Bump version to 4.17.0

Currently translated at 33.6% (1740 of 5177 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/da/

powered by weblate

.github/workflows/docs.yml

@@ -26,10 +26,10 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v2
-      - name: Set up Python 3.9
+      - name: Set up Python 3.11
         uses: actions/setup-python@v1
         with:
-          python-version: 3.9
+          python-version: 3.11
       - uses: actions/cache@v1
         with:
           path: ~/.cache/pip

.github/workflows/strings.yml

@@ -24,10 +24,10 @@ jobs:
     name: Check gettext syntax
     steps:
       - uses: actions/checkout@v2
-      - name: Set up Python 3.9
+      - name: Set up Python 3.11
         uses: actions/setup-python@v1
         with:
-          python-version: 3.9
+          python-version: 3.11
       - uses: actions/cache@v1
         with:
           path: ~/.cache/pip
@@ -50,10 +50,10 @@ jobs:
     name: Spellcheck
     steps:
       - uses: actions/checkout@v2
-      - name: Set up Python 3.9
+      - name: Set up Python 3.11
         uses: actions/setup-python@v1
         with:
-          python-version: 3.9
+          python-version: 3.11
       - uses: actions/cache@v1
         with:
           path: ~/.cache/pip

.github/workflows/style.yml

@@ -24,10 +24,10 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v2
-      - name: Set up Python 3.9
+      - name: Set up Python 3.11
         uses: actions/setup-python@v1
         with:
-          python-version: 3.9
+          python-version: 3.11
       - uses: actions/cache@v1
         with:
           path: ~/.cache/pip
@@ -45,10 +45,10 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v2
-      - name: Set up Python 3.9
+      - name: Set up Python 3.11
         uses: actions/setup-python@v1
         with:
-          python-version: 3.9
+          python-version: 3.11
       - uses: actions/cache@v1
         with:
           path: ~/.cache/pip
@@ -66,10 +66,10 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v2
-      - name: Set up Python 3.9
+      - name: Set up Python 3.11
         uses: actions/setup-python@v1
         with:
-          python-version: 3.9
+          python-version: 3.11
       - name: Install Dependencies
         run: pip3 install licenseheaders
       - name: Run licenseheaders

.github/workflows/tests.yml

@@ -24,22 +24,22 @@ jobs:
     name: Tests
     strategy:
       matrix:
-        python-version: ["3.7", "3.9", "3.10"]
+        python-version: ["3.9", "3.10", "3.11"]
         database: [sqlite, postgres, mysql]
         exclude:
-          - database: mysql
-            python-version: "3.10"
           - database: mysql
             python-version: "3.9"
+          - database: mysql
+            python-version: "3.11"
           - database: sqlite
-            python-version: "3.7"
+            python-version: "3.9"
           - database: sqlite
             python-version: "3.10"
     steps:
       - uses: actions/checkout@v2
       - uses: getong/mariadb-action@v1.1
         with:
-          mariadb version: '10.4'
+          mariadb version: '10.10'
           mysql database: 'pretix'
           mysql root password: ''
         if: matrix.database == 'mysql'
@@ -83,4 +83,4 @@ jobs:
           file: src/coverage.xml
           token: ${{ secrets.CODECOV_TOKEN }}
           fail_ci_if_error: true
-        if: matrix.database == 'postgres' && matrix.python-version == '3.10'
+        if: matrix.database == 'postgres' && matrix.python-version == '3.11'

Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.9-bullseye
+FROM python:3.11-bullseye
 
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \

doc/_themes/pretix_theme/layout.html

@@ -18,67 +18,82 @@
   <title>{{ title|striptags|e }}{{ titlesuffix }}</title>
   {% endblock %}
 
-  {# FAVICON #}
-  {% if favicon %}
-    <link rel="shortcut icon" href="{{ pathto('_static/' + favicon, 1) }}"/>
-  {% endif %}
-  {# CANONICAL URL #}
-  {% if theme_canonical_url %}
+
+  {#- CSS #}
+  {%- for css in css_files %}
+    {%- if css|attr("rel") %}
+      <link rel="{{ css.rel }}" href="{{ pathto(css.filename, 1) }}" type="text/css"{% if css.title is not none %} title="{{ css.title }}"{% endif %} />
+    {%- else %}
+      <link rel="stylesheet" href="{{ pathto(css, 1) }}" type="text/css" />
+    {%- endif %}
+  {%- endfor %}
+
+  {%- for cssfile in extra_css_files %}
+    <link rel="stylesheet" href="{{ pathto(cssfile, 1) }}" type="text/css" />
+  {%- endfor -%}
+
+  {#- FAVICON
+      favicon_url is the only context var necessary since Sphinx 4.
+      In Sphinx<4, we use favicon but need to prepend path info.
+  #}
+  {%- set _favicon_url = favicon_url | default(pathto('_static/' + (favicon or ""), 1)) %}
+  {%- if favicon_url or favicon %}
+    <link rel="shortcut icon" href="{{ _favicon_url }}"/>
+  {%- endif %}
+
+  {#- CANONICAL URL (deprecated) #}
+  {%- if theme_canonical_url and not pageurl %}
     <link rel="canonical" href="{{ theme_canonical_url }}{{ pagename }}.html"/>
-  {% endif %}
+  {%- endif -%}
 
-  {# CSS #}
+  {#- CANONICAL URL #}
+  {%- if pageurl %}
+    <link rel="canonical" href="{{ pageurl|e }}" />
+  {%- endif -%}
 
-  {# OPENSEARCH #}
-  {% if not embedded %}
-    {% if use_opensearch %}
-      <link rel="search" type="application/opensearchdescription+xml" title="{% trans docstitle=docstitle|e %}Search within {{ docstitle }}{% endtrans %}" href="{{ pathto('_static/opensearch.xml', 1) }}"/>
-    {% endif %}
+  {#- JAVASCRIPTS #}
+  {%- block scripts %}
+  <!--[if lt IE 9]>
+    <script src="{{ pathto('_static/js/html5shiv.min.js', 1) }}"></script>
+  <![endif]-->
+  {%- if not embedded %}
+  {# XXX Sphinx 1.8.0 made this an external js-file, quick fix until we refactor the template to inherert more blocks directly from sphinx #}
+      {%- for scriptfile in script_files %}
+        {{ js_tag(scriptfile) }}
+      {%- endfor %}
+    <script src="{{ pathto('_static/js/theme.js', 1) }}"></script>
 
-  {% endif %}
-
-  {# RTD hosts this file, so just load on non RTD builds #}
-    <link rel="stylesheet" href="{{ pathto('_static/' + style, 1) }}" type="text/css" />
-
-  {% for cssfile in css_files %}
-    <link rel="stylesheet" href="{{ pathto(cssfile, 1) }}" type="text/css" />
-  {% endfor %}
-
-  {% for cssfile in extra_css_files %}
-    <link rel="stylesheet" href="{{ pathto(cssfile, 1) }}" type="text/css" />
-  {% endfor %}
+    {#- OPENSEARCH #}
+    {%- if use_opensearch %}
+    <link rel="search" type="application/opensearchdescription+xml"
+          title="{% trans docstitle=docstitle|e %}Search within {{ docstitle }}{% endtrans %}"
+          href="{{ pathto('_static/opensearch.xml', 1) }}"/>
+    {%- endif %}
+  {%- endif %}
+  {%- endblock %}
 
   {%- block linktags %}
     {%- if hasdoc('about') %}
-        <link rel="author" title="{{ _('About these documents') }}"
-              href="{{ pathto('about') }}"/>
+    <link rel="author" title="{{ _('About these documents') }}" href="{{ pathto('about') }}" />
     {%- endif %}
     {%- if hasdoc('genindex') %}
-        <link rel="index" title="{{ _('Index') }}"
-              href="{{ pathto('genindex') }}"/>
+    <link rel="index" title="{{ _('Index') }}" href="{{ pathto('genindex') }}" />
     {%- endif %}
     {%- if hasdoc('search') %}
-        <link rel="search" title="{{ _('Search') }}" href="{{ pathto('search') }}"/>
+    <link rel="search" title="{{ _('Search') }}" href="{{ pathto('search') }}" />
     {%- endif %}
     {%- if hasdoc('copyright') %}
-        <link rel="copyright" title="{{ _('Copyright') }}" href="{{ pathto('copyright') }}"/>
-    {%- endif %}
-    <link rel="top" title="{{ docstitle|e }}" href="{{ pathto('index') }}"/>
-    {%- if parents %}
-        <link rel="up" title="{{ parents[-1].title|striptags|e }}" href="{{ parents[-1].link|e }}"/>
+    <link rel="copyright" title="{{ _('Copyright') }}" href="{{ pathto('copyright') }}" />
     {%- endif %}
     {%- if next %}
-        <link rel="next" title="{{ next.title|striptags|e }}" href="{{ next.link|e }}"/>
+    <link rel="next" title="{{ next.title|striptags|e }}" href="{{ next.link|e }}" />
     {%- endif %}
     {%- if prev %}
-        <link rel="prev" title="{{ prev.title|striptags|e }}" href="{{ prev.link|e }}"/>
+    <link rel="prev" title="{{ prev.title|striptags|e }}" href="{{ prev.link|e }}" />
     {%- endif %}
   {%- endblock %}
   {%- block extrahead %} {% endblock %}
 
-  {# Keep modernizr in head - http://modernizr.com/docs/#installing #}
-  <script src="{{ pathto('_static/js/modernizr.min.js', 1) }}"></script>
-
 </head>
 
 <body class="wy-body-for-nav" role="document">
@@ -92,16 +107,14 @@
         <div class="wy-side-nav-search">
           {% block sidebartitle %}
 
-          {% if logo and theme_logo_only %}
-            <a href="{{ pathto('index') }}">
-          {% else %}
-            <a href="{{ pathto('index') }}" class="icon icon-home"> {{ project }}
-          {% endif %}
-
-          {% if logo %}
-            {# Not strictly valid HTML, but it's the only way to display/scale it properly, without weird scripting or heaps of work #}
-            <img src="{{ pathto('_static/' + logo, 1) }}" class="logo" />
-          {% endif %}
+          {# the logo helper function was removed in Sphinx 6 and deprecated since Sphinx 4 #}
+          {# the master_doc variable was renamed to root_doc in Sphinx 4 (master_doc still exists in later Sphinx versions) #}
+          {%- set _logo_url = logo_url|default(pathto('_static/' + (logo or ""), 1)) %}
+          {%- set _root_doc = root_doc|default(master_doc) %}
+          <a href="{{ pathto(_root_doc) }}"{% if not theme_logo_only %} class="icon icon-home"{% endif %}>
+            {%- if logo or logo_url %}
+              <img src="{{ _logo_url }}" class="logo" alt="{{ _('Logo') }}"/>
+            {%- endif %}
           </a>
 
           {% include "searchbox.html" %}

doc/_themes/pretix_theme/search.html

@@ -5,31 +5,37 @@
     Template for the search page.
 
     :copyright: Copyright 2007-2013 by the Sphinx team, see AUTHORS.
-    :license: BSD, see LICENSE for details.
+    :license: BSD, see https://github.com/sphinx-doc/sphinx/blob/master/LICENSE for details.
 #}
 {%- extends "layout.html" %}
 {% set title = _('Search') %}
-{% set script_files = script_files + ['_static/searchtools.js'] %}
+{% set display_vcs_links = False %}
+{%- block scripts %}
+    {{ super() }}
+    <script src="{{ pathto('_static/searchtools.js', 1) }}"></script>
+    <script src="{{ pathto('_static/language_data.js', 1) }}"></script>
+{%- endblock %}
 {% block footer %}
-  <script type="text/javascript">
+  <script>
     jQuery(function() { Search.loadIndex("{{ pathto('searchindex.js', 1) }}"); });
   </script>
   {# this is used when loading the search index using $.ajax fails,
      such as on Chrome for documents on localhost #}
-  <script type="text/javascript" id="searchindexloader"></script>
+  <script id="searchindexloader"></script>
   {{ super() }}
 {% endblock %}
 {% block body %}
   <noscript>
   <div id="fallback" class="admonition warning">
     <p class="last">
-      {% trans %}Please activate JavaScript to enable the search
+      {% trans trimmed %}Please activate JavaScript to enable the search
       functionality.{% endtrans %}
     </p>
   </div>
   </noscript>
 
   {% if search_performed %}
+    {# Translators: Search is a noun, not a verb #}
     <h2>{{ _('Search Results') }}</h2>
     {% if not search_results %}
       <p>{{ _('Your search did not match any documents. Please make sure that all words are spelled correctly and that you\'ve selected enough categories.') }}</p>
@@ -47,4 +53,4 @@
     </ul>
   {% endif %}
   </div>
-{% endblock %}
+{% endblock %}

doc/admin/config.rst

@@ -2,7 +2,7 @@
 
 .. _`config`:
 
-.. spelling:: Galera
+.. spelling:word-list:: Galera
 
 Configuration file
 ==================
@@ -84,7 +84,7 @@ Example::
     Enables or disables the "keep me logged in" button. Defaults to ``on``.
 
 ``ecb_rates``
-    By default, pretix periodically downloads a XML file from the European Central Bank to retrieve exchange rates
+    By default, pretix periodically downloads currency rates from the European Central Bank as well as other authorities
     that are used to print tax amounts in the customer currency on invoices for some currencies. Set to ``off`` to
     disable this feature. Defaults to ``on``.
 
@@ -106,6 +106,11 @@ Example::
     proxy that actively removes and re-adds the header to make sure the correct value is set.
     Defaults to ``off``.
 
+``trust_x_forwarded_host``
+    Specifies whether the ``X-Forwarded-Host`` header can be trusted. Only set to ``on`` if you have a reverse
+    proxy that actively removes and re-adds the header to make sure the correct value is set.
+    Defaults to ``off``.
+
 ``csp_log``
     Log violations of the Content Security Policy (CSP). Defaults to ``on``.
 

doc/admin/indexes.rst

@@ -45,8 +45,8 @@ Here is the currently recommended set of commands::
     CREATE INDEX CONCURRENTLY pretix_addidx_order_comment
         ON pretixbase_order
         USING gin (upper("comment") gin_trgm_ops);
-    CREATE INDEX CONCURRENTLY pretix_addidx_order_event_date
-        ON public.pretixbase_order (event_id, datetime);
+    CREATE INDEX CONCURRENTLY pretix_addidx_order_event_date_id
+        ON public.pretixbase_order (event_id, datetime, id);
     CREATE INDEX CONCURRENTLY pretix_addidx_orderpos_name
         ON pretixbase_orderposition
         USING gin (upper("attendee_name_cached") gin_trgm_ops);
@@ -66,10 +66,10 @@ Here is the currently recommended set of commands::
         ON public.pretixbase_orderposition (upper((attendee_email)::text));
     CREATE INDEX CONCURRENTLY pretix_addidx_voucher_code_upper
         ON public.pretixbase_voucher (upper((code)::text));
-    CREATE INDEX CONCURRENTLY pretix_addidx_logentry_event_date
-        ON public.pretixbase_logentry (event_id, datetime);
-    CREATE INDEX CONCURRENTLY pretix_addidx_logentry_event_cid_date
-        ON public.pretixbase_logentry (event_id, content_type_id, datetime);
+    CREATE INDEX CONCURRENTLY pretix_addidx_logentry_event_date_id
+        ON public.pretixbase_logentry (event_id, datetime, id);
+    CREATE INDEX CONCURRENTLY pretix_addidx_logentry_event_cid_date_id
+        ON public.pretixbase_logentry (event_id, content_type_id, datetime, id);
 
 
 Also, if you use our ``pretix-shipping`` plugin::

doc/admin/installation/general.rst

@@ -1,6 +1,6 @@
 .. highlight:: ini
 
-.. spelling:: SQL
+.. spelling:word-list:: SQL
 
 General remarks
 ===============

doc/admin/installation/manual_smallscale.rst

@@ -23,7 +23,7 @@ installation guides):
 
 * A SMTP server to send out mails, e.g. `Postfix`_ on your machine or some third-party server you have credentials for
 * A HTTP reverse proxy, e.g. `nginx`_ or Apache to allow HTTPS connections
-* A `PostgreSQL`_ 9.6+ database server
+* A `PostgreSQL`_ 11+ database server
 * A `redis`_ server
 * A `nodejs`_ installation
 
@@ -127,7 +127,7 @@ We now install pretix, its direct dependencies and gunicorn::
 
     (venv)$ pip3 install pretix gunicorn
 
-Note that you need Python 3.7 or newer. You can find out your Python version using ``python -V``.
+Note that you need Python 3.9 or newer. You can find out your Python version using ``python -V``.
 
 We also need to create a data directory::
 

doc/admin/mysql2postgres.rst

@@ -104,6 +104,12 @@ Install ``pgloader``::
 
     # apt install pgloader
 
+.. note::
+
+   If you are using Ubuntu 20.04, the ``pgloader`` version from the repositories seems to be incompatible with PostgreSQL
+   12+. You can install ``pgloader`` from the `PostgreSQL repositories`_ instead.
+   See also `this discussion <https://github.com/pretix/pretix/issues/3090>`_.
+
 Create a new file ``/tmp/pretix.load``, replacing the MySQL and PostgreSQL connection strings with the correct user names, passwords, and/or database names::
 
     LOAD DATABASE
@@ -146,3 +152,5 @@ Now, restart pretix. Maybe stop your MySQL server as a verification step that yo
 And you're done! After you've verified everything has been copied correctly, you can delete the old MySQL database.
 
 .. note:: Don't forget to update your backup process to back up your PostgreSQL database instead of your MySQL database now.
+
+.. _PostgreSQL repositories: https://wiki.postgresql.org/wiki/Apt

doc/api/oauth.rst

@@ -107,9 +107,9 @@ You can supply a valid access token as a ``Bearer``-type token in the ``Authoriz
 .. sourcecode:: http
    :emphasize-lines: 3
 
-       GET /api/v1/organizers/ HTTP/1.1
-       Host: pretix.eu
-       Authorization: Bearer i3ytqTSRWsKp16fqjekHXa4tdM4qNC
+   GET /api/v1/organizers/ HTTP/1.1
+   Host: pretix.eu
+   Authorization: Bearer i3ytqTSRWsKp16fqjekHXa4tdM4qNC
 
 Refreshing an access token
 --------------------------

doc/api/resources/checkin.rst

@@ -1,4 +1,4 @@
-.. spelling:: checkin
+.. spelling:word-list:: checkin
 
 .. _rest-checkin:
 
@@ -203,6 +203,8 @@ Checking a ticket in
 
    * ``invalid`` - Ticket is not known.
    * ``unpaid`` - Ticket is not paid for.
+   * ``blocked`` - Ticket has been blocked.
+   * ``invalid_time`` - Ticket is not valid at this time.
    * ``canceled`` – Ticket is canceled or expired.
    * ``already_redeemed`` - Ticket already has been redeemed.
    * ``product`` - Tickets with this product may not be scanned at this device.

doc/api/resources/checkinlists.rst

@@ -1,4 +1,4 @@
-.. spelling:: checkin
+.. spelling:word-list:: checkin
 
 .. _rest-checkinlists:
 
@@ -364,7 +364,7 @@ Endpoints
    Stores a failed check-in. Only necessary for statistical purposes if you perform scan validation offline.
 
    :<json boolean error_reason: One of ``canceled``, ``invalid``, ``unpaid``, ``product``, ``rules``, ``revoked``,
-                                ``incomplete``, ``already_redeemed``, or ``error``. Required.
+                                ``incomplete``, ``already_redeemed``, ``blocked``, ``invalid_time``, or ``error``. Required.
    :<json raw_barcode: The raw barcode you scanned. Required.
    :<json datetime: Date and time of the scan. Optional.
    :<json type: Type of scan, defaults to ``"entry"``.
@@ -743,6 +743,8 @@ Order position endpoints
 
    * ``invalid`` - Ticket code not known.
    * ``unpaid`` - Ticket is not paid for.
+   * ``blocked`` - Ticket has been blocked.
+   * ``invalid_time`` - Ticket is not valid at this time.
    * ``canceled`` – Ticket is canceled or expired. This reason is only sent when your request sets.
      ``canceled_supported`` to ``true``, otherwise these orders return ``unpaid``.
    * ``already_redeemed`` - Ticket already has been redeemed.

doc/api/resources/devices.rst

@@ -1,4 +1,4 @@
-.. spelling:: fullname
+.. spelling:word-list:: fullname
 
 .. _`rest-devices`:
 

doc/api/resources/events.rst

@@ -1,4 +1,4 @@
-.. spelling::
+.. spelling:word-list::
 
    geo
    lat
@@ -49,6 +49,7 @@ valid_keys                            object                     Cryptographic k
                                                                  only contained in detail views. Value can be cached.
 sales_channels                        list                       A list of sales channels this event is available for
                                                                  sale on.
+public_url                            string                     The public, customer-facing URL of the event (read-only).
 ===================================== ========================== =======================================================
 
 
@@ -65,6 +66,10 @@ Endpoints
 
     The ``search`` query parameter has been added to filter events by their slug, name, or location in any language.
 
+.. versionchanged:: 4.17
+
+    The ``public_url`` field has been added.
+
 .. http:get:: /api/v1/organizers/(organizer)/events/
 
    Returns a list of all events within a given organizer the authenticated user/token has access to.
@@ -123,7 +128,8 @@ Endpoints
               "web",
               "pretixpos",
               "resellers"
-            ]
+            ],
+            "public_url": "https://pretix.eu/bigevents/sampleconf/"
           }
         ]
       }
@@ -211,7 +217,8 @@ Endpoints
           "web",
           "pretixpos",
           "resellers"
-        ]
+        ],
+        "public_url": "https://pretix.eu/bigevents/sampleconf/"
       }
 
    :param organizer: The ``slug`` field of the organizer to fetch
@@ -307,7 +314,8 @@ Endpoints
           "web",
           "pretixpos",
           "resellers"
-        ]
+        ],
+        "public_url": "https://pretix.eu/bigevents/sampleconf/"
       }
 
    :param organizer: The ``slug`` field of the organizer of the event to create.
@@ -411,7 +419,8 @@ Endpoints
           "web",
           "pretixpos",
           "resellers"
-        ]
+        ],
+        "public_url": "https://pretix.eu/bigevents/sampleconf/"
       }
 
    :param organizer: The ``slug`` field of the organizer of the event to create.
@@ -485,7 +494,8 @@ Endpoints
           "web",
           "pretixpos",
           "resellers"
-        ]
+        ],
+        "public_url": "https://pretix.eu/bigevents/sampleconf/"
       }
 
    :param organizer: The ``slug`` field of the organizer of the event to update

doc/api/resources/exporters.rst

@@ -1,4 +1,4 @@
-.. spelling:: checkin
+.. spelling:word-list:: checkin
 
 Data exporters
 ==============

doc/api/resources/invoices.rst

@@ -42,6 +42,7 @@ introductory_text                     string                     Text to be prin
 additional_text                       string                     Text to be printed below the product list
 payment_provider_text                 string                     Text to be printed below the product list with
                                                                  payment information
+payment_provider_stamp                string                     Short text to be visibly printed to indicate payment status
 footer_text                           string                     Text to be printed in the page footer area
 lines                                 list of objects            The actual invoice contents
 ├ position                            integer                    Number of the line within an invoice.
@@ -178,6 +179,7 @@ Endpoints
             "internal_reference": "",
             "additional_text": "We are looking forward to see you on our conference!",
             "payment_provider_text": "Please transfer the money to our account ABC…",
+            "payment_provider_stamp": null,
             "footer_text": "Big Events LLC - Registration No. 123456 - VAT ID: EU0987654321",
             "lines": [
               {
@@ -268,6 +270,7 @@ Endpoints
         "internal_reference": "",
         "additional_text": "We are looking forward to see you on our conference!",
         "payment_provider_text": "Please transfer the money to our account ABC…",
+        "payment_provider_stamp": null,
         "footer_text": "Big Events LLC - Registration No. 123456 - VAT ID: EU0987654321",
         "lines": [
           {

doc/api/resources/item_variations.rst

@@ -24,6 +24,9 @@ active                                boolean                    If ``false``, t
 description                           multi-lingual string       A public description of the variation. May contain
                                                                  Markdown syntax or can be ``null``.
 position                              integer                    An integer, used for sorting
+checkin_attention                     boolean                    If ``true``, the check-in app should show a warning
+                                                                 that this ticket requires special attention if such
+                                                                 a variation is being scanned.
 require_approval                      boolean                    If ``true``, orders with this variation will need to be
                                                                  approved by the event organizer before they can be
                                                                  paid.
@@ -48,7 +51,7 @@ meta_data                             object                     Values set for
 
 .. versionchanged:: 4.16
 
-   The ``meta_data`` attribute has been added.
+   The ``meta_data`` and ``checkin_attention`` attributes have been added.
 
 Endpoints
 ---------
@@ -84,6 +87,7 @@ Endpoints
               "en": "S"
             },
             "active": true,
+            "checkin_attention": false,
             "require_approval": false,
             "require_membership": false,
             "require_membership_hidden": false,
@@ -107,6 +111,7 @@ Endpoints
               "en": "L"
             },
             "active": true,
+            "checkin_attention": false,
             "require_approval": false,
             "require_membership": false,
             "require_membership_hidden": false,
@@ -159,6 +164,7 @@ Endpoints
         "price": "10.00",
         "original_price": null,
         "active": true,
+        "checkin_attention": false,
         "require_approval": false,
         "require_membership": false,
         "require_membership_hidden": false,
@@ -197,6 +203,7 @@ Endpoints
         "value": {"en": "Student"},
         "default_price": "10.00",
         "active": true,
+        "checkin_attention": false,
         "require_approval": false,
         "require_membership": false,
         "require_membership_hidden": false,
@@ -225,6 +232,7 @@ Endpoints
         "price": "10.00",
         "original_price": null,
         "active": true,
+        "checkin_attention": false,
         "require_approval": false,
         "require_membership": false,
         "require_membership_hidden": false,
@@ -284,6 +292,7 @@ Endpoints
         "price": "10.00",
         "original_price": null,
         "active": false,
+        "checkin_attention": false,
         "require_approval": false,
         "require_membership": false,
         "require_membership_hidden": false,

doc/api/resources/items.rst

@@ -11,147 +11,165 @@ The item resource contains the following public fields:
 
 .. rst-class:: rest-resource-table
 
-===================================== ========================== =======================================================
-Field                                 Type                       Description
-===================================== ========================== =======================================================
-id                                    integer                    Internal ID of the item
-name                                  multi-lingual string       The item's visible name
-internal_name                         string                     An optional name that is only used in the backend
-default_price                         money (string)             The item price that is applied if the price is not
-                                                                 overwritten by variations or other options.
-category                              integer                    The ID of the category this item belongs to
-                                                                 (or ``null``).
-active                                boolean                    If ``false``, the item is hidden from all public lists
-                                                                 and will not be sold.
-description                           multi-lingual string       A public description of the item. May contain Markdown
-                                                                 syntax or can be ``null``.
-free_price                            boolean                    If ``true``, customers can change the price at which
-                                                                 they buy the product (however, the price can't be set
-                                                                 lower than the price defined by ``default_price`` or
-                                                                 otherwise).
-tax_rate                              decimal (string)           The VAT rate to be applied for this item (read-only,
-                                                                 set through ``tax_rule``).
-tax_rule                              integer                    The internal ID of the applied tax rule (or ``null``).
-admission                             boolean                    ``true`` for items that grant admission to the event
-                                                                 (such as primary tickets) and ``false`` for others
-                                                                 (such as add-ons or merchandise).
-personalized                          boolean                    ``true`` for items that require personalization according
-                                                                 to event settings. Only affects system-level fields, not
-                                                                 custom questions. Currently only allowed for products with
-                                                                 ``admission`` set to ``true``. For backwards compatibility,
-                                                                 when creating new items and this field is not given, it defaults
-                                                                 to the same value as ``admission``.
-position                              integer                    An integer, used for sorting
-picture                               file                       A product picture to be displayed in the shop
-                                                                 (can be ``null``).
-sales_channels                        list of strings            Sales channels this product is available on, such as
-                                                                 ``"web"`` or ``"resellers"``. Defaults to ``["web"]``.
-available_from                        datetime                   The first date time at which this item can be bought
-                                                                 (or ``null``).
-available_until                       datetime                   The last date time at which this item can be bought
-                                                                 (or ``null``).
-hidden_if_available                   integer                    The internal ID of a quota object, or ``null``. If
-                                                                 set, this item won't be shown publicly as long as this
-                                                                 quota is available.
-require_voucher                       boolean                    If ``true``, this item can only be bought using a
-                                                                 voucher that is specifically assigned to this item.
-hide_without_voucher                  boolean                    If ``true``, this item is only shown during the voucher
-                                                                 redemption process, but not in the normal shop
-                                                                 frontend.
-allow_cancel                          boolean                    If ``false``, customers cannot cancel orders containing
-                                                                 this item.
-min_per_order                         integer                    This product can only be bought if it is included at
-                                                                 least this many times in the order (or ``null`` for no
-                                                                 limitation).
-max_per_order                         integer                    This product can only be bought if it is included at
-                                                                 most this many times in the order (or ``null`` for no
-                                                                 limitation).
-checkin_attention                     boolean                    If ``true``, the check-in app should show a warning
-                                                                 that this ticket requires special attention if such
-                                                                 a product is being scanned.
-original_price                        money (string)             An original price, shown for comparison, not used
-                                                                 for price calculations (or ``null``).
-require_approval                      boolean                    If ``true``, orders with this product will need to be
-                                                                 approved by the event organizer before they can be
-                                                                 paid.
-require_bundling                      boolean                    If ``true``, this item is only available as part of bundles.
-require_membership                    boolean                    If ``true``, booking this item requires an active membership.
-require_membership_hidden             boolean                    If ``true`` and ``require_membership`` is set, this product will
-                                                                 be hidden from users without a valid membership.
-require_membership_types              list of integers           Internal IDs of membership types valid if ``require_membership`` is ``true``
-grant_membership_type                 integer                    If set to the internal ID of a membership type, purchasing this item will
-                                                                 create a membership of the given type.
-grant_membership_duration_like_event  boolean                    If ``true``, the membership created through ``grant_membership_type`` will derive
-                                                                 its term from ``date_from`` to ``date_to`` of the purchased (sub)event.
-grant_membership_duration_days        integer                    If ``grant_membership_duration_like_event`` is ``false``, this sets the number of
-                                                                 days for the membership.
-grant_membership_duration_months      integer                    If ``grant_membership_duration_like_event`` is ``false``, this sets the number of
-                                                                 calendar months for the membership.
-generate_tickets                      boolean                    If ``false``, tickets are never generated for this
-                                                                 product, regardless of other settings. If ``true``,
-                                                                 tickets are generated even if this is a
-                                                                 non-admission or add-on product, regardless of event
-                                                                 settings. If this is ``null``, regular ticketing
-                                                                 rules apply.
-allow_waitinglist                     boolean                    If ``false``, no waiting list will be shown for this
-                                                                 product when it is sold out.
-issue_giftcard                        boolean                    If ``true``, buying this product will yield a gift card.
-show_quota_left                       boolean                    Publicly show how many tickets are still available.
-                                                                 If this is ``null``, the event default is used.
-has_variations                        boolean                    Shows whether or not this item has variations.
-variations                            list of objects            A list with one object for each variation of this item.
-                                                                 Can be empty. Only writable during creation,
-                                                                 use separate endpoint to modify this later.
-├ id                                  integer                    Internal ID of the variation
-├ value                               multi-lingual string       The "name" of the variation
-├ default_price                       money (string)             The price set directly for this variation or ``null``
-├ price                               money (string)             The price used for this variation. This is either the
-                                                                 same as ``default_price`` if that value is set or equal
-                                                                 to the item's ``default_price``.
-├ original_price                      money (string)             An original price, shown for comparison, not used
-                                                                 for price calculations (or ``null``).
-├ active                              boolean                    If ``false``, this variation will not be sold or shown.
-├ description                         multi-lingual string       A public description of the variation. May contain
-├ require_membership                  boolean                    If ``true``, booking this variation requires an active membership.
-├ require_membership_hidden           boolean                    If ``true`` and ``require_membership`` is set, this variation will
-                                                                 be hidden from users without a valid membership.
-├ require_membership_types            list of integers           Internal IDs of membership types valid if ``require_membership`` is ``true``
-                                                                 Markdown syntax or can be ``null``.
-├ sales_channels                      list of strings            Sales channels this variation is available on, such as
-                                                                 ``"web"`` or ``"resellers"``. Defaults to all existing sales channels.
-                                                                 The item-level list takes precedence, i.e. a sales
-                                                                 channel needs to be on both lists for the item to be
-                                                                 available.
-├ available_from                      datetime                   The first date time at which this variation can be bought
-                                                                 (or ``null``).
-├ available_until                     datetime                   The last date time at which this variation can be bought
-                                                                 (or ``null``).
-├ hide_without_voucher                boolean                    If ``true``, this variation is only shown during the voucher
-                                                                 redemption process, but not in the normal shop
-                                                                 frontend.
-├ meta_data                           object                     Values set for event-specific meta data parameters.
-└ position                            integer                    An integer, used for sorting
-addons                                list of objects            Definition of add-ons that can be chosen for this item.
-                                                                 Only writable during creation,
-                                                                 use separate endpoint to modify this later.
-├ addon_category                      integer                    Internal ID of the item category the add-on can be
-                                                                 chosen from.
-├ min_count                           integer                    The minimal number of add-ons that need to be chosen.
-├ max_count                           integer                    The maximal number of add-ons that can be chosen.
-├ position                            integer                    An integer, used for sorting
-├ multi_allowed                       boolean                    Adding the same item multiple times is allowed
-└ price_included                      boolean                    Adding this add-on to the item is free
-bundles                               list of objects            Definition of bundles that are included in this item.
-                                                                 Only writable during creation,
-                                                                 use separate endpoint to modify this later.
-├ bundled_item                        integer                    Internal ID of the item that is included.
-├ bundled_variation                   integer                    Internal ID of the variation of the item (or ``null``).
-├ count                               integer                    Number of items included
-└ designated_price                    money (string)             Designated price of the bundled product. This will be
-                                                                 used to split the price of the base item e.g. for mixed
-                                                                 taxation. This is not added to the price.
-meta_data                             object                     Values set for event-specific meta data parameters.
-===================================== ========================== =======================================================
+======================================= ========================== =======================================================
+Field                                   Type                       Description
+======================================= ========================== =======================================================
+id                                      integer                    Internal ID of the item
+name                                    multi-lingual string       The item's visible name
+internal_name                           string                     An optional name that is only used in the backend
+default_price                           money (string)             The item price that is applied if the price is not
+                                                                   overwritten by variations or other options.
+category                                integer                    The ID of the category this item belongs to
+                                                                   (or ``null``).
+active                                  boolean                    If ``false``, the item is hidden from all public lists
+                                                                   and will not be sold.
+description                             multi-lingual string       A public description of the item. May contain Markdown
+                                                                   syntax or can be ``null``.
+free_price                              boolean                    If ``true``, customers can change the price at which
+                                                                   they buy the product (however, the price can't be set
+                                                                   lower than the price defined by ``default_price`` or
+                                                                   otherwise).
+tax_rate                                decimal (string)           The VAT rate to be applied for this item (read-only,
+                                                                   set through ``tax_rule``).
+tax_rule                                integer                    The internal ID of the applied tax rule (or ``null``).
+admission                               boolean                    ``true`` for items that grant admission to the event
+                                                                   (such as primary tickets) and ``false`` for others
+                                                                   (such as add-ons or merchandise).
+personalized                            boolean                    ``true`` for items that require personalization according
+                                                                   to event settings. Only affects system-level fields, not
+                                                                   custom questions. Currently only allowed for products with
+                                                                   ``admission`` set to ``true``. For backwards compatibility,
+                                                                   when creating new items and this field is not given, it defaults
+                                                                   to the same value as ``admission``.
+position                                integer                    An integer, used for sorting
+picture                                 file                       A product picture to be displayed in the shop
+                                                                   (can be ``null``).
+sales_channels                          list of strings            Sales channels this product is available on, such as
+                                                                   ``"web"`` or ``"resellers"``. Defaults to ``["web"]``.
+available_from                          datetime                   The first date time at which this item can be bought
+                                                                   (or ``null``).
+available_until                         datetime                   The last date time at which this item can be bought
+                                                                   (or ``null``).
+hidden_if_available                     integer                    The internal ID of a quota object, or ``null``. If
+                                                                   set, this item won't be shown publicly as long as this
+                                                                   quota is available.
+require_voucher                         boolean                    If ``true``, this item can only be bought using a
+                                                                   voucher that is specifically assigned to this item.
+hide_without_voucher                    boolean                    If ``true``, this item is only shown during the voucher
+                                                                   redemption process, but not in the normal shop
+                                                                   frontend.
+allow_cancel                            boolean                    If ``false``, customers cannot cancel orders containing
+                                                                   this item.
+min_per_order                           integer                    This product can only be bought if it is included at
+                                                                   least this many times in the order (or ``null`` for no
+                                                                   limitation).
+max_per_order                           integer                    This product can only be bought if it is included at
+                                                                   most this many times in the order (or ``null`` for no
+                                                                   limitation).
+checkin_attention                       boolean                    If ``true``, the check-in app should show a warning
+                                                                   that this ticket requires special attention if such
+                                                                   a product is being scanned.
+original_price                          money (string)             An original price, shown for comparison, not used
+                                                                   for price calculations (or ``null``).
+require_approval                        boolean                    If ``true``, orders with this product will need to be
+                                                                   approved by the event organizer before they can be
+                                                                   paid.
+require_bundling                        boolean                    If ``true``, this item is only available as part of bundles.
+require_membership                      boolean                    If ``true``, booking this item requires an active membership.
+require_membership_hidden               boolean                    If ``true`` and ``require_membership`` is set, this product will
+                                                                   be hidden from users without a valid membership.
+require_membership_types                list of integers           Internal IDs of membership types valid if ``require_membership`` is ``true``
+grant_membership_type                   integer                    If set to the internal ID of a membership type, purchasing this item will
+                                                                   create a membership of the given type.
+grant_membership_duration_like_event    boolean                    If ``true``, the membership created through ``grant_membership_type`` will derive
+                                                                   its term from ``date_from`` to ``date_to`` of the purchased (sub)event.
+grant_membership_duration_days          integer                    If ``grant_membership_duration_like_event`` is ``false``, this sets the number of
+                                                                   days for the membership.
+grant_membership_duration_months        integer                    If ``grant_membership_duration_like_event`` is ``false``, this sets the number of
+                                                                   calendar months for the membership.
+validity_mode                           string                     If ``null``, tickets generated for this product do not
+                                                                   have special validity behavior, but follow event configuration and
+                                                                   can be limited e.g. through check-in rules. Other values are ``"fixed"`` and ``"dynamic"``
+validity_fixed_from                     datetime                   If ``validity_mode`` is ``"fixed"``, this is the start of validity for issued tickets.
+validity_fixed_until                    datetime                   If ``validity_mode`` is ``"fixed"``, this is the end of validity for issued tickets.
+validity_dynamic_duration_minutes       integer                    If ``validity_mode`` is ``"dynamic"``, this is the "minutes" component of the ticket validity duration.
+validity_dynamic_duration_hours         integer                    If ``validity_mode`` is ``"dynamic"``, this is the "hours" component of the ticket validity duration.
+validity_dynamic_duration_days          integer                    If ``validity_mode`` is ``"dynamic"``, this is the "days" component of the ticket validity duration.
+validity_dynamic_duration_months        integer                    If ``validity_mode`` is ``"dynamic"``, this is the "months" component of the ticket validity duration.
+validity_dynamic_start_choice           boolean                    If ``validity_mode`` is ``"dynamic"`` and this is ``true``, customers can choose the start of validity.
+validity_dynamic_start_choice_day_limit boolean                    If ``validity_mode`` is ``"dynamic"`` and ``validity_dynamic_start_choice`` is ``true``,
+                                                                   this is the maximum number of days the start can be in the future.
+generate_tickets                        boolean                    If ``false``, tickets are never generated for this
+                                                                   product, regardless of other settings. If ``true``,
+                                                                   tickets are generated even if this is a
+                                                                   non-admission or add-on product, regardless of event
+                                                                   settings. If this is ``null``, regular ticketing
+                                                                   rules apply.
+allow_waitinglist                       boolean                    If ``false``, no waiting list will be shown for this
+                                                                   product when it is sold out.
+issue_giftcard                          boolean                    If ``true``, buying this product will yield a gift card.
+show_quota_left                         boolean                    Publicly show how many tickets are still available.
+                                                                   If this is ``null``, the event default is used.
+has_variations                          boolean                    Shows whether or not this item has variations.
+variations                              list of objects            A list with one object for each variation of this item.
+                                                                   Can be empty. Only writable during creation,
+                                                                   use separate endpoint to modify this later.
+├ id                                    integer                    Internal ID of the variation
+├ value                                 multi-lingual string       The "name" of the variation
+├ default_price                         money (string)             The price set directly for this variation or ``null``
+├ price                                 money (string)             The price used for this variation. This is either the
+                                                                   same as ``default_price`` if that value is set or equal
+                                                                   to the item's ``default_price``.
+├ original_price                        money (string)             An original price, shown for comparison, not used
+                                                                   for price calculations (or ``null``).
+├ active                                boolean                    If ``false``, this variation will not be sold or shown.
+├ description                           multi-lingual string       A public description of the variation. May contain
+├ checkin_attention                     boolean                    If ``true``, the check-in app should show a warning
+                                                                   that this ticket requires special attention if such
+                                                                   a variation is being scanned.
+├ require_approval                      boolean                    If ``true``, orders with this variation will need to be
+                                                                   approved by the event organizer before they can be
+                                                                   paid.
+├ require_membership                    boolean                    If ``true``, booking this variation requires an active membership.
+├ require_membership_hidden             boolean                    If ``true`` and ``require_membership`` is set, this variation will
+                                                                   be hidden from users without a valid membership.
+├ require_membership_types              list of integers           Internal IDs of membership types valid if ``require_membership`` is ``true``
+                                                                   Markdown syntax or can be ``null``.
+├ sales_channels                        list of strings            Sales channels this variation is available on, such as
+                                                                   ``"web"`` or ``"resellers"``. Defaults to all existing sales channels.
+                                                                   The item-level list takes precedence, i.e. a sales
+                                                                   channel needs to be on both lists for the item to be
+                                                                   available.
+├ available_from                        datetime                   The first date time at which this variation can be bought
+                                                                   (or ``null``).
+├ available_until                       datetime                   The last date time at which this variation can be bought
+                                                                   (or ``null``).
+├ hide_without_voucher                  boolean                    If ``true``, this variation is only shown during the voucher
+                                                                   redemption process, but not in the normal shop
+                                                                   frontend.
+├ meta_data                             object                     Values set for event-specific meta data parameters.
+└ position                              integer                    An integer, used for sorting
+addons                                  list of objects            Definition of add-ons that can be chosen for this item.
+                                                                   Only writable during creation,
+                                                                   use separate endpoint to modify this later.
+├ addon_category                        integer                    Internal ID of the item category the add-on can be
+                                                                   chosen from.
+├ min_count                             integer                    The minimal number of add-ons that need to be chosen.
+├ max_count                             integer                    The maximal number of add-ons that can be chosen.
+├ position                              integer                    An integer, used for sorting
+├ multi_allowed                         boolean                    Adding the same item multiple times is allowed
+└ price_included                        boolean                    Adding this add-on to the item is free
+bundles                                 list of objects            Definition of bundles that are included in this item.
+                                                                   Only writable during creation,
+                                                                   use separate endpoint to modify this later.
+├ bundled_item                          integer                    Internal ID of the item that is included.
+├ bundled_variation                     integer                    Internal ID of the variation of the item (or ``null``).
+├ count                                 integer                    Number of items included
+└ designated_price                      money (string)             Designated price of the bundled product. This will be
+                                                                   used to split the price of the base item e.g. for mixed
+                                                                   taxation. This is not added to the price.
+meta_data                               object                     Values set for event-specific meta data parameters.
+======================================= ========================== =======================================================
 
 .. versionchanged:: 4.0
 
@@ -164,7 +182,12 @@ meta_data                             object                     Values set for
 
 .. versionchanged:: 4.16
 
-   The ``variations[x].meta_data`` attribute has been added. The ``personalized`` attribute has been added.
+   The ``variations[x].meta_data`` and ``variations[x].checkin_attention`` attributes have been added.
+   The ``personalized`` attribute has been added.
+
+.. versionchanged:: 4.17
+
+   The ``validity_*`` attributes have been added.
 
 Notes
 -----
@@ -245,6 +268,14 @@ Endpoints
             "grant_membership_duration_like_event": true,
             "grant_membership_duration_days": 0,
             "grant_membership_duration_months": 0,
+            "validity_fixed_from": null,
+            "validity_fixed_until": null,
+            "validity_dynamic_duration_minutes": null,
+            "validity_dynamic_duration_hours": null,
+            "validity_dynamic_duration_days": null,
+            "validity_dynamic_duration_months": null,
+            "validity_dynamic_start_choice": false,
+            "validity_dynamic_start_choice_day_limit": null,
             "variations": [
               {
                  "value": {"en": "Student"},
@@ -252,6 +283,8 @@ Endpoints
                  "price": "10.00",
                  "original_price": null,
                  "active": true,
+                 "checkin_attention": false,
+                 "require_approval": false,
                  "require_membership": false,
                  "require_membership_types": [],
                  "sales_channels": ["web"],
@@ -268,6 +301,8 @@ Endpoints
                  "price": "23.00",
                  "original_price": null,
                  "active": true,
+                 "checkin_attention": false,
+                 "require_approval": false,
                  "require_membership": false,
                  "require_membership_types": [],
                  "sales_channels": ["web"],
@@ -362,6 +397,14 @@ Endpoints
         "grant_membership_duration_like_event": true,
         "grant_membership_duration_days": 0,
         "grant_membership_duration_months": 0,
+        "validity_fixed_from": null,
+        "validity_fixed_until": null,
+        "validity_dynamic_duration_minutes": null,
+        "validity_dynamic_duration_hours": null,
+        "validity_dynamic_duration_days": null,
+        "validity_dynamic_duration_months": null,
+        "validity_dynamic_start_choice": false,
+        "validity_dynamic_start_choice_day_limit": null,
         "variations": [
           {
              "value": {"en": "Student"},
@@ -369,6 +412,8 @@ Endpoints
              "price": "10.00",
              "original_price": null,
              "active": true,
+             "checkin_attention": false,
+             "require_approval": false,
              "require_membership": false,
              "require_membership_types": [],
              "description": null,
@@ -385,6 +430,8 @@ Endpoints
              "price": "23.00",
              "original_price": null,
              "active": true,
+             "checkin_attention": false,
+             "require_approval": false,
              "require_membership": false,
              "require_membership_types": [],
              "sales_channels": ["web"],
@@ -459,6 +506,14 @@ Endpoints
         "grant_membership_duration_like_event": true,
         "grant_membership_duration_days": 0,
         "grant_membership_duration_months": 0,
+        "validity_fixed_from": null,
+        "validity_fixed_until": null,
+        "validity_dynamic_duration_minutes": null,
+        "validity_dynamic_duration_hours": null,
+        "validity_dynamic_duration_days": null,
+        "validity_dynamic_duration_months": null,
+        "validity_dynamic_start_choice": false,
+        "validity_dynamic_start_choice_day_limit": null,
         "variations": [
           {
              "value": {"en": "Student"},
@@ -466,6 +521,8 @@ Endpoints
              "price": "10.00",
              "original_price": null,
              "active": true,
+             "checkin_attention": false,
+             "require_approval": false,
              "require_membership": false,
              "require_membership_types": [],
              "sales_channels": ["web"],
@@ -482,6 +539,8 @@ Endpoints
              "price": "23.00",
              "original_price": null,
              "active": true,
+             "checkin_attention": false,
+             "require_approval": false,
              "require_membership": false,
              "require_membership_types": [],
              "sales_channels": ["web"],
@@ -545,6 +604,14 @@ Endpoints
         "grant_membership_duration_like_event": true,
         "grant_membership_duration_days": 0,
         "grant_membership_duration_months": 0,
+        "validity_fixed_from": null,
+        "validity_fixed_until": null,
+        "validity_dynamic_duration_minutes": null,
+        "validity_dynamic_duration_hours": null,
+        "validity_dynamic_duration_days": null,
+        "validity_dynamic_duration_months": null,
+        "validity_dynamic_start_choice": false,
+        "validity_dynamic_start_choice_day_limit": null,
         "variations": [
           {
              "value": {"en": "Student"},
@@ -552,6 +619,8 @@ Endpoints
              "price": "10.00",
              "original_price": null,
              "active": true,
+             "checkin_attention": false,
+             "require_approval": false,
              "require_membership": false,
              "require_membership_types": [],
              "sales_channels": ["web"],
@@ -568,6 +637,8 @@ Endpoints
              "price": "23.00",
              "original_price": null,
              "active": true,
+             "checkin_attention": false,
+             "require_approval": false,
              "require_membership": false,
              "require_membership_types": [],
              "sales_channels": ["web"],
@@ -662,6 +733,14 @@ Endpoints
         "grant_membership_duration_like_event": true,
         "grant_membership_duration_days": 0,
         "grant_membership_duration_months": 0,
+        "validity_fixed_from": null,
+        "validity_fixed_until": null,
+        "validity_dynamic_duration_minutes": null,
+        "validity_dynamic_duration_hours": null,
+        "validity_dynamic_duration_days": null,
+        "validity_dynamic_duration_months": null,
+        "validity_dynamic_start_choice": false,
+        "validity_dynamic_start_choice_day_limit": null,
         "variations": [
           {
              "value": {"en": "Student"},
@@ -669,6 +748,8 @@ Endpoints
              "price": "10.00",
              "original_price": null,
              "active": true,
+             "checkin_attention": false,
+             "require_approval": false,
              "require_membership": false,
              "require_membership_types": [],
              "sales_channels": ["web"],
@@ -685,6 +766,8 @@ Endpoints
              "price": "23.00",
              "original_price": null,
              "active": true,
+             "checkin_attention": false,
+             "require_approval": false,
              "require_membership": false,
              "require_membership_types": [],
              "sales_channels": ["web"],

doc/api/resources/orders.rst

@@ -1,4 +1,4 @@
-.. spelling::
+.. spelling:word-list::
 
    checkins
    pdf
@@ -91,6 +91,10 @@ require_approval                      boolean                    If ``true`` and
                                                                  needs approval by an organizer before it can
                                                                  continue. If ``true`` and the order is canceled,
                                                                  this order has been denied by the event organizer.
+valid_if_pending                      boolean                    If ``true`` and the order is pending, this order
+                                                                 is still treated like a paid order for most purposes,
+                                                                 such as check-in. This may be used e.g. for trusted
+                                                                 customers who only need to pay after the event.
 url                                   string                     The full URL to the order confirmation page
 payments                              list of objects            List of payment processes (see below)
 refunds                               list of objects            List of refund processes (see below)
@@ -122,6 +126,10 @@ last_modified                         datetime                   Last modificati
 
    The ``include`` query parameter has been added.
 
+.. versionchanged:: 4.16
+
+   The ``valid_if_pending`` attribute has been added.
+
 
 .. _order-position-resource:
 
@@ -159,6 +167,9 @@ secret                                string                     Secret code pri
 addon_to                              integer                    Internal ID of the position this position is an add-on for (or ``null``)
 subevent                              integer                    ID of the date inside an event series this position belongs to (or ``null``).
 discount                              integer                    ID of a discount that has been used during the creation of this position in some way (or ``null``).
+blocked                               list of strings            A list of strings, or ``null``. Whenever not ``null``, the ticket may not be used (e.g. for check-in).
+valid_from                            datetime                   The ticket will not be valid before this time. Can be ``null``.
+valid_until                           datetime                   The ticket will not be valid after this time. Can be ``null``.
 pseudonymization_id                   string                     A random ID, e.g. for use in lead scanning apps
 checkins                              list of objects            List of **successful** check-ins with this ticket
 ├ id                                  integer                    Internal ID of the check-in event
@@ -186,6 +197,10 @@ pdf_data                              object                     Data object req
                                                                  ``pdf_data=true`` query parameter to your request.
 ===================================== ========================== =======================================================
 
+.. versionchanged:: 4.16
+
+   The attributes ``blocked``, ``valid_from`` and ``valid_until`` have been added.
+
 .. _order-payment-resource:
 
 Order payment resource
@@ -294,6 +309,7 @@ List of all orders
             "custom_followup_at": null,
             "checkin_attention": false,
             "require_approval": false,
+            "valid_if_pending": false,
             "invoice_address": {
                 "last_modified": "2017-12-01T10:00:00Z",
                 "is_business": true,
@@ -336,6 +352,9 @@ List of all orders
                 "secret": "z3fsn8jyufm5kpk768q69gkbyr5f4h6w",
                 "addon_to": null,
                 "subevent": null,
+                "valid_from": null,
+                "valid_until": null,
+                "blocked": null,
                 "discount": null,
                 "pseudonymization_id": "MQLJvANO3B",
                 "seat": null,
@@ -467,6 +486,7 @@ Fetching individual orders
         "custom_followup_at": null,
         "checkin_attention": false,
         "require_approval": false,
+        "valid_if_pending": false,
         "invoice_address": {
             "last_modified": "2017-12-01T10:00:00Z",
             "company": "Sample company",
@@ -509,6 +529,9 @@ Fetching individual orders
             "secret": "z3fsn8jyufm5kpk768q69gkbyr5f4h6w",
             "addon_to": null,
             "subevent": null,
+            "valid_from": null,
+            "valid_until": null,
+            "blocked": null,
             "discount": null,
             "pseudonymization_id": "MQLJvANO3B",
             "seat": null,
@@ -640,6 +663,8 @@ Updating order fields
 
    * ``invoice_address`` (you always need to supply the full object, or ``null`` to delete the current address)
 
+   * ``valid_if_pending``
+
    **Example request**:
 
    .. sourcecode:: http
@@ -815,6 +840,7 @@ Creating orders
 
        * does not support or validate memberships
 
+
    You can supply the following fields of the resource:
 
    * ``code`` (optional) – Only ``A-Z`` and ``0-9``, but without ``O`` and ``1``.
@@ -845,6 +871,7 @@ Creating orders
    * ``custom_followup_at`` (optional)
    * ``checkin_attention`` (optional)
    * ``require_approval`` (optional)
+   * ``valid_if_pending`` (optional)
    * ``invoice_address`` (optional)
 
       * ``company``
@@ -880,6 +907,9 @@ Creating orders
       * ``secret`` (optional)
       * ``addon_to`` (optional, see below)
       * ``subevent`` (optional)
+      * ``valid_from`` (optional, if both ``valid_from`` and ``valid_until`` are **missing** (not ``null``) the availability will be computed from the given product)
+      * ``valid_until`` (optional, if both ``valid_from`` and ``valid_until`` are **missing** (not ``null``) the availability will be computed from the given product)
+      * ``requested_valid_from`` (optional, can be set **instead** of ``valid_from`` and ``valid_until`` to signal a user choice for the start time that may or may not be respected)
       * ``answers``
 
         * ``question``
@@ -950,7 +980,7 @@ Creating orders
           "street": "Sesam Street 12",
           "zipcode": "12345",
           "city": "Sample City",
-          "country": "UK",
+          "country": "GB",
           "state": "",
           "internal_reference": "",
           "vat_id": ""
@@ -1448,6 +1478,9 @@ List of all order positions
             "seat": null,
             "addon_to": null,
             "subevent": null,
+            "valid_from": null,
+            "valid_until": null,
+            "blocked": null,
             "checkins": [
               {
                 "list": 44,
@@ -1554,6 +1587,9 @@ Fetching individual positions
         "secret": "z3fsn8jyufm5kpk768q69gkbyr5f4h6w",
         "addon_to": null,
         "subevent": null,
+        "valid_from": null,
+        "valid_until": null,
+        "blocked": null,
         "discount": null,
         "pseudonymization_id": "MQLJvANO3B",
         "seat": null,
@@ -1659,6 +1695,10 @@ Manipulating individual positions
    The ``PATCH`` method now supports changing items, variations, subevents, seats, prices, and tax rules.
    The ``POST`` endpoint to add individual positions has been added.
 
+.. versionadded:: 4.16
+
+   The endpoints to manage blocks have been added.
+
 .. http:patch:: /api/v1/organizers/(organizer)/events/(event)/orderpositions/(id)/
 
    Updates specific fields on an order position. Currently, only the following fields are supported:
@@ -1697,6 +1737,10 @@ Manipulating individual positions
 
    * ``tax_rule``
 
+   * ``valid_from``
+
+   * ``valid_until``
+
    Changing parameters such as ``item`` or ``price`` will **not** automatically trigger creation of a new invoice,
    you need to take care of that yourself.
 
@@ -1771,6 +1815,10 @@ Manipulating individual positions
      and ``option_identifiers`` will be ignored. As a special case, you can submit the magic value
      ``"file:keep"`` as the answer to a file question to keep the current value without re-uploading it.
 
+   * ``valid_from``
+
+   * ``valid_until``
+
    This will **not** automatically trigger creation of a new invoice, you need to take care of that yourself.
 
    **Example request**:
@@ -1834,6 +1882,82 @@ Manipulating individual positions
    :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view this resource.
    :statuscode 404: The requested order position does not exist.
 
+.. http:post:: /api/v1/organizers/(organizer)/events/(event)/orderpositions/(id)/add_block/
+
+   Blocks an order position from being used. The block name either needs to be ``"admin"`` or start with ``"api:"``. It
+   may only contain letters, numbers, dots and underscores. ``"admin"`` represents the regular block that can be set
+   in the backend user interface.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      POST /api/v1/organizers/bigevents/events/sampleconf/orderpositions/23/add_block/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content-Type: application/json
+
+     {
+       "name": "api:block1"
+     }
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      (Full order position resource, see above.)
+
+   :param organizer: The ``slug`` field of the organizer of the event
+   :param event: The ``slug`` field of the event
+   :param code: The ``id`` field of the order position to update
+
+   :statuscode 200: no error
+   :statuscode 400: The order position could not be updated due to invalid submitted data.
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to update this order position.
+
+.. http:post:: /api/v1/organizers/(organizer)/events/(event)/orderpositions/(id)/remove_block/
+
+   Unblocks an order position from being used. The block name either needs to be ``"admin"`` or start with ``"api:"``. It
+   may only contain letters, numbers, dots and underscores. ``"admin"`` represents the regular block that can be set
+   in the backend user interface. Blocks set by plugins cannot be lifted through this API.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      POST /api/v1/organizers/bigevents/events/sampleconf/orderpositions/23/remove_block/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content-Type: application/json
+
+     {
+       "name": "api:block1"
+     }
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      (Full order position resource, see above.)
+
+   :param organizer: The ``slug`` field of the organizer of the event
+   :param event: The ``slug`` field of the event
+   :param code: The ``id`` field of the order position to update
+
+   :statuscode 200: no error
+   :statuscode 400: The order position could not be updated due to invalid submitted data.
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to update this order position.
+
 Changing order contents
 -----------------------
 
@@ -1852,7 +1976,7 @@ otherwise, such as splitting an order or changing fees.
 
    * ``patch_positions``: A list of objects with the two keys ``position`` specifying an order position ID and
      ``body`` specifying the desired changed values of the position (``item``, ``variation``, ``subevent``, ``seat``,
-     ``price``, ``tax_rule``).
+     ``price``, ``tax_rule``, ``valid_from``, ``valid_until``).
 
    * ``cancel_positions``: A list of objects with the single key ``position`` specifying an order position ID.
 
@@ -2541,3 +2665,57 @@ With some non-default ticket secret generation methods, a list of revoked ticket
    :statuscode 200: no error
    :statuscode 401: Authentication failure
    :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view this resource.
+
+Blocked ticket secrets
+----------------------
+
+With some non-default ticket secret generation methods, a list of blocked ticket secrets is required for proper validation.
+This endpoint returns all secrets that are currently blocked **or have been blocked before and are now unblocked**, so
+be sure to check the ``blocked`` attribute for its actual value. The list is currently always ordered with the most
+recently updated ones first.
+
+.. http:get:: /api/v1/organizers/(organizer)/events/(event)/blockedsecrets/
+
+   Returns a list of all blocked or historically blocked secrets within a given event.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/events/sampleconf/blockedsecrets/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+      X-Page-Generated: 2017-12-01T10:00:00Z
+
+      {
+        "count": 1,
+        "next": null,
+        "previous": null,
+        "results": [
+          {
+            "id": 1234,
+            "secret": "k24fiuwvu8kxz3y1",
+            "blocked": true,
+            "updated": "2017-12-01T10:00:00Z",
+          }
+        ]
+      }
+
+   :query integer page: The page number in case of a multi-page result set, default is 1
+   :query datetime updated_since: Only return records that have been updated since the given date.
+   :query boolean blocked: Only return blocked / non-blocked records.
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :param event: The ``slug`` field of the event to fetch
+   :resheader X-Page-Generated: The server time at the beginning of the operation. If you're using this API to fetch
+                                differences, this is the value you want to use as ``updated_since`` in your next call.
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view this resource.

doc/api/resources/organizers.rst

@@ -17,12 +17,18 @@ Field                                 Type                       Description
 name                                  string                     The organizer's full name, i.e. the name of an
                                                                  organization or company.
 slug                                  string                     A short form of the name, used e.g. in URLs.
+public_url                            string                     The public, customer-facing URL of the organizer, where
+                                                                 the list of all events can be found (read-only).
 ===================================== ========================== =======================================================
 
 
 Endpoints
 ---------
 
+.. versionchanged:: 4.17
+
+    The ``public_url`` field has been added.
+
 .. http:get:: /api/v1/organizers/
 
    Returns a list of all organizers the authenticated user/token has access to.
@@ -51,6 +57,7 @@ Endpoints
           {
             "name": "Big Events LLC",
             "slug": "Big Events",
+            "public_url": "https://pretix.eu/bigevents/"
           }
         ]
       }
@@ -84,6 +91,7 @@ Endpoints
       {
         "name": "Big Events LLC",
         "slug": "Big Events",
+        "public_url": "https://pretix.eu/bigevents/"
       }
 
    :param organizer: The ``slug`` field of the organizer to fetch

doc/api/resources/questions.rst

@@ -1,4 +1,4 @@
-.. spelling::
+.. spelling:word-list::
 
    checkin
    datetime

doc/api/resources/shredders.rst

@@ -1,4 +1,4 @@
-.. spelling:: checkin
+.. spelling:word-list:: checkin
 
 Data shredders
 ==============

doc/api/resources/subevents.rst

@@ -1,4 +1,4 @@
-.. spelling::
+.. spelling:word-list::
 
    geo
    lat

doc/api/resources/teams.rst

@@ -1,4 +1,4 @@
-.. spelling:: fullname checkin
+.. spelling:word-list:: fullname checkin
 
 .. _`rest-teams`:
 

doc/api/resources/webhooks.rst

@@ -26,6 +26,7 @@ limit_events                          list of strings            If ``all_events
 action_types                          list of strings            A list of action type filters that limit the
                                                                  notifications sent to this webhook. See below for
                                                                  valid values
+comment                               string                     Internal comment on this webhook, default ``null``
 ===================================== ========================== =======================================================
 
 The following values for ``action_types`` are valid with pretix core:
@@ -56,6 +57,7 @@ The following values for ``action_types`` are valid with pretix core:
     * ``pretix.subevent.added``
     * ``pretix.subevent.changed``
     * ``pretix.subevent.deleted``
+    * ``pretix.event.item.*``
     * ``pretix.event.live.activated``
     * ``pretix.event.live.deactivated``
     * ``pretix.event.testmode.activated``
@@ -98,7 +100,8 @@ Endpoints
             "target_url": "https://httpstat.us/200",
             "all_events": false,
             "limit_events": ["democon"],
-            "action_types": ["pretix.event.order.modified", "pretix.event.order.changed.*"]
+            "action_types": ["pretix.event.order.modified", "pretix.event.order.changed.*"],
+            "comment": null
           }
         ]
       }
@@ -135,7 +138,8 @@ Endpoints
         "target_url": "https://httpstat.us/200",
         "all_events": false,
         "limit_events": ["democon"],
-        "action_types": ["pretix.event.order.modified", "pretix.event.order.changed.*"]
+        "action_types": ["pretix.event.order.modified", "pretix.event.order.changed.*"],
+        "comment": null
       }
 
    :param organizer: The ``slug`` field of the organizer to fetch
@@ -162,7 +166,8 @@ Endpoints
         "target_url": "https://httpstat.us/200",
         "all_events": false,
         "limit_events": ["democon"],
-        "action_types": ["pretix.event.order.modified", "pretix.event.order.changed.*"]
+        "action_types": ["pretix.event.order.modified", "pretix.event.order.changed.*"],
+        "comment": "Called for changes"
       }
 
    **Example response**:
@@ -179,7 +184,8 @@ Endpoints
         "target_url": "https://httpstat.us/200",
         "all_events": false,
         "limit_events": ["democon"],
-        "action_types": ["pretix.event.order.modified", "pretix.event.order.changed.*"]
+        "action_types": ["pretix.event.order.modified", "pretix.event.order.changed.*"],
+        "comment": "Called for changes"
       }
 
    :param organizer: The ``slug`` field of the organizer to create a webhook for
@@ -224,7 +230,8 @@ Endpoints
         "target_url": "https://httpstat.us/200",
         "all_events": false,
         "limit_events": ["democon"],
-        "action_types": ["pretix.event.order.modified", "pretix.event.order.changed.*"]
+        "action_types": ["pretix.event.order.modified", "pretix.event.order.changed.*"],
+        "comment": null
       }
 
    :param organizer: The ``slug`` field of the organizer to modify

doc/conf.py

@@ -13,10 +13,6 @@
 # All configuration values have a default; values that are commented out
 # serve to show the default.
 
-from docutils.parsers.rst.directives.admonitions import BaseAdmonition
-from sphinx.util import compat
-compat.make_admonition = BaseAdmonition  # See https://github.com/spinus/sphinxcontrib-images/issues/41
-
 import sys
 import os
 
@@ -28,12 +24,13 @@ from datetime import date
 sys.path.insert(0, os.path.abspath('../src'))
 
 import django
+
 os.environ.setdefault("DJANGO_SETTINGS_MODULE", "pretix.testutils.settings")
 django.setup()
 
-
 try:
-    import enchant
+    import enchant  # noqa
+
     HAS_PYENCHANT = True
 except:
     HAS_PYENCHANT = False
@@ -41,7 +38,7 @@ except:
 # -- General configuration ------------------------------------------------
 
 # If your documentation needs a minimal Sphinx version, state it here.
-#needs_sphinx = '1.0'
+# needs_sphinx = '1.0'
 
 # Add any Sphinx extension module names here, as strings. They can be
 # extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
@@ -52,6 +49,7 @@ extensions = [
     'sphinx.ext.coverage',
     'sphinxcontrib.httpdomain',
     'sphinxcontrib.images',
+    'sphinxcontrib.jquery',
     'sphinxemoji.sphinxemoji',
 ]
 if HAS_PYENCHANT:
@@ -64,7 +62,7 @@ templates_path = ['_templates']
 source_suffix = '.rst'
 
 # The encoding of source files.
-#source_encoding = 'utf-8-sig'
+# source_encoding = 'utf-8-sig'
 
 # The master toctree document.
 master_doc = 'index'
@@ -79,19 +77,20 @@ copyright = '2014-{}, Raphael Michel'.format(date.today().year)
 #
 # The short X.Y version.
 from pretix import __version__
+
 version = '.'.join(__version__.split('.')[:2])
 # The full version, including alpha/beta/rc tags.
 release = __version__
 
 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.
-#language = None
+# language = None
 
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:
-#today = ''
+# today = ''
 # Else, today_fmt is used as the format for a strftime call.
-#today_fmt = '%B %d, %Y'
+# today_fmt = '%B %d, %Y'
 
 # List of patterns, relative to source directory, that match files and
 # directories to ignore when looking for source files.
@@ -99,34 +98,34 @@ exclude_patterns = ['_build']
 
 # The reST default role (used for this markup: `text`) to use for all
 # documents.
-#default_role = None
+# default_role = None
 
 # If true, '()' will be appended to :func: etc. cross-reference text.
-#add_function_parentheses = True
+# add_function_parentheses = True
 
 # If true, the current module name will be prepended to all description
 # unit titles (such as .. function::).
-#add_module_names = True
+# add_module_names = True
 
 # If true, sectionauthor and moduleauthor directives will be shown in the
 # output. They are ignored by default.
-#show_authors = False
+# show_authors = False
 
 # The name of the Pygments (syntax highlighting) style to use.
 pygments_style = 'sphinx'
 
 # A list of ignored prefixes for module index sorting.
-#modindex_common_prefix = []
+# modindex_common_prefix = []
 
 # If true, keep warnings as "system message" paragraphs in the built documents.
-#keep_warnings = False
+# keep_warnings = False
 
 
 # -- Options for HTML output ----------------------------------------------
 
 # The theme to use for HTML and HTML Help pages.  See the documentation for
 # a list of builtin themes.
-#html_theme = ""
+# html_theme = ""
 
 # Theme options are theme-specific and customize the look and feel of a theme
 # further.  For a list of options available for each theme, see the
@@ -136,14 +135,14 @@ html_theme_options = {
 }
 
 # Add any paths that contain custom themes here, relative to this directory.
-#html_theme_path = []
+# html_theme_path = []
 
 # The name for this set of Sphinx documents.  If None, it defaults to
 # "<project> v<release> documentation".
-#html_title = None
+# html_title = None
 
 # A shorter title for the navigation bar.  Default is the same as html_title.
-#html_short_title = None
+# html_short_title = None
 
 # The name of an image file (relative to this directory) to place at the top
 # of the sidebar.
@@ -152,7 +151,7 @@ html_logo = 'images/logo-white.svg'
 # The name of an image file (within the static path) to use as favicon of the
 # docs.  This file should be a Windows icon file (.ico) being 16x16 or 32x32
 # pixels large.
-#html_favicon = None
+# html_favicon = None
 
 # Add any paths that contain custom static files (such as style sheets) here,
 # relative to this directory. They are copied after the builtin static files,
@@ -166,18 +165,18 @@ html_static_path = [
 # Add any extra paths that contain custom files (such as robots.txt or
 # .htaccess) here, relative to this directory. These files are copied
 # directly to the root of the documentation.
-#html_extra_path = []
+# html_extra_path = []
 
 # If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
 # using the given strftime format.
-#html_last_updated_fmt = '%b %d, %Y'
+# html_last_updated_fmt = '%b %d, %Y'
 
 # If true, SmartyPants will be used to convert quotes and dashes to
 # typographically correct entities.
-#html_use_smartypants = True
+# html_use_smartypants = True
 
 # Custom sidebar templates, maps document names to template names.
-#html_sidebars = {}
+# html_sidebars = {}
 
 # Additional templates that should be rendered to pages, maps page names to
 # template names.
@@ -192,24 +191,24 @@ html_domain_indices = False
 html_use_index = False
 
 # If true, the index is split into individual pages for each letter.
-#html_split_index = False
+# html_split_index = False
 
 # If true, links to the reST sources are added to the pages.
 html_show_sourcelink = True
 
 # If true, "Created using Sphinx" is shown in the HTML footer. Default is True.
-#html_show_sphinx = True
+# html_show_sphinx = True
 
 # If true, "(C) Copyright ..." is shown in the HTML footer. Default is True.
-#html_show_copyright = True
+# html_show_copyright = True
 
 # If true, an OpenSearch description file will be output, and all pages will
 # contain a <link> tag referring to it.  The value of this option must be the
 # base URL from which the finished HTML is served.
-#html_use_opensearch = ''
+# html_use_opensearch = ''
 
 # This is the file name suffix for HTML files (e.g. ".xhtml").
-#html_file_suffix = None
+# html_file_suffix = None
 
 # Output file base name for HTML help builder.
 htmlhelp_basename = 'pretixdoc'
@@ -217,47 +216,46 @@ htmlhelp_basename = 'pretixdoc'
 html_theme = 'pretix_theme'
 html_theme_path = [os.path.abspath('_themes')]
 
-
 # -- Options for LaTeX output ---------------------------------------------
 
 latex_elements = {
-# The paper size ('letterpaper' or 'a4paper').
+    # The paper size ('letterpaper' or 'a4paper').
     'papersize': 'a4paper',
 
-# The font size ('10pt', '11pt' or '12pt').
+    # The font size ('10pt', '11pt' or '12pt').
     'pointsize': '10pt',
 
-# Additional stuff for the LaTeX preamble.
-#'preamble': '',
+    # Additional stuff for the LaTeX preamble.
+    # 'preamble': '',
 }
 
 # Grouping the document tree into LaTeX files. List of tuples
 # (source start file, target name, title,
 #  author, documentclass [howto, manual, or own class]).
 latex_documents = [
-  ('index', 'pretix.tex', 'pretix Documentation',
-   'Raphael Michel', 'manual'),
+    ('index', 'pretix.tex', 'pretix Documentation',
+     'Raphael Michel', 'manual'),
 ]
 
 # The name of an image file (relative to this directory) to place at the top of
 # the title page.
-#latex_logo = None
+# latex_logo = None
 
 # For "manual" documents, if this is true, then toplevel headings are parts,
 # not chapters.
-#latex_use_parts = False
+# latex_use_parts = False
 
 # If true, show page references after internal links.
-#latex_show_pagerefs = False
+# latex_show_pagerefs = False
 
 # If true, show URL addresses after external links.
-#latex_show_urls = False
+# latex_show_urls = False
 
 # Documents to append as an appendix to all manuals.
-#latex_appendices = []
+# latex_appendices = []
 
 # If false, no module index is generated.
-#latex_domain_indices = True
+# latex_domain_indices = True
 
 
 # -- Options for manual page output ---------------------------------------
@@ -270,7 +268,7 @@ man_pages = [
 ]
 
 # If true, show URL addresses after external links.
-#man_show_urls = False
+# man_show_urls = False
 
 
 # -- Options for Texinfo output -------------------------------------------
@@ -279,22 +277,22 @@ man_pages = [
 # (source start file, target name, title, author,
 #  dir menu entry, description, category)
 texinfo_documents = [
-  ('index', 'pretix', 'pretix Documentation',
-   'Raphael Michel', 'pretix', 'One line description of project.',
-   'Miscellaneous'),
+    ('index', 'pretix', 'pretix Documentation',
+     'Raphael Michel', 'pretix', 'One line description of project.',
+     'Miscellaneous'),
 ]
 
 # Documents to append as an appendix to all manuals.
-#texinfo_appendices = []
+# texinfo_appendices = []
 
 # If false, no module index is generated.
-#texinfo_domain_indices = True
+# texinfo_domain_indices = True
 
 # How to display URL addresses: 'footnote', 'no', or 'inline'.
-#texinfo_show_urls = 'footnote'
+# texinfo_show_urls = 'footnote'
 
 # If true, do not generate a @detailmenu in the "Top" node's menu.
-#texinfo_no_detailmenu = False
+# texinfo_no_detailmenu = False
 
 
 images_config = {
@@ -314,12 +312,13 @@ if HAS_PYENCHANT:
     # String specifying a file containing a list of words known to be spelled
     # correctly but that do not appear in the language dictionary selected by
     # spelling_lang. The file should contain one word per line.
-    spelling_word_list_filename='spelling_wordlist.txt'
+    spelling_word_list_filename = 'spelling_wordlist.txt'
 
     # Boolean controlling whether suggestions for misspelled words are printed.
     # Defaults to False.
-    spelling_show_suggestions=True
+    spelling_show_suggestions = True
 
     # List of filter classes to be added to the tokenizer that produces words to be checked.
     from checkin_filter import CheckinFilter
-    spelling_filters=[CheckinFilter]
+
+    spelling_filters = [CheckinFilter]

doc/development/api/general.rst

@@ -61,7 +61,7 @@ Backend
              item_formsets, order_search_filter_q, order_search_forms
 
 .. automodule:: pretix.base.signals
-   :members: logentry_display, logentry_object_link, requiredaction_display, timeline_events
+   :members: logentry_display, logentry_object_link, requiredaction_display, timeline_events, orderposition_blocked_display
 
 Vouchers
 """"""""

doc/development/api/payment.rst

@@ -102,6 +102,8 @@ The provider class
 
    .. automethod:: render_invoice_text
 
+   .. automethod:: render_invoice_stamp
+
    .. automethod:: order_change_allowed
 
    .. automethod:: payment_prepare
@@ -120,6 +122,8 @@ The provider class
 
    .. automethod:: refund_control_render
 
+   .. automethod:: refund_control_render_short
+
    .. automethod:: new_refund_control_form_render
 
    .. automethod:: new_refund_control_form_process
@@ -130,6 +134,8 @@ The provider class
 
    .. automethod:: matching_id
 
+   .. automethod:: refund_matching_id
+
    .. automethod:: shred_payment_info
 
    .. automethod:: cancel_payment

doc/development/api/plugins.rst

@@ -55,7 +55,6 @@ visible            boolean (optional)   ``True`` by default, can hide a plugin s
 restricted         boolean (optional)   ``False`` by default, restricts a plugin such that it can only be enabled
                                         for an event by system administrators / superusers.
 experimental       boolean (optional)   ``False`` by default, marks a plugin as an experimental feature in the plugins list.
-picture            string (optional)    Path to a picture resolvable through the static file system.
 compatibility      string               Specifier for compatible pretix versions.
 ================== ==================== ===========================================================
 

doc/development/contribution/style.rst

@@ -1,4 +1,4 @@
-.. spelling:: Rebase rebasing
+.. spelling:word-list:: Rebase rebasing
 
 Coding style and quality
 ========================

doc/development/implementation/models.rst

@@ -1,7 +1,7 @@
 .. highlight:: python
    :linenothreshold: 5
 
-.. spelling:: answ contrib
+.. spelling:word-list:: answ contrib
 
 Data model
 ==========

doc/images/checkin_offline.puml

@@ -23,30 +23,50 @@ partition "data-based check" {
     "Is the order in status PAID or PENDING\nand is the position not canceled?" --> if "" then
         -right->[no] "Return error CANCELED"
     else
-        -down->[yes] "Is the product part of the check-in list?"
+        -down->[yes] "Is one or more block set on the ticket?"
         --> if "" then
-            -right->[no] "Return error PRODUCT"
+            -right->[no] "Return error BLOCKED"
         else
-            -down->[yes] "Is the subevent part of the check-in list?"
+            -down->[yes] "If this is not an exit, is the valid_from/valid_until\nconstraint on the ticket fulfilled?"
             --> if "" then
-                -right->[no] "Return error INVALID"
-                note bottom: TODO\ninconsistent\nwith online\ncheck
+                -right->[no] "Return error INVALID_TIME"
             else
-                -down->[yes] "Is the order in status PAID?"
+                -down->[yes] "Is the product part of the check-in list?"
                 --> if "" then
-                    -right->[no] "Does the check-in list include pending orders?"
+                    -right->[no] "Return error PRODUCT"
+                else
+                    -down->[yes] "Is the subevent part of the check-in list?"
                     --> if "" then
-                        -right->[no] "Return error UNPAID "
+                        -right->[no] "Return error INVALID"
+                        note bottom: TODO\ninconsistent\nwith online\ncheck
                     else
-                        -down->[yes] "Is ignore_unpaid set?\n(Has the operator confirmed\nthe checkin?)"
+                        -down->[yes] "Is the order in status PAID?"
                         --> if "" then
-                            -right->[no] "Return error UNPAID "
+                            -right->[no] "Is Order.require_approval set?"
+                            --> if "" then
+                                -->[yes] "Return error UNPAID "
+                            else
+                                -right->[no] "Is Order.valid_if_pending set?"
+                                --> if "" then
+                                    -->[yes] "Is this an entry or exit?"
+                                else
+                                    -->[no] "Does the check-in list include pending orders?"
+                                    --> if "" then
+                                        -->[no] "Return error UNPAID "
+                                    else
+                                        -->[yes] "Is ignore_unpaid set on the request?\n(Has the operator confirmed\nthe checkin?)"
+                                        --> if "" then
+                                            -->[no] "Return error UNPAID "
+                                        else
+                                            -->[yes] "Is this an entry or exit?"
+                                        endif
+                                    endif
+                                endif
+                            endif
                         else
                             -down->[yes] "Is this an entry or exit?"
                         endif
                     endif
-                else
-                    -down->[yes] "Is this an entry or exit?"
                 endif
             endif
         endif
@@ -98,16 +118,26 @@ partition "dataless check" {
         --> if "" then
             -right->[yes] "Return error REVOKED"
         else
-            -down->[no] "Is the product part of the check-in list? "
+            -down->[yes] "Is the ticket secret on the block list?"
             --> if "" then
-                -right->[no] "Return error PRODUCT "
+                -right->[yes] "Return error BLOCKED "
             else
-                -down->[yes] "Is the subevent part of the check-in list? "
+                -down->[yes] "If this is not an exit, is the valid_from/valid_until\nconstraint on the ticket fulfilled? "
                 --> if "" then
-                    -right->[no] "Return error INVALID  "
-                    note bottom: TODO\ninconsistent\nwith online\ncheck
+                    -right->[no] "Return error INVALID_TIME "
                 else
-                  --> "Is this an entry or exit? "
+                    -down->[no] "Is the product part of the check-in list? "
+                    --> if "" then
+                        -right->[no] "Return error PRODUCT "
+                    else
+                        -down->[yes] "Is the subevent part of the check-in list? "
+                        --> if "" then
+                            -right->[no] "Return error INVALID  "
+                            note bottom: TODO\ninconsistent\nwith online\ncheck
+                        else
+                          --> "Is this an entry or exit? "
+                        endif
+                    endif
                 endif
             endif
         endif

doc/images/checkin_online.puml

@@ -40,29 +40,49 @@ endif
 "Is the order in status PAID or PENDING\nand is the position not canceled?" --> if "" then
     -right->[no] "Return error CANCELED"
 else
-    -down->[yes] "Is the product part of the check-in list?"
+    -down->[yes] "Is one or more block set on the ticket?"
     --> if "" then
-        -right->[no] "Return error PRODUCT"
+        -right->[no] "Return error BLOCKED"
     else
-        -down->[yes] "Is the subevent part of the check-in list?"
+        -down->[yes] "If this is not an exit, is the valid_from/valid_until\nconstraint on the ticket fulfilled?"
         --> if "" then
-            -right->[no] "Return error PRODUCT "
+            -right->[no] "Return error INVALID_TIME"
         else
-            -down->[yes] "Is the order in status PAID\nor is this a forced upload?"
+            -down->[yes] "Is the product part of the check-in list?"
             --> if "" then
-                -right->[no] "Does the check-in list include pending orders?"
+                -right->[no] "Return error PRODUCT"
+            else
+                -down->[yes] "Is the subevent part of the check-in list?"
                 --> if "" then
-                    -right->[no] "Return error UNPAID "
+                    -right->[no] "Return error PRODUCT "
                 else
-                    -down->[yes] "Is ignore_unpaid set?\n(Has the operator confirmed\nthe checkin?)"
+                    -down->[yes] "Is the order in status PAID\nor is this a forced upload?"
                     --> if "" then
-                        -right->[no] "Return error UNPAID "
+                        -right->[no] "Is Order.require_approval set?"
+                        --> if "" then
+                            -->[no] "Is Order.valid_if_pending set?"
+                            --> if "" then
+                                -down->[yes] "Is this an entry or exit?\nIs the upload forced?"
+                            else
+                                -right->[no] "Does the check-in list include pending orders?"
+                                --> if "" then
+                                    -right->[no] "Return error UNPAID "
+                                else
+                                    -down->[yes] "Is ignore_unpaid set on the request?\n(Has the operator confirmed\nthe checkin?)"
+                                    --> if "" then
+                                        -right->[no] "Return error UNPAID "
+                                    else
+                                        -down->[yes] "Is this an entry or exit?\nIs the upload forced?"
+                                    endif
+                                endif
+                            endif
+                        else
+                            -->[yes] "Return error UNPAID "
+                        endif
                     else
                         -down->[yes] "Is this an entry or exit?\nIs the upload forced?"
                     endif
                 endif
-            else
-                -down->[yes] "Is this an entry or exit?\nIs the upload forced?"
             endif
         endif
     endif

doc/images/logo-white.svg

@@ -1,69 +1 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<!-- Created with Inkscape (http://www.inkscape.org/) -->
-
-<svg
-   xmlns:dc="http://purl.org/dc/elements/1.1/"
-   xmlns:cc="http://creativecommons.org/ns#"
-   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
-   xmlns:svg="http://www.w3.org/2000/svg"
-   xmlns="http://www.w3.org/2000/svg"
-   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
-   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
-   width="254.15625"
-   height="109.59375"
-   viewBox="0 0 254.15625 109.59375"
-   version="1.1"
-   id="svg5"
-   sodipodi:docname="logo-white.svg"
-   inkscape:version="0.92.1 r"><metadata
-   id="metadata9">
-  <rdf:RDF>
-    <cc:Work
-       rdf:about="">
-      <dc:format>image/svg+xml</dc:format>
-      <dc:type
-         rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
-      <dc:title></dc:title>
-    </cc:Work>
-  </rdf:RDF>
-</metadata>
-<sodipodi:namedview
-   pagecolor="#ffffff"
-   bordercolor="#666666"
-   borderopacity="1"
-   objecttolerance="10"
-   gridtolerance="10"
-   guidetolerance="10"
-   inkscape:pageopacity="0"
-   inkscape:pageshadow="2"
-   inkscape:window-width="1364"
-   inkscape:window-height="676"
-   id="namedview7"
-   showgrid="false"
-   fit-margin-top="0"
-   fit-margin-left="0"
-   fit-margin-right="0"
-   fit-margin-bottom="0"
-   inkscape:zoom="1"
-   inkscape:cx="56.462442"
-   inkscape:cy="54.796875"
-   inkscape:window-x="0"
-   inkscape:window-y="72"
-   inkscape:window-maximized="0"
-   inkscape:current-layer="svg5" />
-
-   id=&quot;svg2&quot;
-   version=&quot;1.1&quot;&gt;
-  <defs
-   id="defs4" />
-<g
-   id="layer1"
-   transform="translate(-277.78125,-568.75)">
-  <path
-     style="color:#000000;display:inline;overflow:visible;visibility:visible;fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:none;marker:none;enable-background:accumulate"
-     d="m 20,20 v 34.09375 c 11.43679,0 20.71875,9.28196 20.71875,20.71875 C 40.71875,86.24928 31.43679,95.5 20,95.5 v 34.09375 h 146.6875 v -9.5 h 3 v 9.5 H 274.15625 V 95.5 c -0.0105,2e-5 -0.0208,0 -0.0312,0 -11.43678,0 -20.71875,-9.25072 -20.71875,-20.6875 0,-11.43679 9.28197,-20.71875 20.71875,-20.71875 0.0105,0 0.0208,-2e-5 0.0312,0 V 20 H 169.6875 v 9.09375 h -3 V 20 Z m 146.6875,16.09375 h 3 v 14 h -3 z m 41.44141,12.833984 c 2.79067,0 5.02343,1.92774 5.02343,4.3125 0,2.38476 -2.23276,4.363282 -5.02343,4.363282 -2.73994,0 -4.97266,-1.978522 -4.97266,-4.363282 0,-2.38476 2.23272,-4.3125 4.97266,-4.3125 z m -13.22852,4.210938 v 8.017578 h 3.95899 v 6.291016 h -3.95899 v 12.279296 c 0,2.02959 0.71015,2.791016 2.13086,2.791016 0.71035,0 1.06703,-0.10181 1.82813,-0.40625 v 5.935547 c -0.71036,0.40591 -2.38661,0.964844 -4.61915,0.964844 -6.13949,0 -8.98046,-3.753876 -8.98046,-8.472657 V 67.447266 h -2.8418 V 61.15625 h 2.8418 V 55.574219 Z M 166.6875,57.09375 h 3 v 14 h -3 z m -74.568359,3.554688 c 8.473509,0 14.207029,4.515688 14.207029,14.105468 0,8.62573 -5.02336,14.105469 -12.07617,14.105469 -1.72514,0 -3.147072,-0.20329 -3.857422,-0.40625 V 99.414062 H 80.751953 V 62.728516 c 2.58772,-1.21775 6.090268,-2.080081 11.367188,-2.080078 z m 49.863279,0 c 8.57499,0 12.63436,5.935363 12.12696,15.220703 l -15.93165,2.234375 c 0.60888,2.94289 2.18061,4.414062 5.68165,4.414062 3.24732,0 5.78445,-0.711556 7.30664,-1.472656 l 2.13086,5.886719 c -2.38476,1.16701 -5.58034,2.080078 -10.6543,2.080078 -8.93017,0 -13.64844,-6.037993 -13.64844,-14.257813 0,-8.21981 4.41329,-14.105468 12.98828,-14.105468 z m -17.92187,0.0059 c 0.8928,0.01358 1.82795,0.04496 2.80468,0.0957 l -1.67578,6.697266 c -1.77589,-0.86257 -3.50104,-0.913692 -4.76953,-0.457032 v 21.513672 h -9.64062 v -25.77539 c 2.79702,-1.376314 7.03166,-2.16926 13.28125,-2.074219 z m 79.24804,0.501953 h 9.64063 v 27.347656 h -9.64063 z m 13.23438,0 h 10.04687 l 3.29883,6.849609 h 0.10156 l 3.60157,-6.849609 h 8.98047 l -7.96485,12.632812 8.72656,14.714844 H 232.67969 L 229.17773,80.9434 h -0.10156 l -3.65234,7.560547 h -9.74219 l 8.57422,-14.105468 z m -74.9668,5.023438 c -2.84142,0 -4.41381,2.585948 -4.10937,7.355468 l 7.76367,-1.166015 c 0,-4.16064 -1.2188,-6.189454 -3.6543,-6.189453 z m -49.507811,0.09961 c -0.71035,0 -1.219131,0.101686 -1.675781,0.253906 v 16.439453 c 0.35517,0.15221 0.863828,0.253906 1.523438,0.253906 3.4503,0 4.871093,-2.840514 4.871093,-8.421874 0,-5.733571 -1.21772,-8.525391 -4.71875,-8.525391 z M 166.6875,78.09375 h 3 v 14 h -3 z m 0,21 h 3 v 14 h -3 z"
-     transform="translate(257.78125,548.75)"
-     id="rect3888"
-     inkscape:connector-curvature="0" />
-</g>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" width="254.156" height="109.594" version="1.1"><g transform="scale(1.9856)"><path d="M36.29 23.21c-.35 0-.61.06-.83.13v8.29c.19.06.45.13.77.13 1.73 0 2.46-1.44 2.46-4.26s-.64-4.29-2.4-4.29z" fill="#f8f8f8"/><path d="M61.22 23.15c-1.44 0-2.21 1.31-2.08 3.71l3.9-.58c.03-2.11-.58-3.14-1.82-3.14z" fill="#f8f8f8"/><path d="M127.39 17.1c.35-.03.61-.29.61-.64V.64c0-.35-.29-.64-.64-.64H75.94v2.48c0 .62-.5 1.12-1.12 1.12-.62 0-1.12-.5-1.12-1.12V0H.64C.29 0 0 .29 0 .64v15.82c0 .35.26.61.61.64 5.47.32 9.82 4.86 9.82 10.43 0 5.57-4.35 10.08-9.82 10.37-.35.03-.61.29-.61.64v15.82c0 .35.29.64.64.64h73.22-.16v-2.48c0-.63.49-1.12 1.12-1.12.63 0 1.12.5 1.12 1.12V55h-.16 51.58c.35 0 .64-.29.64-.64V38.54c0-.35-.26-.61-.61-.64-5.47-.32-9.82-4.83-9.82-10.4s4.35-10.11 9.82-10.4zM37.41 34.57c-.86 0-1.6-.1-1.95-.19v5.54H30.6v-18.5c1.31-.61 3.07-1.06 5.73-1.06 4.26 0 7.17 2.27 7.17 7.1 0 4.35-2.53 7.1-6.08 7.1zm15.58-10.78c-.9-.45-1.76-.45-2.4-.22v10.85h-4.86V21.43c1.41-.7 3.55-1.09 6.69-1.06.45 0 .93.03 1.41.06L53 23.79Zm14.56 4.26-8.03 1.12c.32 1.47 1.09 2.21 2.85 2.21 1.63 0 2.91-.35 3.68-.74l1.09 2.98c-1.22.58-2.82 1.06-5.38 1.06-4.51 0-6.88-3.04-6.88-7.17s2.21-7.1 6.53-7.1c4.35-.03 6.4 2.98 6.14 7.65zm8.38 18.56c0 .62-.5 1.12-1.12 1.12-.62 0-1.12-.5-1.12-1.12v-5.12c0-.62.5-1.12 1.12-1.12.62 0 1.12.52 1.12 1.12zm0-11.07c0 .6-.52 1.12-1.12 1.12-.6 0-1.12-.52-1.12-1.12v-5.12c0-.63.49-1.12 1.12-1.12.63 0 1.12.5 1.12 1.12zm0-11.01c0 .62-.5 1.12-1.12 1.12-.62 0-1.12-.5-1.12-1.12v-5.12c0-.62.5-1.12 1.12-1.12.62 0 1.12.52 1.12 1.12zm0-11.07c0 .6-.52 1.12-1.12 1.12-.6 0-1.12-.52-1.12-1.12V8.34c0-.63.49-1.12 1.12-1.12.63 0 1.12.5 1.12 1.12zM90.11 23.8h-2.02v6.18c0 1.02.35 1.41 1.09 1.41.35 0 .54-.06.93-.19v2.98c-.35.19-1.22.48-2.34.48-3.1 0-4.51-1.89-4.51-4.26v-6.59h-1.44v-3.17h1.44v-2.82l4.86-1.22v4.03h1.98v3.17zm7.07 10.62h-4.86V20.66h4.86zm-2.43-15.58c-1.38 0-2.5-.99-2.5-2.21s1.12-2.18 2.5-2.18 2.53.96 2.53 2.18c0 1.22-1.12 2.21-2.53 2.21zm12.35 15.58-1.76-3.81h-.06l-1.82 3.81h-4.9l4.32-7.1-3.87-6.66h5.06l1.66 3.46h.06l1.82-3.46h4.51l-4 6.37 4.38 7.42-5.41-.03z" fill="#f8f8f8"/></g></svg>

doc/license/faq.rst

@@ -1,4 +1,4 @@
-.. spelling::
+.. spelling:word-list::
 
    AGPL
    AGPLv3

doc/plugins/list.rst

@@ -1,4 +1,4 @@
-.. spelling::
+.. spelling:word-list::
    Analytics
 
 List of plugins

doc/plugins/presale-saml.rst

@@ -1,5 +1,5 @@
 .. highlight:: ini
-.. spelling::
+.. spelling:word-list::
 
    IdP
    skIDentity

doc/requirements.rtd.txt

@@ -1,10 +1,10 @@
-sphinx==2.3.*
-jinja2==3.0.*
+sphinx==6.1.*
+jinja2==3.1.*
 sphinx-rtd-theme
 sphinxcontrib-httpdomain
 sphinxcontrib-images
-sphinxcontrib-spelling==4.*
+sphinxcontrib-jquery
+sphinxcontrib-spelling==7.*
 sphinxemoji
 pygments-markdown-lexer
-# See https://github.com/rfk/pyenchant/pull/130
-git+https://github.com/raphaelm/pyenchant.git@patch-1#egg=pyenchant
+pyenchant==3.2.*

doc/requirements.txt

@@ -1,11 +1,11 @@
 -e ../src/
-sphinx==2.3.*
-jinja2==3.0.*
+sphinx==6.1.*
+jinja2==3.1.*
 sphinx-rtd-theme
 sphinxcontrib-httpdomain
 sphinxcontrib-images
-sphinxcontrib-spelling==4.*
+sphinxcontrib-jquery
+sphinxcontrib-spelling==7.*
 sphinxemoji
 pygments-markdown-lexer
-# See https://github.com/rfk/pyenchant/pull/130
-git+https://github.com/raphaelm/pyenchant.git@patch-1#egg=pyenchant
+pyenchant==3.2.*

doc/user/events/giftcards.rst

@@ -1,4 +1,4 @@
-.. spelling::
+.. spelling:word-list::
 
    Warengutschein
    Wertgutschein

doc/user/events/invoicing.rst

@@ -1,7 +1,7 @@
 Invoice settings
 ================
 
-.. spelling:: Inv
+.. spelling:word-list:: Inv
 
 The settings at "Settings" → "Invoice" allow you to specify if and how pretix should generate invoices for your orders.
 

doc/user/events/widget.rst

@@ -153,9 +153,9 @@ If you want to include all your public events, you can just reference your organ
 There is an optional ``style`` parameter that let's you choose between a monthly calendar view, a week view and a list
 view. If you do not set it, the choice will be taken from your organizer settings::
 
-   <pretix-widget event="https://pretix.eu/demo/series/" style="list"></pretix-widget>
-   <pretix-widget event="https://pretix.eu/demo/series/" style="calendar"></pretix-widget>
-   <pretix-widget event="https://pretix.eu/demo/series/" style="week"></pretix-widget>
+   <pretix-widget event="https://pretix.eu/demo/series/" list-type="list"></pretix-widget>
+   <pretix-widget event="https://pretix.eu/demo/series/" list-type="calendar"></pretix-widget>
+   <pretix-widget event="https://pretix.eu/demo/series/" list-type="week"></pretix-widget>
 
 If you have more than 100 events, the system might refuse to show a list view and always show a calendar for performance
 reasons instead.
@@ -164,7 +164,7 @@ You can see an example here:
 
 .. raw:: html
 
-    <pretix-widget event="https://pretix.eu/demo/series/" style="calendar"></pretix-widget>
+    <pretix-widget event="https://pretix.eu/demo/series/" list-type="calendar"></pretix-widget>
     <noscript>
        <div class="pretix-widget">
             <div class="pretix-widget-info-message">
@@ -176,7 +176,7 @@ You can see an example here:
 You can filter events by meta data attributes. You can create those attributes in your order profile and set their values in both event and series date
 settings. For example, if you set up a meta data property called "Promoted" that you set to "Yes" on some events, you can pass a filter like this::
 
-   <pretix-widget event="https://pretix.eu/demo/series/" style="list" filter="attr[Promoted]=Yes"></pretix-widget>
+   <pretix-widget event="https://pretix.eu/demo/series/" list-type="list" filter="attr[Promoted]=Yes"></pretix-widget>
 
 pretix Button
 -------------

res/icon.svg

@@ -1,36 +1 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<svg
-   xmlns:dc="http://purl.org/dc/elements/1.1/"
-   xmlns:cc="http://creativecommons.org/ns#"
-   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
-   xmlns:svg="http://www.w3.org/2000/svg"
-   xmlns="http://www.w3.org/2000/svg"
-   viewBox="0 0 149.59399 149.59399"
-   version="1.1"
-   id="svg2"
-   height="159.56693"
-   width="159.56693">
-  <defs
-     id="defs4" />
-  <metadata
-     id="metadata7">
-    <rdf:RDF>
-      <cc:Work
-         rdf:about="">
-        <dc:format>image/svg+xml</dc:format>
-        <dc:type
-           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
-        <dc:title></dc:title>
-      </cc:Work>
-    </rdf:RDF>
-  </metadata>
-  <g
-     transform="translate(-257.78125,-548.74975)"
-     id="layer1">
-    <path
-       id="rect3888"
-       transform="matrix(0.93749999,0,0,0.93749999,257.78125,548.74975)"
-       d="M 21.333984 21.333984 L 21.333984 57.699219 C 33.470966 57.699219 43.320312 67.601506 43.320312 79.800781 C 43.320312 92.000035 33.470966 101.86719 21.333984 101.86719 L 21.333984 138.23438 L 94.226562 138.23438 L 94.226562 128.09961 L 97.410156 128.09961 L 97.410156 138.23438 L 138.23438 138.23438 L 138.23438 101.86719 C 138.22328 101.86721 138.21216 101.86719 138.20117 101.86719 C 126.0642 101.86719 116.21289 92.000035 116.21289 79.800781 C 116.21289 67.601506 126.0642 57.699219 138.20117 57.699219 C 138.21237 57.699219 138.22339 57.699197 138.23438 57.699219 L 138.23438 21.333984 L 97.410156 21.333984 L 97.410156 31.033203 L 94.226562 31.033203 L 94.226562 21.333984 L 21.333984 21.333984 z M 94.226562 38.5 L 97.410156 38.5 L 97.410156 53.433594 L 94.226562 53.433594 L 94.226562 38.5 z M 94.226562 60.900391 L 97.410156 60.900391 L 97.410156 75.833984 L 94.226562 75.833984 L 94.226562 60.900391 z M 67.044922 64.027344 C 76.359333 64.027344 82.662109 68.991742 82.662109 79.533203 C 82.662109 89.014942 77.139434 95.039062 69.386719 95.039062 C 67.490377 95.039062 65.927327 94.814901 65.146484 94.591797 L 65.146484 106.64062 L 54.550781 106.64062 L 54.550781 66.314453 C 57.395304 64.97585 61.244324 64.027344 67.044922 64.027344 z M 66.990234 70.216797 C 66.209392 70.216797 65.648458 70.328766 65.146484 70.496094 L 65.146484 88.568359 C 65.536906 88.735677 66.097199 88.845703 66.822266 88.845703 C 70.61497 88.845703 72.175781 85.725087 72.175781 79.589844 C 72.175781 73.287273 70.838704 70.216797 66.990234 70.216797 z M 94.226562 83.300781 L 97.410156 83.300781 L 97.410156 98.234375 L 94.226562 98.234375 L 94.226562 83.300781 z M 94.226562 105.69922 L 97.410156 105.69922 L 97.410156 120.63281 L 94.226562 120.63281 L 94.226562 105.69922 z "
-       style="color:#000000;display:inline;overflow:visible;visibility:visible;fill:#3b1c4a;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:1.06666672;marker:none;enable-background:accumulate" />
-  </g>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" width="159.567" height="159.567" version="1.1" viewBox="0 0 149.594 149.594"><g transform="matrix(.9375 0 0 .9375 20.413 20.413)"><path d="M45.52 48.98c-.74 0-1.28.13-1.75.27v17.43c.4.13.94.27 1.61.27 3.63 0 5.18-3.03 5.18-8.95s-1.35-9.02-5.05-9.02z" fill="#3b1c4a"/><path d="M114.72 36.13c.74-.07 1.28-.61 1.28-1.35V1.35c0-.74-.61-1.35-1.35-1.35H75.99v5.38c0 1.15-.94 2.09-2.09 2.09s-2.09-.94-2.09-2.09V0H1.35C.61 0 0 .61 0 1.35v33.44c0 .74.54 1.28 1.28 1.35 11.51.67 20.66 10.23 20.66 21.94s-9.15 21.2-20.66 21.8c-.74.07-1.28.61-1.28 1.35v33.44c0 .74.61 1.35 1.35 1.35h70.48v-5.38c0-1.19.9-2.09 2.09-2.09s2.09.94 2.09 2.09v5.38h38.66c.74 0 1.35-.61 1.35-1.35V81.23c0-.74-.54-1.28-1.28-1.35-11.51-.67-20.66-10.16-20.66-21.87s9.15-21.26 20.66-21.87zM47.87 72.87c-1.82 0-3.36-.2-4.1-.4v11.64H33.54V45.22C36.3 43.94 40 43 45.58 43c8.95 0 15.07 4.78 15.07 14.94 0 9.15-5.32 14.94-12.78 14.94zm28.12 25.3c0 1.15-.94 2.09-2.09 2.09s-2.09-.94-2.09-2.09V87.4c0-1.15.94-2.09 2.09-2.09s2.09.97 2.09 2.09zm0-23.28c0 1.11-.97 2.09-2.09 2.09-1.12 0-2.09-.97-2.09-2.09V64.12c0-1.19.9-2.09 2.09-2.09s2.09.94 2.09 2.09zm0-23.15c0 1.15-.94 2.09-2.09 2.09s-2.09-.94-2.09-2.09V40.97c0-1.15.94-2.09 2.09-2.09s2.09.97 2.09 2.09zm0-23.28c0 1.11-.97 2.09-2.09 2.09-1.12 0-2.09-.97-2.09-2.09V17.69c0-1.19.9-2.09 2.09-2.09s2.09.94 2.09 2.09z" fill="#3b1c4a"/></g></svg>

res/logo.svg

@@ -1,72 +1 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<!-- Created with Inkscape (http://www.inkscape.org/) -->
-
-<svg
-   xmlns:dc="http://purl.org/dc/elements/1.1/"
-   xmlns:cc="http://creativecommons.org/ns#"
-   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
-   xmlns:svg="http://www.w3.org/2000/svg"
-   xmlns="http://www.w3.org/2000/svg"
-   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
-   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
-   width="600"
-   height="400"
-   id="svg2"
-   version="1.1"
-   inkscape:version="0.92.1 r"
-   sodipodi:docname="logo.svg"
-   inkscape:export-filename="/tmp/LOGO.png"
-   inkscape:export-xdpi="96"
-   inkscape:export-ydpi="96"
-   viewBox="0 0 562.50001 375.00002">
-  <defs
-     id="defs4" />
-  <sodipodi:namedview
-     id="base"
-     pagecolor="#ffffff"
-     bordercolor="#666666"
-     borderopacity="1.0"
-     inkscape:pageopacity="0.0"
-     inkscape:pageshadow="2"
-     inkscape:zoom="0.9899495"
-     inkscape:cx="133.36756"
-     inkscape:cy="276.10571"
-     inkscape:document-units="px"
-     inkscape:current-layer="layer1"
-     showgrid="false"
-     inkscape:window-width="1916"
-     inkscape:window-height="1041"
-     inkscape:window-x="1920"
-     inkscape:window-y="18"
-     inkscape:window-maximized="0"
-     fit-margin-top="20"
-     fit-margin-left="20"
-     fit-margin-right="20"
-     fit-margin-bottom="20" />
-  <metadata
-     id="metadata7">
-    <rdf:RDF>
-      <cc:Work
-         rdf:about="">
-        <dc:format>image/svg+xml</dc:format>
-        <dc:type
-           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
-        <dc:title></dc:title>
-      </cc:Work>
-    </rdf:RDF>
-  </metadata>
-  <g
-     inkscape:label="Ebene 1"
-     inkscape:groupmode="layer"
-     id="layer1"
-     transform="translate(-259.03125,-322.09374)">
-    <path
-       style="color:#000000;display:inline;overflow:visible;visibility:visible;fill:#3b1c4a;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:1.91138947;marker:none;enable-background:accumulate"
-       d="m 297.38548,404.85558 v 65.16643 c 21.86016,0 39.6016,17.74144 39.6016,39.60159 0,21.86015 -17.74144,39.54187 -39.6016,39.54187 v 65.16644 h 280.37693 v -18.1582 h 5.73417 v 18.1582 h 199.68046 v -65.16644 c -0.02,4e-5 -0.0397,0 -0.0596,0 -21.86015,0 -39.6016,-17.68172 -39.6016,-39.54187 0,-21.86015 17.74145,-39.60159 39.6016,-39.60159 0.02,0 0.0397,-4e-5 0.0596,0 V 404.85558 H 583.49658 v 17.38169 h -5.73417 V 404.85558 Z M 577.76241,435.617 h 5.73417 v 26.75945 h -5.73417 z m 79.21068,24.53074 c 5.33405,0 9.60172,3.68466 9.60172,8.24287 0,4.5582 -4.26767,8.33993 -9.60172,8.33993 -5.2371,0 -9.50469,-3.78173 -9.50469,-8.33993 0,-4.55821 4.26759,-8.24287 9.50469,-8.24287 z m -25.28486,8.04874 v 15.32472 h 7.56717 v 12.02458 h -7.56717 v 23.47051 c 0,3.87934 1.35737,5.33473 4.0729,5.33473 1.35775,0 2.03951,-0.19461 3.49427,-0.77651 v 11.34514 c -1.35777,0.77585 -4.56174,1.84419 -8.829,1.84419 -11.73495,0 -17.16515,-7.17511 -17.16515,-16.19455 v -25.02351 h -5.43179 V 483.5212 h 5.43179 v -10.66944 z m -53.92582,7.5597 h 5.73417 v 26.75945 h -5.73417 z m -142.52917,6.79439 c 16.19618,0 27.15517,8.63124 27.15517,26.96104 0,16.48713 -9.6016,26.96105 -23.08227,26.96105 -3.29741,0 -6.01528,-0.38857 -7.37304,-0.77651 v 20.95062 H 413.50612 V 486.5264 c 4.94614,-2.32759 11.64087,-3.97583 21.72712,-3.97583 z m 95.30815,0 c 16.39014,0 24.14917,11.34479 23.17933,29.09269 l -30.45158,4.27076 c 1.1638,5.62501 4.16799,8.437 10.85985,8.437 6.20689,0 11.05633,-1.36007 13.96583,-2.81482 l 4.0729,11.2518 c -4.5582,2.23062 -10.6662,3.97584 -20.36451,3.97584 -17.06903,0 -26.08749,-11.54096 -26.08749,-27.25223 0,-15.71126 8.43552,-26.96104 24.82567,-26.96104 z m -34.25568,0.0113 c 1.70649,0.026 3.49392,0.0859 5.36084,0.18292 l -3.20307,12.80108 c -3.39442,-1.6487 -6.69185,-1.74642 -9.11643,-0.87356 v 41.121 h -18.42698 v -49.2668 c 5.3462,-2.63068 13.44024,-4.1463 25.38564,-3.96465 z m 151.47387,0.95943 h 18.42699 v 52.27202 h -18.42699 z m 25.29605,0 h 19.20348 l 6.30535,13.09227 h 0.19412 l 6.884,-13.09227 h 17.16517 l -15.22393,24.14622 16.67986,28.1258 h -20.3645 l -6.69361,-14.45115 h -0.19412 l -6.98104,14.45115 h -18.62112 l 16.38867,-26.96104 z m -143.29075,9.60175 c -5.43106,0 -8.43651,4.94275 -7.85461,14.05916 l 14.8394,-2.22871 c 0,-7.9526 -2.3296,-11.83045 -6.98479,-11.83045 z m -94.6287,0.19038 c -1.35776,0 -2.33024,0.19437 -3.20308,0.48532 v 31.4222 c 0.67888,0.29093 1.65112,0.48531 2.91189,0.48531 6.59487,0 9.31055,-5.42933 9.31055,-16.09748 0,-10.95908 -2.32753,-16.29535 -9.01936,-16.29535 z m 142.62623,22.58194 h 5.73417 v 26.75946 h -5.73417 z m 0,40.13918 h 5.73417 v 26.75946 h -5.73417 z"
-       id="rect3888"
-       inkscape:connector-curvature="0"
-       inkscape:export-filename="/tmp/LOGO.png"
-       inkscape:export-xdpi="88"
-       inkscape:export-ydpi="88" />
-  </g>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" width="600" height="400" version="1.1" viewBox="0 0 562.5 375"><g transform="translate(-259.031 -322.094)"><g transform="matrix(3.79525 0 0 3.79525 297.317 405.22)"><path d="M36.29 23.21c-.35 0-.61.06-.83.13v8.29c.19.06.45.13.77.13 1.73 0 2.46-1.44 2.46-4.26s-.64-4.29-2.4-4.29z" fill="#3b1c4a"/><path d="M61.22 23.15c-1.44 0-2.21 1.31-2.08 3.71l3.9-.58c.03-2.11-.58-3.14-1.82-3.14z" fill="#3b1c4a"/><path d="M127.39 17.1c.35-.03.61-.29.61-.64V.64c0-.35-.29-.64-.64-.64H75.81v2.48c0 .55-.45.99-.99.99s-.99-.45-.99-.99V0H.64C.29 0 0 .29 0 .64v15.82c0 .35.26.61.61.64 5.47.32 9.82 4.86 9.82 10.43 0 5.57-4.35 10.08-9.82 10.37-.35.03-.61.29-.61.64v15.82c0 .35.29.64.64.64h73.22-.03v-2.48c0-.57.43-.99.99-.99s.99.45.99.99V55h-.03 51.58c.35 0 .64-.29.64-.64V38.54c0-.35-.26-.61-.61-.64-5.47-.32-9.82-4.83-9.82-10.4s4.35-10.11 9.82-10.4zM37.41 34.57c-.86 0-1.6-.1-1.95-.19v5.54H30.6v-18.5c1.31-.61 3.07-1.06 5.73-1.06 4.26 0 7.17 2.27 7.17 7.1 0 4.35-2.53 7.1-6.08 7.1zm15.58-10.78c-.9-.45-1.76-.45-2.4-.22v10.85h-4.86V21.43c1.41-.7 3.55-1.09 6.69-1.06.45 0 .93.03 1.41.06L53 23.79Zm14.56 4.26-8.03 1.12c.32 1.47 1.09 2.21 2.85 2.21 1.63 0 2.91-.35 3.68-.74l1.09 2.98c-1.22.58-2.82 1.06-5.38 1.06-4.51 0-6.88-3.04-6.88-7.17s2.21-7.1 6.53-7.1c4.35-.03 6.4 2.98 6.14 7.65zm8.26 18.56c0 .55-.45.99-.99.99s-.99-.45-.99-.99v-5.12c0-.55.45-.99.99-.99s.99.46.99.99zm0-11.07c0 .53-.46.99-.99.99s-.99-.46-.99-.99v-5.12c0-.57.43-.99.99-.99s.99.45.99.99zm0-11.01c0 .55-.45.99-.99.99s-.99-.45-.99-.99v-5.12c0-.55.45-.99.99-.99s.99.46.99.99zm0-11.07c0 .53-.46.99-.99.99s-.99-.46-.99-.99V8.34c0-.57.43-.99.99-.99s.99.45.99.99zm14.3 10.34h-2.02v6.18c0 1.02.35 1.41 1.09 1.41.35 0 .54-.06.93-.19v2.98c-.35.19-1.22.48-2.34.48-3.1 0-4.51-1.89-4.51-4.26v-6.59h-1.44v-3.17h1.44v-2.82l4.86-1.22v4.03h1.98v3.17zm7.07 10.62h-4.86V20.66h4.86zm-2.43-15.58c-1.38 0-2.5-.99-2.5-2.21s1.12-2.18 2.5-2.18 2.53.96 2.53 2.18c0 1.22-1.12 2.21-2.53 2.21zm12.35 15.58-1.76-3.81h-.06l-1.82 3.81h-4.9l4.32-7.1-3.87-6.66h5.06l1.66 3.46h.06l1.82-3.46h4.51l-4 6.37 4.38 7.42-5.41-.03z" fill="#3b1c4a"/></g></g></svg>

res/logo_white.svg

@@ -1,68 +1 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<!-- Created with Inkscape (http://www.inkscape.org/) -->
-
-<svg
-   xmlns:dc="http://purl.org/dc/elements/1.1/"
-   xmlns:cc="http://creativecommons.org/ns#"
-   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
-   xmlns:svg="http://www.w3.org/2000/svg"
-   xmlns="http://www.w3.org/2000/svg"
-   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
-   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
-   width="294.15625"
-   height="149.59375"
-   id="svg2"
-   version="1.1"
-   inkscape:version="0.91 r13725"
-   sodipodi:docname="logo_draft_white.svg"
-   inkscape:export-filename="/home/raphael/proj/pretix/pretix/logo_draft.png"
-   inkscape:export-xdpi="88.529999"
-   inkscape:export-ydpi="88.529999">
-  <defs
-     id="defs4" />
-  <sodipodi:namedview
-     id="base"
-     pagecolor="#ffffff"
-     bordercolor="#666666"
-     borderopacity="1.0"
-     inkscape:pageopacity="0.0"
-     inkscape:pageshadow="2"
-     inkscape:zoom="0.9899495"
-     inkscape:cx="121.06383"
-     inkscape:cy="277.43904"
-     inkscape:document-units="px"
-     inkscape:current-layer="layer1"
-     showgrid="false"
-     inkscape:window-width="956"
-     inkscape:window-height="1041"
-     inkscape:window-x="2880"
-     inkscape:window-y="18"
-     inkscape:window-maximized="0"
-     fit-margin-top="20"
-     fit-margin-left="20"
-     fit-margin-right="20"
-     fit-margin-bottom="20" />
-  <metadata
-     id="metadata7">
-    <rdf:RDF>
-      <cc:Work
-         rdf:about="">
-        <dc:format>image/svg+xml</dc:format>
-        <dc:type
-           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
-        <dc:title></dc:title>
-      </cc:Work>
-    </rdf:RDF>
-  </metadata>
-  <g
-     inkscape:label="Ebene 1"
-     inkscape:groupmode="layer"
-     id="layer1"
-     transform="translate(-257.78125,-548.75)">
-    <path
-       style="color:#000000;display:inline;overflow:visible;visibility:visible;fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:none;marker:none;enable-background:accumulate"
-       d="M 20 20 L 20 54.09375 C 31.43679 54.09375 40.71875 63.37571 40.71875 74.8125 C 40.71875 86.24928 31.43679 95.5 20 95.5 L 20 129.59375 L 166.6875 129.59375 L 166.6875 120.09375 L 169.6875 120.09375 L 169.6875 129.59375 L 274.15625 129.59375 L 274.15625 95.5 C 274.14575 95.50002 274.1354 95.5 274.125 95.5 C 262.68822 95.5 253.40625 86.24928 253.40625 74.8125 C 253.40625 63.37571 262.68822 54.09375 274.125 54.09375 C 274.1355 54.09375 274.14585 54.09373 274.15625 54.09375 L 274.15625 20 L 169.6875 20 L 169.6875 29.09375 L 166.6875 29.09375 L 166.6875 20 L 20 20 z M 166.6875 36.09375 L 169.6875 36.09375 L 169.6875 50.09375 L 166.6875 50.09375 L 166.6875 36.09375 z M 208.12891 48.927734 C 210.91958 48.927734 213.15234 50.855474 213.15234 53.240234 C 213.15234 55.624994 210.91958 57.603516 208.12891 57.603516 C 205.38897 57.603516 203.15625 55.624994 203.15625 53.240234 C 203.15625 50.855474 205.38897 48.927734 208.12891 48.927734 z M 194.90039 53.138672 L 194.90039 61.15625 L 198.85938 61.15625 L 198.85938 67.447266 L 194.90039 67.447266 L 194.90039 79.726562 C 194.90039 81.756152 195.61054 82.517578 197.03125 82.517578 C 197.7416 82.517578 198.09828 82.415768 198.85938 82.111328 L 198.85938 88.046875 C 198.14902 88.452785 196.47277 89.011719 194.24023 89.011719 C 188.10074 89.011719 185.25977 85.257843 185.25977 80.539062 L 185.25977 67.447266 L 182.41797 67.447266 L 182.41797 61.15625 L 185.25977 61.15625 L 185.25977 55.574219 L 194.90039 53.138672 z M 166.6875 57.09375 L 169.6875 57.09375 L 169.6875 71.09375 L 166.6875 71.09375 L 166.6875 57.09375 z M 92.119141 60.648438 C 100.59265 60.648438 106.32617 65.164126 106.32617 74.753906 C 106.32617 83.379636 101.30281 88.859375 94.25 88.859375 C 92.52486 88.859375 91.102928 88.656085 90.392578 88.453125 L 90.392578 99.414062 L 80.751953 99.414062 L 80.751953 62.728516 C 83.339673 61.510766 86.842221 60.648435 92.119141 60.648438 z M 141.98242 60.648438 C 150.55741 60.648438 154.61678 66.583801 154.10938 75.869141 L 138.17773 78.103516 C 138.78661 81.046406 140.35834 82.517578 143.85938 82.517578 C 147.1067 82.517578 149.64383 81.806022 151.16602 81.044922 L 153.29688 86.931641 C 150.91212 88.098651 147.71654 89.011719 142.64258 89.011719 C 133.71241 89.011719 128.99414 82.973726 128.99414 74.753906 C 128.99414 66.534096 133.40743 60.648438 141.98242 60.648438 z M 124.06055 60.654297 C 124.95335 60.667874 125.8885 60.69926 126.86523 60.75 L 125.18945 67.447266 C 123.41356 66.584696 121.68841 66.533574 120.41992 66.990234 L 120.41992 88.503906 L 110.7793 88.503906 L 110.7793 62.728516 C 113.57632 61.352202 117.81096 60.559256 124.06055 60.654297 z M 203.30859 61.15625 L 212.94922 61.15625 L 212.94922 88.503906 L 203.30859 88.503906 L 203.30859 61.15625 z M 216.54297 61.15625 L 226.58984 61.15625 L 229.88867 68.005859 L 229.99023 68.005859 L 233.5918 61.15625 L 242.57227 61.15625 L 234.60742 73.789062 L 243.33398 88.503906 L 232.67969 88.503906 L 229.17773 80.943359 L 229.07617 80.943359 L 225.42383 88.503906 L 215.68164 88.503906 L 224.25586 74.398438 L 216.54297 61.15625 z M 141.57617 66.179688 C 138.73475 66.179688 137.16236 68.765636 137.4668 73.535156 L 145.23047 72.369141 C 145.23047 68.208501 144.01167 66.179687 141.57617 66.179688 z M 92.068359 66.279297 C 91.358009 66.279297 90.849228 66.380983 90.392578 66.533203 L 90.392578 82.972656 C 90.747748 83.124866 91.256406 83.226562 91.916016 83.226562 C 95.366316 83.226562 96.787109 80.386048 96.787109 74.804688 C 96.787109 69.071117 95.569389 66.279297 92.068359 66.279297 z M 166.6875 78.09375 L 169.6875 78.09375 L 169.6875 92.09375 L 166.6875 92.09375 L 166.6875 78.09375 z M 166.6875 99.09375 L 169.6875 99.09375 L 169.6875 113.09375 L 166.6875 113.09375 L 166.6875 99.09375 z "
-       transform="translate(257.78125,548.75)"
-       id="rect3888" />
-  </g>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" width="294.156" height="149.594" version="1.1"><g transform="translate(-257.781 -548.75)"><g transform="matrix(1.9856 0 0 1.9856 277.781 568.75)"><path d="M36.29 23.21c-.35 0-.61.06-.83.13v8.29c.19.06.45.13.77.13 1.73 0 2.46-1.44 2.46-4.26s-.64-4.29-2.4-4.29z" fill="#f8f8f8"/><path d="M61.22 23.15c-1.44 0-2.21 1.31-2.08 3.71l3.9-.58c.03-2.11-.58-3.14-1.82-3.14z" fill="#f8f8f8"/><path d="M127.39 17.1c.35-.03.61-.29.61-.64V.64c0-.35-.29-.64-.64-.64H75.94v2.48c0 .62-.5 1.12-1.12 1.12-.62 0-1.12-.5-1.12-1.12V0H.64C.29 0 0 .29 0 .64v15.82c0 .35.26.61.61.64 5.47.32 9.82 4.86 9.82 10.43 0 5.57-4.35 10.08-9.82 10.37-.35.03-.61.29-.61.64v15.82c0 .35.29.64.64.64h73.22-.16v-2.48c0-.63.49-1.12 1.12-1.12.63 0 1.12.5 1.12 1.12V55h-.16 51.58c.35 0 .64-.29.64-.64V38.54c0-.35-.26-.61-.61-.64-5.47-.32-9.82-4.83-9.82-10.4s4.35-10.11 9.82-10.4zM37.41 34.57c-.86 0-1.6-.1-1.95-.19v5.54H30.6v-18.5c1.31-.61 3.07-1.06 5.73-1.06 4.26 0 7.17 2.27 7.17 7.1 0 4.35-2.53 7.1-6.08 7.1zm15.58-10.78c-.9-.45-1.76-.45-2.4-.22v10.85h-4.86V21.43c1.41-.7 3.55-1.09 6.69-1.06.45 0 .93.03 1.41.06L53 23.79Zm14.56 4.26-8.03 1.12c.32 1.47 1.09 2.21 2.85 2.21 1.63 0 2.91-.35 3.68-.74l1.09 2.98c-1.22.58-2.82 1.06-5.38 1.06-4.51 0-6.88-3.04-6.88-7.17s2.21-7.1 6.53-7.1c4.35-.03 6.4 2.98 6.14 7.65zm8.38 18.56c0 .62-.5 1.12-1.12 1.12-.62 0-1.12-.5-1.12-1.12v-5.12c0-.62.5-1.12 1.12-1.12.62 0 1.12.52 1.12 1.12zm0-11.07c0 .6-.52 1.12-1.12 1.12-.6 0-1.12-.52-1.12-1.12v-5.12c0-.63.49-1.12 1.12-1.12.63 0 1.12.5 1.12 1.12zm0-11.01c0 .62-.5 1.12-1.12 1.12-.62 0-1.12-.5-1.12-1.12v-5.12c0-.62.5-1.12 1.12-1.12.62 0 1.12.52 1.12 1.12zm0-11.07c0 .6-.52 1.12-1.12 1.12-.6 0-1.12-.52-1.12-1.12V8.34c0-.63.49-1.12 1.12-1.12.63 0 1.12.5 1.12 1.12zM90.11 23.8h-2.02v6.18c0 1.02.35 1.41 1.09 1.41.35 0 .54-.06.93-.19v2.98c-.35.19-1.22.48-2.34.48-3.1 0-4.51-1.89-4.51-4.26v-6.59h-1.44v-3.17h1.44v-2.82l4.86-1.22v4.03h1.98v3.17zm7.07 10.62h-4.86V20.66h4.86zm-2.43-15.58c-1.38 0-2.5-.99-2.5-2.21s1.12-2.18 2.5-2.18 2.53.96 2.53 2.18c0 1.22-1.12 2.21-2.53 2.21zm12.35 15.58-1.76-3.81h-.06l-1.82 3.81h-4.9l4.32-7.1-3.87-6.66h5.06l1.66 3.46h.06l1.82-3.46h4.51l-4 6.37 4.38 7.42-5.41-.03z" fill="#f8f8f8"/></g></g></svg>

src/pretix/__init__.py

@@ -19,4 +19,4 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-__version__ = "4.16.0"
+__version__ = "4.17.0"

src/pretix/api/auth/devicesecurity.py

@@ -19,9 +19,12 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
+import logging
 
 from django.utils.translation import gettext_lazy as _
 
+logger = logging.getLogger(__name__)
+
 
 class FullAccessSecurityProfile:
     identifier = 'full'
@@ -36,7 +39,13 @@ class AllowListSecurityProfile:
 
     def is_allowed(self, request):
         key = (request.method, f"{request.resolver_match.namespace}:{request.resolver_match.url_name}")
-        return key in self.allowlist
+        if key in self.allowlist:
+            return True
+        else:
+            logger.info(
+                f'Request {key} not allowed in profile {self.identifier}'
+            )
+            return False
 
 
 class PretixScanSecurityProfile(AllowListSecurityProfile):
@@ -65,6 +74,7 @@ class PretixScanSecurityProfile(AllowListSecurityProfile):
         ('GET', 'api-v1:checkinlistpos-list'),
         ('POST', 'api-v1:checkinlistpos-redeem'),
         ('GET', 'api-v1:revokedsecrets-list'),
+        ('GET', 'api-v1:blockedsecrets-list'),
         ('GET', 'api-v1:order-list'),
         ('GET', 'api-v1:orderposition-pdf_image'),
         ('GET', 'api-v1:event.settings'),
@@ -99,6 +109,7 @@ class PretixScanNoSyncNoSearchSecurityProfile(AllowListSecurityProfile):
         ('POST', 'api-v1:checkinlist-failed_checkins'),
         ('POST', 'api-v1:checkinlistpos-redeem'),
         ('GET', 'api-v1:revokedsecrets-list'),
+        ('GET', 'api-v1:blockedsecrets-list'),
         ('GET', 'api-v1:orderposition-pdf_image'),
         ('GET', 'api-v1:event.settings'),
         ('POST', 'api-v1:upload'),
@@ -133,6 +144,7 @@ class PretixScanNoSyncSecurityProfile(AllowListSecurityProfile):
         ('GET', 'api-v1:checkinlistpos-list'),
         ('POST', 'api-v1:checkinlistpos-redeem'),
         ('GET', 'api-v1:revokedsecrets-list'),
+        ('GET', 'api-v1:blockedsecrets-list'),
         ('GET', 'api-v1:orderposition-pdf_image'),
         ('GET', 'api-v1:event.settings'),
         ('POST', 'api-v1:upload'),
@@ -199,6 +211,7 @@ class PretixPosSecurityProfile(AllowListSecurityProfile):
         ('POST', 'plugins:pretix_posbackend:stripeterminal.paymentintent'),
         ('PUT', 'plugins:pretix_posbackend:file.upload'),
         ('GET', 'api-v1:revokedsecrets-list'),
+        ('GET', 'api-v1:blockedsecrets-list'),
         ('GET', 'api-v1:event.settings'),
         ('GET', 'plugins:pretix_seating:event.event'),
         ('GET', 'plugins:pretix_seating:event.event.subevent'),

src/pretix/api/middleware.py

@@ -20,6 +20,7 @@
 # <https://www.gnu.org/licenses/>.
 #
 import json
+import logging
 from hashlib import sha1
 
 from django.conf import settings
@@ -34,6 +35,8 @@ from pretix.api.models import ApiCall
 from pretix.base.models import Organizer
 from pretix.helpers import OF_SELF
 
+logger = logging.getLogger(__name__)
+
 
 class IdempotencyMiddleware:
     def __init__(self, get_response):
@@ -97,6 +100,9 @@ class IdempotencyMiddleware:
             return resp
         else:
             if call.locked:
+                logger.info(
+                    f'Concurrent request with idempotency key {idempotency_key} blocked.'
+                )
                 r = JsonResponse(
                     {'detail': 'Concurrent request with idempotency key.'},
                     status=status.HTTP_409_CONFLICT,
@@ -111,6 +117,7 @@ class IdempotencyMiddleware:
                 content=content,
                 status=call.response_code,
             )
+            logger.info(f'API response replayed from idempotency store for key {idempotency_key} [{call.response_code}]')
             for k, v in json.loads(call.response_headers).values():
                 r[k] = v
             return r

src/pretix/api/migrations/0010_webhook_comment.py

@@ -0,0 +1,18 @@
+# Generated by Django 3.2.17 on 2023-02-07 12:18
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixapi', '0009_auto_20221217_1847'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='webhook',
+            name='comment',
+            field=models.CharField(max_length=255, null=True),
+        ),
+    ]

src/pretix/api/models.py

@@ -112,6 +112,7 @@ class WebHook(models.Model):
     target_url = models.URLField(verbose_name=_("Target URL"), max_length=255)
     all_events = models.BooleanField(default=True, verbose_name=_("All events (including newly created ones)"))
     limit_events = models.ManyToManyField('pretixbase.Event', verbose_name=_("Limit to events"), blank=True)
+    comment = models.CharField(verbose_name=_("Comment"), max_length=255, null=True, blank=True)
 
     class Meta:
         ordering = ('id',)

src/pretix/api/pagination.py

@@ -19,9 +19,19 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
+from rest_framework.filters import OrderingFilter
 from rest_framework.pagination import PageNumberPagination
 
+from pretix.helpers import get_deterministic_ordering
+
 
 class Pagination(PageNumberPagination):
     page_size_query_param = 'page_size'
     max_page_size = 50
+
+
+class TotalOrderingFilter(OrderingFilter):
+    def get_ordering(self, request, queryset, view):
+        o = super().get_ordering(request, queryset, view)
+        o = get_deterministic_ordering(queryset.model, o)
+        return o

src/pretix/api/serializers/event.py

@@ -59,6 +59,7 @@ from pretix.base.settings import (
     LazyI18nStringList, validate_event_settings,
 )
 from pretix.base.signals import api_event_settings_fields
+from pretix.multidomain.urlreverse import build_absolute_uri
 
 logger = logging.getLogger(__name__)
 
@@ -164,6 +165,10 @@ class EventSerializer(I18nAwareModelSerializer):
     timezone = TimeZoneField(required=False, choices=[(a, a) for a in common_timezones])
     valid_keys = ValidKeysField(source='*', read_only=True)
     best_availability_state = serializers.IntegerField(allow_null=True, read_only=True)
+    public_url = serializers.SerializerMethodField('get_event_url', read_only=True)
+
+    def get_event_url(self, event):
+        return build_absolute_uri(event, 'presale:event.index')
 
     class Meta:
         model = Event
@@ -171,7 +176,7 @@ class EventSerializer(I18nAwareModelSerializer):
                   'date_to', 'date_admission', 'is_public', 'presale_start',
                   'presale_end', 'location', 'geo_lat', 'geo_lon', 'has_subevents', 'meta_data', 'seating_plan',
                   'plugins', 'seat_category_mapping', 'timezone', 'item_meta_properties', 'valid_keys',
-                  'sales_channels', 'best_availability_state')
+                  'sales_channels', 'best_availability_state', 'public_url')
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
@@ -662,6 +667,7 @@ class EventSettingsSerializer(SettingsSerializer):
         'show_times',
         'show_items_outside_presale_period',
         'display_net_prices',
+        'hide_prices_from_attendees',
         'presale_start_show_date',
         'locales',
         'locale',

src/pretix/api/serializers/item.py

@@ -60,8 +60,8 @@ class InlineItemVariationSerializer(I18nAwareModelSerializer):
         model = ItemVariation
         fields = ('id', 'value', 'active', 'description',
                   'position', 'default_price', 'price', 'original_price', 'require_approval',
-                  'require_membership', 'require_membership_types',
-                  'require_membership_hidden', 'available_from', 'available_until',
+                  'require_membership', 'require_membership_types', 'require_membership_hidden',
+                  'checkin_attention', 'available_from', 'available_until',
                   'sales_channels', 'hide_without_voucher', 'meta_data')
 
     def __init__(self, *args, **kwargs):
@@ -84,8 +84,8 @@ class ItemVariationSerializer(I18nAwareModelSerializer):
         model = ItemVariation
         fields = ('id', 'value', 'active', 'description',
                   'position', 'default_price', 'price', 'original_price', 'require_approval',
-                  'require_membership', 'require_membership_types',
-                  'require_membership_hidden', 'available_from', 'available_until',
+                  'require_membership', 'require_membership_types', 'require_membership_hidden',
+                  'checkin_attention', 'available_from', 'available_until',
                   'sales_channels', 'hide_without_voucher', 'meta_data')
 
     def __init__(self, *args, **kwargs):
@@ -242,7 +242,9 @@ class ItemSerializer(I18nAwareModelSerializer):
                   'show_quota_left', 'hidden_if_available', 'allow_waitinglist', 'issue_giftcard', 'meta_data',
                   'require_membership', 'require_membership_types', 'require_membership_hidden', 'grant_membership_type',
                   'grant_membership_duration_like_event', 'grant_membership_duration_days',
-                  'grant_membership_duration_months')
+                  'grant_membership_duration_months', 'validity_mode', 'validity_fixed_from', 'validity_fixed_until',
+                  'validity_dynamic_duration_minutes', 'validity_dynamic_duration_hours', 'validity_dynamic_duration_days',
+                  'validity_dynamic_duration_months', 'validity_dynamic_start_choice', 'validity_dynamic_start_choice_day_limit')
         read_only_fields = ('has_variations',)
 
     def __init__(self, *args, **kwargs):

src/pretix/api/serializers/order.py

@@ -52,7 +52,8 @@ from pretix.base.models import (
     SubEvent, TaxRule, Voucher,
 )
 from pretix.base.models.orders import (
-    CartPosition, OrderFee, OrderPayment, OrderRefund, RevokedTicketSecret,
+    BlockedTicketSecret, CartPosition, OrderFee, OrderPayment, OrderRefund,
+    RevokedTicketSecret,
 )
 from pretix.base.pdf import get_images, get_variables
 from pretix.base.services.cart import error_messages
@@ -300,7 +301,9 @@ class FailedCheckinSerializer(I18nAwareModelSerializer):
 class OrderDownloadsField(serializers.Field):
     def to_representation(self, instance: Order):
         if instance.status != Order.STATUS_PAID:
-            if instance.status != Order.STATUS_PENDING or instance.require_approval or not instance.event.settings.ticket_download_pending:
+            if instance.status != Order.STATUS_PENDING or instance.require_approval or (
+                not instance.valid_if_pending and not instance.event.settings.ticket_download_pending
+            ):
                 return []
 
         request = self.context['request']
@@ -324,7 +327,9 @@ class OrderDownloadsField(serializers.Field):
 class PositionDownloadsField(serializers.Field):
     def to_representation(self, instance: OrderPosition):
         if instance.order.status != Order.STATUS_PAID:
-            if instance.order.status != Order.STATUS_PENDING or instance.order.require_approval or not instance.order.event.settings.ticket_download_pending:
+            if instance.order.status != Order.STATUS_PENDING or instance.order.require_approval or (
+                not instance.order.valid_if_pending and not instance.order.event.settings.ticket_download_pending
+            ):
                 return []
         if not instance.generate_ticket:
             return []
@@ -437,11 +442,12 @@ class OrderPositionSerializer(I18nAwareModelSerializer):
         fields = ('id', 'order', 'positionid', 'item', 'variation', 'price', 'attendee_name', 'attendee_name_parts',
                   'company', 'street', 'zipcode', 'city', 'country', 'state', 'discount',
                   'attendee_email', 'voucher', 'tax_rate', 'tax_value', 'secret', 'addon_to', 'subevent', 'checkins',
-                  'downloads', 'answers', 'tax_rule', 'pseudonymization_id', 'pdf_data', 'seat', 'canceled')
+                  'downloads', 'answers', 'tax_rule', 'pseudonymization_id', 'pdf_data', 'seat', 'canceled',
+                  'valid_from', 'valid_until', 'blocked')
         read_only_fields = (
             'id', 'order', 'positionid', 'item', 'variation', 'price', 'voucher', 'tax_rate', 'tax_value', 'secret',
             'addon_to', 'subevent', 'checkins', 'downloads', 'answers', 'tax_rule', 'pseudonymization_id', 'pdf_data',
-            'seat', 'canceled', 'discount',
+            'seat', 'canceled', 'discount', 'valid_from', 'valid_until', 'blocked'
         )
 
     def __init__(self, *args, **kwargs):
@@ -463,7 +469,7 @@ class OrderPositionSerializer(I18nAwareModelSerializer):
 
 class RequireAttentionField(serializers.Field):
     def to_representation(self, instance: OrderPosition):
-        return instance.order.checkin_attention or instance.item.checkin_attention
+        return instance.require_checkin_attention
 
 
 class AttendeeNameField(serializers.Field):
@@ -508,7 +514,7 @@ class CheckinListOrderPositionSerializer(OrderPositionSerializer):
                   'company', 'street', 'zipcode', 'city', 'country', 'state',
                   'attendee_email', 'voucher', 'tax_rate', 'tax_value', 'secret', 'addon_to', 'subevent', 'checkins',
                   'downloads', 'answers', 'tax_rule', 'pseudonymization_id', 'pdf_data', 'seat', 'require_attention',
-                  'order__status')
+                  'order__status', 'valid_from', 'valid_until', 'blocked')
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
@@ -622,7 +628,7 @@ class OrderSerializer(I18nAwareModelSerializer):
             'code', 'status', 'testmode', 'secret', 'email', 'phone', 'locale', 'datetime', 'expires', 'payment_date',
             'payment_provider', 'fees', 'total', 'comment', 'custom_followup_at', 'invoice_address', 'positions', 'downloads',
             'checkin_attention', 'last_modified', 'payments', 'refunds', 'require_approval', 'sales_channel',
-            'url', 'customer'
+            'url', 'customer', 'valid_if_pending'
         )
         read_only_fields = (
             'code', 'status', 'testmode', 'secret', 'datetime', 'expires', 'payment_date',
@@ -677,7 +683,8 @@ class OrderSerializer(I18nAwareModelSerializer):
     def update(self, instance, validated_data):
         # Even though all fields that shouldn't be edited are marked as read_only in the serializer
         # (hopefully), we'll be extra careful here and be explicit about the model fields we update.
-        update_fields = ['comment', 'custom_followup_at', 'checkin_attention', 'email', 'locale', 'phone']
+        update_fields = ['comment', 'custom_followup_at', 'checkin_attention', 'email', 'locale', 'phone',
+                         'valid_if_pending']
 
         if 'invoice_address' in validated_data:
             iadata = validated_data.pop('invoice_address')
@@ -778,12 +785,14 @@ class OrderPositionCreateSerializer(I18nAwareModelSerializer):
     voucher = serializers.SlugRelatedField(slug_field='code', queryset=Voucher.objects.none(),
                                            required=False, allow_null=True)
     country = CompatibleCountryField(source='*')
+    requested_valid_from = serializers.DateTimeField(required=False, allow_null=True)
 
     class Meta:
         model = OrderPosition
         fields = ('positionid', 'item', 'variation', 'price', 'attendee_name', 'attendee_name_parts', 'attendee_email',
                   'company', 'street', 'zipcode', 'city', 'country', 'state', 'is_bundled',
-                  'secret', 'addon_to', 'subevent', 'answers', 'seat', 'voucher')
+                  'secret', 'addon_to', 'subevent', 'answers', 'seat', 'voucher', 'valid_from', 'valid_until',
+                  'requested_valid_from')
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
@@ -941,7 +950,8 @@ class OrderCreateSerializer(I18nAwareModelSerializer):
         model = Order
         fields = ('code', 'status', 'testmode', 'email', 'phone', 'locale', 'payment_provider', 'fees', 'comment', 'sales_channel',
                   'invoice_address', 'positions', 'checkin_attention', 'payment_info', 'payment_date', 'consume_carts',
-                  'force', 'send_email', 'simulate', 'customer', 'custom_followup_at', 'require_approval')
+                  'force', 'send_email', 'simulate', 'customer', 'custom_followup_at', 'require_approval',
+                  'valid_if_pending')
 
     def validate_payment_provider(self, pp):
         if pp is None:
@@ -1169,6 +1179,20 @@ class OrderCreateSerializer(I18nAwareModelSerializer):
                 elif seated:
                     errs[i]['seat'] = ['The specified product requires to choose a seat.']
 
+                requested_valid_from = pos_data.pop('requested_valid_from', None)
+                if 'valid_from' not in pos_data and 'valid_until' not in pos_data:
+                    valid_from, valid_until = pos_data['item'].compute_validity(
+                        requested_start=(
+                            max(requested_valid_from, now())
+                            if requested_valid_from and pos_data['item'].validity_dynamic_start_choice
+                            else now()
+                        ),
+                        enforce_start_limit=True,
+                        override_tz=self.context['event'].timezone,
+                    )
+                    pos_data['valid_from'] = valid_from
+                    pos_data['valid_until'] = valid_until
+
             if not force:
                 for i, pos_data in enumerate(positions_data):
                     if pos_data.get('voucher'):
@@ -1484,9 +1508,9 @@ class InvoiceSerializer(I18nAwareModelSerializer):
                   'invoice_to', 'invoice_to_company', 'invoice_to_name', 'invoice_to_street', 'invoice_to_zipcode',
                   'invoice_to_city', 'invoice_to_state', 'invoice_to_country', 'invoice_to_vat_id', 'invoice_to_beneficiary',
                   'custom_field', 'date', 'refers', 'locale',
-                  'introductory_text', 'additional_text', 'payment_provider_text', 'footer_text', 'lines',
-                  'foreign_currency_display', 'foreign_currency_rate', 'foreign_currency_rate_date',
-                  'internal_reference')
+                  'introductory_text', 'additional_text', 'payment_provider_text', 'payment_provider_stamp',
+                  'footer_text', 'lines', 'foreign_currency_display', 'foreign_currency_rate',
+                  'foreign_currency_rate_date', 'internal_reference')
 
 
 class OrderPaymentCreateSerializer(I18nAwareModelSerializer):
@@ -1532,3 +1556,10 @@ class RevokedTicketSecretSerializer(I18nAwareModelSerializer):
     class Meta:
         model = RevokedTicketSecret
         fields = ('id', 'secret', 'created')
+
+
+class BlockedTicketSecretSerializer(I18nAwareModelSerializer):
+
+    class Meta:
+        model = BlockedTicketSecret
+        fields = ('id', 'secret', 'updated', 'blocked')

src/pretix/api/serializers/orderchange.py

@@ -24,6 +24,7 @@ import os
 
 import pycountry
 from django.core.files import File
+from django.core.validators import RegexValidator
 from rest_framework import serializers
 from rest_framework.exceptions import ValidationError
 
@@ -53,7 +54,7 @@ class OrderPositionCreateForExistingOrderSerializer(OrderPositionCreateSerialize
         model = OrderPosition
         fields = ('order', 'item', 'variation', 'price', 'attendee_name', 'attendee_name_parts', 'attendee_email',
                   'company', 'street', 'zipcode', 'city', 'country', 'state',
-                  'secret', 'addon_to', 'subevent', 'answers', 'seat')
+                  'secret', 'addon_to', 'subevent', 'answers', 'seat', 'valid_from', 'valid_until')
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
@@ -89,6 +90,8 @@ class OrderPositionCreateForExistingOrderSerializer(OrderPositionCreateSerialize
                 addon_to=validated_data.get('addon_to'),
                 subevent=validated_data.get('subevent'),
                 seat=validated_data.get('seat'),
+                valid_from=validated_data.get('valid_from'),
+                valid_until=validated_data.get('valid_until'),
             )
             if self.context.get('commit', True):
                 ocm.commit()
@@ -198,7 +201,7 @@ class OrderPositionChangeSerializer(serializers.ModelSerializer):
     class Meta:
         model = OrderPosition
         fields = (
-            'item', 'variation', 'subevent', 'seat', 'price', 'tax_rule',
+            'item', 'variation', 'subevent', 'seat', 'price', 'tax_rule', 'valid_from', 'valid_until'
         )
 
     def __init__(self, *args, **kwargs):
@@ -264,6 +267,8 @@ class OrderPositionChangeSerializer(serializers.ModelSerializer):
         price = validated_data.get('price', instance.price)
         seat = validated_data.get('seat', current_seat)
         tax_rule = validated_data.get('tax_rule', instance.tax_rule)
+        valid_from = validated_data.get('valid_from', instance.valid_from)
+        valid_until = validated_data.get('valid_until', instance.valid_until)
 
         change_item = None
         if item != instance.item or variation != instance.variation:
@@ -290,6 +295,12 @@ class OrderPositionChangeSerializer(serializers.ModelSerializer):
             if tax_rule != instance.tax_rule:
                 ocm.change_tax_rule(instance, tax_rule)
 
+            if valid_from != instance.valid_from:
+                ocm.change_valid_from(instance, valid_from)
+
+            if valid_until != instance.valid_until:
+                ocm.change_valid_until(instance, valid_until)
+
             if self.context.get('commit', True):
                 ocm.commit()
                 instance.refresh_from_db()
@@ -423,3 +434,7 @@ class OrderChangeOperationSerializer(serializers.Serializer):
             seen_positions.add(d['fee'])
 
         return data
+
+
+class BlockNameSerializer(serializers.Serializer):
+    name = serializers.CharField(validators=[RegexValidator('^(admin|api:[a-zA-Z0-9._]+)$')])

src/pretix/api/serializers/organizer.py

@@ -41,15 +41,21 @@ from pretix.base.models import (
 from pretix.base.models.seating import SeatingPlanLayoutValidator
 from pretix.base.services.mail import SendMailException, mail
 from pretix.base.settings import validate_organizer_settings
-from pretix.helpers.urls import build_absolute_uri
+from pretix.helpers.urls import build_absolute_uri as build_global_uri
+from pretix.multidomain.urlreverse import build_absolute_uri
 
 logger = logging.getLogger(__name__)
 
 
 class OrganizerSerializer(I18nAwareModelSerializer):
+    public_url = serializers.SerializerMethodField('get_organizer_url', read_only=True)
+
+    def get_organizer_url(self, organizer):
+        return build_absolute_uri(organizer, 'presale:organizer.index')
+
     class Meta:
         model = Organizer
-        fields = ('name', 'slug')
+        fields = ('name', 'slug', 'public_url')
 
 
 class SeatingPlanSerializer(I18nAwareModelSerializer):
@@ -227,7 +233,7 @@ class TeamInviteSerializer(serializers.ModelSerializer):
                     'user': self,
                     'organizer': self.context['organizer'].name,
                     'team': instance.team.name,
-                    'url': build_absolute_uri('control:auth.invite', kwargs={
+                    'url': build_global_uri('control:auth.invite', kwargs={
                         'token': instance.token
                     })
                 },

src/pretix/api/serializers/webhooks.py

@@ -55,7 +55,7 @@ class WebHookSerializer(I18nAwareModelSerializer):
 
     class Meta:
         model = WebHook
-        fields = ('id', 'enabled', 'target_url', 'all_events', 'limit_events', 'action_types')
+        fields = ('id', 'enabled', 'target_url', 'all_events', 'limit_events', 'action_types', 'comment')
 
     def validate(self, data):
         data = super().validate(data)

src/pretix/api/urls.py

@@ -81,6 +81,7 @@ event_router.register(r'orders', order.OrderViewSet)
 event_router.register(r'orderpositions', order.OrderPositionViewSet)
 event_router.register(r'invoices', order.InvoiceViewSet)
 event_router.register(r'revokedsecrets', order.RevokedSecretViewSet, basename='revokedsecrets')
+event_router.register(r'blockedsecrets', order.BlockedSecretViewSet, basename='blockedsecrets')
 event_router.register(r'taxrules', event.TaxRuleViewSet)
 event_router.register(r'waitinglistentries', waitinglist.WaitingListViewSet)
 event_router.register(r'checkinlists', checkin.CheckinListViewSet)

src/pretix/api/views/__init__.py

@@ -24,10 +24,11 @@ from calendar import timegm
 from django.db.models import Max
 from django.http import HttpResponse
 from django.utils.http import http_date, parse_http_date_safe
-from rest_framework.filters import OrderingFilter
+
+from pretix.api.pagination import TotalOrderingFilter
 
 
-class RichOrderingFilter(OrderingFilter):
+class RichOrderingFilter(TotalOrderingFilter):
 
     def filter_queryset(self, request, queryset, view):
         ordering = self.get_ordering(request, queryset, view)

src/pretix/api/views/cart.py

@@ -29,11 +29,11 @@ from django.utils.translation import gettext as _
 from rest_framework import status, viewsets
 from rest_framework.decorators import action
 from rest_framework.exceptions import ValidationError
-from rest_framework.filters import OrderingFilter
 from rest_framework.mixins import CreateModelMixin, DestroyModelMixin
 from rest_framework.response import Response
 from rest_framework.serializers import as_serializer_error
 
+from pretix.api.pagination import TotalOrderingFilter
 from pretix.api.serializers.cart import (
     CartPositionCreateSerializer, CartPositionSerializer,
 )
@@ -47,7 +47,7 @@ from pretix.base.services.locking import NoLockManager
 class CartPositionViewSet(CreateModelMixin, DestroyModelMixin, viewsets.ReadOnlyModelViewSet):
     serializer_class = CartPositionSerializer
     queryset = CartPosition.objects.none()
-    filter_backends = (OrderingFilter,)
+    filter_backends = (TotalOrderingFilter,)
     ordering = ('datetime',)
     ordering_fields = ('datetime', 'cart_id')
     lookup_field = 'id'

src/pretix/api/views/checkin.py

@@ -273,7 +273,13 @@ with scopes_disabled():
         def check_rules_qs(self, queryset, name, value):
             if not self.checkinlist.rules:
                 return queryset
-            return queryset.filter(SQLLogic(self.checkinlist).apply(self.checkinlist.rules))
+            return queryset.filter(
+                SQLLogic(self.checkinlist).apply(self.checkinlist.rules)
+            ).filter(
+                Q(valid_from__isnull=True) | Q(valid_from__lte=now()),
+                Q(valid_until__isnull=True) | Q(valid_until__gte=now()),
+                blocked__isnull=True,
+            )
 
 
 def _handle_file_upload(data, user, auth):
@@ -325,7 +331,13 @@ def _checkin_list_position_queryset(checkinlists, ignore_status=False, ignore_pr
         if checkinlist.subevent:
             list_q &= Q(subevent=checkinlist.subevent)
         if not ignore_status:
-            list_q &= Q(order__status__in=[Order.STATUS_PAID, Order.STATUS_PENDING] if checkinlist.include_pending else [Order.STATUS_PAID])
+            if checkinlist.include_pending:
+                list_q &= Q(order__status__in=[Order.STATUS_PAID, Order.STATUS_PENDING])
+            else:
+                list_q &= Q(
+                    Q(order__status=Order.STATUS_PAID) |
+                    Q(order__status=Order.STATUS_PENDING, order__valid_if_pending=True)
+                )
         if not checkinlist.all_products and not ignore_products:
             list_q &= Q(item__in=checkinlist.limit_products.values_list('id', flat=True))
         lists_qs.append(list_q)
@@ -582,7 +594,7 @@ def _redeem_process(*, checkinlists, raw_barcode, answers_data, datetime, force,
                 'status': 'error',
                 'reason': Checkin.REASON_AMBIGUOUS,
                 'reason_explanation': None,
-                'require_attention': op.item.checkin_attention or op.order.checkin_attention,
+                'require_attention': op.require_checkin_attention,
                 'position': CheckinListOrderPositionSerializer(op, context=_make_context(context, op.order.event)).data,
                 'list': MiniCheckinListSerializer(list_by_event[op.order.event_id]).data,
             }, status=400)
@@ -627,7 +639,7 @@ def _redeem_process(*, checkinlists, raw_barcode, answers_data, datetime, force,
         except RequiredQuestionsError as e:
             return Response({
                 'status': 'incomplete',
-                'require_attention': op.item.checkin_attention or op.order.checkin_attention,
+                'require_attention': op.require_checkin_attention,
                 'position': CheckinListOrderPositionSerializer(op, context=_make_context(context, op.order.event)).data,
                 'questions': [
                     QuestionSerializer(q).data for q in e.questions
@@ -656,14 +668,14 @@ def _redeem_process(*, checkinlists, raw_barcode, answers_data, datetime, force,
                 'status': 'error',
                 'reason': e.code,
                 'reason_explanation': e.reason,
-                'require_attention': op.item.checkin_attention or op.order.checkin_attention,
+                'require_attention': op.require_checkin_attention,
                 'position': CheckinListOrderPositionSerializer(op, context=_make_context(context, op.order.event)).data,
                 'list': MiniCheckinListSerializer(list_by_event[op.order.event_id]).data,
             }, status=400)
         else:
             return Response({
                 'status': 'ok',
-                'require_attention': op.item.checkin_attention or op.order.checkin_attention,
+                'require_attention': op.require_checkin_attention,
                 'position': CheckinListOrderPositionSerializer(op, context=_make_context(context, op.order.event)).data,
                 'list': MiniCheckinListSerializer(list_by_event[op.order.event_id]).data,
             }, status=201)

src/pretix/api/views/discount.py

@@ -36,8 +36,8 @@ from django_filters.rest_framework import DjangoFilterBackend, FilterSet
 from django_scopes import scopes_disabled
 from rest_framework import viewsets
 from rest_framework.exceptions import PermissionDenied
-from rest_framework.filters import OrderingFilter
 
+from pretix.api.pagination import TotalOrderingFilter
 from pretix.api.serializers.discount import DiscountSerializer
 from pretix.api.views import ConditionalListView
 from pretix.base.models import CartPosition, Discount
@@ -52,7 +52,7 @@ with scopes_disabled():
 class DiscountViewSet(ConditionalListView, viewsets.ModelViewSet):
     serializer_class = DiscountSerializer
     queryset = Discount.objects.none()
-    filter_backends = (DjangoFilterBackend, OrderingFilter)
+    filter_backends = (DjangoFilterBackend, TotalOrderingFilter)
     filterset_class = DiscountFilter
     ordering_fields = ('id', 'position')
     ordering = ('position', 'id')

src/pretix/api/views/event.py

@@ -39,11 +39,12 @@ from django.db.models import Prefetch, ProtectedError, Q
 from django.utils.timezone import now
 from django_filters.rest_framework import DjangoFilterBackend, FilterSet
 from django_scopes import scopes_disabled
-from rest_framework import filters, serializers, views, viewsets
+from rest_framework import serializers, views, viewsets
 from rest_framework.exceptions import PermissionDenied, ValidationError
 from rest_framework.response import Response
 
 from pretix.api.auth.permission import EventCRUDPermission
+from pretix.api.pagination import TotalOrderingFilter
 from pretix.api.serializers.event import (
     CloneEventSerializer, DeviceEventSettingsSerializer, EventSerializer,
     EventSettingsSerializer, SubEventSerializer, TaxRuleSerializer,
@@ -127,7 +128,7 @@ class EventViewSet(viewsets.ModelViewSet):
     lookup_url_kwarg = 'event'
     lookup_value_regex = '[^/]+'
     permission_classes = (EventCRUDPermission,)
-    filter_backends = (DjangoFilterBackend, filters.OrderingFilter)
+    filter_backends = (DjangoFilterBackend, TotalOrderingFilter)
     ordering = ('slug',)
     ordering_fields = ('date_from', 'slug')
     filterset_class = EventFilter
@@ -379,7 +380,7 @@ class SubEventViewSet(ConditionalListView, viewsets.ModelViewSet):
     serializer_class = SubEventSerializer
     queryset = SubEvent.objects.none()
     write_permission = 'can_change_event_settings'
-    filter_backends = (DjangoFilterBackend, filters.OrderingFilter)
+    filter_backends = (DjangoFilterBackend, TotalOrderingFilter)
     filterset_class = SubEventFilter
     ordering = ('date_from',)
     ordering_fields = ('id', 'date_from', 'last_modified')

src/pretix/api/views/item.py

@@ -41,9 +41,9 @@ from django_scopes import scopes_disabled
 from rest_framework import viewsets
 from rest_framework.decorators import action
 from rest_framework.exceptions import PermissionDenied
-from rest_framework.filters import OrderingFilter
 from rest_framework.response import Response
 
+from pretix.api.pagination import TotalOrderingFilter
 from pretix.api.serializers.item import (
     ItemAddOnSerializer, ItemBundleSerializer, ItemCategorySerializer,
     ItemSerializer, ItemVariationSerializer, QuestionOptionSerializer,
@@ -75,7 +75,7 @@ with scopes_disabled():
 class ItemViewSet(ConditionalListView, viewsets.ModelViewSet):
     serializer_class = ItemSerializer
     queryset = Item.objects.none()
-    filter_backends = (DjangoFilterBackend, OrderingFilter)
+    filter_backends = (DjangoFilterBackend, TotalOrderingFilter)
     ordering_fields = ('id', 'position')
     ordering = ('position', 'id')
     filterset_class = ItemFilter
@@ -138,7 +138,7 @@ class ItemViewSet(ConditionalListView, viewsets.ModelViewSet):
 class ItemVariationViewSet(viewsets.ModelViewSet):
     serializer_class = ItemVariationSerializer
     queryset = ItemVariation.objects.none()
-    filter_backends = (DjangoFilterBackend, OrderingFilter,)
+    filter_backends = (DjangoFilterBackend, TotalOrderingFilter,)
     ordering_fields = ('id', 'position')
     ordering = ('id',)
     permission = None
@@ -208,7 +208,7 @@ class ItemVariationViewSet(viewsets.ModelViewSet):
 class ItemBundleViewSet(viewsets.ModelViewSet):
     serializer_class = ItemBundleSerializer
     queryset = ItemBundle.objects.none()
-    filter_backends = (DjangoFilterBackend, OrderingFilter,)
+    filter_backends = (DjangoFilterBackend, TotalOrderingFilter,)
     ordering_fields = ('id',)
     ordering = ('id',)
     permission = None
@@ -260,7 +260,7 @@ class ItemBundleViewSet(viewsets.ModelViewSet):
 class ItemAddOnViewSet(viewsets.ModelViewSet):
     serializer_class = ItemAddOnSerializer
     queryset = ItemAddOn.objects.none()
-    filter_backends = (DjangoFilterBackend, OrderingFilter,)
+    filter_backends = (DjangoFilterBackend, TotalOrderingFilter,)
     ordering_fields = ('id', 'position')
     ordering = ('id',)
     permission = None
@@ -318,7 +318,7 @@ class ItemCategoryFilter(FilterSet):
 class ItemCategoryViewSet(ConditionalListView, viewsets.ModelViewSet):
     serializer_class = ItemCategorySerializer
     queryset = ItemCategory.objects.none()
-    filter_backends = (DjangoFilterBackend, OrderingFilter)
+    filter_backends = (DjangoFilterBackend, TotalOrderingFilter)
     filterset_class = ItemCategoryFilter
     ordering_fields = ('id', 'position')
     ordering = ('position', 'id')
@@ -373,7 +373,7 @@ with scopes_disabled():
 class QuestionViewSet(ConditionalListView, viewsets.ModelViewSet):
     serializer_class = QuestionSerializer
     queryset = Question.objects.none()
-    filter_backends = (DjangoFilterBackend, OrderingFilter)
+    filter_backends = (DjangoFilterBackend, TotalOrderingFilter)
     filterset_class = QuestionFilter
     ordering_fields = ('id', 'position')
     ordering = ('position', 'id')
@@ -418,7 +418,7 @@ class QuestionViewSet(ConditionalListView, viewsets.ModelViewSet):
 class QuestionOptionViewSet(viewsets.ModelViewSet):
     serializer_class = QuestionOptionSerializer
     queryset = QuestionOption.objects.none()
-    filter_backends = (DjangoFilterBackend, OrderingFilter,)
+    filter_backends = (DjangoFilterBackend, TotalOrderingFilter,)
     ordering_fields = ('id', 'position')
     ordering = ('position',)
     permission = None
@@ -475,7 +475,7 @@ with scopes_disabled():
 class QuotaViewSet(ConditionalListView, viewsets.ModelViewSet):
     serializer_class = QuotaSerializer
     queryset = Quota.objects.none()
-    filter_backends = (DjangoFilterBackend, OrderingFilter,)
+    filter_backends = (DjangoFilterBackend, TotalOrderingFilter,)
     filterset_class = QuotaFilter
     ordering_fields = ('id', 'size')
     ordering = ('id',)

src/pretix/api/views/order.py

@@ -43,21 +43,21 @@ from rest_framework.decorators import action
 from rest_framework.exceptions import (
     APIException, NotFound, PermissionDenied, ValidationError,
 )
-from rest_framework.filters import OrderingFilter
 from rest_framework.mixins import CreateModelMixin
 from rest_framework.response import Response
 
 from pretix.api.models import OAuthAccessToken
+from pretix.api.pagination import TotalOrderingFilter
 from pretix.api.serializers.order import (
-    InvoiceSerializer, OrderCreateSerializer, OrderPaymentCreateSerializer,
-    OrderPaymentSerializer, OrderPositionSerializer,
-    OrderRefundCreateSerializer, OrderRefundSerializer, OrderSerializer,
-    PriceCalcSerializer, RevokedTicketSecretSerializer,
-    SimulatedOrderSerializer,
+    BlockedTicketSecretSerializer, InvoiceSerializer, OrderCreateSerializer,
+    OrderPaymentCreateSerializer, OrderPaymentSerializer,
+    OrderPositionSerializer, OrderRefundCreateSerializer,
+    OrderRefundSerializer, OrderSerializer, PriceCalcSerializer,
+    RevokedTicketSecretSerializer, SimulatedOrderSerializer,
 )
 from pretix.api.serializers.orderchange import (
-    OrderChangeOperationSerializer, OrderFeeChangeSerializer,
-    OrderPositionChangeSerializer,
+    BlockNameSerializer, OrderChangeOperationSerializer,
+    OrderFeeChangeSerializer, OrderPositionChangeSerializer,
     OrderPositionCreateForExistingOrderSerializer,
     OrderPositionInfoPatchSerializer,
 )
@@ -70,7 +70,9 @@ from pretix.base.models import (
     OrderRefund, Quota, SubEvent, SubEventMetaValue, TaxRule, TeamAPIToken,
     generate_secret,
 )
-from pretix.base.models.orders import QuestionAnswer, RevokedTicketSecret
+from pretix.base.models.orders import (
+    BlockedTicketSecret, QuestionAnswer, RevokedTicketSecret,
+)
 from pretix.base.payment import PaymentException
 from pretix.base.pdf import get_images
 from pretix.base.secrets import assign_ticket_secret
@@ -179,7 +181,7 @@ with scopes_disabled():
 class OrderViewSet(viewsets.ModelViewSet):
     serializer_class = OrderSerializer
     queryset = Order.objects.none()
-    filter_backends = (DjangoFilterBackend, OrderingFilter)
+    filter_backends = (DjangoFilterBackend, TotalOrderingFilter)
     ordering = ('datetime',)
     ordering_fields = ('datetime', 'code', 'status', 'last_modified')
     filterset_class = OrderFilter
@@ -287,7 +289,7 @@ class OrderViewSet(viewsets.ModelViewSet):
         if order.status in (Order.STATUS_CANCELED, Order.STATUS_EXPIRED):
             raise PermissionDenied("Downloads are not available for canceled or expired orders.")
 
-        if order.status == Order.STATUS_PENDING and not request.event.settings.ticket_download_pending:
+        if order.status == Order.STATUS_PENDING and not (order.valid_if_pending or request.event.settings.ticket_download_pending):
             raise PermissionDenied("Downloads are not available for pending orders.")
 
         ct = CachedCombinedTicket.objects.filter(
@@ -763,6 +765,16 @@ class OrderViewSet(viewsets.ModelViewSet):
                     }
                 )
 
+            if 'valid_if_pending' in self.request.data and serializer.instance.valid_if_pending != self.request.data.get('valid_if_pending'):
+                serializer.instance.log_action(
+                    'pretix.event.order.valid_if_pending',
+                    user=self.request.user,
+                    auth=self.request.auth,
+                    data={
+                        'new_value': self.request.data.get('valid_if_pending')
+                    }
+                )
+
             if 'email' in self.request.data and serializer.instance.email != self.request.data.get('email'):
                 serializer.instance.email_known_to_work = False
                 serializer.instance.log_action(
@@ -1183,7 +1195,7 @@ class OrderPositionViewSet(viewsets.ModelViewSet):
         if pos.order.status in (Order.STATUS_CANCELED, Order.STATUS_EXPIRED):
             raise PermissionDenied("Downloads are not available for canceled or expired orders.")
 
-        if pos.order.status == Order.STATUS_PENDING and not request.event.settings.ticket_download_pending:
+        if pos.order.status == Order.STATUS_PENDING and not (pos.order.valid_if_pending or request.event.settings.ticket_download_pending):
             raise PermissionDenied("Downloads are not available for pending orders.")
         if not pos.generate_ticket:
             raise PermissionDenied("Downloads are not enabled for this product.")
@@ -1225,6 +1237,54 @@ class OrderPositionViewSet(viewsets.ModelViewSet):
             raise ValidationError(str(e))
         return self.retrieve(request, [], **kwargs)
 
+    @action(detail=True, methods=['POST'])
+    def add_block(self, request, **kwargs):
+        serializer = BlockNameSerializer(
+            data=request.data,
+            context=self.get_serializer_context(),
+        )
+        serializer.is_valid(raise_exception=True)
+        instance = self.get_object()
+        try:
+            ocm = OrderChangeManager(
+                instance.order,
+                user=self.request.user if self.request.user.is_authenticated else None,
+                auth=self.request.auth,
+                notify=False,
+                reissue_invoice=False,
+            )
+            ocm.add_block(instance, serializer.validated_data['name'])
+            ocm.commit()
+        except OrderError as e:
+            raise ValidationError(str(e))
+        except Quota.QuotaExceededException as e:
+            raise ValidationError(str(e))
+        return self.retrieve(request, [], **kwargs)
+
+    @action(detail=True, methods=['POST'])
+    def remove_block(self, request, **kwargs):
+        serializer = BlockNameSerializer(
+            data=request.data,
+            context=self.get_serializer_context(),
+        )
+        serializer.is_valid(raise_exception=True)
+        instance = self.get_object()
+        try:
+            ocm = OrderChangeManager(
+                instance.order,
+                user=self.request.user if self.request.user.is_authenticated else None,
+                auth=self.request.auth,
+                notify=False,
+                reissue_invoice=False,
+            )
+            ocm.remove_block(instance, serializer.validated_data['name'])
+            ocm.commit()
+        except OrderError as e:
+            raise ValidationError(str(e))
+        except Quota.QuotaExceededException as e:
+            raise ValidationError(str(e))
+        return self.retrieve(request, [], **kwargs)
+
     def perform_destroy(self, instance):
         try:
             ocm = OrderChangeManager(
@@ -1479,21 +1539,27 @@ class PaymentViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet):
             source=OrderRefund.REFUND_SOURCE_ADMIN,
             state=OrderRefund.REFUND_STATE_CREATED,
             amount=amount,
-            provider=payment.provider
+            provider=payment.provider,
+            info='{}',
         )
+        payment.order.log_action('pretix.event.order.refund.created', {
+            'local_id': r.local_id,
+            'provider': r.provider,
+        }, user=self.request.user if self.request.user.is_authenticated else None, auth=self.request.auth)
 
         try:
             r.payment_provider.execute_refund(r)
         except PaymentException as e:
             r.state = OrderRefund.REFUND_STATE_FAILED
             r.save()
+            payment.order.log_action('pretix.event.order.refund.failed', {
+                'local_id': r.local_id,
+                'provider': r.provider,
+                'error': str(e)
+            })
             return Response({'detail': 'External error: {}'.format(str(e))},
                             status=status.HTTP_400_BAD_REQUEST)
         else:
-            payment.order.log_action('pretix.event.order.refund.created', {
-                'local_id': r.local_id,
-                'provider': r.provider,
-            }, user=self.request.user if self.request.user.is_authenticated else None, auth=self.request.auth)
             if payment.order.pending_sum > 0:
                 if mark_refunded:
                     mark_order_refunded(payment.order,
@@ -1683,7 +1749,7 @@ class RetryException(APIException):
 class InvoiceViewSet(viewsets.ReadOnlyModelViewSet):
     serializer_class = InvoiceSerializer
     queryset = Invoice.objects.none()
-    filter_backends = (DjangoFilterBackend, OrderingFilter)
+    filter_backends = (DjangoFilterBackend, TotalOrderingFilter)
     ordering = ('nr',)
     ordering_fields = ('nr', 'date')
     filterset_class = InvoiceFilter
@@ -1776,7 +1842,7 @@ with scopes_disabled():
 class RevokedSecretViewSet(viewsets.ReadOnlyModelViewSet):
     serializer_class = RevokedTicketSecretSerializer
     queryset = RevokedTicketSecret.objects.none()
-    filter_backends = (DjangoFilterBackend, OrderingFilter)
+    filter_backends = (DjangoFilterBackend, TotalOrderingFilter)
     ordering = ('-created',)
     ordering_fields = ('created', 'secret')
     filterset_class = RevokedSecretFilter
@@ -1785,3 +1851,25 @@ class RevokedSecretViewSet(viewsets.ReadOnlyModelViewSet):
 
     def get_queryset(self):
         return RevokedTicketSecret.objects.filter(event=self.request.event)
+
+
+with scopes_disabled():
+    class BlockedSecretFilter(FilterSet):
+        updated_since = django_filters.IsoDateTimeFilter(field_name='updated', lookup_expr='gte')
+
+        class Meta:
+            model = BlockedTicketSecret
+            fields = ['blocked']
+
+
+class BlockedSecretViewSet(viewsets.ReadOnlyModelViewSet):
+    serializer_class = BlockedTicketSecretSerializer
+    queryset = BlockedTicketSecret.objects.none()
+    filter_backends = (DjangoFilterBackend, TotalOrderingFilter)
+    ordering = ('-updated', '-pk')
+    filterset_class = BlockedSecretFilter
+    permission = 'can_view_orders'
+    write_permission = 'can_change_orders'
+
+    def get_queryset(self):
+        return BlockedTicketSecret.objects.filter(event=self.request.event)

src/pretix/api/views/organizer.py

@@ -28,9 +28,7 @@ from django.shortcuts import get_object_or_404
 from django.utils.functional import cached_property
 from django_filters.rest_framework import DjangoFilterBackend, FilterSet
 from django_scopes import scopes_disabled
-from rest_framework import (
-    filters, mixins, serializers, status, views, viewsets,
-)
+from rest_framework import mixins, serializers, status, views, viewsets
 from rest_framework.decorators import action
 from rest_framework.exceptions import MethodNotAllowed, PermissionDenied
 from rest_framework.mixins import CreateModelMixin, DestroyModelMixin
@@ -38,6 +36,7 @@ from rest_framework.response import Response
 from rest_framework.viewsets import GenericViewSet
 
 from pretix.api.models import OAuthAccessToken
+from pretix.api.pagination import TotalOrderingFilter
 from pretix.api.serializers.organizer import (
     CustomerCreateSerializer, CustomerSerializer, DeviceSerializer,
     GiftCardSerializer, GiftCardTransactionSerializer, MembershipSerializer,
@@ -62,7 +61,7 @@ class OrganizerViewSet(viewsets.ReadOnlyModelViewSet):
     lookup_field = 'slug'
     lookup_url_kwarg = 'organizer'
     lookup_value_regex = '[^/]+'
-    filter_backends = (filters.OrderingFilter,)
+    filter_backends = (TotalOrderingFilter,)
     ordering = ('slug',)
     ordering_fields = ('name', 'slug')
 

src/pretix/api/views/voucher.py

@@ -31,9 +31,9 @@ from django_scopes import scopes_disabled
 from rest_framework import status, viewsets
 from rest_framework.decorators import action
 from rest_framework.exceptions import PermissionDenied
-from rest_framework.filters import OrderingFilter
 from rest_framework.response import Response
 
+from pretix.api.pagination import TotalOrderingFilter
 from pretix.api.serializers.voucher import VoucherSerializer
 from pretix.base.models import Voucher
 
@@ -59,7 +59,7 @@ with scopes_disabled():
 class VoucherViewSet(viewsets.ModelViewSet):
     serializer_class = VoucherSerializer
     queryset = Voucher.objects.none()
-    filter_backends = (DjangoFilterBackend, OrderingFilter)
+    filter_backends = (DjangoFilterBackend, TotalOrderingFilter)
     ordering = ('id',)
     ordering_fields = ('id', 'code', 'max_usages', 'valid_until', 'value')
     filterset_class = VoucherFilter

src/pretix/api/views/waitinglist.py

@@ -25,9 +25,9 @@ from django_scopes import scopes_disabled
 from rest_framework import viewsets
 from rest_framework.decorators import action
 from rest_framework.exceptions import PermissionDenied, ValidationError
-from rest_framework.filters import OrderingFilter
 from rest_framework.response import Response
 
+from pretix.api.pagination import TotalOrderingFilter
 from pretix.api.serializers.waitinglist import WaitingListSerializer
 from pretix.base.models import WaitingListEntry
 from pretix.base.models.waitinglist import WaitingListException
@@ -47,8 +47,8 @@ with scopes_disabled():
 class WaitingListViewSet(viewsets.ModelViewSet):
     serializer_class = WaitingListSerializer
     queryset = WaitingListEntry.objects.none()
-    filter_backends = (DjangoFilterBackend, OrderingFilter)
-    ordering = ('created',)
+    filter_backends = (DjangoFilterBackend, TotalOrderingFilter)
+    ordering = ('created', 'pk',)
     ordering_fields = ('id', 'created', 'email', 'item')
     filterset_class = WaitingListFilter
     permission = 'can_view_orders'

src/pretix/api/webhooks.py

@@ -96,7 +96,7 @@ def get_all_webhook_events():
     return types
 
 
-class ParametrizedOrderWebhookEvent(WebhookEvent):
+class ParametrizedWebhookEvent(WebhookEvent):
     def __init__(self, action_type, verbose_name):
         self._action_type = action_type
         self._verbose_name = verbose_name
@@ -110,6 +110,8 @@ class ParametrizedOrderWebhookEvent(WebhookEvent):
     def verbose_name(self):
         return self._verbose_name
 
+
+class ParametrizedOrderWebhookEvent(ParametrizedWebhookEvent):
     def build_payload(self, logentry: LogEntry):
         order = logentry.content_object
         if not order:
@@ -124,19 +126,7 @@ class ParametrizedOrderWebhookEvent(WebhookEvent):
         }
 
 
-class ParametrizedEventWebhookEvent(WebhookEvent):
-    def __init__(self, action_type, verbose_name):
-        self._action_type = action_type
-        self._verbose_name = verbose_name
-        super().__init__()
-
-    @property
-    def action_type(self):
-        return self._action_type
-
-    @property
-    def verbose_name(self):
-        return self._verbose_name
+class ParametrizedEventWebhookEvent(ParametrizedWebhookEvent):
 
     def build_payload(self, logentry: LogEntry):
         if logentry.action_type == 'pretix.event.deleted':
@@ -160,19 +150,7 @@ class ParametrizedEventWebhookEvent(WebhookEvent):
         }
 
 
-class ParametrizedSubEventWebhookEvent(WebhookEvent):
-    def __init__(self, action_type, verbose_name):
-        self._action_type = action_type
-        self._verbose_name = verbose_name
-        super().__init__()
-
-    @property
-    def action_type(self):
-        return self._action_type
-
-    @property
-    def verbose_name(self):
-        return self._verbose_name
+class ParametrizedSubEventWebhookEvent(ParametrizedWebhookEvent):
 
     def build_payload(self, logentry: LogEntry):
         # do not use content_object, this is also called in deletion
@@ -185,6 +163,19 @@ class ParametrizedSubEventWebhookEvent(WebhookEvent):
         }
 
 
+class ParametrizedItemWebhookEvent(ParametrizedWebhookEvent):
+
+    def build_payload(self, logentry: LogEntry):
+        # do not use content_object, this is also called in deletion
+        return {
+            'notification_id': logentry.pk,
+            'organizer': logentry.event.organizer.slug,
+            'event': logentry.event.slug,
+            'item': logentry.object_id,
+            'action': logentry.action_type,
+        }
+
+
 class ParametrizedOrderPositionWebhookEvent(ParametrizedOrderWebhookEvent):
 
     def build_payload(self, logentry: LogEntry):
@@ -305,6 +296,11 @@ def register_default_webhook_events(sender, **kwargs):
             'pretix.subevent.deleted',
             pgettext_lazy('subevent', 'Event series date deleted'),
         ),
+        ParametrizedItemWebhookEvent(
+            'pretix.event.item.*',
+            _('Product changed (including product added or deleted and including changes to nested objects like '
+              'variations or bundles)'),
+        ),
         ParametrizedEventWebhookEvent(
             'pretix.event.live.activated',
             _('Shop taken live'),

src/pretix/base/apps.py

@@ -46,7 +46,7 @@ class PretixBaseConfig(AppConfig):
         from . import invoice  # NOQA
         from . import notifications  # NOQA
         from . import email  # NOQA
-        from .services import auth, checkin, export, mail, tickets, cart, orderimport, orders, invoices, cleanup, update_check, quotas, notifications, vouchers  # NOQA
+        from .services import auth, checkin, currencies, export, mail, tickets, cart, orderimport, orders, invoices, cleanup, update_check, quotas, notifications, vouchers  # NOQA
         from .models import _transactions  # NOQA
         from django.conf import settings
 

src/pretix/base/email.py

@@ -394,6 +394,11 @@ def base_placeholders(sender, **kwargs):
             lambda event_or_subevent, refund_amount: LazyCurrencyNumber(refund_amount, event_or_subevent.currency),
             lambda event_or_subevent: LazyCurrencyNumber(Decimal('42.23'), event_or_subevent.currency)
         ),
+        SimpleFunctionalMailTextPlaceholder(
+            'pending_sum', ['event', 'pending_sum'],
+            lambda event, pending_sum: LazyCurrencyNumber(pending_sum, event.currency),
+            lambda event: LazyCurrencyNumber(Decimal('42.23'), event.currency)
+        ),
         SimpleFunctionalMailTextPlaceholder(
             'total_with_currency', ['event', 'order'], lambda event, order: LazyCurrencyNumber(order.total,
                                                                                                event.currency),

src/pretix/base/exporters/json.py

@@ -109,6 +109,8 @@ class JSONExporter(BaseExporter):
                                 'name': str(variation),
                                 'description': str(variation.description),
                                 'position': variation.position,
+                                'checkin_attention': variation.checkin_attention,
+                                'require_approval': variation.require_approval,
                                 'require_membership': variation.require_membership,
                                 'sales_channels': variation.sales_channels,
                                 'available_from': variation.available_from,
@@ -193,6 +195,9 @@ class JSONExporter(BaseExporter):
                                 'state': position.state,
                                 'secret': position.secret,
                                 'addon_to': position.addon_to_id,
+                                'valid_from': position.valid_from,
+                                'valid_until': position.valid_until,
+                                'blocked': position.blocked,
                                 'answers': [
                                     {
                                         'question': answer.question_id,

src/pretix/base/exporters/orderlist.py

@@ -43,6 +43,7 @@ from django.db.models import (
 )
 from django.db.models.functions import Coalesce
 from django.dispatch import receiver
+from django.utils.formats import date_format
 from django.utils.functional import cached_property
 from django.utils.timezone import get_current_timezone, now
 from django.utils.translation import (
@@ -569,6 +570,9 @@ class OrderListExporter(MultiSheetListExporter):
             _('Seat zone'),
             _('Seat row'),
             _('Seat number'),
+            _('Blocked'),
+            _('Valid from'),
+            _('Valid until'),
             _('Order comment'),
             _('Follow-up date'),
         ]
@@ -682,6 +686,11 @@ class OrderListExporter(MultiSheetListExporter):
                 else:
                     row += ['', '', '', '', '']
 
+                row += [
+                    _('Yes') if op.blocked else '',
+                    date_format(op.valid_from, 'SHORT_DATETIME_FORMAT') if op.valid_from else '',
+                    date_format(op.valid_until, 'SHORT_DATETIME_FORMAT') if op.valid_until else '',
+                ]
                 row.append(order.comment)
                 row.append(order.custom_followup_at.strftime("%Y-%m-%d") if order.custom_followup_at else "")
                 acache = {}
@@ -761,6 +770,19 @@ class PaymentListExporter(ListExporter):
     def additional_form_fields(self):
         return OrderedDict(
             [
+                ('end_date_range',
+                 DateFrameField(
+                     label=_('Date range (payment date)'),
+                     include_future_frames=False,
+                     required=False,
+                     help_text=_('Note that using this will exclude any non-confirmed payments or non-completed refunds.'),
+                 )),
+                ('start_date_range',
+                 DateFrameField(
+                     label=_('Date range (start of transaction)'),
+                     include_future_frames=False,
+                     required=False
+                 )),
                 ('payment_states',
                  forms.MultipleChoiceField(
                      label=_('Payment states'),
@@ -787,17 +809,35 @@ class PaymentListExporter(ListExporter):
         payments = OrderPayment.objects.filter(
             order__event__in=self.events,
             state__in=form_data.get('payment_states', [])
-        ).order_by('created')
+        ).select_related('order').prefetch_related('order__event').order_by('created')
         refunds = OrderRefund.objects.filter(
             order__event__in=self.events,
             state__in=form_data.get('refund_states', [])
-        ).order_by('created')
+        ).select_related('order').prefetch_related('order__event').order_by('created')
+
+        if form_data.get('end_date_range'):
+            dt_start, dt_end = resolve_timeframe_to_datetime_start_inclusive_end_exclusive(now(), form_data['end_date_range'], self.timezone)
+            if dt_start:
+                payments = payments.filter(created__gte=dt_start)
+                refunds = refunds .filter(created__gte=dt_start)
+            if dt_end:
+                payments = payments.filter(created__lt=dt_end)
+                refunds = refunds .filter(created__lt=dt_end)
+
+        if form_data.get('start_end_date_range'):
+            dt_start, dt_end = resolve_timeframe_to_datetime_start_inclusive_end_exclusive(now(), form_data['start_date_range'], self.timezone)
+            if dt_start:
+                payments = payments.filter(payment_date__gte=dt_start)
+                refunds = refunds .filter(execution_date__gte=dt_start)
+            if dt_end:
+                payments = payments.filter(payment_date__lt=dt_end)
+                refunds = refunds.filter(execution_date__lt=dt_end)
 
         objs = sorted(list(payments) + list(refunds), key=lambda o: o.created)
 
         headers = [
             _('Event slug'), _('Order'), _('Payment ID'), _('Creation date'), _('Completion date'), _('Status'),
-            _('Status code'), _('Amount'), _('Payment method'), _('Comment'),
+            _('Status code'), _('Amount'), _('Payment method'), _('Comment'), _('Matching ID'), _('Payment details'),
         ]
         yield headers
 
@@ -810,6 +850,18 @@ class PaymentListExporter(ListExporter):
                 d2 = obj.execution_date.astimezone(tz).date().strftime('%Y-%m-%d')
             else:
                 d2 = ''
+            matching_id = ''
+            payment_details = ''
+            try:
+                if isinstance(obj, OrderPayment):
+                    matching_id = obj.payment_provider.matching_id(obj) or ''
+                    payment_details = obj.payment_provider.payment_control_render_short(obj)
+                elif isinstance(obj, OrderRefund):
+                    matching_id = obj.payment_provider.refund_matching_id(obj) or ''
+                    payment_details = obj.payment_provider.refund_control_render_short(obj)
+            except Exception:
+                pass
+
             row = [
                 obj.order.event.slug,
                 obj.order.code,
@@ -821,6 +873,8 @@ class PaymentListExporter(ListExporter):
                 obj.amount * (-1 if isinstance(obj, OrderRefund) else 1),
                 provider_names.get(obj.provider, obj.provider),
                 obj.comment if isinstance(obj, OrderRefund) else "",
+                matching_id,
+                payment_details,
             ]
             yield row
 

src/pretix/base/forms/questions.py

@@ -35,6 +35,7 @@
 import copy
 import json
 import logging
+from datetime import timedelta
 from decimal import Decimal
 from io import BytesIO
 
@@ -55,7 +56,7 @@ from django.forms.widgets import FILE_INPUT_CONTRADICTION
 from django.utils.formats import date_format
 from django.utils.html import escape
 from django.utils.safestring import mark_safe
-from django.utils.timezone import get_current_timezone
+from django.utils.timezone import get_current_timezone, now
 from django.utils.translation import gettext_lazy as _, pgettext_lazy
 from django_countries import countries
 from django_countries.fields import Country, CountryField
@@ -73,7 +74,7 @@ from pretix.base.forms.widgets import (
 from pretix.base.i18n import (
     get_babel_locale, get_language_without_region, language,
 )
-from pretix.base.models import InvoiceAddress, Question, QuestionOption
+from pretix.base.models import InvoiceAddress, Item, Question, QuestionOption
 from pretix.base.models.tax import VAT_ID_COUNTRIES, ask_for_vat_id
 from pretix.base.services.tax import (
     VATIDFinalError, VATIDTemporaryError, validate_vat_id,
@@ -573,6 +574,34 @@ class BaseQuestionsForm(forms.Form):
 
         super().__init__(*args, **kwargs)
 
+        if cartpos and item.validity_mode == Item.VALIDITY_MODE_DYNAMIC and item.validity_dynamic_start_choice:
+            if item.validity_dynamic_start_choice_day_limit:
+                max_date = now().astimezone(event.timezone) + timedelta(days=item.validity_dynamic_start_choice_day_limit)
+            else:
+                max_date = None
+            if item.validity_dynamic_duration_months or item.validity_dynamic_duration_days:
+                attrs = {}
+                if max_date:
+                    attrs['data-max'] = max_date.date().isoformat()
+                self.fields['requested_valid_from'] = forms.DateField(
+                    label=_('Start date'),
+                    help_text=_('If you keep this empty, the ticket will be valid starting at the time of purchase.'),
+                    required=False,
+                    widget=DatePickerWidget(attrs),
+                    validators=[MaxDateValidator(max_date.date())] if max_date else []
+                )
+            else:
+                self.fields['requested_valid_from'] = forms.SplitDateTimeField(
+                    label=_('Start date'),
+                    help_text=_('If you keep this empty, the ticket will be valid starting at the time of purchase.'),
+                    required=False,
+                    widget=SplitDateTimePickerWidget(
+                        time_format=get_format_without_seconds('TIME_INPUT_FORMATS'),
+                        max_date=max_date
+                    ),
+                    validators=[MaxDateTimeValidator(max_date)] if max_date else []
+                )
+
         add_fields = {}
 
         if item.ask_attendee_data and event.settings.attendee_names_asked:

src/pretix/base/invoice.py

@@ -35,8 +35,8 @@ from django.utils.formats import date_format, localize
 from django.utils.translation import (
     get_language, gettext, gettext_lazy, pgettext,
 )
-from reportlab.lib import pagesizes
-from reportlab.lib.enums import TA_LEFT, TA_RIGHT
+from reportlab.lib import colors, pagesizes
+from reportlab.lib.enums import TA_CENTER, TA_LEFT, TA_RIGHT
 from reportlab.lib.styles import ParagraphStyle, StyleSheet1
 from reportlab.lib.units import mm
 from reportlab.pdfbase import pdfmetrics
@@ -44,12 +44,13 @@ from reportlab.pdfbase.pdfmetrics import stringWidth
 from reportlab.pdfbase.ttfonts import TTFont
 from reportlab.pdfgen.canvas import Canvas
 from reportlab.platypus import (
-    BaseDocTemplate, Frame, KeepTogether, NextPageTemplate, PageTemplate,
-    Paragraph, Spacer, Table, TableStyle,
+    BaseDocTemplate, Flowable, Frame, KeepTogether, NextPageTemplate,
+    PageTemplate, Paragraph, Spacer, Table, TableStyle,
 )
 
 from pretix.base.decimal import round_decimal
 from pretix.base.models import Event, Invoice, Order, OrderPayment
+from pretix.base.services.currencies import SOURCE_NAMES
 from pretix.base.signals import register_invoice_renderers
 from pretix.base.templatetags.money import money_filter
 from pretix.helpers.reportlab import ThumbnailingImageReader
@@ -147,6 +148,8 @@ class BaseReportlabInvoiceRenderer(BaseInvoiceRenderer):
         """
         stylesheet = StyleSheet1()
         stylesheet.add(ParagraphStyle(name='Normal', fontName=self.font_regular, fontSize=10, leading=12))
+        stylesheet.add(ParagraphStyle(name='BoldInverseCenter', fontName=self.font_bold, fontSize=10, leading=12,
+                                      textColor=colors.white, alignment=TA_CENTER))
         stylesheet.add(ParagraphStyle(name='InvoiceFrom', parent=stylesheet['Normal']))
         stylesheet.add(ParagraphStyle(name='Heading1', fontName=self.font_bold, fontSize=15, leading=15 * 1.2))
         stylesheet.add(ParagraphStyle(name='FineprintHeading', fontName=self.font_bold, fontSize=8, leading=12))
@@ -249,6 +252,31 @@ class BaseReportlabInvoiceRenderer(BaseInvoiceRenderer):
         ).strip().replace('<br>', '<br />').replace('\n', '<br />\n')
 
 
+class PaidMarker(Flowable):
+    def __init__(self, text='paid', color=None, font='OpenSansBd', size=20):
+        super().__init__()
+        self.text = text
+        self.color = color
+        self.font = font
+        self.size = size
+        self._showBoundary = True
+
+    def wrap(self, availwidth, availheight):
+        # Fake a size, we don't care if we exceed the table
+        return 10, self.size / 2
+
+    def draw(self):
+        self.canv.translate(0, - self.size / 2)
+        self.canv.rotate(2)
+        self.canv.setFont(self.font, self.size)
+        self.canv.setFillColor(self.color)
+        width = self.canv.stringWidth(self.text, self.font, self.size)
+        self.canv.drawRightString(0, 0, self.text)
+
+        self.canv.setStrokeColor(self.color)
+        self.canv.roundRect(-width - self.size / 2, -self.size / 4, width + self.size, self.size + self.size / 4, 3)
+
+
 class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
     identifier = 'classic'
     verbose_name = pgettext('invoice', 'Classic renderer (pretix 1.0)')
@@ -612,10 +640,10 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
             tdata.append([
                 pgettext('invoice', 'Invoice total'), '', money_filter(total, self.invoice.event.currency)
             ])
-            colwidths = [a * doc.width for a in (.65, .05, .30)]
+            colwidths = [a * doc.width for a in (.65, .20, .15)]
 
-        if self.invoice.event.settings.invoice_show_payments and not self.invoice.is_cancellation:
-            if self.invoice.order.status == Order.STATUS_PENDING:
+        if not self.invoice.is_cancellation:
+            if self.invoice.event.settings.invoice_show_payments and self.invoice.order.status == Order.STATUS_PENDING:
                 pending_sum = self.invoice.order.pending_sum
                 if pending_sum != total:
                     tdata.append([pgettext('invoice', 'Received payments')] + (['', '', ''] if has_taxes else ['']) + [
@@ -627,7 +655,7 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
                     tstyledata += [
                         ('FONTNAME', (0, len(tdata) - 3), (-1, len(tdata) - 3), self.font_bold),
                     ]
-            elif self.invoice.order.payments.filter(
+            elif self.invoice.event.settings.invoice_show_payments and self.invoice.order.payments.filter(
                 state__in=(OrderPayment.PAYMENT_STATE_CONFIRMED, OrderPayment.PAYMENT_STATE_REFUNDED), provider='giftcard'
             ).exists():
                 giftcard_sum = self.invoice.order.payments.filter(
@@ -645,6 +673,13 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
                 tstyledata += [
                     ('FONTNAME', (0, len(tdata) - 3), (-1, len(tdata) - 3), self.font_bold),
                 ]
+            elif self.invoice.payment_provider_stamp:
+                pm = PaidMarker(
+                    text=self.invoice.payment_provider_stamp,
+                    color=colors.HexColor(self.event.settings.theme_color_success),
+                    size=16
+                )
+                tdata[-1][-2] = pm
 
         table = Table(tdata, colWidths=colwidths, repeatRows=1)
         table.setStyle(TableStyle(tstyledata))
@@ -739,9 +774,10 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
                     Spacer(1, height=2 * mm),
                     Paragraph(
                         pgettext(
-                            'invoice', 'Using the conversion rate of 1:{rate} as published by the European Central Bank on '
+                            'invoice', 'Using the conversion rate of 1:{rate} as published by the {authority} on '
                                        '{date}, this corresponds to:'
                         ).format(rate=localize(self.invoice.foreign_currency_rate),
+                                 authority=SOURCE_NAMES.get(self.invoice.foreign_currency_source, "?"),
                                  date=date_format(self.invoice.foreign_currency_rate_date, "SHORT_DATE_FORMAT")),
                         self.stylesheet['Fineprint']
                     ),
@@ -753,10 +789,11 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
             story.append(Spacer(1, 5 * mm))
             story.append(Paragraph(
                 pgettext(
-                    'invoice', 'Using the conversion rate of 1:{rate} as published by the European Central Bank on '
+                    'invoice', 'Using the conversion rate of 1:{rate} as published by the {authority} on '
                                '{date}, the invoice total corresponds to {total}.'
                 ).format(rate=localize(self.invoice.foreign_currency_rate),
                          date=date_format(self.invoice.foreign_currency_rate_date, "SHORT_DATE_FORMAT"),
+                         authority=SOURCE_NAMES.get(self.invoice.foreign_currency_source, "?"),
                          total=fmt(foreign_total)),
                 self.stylesheet['Fineprint']
             ))

src/pretix/base/migrations/0229_invoice_payment_provider_stamp.py

@@ -0,0 +1,19 @@
+# Generated by Django 3.2.17 on 2023-02-07 10:00
+
+import django.core.serializers.json
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0228_scheduledeventexport_scheduledorganizerexport'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='invoice',
+            name='payment_provider_stamp',
+            field=models.CharField(max_length=100, null=True),
+        ),
+    ]

src/pretix/base/migrations/0230_auto_20230208_0939.py

@@ -0,0 +1,55 @@
+# Generated by Django 3.2.17 on 2023-02-08 09:39
+
+import django.core.serializers.json
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0229_invoice_payment_provider_stamp'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='itemvariation',
+            name='checkin_attention',
+            field=models.BooleanField(default=False),
+        ),
+        migrations.AddField(
+            model_name='order',
+            name='valid_if_pending',
+            field=models.BooleanField(default=False),
+        ),
+        migrations.AddField(
+            model_name='orderposition',
+            name='blocked',
+            field=models.JSONField(null=True),
+        ),
+        migrations.AddField(
+            model_name='orderposition',
+            name='valid_from',
+            field=models.DateTimeField(blank=True, null=True),
+        ),
+        migrations.AddField(
+            model_name='orderposition',
+            name='valid_until',
+            field=models.DateTimeField(blank=True, null=True),
+        ),
+        migrations.CreateModel(
+            name='BlockedTicketSecret',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False)),
+                ('secret', models.TextField(db_index=True)),
+                ('blocked', models.BooleanField()),
+                ('updated', models.DateTimeField(auto_now=True)),
+                ('event', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='blocked_secrets', to='pretixbase.event')),
+                ('position', models.ForeignKey(null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='blocked_secrets', to='pretixbase.orderposition')),
+            ],
+            options={
+                'unique_together': {('event', 'secret')},
+            } if 'mysql' not in settings.DATABASES['default']['ENGINE'] else {}
+        ),
+    ]

src/pretix/base/migrations/0231_auto_20230208_1546.py

@@ -0,0 +1,64 @@
+# Generated by Django 3.2.17 on 2023-02-08 15:46
+
+import django.core.serializers.json
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0230_auto_20230208_0939'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='item',
+            name='validity_dynamic_duration_days',
+            field=models.PositiveIntegerField(null=True),
+        ),
+        migrations.AddField(
+            model_name='item',
+            name='validity_dynamic_duration_hours',
+            field=models.PositiveIntegerField(null=True),
+        ),
+        migrations.AddField(
+            model_name='item',
+            name='validity_dynamic_duration_minutes',
+            field=models.PositiveIntegerField(null=True),
+        ),
+        migrations.AddField(
+            model_name='item',
+            name='validity_dynamic_duration_months',
+            field=models.PositiveIntegerField(null=True),
+        ),
+        migrations.AddField(
+            model_name='item',
+            name='validity_dynamic_start_choice',
+            field=models.BooleanField(default=False),
+        ),
+        migrations.AddField(
+            model_name='item',
+            name='validity_dynamic_start_choice_day_limit',
+            field=models.PositiveIntegerField(null=True),
+        ),
+        migrations.AddField(
+            model_name='item',
+            name='validity_fixed_from',
+            field=models.DateTimeField(blank=True, null=True),
+        ),
+        migrations.AddField(
+            model_name='item',
+            name='validity_fixed_until',
+            field=models.DateTimeField(blank=True, null=True),
+        ),
+        migrations.AddField(
+            model_name='item',
+            name='validity_mode',
+            field=models.CharField(max_length=16, null=True),
+        ),
+        migrations.AddField(
+            model_name='cartposition',
+            name='requested_valid_from',
+            field=models.DateTimeField(null=True),
+        ),
+    ]

src/pretix/base/migrations/0232_exchangerate.py

@@ -0,0 +1,34 @@
+# Generated by Django 3.2.17 on 2023-02-14 15:34
+
+import django.core.serializers.json
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0231_auto_20230208_1546'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='ExchangeRate',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False)),
+                ('source', models.CharField(max_length=100)),
+                ('source_date', models.DateField()),
+                ('updated', models.DateTimeField(auto_now=True)),
+                ('source_currency', models.CharField(max_length=3)),
+                ('other_currency', models.CharField(max_length=3)),
+                ('rate', models.DecimalField(decimal_places=6, max_digits=16)),
+            ],
+            options={
+                'unique_together': {('source', 'source_currency', 'other_currency')},
+            },
+        ),
+        migrations.AddField(
+            model_name='invoice',
+            name='foreign_currency_source',
+            field=models.CharField(max_length=100, null=True),
+        ),
+    ]

src/pretix/base/migrations/0233_ignore_from_quota_while_blocked.py

@@ -0,0 +1,19 @@
+# Generated by Django 3.2.17 on 2023-02-14 10:35
+
+import django.core.serializers.json
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0232_exchangerate'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='orderposition',
+            name='ignore_from_quota_while_blocked',
+            field=models.BooleanField(default=False),
+        ),
+    ]

src/pretix/base/migrations/0234_total_ordering.py

@@ -0,0 +1,56 @@
+# Generated by Django 3.2.16 on 2023-02-01 10:58
+
+import django.core.serializers.json
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0233_ignore_from_quota_while_blocked'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='logentry',
+            name='datetime',
+            field=models.DateTimeField(auto_now_add=True),
+        ),
+        migrations.AlterField(
+            model_name='order',
+            name='datetime',
+            field=models.DateTimeField(),
+        ),
+        migrations.AlterField(
+            model_name='order',
+            name='last_modified',
+            field=models.DateTimeField(auto_now=True),
+        ),
+        migrations.AlterField(
+            model_name='scheduledeventexport',
+            name='export_form_data',
+            field=models.JSONField(default=dict, encoder=django.core.serializers.json.DjangoJSONEncoder),
+        ),
+        migrations.AlterField(
+            model_name='scheduledorganizerexport',
+            name='export_form_data',
+            field=models.JSONField(default=dict, encoder=django.core.serializers.json.DjangoJSONEncoder),
+        ),
+        migrations.AlterField(
+            model_name='transaction',
+            name='datetime',
+            field=models.DateTimeField(),
+        ),
+        migrations.AlterIndexTogether(
+            name='logentry',
+            index_together={('datetime', 'id')},
+        ),
+        migrations.AlterIndexTogether(
+            name='order',
+            index_together={('datetime', 'id'), ('last_modified', 'id')},
+        ),
+        migrations.AlterIndexTogether(
+            name='transaction',
+            index_together={('datetime', 'id')},
+        ),
+    ]

src/pretix/base/models/__init__.py

@@ -23,6 +23,7 @@ from ..settings import GlobalSettingsObject_SettingsStore
 from .auth import U2FDevice, User, WebAuthnDevice
 from .base import CachedFile, LoggedModel, cachedfile_name
 from .checkin import Checkin, CheckinList
+from .currencies import ExchangeRate
 from .customers import Customer
 from .devices import Device, Gate
 from .discount import Discount

src/pretix/base/models/checkin.py

@@ -97,7 +97,7 @@ class CheckinList(LoggedModel):
     objects = ScopedManager(organizer='event__organizer')
 
     class Meta:
-        ordering = ('subevent__date_from', 'name')
+        ordering = ('subevent__date_from', 'name', 'pk')
 
     def positions_query(self, ignore_status=False):
         from . import Order, OrderPosition
@@ -106,10 +106,14 @@ class CheckinList(LoggedModel):
             order__event=self.event,
         )
         if not ignore_status:
-            qs = qs.filter(
-                canceled=False,
-                order__status__in=[Order.STATUS_PAID, Order.STATUS_PENDING] if self.include_pending else [Order.STATUS_PAID],
-            )
+            if self.include_pending:
+                qs = qs.filter(order__status__in=[Order.STATUS_PAID, Order.STATUS_PENDING], canceled=False)
+            else:
+                qs = qs.filter(
+                    Q(order__status=Order.STATUS_PAID) |
+                    Q(order__status=Order.STATUS_PENDING, order__valid_if_pending=True),
+                    canceled=False
+                )
 
         if self.subevent_id:
             qs = qs.filter(subevent_id=self.subevent_id)
@@ -327,6 +331,8 @@ class Checkin(models.Model):
     REASON_ALREADY_REDEEMED = 'already_redeemed'
     REASON_AMBIGUOUS = 'ambiguous'
     REASON_ERROR = 'error'
+    REASON_BLOCKED = 'blocked'
+    REASON_INVALID_TIME = 'invalid_time'
     REASONS = (
         (REASON_CANCELED, _('Order canceled')),
         (REASON_INVALID, _('Unknown ticket')),
@@ -338,6 +344,8 @@ class Checkin(models.Model):
         (REASON_PRODUCT, _('Ticket type not allowed here')),
         (REASON_AMBIGUOUS, _('Ticket code is ambiguous on list')),
         (REASON_ERROR, _('Server error')),
+        (REASON_BLOCKED, _('Ticket blocked')),
+        (REASON_INVALID_TIME, _('Ticket not valid at this time')),
     )
 
     successful = models.BooleanField(

src/pretix/base/models/currencies.py

@@ -0,0 +1,34 @@
+#
+# This file is part of pretix (Community Edition).
+#
+# Copyright (C) 2014-2020 Raphael Michel and contributors
+# Copyright (C) 2020-2021 rami.io GmbH and contributors
+#
+# This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
+# Public License as published by the Free Software Foundation in version 3 of the License.
+#
+# ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are
+# applicable granting you additional permissions and placing additional restrictions on your usage of this software.
+# Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive
+# this file, see <https://pretix.eu/about/en/license>.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
+# details.
+#
+# You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
+# <https://www.gnu.org/licenses/>.
+#
+from django.db import models
+
+
+class ExchangeRate(models.Model):
+    source = models.CharField(max_length=100)
+    source_date = models.DateField()
+    updated = models.DateTimeField(auto_now=True)
+    source_currency = models.CharField(max_length=3)
+    other_currency = models.CharField(max_length=3)
+    rate = models.DecimalField(decimal_places=6, max_digits=16)
+
+    class Meta:
+        unique_together = (('source', 'source_currency', 'other_currency'))

src/pretix/base/models/event.py

@@ -36,7 +36,7 @@ import logging
 import os
 import string
 import uuid
-from collections import OrderedDict
+from collections import Counter, OrderedDict, defaultdict
 from datetime import datetime, time, timedelta
 from operator import attrgetter
 from urllib.parse import urljoin
@@ -340,64 +340,104 @@ class EventMixin:
             )
         )
 
-    @cached_property
+    @property
     def best_availability_state(self):
+        return self.best_availability[0]
+
+    @property
+    def best_availability_is_low(self):
+        """
+        Returns ``True`` if the availability of tickets in this event is lower than the percentage
+        given in setting ``low_availability_percentage``.
+        """
+        if not self.settings.low_availability_percentage:
+            return False
+        ba = self.best_availability
+        if ba[1] is None or not ba[2]:
+            return False
+
+        percentage = ba[1] / ba[2] * 100
+        return percentage < self.settings.low_availability_percentage
+
+    @cached_property
+    def best_availability(self):
+        """
+        Returns a 3-tuple of
+
+        - The availability state of this event (one of the ``Quota.AVAILABILITY_*`` constants)
+        - The number of tickets currently available (or ``None``)
+        - The number of tickets "originally" available (or ``None``)
+
+        This can only be called on objects obtained through a queryset that has been passed through ``.annotated()``.
+        """
         from .items import Quota
 
         if not hasattr(self, 'active_quotas'):
             raise TypeError("Call this only if you fetched the subevents via Event/SubEvent.annotated()")
-        items_available = set()
-        vars_available = set()
-        items_reserved = set()
-        vars_reserved = set()
-        items_gone = set()
-        vars_gone = set()
-        items_disabled = set()
-        vars_disabled = set()
 
         if hasattr(self, 'disabled_items'):  # SubEventItem
             items_disabled = set(self.disabled_items.split(","))
+        else:
+            items_disabled = set()
 
         if hasattr(self, 'disabled_vars'):  # SubEventItemVariation
             vars_disabled = set(self.disabled_vars.split(","))
+        else:
+            vars_disabled = set()
 
+        # Compute the availability of all quotas and build a item→quotas mapping with all non-disabled items
         r = getattr(self, '_quota_cache', {})
+        quotas_for_item = defaultdict(list)
+        quotas_for_variation = defaultdict(list)
         for q in self.active_quotas:
-            res = r[q] if q in r else q.availability(allow_cache=True)
+            if q not in r:
+                r[q] = q.availability(allow_cache=True)
 
-            if res[0] == Quota.AVAILABILITY_OK:
-                if q.active_items:
-                    items_available.update(q.active_items.split(","))
-                if q.active_variations:
-                    vars_available.update(q.active_variations.split(","))
-            elif res[0] == Quota.AVAILABILITY_RESERVED:
-                if q.active_items:
-                    items_reserved.update(q.active_items.split(","))
-                if q.active_variations:
-                    vars_reserved.update(q.active_variations.split(","))
-            elif res[0] < Quota.AVAILABILITY_RESERVED:
-                if q.active_items:
-                    items_gone.update(q.active_items.split(","))
-                if q.active_variations:
-                    vars_gone.update(q.active_variations.split(","))
+            if q.active_items:
+                for item_id in q.active_items.split(","):
+                    if item_id not in items_disabled:
+                        quotas_for_item[item_id].append(q)
+            if q.active_variations:
+                for var_id in q.active_variations.split(","):
+                    if var_id not in vars_disabled:
+                        quotas_for_variation[var_id].append(q)
 
-        items_available -= items_disabled
-        items_reserved -= items_disabled
-        items_gone -= items_disabled
-        vars_available -= vars_disabled
-        vars_reserved -= vars_disabled
-        vars_gone -= vars_disabled
+        if not self.active_quotas or (not quotas_for_item and not quotas_for_variation):
+            # No item is enabled for this event, treat the event as "unknown"
+            return None, None, None
 
-        if not self.active_quotas or (
-            not items_available and not items_reserved and not items_gone and not vars_gone and not vars_available and not vars_reserved
-        ):
-            return None
+        # We iterate over all items and variations and keep track of
+        # - `best_state_found` - the best availability state we have seen so far. If one item is available, the event is available!
+        # - `num_tickets_found` - the number of tickets currently available in total. We sum up all the items and variations, but keep
+        #   track of them per-quota in `quota_used_for_found_tickets` to make sure we don't count the same tickets twice if two or more
+        #   items share the same quota
+        # - `num_tickets_possible` - basically the same thing, just with the total size of quotas instead of their currently availability
+        #   since we need that for the percentage calculation
+        best_state_found = Quota.AVAILABILITY_GONE
+        num_tickets_found = 0
+        num_tickets_possible = 0
+        quota_used_for_found_tickets = Counter()
+        quota_used_for_possible_tickets = Counter()
+        for quota_list in list(quotas_for_item.values()) + list(quotas_for_variation.values()):
+            worst_state_for_ticket = min(r[q][0] for q in quota_list)
+            quotas_that_are_not_unlimited = [q for q in quota_list if q.size is not None]
+            if not quotas_that_are_not_unlimited:
+                # We found an unlimited ticket, no more need to do anything else
+                return Quota.AVAILABILITY_OK, None, None
 
-        if items_available - items_reserved - items_gone or vars_available - vars_reserved - vars_gone:
-            return Quota.AVAILABILITY_OK
-        if items_reserved - items_gone or vars_reserved - vars_gone:
-            return Quota.AVAILABILITY_RESERVED
-        return Quota.AVAILABILITY_GONE
+            if worst_state_for_ticket == Quota.AVAILABILITY_OK:
+                availability_of_this = min(max(0, r[q][1] - quota_used_for_found_tickets[q]) for q in quotas_that_are_not_unlimited)
+                num_tickets_found += availability_of_this
+                for q in quota_list:
+                    quota_used_for_found_tickets[q] += availability_of_this
+
+            possible_of_this = min(max(0, q.size - quota_used_for_possible_tickets[q]) for q in quotas_that_are_not_unlimited)
+            num_tickets_possible += possible_of_this
+            for q in quota_list:
+                quota_used_for_possible_tickets[q] += possible_of_this
+
+            best_state_found = max(best_state_found, worst_state_for_ticket)
+        return best_state_found, num_tickets_found, num_tickets_possible
 
     def free_seats(self, ignore_voucher=None, sales_channel='web', include_blocked=False):
         qs_annotated = self._seats(ignore_voucher=ignore_voucher)
@@ -572,7 +612,7 @@ class Event(EventMixin, LoggedModel):
     class Meta:
         verbose_name = _("Event")
         verbose_name_plural = _("Events")
-        ordering = ("date_from", "name")
+        ordering = ("date_from", "name", "slug")
         unique_together = (('organizer', 'slug'),)
 
     def __str__(self):
@@ -591,6 +631,7 @@ class Event(EventMixin, LoggedModel):
         self.settings.invoice_email_attachment = True
         self.settings.name_scheme = 'given_family'
         self.settings.payment_banktransfer_invoice_immediately = True
+        self.settings.low_availability_percentage = 10
 
     @property
     def social_image(self):
@@ -1601,6 +1642,9 @@ class EventMetaProperty(LoggedModel):
         if self.default and self.allowed_values and self.default not in self.allowed_values.splitlines():
             raise ValidationError(_("You cannot set a default value that is not a valid value."))
 
+    class Meta:
+        ordering = ("name",)
+
 
 class EventMetaValue(LoggedModel):
     """

src/pretix/base/models/invoices.py

@@ -95,6 +95,8 @@ class Invoice(models.Model):
     :type additional_text: str
     :param payment_provider_text: A payment provider specific text
     :type payment_provider_text: str
+    :param payment_provider_stamp: A payment provider specific stamp
+    :type payment_provider_stamp: str
     :param footer_text: A footer text, displayed smaller and centered on every page
     :type footer_text: str
     :param foreign_currency_display: A different currency that taxes should also be displayed in.
@@ -103,6 +105,8 @@ class Invoice(models.Model):
     :type foreign_currency_rate: Decimal
     :param foreign_currency_rate_date: The date of the foreign currency exchange rates.
     :type foreign_currency_rate_date: date
+    :param foreign_currency_rate_source: The source of the foreign currency rate.
+    :type foreign_currency_rate_source: str
     :param file: The filename of the rendered invoice
     :type file: File
     """
@@ -144,11 +148,13 @@ class Invoice(models.Model):
     additional_text = models.TextField(blank=True)
     reverse_charge = models.BooleanField(default=False)
     payment_provider_text = models.TextField(blank=True)
+    payment_provider_stamp = models.CharField(max_length=100, null=True, blank=True)
     footer_text = models.TextField(blank=True)
 
     foreign_currency_display = models.CharField(max_length=50, null=True, blank=True)
     foreign_currency_rate = models.DecimalField(decimal_places=4, max_digits=10, null=True, blank=True)
     foreign_currency_rate_date = models.DateField(null=True, blank=True)
+    foreign_currency_source = models.CharField(max_length=100, null=True, blank=True)
 
     shredded = models.BooleanField(default=False)
 

src/pretix/base/models/items.py

@@ -33,12 +33,13 @@
 # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 # License for the specific language governing permissions and limitations under the License.
 
+import calendar
 import sys
 import uuid
 from collections import Counter, OrderedDict
-from datetime import date, datetime, time
+from datetime import date, datetime, time, timedelta
 from decimal import Decimal, DecimalException
-from typing import Tuple
+from typing import Optional, Tuple
 
 import dateutil.parser
 import pytz
@@ -339,7 +340,33 @@ class Item(LoggedModel):
     :type sales_channels: bool
     :param issue_giftcard: If ``True``, buying this product will give you a gift card with the value of the product's price
     :type issue_giftcard: bool
+    :param validity_mode: Instruction how to set ``valid_from``/``valid_until`` on tickets, ``null`` is default event validity.
+    :type validity_mode: str
+    :param validity_fixed_from: Start of validity if ``validity_mode`` is ``"fixed"``.
+    :type validity_fixed_from: datetime
+    :param validity_fixed_until: End of validity if ``validity_mode`` is ``"fixed"``.
+    :type validity_fixed_until: datetime
+    :param validity_dynamic_duration_minutes: Number of minutes if ``validity_mode`` is ``"dnyamic"``.
+    :type validity_dynamic_duration_minutes: int
+    :param validity_dynamic_duration_hours: Number of hours if ``validity_mode`` is ``"dnyamic"``.
+    :type validity_dynamic_duration_hours: int
+    :param validity_dynamic_duration_days: Number of days if ``validity_mode`` is ``"dnyamic"``.
+    :type validity_dynamic_duration_days: int
+    :param validity_dynamic_duration_months: Number of months if ``validity_mode`` is ``"dnyamic"``.
+    :type validity_dynamic_duration_months: int
+    :param validity_dynamic_start_choice: Whether customers can choose the start date if ``validity_mode`` is ``"dnyamic"``.
+    :type validity_dynamic_start_choice: bool
+    :param validity_dynamic_start_choice_day_limit: Start date may be maximum this many days in the future if ``validity_mode`` is ``"dnyamic"``.
+    :type validity_dynamic_start_choice_day_limnit: int
+
     """
+    VALIDITY_MODE_FIXED = 'fixed'
+    VALIDITY_MODE_DYNAMIC = 'dynamic'
+    VALIDITY_MODES = (
+        (None, _('Event validity (default)')),
+        (VALIDITY_MODE_FIXED, _('Fixed time frame')),
+        (VALIDITY_MODE_DYNAMIC, _('Dynamic validity')),
+    )
 
     objects = ItemQuerySetManager()
 
@@ -560,6 +587,49 @@ class Item(LoggedModel):
         verbose_name=_('Membership duration in months'),
         default=0,
     )
+
+    validity_mode = models.CharField(
+        choices=VALIDITY_MODES,
+        null=True, blank=True, max_length=16,
+        verbose_name=_('Validity'),
+        help_text=_(
+            'When setting up a regular event, or an event series with time slots, you typically to NOT need to change '
+            'this value. The default setting means that the validity time of tickets will not be decided by the '
+            'product, but by the event and check-in configuration. Only use the other options if you need them to '
+            'realize e.g. a booking of a year-long ticket with a dynamic start date. Note that the validity will be '
+            'stored with the ticket, so if you change the settings here later, existing tickets will not be affected '
+            'by the change but keep their current validity.'
+        )
+    )
+    validity_fixed_from = models.DateTimeField(null=True, blank=True, verbose_name=_('Start of validity'))
+    validity_fixed_until = models.DateTimeField(null=True, blank=True, verbose_name=_('End of validity'))
+    validity_dynamic_duration_minutes = models.PositiveIntegerField(
+        blank=True, null=True,
+        verbose_name=_('Minutes'),
+    )
+    validity_dynamic_duration_hours = models.PositiveIntegerField(
+        blank=True, null=True,
+        verbose_name=_('Hours')
+    )
+    validity_dynamic_duration_days = models.PositiveIntegerField(
+        blank=True, null=True,
+        verbose_name=_('Days'),
+    )
+    validity_dynamic_duration_months = models.PositiveIntegerField(
+        blank=True, null=True,
+        verbose_name=_('Months'),
+    )
+    validity_dynamic_start_choice = models.BooleanField(
+        verbose_name=_('Customers can select the validity start date'),
+        help_text=_('If not selected, the validity always starts at the time of purchase.'),
+        default=False
+    )
+    validity_dynamic_start_choice_day_limit = models.PositiveIntegerField(
+        blank=True, null=True,
+        verbose_name=_('Maximum future start'),
+        help_text=_('The selected start date may only be this many days in the future.')
+    )
+
     # !!! Attention: If you add new fields here, also add them to the copying code in
     # pretix/control/forms/item.py if applicable.
 
@@ -764,6 +834,73 @@ class Item(LoggedModel):
 
         return OrderedDict((k, v) for k, v in sorted(data.items(), key=lambda k: k[0]))
 
+    def compute_validity(
+        self, *, requested_start: datetime, override_tz=None, enforce_start_limit=False
+    ) -> Tuple[Optional[datetime], Optional[datetime]]:
+        if self.validity_mode == Item.VALIDITY_MODE_FIXED:
+            return self.validity_fixed_from, self.validity_fixed_until
+        elif self.validity_mode == Item.VALIDITY_MODE_DYNAMIC:
+            tz = override_tz or self.event.timezone
+            requested_start = requested_start or now()
+            if enforce_start_limit and not self.validity_dynamic_start_choice:
+                requested_start = now()
+            if enforce_start_limit and self.validity_dynamic_start_choice_day_limit is not None:
+                requested_start = min(requested_start, now() + timedelta(days=self.validity_dynamic_start_choice_day_limit))
+
+            valid_until = requested_start.astimezone(tz)
+
+            if self.validity_dynamic_duration_months:
+                valid_until -= timedelta(days=1)
+
+                replace_day = valid_until.day
+                max_day_start_month = calendar.monthrange(valid_until.year, valid_until.month)[1]
+                if replace_day == max_day_start_month:
+                    # This is a correction for month passes that start e.g. on March 1st – their previous day should
+                    # be "last of previous month", not "28th of previous month".
+                    replace_day = 31
+
+                replace_year = valid_until.year
+                replace_month = valid_until.month + self.validity_dynamic_duration_months
+
+                while replace_month > 12:
+                    replace_month -= 12
+                    replace_year += 1
+                max_day = calendar.monthrange(replace_year, replace_month)[1]
+                replace_date = date(
+                    year=replace_year,
+                    month=replace_month,
+                    day=min(replace_day, max_day),
+                )
+                if self.validity_dynamic_duration_days:
+                    replace_date += timedelta(days=self.validity_dynamic_duration_days)
+                valid_until = tz.localize(valid_until.replace(
+                    year=replace_date.year,
+                    month=replace_date.month,
+                    day=replace_date.day,
+                    hour=23, minute=59, second=59, microsecond=0,
+                    tzinfo=None,
+                ))
+            elif self.validity_dynamic_duration_days:
+                replace_date = valid_until.date() + timedelta(days=self.validity_dynamic_duration_days - 1)
+                valid_until = tz.localize(valid_until.replace(
+                    year=replace_date.year,
+                    month=replace_date.month,
+                    day=replace_date.day,
+                    hour=23, minute=59, second=59, microsecond=0,
+                    tzinfo=None
+                ))
+
+            if self.validity_dynamic_duration_hours:
+                valid_until += timedelta(hours=self.validity_dynamic_duration_hours)
+
+            if self.validity_dynamic_duration_minutes:
+                valid_until += timedelta(minutes=self.validity_dynamic_duration_minutes)
+
+            return requested_start, valid_until
+
+        else:
+            return None, None
+
 
 def _all_sales_channels_identifiers():
     from pretix.base.channels import get_all_sales_channels
@@ -790,6 +927,7 @@ class ItemVariation(models.Model):
     :param require_approval: If set to ``True``, orders containing this variation can only be processed and paid after
     approval by an administrator
     :type require_approval: bool
+
     """
     item = models.ForeignKey(
         Item,
@@ -870,6 +1008,13 @@ class ItemVariation(models.Model):
         help_text=_('This variation will be hidden from the event page until the user enters a voucher '
                     'that unlocks this variation.')
     )
+    checkin_attention = models.BooleanField(
+        verbose_name=_('Requires special attention'),
+        default=False,
+        help_text=_('If you set this, the check-in app will show a visible warning that this ticket requires special '
+                    'attention. You can use this for example for student tickets to indicate to the person at '
+                    'check-in that the student ID card still needs to be checked.')
+    )
 
     objects = ScopedManager(organizer='item__event__organizer')
 
@@ -1792,6 +1937,9 @@ class ItemMetaProperty(LoggedModel):
     )
     default = models.TextField(blank=True)
 
+    class Meta:
+        ordering = ("name",)
+
 
 class ItemMetaValue(LoggedModel):
     """

src/pretix/base/models/log.py

@@ -72,7 +72,7 @@ class LogEntry(models.Model):
     content_type = models.ForeignKey(ContentType, on_delete=models.CASCADE)
     object_id = models.PositiveIntegerField(db_index=True)
     content_object = GenericForeignKey('content_type', 'object_id')
-    datetime = models.DateTimeField(auto_now_add=True, db_index=True)
+    datetime = models.DateTimeField(auto_now_add=True)
     user = models.ForeignKey('User', null=True, blank=True, on_delete=models.PROTECT)
     api_token = models.ForeignKey('TeamAPIToken', null=True, blank=True, on_delete=models.PROTECT)
     device = models.ForeignKey('Device', null=True, blank=True, on_delete=models.PROTECT)
@@ -88,6 +88,9 @@ class LogEntry(models.Model):
 
     class Meta:
         ordering = ('-datetime', '-id')
+        index_together = [
+            ['datetime', 'id']
+        ]
 
     def display(self):
         from ..signals import logentry_display

src/pretix/base/models/orders.py

@@ -122,6 +122,9 @@ class Order(LockModel, LoggedModel):
         * ``STATUS_EXPIRED``
         * ``STATUS_CANCELED``
 
+    :param valid_if_pending: Treat this order like a paid order for most purposes (such as check-in), even if it is
+                             still unpaid.
+    :type valid_if_pending: bool
     :param event: The event this order belongs to
     :type event: Event
     :param customer: The customer this order belongs to
@@ -177,6 +180,9 @@ class Order(LockModel, LoggedModel):
         verbose_name=_("Status"),
         db_index=True
     )
+    valid_if_pending = models.BooleanField(
+        default=False,
+    )
     testmode = models.BooleanField(default=False)
     event = models.ForeignKey(
         Event,
@@ -205,7 +211,7 @@ class Order(LockModel, LoggedModel):
     )
     secret = models.CharField(max_length=32, default=generate_secret)
     datetime = models.DateTimeField(
-        verbose_name=_("Date"), db_index=True
+        verbose_name=_("Date"), db_index=False
     )
     cancellation_date = models.DateTimeField(
         null=True, blank=True
@@ -246,7 +252,7 @@ class Order(LockModel, LoggedModel):
         null=True, blank=True
     )
     last_modified = models.DateTimeField(
-        auto_now=True, db_index=True
+        auto_now=True, db_index=False
     )
     require_approval = models.BooleanField(
         default=False
@@ -262,7 +268,11 @@ class Order(LockModel, LoggedModel):
     class Meta:
         verbose_name = _("Order")
         verbose_name_plural = _("Orders")
-        ordering = ("-datetime",)
+        ordering = ("-datetime", "-pk")
+        index_together = [
+            ["datetime", "id"],
+            ["last_modified", "id"],
+        ]
 
     def __str__(self):
         return self.full_code
@@ -645,7 +655,7 @@ class Order(LockModel, LoggedModel):
                 has_checkin=Exists(Checkin.objects.filter(position_id=OuterRef('pk')))
             ).select_related('item').prefetch_related('issued_gift_cards')
         )
-        cancelable = all([op.item.allow_cancel and not op.has_checkin for op in positions])
+        cancelable = all([op.item.allow_cancel and not op.has_checkin and not op.blocked for op in positions])
         if not cancelable or not positions:
             return False
         for op in positions:
@@ -848,7 +858,7 @@ class Order(LockModel, LoggedModel):
         ) and (
             self.status == Order.STATUS_PAID
             or (
-                (self.event.settings.ticket_download_pending or self.total == Decimal("0.00")) and
+                (self.valid_if_pending or self.event.settings.ticket_download_pending) and
                 self.status == Order.STATUS_PENDING and
                 not self.require_approval
             )
@@ -1635,7 +1645,7 @@ class OrderPayment(models.Model):
                 logger.info('Failed payment {} but ignored due to likely race condition.'.format(
                     self.full_id,
                 ))
-                return
+                return False
 
             if isinstance(info, str):
                 locked_instance.info = info
@@ -1651,6 +1661,7 @@ class OrderPayment(models.Model):
             'info': info,
             'data': log_data,
         }, user=user, auth=auth)
+        return True
 
     def confirm(self, count_waitinglist=True, send_mail=True, force=False, user=None, auth=None, mail_text='',
                 ignore_date=False, lock=True, payment_date=None, generate_invoice=True):
@@ -2200,17 +2211,34 @@ class OrderPosition(AbstractPosition):
     :type canceled: bool
     :param pseudonymization_id: The QR code content for lead scanning
     :type pseudonymization_id: str
+    :param blocked: A list of reasons why this order position is blocked. Blocked positions can't be used for check-in and
+                    other purposes. Each entry should be a short string that can be translated into a human-readable
+                    description by a plugin. If the position is not blocked, the value must be ``None``, not an empty
+                    list.
+    :type blocked: list
+    :param ignore_from_quota_while_blocked: Ignore this order position from quota, as long as ``blocked`` is set. Only
+                                            to be used carefully by specific plugins.
+    :type ignore_from_quota_while_blocked: boolean
+    :param valid_from: The ticket will not be considered valid before this date. If the value is ``None``, no check on
+                       ticket level is made.
+    :type valid_from: datetime
+    :param valid_until: The ticket will not be considered valid after this date. If the value is ``None``, no check on
+                       ticket level is made.
+    :type valid_until: datetime
     """
     positionid = models.PositiveIntegerField(default=1)
+
     order = models.ForeignKey(
         Order,
         verbose_name=_("Order"),
         related_name='all_positions',
         on_delete=models.PROTECT
     )
+
     voucher_budget_use = models.DecimalField(
         max_digits=10, decimal_places=2, null=True, blank=True,
     )
+
     tax_rate = models.DecimalField(
         max_digits=7, decimal_places=2,
         verbose_name=_('Tax rate')
@@ -2224,6 +2252,7 @@ class OrderPosition(AbstractPosition):
         max_digits=10, decimal_places=2,
         verbose_name=_('Tax value')
     )
+
     secret = models.CharField(max_length=255, null=False, blank=False, db_index=True)
     web_secret = models.CharField(max_length=32, default=generate_secret, db_index=True)
     pseudonymization_id = models.CharField(
@@ -2231,8 +2260,22 @@ class OrderPosition(AbstractPosition):
         unique=True,
         db_index=True
     )
+
     canceled = models.BooleanField(default=False)
 
+    blocked = models.JSONField(null=True, blank=True)
+    ignore_from_quota_while_blocked = models.BooleanField(default=False)
+    valid_from = models.DateTimeField(
+        verbose_name=_("Valid from"),
+        null=True,
+        blank=True,
+    )
+    valid_until = models.DateTimeField(
+        verbose_name=_("Valid until"),
+        null=True,
+        blank=True,
+    )
+
     all = ScopedManager(organizer='order__event__organizer')
     objects = ActivePositionManager()
 
@@ -2263,6 +2306,12 @@ class OrderPosition(AbstractPosition):
     def sort_key(self):
         return self.addon_to.positionid if self.addon_to else self.positionid, self.addon_to_id or 0, self.positionid
 
+    @cached_property
+    def require_checkin_attention(self):
+        if self.order.checkin_attention or self.item.checkin_attention or (self.variation_id and self.variation.checkin_attention):
+            return True
+        return False
+
     @property
     def checkins(self):
         """
@@ -2275,11 +2324,30 @@ class OrderPosition(AbstractPosition):
     def generate_ticket(self):
         if self.item.generate_tickets is not None:
             return self.item.generate_tickets
+        if self.blocked:
+            return False
         return (
             (self.order.event.settings.ticket_download_addons or not self.addon_to_id) and
             (self.event.settings.ticket_download_nonadm or self.item.admission)
         )
 
+    @property
+    def blocked_reasons(self):
+        from ..signals import orderposition_blocked_display
+
+        if not self.blocked:
+            return []
+
+        reasons = {}
+        for b in self.blocked:
+            for recv, response in orderposition_blocked_display.send(self.event, orderposition=self, block_name=b):
+                if response:
+                    reasons[b] = response
+                    break
+            else:
+                reasons[b] = b
+        return reasons
+
     @classmethod
     def transform_cart_positions(cls, cp: List, order) -> list:
         from . import Voucher
@@ -2297,6 +2365,20 @@ class OrderPosition(AbstractPosition):
             op._calculate_tax()
             if cartpos.voucher:
                 op.voucher_budget_use = cartpos.listed_price - cartpos.price_after_voucher
+
+            if cartpos.item.validity_mode:
+                valid_from, valid_until = cartpos.item.compute_validity(
+                    requested_start=(
+                        max(cartpos.requested_valid_from, now())
+                        if cartpos.requested_valid_from and cartpos.item.validity_dynamic_start_choice
+                        else now()
+                    ),
+                    enforce_start_limit=True,
+                    override_tz=order.event.timezone,
+                )
+                op.valid_from = valid_from
+                op.valid_until = valid_until
+
             op.positionid = i + 1
             op.save()
             ops.append(op)
@@ -2362,6 +2444,11 @@ class OrderPosition(AbstractPosition):
                     event=self.order.event, position=self, force_invalidate=True, save=False
                 )
 
+        if not self.blocked:
+            self.blocked = None
+        elif not isinstance(self.blocked, list) or any(not isinstance(b, str) for b in self.blocked):
+            raise TypeError("blocked needs to be a list of strings")
+
         if not self.pseudonymization_id:
             self.assign_pseudonymization_id()
 
@@ -2535,7 +2622,6 @@ class Transaction(models.Model):
     )
     datetime = models.DateTimeField(
         verbose_name=_("Date"),
-        db_index=True,
     )
     migrated = models.BooleanField(
         default=False
@@ -2586,6 +2672,9 @@ class Transaction(models.Model):
 
     class Meta:
         ordering = 'datetime', 'pk'
+        index_together = [
+            ['datetime', 'id']
+        ]
 
     def save(self, *args, **kwargs):
         if not self.fee_type and not self.item:
@@ -2665,6 +2754,9 @@ class CartPosition(AbstractPosition):
     line_price_gross = models.DecimalField(
         decimal_places=2, max_digits=10, null=True,
     )
+    requested_valid_from = models.DateTimeField(
+        null=True,
+    )
 
     objects = ScopedManager(organizer='event__organizer')
 
@@ -2758,6 +2850,25 @@ class CartPosition(AbstractPosition):
         addons = [op for op in self.addons.all() if not op.is_bundled]
         return sorted(addons, key=lambda cp: cp.sort_key)
 
+    @cached_property
+    def predicted_validity(self):
+        return self.item.compute_validity(
+            requested_start=(
+                max(self.requested_valid_from, now())
+                if self.requested_valid_from and self.item.validity_dynamic_start_choice
+                else now()
+            ),
+            override_tz=self.event.timezone,
+        )
+
+    @property
+    def valid_from(self):
+        return self.predicted_validity[0]
+
+    @property
+    def valid_until(self):
+        return self.predicted_validity[1]
+
 
 class InvoiceAddress(models.Model):
     last_modified = models.DateTimeField(auto_now=True)
@@ -2940,6 +3051,26 @@ class RevokedTicketSecret(models.Model):
     created = models.DateTimeField(auto_now_add=True)
 
 
+class BlockedTicketSecret(models.Model):
+    event = models.ForeignKey(Event, on_delete=models.CASCADE, related_name='blocked_secrets')
+    position = models.ForeignKey(
+        OrderPosition,
+        on_delete=models.SET_NULL,
+        related_name='blocked_secrets',
+        null=True,
+    )
+    secret = models.TextField(db_index=True)
+    blocked = models.BooleanField()
+    updated = models.DateTimeField(auto_now=True)
+
+    class Meta:
+        if 'mysql' not in settings.DATABASES['default']['ENGINE']:
+            # MySQL does not support indexes on TextField(). Django knows this and just ignores db_index, but it will
+            # not silently ignore the UNIQUE index, causing this table to fail. I'm so glad we're deprecating MySQL
+            # in a few months, so we'll just live without an unique index until then.
+            unique_together = (('event', 'secret'),)
+
+
 @receiver(post_delete, sender=CachedTicket)
 def cachedticket_delete(sender, instance, **kwargs):
     if instance.file:

src/pretix/base/models/organizer.py

@@ -93,7 +93,7 @@ class Organizer(LoggedModel):
     class Meta:
         verbose_name = _("Organizer")
         verbose_name_plural = _("Organizers")
-        ordering = ("name",)
+        ordering = ("name", "slug")
 
     def __str__(self) -> str:
         return self.name

src/pretix/base/models/vouchers.py

@@ -331,8 +331,12 @@ class Voucher(LoggedModel):
             if item:
                 raise ValidationError(_('You cannot select a quota and a specific product at the same time.'))
         elif item:
+            if item.require_bundling or (item.category_id and item.category.is_addon):
+                raise ValidationError(_('You cannot select a product that is only available as an add-on product or '
+                                        'as part of a bundle, since vouchers cannot be applied to add-on products or '
+                                        'bundled products.'))
             if item.event != event:
-                raise ValidationError(_('You cannot select an item that belongs to a different event.'))
+                raise ValidationError(_('You cannot select a product that belongs to a different event.'))
             if variation and (not item or not item.has_variations):
                 raise ValidationError(_('You cannot select a variation without having selected a product that provides '
                                         'variations.'))

src/pretix/base/models/waitinglist.py

@@ -112,7 +112,7 @@ class WaitingListEntry(LoggedModel):
     class Meta:
         verbose_name = _("Waiting list entry")
         verbose_name_plural = _("Waiting list entries")
-        ordering = ('-priority', 'created')
+        ordering = ('-priority', 'created', 'pk')
 
     def __str__(self):
         return '%s waits for %s' % (str(self.email), str(self.item))

src/pretix/base/orderimport.py

@@ -638,6 +638,8 @@ class Locale(ImportColumn):
     def clean(self, value, previous_values):
         if not value:
             value = self.event.settings.locale
+        if isinstance(value, str):
+            value = value.lower()
         if value not in self.event.settings.locales:
             raise ValidationError(_("Please enter a valid language code."))
         return value
@@ -646,6 +648,52 @@ class Locale(ImportColumn):
         order.locale = value
 
 
+class ValidFrom(ImportColumn):
+    identifier = 'valid_from'
+    verbose_name = gettext_lazy('Valid from')
+
+    def clean(self, value, previous_values):
+        if not value:
+            return
+
+        input_formats = formats.get_format('DATETIME_INPUT_FORMATS', use_l10n=True)
+        for format in input_formats:
+            try:
+                d = datetime.datetime.strptime(value, format)
+                d = self.event.timezone.localize(d)
+                return d
+            except (ValueError, TypeError):
+                pass
+        else:
+            raise ValidationError(_("Could not parse {value} as a date and time.").format(value=value))
+
+    def assign(self, value, order, position, invoice_address, **kwargs):
+        position.valid_from = value
+
+
+class ValidUntil(ImportColumn):
+    identifier = 'valid_until'
+    verbose_name = gettext_lazy('Valid until')
+
+    def clean(self, value, previous_values):
+        if not value:
+            return
+
+        input_formats = formats.get_format('DATETIME_INPUT_FORMATS', use_l10n=True)
+        for format in input_formats:
+            try:
+                d = datetime.datetime.strptime(value, format)
+                d = self.event.timezone.localize(d)
+                return d
+            except (ValueError, TypeError):
+                pass
+        else:
+            raise ValidationError(_("Could not parse {value} as a date and time.").format(value=value))
+
+    def assign(self, value, order, position, invoice_address, **kwargs):
+        position.valid_until = value
+
+
 class Saleschannel(ImportColumn):
     identifier = 'sales_channel'
     verbose_name = gettext_lazy('Sales channel')
@@ -816,7 +864,9 @@ def get_all_columns(event):
         Locale(event),
         Saleschannel(event),
         SeatColumn(event),
-        Comment(event)
+        Comment(event),
+        ValidFrom(event),
+        ValidUntil(event),
     ]
     for q in event.questions.prefetch_related('options').exclude(type=Question.TYPE_FILE):
         default.append(QuestionColumn(event, q))