voucher, it usually does
-                            # not mean it should be unremovable for others.
-                            # This also prevents accidental removal through the UI because a hidden product will no longer
-                            # be part of the input.
-                            (a.variation and a.variation.unavailability_reason(has_voucher=True, subevent=a.subevent))
-                            or (a.variation and not a.variation.all_sales_channels and not a.variation.limit_sales_channels.contains(self.order.sales_channel))
-                            or a.item.unavailability_reason(has_voucher=True, subevent=a.subevent)
-                            or (
-                                not item.all_sales_channels and
-                                not item.limit_sales_channels.contains(self.order.sales_channel)
-                            )
-                        )
-                        if is_unavailable:
-                            continue
-                        if a.checkins.filter(list__consider_tickets_used=True).exists():
-                            raise OrderError(
-                                error_messages['addon_already_checked_in'] % {
-                                    'addon': str(a.item.name),
-                                }
-                            )
-                        self.cancel(a)
-                        item_counts[a.item] -= 1
-
         for item, count in item_counts.items():
             if count == 0:
                 continue

src/pretix/helpers/format.py

@@ -22,7 +22,6 @@
 import logging
 from string import Formatter
 
-from django.core.exceptions import SuspiciousOperation
 from django.utils.html import conditional_escape
 
 logger = logging.getLogger(__name__)
@@ -38,17 +37,6 @@ class PlainHtmlAlternativeString:
         return f"PlainHtmlAlternativeString('{self.plain}', '{self.html}')"
 
 
-class FormattedString(str):
-    """
-    A str subclass that has been specifically marked as "already formatted" for email rendering
-    purposes to avoid duplicate formatting.
-    """
-    __slots__ = ()
-
-    def __str__(self):
-        return self
-
-
 class SafeFormatter(Formatter):
     """
     Customized version of ``str.format`` that (a) behaves just like ``str.format_map`` and
@@ -89,19 +77,8 @@ class SafeFormatter(Formatter):
         # Ignore format_spec
         return super().format_field(self._prepare_value(value), '')
 
-    def convert_field(self, value, conversion):
-        # Ignore any conversions
-        if conversion is None:
-            return value
-        else:
-            return str(value)
 
-
-def format_map(template, context, raise_on_missing=False, mode=SafeFormatter.MODE_RICH_TO_PLAIN, linkifier=None) -> FormattedString:
-    if isinstance(template, FormattedString):
-        raise SuspiciousOperation("Calling format_map() on an already formatted string is likely unsafe.")
+def format_map(template, context, raise_on_missing=False, mode=SafeFormatter.MODE_RICH_TO_PLAIN, linkifier=None):
     if not isinstance(template, str):
         template = str(template)
-    return FormattedString(
-        SafeFormatter(context, raise_on_missing, mode=mode, linkifier=linkifier).format(template)
-    )
+    return SafeFormatter(context, raise_on_missing, mode=mode, linkifier=linkifier).format(template)

src/pretix/presale/templates/pretixpresale/event/fragment_addon_choice.html

@@ -372,6 +372,19 @@
                 </article>
             {% endif %}
         {% endfor %}
+
+        {% if c.items_missing %}
+            <div class="product-appendix-row">
+                <p class="text-muted">
+                    {% trans "There are products selected in this add-on category that currently cannot be changed because they are not on sale:" %}
+                </p>
+                <ul class="text-muted">
+                    {% for itemvar, count in c.items_missing.items %}
+                        <li>{{ count }}x {{ itemvar.0 }}{% if itemvar.1 %} – {{ itemvar.1 }}{% endif %}</li>
+                    {% endfor %}
+                </ul>
+            </div>
+        {% endif %}
     </fieldset>
     {% endwith %}
 {% empty %}

src/pretix/presale/views/order.py

@@ -40,7 +40,7 @@ import logging
 import mimetypes
 import os
 import re
-from collections import OrderedDict, defaultdict
+from collections import Counter, OrderedDict, defaultdict
 from decimal import Decimal
 from urllib.parse import quote
 
@@ -1431,11 +1431,13 @@ class OrderChangeMixin:
                     'categories': []
                 }
                 current_addon_products = defaultdict(list)
+                current_addon_products_missing = Counter()
                 for a in p.addons.all():
                     if a.canceled:
                         continue
                     if not a.is_bundled:
                         current_addon_products[a.item_id, a.variation_id].append(a)
+                        current_addon_products_missing[a.item, a.variation] += 1
 
                 for iao in p.item.addons.all():
                     ckey = '{}-{}'.format(p.subevent.pk if p.subevent else 0, iao.addon_category.pk)
@@ -1473,6 +1475,7 @@ class OrderChangeMixin:
                         if i.has_variations:
                             for v in i.available_variations:
                                 v.initial = len(current_addon_products[i.pk, v.pk])
+                                current_addon_products_missing[i, v] = 0
                                 if v.initial and i.free_price:
                                     a = current_addon_products[i.pk, v.pk][0]
                                     v.initial_price = TaxedPrice(
@@ -1488,6 +1491,7 @@ class OrderChangeMixin:
                             i.expand = any(v.initial for v in i.available_variations)
                         else:
                             i.initial = len(current_addon_products[i.pk, None])
+                            current_addon_products_missing[i, None] = 0
                             if i.initial and i.free_price:
                                 a = current_addon_products[i.pk, None][0]
                                 i.initial_price = TaxedPrice(
@@ -1509,7 +1513,8 @@ class OrderChangeMixin:
                             'min_count': iao.min_count,
                             'max_count': iao.max_count,
                             'iao': iao,
-                            'items': [i for i in items if not i.require_voucher]
+                            'items': [i for i in items if not i.require_voucher],
+                            'items_missing': {k: v for k, v in current_addon_products_missing.items() if v},
                         })
 
         return positions

src/pretix/static/pretixpresale/scss/_event.scss

@@ -99,6 +99,15 @@
     }
 }
 
+.product-appendix-row {
+    border-top: 1px solid $table-border-color;
+    border-bottom: 1px solid $table-border-color;
+    padding: 1.25*$line-height-computed 0;
+    & > :last-child {
+        margin-bottom: 0;
+    }
+}
+
 article.item-with-variations {
     margin: 0 -15px;
     padding: 0 15px;

src/tests/base/test_mail.py

@@ -32,23 +32,20 @@
 # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 # License for the specific language governing permissions and limitations under the License.
 
-import datetime
 import os
 import re
-from decimal import Decimal
 from email.mime.text import MIMEText
 
 import pytest
 from django.conf import settings
 from django.core import mail as djmail
-from django.utils.html import escape
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
-from django_scopes import scope, scopes_disabled
+from django_scopes import scope
 from i18nfield.strings import LazyI18nString
 
 from pretix.base.email import get_email_context
-from pretix.base.models import Event, InvoiceAddress, Order, Organizer, User
+from pretix.base.models import Event, Organizer, User
 from pretix.base.services.mail import mail
 
 
@@ -70,45 +67,6 @@ def env():
         yield event, user, o
 
 
-@pytest.fixture
-@scopes_disabled()
-def item(env):
-    return env[0].items.create(name="Budget Ticket", default_price=23)
-
-
-@pytest.fixture
-@scopes_disabled()
-def order(env, item):
-    event, _, _ = env
-    o = Order.objects.create(
-        code="FOO",
-        event=event,
-        email="dummy@dummy.test",
-        status=Order.STATUS_PENDING,
-        secret="k24fiuwvu8kxz3y1",
-        sales_channel=event.organizer.sales_channels.get(identifier="web"),
-        datetime=datetime.datetime(2017, 12, 1, 10, 0, 0, tzinfo=datetime.UTC),
-        expires=datetime.datetime(2017, 12, 10, 10, 0, 0, tzinfo=datetime.UTC),
-        total=23,
-        locale="en",
-    )
-    o.positions.create(
-        order=o,
-        item=item,
-        variation=None,
-        price=Decimal("23"),
-        attendee_email="peter@example.org",
-        attendee_name_parts={"given_name": "Peter", "family_name": "Miller"},
-        secret="z3fsn8jyufm5kpk768q69gkbyr5f4h6w",
-        pseudonymization_id="ABCDEFGHKL",
-    )
-    InvoiceAddress.objects.create(
-        order=o,
-        name_parts={"given_name": "Peter", "family_name": "Miller"},
-    )
-    return o
-
-
 @pytest.mark.django_db
 def test_send_mail_with_prefix(env):
     djmail.outbox = []
@@ -230,7 +188,7 @@ def _extract_html(mail):
 def test_placeholder_html_rendering_from_template(env):
     djmail.outbox = []
     event, user, organizer = env
-    event.name = "<strong>event & co. kg</strong> {currency}"
+    event.name = "<strong>event & co. kg</strong>"
     event.save()
     mail('dummy@dummy.dummy', '{event} Test subject', 'mailtest.txt', get_email_context(
         event=event,
@@ -239,26 +197,25 @@ def test_placeholder_html_rendering_from_template(env):
 
     assert len(djmail.outbox) == 1
     assert djmail.outbox[0].to == [user.email]
-    # Known bug for now: These should not have HTML for the plain body, but we'll fix this safter the security release
-    assert escape('Event name: <strong>event & co. kg</strong> {currency}') in djmail.outbox[0].body
-    assert '<strong>IBAN</strong>: 123<br>\n<strong>BIC</strong>: 456' in djmail.outbox[0].body
-    assert '**Meta**: <em>Beep</em>' in djmail.outbox[0].body
-    assert escape('Event website: [<strong>event & co. kg</strong> {currency}](https://example.org/dummy)') in djmail.outbox[0].body
-    # todo: assert '&lt;' not in djmail.outbox[0].body
-    # todo: assert '&amp;' not in djmail.outbox[0].body
-    assert 'Unevaluated placeholder: {currency}' in djmail.outbox[0].body
-    assert 'EUR' not in djmail.outbox[0].body
+    assert 'Event name: <strong>event & co. kg</strong>' in djmail.outbox[0].body
+    assert '**IBAN**: 123  \n**BIC**: 456' in djmail.outbox[0].body
+    assert '**Meta**: *Beep*' in djmail.outbox[0].body
+    assert 'Event website: [<strong>event & co. kg</strong>](https://example.org/dummy)' in djmail.outbox[0].body
+    assert 'Other website: [<strong>event & co. kg</strong>](https://example.com)' in djmail.outbox[0].body
+    assert '&lt;' not in djmail.outbox[0].body
+    assert '&amp;' not in djmail.outbox[0].body
     html = _extract_html(djmail.outbox[0])
 
     assert '<strong>event' not in html
-    assert 'Event name: &lt;strong&gt;event &amp; co. kg&lt;/strong&gt; {currency}' in html
+    assert 'Event name: &lt;strong&gt;event &amp; co. kg&lt;/strong&gt;' in html
     assert '<strong>IBAN</strong>: 123<br/>\n<strong>BIC</strong>: 456' in html
     assert '<strong>Meta</strong>: <em>Beep</em>' in html
-    assert 'Unevaluated placeholder: {currency}' in html
-    assert 'EUR' not in html
     assert re.search(
-        r'Event website: <a href="https://example.org/dummy" rel="noopener" style="[^"]+" target="_blank">'
-        r'&lt;strong&gt;event &amp; co. kg&lt;/strong&gt; {currency}</a>',
+        r'Event website: <a href="https://example.org/dummy" rel="noopener" style="[^"]+" target="_blank">&lt;strong&gt;event &amp; co. kg&lt;/strong&gt;</a>',
+        html
+    )
+    assert re.search(
+        r'Other website: <a href="https://example.com" rel="noopener" style="[^"]+" target="_blank">&lt;strong&gt;event &amp; co. kg&lt;/strong&gt;</a>',
         html
     )
 
@@ -276,7 +233,7 @@ def test_placeholder_html_rendering_from_string(env):
     })
     djmail.outbox = []
     event, user, organizer = env
-    event.name = "<strong>event & co. kg</strong> {currency}"
+    event.name = "<strong>event & co. kg</strong>"
     event.save()
     ctx = get_email_context(
         event=event,
@@ -287,9 +244,9 @@ def test_placeholder_html_rendering_from_string(env):
 
     assert len(djmail.outbox) == 1
     assert djmail.outbox[0].to == [user.email]
-    assert 'Event name: <strong>event & co. kg</strong> {currency}' in djmail.outbox[0].body
-    assert 'Event website: [<strong>event & co. kg</strong> {currency}](https://example.org/dummy)' in djmail.outbox[0].body
-    assert 'Other website: [<strong>event & co. kg</strong> {currency}](https://example.com)' in djmail.outbox[0].body
+    assert 'Event name: <strong>event & co. kg</strong>' in djmail.outbox[0].body
+    assert 'Event website: [<strong>event & co. kg</strong>](https://example.org/dummy)' in djmail.outbox[0].body
+    assert 'Other website: [<strong>event & co. kg</strong>](https://example.com)' in djmail.outbox[0].body
     assert '**IBAN**: 123  \n**BIC**: 456' in djmail.outbox[0].body
     assert '**Meta**: *Beep*' in djmail.outbox[0].body
     assert 'URL: https://google.com' in djmail.outbox[0].body
@@ -304,13 +261,11 @@ def test_placeholder_html_rendering_from_string(env):
     assert '<strong>IBAN</strong>: 123<br/>\n<strong>BIC</strong>: 456' in html
     assert '<strong>Meta</strong>: <em>Beep</em>' in html
     assert re.search(
-        r'Event website: <a href="https://example.org/dummy" rel="noopener" style="[^"]+" target="_blank">'
-        r'&lt;strong&gt;event &amp; co. kg&lt;/strong&gt; {currency}</a>',
+        r'Event website: <a href="https://example.org/dummy" rel="noopener" style="[^"]+" target="_blank">&lt;strong&gt;event &amp; co. kg&lt;/strong&gt;</a>',
         html
     )
     assert re.search(
-        r'Other website: <a href="https://example.com" rel="noopener" style="[^"]+" target="_blank">'
-        r'&lt;strong&gt;event &amp; co. kg&lt;/strong&gt; {currency}</a>',
+        r'Other website: <a href="https://example.com" rel="noopener" style="[^"]+" target="_blank">&lt;strong&gt;event &amp; co. kg&lt;/strong&gt;</a>',
         html
     )
     assert re.search(
@@ -331,141 +286,3 @@ def test_placeholder_html_rendering_from_string(env):
         r'style="[^"]+" target="_blank">Link &amp; Text</a>',
         html
     )
-
-
-@pytest.mark.django_db
-def test_nested_placeholder_inclusion_full_process(env, order):
-    # Test that it is not possible to sneak in a placeholder like {url_cancel} inside a user-controlled
-    # placeholder value like {invoice_company}
-    event, user, organizer = env
-    position = order.positions.get()
-    order.invoice_address.company = "{url_cancel} Corp"
-    order.invoice_address.save()
-    event.settings.mail_text_resend_link = LazyI18nString({"en": "Ticket for {invoice_company}"})
-    event.settings.mail_subject_resend_link_attendee = LazyI18nString({"en": "Ticket for {invoice_company}"})
-
-    djmail.outbox = []
-    position.resend_link()
-    assert len(djmail.outbox) == 1
-    assert djmail.outbox[0].to == [position.attendee_email]
-    assert "Ticket for {url_cancel} Corp" == djmail.outbox[0].subject
-    assert "/cancel" not in djmail.outbox[0].body
-    assert "/order" not in djmail.outbox[0].body
-    html, plain = _extract_html(djmail.outbox[0]), djmail.outbox[0].body
-    for part in (html, plain):
-        assert "Ticket for {url_cancel} Corp" in part
-        assert "/order/" not in part
-        assert "/cancel" not in part
-
-
-@pytest.mark.django_db
-def test_nested_placeholder_inclusion_mail_service(env):
-    # test that it is not possible to have placeholders within the values of placeholders when
-    # the mail() function is called directly
-    template = LazyI18nString("Event name: {event}")
-    djmail.outbox = []
-    event, user, organizer = env
-    event.name = "event & {currency} co. kg"
-    event.slug = "event-co-ag-slug"
-    event.save()
-
-    mail(
-        "dummy@dummy.dummy",
-        "{event} Test subject",
-        template,
-        get_email_context(
-            event=event,
-            payment_info="**IBAN**: 123  \n**BIC**: 456 {event}",
-        ),
-        event,
-    )
-
-    assert len(djmail.outbox) == 1
-    assert djmail.outbox[0].to == [user.email]
-    html, plain = _extract_html(djmail.outbox[0]), djmail.outbox[0].body
-    for part in (html, plain, djmail.outbox[0].subject):
-        assert "event & {currency} co. kg" in part or "event &amp; {currency} co. kg" in part
-        assert "EUR" not in part
-
-
-@pytest.mark.django_db
-@pytest.mark.parametrize("tpl", [
-    "Event: {event.__class__}",
-    "Event: {{event.__class__}}",
-    "Event: {{{event.__class__}}}",
-])
-def test_variable_inclusion_from_string_full_process(env, tpl, order):
-    # Test that it is not possible to use placeholders that leak system information in templates
-    # when run through system processes
-    event, user, organizer = env
-    event.name = "event & co. kg"
-    event.save()
-    position = order.positions.get()
-    event.settings.mail_text_resend_link = LazyI18nString({"en": tpl})
-    event.settings.mail_subject_resend_link_attendee = LazyI18nString({"en": tpl})
-
-    position.resend_link()
-    assert len(djmail.outbox) == 1
-    html, plain = _extract_html(djmail.outbox[0]), djmail.outbox[0].body
-    for part in (html, plain, djmail.outbox[0].subject):
-        assert "{event.__class__}" in part
-        assert "LazyI18nString" not in part
-
-
-@pytest.mark.django_db
-@pytest.mark.parametrize("tpl", [
-    "Event: {event.__class__}",
-    "Event: {{event.__class__}}",
-    "Event: {{{event.__class__}}}",
-])
-def test_variable_inclusion_from_string_mail_service(env, tpl):
-    # Test that it is not possible to use placeholders that leak system information in templates
-    # when run through mail() directly
-    event, user, organizer = env
-    event.name = "event & co. kg"
-    event.save()
-
-    djmail.outbox = []
-    mail(
-        "dummy@dummy.dummy",
-        tpl,
-        LazyI18nString(tpl),
-        get_email_context(
-            event=event,
-            payment_info="**IBAN**: 123  \n**BIC**: 456\n" + tpl,
-        ),
-        event,
-    )
-    assert len(djmail.outbox) == 1
-    html, plain = _extract_html(djmail.outbox[0]), djmail.outbox[0].body
-    for part in (html, plain, djmail.outbox[0].subject):
-        assert "{event.__class__}" in part
-        assert "LazyI18nString" not in part
-
-
-@pytest.mark.django_db
-def test_escaped_braces_mail_services(env):
-    # Test that braces can be escaped by doubling
-    template = LazyI18nString("Event name: -{{currency}}-")
-    djmail.outbox = []
-    event, user, organizer = env
-    event.name = "event & co. kg"
-    event.save()
-
-    mail(
-        "dummy@dummy.dummy",
-        "-{{currency}}- Test subject",
-        template,
-        get_email_context(
-            event=event,
-            payment_info="**IBAN**: 123  \n**BIC**: 456 {event}",
-        ),
-        event,
-    )
-
-    assert len(djmail.outbox) == 1
-    assert djmail.outbox[0].to == [user.email]
-    html, plain = _extract_html(djmail.outbox[0]), djmail.outbox[0].body
-    for part in (html, plain, djmail.outbox[0].subject):
-        assert "EUR" not in part
-        assert "-{currency}-" in part

src/tests/helpers/test_format.py

@@ -29,8 +29,6 @@ def test_format_map():
     assert format_map("Foo {baz}", {"bar": 3}) == "Foo {baz}"
     assert format_map("Foo {bar.__module__}", {"bar": 3}) == "Foo {bar.__module__}"
     assert format_map("Foo {bar!s}", {"bar": 3}) == "Foo 3"
-    assert format_map("Foo {bar!r}", {"bar": '3'}) == "Foo 3"
-    assert format_map("Foo {bar!a}", {"bar": '3'}) == "Foo 3"
     assert format_map("Foo {bar:<20}", {"bar": 3}) == "Foo 3"
 
 

src/tests/presale/test_order_change.py

@@ -1015,7 +1015,8 @@ class OrderChangeAddonsTest(BaseOrdersTest):
             '/%s/%s/order/%s/%s/change' % (self.orga.slug, self.event.slug, self.order.code, self.order.secret)
         )
         assert response.status_code == 200
-        assert 'Workshop 1' not in response.content.decode()
+        assert '<li>1x Workshop 1</li>' in response.content.decode()
+        assert f'cp_{self.ticket_pos.pk}_item_{self.workshop1.pk}' not in response.content.decode()
 
         response = self.client.post(
             '/%s/%s/order/%s/%s/change' % (self.orga.slug, self.event.slug, self.order.code, self.order.secret),
@@ -1035,6 +1036,39 @@ class OrderChangeAddonsTest(BaseOrdersTest):
         with scopes_disabled():
             assert self.ticket_pos.addons.count() == 2
 
+    def test_do_not_overbook_unavailable_on_adding(self):
+        self.iao.max_count = 1
+        self.iao.save()
+        self.workshop1.available_until = now() - datetime.timedelta(days=1)
+        self.workshop1.save()
+        with scopes_disabled():
+            OrderPosition.objects.create(
+                order=self.order,
+                item=self.workshop1,
+                variation=None,
+                price=Decimal("12"),
+                addon_to=self.ticket_pos,
+                attendee_name_parts={'full_name': "Peter"}
+            )
+            self.order.total += Decimal("12")
+            self.order.save()
+
+        response = self.client.get(
+            '/%s/%s/order/%s/%s/change' % (self.orga.slug, self.event.slug, self.order.code, self.order.secret)
+        )
+        assert response.status_code == 200
+        assert '<li>1x Workshop 1</li>' in response.content.decode()
+        assert f'cp_{self.ticket_pos.pk}_item_{self.workshop1.pk}' not in response.content.decode()
+
+        response = self.client.post(
+            '/%s/%s/order/%s/%s/change' % (self.orga.slug, self.event.slug, self.order.code, self.order.secret),
+            {
+                f'cp_{self.ticket_pos.pk}_variation_{self.workshop2.pk}_{self.workshop2a.pk}': '1'
+            },
+            follow=True
+        )
+        assert 'alert-danger' in response.content.decode()
+
     def test_remove_addon_checked_in(self):
         with scopes_disabled():
             self.event.settings.change_allow_user_if_checked_in = True

src/tests/templates/mailtest.txt

@@ -1,13 +1,13 @@
 {% load i18n %}
 This is a test file for sending mails.
-Event name: {{ event }}
-Unevaluated placeholder: {currency}
+Event name: {event}
 {% get_current_language as LANGUAGE_CODE %}
 The language code used for rendering this email is {{ LANGUAGE_CODE }}.
 
 Payment info:
-{{ payment_info }}
+{payment_info}
 
-**Meta**: {{ meta_Test }}
+**Meta**: {meta_Test}
 
-Event website: [{{event}}](https://example.org/{{event_slug}})
+Event website: [{event}](https://example.org/{event_slug})
+Other website: [{event}]({meta_Website})