Delete template

pyproject.toml

@@ -93,7 +93,7 @@ dependencies = [
   "redis==7.1.*",
   "reportlab==4.4.*",
   "requests==2.32.*",
-  "sentry-sdk==2.56.*",
+  "sentry-sdk==2.54.*",
   "sepaxml==2.7.*",
   "stripe==7.9.*",
   "text-unidecode==1.*",

src/pretix/__init__.py

@@ -19,4 +19,4 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-__version__ = "2026.3.4"
+__version__ = "2026.3.0.dev0"

src/pretix/api/views/checkin.py

@@ -1122,7 +1122,7 @@ class CheckinViewSet(viewsets.ReadOnlyModelViewSet):
     permission = 'event.orders:read'
 
     def get_queryset(self):
-        qs = Checkin.all.filter(list__event=self.request.event).select_related(
+        qs = Checkin.all.filter().select_related(
             "position",
             "device",
         )

src/pretix/base/exporters/reusablemedia.py

@@ -69,9 +69,7 @@ class ReusableMediaExporter(OrganizerLevelExportMixin, ListExporter):
                 date_format(medium.expires, 'SHORT_DATETIME_FORMAT') if medium.expires else '',
                 medium.customer.identifier if medium.customer_id else '',
                 f"{medium.linked_orderposition.order.code}-{medium.linked_orderposition.positionid}" if medium.linked_orderposition_id else '',
-                # we cannot determine here whether user has permission organizer.giftcards:read
-                # so default to not showing giftcard secret
-                medium.linked_giftcard.secret[:3] + "…" if medium.linked_giftcard_id else '',
+                medium.linked_giftcard.secret if medium.linked_giftcard_id else '',
                 medium.notes,
             ]
             yield row

src/pretix/base/forms/auth.py

@@ -196,7 +196,8 @@ class RegistrationForm(forms.Form):
     def clean_password(self):
         password1 = self.cleaned_data.get('password', '')
         user = User(email=self.cleaned_data.get('email'))
-        validate_password(password1, user=user)
+        if validate_password(password1, user=user) is not None:
+            raise forms.ValidationError(_(password_validators_help_texts()), code='pw_invalid')
         return password1
 
     def clean_email(self):

src/pretix/base/invoicing/pdf.py

@@ -22,7 +22,9 @@
 import datetime
 import logging
 import math
+import re
 import textwrap
+import unicodedata
 from collections import defaultdict
 from decimal import Decimal
 from io import BytesIO
@@ -56,8 +58,8 @@ from pretix.base.services.currencies import SOURCE_NAMES
 from pretix.base.signals import register_invoice_renderers
 from pretix.base.templatetags.money import money_filter
 from pretix.helpers.reportlab import (
-    FontFallbackParagraph, PlainTextParagraph, ThumbnailingImageReader,
-    normalize_text, register_ttf_font_if_new, reshaper,
+    FontFallbackParagraph, ThumbnailingImageReader, register_ttf_font_if_new,
+    reshaper,
 )
 from pretix.presale.style import get_fonts
 
@@ -257,8 +259,18 @@ class BaseReportlabInvoiceRenderer(BaseInvoiceRenderer):
                 register_ttf_font_if_new(family + ' B I', finders.find(styles['bolditalic']['truetype']))
 
     def _normalize(self, text):
-        # alias kept for plugin compatibility
-        return normalize_text(text)
+        # reportlab does not support unicode combination characters
+        # It's important we do this before we use ArabicReshaper
+        text = unicodedata.normalize("NFKC", text)
+
+        # reportlab does not support RTL, ligature-heavy scripts like Arabic. Therefore, we use ArabicReshaper
+        # to resolve all ligatures and python-bidi to switch RTL texts.
+        try:
+            text = "<br />".join(get_display(reshaper.reshape(l)) for l in re.split("<br ?/>", text))
+        except:
+            logger.exception('Reshaping/Bidi fixes failed on string {}'.format(repr(text)))
+
+        return text
 
     def _upper(self, val):
         # We uppercase labels, but not in every language
@@ -339,15 +351,10 @@ class BaseReportlabInvoiceRenderer(BaseInvoiceRenderer):
         return 'invoice.pdf', 'application/pdf', buffer.read()
 
     def _clean_text(self, text, tags=None):
-        # For backwards compatibility with customer content, we need to support tags like <br> and <b> in a few text
-        # fields. Therefore, we can't use PlainTextParagraph for these, but run bleach instead to limit the allowed
-        # tags.
-        return self._normalize(
-            bleach.clean(
-                text,
-                tags=set(tags) if tags else set()
-            ).strip().replace('<br>', '<br />').replace('\n', '<br />\n')
-        )
+        return self._normalize(bleach.clean(
+            text,
+            tags=set(tags) if tags else set()
+        ).strip().replace('<br>', '<br />').replace('\n', '<br />\n'))
 
 
 class PaidMarker(Flowable):
@@ -398,7 +405,8 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
     invoice_to_top = 52 * mm
 
     def _draw_invoice_to(self, canvas):
-        p = PlainTextParagraph(self.invoice.address_invoice_to, style=self.stylesheet['Normal'])
+        p = FontFallbackParagraph(self._clean_text(self.invoice.address_invoice_to),
+                                  style=self.stylesheet['Normal'])
         p.wrapOn(canvas, self.invoice_to_width, self.invoice_to_height)
         p_size = p.wrap(self.invoice_to_width, self.invoice_to_height)
         p.drawOn(canvas, self.invoice_to_left, self.pagesize[1] - p_size[1] - self.invoice_to_top)
@@ -409,8 +417,8 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
     invoice_from_top = 17 * mm
 
     def _draw_invoice_from(self, canvas):
-        p = PlainTextParagraph(
-            self.invoice.full_invoice_from,
+        p = FontFallbackParagraph(
+            self._clean_text(self.invoice.full_invoice_from),
             style=self.stylesheet['InvoiceFrom']
         )
         p.wrapOn(canvas, self.invoice_from_width, self.invoice_from_height)
@@ -540,12 +548,13 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
     def _draw_event(self, canvas):
         def shorten(txt):
             txt = str(txt)
-            p = PlainTextParagraph(txt, style=self.stylesheet['Normal'])
+            txt = bleach.clean(txt, tags=set()).strip()
+            p = FontFallbackParagraph(self._normalize(txt.strip().replace('\n', '<br />\n')), style=self.stylesheet['Normal'])
             p_size = p.wrap(self.event_width, self.event_height)
 
             while p_size[1] > 2 * self.stylesheet['Normal'].leading:
                 txt = ' '.join(txt.replace('…', '').split()[:-1]) + '…'
-                p = PlainTextParagraph(txt, style=self.stylesheet['Normal'])
+                p = FontFallbackParagraph(self._normalize(txt.strip().replace('\n', '<br />\n')), style=self.stylesheet['Normal'])
                 p_size = p.wrap(self.event_width, self.event_height)
             return txt
 
@@ -563,7 +572,7 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
         else:
             p_str = shorten(self.invoice.event.name)
 
-        p = PlainTextParagraph(p_str, style=self.stylesheet['Normal'])
+        p = FontFallbackParagraph(self._normalize(p_str.strip().replace('\n', '<br />\n')), style=self.stylesheet['Normal'])
         p.wrapOn(canvas, self.event_width, self.event_height)
         p_size = p.wrap(self.event_width, self.event_height)
         p.drawOn(canvas, self.event_left, self.pagesize[1] - self.event_top - p_size[1])
@@ -636,37 +645,39 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
 
         type_info_text = self.invoice.transmission_type_instance.pdf_info_text()
         if type_info_text:
-            story.append(PlainTextParagraph(
+            story.append(FontFallbackParagraph(
                 type_info_text,
                 self.stylesheet['WarningBlock']
             ))
 
         if self.invoice.custom_field:
-            story.append(PlainTextParagraph(
+            story.append(FontFallbackParagraph(
                 '{}: {}'.format(
-                    str(self.invoice.event.settings.invoice_address_custom_field),
-                    self.invoice.custom_field,
+                    self._clean_text(str(self.invoice.event.settings.invoice_address_custom_field)),
+                    self._clean_text(self.invoice.custom_field),
                 ),
                 self.stylesheet['Normal']
             ))
 
         if self.invoice.internal_reference:
-            story.append(PlainTextParagraph(
-                pgettext('invoice', 'Customer reference: {reference}').format(
-                    reference=self.invoice.internal_reference,
-                ),
+            story.append(FontFallbackParagraph(
+                self._normalize(pgettext('invoice', 'Customer reference: {reference}').format(
+                    reference=self._clean_text(self.invoice.internal_reference),
+                )),
                 self.stylesheet['Normal']
             ))
 
         if self.invoice.invoice_to_vat_id:
-            story.append(PlainTextParagraph(
-                pgettext('invoice', 'Customer VAT ID') + ': ' + self.invoice.invoice_to_vat_id,
+            story.append(FontFallbackParagraph(
+                self._normalize(pgettext('invoice', 'Customer VAT ID')) + ': ' +
+                self._clean_text(self.invoice.invoice_to_vat_id),
                 self.stylesheet['Normal']
             ))
 
         if self.invoice.invoice_to_beneficiary:
-            story.append(PlainTextParagraph(
-                pgettext('invoice', 'Beneficiary') + ':\n' + self.invoice.invoice_to_beneficiary,
+            story.append(FontFallbackParagraph(
+                self._normalize(pgettext('invoice', 'Beneficiary')) + ':<br />' +
+                self._clean_text(self.invoice.invoice_to_beneficiary),
                 self.stylesheet['Normal']
             ))
 
@@ -696,11 +707,11 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
 
         story = [
             NextPageTemplate('FirstPage'),
-            PlainTextParagraph(
-                (
+            FontFallbackParagraph(
+                self._normalize(
                     pgettext('invoice', 'Tax Invoice') if str(self.invoice.invoice_from_country) == 'AU'
                     else pgettext('invoice', 'Invoice')
-                ) if not self.invoice.is_cancellation else pgettext('invoice', 'Cancellation'),
+                ) if not self.invoice.is_cancellation else self._normalize(pgettext('invoice', 'Cancellation')),
                 self.stylesheet['Heading1']
             ),
             Spacer(1, 5 * mm),
@@ -722,17 +733,17 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
         ]
         if has_taxes:
             tdata = [(
-                PlainTextParagraph(pgettext('invoice', 'Description'), self.stylesheet['Bold']),
-                PlainTextParagraph(pgettext('invoice', 'Qty'), self.stylesheet['BoldRightNoSplit']),
-                PlainTextParagraph(pgettext('invoice', 'Tax rate'), self.stylesheet['BoldRightNoSplit']),
-                PlainTextParagraph(pgettext('invoice', 'Net'), self.stylesheet['BoldRightNoSplit']),
-                PlainTextParagraph(pgettext('invoice', 'Gross'), self.stylesheet['BoldRightNoSplit']),
+                FontFallbackParagraph(self._normalize(pgettext('invoice', 'Description')), self.stylesheet['Bold']),
+                FontFallbackParagraph(self._normalize(pgettext('invoice', 'Qty')), self.stylesheet['BoldRightNoSplit']),
+                FontFallbackParagraph(self._normalize(pgettext('invoice', 'Tax rate')), self.stylesheet['BoldRightNoSplit']),
+                FontFallbackParagraph(self._normalize(pgettext('invoice', 'Net')), self.stylesheet['BoldRightNoSplit']),
+                FontFallbackParagraph(self._normalize(pgettext('invoice', 'Gross')), self.stylesheet['BoldRightNoSplit']),
             )]
         else:
             tdata = [(
-                PlainTextParagraph(pgettext('invoice', 'Description'), self.stylesheet['Bold']),
-                PlainTextParagraph(pgettext('invoice', 'Qty'), self.stylesheet['BoldRightNoSplit']),
-                PlainTextParagraph(pgettext('invoice', 'Amount'), self.stylesheet['BoldRightNoSplit']),
+                FontFallbackParagraph(self._normalize(pgettext('invoice', 'Description')), self.stylesheet['Bold']),
+                FontFallbackParagraph(self._normalize(pgettext('invoice', 'Qty')), self.stylesheet['BoldRightNoSplit']),
+                FontFallbackParagraph(self._normalize(pgettext('invoice', 'Amount')), self.stylesheet['BoldRightNoSplit']),
             )]
 
         def _group_key(line):
@@ -769,8 +780,8 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
             max_height = self.stylesheet['Normal'].leading * 5
             p_style = self.stylesheet['Normal']
             for __ in range(1000):
-                p = PlainTextParagraph(
-                    curr_description,
+                p = FontFallbackParagraph(
+                    self._clean_text(curr_description, tags=['br']),
                     p_style
                 )
                 h = p.wrap(max_width, doc.height)[1]
@@ -851,7 +862,7 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
                 # Group together at the end of the invoice
                 request_show_service_date = period_line
             elif period_line:
-                description_p_list.append(PlainTextParagraph(
+                description_p_list.append(FontFallbackParagraph(
                     period_line,
                     self.stylesheet['Fineprint']
                 ))
@@ -863,7 +874,7 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
                         net_price=money_filter(net_value, self.invoice.event.currency),
                         gross_price=money_filter(gross_value, self.invoice.event.currency),
                     )
-                    description_p_list.append(PlainTextParagraph(
+                    description_p_list.append(FontFallbackParagraph(
                         single_price_line,
                         self.stylesheet['Fineprint']
                     ))
@@ -872,11 +883,11 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
                     description_p_list.pop(0),
                     str(len(lines)),
                     localize(tax_rate) + " %",
-                    PlainTextParagraph(
+                    FontFallbackParagraph(
                         money_filter(net_value * len(lines), self.invoice.event.currency).replace('\xa0', ' '),
                         self.stylesheet['NormalRight']
                     ),
-                    PlainTextParagraph(
+                    FontFallbackParagraph(
                         money_filter(gross_value * len(lines), self.invoice.event.currency).replace('\xa0', ' '),
                         self.stylesheet['NormalRight']
                     ),
@@ -893,14 +904,14 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
                     single_price_line = pgettext('invoice', 'Single price: {price}').format(
                         price=money_filter(gross_value, self.invoice.event.currency),
                     )
-                    description_p_list.append(PlainTextParagraph(
+                    description_p_list.append(FontFallbackParagraph(
                         single_price_line,
                         self.stylesheet['Fineprint']
                     ))
                 tdata.append((
                     description_p_list.pop(0),
                     str(len(lines)),
-                    PlainTextParagraph(
+                    FontFallbackParagraph(
                         money_filter(gross_value * len(lines), self.invoice.event.currency).replace('\xa0', ' '),
                         self.stylesheet['NormalRight']
                     ),
@@ -933,12 +944,12 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
 
         if has_taxes:
             tdata.append([
-                PlainTextParagraph(pgettext('invoice', 'Invoice total'), self.stylesheet['Bold']), '', '', '',
+                FontFallbackParagraph(self._normalize(pgettext('invoice', 'Invoice total')), self.stylesheet['Bold']), '', '', '',
                 money_filter(total, self.invoice.event.currency)
             ])
         else:
             tdata.append([
-                PlainTextParagraph(pgettext('invoice', 'Invoice total'), self.stylesheet['Bold']), '',
+                FontFallbackParagraph(self._normalize(pgettext('invoice', 'Invoice total')), self.stylesheet['Bold']), '',
                 money_filter(total, self.invoice.event.currency)
             ])
 
@@ -947,12 +958,12 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
                 pending_sum = self.invoice.order.pending_sum
                 if pending_sum != total:
                     tdata.append(
-                        [PlainTextParagraph(pgettext('invoice', 'Received payments'), self.stylesheet['Normal'])] +
+                        [FontFallbackParagraph(self._normalize(pgettext('invoice', 'Received payments')), self.stylesheet['Normal'])] +
                         (['', '', ''] if has_taxes else ['']) +
                         [money_filter(pending_sum - total, self.invoice.event.currency)]
                     )
                     tdata.append(
-                        [PlainTextParagraph(pgettext('invoice', 'Outstanding payments'), self.stylesheet['Bold'])] +
+                        [FontFallbackParagraph(self._normalize(pgettext('invoice', 'Outstanding payments')), self.stylesheet['Bold'])] +
                         (['', '', ''] if has_taxes else ['']) +
                         [money_filter(pending_sum, self.invoice.event.currency)]
                     )
@@ -969,12 +980,12 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
                     s=Sum('amount')
                 )['s'] or Decimal('0.00')
                 tdata.append(
-                    [PlainTextParagraph(pgettext('invoice', 'Paid by gift card'), self.stylesheet['Normal'])] +
+                    [FontFallbackParagraph(self._normalize(pgettext('invoice', 'Paid by gift card')), self.stylesheet['Normal'])] +
                     (['', '', ''] if has_taxes else ['']) +
                     [money_filter(giftcard_sum, self.invoice.event.currency)]
                 )
                 tdata.append(
-                    [PlainTextParagraph(pgettext('invoice', 'Remaining amount'), self.stylesheet['Bold'])] +
+                    [FontFallbackParagraph(self._normalize(pgettext('invoice', 'Remaining amount')), self.stylesheet['Bold'])] +
                     (['', '', ''] if has_taxes else ['']) +
                     [money_filter(total - giftcard_sum, self.invoice.event.currency)]
                 )
@@ -997,14 +1008,14 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
         story.append(Spacer(1, 10 * mm))
 
         if request_show_service_date:
-            story.append(PlainTextParagraph(
-                pgettext('invoice', 'Invoice period: {daterange}').format(daterange=request_show_service_date),
+            story.append(FontFallbackParagraph(
+                self._normalize(pgettext('invoice', 'Invoice period: {daterange}').format(daterange=request_show_service_date)),
                 self.stylesheet['Normal']
             ))
 
         if self.invoice.payment_provider_text:
             story.append(FontFallbackParagraph(
-                self._clean_text(self.invoice.payment_provider_text, tags=['br', 'b']),
+                self._normalize(self.invoice.payment_provider_text),
                 self.stylesheet['Normal']
             ))
 
@@ -1028,10 +1039,10 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
             ('FONTNAME', (0, 0), (-1, -1), self.font_regular),
         ]
         thead = [
-            PlainTextParagraph(pgettext('invoice', 'Tax rate'), self.stylesheet['Fineprint']),
-            PlainTextParagraph(pgettext('invoice', 'Net value'), self.stylesheet['FineprintRight']),
-            PlainTextParagraph(pgettext('invoice', 'Gross value'), self.stylesheet['FineprintRight']),
-            PlainTextParagraph(pgettext('invoice', 'Tax'), self.stylesheet['FineprintRight']),
+            FontFallbackParagraph(self._normalize(pgettext('invoice', 'Tax rate')), self.stylesheet['Fineprint']),
+            FontFallbackParagraph(self._normalize(pgettext('invoice', 'Net value')), self.stylesheet['FineprintRight']),
+            FontFallbackParagraph(self._normalize(pgettext('invoice', 'Gross value')), self.stylesheet['FineprintRight']),
+            FontFallbackParagraph(self._normalize(pgettext('invoice', 'Tax')), self.stylesheet['FineprintRight']),
             ''
         ]
         tdata = [thead]
@@ -1042,7 +1053,7 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
                 continue
             tax = taxvalue_map[idx]
             tdata.append([
-                PlainTextParagraph(localize(rate) + " % " + name, self.stylesheet['Fineprint']),
+                FontFallbackParagraph(self._normalize(localize(rate) + " % " + name), self.stylesheet['Fineprint']),
                 money_filter(gross - tax, self.invoice.event.currency),
                 money_filter(gross, self.invoice.event.currency),
                 money_filter(tax, self.invoice.event.currency),
@@ -1061,7 +1072,7 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
             table.setStyle(TableStyle(tstyledata))
             story.append(Spacer(5 * mm, 5 * mm))
             story.append(KeepTogether([
-                PlainTextParagraph(pgettext('invoice', 'Included taxes'), self.stylesheet['FineprintHeading']),
+                FontFallbackParagraph(self._normalize(pgettext('invoice', 'Included taxes')), self.stylesheet['FineprintHeading']),
                 table
             ]))
 
@@ -1078,7 +1089,7 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
                     net = gross - tax
 
                     tdata.append([
-                        PlainTextParagraph(localize(rate) + " % " + name, self.stylesheet['Fineprint']),
+                        FontFallbackParagraph(self._normalize(localize(rate) + " % " + name), self.stylesheet['Fineprint']),
                         fmt(net), fmt(gross), fmt(tax), ''
                     ])
 
@@ -1087,13 +1098,13 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
 
                 story.append(KeepTogether([
                     Spacer(1, height=2 * mm),
-                    PlainTextParagraph(
-                        pgettext(
+                    FontFallbackParagraph(
+                        self._normalize(pgettext(
                             'invoice', 'Using the conversion rate of 1:{rate} as published by the {authority} on '
                                        '{date}, this corresponds to:'
                         ).format(rate=localize(self.invoice.foreign_currency_rate),
                                  authority=SOURCE_NAMES.get(self.invoice.foreign_currency_source, "?"),
-                                 date=date_format(self.invoice.foreign_currency_rate_date, "SHORT_DATE_FORMAT")),
+                                 date=date_format(self.invoice.foreign_currency_rate_date, "SHORT_DATE_FORMAT"))),
                         self.stylesheet['Fineprint']
                     ),
                     Spacer(1, height=3 * mm),
@@ -1102,14 +1113,14 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
         elif self.invoice.foreign_currency_display and self.invoice.foreign_currency_rate:
             foreign_total = round_decimal(total * self.invoice.foreign_currency_rate)
             story.append(Spacer(1, 5 * mm))
-            story.append(PlainTextParagraph(
+            story.append(FontFallbackParagraph(self._normalize(
                 pgettext(
                     'invoice', 'Using the conversion rate of 1:{rate} as published by the {authority} on '
                                '{date}, the invoice total corresponds to {total}.'
                 ).format(rate=localize(self.invoice.foreign_currency_rate),
                          date=date_format(self.invoice.foreign_currency_rate_date, "SHORT_DATE_FORMAT"),
                          authority=SOURCE_NAMES.get(self.invoice.foreign_currency_source, "?"),
-                         total=fmt(foreign_total)),
+                         total=fmt(foreign_total))),
                 self.stylesheet['Fineprint']
             ))
 
@@ -1151,8 +1162,11 @@ class Modern1Renderer(ClassicInvoiceRenderer):
     def _draw_invoice_from(self, canvas):
         if not self.invoice.invoice_from:
             return
-        c = self.invoice.address_invoice_from.strip().split('\n')
-        p = PlainTextParagraph(' · '.join(c), style=self.stylesheet['Sender'])
+        c = [
+            self._clean_text(l)
+            for l in self.invoice.address_invoice_from.strip().split('\n')
+        ]
+        p = FontFallbackParagraph(self._normalize(' · '.join(c)), style=self.stylesheet['Sender'])
         p.wrapOn(canvas, self.invoice_to_width, 15.7 * mm)
         p.drawOn(canvas, self.invoice_to_left, self.pagesize[1] - self.invoice_to_top + 2 * mm)
         super()._draw_invoice_from(canvas)
@@ -1211,8 +1225,8 @@ class Modern1Renderer(ClassicInvoiceRenderer):
                 _draw(pgettext('invoice', 'Order code'), self.invoice.order.full_code, value_size, self.left_margin, 45 * mm, **kwargs)
             ]
 
-            p = PlainTextParagraph(
-                date_format(self.invoice.date, "DATE_FORMAT"),
+            p = FontFallbackParagraph(
+                self._normalize(date_format(self.invoice.date, "DATE_FORMAT")),
                 style=ParagraphStyle(name=f'Normal{value_size}', fontName=self.font_regular, fontSize=value_size, leading=value_size * 1.2)
             )
             w = stringWidth(p.text, p.frags[0].fontName, p.frags[0].fontSize)
@@ -1269,7 +1283,7 @@ class Modern1SimplifiedRenderer(Modern1Renderer):
         i = []
 
         if not self.invoice.event.has_subevents and self.invoice.event.settings.show_dates_on_frontpage:
-            i.append(PlainTextParagraph(
+            i.append(FontFallbackParagraph(
                 pgettext('invoice', 'Event date: {date_range}').format(
                     date_range=self.invoice.event.get_date_range_display(),
                 ),

src/pretix/base/pdf.py

@@ -1045,7 +1045,7 @@ class Renderer:
         except:
             logger.exception('Reshaping/Bidi fixes failed on string {}'.format(repr(text)))
 
-        p = Paragraph(text, style=style)  # not using AutoEscapeParagraph is safe as we escape above
+        p = Paragraph(text, style=style)
         return p, ad, lineheight
 
     def _draw_textcontainer(self, canvas: Canvas, op: OrderPosition, order: Order, o: dict):

src/pretix/base/services/mail.py

@@ -411,7 +411,7 @@ def mail_send_task(self, **kwargs) -> bool:
         try:
             outgoing_mail = OutgoingMail.objects.select_for_update(of=OF_SELF).get(pk=outgoing_mail)
         except OutgoingMail.DoesNotExist:
-            logger.info(f"Ignoring job for non existing email {outgoing_mail}")
+            logger.info(f"Ignoring job for non existing email {outgoing_mail.guid}")
             return False
         if outgoing_mail.status == OutgoingMail.STATUS_INFLIGHT:
             logger.info(f"Ignoring job for inflight email {outgoing_mail.guid}")

src/pretix/base/settings.py

@@ -100,7 +100,7 @@ def primary_font_kwargs():
 
     choices = [('Open Sans', 'Open Sans')]
     choices += sorted([
-        (a, FontSelect.FontOption(title=a, data=v)) for a, v in get_fonts(pdf_support_required=False).items()
+        (a, {"title": a, "data": v}) for a, v in get_fonts(pdf_support_required=False).items()
     ], key=lambda a: a[0])
     return {
         'choices': choices,

src/pretix/base/templates/pretixbase/redirect.html

@@ -2,14 +2,13 @@
 {% load i18n %}
 {% load rich_text %}
 {% load static %}
-{% load wrap_in %}
 {% block title %}{% trans "Redirect" %}{% endblock %}
 {% block content %}
 <i class="fa fa-link fa-fw big-icon"></i>
 <div class="error-details">
     <h1>{% trans "Redirect" %}</h1>
     <h3>
-        {% blocktrans trimmed with host=hostname|wrap_in:'strong' %}
+        {% blocktrans trimmed with host="<strong>"|add:hostname|add:"</strong>"|safe %}
         The link you clicked on wants to redirect you to a destination on the website {{ host }}.
         {% endblocktrans %}
         {% blocktrans trimmed %}

src/pretix/control/forms/__init__.py

@@ -34,7 +34,6 @@
 
 import datetime
 import os
-from dataclasses import dataclass
 
 from django import forms
 from django.conf import settings
@@ -421,11 +420,6 @@ class SplitDateTimeField(forms.SplitDateTimeField):
 class FontSelect(forms.RadioSelect):
     option_template_name = 'pretixcontrol/font_option.html'
 
-    @dataclass
-    class FontOption:
-        title: str
-        data: str
-
 
 class ItemMultipleChoiceField(SafeModelMultipleChoiceField):
     def label_from_instance(self, obj):

src/pretix/control/forms/event.py

@@ -73,8 +73,8 @@ from pretix.base.settings import (
 )
 from pretix.base.validators import multimail_validate
 from pretix.control.forms import (
-    FontSelect, MultipleLanguagesWidget, SalesChannelCheckboxSelectMultiple,
-    SlugWidget, SplitDateTimeField, SplitDateTimePickerWidget,
+    MultipleLanguagesWidget, SalesChannelCheckboxSelectMultiple, SlugWidget,
+    SplitDateTimeField, SplitDateTimePickerWidget,
 )
 from pretix.control.forms.widgets import Select2
 from pretix.helpers.countries import CachedCountries
@@ -729,7 +729,7 @@ class EventSettingsForm(EventSettingsValidationMixin, FormPlaceholderMixin, Sett
             del self.fields['event_list_filters']
             del self.fields['event_calendar_future_only']
         self.fields['primary_font'].choices = [('Open Sans', 'Open Sans')] + sorted([
-            (a, FontSelect.FontOption(title=a, data=v)) for a, v in get_fonts(self.event, pdf_support_required=False).items()
+            (a, {"title": a, "data": v}) for a, v in get_fonts(self.event, pdf_support_required=False).items()
         ], key=lambda a: a[0])
 
         # create "virtual" fields for better UX when editing <name>_asked and <name>_required fields

src/pretix/control/sysreport.py

@@ -38,7 +38,6 @@ from pretix import __version__
 from pretix.base.models import Order, OrderPayment, Transaction
 from pretix.base.plugins import get_all_plugins
 from pretix.base.templatetags.money import money_filter
-from pretix.helpers.reportlab import PlainTextParagraph
 from pretix.plugins.reports.exporters import ReportlabExportMixin
 from pretix.settings import DATA_DIR
 
@@ -80,23 +79,23 @@ class SysReport(ReportlabExportMixin):
         style_small.fontSize = 6
 
         story = [
-            PlainTextParagraph("System report", headlinestyle),
+            Paragraph("System report", headlinestyle),
             Spacer(1, 5 * mm),
-            PlainTextParagraph("Usage", subheadlinestyle),
+            Paragraph("Usage", subheadlinestyle),
             Spacer(1, 5 * mm),
             self._usage_table(),
             Spacer(1, 5 * mm),
-            PlainTextParagraph("Installed versions", subheadlinestyle),
+            Paragraph("Installed versions", subheadlinestyle),
             Spacer(1, 5 * mm),
             self._tech_table(),
             Spacer(1, 5 * mm),
-            PlainTextParagraph("Plugins", subheadlinestyle),
+            Paragraph("Plugins", subheadlinestyle),
             Spacer(1, 5 * mm),
-            PlainTextParagraph(self._get_plugin_versions(), style_small),
+            Paragraph(self._get_plugin_versions(), style_small),
             Spacer(1, 5 * mm),
-            PlainTextParagraph("Custom templates", subheadlinestyle),
+            Paragraph("Custom templates", subheadlinestyle),
             Spacer(1, 5 * mm),
-            PlainTextParagraph(self._get_custom_templates(), style_small),
+            Paragraph(self._get_custom_templates(), style_small),
             Spacer(1, 5 * mm),
         ]
 
@@ -122,13 +121,13 @@ class SysReport(ReportlabExportMixin):
             ("RIGHTPADDING", (-1, 0), (-1, -1), 0),
         ]
         tdata = [
-            [PlainTextParagraph("Site URL:", style), Paragraph(settings.SITE_URL, style)],
-            [PlainTextParagraph("pretix version:", style), Paragraph(__version__, style)],
-            [PlainTextParagraph("Python version:", style), Paragraph(sys.version, style)],
-            [PlainTextParagraph("Platform:", style), Paragraph(platform.platform(), style)],
+            [Paragraph("Site URL:", style), Paragraph(settings.SITE_URL, style)],
+            [Paragraph("pretix version:", style), Paragraph(__version__, style)],
+            [Paragraph("Python version:", style), Paragraph(sys.version, style)],
+            [Paragraph("Platform:", style), Paragraph(platform.platform(), style)],
             [
-                PlainTextParagraph("Database engine:", style),
-                PlainTextParagraph(settings.DATABASES["default"]["ENGINE"], style),
+                Paragraph("Database engine:", style),
+                Paragraph(settings.DATABASES["default"]["ENGINE"], style),
             ],
         ]
         table = Table(tdata, colWidths=colwidths, repeatRows=0)
@@ -207,7 +206,7 @@ class SysReport(ReportlabExportMixin):
         year_last = now().year
         tdata = [
             [
-                PlainTextParagraph(l, style_small_head)
+                Paragraph(l, style_small_head)
                 for l in (
                     "Time frame",
                     "Currency",
@@ -258,19 +257,19 @@ class SysReport(ReportlabExportMixin):
 
                 tdata.append(
                     (
-                        PlainTextParagraph(
+                        Paragraph(
                             date_format(first_day, "M Y")
                             + " – "
                             + date_format(after_day - timedelta(days=1), "M Y"),
                             style_small,
                         ),
-                        PlainTextParagraph(c, style_small),
-                        PlainTextParagraph(str(orders_count), style_small) if i == 0 else "",
-                        PlainTextParagraph(money_filter(revenue_data.get("s_net") or 0, c), style_small),
-                        PlainTextParagraph(str(testmode_count), style_small) if i == 0 else "",
-                        PlainTextParagraph(str(unconfirmed_count), style_small) if i == 0 else "",
-                        PlainTextParagraph(str(revenue_data.get("c") or 0), style_small),
-                        PlainTextParagraph(money_filter(revenue_data.get("s_gross") or 0, c), style_small),
+                        Paragraph(c, style_small),
+                        Paragraph(str(orders_count), style_small) if i == 0 else "",
+                        Paragraph(money_filter(revenue_data.get("s_net") or 0, c), style_small),
+                        Paragraph(str(testmode_count), style_small) if i == 0 else "",
+                        Paragraph(str(unconfirmed_count), style_small) if i == 0 else "",
+                        Paragraph(str(revenue_data.get("c") or 0), style_small),
+                        Paragraph(money_filter(revenue_data.get("s_gross") or 0, c), style_small),
                     )
                 )
 

src/pretix/control/templates/pretixcontrol/pdf/index.html

@@ -19,7 +19,9 @@
         {% endif %}
     </h1>
 
-    {{ layout|json_script:"editor-data" }}
+    <script type="application/json" id="editor-data">
+        {{ layout|safe }}
+    </script>
     <div class="row">
         <div class="col-md-9">
             <div class="panel panel-default panel-pdf-editor">

src/pretix/control/templates/pretixcontrol/user/2fa_add.html

@@ -8,45 +8,7 @@
         {% csrf_token %}
         {% bootstrap_form_errors form %}
         {% bootstrap_field form.name layout='horizontal' %}
-
-        <div class="form-group{% if form.devicetype.errors %} has-error{% endif %}">
-            <label class="col-md-3 control-label">{% trans "Device type" %}</label>
-            <div class="col-md-9">
-                <div>
-                    <div class="big-radio radio">
-                        <label>
-                            <input type="radio" required value="totp" name="{{ form.devicetype.html_name }}" {% if form.devicetype.value == "totp" %}checked{% endif %}>
-                            <strong>{% trans "Smartphone with Authenticator app" %}</strong><br>
-                            <div class="help-block">
-                                {% blocktrans trimmed %}
-                                    Use your smartphone with any Time-based One-Time-Password app like freeOTP, Google Authenticator or Proton Authenticator.
-                                {% endblocktrans %}
-                            </div>
-                        </label>
-                    </div>
-                    <div class="big-radio radio">
-                        <label>
-                            <input type="radio" required value="webauthn" name="{{ form.devicetype.html_name }}" {% if form.devicetype.value == "webauthn" %}checked{% endif %}>
-                            <strong>{% trans "WebAuthn-compatible hardware token" %}</strong><br>
-                            <div class="help-block">
-                                {% blocktrans trimmed %}
-                                    Use a hardware token like the Yubikey, or other biometric authentication like fingerprint or face recognition.
-                                {% endblocktrans %}
-                            </div>
-                        </label>
-                    </div>
-                </div>
-
-                {% if form.devicetype.errors %}
-                    <div class="help-block">
-                    {% for error in form.devicetype.errors %}
-                        <p>{{ error|escape }}</p>
-                    {% endfor %}
-                    </div>
-                {% endif %}
-            </div>
-        </div>
-
+        {% bootstrap_field form.devicetype layout='horizontal' %}
         <div class="form-group submit-group">
             <button type="submit" class="btn btn-primary btn-save">
                 {% trans "Continue" %}

src/pretix/control/templates/pretixcontrol/user/2fa_confirm_totp.html

@@ -28,6 +28,11 @@
                         {% trans "iOS (iTunes)" %}
                     </a>
                 </li>
+                <li>
+                    <a href="https://m.google.com/authenticator">
+                        {% trans "Blackberry (Link via Google)" %}
+                    </a>
+                </li>
             </ul>
         </li>
         <li>

src/pretix/control/views/pdf.py

@@ -289,7 +289,7 @@ class BaseEditorView(EventPermissionRequiredMixin, TemplateView):
         ctx['pdf'] = self.get_current_background()
         ctx['variables'] = self.get_variables()
         ctx['images'] = self.get_images()
-        ctx['layout'] = self.get_current_layout()
+        ctx['layout'] = json.dumps(self.get_current_layout())
         ctx['title'] = self.title
         ctx['locales'] = [p for p in settings.LANGUAGES if p[0] in self.request.event.settings.locales]
         ctx['maxfilesize'] = self.maxfilesize

src/pretix/helpers/apps.py

@@ -29,8 +29,3 @@ class PretixHelpersConfig(AppConfig):
     def ready(self):
         from .monkeypatching import monkeypatch_all_at_ready
         monkeypatch_all_at_ready()
-
-        # Ensure reportlab does not make any calls to the internet or the local disk
-        from reportlab import rl_config
-        rl_config.trustedHosts = []
-        rl_config.trustedSchemes = ['data']

src/pretix/helpers/monkeypatching.py

@@ -24,11 +24,8 @@ from datetime import datetime
 from http import cookies
 
 from PIL import Image
-from django.core.exceptions import SuspiciousFileOperation
 from requests.adapters import HTTPAdapter
 
-from pretix.helpers.reportlab import ThumbnailingImageReader
-
 
 def monkeypatch_vobject_performance():
     """
@@ -98,26 +95,8 @@ def monkeypatch_cookie_morsel():
     cookies.Morsel._reserved.setdefault("partitioned", "Partitioned")
 
 
-def monkeypatch_reportlab_imagereader():
-    from reportlab.lib import utils
-    old_init = utils.ImageReader.__init__
-
-    def new_init(self, fileName, ident=None):  # noqa
-        if not isinstance(fileName, Image.Image) and not hasattr(fileName, 'read') and not hasattr(fileName, 'str'):
-            if not isinstance(self, ThumbnailingImageReader):
-                # ThumbnailingImageReader is only used by us explicitly and not by using <img> in html, so it is safe
-                raise SuspiciousFileOperation("reportlab should not be reading images from disk")
-
-        return types.MethodType(old_init, self)(
-            fileName, ident
-        )
-
-    utils.ImageReader.__init__ = new_init
-
-
 def monkeypatch_all_at_ready():
     monkeypatch_vobject_performance()
     monkeypatch_pillow_safer()
     monkeypatch_requests_timeout()
     monkeypatch_cookie_morsel()
-    monkeypatch_reportlab_imagereader()

src/pretix/helpers/reportlab.py

@@ -20,19 +20,14 @@
 # <https://www.gnu.org/licenses/>.
 #
 import logging
-import re
-import unicodedata
 
 from arabic_reshaper import ArabicReshaper
-from bidi import get_display
 from django.conf import settings
 from django.utils.functional import SimpleLazyObject
-from django.utils.html import escape
 from PIL import Image
 from reportlab.lib.styles import ParagraphStyle
 from reportlab.lib.utils import ImageReader
 from reportlab.pdfbase import pdfmetrics
-from reportlab.pdfbase.ttfonts import TTFont
 from reportlab.platypus import Paragraph
 
 from pretix.presale.style import get_fonts
@@ -75,20 +70,6 @@ reshaper = SimpleLazyObject(lambda: ArabicReshaper(configuration={
 }))
 
 
-def normalize_text(text: str) -> str:
-    # reportlab does not support unicode combination characters
-    # It's important we do this before we use ArabicReshaper
-    text = unicodedata.normalize("NFKC", text)
-
-    # reportlab does not support RTL, ligature-heavy scripts like Arabic. Therefore, we use ArabicReshaper
-    # to resolve all ligatures and python-bidi to switch RTL texts.
-    try:
-        text = "\n".join(get_display(reshaper.reshape(l)) for l in re.split("\n", text))
-    except:
-        logger.exception('Reshaping/Bidi fixes failed on string {}'.format(repr(text)))
-    return text
-
-
 class FontFallbackParagraph(Paragraph):
     def __init__(self, text, style=None, *args, **kwargs):
         if style is None:
@@ -106,8 +87,6 @@ class FontFallbackParagraph(Paragraph):
         if not text:
             return True
         font = pdfmetrics.getFont(font_name)
-        if not isinstance(font, TTFont):
-            return True
         return all(
             ord(c) in font.face.charToGlyph or not c.isprintable()
             for c in text
@@ -123,24 +102,6 @@ class FontFallbackParagraph(Paragraph):
                 return family
 
 
-class PlainTextParagraph(FontFallbackParagraph):
-    def __init__(self, text, style=None, linebreaks=True, *args, **kwargs):
-        if not isinstance(text, str):
-            if hasattr(text, '__html__'):
-                raise ValueError("It is contradictory to pass escaped content to PlainTextParagraph")
-            text = str(text)
-
-        # Normalize unicode and apply reshaping
-        text = normalize_text(text)
-
-        # Escape any HTML in the text
-        text = escape(text)
-
-        if linebreaks:
-            text = text.strip().replace("\n", "<br />\n")
-        super().__init__(text, style, *args, **kwargs)
-
-
 def register_ttf_font_if_new(name, path):
     from reportlab.pdfbase import pdfmetrics
     from reportlab.pdfbase.ttfonts import TTFont

src/pretix/helpers/templatetags/wrap_in.py

@@ -1,33 +0,0 @@
-#
-# This file is part of pretix (Community Edition).
-#
-# Copyright (C) 2014-2020  Raphael Michel and contributors
-# Copyright (C) 2020-today pretix GmbH and contributors
-#
-# This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
-# Public License as published by the Free Software Foundation in version 3 of the License.
-#
-# ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are
-# applicable granting you additional permissions and placing additional restrictions on your usage of this software.
-# Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive
-# this file, see <https://pretix.eu/about/en/license>.
-#
-# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
-# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
-# details.
-#
-# You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
-# <https://www.gnu.org/licenses/>.
-#
-import logging
-
-from django import template
-from django.utils.html import format_html
-
-register = template.Library()
-logger = logging.getLogger(__name__)
-
-
-@register.filter
-def wrap_in(content, tag_name):
-    return format_html(f'<{tag_name}>{{}}</{tag_name}>', content)

src/pretix/locale/de/wordlist.txt

@@ -32,7 +32,6 @@ ausgecheckt
 ausgeklappt
 auswahl
 Authentication
-Authenticator
 Authenticator-App
 Autorisierungscode
 Autorisierungs-Endpunktes
@@ -131,7 +130,6 @@ Eingangsscan
 Einlassbuchung
 Einlassdatum
 Einlasskontrolle
-Einmalpasswörter
 einzuchecken
 email
 E-Mail-Renderer
@@ -165,7 +163,6 @@ Explorer
 FA
 Favicon
 F-Droid
-freeOTP
 Footer
 Footer-Link
 Footer-Text
@@ -560,7 +557,6 @@ Zahlungs-ID
 Zahlungspflichtig
 Zehnerkarten
 Zeitbasiert
-zeitbasierte
 Zeitslotbuchung
 Zimpler
 ZIP-Datei

src/pretix/locale/de_Informal/wordlist.txt

@@ -32,7 +32,6 @@ ausgecheckt
 ausgeklappt
 auswahl
 Authentication
-Authenticator
 Authenticator-App
 Autorisierungscode
 Autorisierungs-Endpunktes
@@ -131,7 +130,6 @@ Eingangsscan
 Einlassbuchung
 Einlassdatum
 Einlasskontrolle
-Einmalpasswörter
 einzuchecken
 email
 E-Mail-Renderer
@@ -165,7 +163,6 @@ Explorer
 FA
 Favicon
 F-Droid
-freeOTP
 Footer
 Footer-Link
 Footer-Text
@@ -560,7 +557,6 @@ Zahlungs-ID
 Zahlungspflichtig
 Zehnerkarten
 Zeitbasiert
-zeitbasierte
 Zeitslotbuchung
 Zimpler
 ZIP-Datei

src/pretix/locale/djangojs.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-03-30 11:25+0000\n"
+"POT-Creation-Date: 2026-03-17 14:06+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"

src/pretix/locale/es/LC_MESSAGES/djangojs.po

@@ -8,7 +8,7 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-03-17 14:06+0000\n"
-"PO-Revision-Date: 2026-03-30 03:00+0000\n"
+"PO-Revision-Date: 2026-03-18 12:23+0000\n"
 "Last-Translator: CVZ-es <damien.bremont@casadevelazquez.org>\n"
 "Language-Team: Spanish <https://translate.pretix.eu/projects/pretix/pretix-"
 "js/es/>\n"
@@ -329,7 +329,7 @@ msgstr "Pedido no aprobado"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:68
 msgid "Checked-in Tickets"
-msgstr "Billetes registrados"
+msgstr "Registro de código QR"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:69
 msgid "Valid Tickets"

src/pretix/locale/it/LC_MESSAGES/djangojs.po

@@ -8,8 +8,8 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-03-17 14:06+0000\n"
-"PO-Revision-Date: 2026-03-25 14:14+0000\n"
-"Last-Translator: Pietro Isotti <isottipietro@gmail.com>\n"
+"PO-Revision-Date: 2026-02-10 16:49+0000\n"
+"Last-Translator: Raffaele Doretto <ced@comune.portogruaro.ve.it>\n"
 "Language-Team: Italian <https://translate.pretix.eu/projects/pretix/pretix-"
 "js/it/>\n"
 "Language: it\n"
@@ -17,7 +17,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 5.16.2\n"
+"X-Generator: Weblate 5.15.2\n"
 
 #: pretix/plugins/banktransfer/static/pretixplugins/banktransfer/ui.js:56
 #: pretix/plugins/banktransfer/static/pretixplugins/banktransfer/ui.js:62
@@ -310,8 +310,9 @@ msgid "Ticket code revoked/changed"
 msgstr "Codice biglietto annullato/modificato"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
+#, fuzzy
 msgid "Ticket blocked"
-msgstr "Biglietto bloccato"
+msgstr "Biglietto non pagato"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
 msgid "Ticket not valid at this time"
@@ -428,7 +429,7 @@ msgstr ""
 
 #: pretix/static/pretixbase/js/asynctask.js:276
 msgid "If this takes longer than a few minutes, please contact us."
-msgstr "Se questa operazione richiede alcuni minuti, si prega di contattarci."
+msgstr ""
 
 #: pretix/static/pretixbase/js/asynctask.js:331
 msgid "Close message"

src/pretix/locale/ja/LC_MESSAGES/djangojs.po

@@ -8,7 +8,7 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-03-17 14:06+0000\n"
-"PO-Revision-Date: 2026-03-23 21:00+0000\n"
+"PO-Revision-Date: 2026-02-23 10:00+0000\n"
 "Last-Translator: Hijiri Umemoto <hijiri@umemoto.org>\n"
 "Language-Team: Japanese <https://translate.pretix.eu/projects/pretix/pretix-"
 "js/ja/>\n"
@@ -17,7 +17,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=1; plural=0;\n"
-"X-Generator: Weblate 5.16.2\n"
+"X-Generator: Weblate 5.16\n"
 
 #: pretix/plugins/banktransfer/static/pretixplugins/banktransfer/ui.js:56
 #: pretix/plugins/banktransfer/static/pretixplugins/banktransfer/ui.js:62
@@ -60,7 +60,7 @@ msgstr "PayPal後払い"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js:41
 msgid "iDEAL | Wero"
-msgstr "iDEAL | Wero"
+msgstr ""
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js:42
 msgid "SEPA Direct Debit"

src/pretix/locale/pt_BR/LC_MESSAGES/djangojs.po

@@ -8,7 +8,7 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-03-17 14:06+0000\n"
-"PO-Revision-Date: 2026-03-25 08:00+0000\n"
+"PO-Revision-Date: 2026-01-26 22:00+0000\n"
 "Last-Translator: Renne Rocha <renne@rocha.dev.br>\n"
 "Language-Team: Portuguese (Brazil) <https://translate.pretix.eu/projects/"
 "pretix/pretix-js/pt_BR/>\n"
@@ -17,7 +17,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n > 1;\n"
-"X-Generator: Weblate 5.16.2\n"
+"X-Generator: Weblate 5.15.2\n"
 
 #: pretix/plugins/banktransfer/static/pretixplugins/banktransfer/ui.js:56
 #: pretix/plugins/banktransfer/static/pretixplugins/banktransfer/ui.js:62
@@ -60,7 +60,7 @@ msgstr "PayPal Pay Later"
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js:41
 msgid "iDEAL | Wero"
-msgstr "iDEAL | Wero"
+msgstr ""
 
 #: pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js:42
 msgid "SEPA Direct Debit"

src/pretix/locale/sv/LC_MESSAGES/djangojs.po

@@ -8,7 +8,7 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-03-17 14:06+0000\n"
-"PO-Revision-Date: 2026-03-26 14:29+0000\n"
+"PO-Revision-Date: 2025-10-10 17:00+0000\n"
 "Last-Translator: Linnea Thelander <linnea@coeo.events>\n"
 "Language-Team: Swedish <https://translate.pretix.eu/projects/pretix/pretix-"
 "js/sv/>\n"
@@ -17,7 +17,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 5.16.2\n"
+"X-Generator: Weblate 5.13.3\n"
 
 #: pretix/plugins/banktransfer/static/pretixplugins/banktransfer/ui.js:56
 #: pretix/plugins/banktransfer/static/pretixplugins/banktransfer/ui.js:62
@@ -1023,6 +1023,7 @@ msgid "Waiting list"
 msgstr "Väntelista"
 
 #: pretix/static/pretixpresale/js/widget/widget.js:55
+#, fuzzy
 msgctxt "widget"
 msgid ""
 "You currently have an active cart for this event. If you select more "

src/pretix/locale/wordlist.txt

@@ -12,7 +12,6 @@ anonymized
 Auth
 authentification
 authenticator
-Authenticator
 automatical
 availabilities
 backend
@@ -23,7 +22,6 @@ barcodes
 Bcc
 BCC
 BezahlCode
-biometric
 BLIK
 blocklist
 BN
@@ -58,7 +56,6 @@ EPS
 eps
 favicon
 filetype
-freeOTP
 frontend
 frontpage
 Galician

src/pretix/plugins/checkinlists/exporters.py

@@ -64,7 +64,7 @@ from pretix.base.timeframes import (
 from pretix.control.forms.widgets import Select2
 from pretix.helpers.filenames import safe_for_filename
 from pretix.helpers.iter import chunked_iterable
-from pretix.helpers.reportlab import PlainTextParagraph
+from pretix.helpers.reportlab import FontFallbackParagraph
 from pretix.helpers.templatetags.jsonfield import JSONExtract
 from pretix.plugins.reports.exporters import ReportlabExportMixin
 
@@ -344,7 +344,7 @@ class PDFCheckinList(ReportlabExportMixin, CheckInListMixin, BaseExporter):
         ]
 
         story = [
-            PlainTextParagraph(
+            FontFallbackParagraph(
                 cl.name,
                 headlinestyle
             ),
@@ -352,7 +352,7 @@ class PDFCheckinList(ReportlabExportMixin, CheckInListMixin, BaseExporter):
         if cl.subevent:
             story += [
                 Spacer(1, 3 * mm),
-                PlainTextParagraph(
+                FontFallbackParagraph(
                     '{} ({} {})'.format(
                         cl.subevent.name,
                         cl.subevent.get_date_range_display(),
@@ -382,10 +382,10 @@ class PDFCheckinList(ReportlabExportMixin, CheckInListMixin, BaseExporter):
         headrowstyle.fontName = 'OpenSansBd'
         for q in questions:
             txt = str(q.question)
-            p = PlainTextParagraph(txt, headrowstyle)
+            p = FontFallbackParagraph(txt, headrowstyle)
             while p.wrap(colwidths[len(tdata[0])], 5000)[1] > 30 * mm:
                 txt = txt[:len(txt) - 50] + "..."
-                p = PlainTextParagraph(txt, headrowstyle)
+                p = FontFallbackParagraph(txt, headrowstyle)
             tdata[0].append(p)
 
         qs = self._get_queryset(cl, form_data)
@@ -432,8 +432,8 @@ class PDFCheckinList(ReportlabExportMixin, CheckInListMixin, BaseExporter):
                 CBFlowable(bool(op.last_checked_in)) if not op.blocked else '—',
                 '✘' if op.order.status != Order.STATUS_PAID else '✔',
                 op.order.code,
-                PlainTextParagraph(name, self.get_style()),
-                PlainTextParagraph(bleach.clean(str(item), tags={'br'}).strip().replace('<br>', '<br/>'), self.get_style()),
+                FontFallbackParagraph(name, self.get_style()),
+                FontFallbackParagraph(bleach.clean(str(item), tags={'br'}).strip().replace('<br>', '<br/>'), self.get_style()),
             ]
             acache = {}
             if op.addon_to:
@@ -444,10 +444,10 @@ class PDFCheckinList(ReportlabExportMixin, CheckInListMixin, BaseExporter):
             for q in questions:
                 txt = acache.get(q.pk, '')
                 txt = bleach.clean(txt, tags={'br'}).strip().replace('<br>', '<br/>')
-                p = PlainTextParagraph(txt, self.get_style())
+                p = FontFallbackParagraph(txt, self.get_style())
                 while p.wrap(colwidths[len(row)], 5000)[1] > 50 * mm:
                     txt = txt[:len(txt) - 50] + "..."
-                    p = PlainTextParagraph(txt, self.get_style())
+                    p = FontFallbackParagraph(txt, self.get_style())
                 row.append(p)
             if op.order.status != Order.STATUS_PAID:
                 tstyledata += [

src/pretix/plugins/reports/accountingreport.py

@@ -36,7 +36,7 @@ from reportlab.lib import colors, pagesizes
 from reportlab.lib.enums import TA_CENTER, TA_RIGHT
 from reportlab.lib.units import mm
 from reportlab.platypus import (
-    KeepTogether, PageTemplate, Spacer, Table, TableStyle,
+    KeepTogether, PageTemplate, Paragraph, Spacer, Table, TableStyle,
 )
 
 from pretix.base.exporter import BaseExporter
@@ -49,7 +49,7 @@ from pretix.base.timeframes import (
     resolve_timeframe_to_datetime_start_inclusive_end_exclusive,
 )
 from pretix.control.forms.filter import get_all_payment_providers
-from pretix.helpers.reportlab import PlainTextParagraph
+from pretix.helpers.reportlab import FontFallbackParagraph
 from pretix.plugins.reports.exporters import ReportlabExportMixin
 
 
@@ -311,13 +311,13 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
 
         tdata = [
             [
-                PlainTextParagraph(self._transaction_group_header_label(), tstyle_bold),
-                PlainTextParagraph(_("Price"), tstyle_bold_right),
-                PlainTextParagraph(_("Tax rate"), tstyle_bold_right),
-                PlainTextParagraph("#", tstyle_bold_right),
-                PlainTextParagraph(_("Net total"), tstyle_bold_right),
-                PlainTextParagraph(_("Tax total"), tstyle_bold_right),
-                PlainTextParagraph(_("Gross total"), tstyle_bold_right),
+                FontFallbackParagraph(self._transaction_group_header_label(), tstyle_bold),
+                FontFallbackParagraph(_("Price"), tstyle_bold_right),
+                FontFallbackParagraph(_("Tax rate"), tstyle_bold_right),
+                FontFallbackParagraph("#", tstyle_bold_right),
+                FontFallbackParagraph(_("Net total"), tstyle_bold_right),
+                FontFallbackParagraph(_("Tax total"), tstyle_bold_right),
+                FontFallbackParagraph(_("Gross total"), tstyle_bold_right),
             ]
         ]
 
@@ -347,12 +347,12 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
 
             if e != last_group:
                 if last_group_head_idx > 0 and e is not None:
-                    tdata[last_group_head_idx][4] = PlainTextParagraph(money_filter(sum_price_by_group - sum_tax_by_group, currency), tstyle_bold_right),
-                    tdata[last_group_head_idx][5] = PlainTextParagraph(money_filter(sum_tax_by_group, currency), tstyle_bold_right),
-                    tdata[last_group_head_idx][6] = PlainTextParagraph(money_filter(sum_price_by_group, currency), tstyle_bold_right),
+                    tdata[last_group_head_idx][4] = Paragraph(money_filter(sum_price_by_group - sum_tax_by_group, currency), tstyle_bold_right),
+                    tdata[last_group_head_idx][5] = Paragraph(money_filter(sum_tax_by_group, currency), tstyle_bold_right),
+                    tdata[last_group_head_idx][6] = Paragraph(money_filter(sum_price_by_group, currency), tstyle_bold_right),
                 tdata.append(
                     [
-                        PlainTextParagraph(
+                        FontFallbackParagraph(
                             e,
                             tstyle_bold,
                         ),
@@ -375,20 +375,20 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
             text = self._transaction_row_label(r)
             tdata.append(
                 [
-                    PlainTextParagraph(text, tstyle),
-                    PlainTextParagraph(
+                    FontFallbackParagraph(text, tstyle),
+                    Paragraph(
                         money_filter(r["price"], currency)
                         if "price" in r and r["price"] is not None
                         else "",
                         tstyle_right,
                     ),
-                    PlainTextParagraph(localize(r["tax_rate"].normalize()) + " %", tstyle_right),
-                    PlainTextParagraph(str(r["sum_cont"]), tstyle_right),
-                    PlainTextParagraph(
+                    Paragraph(localize(r["tax_rate"].normalize()) + " %", tstyle_right),
+                    Paragraph(str(r["sum_cont"]), tstyle_right),
+                    Paragraph(
                         money_filter(r["sum_price"] - r["sum_tax"], currency), tstyle_right
                     ),
-                    PlainTextParagraph(money_filter(r["sum_tax"], currency), tstyle_right),
-                    PlainTextParagraph(money_filter(r["sum_price"], currency), tstyle_right),
+                    Paragraph(money_filter(r["sum_tax"], currency), tstyle_right),
+                    Paragraph(money_filter(r["sum_price"], currency), tstyle_right),
                 ]
             )
             sum_cnt_by_tax_rate[r["tax_rate"]] += r["sum_cont"]
@@ -398,19 +398,19 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
             sum_tax_by_group += r["sum_tax"]
 
         if last_group_head_idx > 0 and last_group is not None:
-            tdata[last_group_head_idx][4] = PlainTextParagraph(money_filter(sum_price_by_group - sum_tax_by_group, currency), tstyle_bold_right),
-            tdata[last_group_head_idx][5] = PlainTextParagraph(money_filter(sum_tax_by_group, currency), tstyle_bold_right),
-            tdata[last_group_head_idx][6] = PlainTextParagraph(money_filter(sum_price_by_group, currency), tstyle_bold_right),
+            tdata[last_group_head_idx][4] = Paragraph(money_filter(sum_price_by_group - sum_tax_by_group, currency), tstyle_bold_right),
+            tdata[last_group_head_idx][5] = Paragraph(money_filter(sum_tax_by_group, currency), tstyle_bold_right),
+            tdata[last_group_head_idx][6] = Paragraph(money_filter(sum_price_by_group, currency), tstyle_bold_right),
 
         if len(sum_tax_by_tax_rate) > 1:
             for tax_rate in sorted(sum_tax_by_tax_rate.keys(), reverse=True):
                 tdata.append(
                     [
-                        PlainTextParagraph(_("Sum"), tstyle),
-                        PlainTextParagraph("", tstyle_right),
-                        PlainTextParagraph(localize(tax_rate.normalize()) + " %", tstyle_right),
-                        PlainTextParagraph("", tstyle_right),
-                        PlainTextParagraph(
+                        FontFallbackParagraph(_("Sum"), tstyle),
+                        Paragraph("", tstyle_right),
+                        Paragraph(localize(tax_rate.normalize()) + " %", tstyle_right),
+                        Paragraph("", tstyle_right),
+                        Paragraph(
                             money_filter(
                                 sum_price_by_tax_rate[tax_rate]
                                 - sum_tax_by_tax_rate[tax_rate],
@@ -418,10 +418,10 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
                             ),
                             tstyle_right,
                         ),
-                        PlainTextParagraph(
+                        Paragraph(
                             money_filter(sum_tax_by_tax_rate[tax_rate], currency), tstyle_right
                         ),
-                        PlainTextParagraph(
+                        Paragraph(
                             money_filter(sum_price_by_tax_rate[tax_rate], currency),
                             tstyle_right,
                         ),
@@ -439,11 +439,11 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
 
         tdata.append(
             [
-                PlainTextParagraph(_("Sum"), tstyle_bold),
-                PlainTextParagraph("", tstyle_right),
-                PlainTextParagraph("", tstyle_right),
-                PlainTextParagraph("", tstyle_bold_right),
-                PlainTextParagraph(
+                FontFallbackParagraph(_("Sum"), tstyle_bold),
+                Paragraph("", tstyle_right),
+                Paragraph("", tstyle_right),
+                Paragraph("", tstyle_bold_right),
+                Paragraph(
                     money_filter(
                         sum(sum_price_by_tax_rate.values())
                         - sum(sum_tax_by_tax_rate.values()),
@@ -451,11 +451,11 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
                     ),
                     tstyle_bold_right,
                 ),
-                PlainTextParagraph(
+                Paragraph(
                     money_filter(sum(sum_tax_by_tax_rate.values()), currency),
                     tstyle_bold_right,
                 ),
-                PlainTextParagraph(
+                Paragraph(
                     money_filter(sum(sum_price_by_tax_rate.values()), currency),
                     tstyle_bold_right,
                 ),
@@ -493,10 +493,10 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
 
         tdata = [
             [
-                PlainTextParagraph(_("Payment method"), tstyle_bold),
-                PlainTextParagraph(_("Payments"), tstyle_bold_right),
-                PlainTextParagraph(_("Refunds"), tstyle_bold_right),
-                PlainTextParagraph(_("Total"), tstyle_bold_right),
+                FontFallbackParagraph(_("Payment method"), tstyle_bold),
+                FontFallbackParagraph(_("Payments"), tstyle_bold_right),
+                FontFallbackParagraph(_("Refunds"), tstyle_bold_right),
+                FontFallbackParagraph(_("Total"), tstyle_bold_right),
             ]
         ]
 
@@ -537,20 +537,20 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
         for p in providers:
             tdata.append(
                 [
-                    PlainTextParagraph(provider_names.get(p, p), tstyle),
-                    PlainTextParagraph(
+                    Paragraph(provider_names.get(p, p), tstyle),
+                    FontFallbackParagraph(
                         money_filter(payments_by_provider[p], currency)
                         if p in payments_by_provider
                         else "",
                         tstyle_right,
                     ),
-                    PlainTextParagraph(
+                    Paragraph(
                         money_filter(refunds_by_provider[p], currency)
                         if p in refunds_by_provider
                         else "",
                         tstyle_right,
                     ),
-                    PlainTextParagraph(
+                    Paragraph(
                         money_filter(
                             payments_by_provider.get(p, Decimal("0.00"))
                             - refunds_by_provider.get(p, Decimal("0.00")),
@@ -563,20 +563,20 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
 
         tdata.append(
             [
-                PlainTextParagraph(_("Sum"), tstyle_bold),
-                PlainTextParagraph(
+                FontFallbackParagraph(_("Sum"), tstyle_bold),
+                Paragraph(
                     money_filter(
                         sum(payments_by_provider.values(), Decimal("0.00")), currency
                     ),
                     tstyle_bold_right,
                 ),
-                PlainTextParagraph(
+                Paragraph(
                     money_filter(
                         sum(refunds_by_provider.values(), Decimal("0.00")), currency
                     ),
                     tstyle_bold_right,
                 ),
-                PlainTextParagraph(
+                Paragraph(
                     money_filter(
                         sum(payments_by_provider.values(), Decimal("0.00"))
                         - sum(refunds_by_provider.values(), Decimal("0.00")),
@@ -641,7 +641,7 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
             open_before = tx_before - p_before + r_before
             tdata.append(
                 [
-                    PlainTextParagraph(
+                    FontFallbackParagraph(
                         _("Pending payments at {datetime}").format(
                             datetime=date_format(
                                 (df_start - datetime.timedelta.resolution).astimezone(
@@ -653,7 +653,7 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
                         tstyle,
                     ),
                     "",
-                    PlainTextParagraph(money_filter(open_before, currency), tstyle_right),
+                    Paragraph(money_filter(open_before, currency), tstyle_right),
                 ]
             )
         else:
@@ -670,30 +670,30 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
         ] or Decimal("0.00")
         tdata.append(
             [
-                PlainTextParagraph(_("Orders"), tstyle),
-                PlainTextParagraph("+", tstyle_center),
-                PlainTextParagraph(money_filter(tx_during, currency), tstyle_right),
+                FontFallbackParagraph(_("Orders"), tstyle),
+                Paragraph("+", tstyle_center),
+                Paragraph(money_filter(tx_during, currency), tstyle_right),
             ]
         )
         tdata.append(
             [
-                PlainTextParagraph(_("Payments"), tstyle),
-                PlainTextParagraph("-", tstyle_center),
-                PlainTextParagraph(money_filter(p_during, currency), tstyle_right),
+                FontFallbackParagraph(_("Payments"), tstyle),
+                Paragraph("-", tstyle_center),
+                Paragraph(money_filter(p_during, currency), tstyle_right),
             ]
         )
         tdata.append(
             [
-                PlainTextParagraph(_("Refunds"), tstyle),
-                PlainTextParagraph("+", tstyle_center),
-                PlainTextParagraph(money_filter(r_during, currency), tstyle_right),
+                FontFallbackParagraph(_("Refunds"), tstyle),
+                Paragraph("+", tstyle_center),
+                Paragraph(money_filter(r_during, currency), tstyle_right),
             ]
         )
 
         open_after = open_before + tx_during - p_during + r_during
         tdata.append(
             [
-                PlainTextParagraph(
+                Paragraph(
                     _("Pending payments at {datetime}").format(
                         datetime=date_format(
                             ((df_end or now()) - datetime.timedelta.resolution).astimezone(
@@ -704,8 +704,8 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
                     ),
                     tstyle_bold,
                 ),
-                PlainTextParagraph("=", tstyle_center),
-                PlainTextParagraph(money_filter(open_after, currency), tstyle_bold_right),
+                Paragraph("=", tstyle_center),
+                Paragraph(money_filter(open_after, currency), tstyle_bold_right),
             ]
         )
         tstyledata += [
@@ -752,7 +752,7 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
             )
             tdata.append(
                 [
-                    PlainTextParagraph(
+                    Paragraph(
                         _("Total gift card value at {datetime}").format(
                             datetime=date_format(
                                 (df_start - datetime.timedelta.resolution).astimezone(
@@ -763,7 +763,7 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
                         ),
                         tstyle,
                     ),
-                    PlainTextParagraph(money_filter(tx_before, currency), tstyle_right),
+                    Paragraph(money_filter(tx_before, currency), tstyle_right),
                 ]
             )
         else:
@@ -774,8 +774,8 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
         ] or Decimal("0.00")
         tdata.append(
             [
-                PlainTextParagraph(_("Gift card transactions (credit)"), tstyle),
-                PlainTextParagraph(money_filter(tx_during_pos, currency), tstyle_right),
+                FontFallbackParagraph(_("Gift card transactions (credit)"), tstyle),
+                Paragraph(money_filter(tx_during_pos, currency), tstyle_right),
             ]
         )
 
@@ -784,15 +784,15 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
         ] or Decimal("0.00")
         tdata.append(
             [
-                PlainTextParagraph(_("Gift card transactions (debit)"), tstyle),
-                PlainTextParagraph(money_filter(tx_during_neg, currency), tstyle_right),
+                FontFallbackParagraph(_("Gift card transactions (debit)"), tstyle),
+                Paragraph(money_filter(tx_during_neg, currency), tstyle_right),
             ]
         )
 
         open_after = tx_before + tx_during_pos + tx_during_neg
         tdata.append(
             [
-                PlainTextParagraph(
+                Paragraph(
                     _("Total gift card value at {datetime}").format(
                         datetime=date_format(
                             ((df_end or now()) - datetime.timedelta.resolution).astimezone(
@@ -803,7 +803,7 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
                     ),
                     tstyle_bold,
                 ),
-                PlainTextParagraph(money_filter(open_after, currency), tstyle_bold_right),
+                Paragraph(money_filter(open_after, currency), tstyle_bold_right),
             ]
         )
         tstyledata += [
@@ -854,10 +854,10 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
             style_small.leading = 10
 
             story = [
-                PlainTextParagraph(self.verbose_name, style_h1),
+                FontFallbackParagraph(self.verbose_name, style_h1),
                 Spacer(0, 3 * mm),
-                PlainTextParagraph(
-                    "\n".join(escape(f) for f in self.describe_filters(form_data)),
+                FontFallbackParagraph(
+                    "<br />".join(escape(f) for f in self.describe_filters(form_data)),
                     style_small,
                 ),
             ]
@@ -870,7 +870,7 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
                 if s:
                     story += [
                         Spacer(0, 3 * mm),
-                        PlainTextParagraph(_("Orders") + c_head, style_h2),
+                        FontFallbackParagraph(_("Orders") + c_head, style_h2),
                         Spacer(0, 3 * mm),
                         *s
                     ]
@@ -881,7 +881,7 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
                 if s:
                     story += [
                         Spacer(0, 8 * mm),
-                        PlainTextParagraph(_("Payments") + c_head, style_h2),
+                        FontFallbackParagraph(_("Payments") + c_head, style_h2),
                         Spacer(0, 3 * mm),
                         *s
                     ]
@@ -894,7 +894,7 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
                         Spacer(0, 8 * mm),
                         KeepTogether(
                             [
-                                PlainTextParagraph(_("Open items") + c_head, style_h2),
+                                FontFallbackParagraph(_("Open items") + c_head, style_h2),
                                 Spacer(0, 3 * mm),
                                 *s
                             ]
@@ -912,7 +912,7 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
                             Spacer(0, 8 * mm),
                             KeepTogether(
                                 [
-                                    PlainTextParagraph(_("Gift cards") + c_head, style_h2),
+                                    FontFallbackParagraph(_("Gift cards") + c_head, style_h2),
                                     Spacer(0, 3 * mm),
                                     *s,
                                 ]

src/pretix/plugins/reports/exporters.py

@@ -70,7 +70,7 @@ from pretix.base.timeframes import (
 )
 from pretix.control.forms.filter import OverviewFilterForm
 from pretix.helpers.reportlab import (
-    PlainTextParagraph, register_ttf_font_if_new,
+    FontFallbackParagraph, register_ttf_font_if_new,
 )
 from pretix.presale.style import get_fonts
 
@@ -282,7 +282,7 @@ class OverviewReport(Report):
         headlinestyle.fontSize = 15
         headlinestyle.fontName = 'OpenSansBd'
         story = [
-            PlainTextParagraph(_('Orders by product') + ' ' + (_('(excl. taxes)') if net else _('(incl. taxes)')), headlinestyle),
+            FontFallbackParagraph(_('Orders by product') + ' ' + (_('(excl. taxes)') if net else _('(incl. taxes)')), headlinestyle),
             Spacer(1, 5 * mm)
         ]
         return story
@@ -292,7 +292,7 @@ class OverviewReport(Report):
         if form_data.get('date_axis') and form_data.get('date_range'):
             d_start, d_end = resolve_timeframe_to_dates_inclusive(now(), form_data['date_range'], self.timezone)
             story += [
-                PlainTextParagraph(_('{axis} between {start} and {end}').format(
+                FontFallbackParagraph(_('{axis} between {start} and {end}').format(
                     axis=dict(OverviewFilterForm(event=self.event).fields['date_axis'].choices)[form_data.get('date_axis')],
                     start=date_format(d_start, 'SHORT_DATE_FORMAT') if d_start else '–',
                     end=date_format(d_end, 'SHORT_DATE_FORMAT') if d_end else '–',
@@ -305,13 +305,13 @@ class OverviewReport(Report):
                 subevent = self.event.subevents.get(pk=self.form_data.get('subevent'))
             except SubEvent.DoesNotExist:
                 subevent = self.form_data.get('subevent')
-            story.append(PlainTextParagraph(pgettext('subevent', 'Date: {}').format(subevent), self.get_style()))
+            story.append(FontFallbackParagraph(pgettext('subevent', 'Date: {}').format(subevent), self.get_style()))
             story.append(Spacer(1, 5 * mm))
 
         if form_data.get('subevent_date_range'):
             d_start, d_end = resolve_timeframe_to_datetime_start_inclusive_end_exclusive(now(), form_data['subevent_date_range'], self.timezone)
             story += [
-                PlainTextParagraph(_('{axis} between {start} and {end}').format(
+                FontFallbackParagraph(_('{axis} between {start} and {end}').format(
                     axis=_('Event date'),
                     start=date_format(d_start, 'SHORT_DATE_FORMAT') if d_start else '–',
                     end=date_format(d_end - timedelta(hours=1), 'SHORT_DATE_FORMAT') if d_end else '–',
@@ -384,13 +384,13 @@ class OverviewReport(Report):
         tdata = [
             [
                 _('Product'),
-                PlainTextParagraph(_('Canceled'), tstyle_th),
+                FontFallbackParagraph(_('Canceled'), tstyle_th),
                 '',
-                PlainTextParagraph(_('Expired'), tstyle_th),
+                FontFallbackParagraph(_('Expired'), tstyle_th),
                 '',
-                PlainTextParagraph(_('Approval pending'), tstyle_th),
+                FontFallbackParagraph(_('Approval pending'), tstyle_th),
                 '',
-                PlainTextParagraph(_('Purchased'), tstyle_th),
+                FontFallbackParagraph(_('Purchased'), tstyle_th),
                 '', '', '', '', ''
             ],
             [
@@ -421,14 +421,14 @@ class OverviewReport(Report):
         for tup in items_by_category:
             if tup[0]:
                 tdata.append([
-                    PlainTextParagraph(str(tup[0]), tstyle_bold)
+                    FontFallbackParagraph(str(tup[0]), tstyle_bold)
                 ])
                 for l, s in states:
                     tdata[-1].append(str(tup[0].num[l][0]))
                     tdata[-1].append(floatformat(tup[0].num[l][2 if net else 1], places))
             for item in tup[1]:
                 tdata.append([
-                    PlainTextParagraph(str(item), tstyle)
+                    FontFallbackParagraph(str(item), tstyle)
                 ])
                 for l, s in states:
                     tdata[-1].append(str(item.num[l][0]))
@@ -436,7 +436,7 @@ class OverviewReport(Report):
                 if item.has_variations:
                     for var in item.all_variations:
                         tdata.append([
-                            PlainTextParagraph("          " + str(var), tstyle)
+                            FontFallbackParagraph("          " + str(var), tstyle)
                         ])
                         for l, s in states:
                             tdata[-1].append(str(var.num[l][0]))
@@ -568,7 +568,7 @@ class OrderTaxListReportPDF(Report):
             tstyledata.append(('SPAN', (5 + 2 * i, 0), (6 + 2 * i, 0)))
 
         story = [
-            PlainTextParagraph(_('Orders by tax rate ({currency})').format(currency=self.event.currency), headlinestyle),
+            FontFallbackParagraph(_('Orders by tax rate ({currency})').format(currency=self.event.currency), headlinestyle),
             Spacer(1, 5 * mm)
         ]
         tdata = [

src/pretix/plugins/ticketoutputpdf/api.py

@@ -229,11 +229,6 @@ class TicketRendererViewSet(viewsets.ViewSet):
     @action(detail=False, methods=['GET'], url_name='download', url_path='download/(?P<asyncid>[^/]+)/(?P<cfid>[^/]+)')
     def download(self, *args, **kwargs):
         cf = get_object_or_404(CachedFile, id=kwargs['cfid'])
-        if not cf.allowed_for_session(self.request, "ticketoutputpdf-api"):
-            return Response(
-                {'status': 'failed', 'message': 'Unknown file ID or export failed'},
-                status=status.HTTP_410_GONE
-            )
         if cf.file:
             resp = ChunkBasedFileResponse(cf.file.file, content_type=cf.type)
             resp['Content-Disposition'] = 'attachment; filename="{}"'.format(cf.filename).encode("ascii", "ignore")
@@ -270,7 +265,6 @@ class TicketRendererViewSet(viewsets.ViewSet):
         serializer.is_valid(raise_exception=True)
 
         cf = CachedFile(web_download=False)
-        cf.bind_to_session(self.request, "ticketoutputpdf-api")
         cf.date = now()
         cf.expires = now() + timedelta(hours=24)
         cf.save()

src/pretix/presale/checkoutflow.py

@@ -50,7 +50,6 @@ from django.http import HttpResponseNotAllowed, JsonResponse
 from django.shortcuts import redirect
 from django.utils import translation
 from django.utils.functional import cached_property
-from django.utils.html import conditional_escape
 from django.utils.translation import (
     get_language, gettext_lazy as _, pgettext_lazy,
 )
@@ -1615,7 +1614,7 @@ class ConfirmStep(CartMixin, AsyncAction, TemplateFlowStep):
         meta_info = {
             'contact_form_data': self.cart_session.get('contact_form_data', {}),
             'confirm_messages': [
-                conditional_escape(str(m)) for m in self.confirm_messages.values()
+                str(m) for m in self.confirm_messages.values()
             ]
         }
         api_meta = {}

src/pretix/presale/forms/checkout.py

@@ -32,11 +32,8 @@
 # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 # License for the specific language governing permissions and limitations under the License.
 
-from itertools import chain
-
 from django import forms
 from django.core.exceptions import ValidationError
-from django.utils.encoding import force_str
 from django.utils.formats import date_format
 from django.utils.html import escape
 from django.utils.safestring import mark_safe
@@ -168,46 +165,6 @@ class QuestionsForm(BaseQuestionsForm):
             )
 
 
-class AddOnRadioSelect(forms.RadioSelect):
-    option_template_name = 'pretixpresale/forms/addon_choice_option.html'
-
-    def optgroups(self, name, value, attrs=None):
-        attrs = attrs or {}
-        groups = []
-        has_selected = False
-        for index, (option_value, option_label, option_desc) in enumerate(chain(self.choices)):
-            if option_value is None:
-                option_value = ''
-            if isinstance(option_label, (list, tuple)):
-                raise TypeError('Choice groups are not supported here')
-            group_name = None
-            subgroup = []
-            groups.append((group_name, subgroup, index))
-
-            selected = (
-                force_str(option_value) in value and
-                (has_selected is False or self.allow_multiple_selected)
-            )
-            if selected is True and has_selected is False:
-                has_selected = True
-            attrs['description'] = option_desc
-            subgroup.append(self.create_option(
-                name, option_value, option_label, selected, index,
-                subindex=None, attrs=attrs,
-            ))
-
-        return groups
-
-
-class AddOnVariationField(forms.ChoiceField):
-    def valid_value(self, value):
-        text_value = force_str(value)
-        for k, v, d in self.choices:
-            if value == k or text_value == force_str(k):
-                return True
-        return False
-
-
 class MembershipForm(forms.Form):
     required_css_class = 'required'
 

src/pretix/presale/forms/customer.py

@@ -28,7 +28,7 @@ from django import forms
 from django.conf import settings
 from django.contrib.auth.hashers import check_password
 from django.contrib.auth.password_validation import (
-    MinimumLengthValidator, get_password_validators, validate_password,
+    get_password_validators, password_validators_help_texts, validate_password,
 )
 from django.contrib.auth.tokens import PasswordResetTokenGenerator
 from django.core import signing
@@ -300,12 +300,13 @@ class SetPasswordForm(forms.Form):
     )
     password = forms.CharField(
         label=_('Password'),
-        widget=forms.PasswordInput(attrs={'autocomplete': 'new-password'}),
+        widget=forms.PasswordInput(attrs={'minlength': '8', 'autocomplete': 'new-password'}),
         max_length=4096,
+        required=True
     )
     password_repeat = forms.CharField(
         label=_('Repeat password'),
-        widget=forms.PasswordInput(attrs={'autocomplete': 'new-password'}),
+        widget=forms.PasswordInput(attrs={'minlength': '8', 'autocomplete': 'new-password'}),
         max_length=4096,
     )
 
@@ -315,14 +316,6 @@ class SetPasswordForm(forms.Form):
         kwargs['initial']['email'] = self.customer.email
         super().__init__(*args, **kwargs)
 
-        pw_min_len_validators = [v for v in get_customer_password_validators() if isinstance(v, MinimumLengthValidator)]
-        if pw_min_len_validators:
-            self.fields['password'].widget.attrs['minlength'] = max(v.min_length for v in pw_min_len_validators)
-            self.fields['password_repeat'].widget.attrs['minlength'] = max(v.min_length for v in pw_min_len_validators)
-
-        if 'password' not in self.data:
-            self.fields['password'].help_text = ' '.join(v.get_help_text() for v in pw_min_len_validators)
-
     def clean(self):
         password1 = self.cleaned_data.get('password', '')
         password2 = self.cleaned_data.get('password_repeat')
@@ -336,7 +329,8 @@ class SetPasswordForm(forms.Form):
 
     def clean_password(self):
         password1 = self.cleaned_data.get('password', '')
-        validate_password(password1, user=self.customer, password_validators=get_customer_password_validators())
+        if validate_password(password1, user=self.customer, password_validators=get_customer_password_validators()) is not None:
+            raise forms.ValidationError(_(password_validators_help_texts()), code='pw_invalid')
         return password1
 
 
@@ -401,13 +395,13 @@ class ChangePasswordForm(forms.Form):
     )
     password = forms.CharField(
         label=_('New password'),
-        widget=forms.PasswordInput(attrs={'autocomplete': 'new-password'}),
+        widget=forms.PasswordInput(attrs={'minlength': '8', 'autocomplete': 'new-password'}),
         max_length=4096,
         required=True
     )
     password_repeat = forms.CharField(
         label=_('Repeat password'),
-        widget=forms.PasswordInput(attrs={'autocomplete': 'new-password'}),
+        widget=forms.PasswordInput(attrs={'minlength': '8', 'autocomplete': 'new-password'}),
         max_length=4096,
     )
 
@@ -417,14 +411,6 @@ class ChangePasswordForm(forms.Form):
         kwargs['initial']['email'] = self.customer.email
         super().__init__(*args, **kwargs)
 
-        pw_min_len_validators = [v for v in get_customer_password_validators() if isinstance(v, MinimumLengthValidator)]
-        if pw_min_len_validators:
-            self.fields['password'].widget.attrs['minlength'] = max(v.min_length for v in pw_min_len_validators)
-            self.fields['password_repeat'].widget.attrs['minlength'] = max(v.min_length for v in pw_min_len_validators)
-
-        if 'password' not in self.data:
-            self.fields['password'].help_text = ' '.join(v.get_help_text() for v in pw_min_len_validators)
-
     def clean(self):
         password1 = self.cleaned_data.get('password', '')
         password2 = self.cleaned_data.get('password_repeat')
@@ -438,7 +424,8 @@ class ChangePasswordForm(forms.Form):
 
     def clean_password(self):
         password1 = self.cleaned_data.get('password', '')
-        validate_password(password1, user=self.customer, password_validators=get_customer_password_validators())
+        if validate_password(password1, user=self.customer, password_validators=get_customer_password_validators()) is not None:
+            raise forms.ValidationError(_(password_validators_help_texts()), code='pw_invalid')
         return password1
 
     def clean_password_current(self):

src/pretix/presale/signals.py

@@ -144,7 +144,7 @@ checkout_confirm_messages = EventPluginSignal()
 This signal is sent out to retrieve short messages that need to be acknowledged by the user before the
 order can be completed. This is typically used for something like "accept the terms and conditions".
 Receivers are expected to return a dictionary where the keys are globally unique identifiers for the
-message and the values can be a SafeString containing arbitrary HTML, or a string that will be HTML-escaped.
+message and the values can be arbitrary HTML.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 """

src/pretix/presale/templates/pretixpresale/event/checkout_confirm.html

@@ -176,7 +176,7 @@
                         <div class="checkbox">
                             <label for="input_confirm_{{ key }}">
                                 <input type="checkbox" class="checkbox" value="yes" name="confirm_{{ key }}" id="input_confirm_{{ key }}" required>
-                                {{ desc }}
+                                {{ desc|safe }}
                             </label>
                         </div>
                     {% endfor %}

src/pretix/presale/templates/pretixpresale/event/position.html

@@ -4,7 +4,6 @@
 {% load eventsignal %}
 {% load money %}
 {% load eventurl %}
-{% load wrap_in %}
 {% block title %}{% trans "Registration details" %}{% endblock %}
 {% block content %}
     <h2 class="h1">
@@ -49,7 +48,7 @@
         </div>
         <div class="panel-body">
             <p>
-                {% blocktrans trimmed with email=order.email|wrap_in:"strong" %}
+                {% blocktrans trimmed with email="<strong>"|add:order.email|add:"</strong>"|safe %}
                     This order is managed for you by {{ email }}. Please contact them for any questions regarding
                     payment, cancellation or changes to this order.
                 {% endblocktrans %}

src/pretix/presale/templates/pretixpresale/forms/addon_choice_option.html

@@ -1,3 +0,0 @@
-{% load rich_text %}
-<label{% if widget.attrs.id %} for="{{ widget.attrs.id }}"{% endif %}>{% include "django/forms/widgets/input.html" %} {{ widget.label }}</label> {% if widget.attrs.description %}<span class="fa fa-info-circle toggle-variation-description" aria-hidden="true"></span>
-<div class="variation-description addon-variation-description">{{ widget.attrs.description|rich_text }}</div>{% endif %}

src/tests/helpers/test_reportlab.py

@@ -1,50 +0,0 @@
-#
-# This file is part of pretix (Community Edition).
-#
-# Copyright (C) 2014-2020  Raphael Michel and contributors
-# Copyright (C) 2020-today pretix GmbH and contributors
-#
-# This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
-# Public License as published by the Free Software Foundation in version 3 of the License.
-#
-# ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are
-# applicable granting you additional permissions and placing additional restrictions on your usage of this software.
-# Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive
-# this file, see <https://pretix.eu/about/en/license>.
-#
-# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
-# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
-# details.
-#
-# You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
-# <https://www.gnu.org/licenses/>.
-#
-import pytest
-from django.core.exceptions import SuspiciousFileOperation
-from reportlab.platypus import Paragraph
-
-
-def test_http_access_disabled(monkeypatch):
-    def guard(*args, **kwargs):
-        pytest.fail("No internet wanted!")
-
-    monkeypatch.setattr('socket.socket', guard)
-
-    with pytest.raises(SuspiciousFileOperation, match="should not be reading images from disk"):
-        Paragraph(
-            '<img src="https://static.pretix.cloud/static/pretixeu/img/opengraph.png"/>',
-        )
-
-
-def test_file_access_disabled_scheme(monkeypatch):
-    with pytest.raises(SuspiciousFileOperation, match="should not be reading images from disk"):
-        Paragraph(
-            '<img src="file:///etc/passwd" />',
-        )
-
-
-def test_file_access_disabled_direct(monkeypatch):
-    with pytest.raises(SuspiciousFileOperation, match="should not be reading images from disk"):
-        Paragraph(
-            '<img src="/etc/passwd" />',
-        )