Do not use redis cache at import time

During our [2026-06-27 incident](https://pretix.eu/about/en/blog/20260630-pretix-hosted-outage/), we noticed that pretix is using redis at import time. This means that gunicorn and celery process were unable to start on servers who could currently not reach redis. This is kinda mitigated through auto-restart on systemd or docker level, but that's not really how it is supposed to work. Celery even has smart retry/reconnect logic that becomes pointless this way.
2026-08-17 11:56:27 +00:00 · 2026-06-30 13:10:45 +02:00
46 changed files with 637 additions and 524 deletions
@@ -53,7 +53,6 @@ dependencies = [
  "django-oauth-toolkit==2.3.*",
  "django-otp==1.7.*",
  "django-phonenumber-field==8.4.*",
  "django-querytagger==0.0.2",
  "django-redis==6.0.*",
  "django-scopes==2.0.*",
  "django-statici18n==2.7.*",
@@ -94,7 +93,7 @@ dependencies = [
  "redis==7.4.*",
  "reportlab==4.5.*",
  "requests==2.32.*",
-  "sentry-sdk==2.64.*",
+  "sentry-sdk==2.63.*",
  "sepaxml==2.7.*",
  "stripe==7.9.*",
  "text-unidecode==1.*",
@@ -6,8 +6,8 @@ localecompile:
 	./manage.py compilemessages
 localegen:
-	./manage.py makemessages --keep-pot --add-location file --ignore "pretix/static/npm_dir/*" $(LNGS)
+	./manage.py makemessages --keep-pot --ignore "pretix/static/npm_dir/*" $(LNGS)
-	./manage.py makemessages --keep-pot --add-location file -e js,ts,vue -d djangojs --ignore "pretix/static/npm_dir/*" --ignore "pretix/helpers/*" --ignore "pretix/static/jsi18n/*" --ignore "pretix/static/jsi18n/*" --ignore "pretix/static.dist/*" --ignore "data/*" --ignore "pretix/static/rrule/*" --ignore "build/*" $(LNGS)
+	./manage.py makemessages --keep-pot -e js,ts,vue -d djangojs --ignore "pretix/static/npm_dir/*" --ignore "pretix/helpers/*" --ignore "pretix/static/jsi18n/*" --ignore "pretix/static/jsi18n/*" --ignore "pretix/static.dist/*" --ignore "data/*" --ignore "pretix/static/rrule/*" --ignore "build/*" $(LNGS)
 staticfiles: npminstall npmbuild jsi18n
 	./manage.py collectstatic --noinput
@@ -19,4 +19,4 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-__version__ = "2026.7.0.dev0"
+__version__ = "2026.6.0.dev0"
@@ -118,7 +118,6 @@ ALL_LANGUAGES = [
    ('sv', _('Swedish')),
    ('es', _('Spanish')),
    ('es-419', _('Spanish (Latin America)')),
    ('th', _('Thai')),
    ('tr', _('Turkish')),
    ('uk', _('Ukrainian')),
 ]
@@ -53,6 +53,7 @@ from django.db.models import QuerySet
 from django.forms import Select, widgets
 from django.forms.widgets import FILE_INPUT_CONTRADICTION
 from django.utils.formats import date_format
 from django.utils.functional import lazy
 from django.utils.html import escape
 from django.utils.safestring import mark_safe
 from django.utils.text import format_lazy
@@ -324,16 +325,21 @@ class WrappedPhonePrefixSelect(Select):
    initial = None
    def __init__(self, initial=None):
-        choices = [("", "---------")]
+        def _get_choices():
            choices = [("", "---------")]
            if initial:
                for prefix, values in COUNTRY_CODE_TO_REGION_CODE.items():
                    if all(v == REGION_CODE_FOR_NON_GEO_ENTITY for v in values):
                        continue
                    if initial in values:
                        self.initial = "+%d" % prefix
                        break
            choices += get_phone_prefixes_sorted_and_localized()
            return choices
        choices = lazy(_get_choices, list)()
        if initial:
            for prefix, values in COUNTRY_CODE_TO_REGION_CODE.items():
                if all(v == REGION_CODE_FOR_NON_GEO_ENTITY for v in values):
                    continue
                if initial in values:
                    self.initial = "+%d" % prefix
                    break
        choices += get_phone_prefixes_sorted_and_localized()
        super().__init__(choices=choices, attrs={
            'aria-label': pgettext_lazy('phonenumber', 'International area code'),
            'autocomplete': 'tel-country-code',
@@ -0,0 +1,29 @@
 #
 # This file is part of pretix (Community Edition).
 #
 # Copyright (C) 2014-2020  Raphael Michel and contributors
 # Copyright (C) 2020-today pretix GmbH and contributors
 #
 # This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
 # Public License as published by the Free Software Foundation in version 3 of the License.
 #
 # ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are
 # applicable granting you additional permissions and placing additional restrictions on your usage of this software.
 # Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive
 # this file, see <https://pretix.eu/about/en/license>.
 #
 # This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
 # warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
 # details.
 #
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
 from django.core.management.base import BaseCommand
 class Command(BaseCommand):
    help = "Do nothing. Useful for startup performance testing."
    def handle(self, *args, **options):
        pass
@@ -19,8 +19,6 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
 import logging
 import re
 from collections import OrderedDict
 from urllib.parse import urlparse, urlsplit
 from zoneinfo import ZoneInfo, ZoneInfoNotFoundError
@@ -45,8 +43,6 @@ from pretix.multidomain.urlreverse import (
 )
 from pretix.presale.style import get_fonts
 logger = logging.getLogger(__name__)
 _supported = None
@@ -227,26 +223,7 @@ def _parse_csp(header):
    return h
 VALID_CSP_DIRECTIVES = [
    "child-src", "connect-src", "default-src", "fenced-frame-src", "font-src", "form-action", "frame-src", "img-src",
    "manifest-src", "media-src", "object-src", "prefetch-src", "report-uri", "script-src", "script-src-elem",
    "script-src-attr", "style-src", "style-src-elem", "style-src-attr", "worker-src",
 ]
 CSP_ILLEGAL_CHARS = re.compile(r'[\s,;]')
 def _sanitize_csp(h):
    for k, v in h.items():
        if k not in VALID_CSP_DIRECTIVES:
            raise ValueError("Invalid CSP directive " + k)
        if any(CSP_ILLEGAL_CHARS.search(el) for el in v):
            logger.warning("Stripping invalid component from CSP: %r", h)
            h[k] = [el for el in v if not CSP_ILLEGAL_CHARS.search(el)]
 def _render_csp(h):
    _sanitize_csp(h)
    return "; ".join(k + ' ' + ' '.join(v) for k, v in h.items() if v)
@@ -266,7 +243,21 @@ def _merge_csp(a, b):
 class SecurityMiddleware(MiddlewareMixin):
    CSP_EXEMPT = (
        '/api/v1/docs/',
    )
    def process_response(self, request, resp):
        def nested_dict_values(d):
            for v in d.values():
                if isinstance(v, dict):
                    yield from nested_dict_values(v)
                else:
                    if isinstance(v, str):
                        yield v
        url = resolve(request.path_info)
        if settings.DEBUG and resp.status_code >= 400:
            # Don't use CSP on debug error page as it breaks of Django's fancy error
            # pages
@@ -277,15 +268,18 @@ class SecurityMiddleware(MiddlewareMixin):
        # https://github.com/pretix/pretix/issues/765
        resp['P3P'] = 'CP=\"ALL DSP COR CUR ADM TAI OUR IND COM NAV INT\"'
-        if not getattr(resp, '_csp_ignore', False):
+        img_src = []
-            resp['Content-Security-Policy'] = _render_csp(self._build_csp(request, resp))
+        gs = global_settings_object(request)
-        elif 'Content-Security-Policy' in resp:
+        if gs.settings.leaflet_tiles:
-            del resp['Content-Security-Policy']
+            img_src.append(gs.settings.leaflet_tiles[:gs.settings.leaflet_tiles.index("/", 10)].replace("{s}", "*"))
-        return resp
+        font_src = set()
-
+        if hasattr(request, 'event'):
-    def _build_csp(self, request, resp):
+            for font in get_fonts(request.event, pdf_support_required=False).values():
-        url = resolve(request.path_info)
+                for path in list(nested_dict_values(font)):
                    font_location = urlparse(path)
                    if font_location.scheme and font_location.netloc:
                        font_src.add('{}://{}'.format(font_location.scheme, font_location.netloc))
        h = {
            'default-src': ["{static}"],
@@ -294,8 +288,8 @@ class SecurityMiddleware(MiddlewareMixin):
            'frame-src': ['{static}'],
            'style-src': ["{static}", "{media}"],
            'connect-src': ["{dynamic}", "{media}"],
-            'img-src': ["{static}", "{media}", "data:"],
+            'img-src': ["{static}", "{media}", "data:"] + img_src,
-            'font-src': ["{static}"],
+            'font-src': ["{static}"] + list(font_src),
            'media-src': ["{static}", "data:"],
            # form-action is not only used to match on form actions, but also on URLs
            # form-actions redirect to. In the context of e.g. payment providers or
@@ -304,13 +298,6 @@ class SecurityMiddleware(MiddlewareMixin):
            'form-action': ["{dynamic}", "https:"] + (['http:'] if settings.SITE_URL.startswith('http://') else []),
        }
        gs = global_settings_object(request)
        if gs.settings.leaflet_tiles:
            h['img-src'].append(gs.settings.leaflet_tiles[:gs.settings.leaflet_tiles.index("/", 10)].replace("{s}", "*"))
        if hasattr(request, 'event'):
            h['font-src'] += list(self._get_font_origins(request.event))
        if settings.VITE_DEV_MODE:
            h['script-src'] += ["http://localhost:5173", "ws://localhost:5173"]
            h['style-src'] += ["'unsafe-inline'"]
@@ -322,7 +309,6 @@ class SecurityMiddleware(MiddlewareMixin):
            if not settings.VITE_DEV_MODE:
                # can't have 'unsafe-inline' and nonce at the same time
                h['style-src'].append(nonce)
        # Only include pay.google.com for wallet detection purposes on the Payment selection page
        if (
                url.url_name == "event.order.pay.change" or
@@ -331,32 +317,27 @@ class SecurityMiddleware(MiddlewareMixin):
            h['script-src'].append('https://pay.google.com')
            h['frame-src'].append('https://pay.google.com')
            h['connect-src'].append('https://google.com/pay')
        if settings.LOG_CSP:
            h['report-uri'] = ["/csp_report/"]
        if 'Content-Security-Policy' in resp:
            _merge_csp(h, _parse_csp(resp['Content-Security-Policy']))
        if settings.CSP_ADDITIONAL_HEADER:
            _merge_csp(h, _parse_csp(settings.CSP_ADDITIONAL_HEADER))
-        placeholders = {
+        staticdomain = "'self'"
-            "{static}": ["'self'"],
+        dynamicdomain = "'self'"
-            "{dynamic}": ["'self'"],
+        mediadomain = "'self'"
            "{media}": ["'self'"],
        }
        if settings.MEDIA_URL.startswith('http'):
-            placeholders["{media}"].append(settings.MEDIA_URL[:settings.MEDIA_URL.find('/', 9)])
+            mediadomain += " " + settings.MEDIA_URL[:settings.MEDIA_URL.find('/', 9)]
        if settings.STATIC_URL.startswith('http'):
-            placeholders["{static}"].append(settings.STATIC_URL[:settings.STATIC_URL.find('/', 9)])
+            staticdomain += " " + settings.STATIC_URL[:settings.STATIC_URL.find('/', 9)]
        if settings.SITE_URL.startswith('http'):
            if settings.SITE_URL.find('/', 9) > 0:
-                placeholders["{static}"].append(settings.SITE_URL[:settings.SITE_URL.find('/', 9)])
+                staticdomain += " " + settings.SITE_URL[:settings.SITE_URL.find('/', 9)]
-                placeholders["{dynamic}"].append(settings.SITE_URL[:settings.SITE_URL.find('/', 9)])
+                dynamicdomain += " " + settings.SITE_URL[:settings.SITE_URL.find('/', 9)]
            else:
-                placeholders["{static}"].append(settings.SITE_URL)
+                staticdomain += " " + settings.SITE_URL
-                placeholders["{dynamic}"].append(settings.SITE_URL)
+                dynamicdomain += " " + settings.SITE_URL
        if hasattr(request, 'organizer') and request.organizer:
            if hasattr(request, 'event') and request.event:
@@ -367,29 +348,18 @@ class SecurityMiddleware(MiddlewareMixin):
                siteurlsplit = urlsplit(settings.SITE_URL)
                if siteurlsplit.port and siteurlsplit.port not in (80, 443):
                    domain = '%s:%d' % (domain, siteurlsplit.port)
-                placeholders["{dynamic}"].append(domain)
+                dynamicdomain += " " + domain
-        for k, v in h.items():
+        if request.path not in self.CSP_EXEMPT and not getattr(resp, '_csp_ignore', False):
-            h[k] = sorted(set(result for part in v for result in placeholders.get(part, [part])))
+            resp['Content-Security-Policy'] = _render_csp(h).format(static=staticdomain, dynamic=dynamicdomain,
                                                                    media=mediadomain)
            for k, v in h.items():
                h[k] = sorted(set(' '.join(v).format(static=staticdomain, dynamic=dynamicdomain, media=mediadomain).split(' ')))
            resp['Content-Security-Policy'] = _render_csp(h)
        elif 'Content-Security-Policy' in resp:
            del resp['Content-Security-Policy']
-        return h
+        return resp
    def _get_font_origins(self, event):
        def nested_dict_values(d):
            for v in d.values():
                if isinstance(v, dict):
                    yield from nested_dict_values(v)
                else:
                    if isinstance(v, str):
                        yield v
        font_src = set()
        for font in get_fonts(event, pdf_support_required=False).values():
            for path in list(nested_dict_values(font)):
                font_location = urlparse(path)
                if font_location.scheme and font_location.netloc:
                    font_src.add('{}://{}'.format(font_location.scheme, font_location.netloc))
        return font_src
 class RejectInvalidInputMiddleware(MiddlewareMixin):
@@ -647,22 +647,25 @@ class User(AbstractBaseUser, PermissionsMixin, LoggingMixin):
            id__in=self.teams.filter(TeamQuerySet.organizer_permission_q(permission)).values_list('organizer', flat=True)
        )
-    def has_active_staff_session(self, session_key):
+    def has_active_staff_session(self, session_key=None):
        """
        Returns whether or not a user has an active staff session (formerly known as superuser session)
        with the given session key.
        """
        return self.get_active_staff_session(session_key) is not None
-    def get_active_staff_session(self, session_key):
+    def get_active_staff_session(self, session_key=None):
-        if not self.is_staff or not session_key:
+        if not self.is_staff:
            return None
        if not hasattr(self, '_staff_session_cache'):
            self._staff_session_cache = {}
        if session_key not in self._staff_session_cache:
-            sess = StaffSession.objects.filter(
+            qs = StaffSession.objects.filter(
-                user=self, date_end__isnull=True, session_key=session_key
+                user=self, date_end__isnull=True
-            ).first()
+            )
            if session_key:
                qs = qs.filter(session_key=session_key)
            sess = qs.first()
            if sess:
                if sess.date_start < now() - timedelta(seconds=settings.PRETIX_SESSION_TIMEOUT_ABSOLUTE):
                    sess.date_end = now()
@@ -40,7 +40,6 @@ import warnings
 from collections import Counter, OrderedDict, defaultdict
 from datetime import datetime, time, timedelta
 from operator import attrgetter
 from typing import TYPE_CHECKING
 from urllib.parse import urljoin
 from zoneinfo import ZoneInfo
@@ -80,16 +79,10 @@ from pretix.helpers.thumb import get_thumbnail
 from ..settings import settings_hierarkey
 from .organizer import Organizer, Team
 if TYPE_CHECKING:
    from hierarkey.proxy import HierarkeyProxy
 logger = logging.getLogger(__name__)
 class EventMixin:
    if TYPE_CHECKING:
        settings: HierarkeyProxy
    def clean(self):
        if self.presale_start and self.presale_end and self.presale_start > self.presale_end:
            raise ValidationError({'presale_end': _('The end of the presale period has to be later than its start.')})
@@ -906,7 +899,7 @@ class Event(EventMixin, LoggedModel):
        self.save()
        self.log_action('pretix.object.cloned', data={'source': other.slug, 'source_id': other.pk})
-        if hasattr(other, 'alternative_domain_assignment') and not is_cross_organizer:
+        if hasattr(other, 'alternative_domain_assignment'):
            other.alternative_domain_assignment.domain.event_assignments.create(event=self)
        if not self.all_sales_channels:
@@ -35,7 +35,6 @@ import operator
 import string
 from datetime import date, datetime, time
 from functools import reduce
 from typing import TYPE_CHECKING
 import pytz_deprecation_shim
 from django.conf import settings
@@ -62,9 +61,6 @@ from ...helpers.permission_migration import (
 from ..settings import settings_hierarkey
 from .auth import User
 if TYPE_CHECKING:
    from hierarkey.proxy import HierarkeyProxy
@settings_hierarkey.add(cache_namespace='organizer')
 class Organizer(LoggedModel):
@@ -82,9 +78,6 @@ class Organizer(LoggedModel):
    """
    settings_namespace = 'organizer'
    if TYPE_CHECKING:
        settings: HierarkeyProxy
    name = models.CharField(max_length=200,
                            verbose_name=_("Name"))
    slug = models.CharField(
@@ -1924,6 +1924,8 @@ DEFAULTS = {
        'serializer_class': serializers.BooleanField,
        'form_kwargs': dict(
            label=_("Hide all past dates from calendar"),
            help_text=_("This option currently only affects the calendar of this event series, not the organizer-wide "
                        "calendar.")
        )
    },
    'allow_modifications': {
@@ -1,28 +0,0 @@
 {% extends "error.html" %}
 {% load i18n %}
 {% load eventurl %}
 {% load urlreplace %}
 {% load static %}
 {% block content %}
    <h1>{% trans "Please continue in a new tab" %}</h1>
    <p class="larger">
        {% blocktrans trimmed %}
            For security reasons, the following step is only possible in a new tab.
        {% endblocktrans %}
    </p>
    <p class="larger">
        {% blocktrans trimmed %}
            If the new tab did not open automatically, please click the following button:
        {% endblocktrans %}
    </p>
    <div class="text-center">
        <a href="{{ url }}"
           class="btn btn-primary btn-lg" target="_blank">
            <span class="fa fa-external-link-square"></span>
            {% trans "Continue in new tab" %}
        </a>
        {{ url|json_script:"framebreak-url" }}
        <script type="text/javascript" src="{% static "pretixbase/js/framebreak.js" %}"></script>
    </div>
 {% endblock %}
@@ -42,6 +42,8 @@ from bleach import DEFAULT_CALLBACKS, html5lib_shim
 from bleach.linkifier import build_email_re
 from django import template
 from django.conf import settings
 from django.core import signing
 from django.urls import reverse
 from django.utils.functional import SimpleLazyObject
 from django.utils.html import escape
 from django.utils.http import url_has_allowed_host_and_scheme
@@ -52,7 +54,6 @@ from markdown.postprocessors import Postprocessor
 from markdown.treeprocessors import UnescapeTreeprocessor
 from tlds import tld_set
 from pretix.base.views.redirect import safelink
 from pretix.helpers.format import SafeFormatter, format_map
 register = template.Library()
@@ -157,7 +158,8 @@ def safelink_callback(attrs, new=False):
    """
    url = html.unescape(attrs.get((None, 'href'), '/'))
    if not url_has_allowed_host_and_scheme(url, allowed_hosts=None) and not url.startswith('mailto:') and not url.startswith('tel:'):
-        attrs[None, 'href'] = safelink(url)
+        signer = signing.Signer(salt='safe-redirect')
        attrs[None, 'href'] = reverse('redirect') + '?url=' + urllib.parse.quote(signer.sign(url))
        attrs[None, 'target'] = '_blank'
        attrs[None, 'rel'] = 'noopener'
    return attrs
@@ -19,7 +19,6 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
 import logging
 import urllib.parse
 from django.core import signing
@@ -27,8 +26,6 @@ from django.http import HttpResponseBadRequest, HttpResponseRedirect
 from django.shortcuts import render
 from django.urls import reverse
 logger = logging.getLogger(__name__)
 def _is_samesite_referer(request):
    referer = request.headers.get('referer')
@@ -45,16 +42,11 @@ def _is_samesite_referer(request):
 def redir_view(request):
-    framebreak = "framebreak" in request.GET
+    signer = signing.Signer(salt='safe-redirect')
    salt = 'framebreak-safelink-url' if framebreak else 'safelink-url'
    try:
-        url = signing.Signer(salt=salt).unsign(request.GET.get('url', ''))
+        url = signer.unsign(request.GET.get('url', ''))
    except signing.BadSignature:
-        try:
+        return HttpResponseBadRequest('Invalid parameter')
            # Backwards-compatibility for a change in 2026-06, remove after a while
            url = signing.Signer(salt='safe-redirect').unsign(request.GET.get('url', ''))
        except signing.BadSignature:
            return HttpResponseBadRequest('Invalid parameter')
    if not _is_samesite_referer(request):
        u = urllib.parse.urlparse(url)
@@ -63,26 +55,11 @@ def redir_view(request):
            'url': url,
        })
    if framebreak:
        r = render(request, 'pretixbase/framebreak.html', {
            'url': url,
        })
        r.xframe_options_exempt = True
        return r
    r = HttpResponseRedirect(url)
    r['X-Robots-Tag'] = 'noindex'
    return r
-def safelink(url, framebreak=False):
+def safelink(url):
-    url = str(url)
+    signer = signing.Signer(salt='safe-redirect')
-    if not (url.startswith('https://') or url.startswith('http://') or url.startswith("/")):
+    return reverse('redirect') + '?url=' + urllib.parse.quote(signer.sign(url))
        logger.warning('Invalid URL passed to safelink: %r', url)
        return '#invalid-url'
    salt = 'framebreak-safelink-url' if framebreak else 'safelink-url'
    signer = signing.Signer(salt=salt)
    u = reverse('redirect') + '?url=' + urllib.parse.quote(signer.sign(url))
    if framebreak:
        u += "&framebreak=true"
    return u
@@ -1673,7 +1673,7 @@ class CountriesAndEUAndStates(CountriesAndEU):
 class TaxRuleLineForm(I18nForm):
    country = LazyTypedChoiceField(
-        choices=CountriesAndEUAndStates(),
+        choices=lazy(lambda: CountriesAndEUAndStates(), CountriesAndEUAndStates),
        required=False
    )
    address_type = forms.ChoiceField(
@@ -36,7 +36,6 @@ from urllib.parse import quote, urljoin, urlparse
 from django.conf import settings
 from django.contrib.auth import REDIRECT_FIELD_NAME, logout
 from django.contrib.auth.views import redirect_to_login
 from django.http import Http404
 from django.shortcuts import get_object_or_404, resolve_url
 from django.template.response import TemplateResponse
@@ -213,17 +212,14 @@ class AuditLogMiddleware:
        if request.path.startswith(get_script_prefix() + 'control') and request.user.is_authenticated:
            if getattr(request.user, "is_hijacked", False):
                hijack_history = request.session.get('hijack_history', False)
-                hijacker = get_object_or_404(User, pk=hijack_history[0]["user"])
+                hijacker = get_object_or_404(User, pk=hijack_history[0])
                ss = hijacker.get_active_staff_session(request.session.get('hijacker_session'))
-                if not ss:
+                if ss:
-                    # Staff session expired or not found
+                    ss.logs.create(
-                    logout(request)
+                        url=request.path,
-                    return redirect_to_login(request.get_full_path())
+                        method=request.method,
-                ss.logs.create(
+                        impersonating=request.user
-                    url=request.path,
+                    )
                    method=request.method,
                    impersonating=request.user
                )
            else:
                ss = request.user.get_active_staff_session(request.session.session_key)
                if ss:
@@ -19,23 +19,19 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
 import hmac
 import json
 from contextlib import contextmanager
 from django.conf import settings
 from django.contrib import messages
 from django.contrib.auth import (
-    BACKEND_SESSION_KEY, HASH_SESSION_KEY, get_user_model, load_backend, login,
+    BACKEND_SESSION_KEY, get_user_model, load_backend, login,
    logout,
 )
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.auth.views import redirect_to_login
 from django.core.exceptions import PermissionDenied
 from django.db import transaction
 from django.shortcuts import get_object_or_404, redirect
 from django.urls import reverse
-from django.utils.crypto import get_random_string, salted_hmac
+from django.utils.crypto import get_random_string
 from django.utils.functional import cached_property
 from django.utils.translation import gettext_lazy as _
 from django.views import View
@@ -222,13 +218,11 @@ class UserImpersonateView(AdministratorPermissionRequiredMixin, RecentAuthentica
    def post(self, request, *args, **kwargs):
        self.object = get_object_or_404(User, pk=self.kwargs.get("id"))
        staff_session = request.user.get_active_staff_session(request.session.session_key)
        self.request.user.log_action('pretix.control.auth.user.impersonated',
                                     user=request.user,
                                     data={
                                         'other': self.kwargs.get("id"),
-                                         'other_email': self.object.email,
+                                         'other_email': self.object.email
                                         'staff_session': staff_session.pk,
                                     })
        oldkey = request.session.session_key
@@ -236,15 +230,7 @@ class UserImpersonateView(AdministratorPermissionRequiredMixin, RecentAuthentica
        hijacked = self.object
        hijack_history = request.session.get("hijack_history", [])
-        hijack_history.append({
+        hijack_history.append(request.user._meta.pk.value_to_string(hijacker))
            "user": request.user.pk,
            # We include the auth_hash, because it is unguessable. So should an attacker gain an attack vector to
            # modify hijack_history, they can't just insert or change a user that shouldn't be there. We HMAC it
            # again, though, since we also do not want the auth_hash of the admin user to be in the session of an
            # unprivileged user to contain the risk if there is some leak of session data.
            "auth_hash": salted_hmac(key_salt=b"hijack-history-hash", value=request.session[HASH_SESSION_KEY],
                                     algorithm="sha256", secret=settings.SECRET_KEY).hexdigest(),
        })
        backend = get_used_backend(request)
        backend = f"{backend.__module__}.{backend.__class__.__name__}"
@@ -252,12 +238,6 @@ class UserImpersonateView(AdministratorPermissionRequiredMixin, RecentAuthentica
        with signals.no_update_last_login(), keep_session_age(request.session):
            login(request, hijacked, backend=backend)
        request.session.save()
        staff_session.logs.create(
            method='(NOTE)',
            url=f'Begin impersonating user #{hijacked.pk} (request session {oldkey[:8]} -> {request.session.session_key[:8]})',
        )
        request.session["hijack_history"] = hijack_history
        signals.hijack_started.send(
@@ -274,28 +254,13 @@ class UserImpersonateView(AdministratorPermissionRequiredMixin, RecentAuthentica
 class UserImpersonateStopView(LoginRequiredMixin, View):
    def post(self, request, *args, **kwargs):
-        staff_session_key = request.session['hijacker_session']
+        impersonated = request.user
-        prev_session_key = request.session.session_key
+
        hijs = request.session['hijacker_session']
        hijack_history = request.session.get("hijack_history", [])
        hijacked = request.user
-        prev_session = hijack_history.pop()
+        user_pk = hijack_history.pop()
-        hijacker = get_object_or_404(get_user_model(), pk=prev_session["user"])
+        hijacker = get_object_or_404(get_user_model(), pk=user_pk)
        staff_session = hijacker.get_active_staff_session(staff_session_key)
        if not staff_session:
            raise PermissionDenied
        expected_hash = salted_hmac(
            key_salt=b"hijack-history-hash",
            value=hijacker.get_session_auth_hash(),
            algorithm="sha256",
            secret=settings.SECRET_KEY
        ).hexdigest()
        if not hmac.compare_digest(expected_hash, prev_session["auth_hash"]):
            # Could be an attacker-controlled hijack history, but could also be e.g. a password change of the admin user
            # that happened during the hijack session
            logout(request)
            return redirect_to_login(request.get_full_path())
        backend = get_used_backend(request)
        backend = f"{backend.__module__}.{backend.__class__.__name__}"
        with signals.no_update_last_login(), keep_session_age(request.session):
@@ -310,22 +275,17 @@ class UserImpersonateStopView(LoginRequiredMixin, View):
            hijacked=hijacked,
        )
-        request.session.save()
+        ss = request.user.get_active_staff_session(hijs)
-        staff_session.session_key = request.session.session_key
+        if ss:
-        staff_session.save()
+            request.session.save()
-
+            ss.session_key = request.session.session_key
-        staff_session.logs.create(
+            ss.save()
            method='(NOTE)',
            url=f'Stop impersonating user #{hijacked.pk} (request session {prev_session_key[:8]}, '
                f'staff session {staff_session_key[:8]} -> {request.session.session_key[:8]})',
        )
        request.user.log_action('pretix.control.auth.user.impersonate_stopped',
                                user=request.user,
                                data={
-                                    'other': hijacked.pk,
+                                    'other': impersonated.pk,
-                                    'other_email': hijacked.email,
+                                    'other_email': impersonated.email
                                    'staff_session': staff_session.pk,
                                })
        return redirect(reverse('control:index'))
@@ -46,13 +46,6 @@ class RequestIdFilter(logging.Filter):
        return True
 class SkipNotFoundFilter(logging.Filter):
    # Drop the WARNING "Not Found: ..." records django.request emits for 404s
    # We have different access logs for that
    def filter(self, record):
        return getattr(record, 'status_code', None) != 404
 class RequestIdMiddleware:
    def __init__(self, get_response):
        self.get_response = get_response
@@ -5,8 +5,8 @@ msgstr ""
 "Project-Id-Version: 1\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-06-28 14:42+0000\n"
-"PO-Revision-Date: 2026-06-29 17:00+0000\n"
+"PO-Revision-Date: 2026-06-28 15:19+0000\n"
-"Last-Translator: CVZ-es <damien.bremont@casadevelazquez.org>\n"
+"Last-Translator: Raphael Michel <michel@rami.io>\n"
 "Language-Team: German <https://translate.pretix.eu/projects/pretix/pretix/"
 "de/>\n"
 "Language: de\n"
@@ -8,7 +8,7 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-06-28 14:42+0000\n"
-"PO-Revision-Date: 2026-06-29 17:00+0000\n"
+"PO-Revision-Date: 2026-05-29 17:00+0000\n"
 "Last-Translator: CVZ-es <damien.bremont@casadevelazquez.org>\n"
 "Language-Team: Spanish <https://translate.pretix.eu/projects/pretix/pretix/"
 "es/>\n"
@@ -17,7 +17,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 2026.6.1\n"
+"X-Generator: Weblate 2026.5\n"
 #: htmlcov/d_daa1541d0cbf5e2b_dashboards_py.html:670
 #: pretix/control/templates/pretixcontrol/events/index.html:166
@@ -467,8 +467,10 @@ msgid "Medium connected to other event"
 msgstr "Medio conectado a otro evento"
 #: pretix/api/views/checkin.py:814
 #, fuzzy
 #| msgid "You cannot change this order."
 msgid "You cannot exchange a medium for a medium."
-msgstr "No se puede cambiar un medio por otro."
+msgstr "No puedes cambiar este pedido."
 #: pretix/api/views/oauth.py:107 pretix/control/logdisplay.py:777
 #, python-brace-format
@@ -4728,16 +4730,22 @@ msgid "Check-in annulled"
 msgstr "Check-in anulado"
 #: pretix/base/models/checkin.py:372
 #, fuzzy
 #| msgid "Ticket already used"
 msgid "Ticket already exchanged"
-msgstr "Entrada ya canjeada"
+msgstr "Esta entrada ya fue utilizada"
 #: pretix/base/models/checkin.py:373
 #, fuzzy
 #| msgid "Reusable media"
 msgid "Reusable medium invalid"
-msgstr "Soporte reutilizable no válido"
+msgstr "Medios reutilizables"
 #: pretix/base/models/checkin.py:374
 #, fuzzy
 #| msgid "Reusable media type"
 msgid "Reusable medium already exists"
-msgstr "El soporte reutilizable ya existe"
+msgstr "Tipo de medio reusable"
 #: pretix/base/models/customers.py:63
 msgid "Provider name"
@@ -5322,8 +5330,11 @@ msgstr ""
 "ambas cosas."
 #: pretix/base/models/event.py:1884
 #, fuzzy
 #| msgid "The bundled item must belong to the same event as the item."
 msgid "Property and event must belong to the same organizer."
-msgstr "La propiedad y el evento deben pertenecer al mismo organizador."
+msgstr ""
 "La agrupación de artículos debe pertenecer al mismo evento que el artículo."
 #: pretix/base/models/event.py:1928 pretix/base/models/organizer.py:627
 msgid "Link text"
@@ -5575,41 +5586,42 @@ msgid "Show product with info on why it’s unavailable"
 msgstr "Mostrar el producto con la razón que no está disponible"
 #: pretix/base/models/items.py:458 pretix/base/models/items.py:786
 #, fuzzy
 #| msgid "Don't use re-usable media, use regular one-off tickets"
 msgid "Don't use reusable media, use regular one-off tickets"
-msgstr ""
+msgstr "No usar medios reutilizables, usar entradas de un solo uso"
 "No utilizar soportes reutilizables, sino billetes normales de un solo uso"
 #: pretix/base/models/items.py:459
 msgid "Require a previously unknown medium to be newly added"
 msgstr "Exigir que un medio desconocido anteriormente se adicione de nuevo"
 #: pretix/base/models/items.py:460
 #, fuzzy
 #| msgid "Require an existing medium to be re-used"
 msgid "Require an existing medium to be reused, replacing any previous tickets"
-msgstr ""
+msgstr "Exigir que se reuse un medio ya existente"
 "Necesita que se reutilice un soporte ya existente, sustituyendo cualquier "
 "billete anterior"
 #: pretix/base/models/items.py:461
 #, fuzzy
 #| msgid "Require either an existing or a new medium to be used"
 msgid ""
 "Require either an existing or a new medium to be used, replacing any "
 "previous tickets"
-msgstr ""
+msgstr "Exigir que se use un medio existente o uno nuevo"
 "Se debe utilizar un soporte ya existente o uno nuevo, sustituyendo cualquier "
 "billete anterior"
 #: pretix/base/models/items.py:462
 #, fuzzy
 #| msgid "Require an existing medium to be re-used"
 msgid "Require an existing medium to be reused, adding to any previous tickets"
-msgstr ""
+msgstr "Exigir que se reuse un medio ya existente"
 "Exigir que se reutilice un soporte ya existente, añadiendo esta información "
 "a cualquier entrada anterior"
 #: pretix/base/models/items.py:464
 #, fuzzy
 #| msgid "Require either an existing or a new medium to be used"
 msgid ""
 "Require either an existing or a new medium to be used, adding to any "
 "previous tickets"
-msgstr ""
+msgstr "Exigir que se use un medio existente o uno nuevo"
 "Es necesario utilizar un medio ya existente o uno nuevo, que se sumará a los "
 "billetes anteriores"
 #: pretix/base/models/items.py:480 pretix/base/models/items.py:1468
 msgid "Category"
@@ -5969,6 +5981,14 @@ msgid "Reusable media policy"
 msgstr "Condiciones de utilización de medios"
 #: pretix/base/models/items.py:777
 #, fuzzy
 #| msgid ""
 #| "If this product should be stored on a re-usable physical medium, you can "
 #| "attach a physical media policy. This is not required for regular tickets, "
 #| "which just use a one-time barcode, but only for products like renewable "
 #| "season tickets or re-chargeable gift card wristbands. This is an advanced "
 #| "feature that also requires specific configuration of ticketing and "
 #| "printing settings."
 msgid ""
 "If this product should be stored on a reusable physical medium, you can "
 "attach a physical media policy. This is not required for regular tickets, "
@@ -6032,9 +6052,6 @@ msgid ""
 "prior to their usage. Therefore, the selected media policy does not make "
 "sense for this media type."
 msgstr ""
 "El tipo de soporte seleccionado requiere que todos los soportes se registren "
 "en el sistema antes de su uso. Por lo tanto, la política de soportes "
 "seleccionada no es aplicable a este tipo de soporte."
 #: pretix/base/models/items.py:1009
 msgid ""
@@ -6609,16 +6626,18 @@ msgstr "rebotado"
 #: pretix/base/models/media.py:77
 msgctxt "reusable_medium"
 msgid "Claim token"
-msgstr "Canjear el token"
+msgstr ""
 #: pretix/base/models/media.py:82
 msgctxt "reusable_medium"
 msgid "Label"
-msgstr "Designación"
+msgstr ""
 #: pretix/base/models/media.py:105
 #, fuzzy
 #| msgid "Linked ticket"
 msgid "Linked tickets"
-msgstr "Entradas vinculadas"
+msgstr "Entrada vinculada"
 #: pretix/base/models/media.py:107
 msgid ""
@@ -6626,9 +6645,6 @@ msgid ""
 "validity. If multiple tickets are valid at once, this will lead to failed "
 "check-ins."
 msgstr ""
 "Si enlaza más de un billete, asegúrese de que no haya solapamiento en la "
 "validez. Si varios billetes son válidos al mismo tiempo, esto provocará que "
 "no se puedan realizar el check-in."
 #: pretix/base/models/memberships.py:44
 #: pretix/presale/templates/pretixpresale/organizers/customer_memberships.html:28
@@ -8374,10 +8390,14 @@ msgid "Atlantis"
 msgstr "Atlántida"
 #: pretix/base/pdf.py:376
 #, fuzzy
 #| msgid "Invoice recipient email"
 msgid "Invoice custom recipient field"
-msgstr "Campo personalizado de destinatario en la factura"
+msgstr "Correo electrónico del destinatario de la factura"
 #: pretix/base/pdf.py:377
 #, fuzzy
 #| msgid "Custom recipient field label"
 msgid "Custom recipient field"
 msgstr "Campo de destinatario personalizado"
@@ -9395,15 +9415,13 @@ msgstr "Necesitas responder preguntas para terminar el check-in."
 #: pretix/base/services/checkin.py:1121
 msgid "Ticket needs to be exchanged to a suitable medium."
-msgstr "El billete debe canjearse por un soporte adecuado."
+msgstr ""
 #: pretix/base/services/checkin.py:1128
 msgid ""
 "This ticket has already been exchanged for a reusable medium that now needs "
 "to be used instead."
 msgstr ""
 "Esta entrada ya se ha canjeado por un soporte reutilizable que ahora hay que "
 "utilizar en su lugar."
 #: pretix/base/services/checkin.py:1180
 msgid "This ticket has already been redeemed."
@@ -9569,46 +9587,64 @@ msgstr ""
 "{event}."
 #: pretix/base/services/media.py:93 pretix/base/services/media.py:95
 #, fuzzy
 #| msgid "Invalid input type."
 msgid "Invalid medium type."
-msgstr "Tipo de soporte no válido."
+msgstr "Tipo de entrada no válido."
 #: pretix/base/services/media.py:100 pretix/base/services/media.py:102
 #, fuzzy
 #| msgid "The selected media type is not enabled in your organizer settings."
 msgid "Medium type is not enabled for organizer."
-msgstr "Este tipo de medio no está habilitado para el organizador."
+msgstr ""
 "El tipo de medio seleccionado no está activo en tus ajustes de organizador/a/"
 "e."
 #: pretix/base/services/media.py:107 pretix/base/services/media.py:109
 msgid "Incorrect medium type for product."
-msgstr "El tipo de soporte no es el adecuado para este producto."
+msgstr ""
 #: pretix/base/services/media.py:114 pretix/base/services/media.py:116
 #, fuzzy
 #| msgid "This ticket has already been redeemed."
 msgid "Ticket is already exchanged for reusable medium."
-msgstr "La entrada ya se ha canjeado por un soporte reutilizable."
+msgstr "Esta entrada ya ha sido canjeada."
 #: pretix/base/services/media.py:133 pretix/base/services/media.py:135
 #, fuzzy
 #| msgid "Reusable Medium ID"
 msgid "Reusable medium not found."
-msgstr "No se ha encontrado el soporte reutilizable."
+msgstr "ID mediana reutilizable"
 #: pretix/base/services/media.py:140 pretix/base/services/media.py:142
 #: pretix/base/services/media.py:168 pretix/base/services/media.py:170
 #, fuzzy
 #| msgid "The reusable medium has been created."
 msgid "Reusable medium is inactive or expired."
-msgstr "El medio reutilizable está inactivo o caducado."
+msgstr "Se ha creado el medio reutilizable."
 #: pretix/base/services/media.py:155 pretix/base/services/media.py:162
 #: pretix/base/services/media.py:176
 #, fuzzy
 #| msgid "The reusable medium has been created."
 msgid "Reusable medium not found and could not be created."
-msgstr "No se ha encontrado el soporte reutilizable y no se ha podido crear."
+msgstr "Se ha creado el medio reutilizable."
 #: pretix/base/services/media.py:183
 #, fuzzy
 #| msgid "Reusable media type"
 msgid "Reusable medium already exists."
-msgstr "Ya existe un soporte reutilizable."
+msgstr "Tipo de medio reusable"
 #: pretix/base/services/media.py:189
 #, fuzzy
 #| msgid "The reusable medium has been created."
 msgid "Reusable medium could not be created."
-msgstr "No se ha podido crear el soporte reutilizable."
+msgstr "Se ha creado el medio reutilizable."
 #: pretix/base/services/media.py:195 pretix/base/services/media.py:197
 msgid "Product does not support medium exchange."
-msgstr "Este producto no admite el cambio de medio."
+msgstr ""
 #: pretix/base/services/memberships.py:108
 #, python-brace-format
@@ -10332,10 +10368,17 @@ msgstr ""
 "inició sesión durante la compra."
 #: pretix/base/settings.py:214
 #, fuzzy
 #| msgid "Activate re-usable media"
 msgid "Activate reusable media"
 msgstr "Activar medios reutilizables"
 #: pretix/base/settings.py:215
 #, fuzzy
 #| msgid ""
 #| "The re-usable media feature allows you to connect tickets and gift cards "
 #| "with physical media such as wristbands or chip cards that may be re-used "
 #| "for different tickets or gift cards later."
 msgid ""
 "The reusable media feature allows you to connect tickets and gift cards with "
 "physical media such as wristbands or chip cards that may be reused for "
@@ -10347,7 +10390,7 @@ msgstr ""
 #: pretix/base/settings.py:226
 msgid "Enforce the usage of issued reusable media for check-in"
-msgstr "Exigir el uso de los soportes reutilizables para el check-in"
+msgstr ""
 #: pretix/base/settings.py:227
 msgid ""
@@ -10355,10 +10398,6 @@ msgid ""
 "medium has been created and linked to a ticket. Keeping this option turned "
 "off will treat the reusable medium and ticket as equals."
 msgstr ""
 "Si se activa esta opción, ya no se aceptarán los códigos de barras de los "
 "billetes cuando se haya creado un soporte reutilizable y se haya vinculado a "
 "un billete. Si se mantiene desactivada esta opción, el soporte reutilizable "
 "y el billete se tratarán como iguales."
 #: pretix/base/settings.py:254
 msgid "Length of barcodes"
@@ -18509,12 +18548,16 @@ msgid "The reusable medium has been changed."
 msgstr "El medio reutilizable ha sido modificado."
 #: pretix/control/logdisplay.py:746
 #, fuzzy
 #| msgid "The new member has been added to the team."
 msgid "A new ticket has been added to the medium."
-msgstr "Se ha añadido un nuevo billete al medio."
+msgstr "El nuevo miembro ha sido añadido al equipo."
 #: pretix/control/logdisplay.py:747
 #, fuzzy
 #| msgid "{user} has been removed from the team."
 msgid "A ticket has been removed from the medium."
-msgstr "Se ha eliminado un billete del medio."
+msgstr "{user} ha sido removido del equipo."
 #: pretix/control/logdisplay.py:748
 msgid "The medium has been connected to a new ticket."
@@ -18526,8 +18569,6 @@ msgid ""
 "The ticket #{positionid} was exchanged for reusable medium "
 "{medium_identifier}."
 msgstr ""
 "El billete n.º {positionid} se ha canjeado por un medio reutilizable "
 "{medium_identifier}."
 #: pretix/control/logdisplay.py:750
 msgid "The medium has been connected to a new gift card."
@@ -20442,8 +20483,10 @@ msgstr ""
 "check-in:"
 #: pretix/control/templates/pretixcontrol/checkin/simulator.html:85
 #, fuzzy
 #| msgid "Special attention required"
 msgid "Media exchange required"
-msgstr "Es necesario intercambiar medios"
+msgstr "Atención especial requerida"
 #: pretix/control/templates/pretixcontrol/checkin/simulator.html:87
 #, python-format
@@ -20451,8 +20494,6 @@ msgid ""
 "This ticket needs to be exchanged into a <strong>%(media_type)s</strong> "
 "reusable medium. <strong>%(media_policy)s</strong>."
 msgstr ""
 "Esta entrada debe canjearse por un soporte reutilizable <strong>%(media_type)"
 "s</strong>. <strong>%(media_policy)s</strong>."
 #: pretix/control/templates/pretixcontrol/checkin/simulator.html:103
 msgid "Special attention required"
@@ -26997,9 +27038,6 @@ msgid ""
 "Even if a team has no access to a certain category of data, they might still "
 "be able to see parts of this data when it is linked to data they can see."
 msgstr ""
 "Aunque un equipo no tenga acceso a una determinada categoría de datos, es "
 "posible que pueda ver parte de esos datos cuando estén vinculados a datos a "
 "los que sí tiene acceso."
 #: pretix/control/templates/pretixcontrol/organizers/team_edit.html:35
 msgid ""
@@ -27007,10 +27045,6 @@ msgid ""
 "some information about gift cards linked to a customer account, even if they "
 "generally can't see gift cards directly."
 msgstr ""
 "Por ejemplo, una persona con acceso a las cuentas de los clientes podrá ver "
 "cierta información sobre las tarjetas regalo vinculadas a una cuenta de "
 "cliente, aunque, por lo general, no pueda ver las tarjetas regalo "
 "directamente."
 #: pretix/control/templates/pretixcontrol/organizers/team_edit.html:59
 msgid ""
@@ -27018,9 +27052,6 @@ msgid ""
 "information about vouchers used to create an order, even if they generally "
 "can't see vouchers directly."
 msgstr ""
 "Por ejemplo, una persona con acceso a los pedidos podrá ver cierta "
 "información sobre los vales utilizados para crear un pedido, aunque "
 "normalmente no pueda ver los vales directamente."
 #: pretix/control/templates/pretixcontrol/organizers/team_members.html:21
 msgid "Member"
@@ -27881,22 +27912,30 @@ msgstr ""
 #: pretix/control/templates/pretixcontrol/subevents/detail.html:9
 #: pretix/control/templates/pretixcontrol/subevents/detail.html:13
-#, python-format
+#, fuzzy, python-format
 #| msgid "Quota: %(name)s"
 msgctxt "subevent"
 msgid "Date: %(name)s"
-msgstr "Fecha: %(name)s"
+msgstr "Cuota: %(name)s"
 #: pretix/control/templates/pretixcontrol/subevents/detail.html:234
 #, fuzzy
 #| msgid "Partially paid"
 msgid "partially canceled"
-msgstr "cancelado parcialmente"
+msgstr "Pagado parcialmente"
 #: pretix/control/templates/pretixcontrol/subevents/detail.html:282
 #, fuzzy
 #| msgctxt "permission_level"
 #| msgid "View all"
 msgid "View all"
 msgstr "Ver todo"
 #: pretix/control/templates/pretixcontrol/subevents/detail.html:289
 #, fuzzy
 #| msgid "No archived events found."
 msgid "No orders found."
-msgstr "No se han encontrado pedidos."
+msgstr "No se han encontrado eventos archivados."
 #: pretix/control/templates/pretixcontrol/subevents/detail.html:302
 #: pretix/control/templates/pretixcontrol/subevents/edit.html:279
@@ -30669,8 +30708,10 @@ msgid "Voucher {}"
 msgstr "Vale de compra {}"
 #: pretix/control/views/typeahead.py:179 pretix/control/views/typeahead.py:180
 #, fuzzy
 #| msgid "Go to event"
 msgid "No event"
-msgstr "No hay eventos"
+msgstr "Ir al evento"
 #: pretix/control/views/user.py:169
 msgid "The password you entered was invalid, please try again."
@@ -8,7 +8,7 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-06-28 15:49+0000\n"
-"PO-Revision-Date: 2026-06-29 17:00+0000\n"
+"PO-Revision-Date: 2026-03-30 03:00+0000\n"
 "Last-Translator: CVZ-es <damien.bremont@casadevelazquez.org>\n"
 "Language-Team: Spanish <https://translate.pretix.eu/projects/pretix/pretix-"
 "js/es/>\n"
@@ -17,7 +17,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 2026.6.1\n"
+"X-Generator: Weblate 5.16.2\n"
 #: pretix/plugins/banktransfer/static/pretixplugins/banktransfer/ui.js:56
 #: pretix/plugins/banktransfer/static/pretixplugins/banktransfer/ui.js:62
@@ -442,11 +442,11 @@ msgstr "¡Presione Control+C para copiar!"
 #: pretix/static/pretixcontrol/js/ui/checkinrules/App.vue:80
 msgid "Edit"
-msgstr "Editar"
+msgstr ""
 #: pretix/static/pretixcontrol/js/ui/checkinrules/App.vue:86
 msgid "Visualize"
-msgstr "Visualizar"
+msgstr ""
 #: pretix/static/pretixcontrol/js/ui/checkinrules/App.vue:96
 msgid ""
@@ -454,13 +454,10 @@ msgid ""
 "or variations are not contained in any of your rule parts so people with "
 "these tickets will not get in:"
 msgstr ""
 "Su regla siempre filtra por producto o variante, pero los siguientes "
 "productos o variantes no figuran en ninguna de las partes de su regla, por "
 "lo que las personas con estos tickets no podrán acceder:"
 #: pretix/static/pretixcontrol/js/ui/checkinrules/App.vue:99
 msgid "Please double-check if this was intentional."
-msgstr "Por favor, comprueba bien si esto ha sido a propósito."
+msgstr ""
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts:4
 msgid "All of the conditions below (AND)"
@@ -4,10 +4,10 @@ msgstr ""
 "Project-Id-Version: 1\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-06-28 14:42+0000\n"
-"PO-Revision-Date: 2026-06-29 17:00+0000\n"
+"PO-Revision-Date: 2026-06-08 17:00+0000\n"
-"Last-Translator: CVZ-es <damien.bremont@casadevelazquez.org>\n"
+"Last-Translator: Sébastien BRUNEAU <s.bruneau@beauvaisis.fr>\n"
-"Language-Team: French <https://translate.pretix.eu/projects/pretix/pretix/"
+"Language-Team: French <https://translate.pretix.eu/projects/pretix/pretix/fr/"
-"fr/>\n"
+">\n"
 "Language: fr\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
@@ -466,8 +466,10 @@ msgid "Medium connected to other event"
 msgstr "Média connecté à un autre événement"
 #: pretix/api/views/checkin.py:814
 #, fuzzy
 #| msgid "You cannot change this order."
 msgid "You cannot exchange a medium for a medium."
-msgstr "Il n'est pas possible d'échanger un support contre un autre support."
+msgstr "Vous ne pouvez pas modifier cette commande."
 #: pretix/api/views/oauth.py:107 pretix/control/logdisplay.py:777
 #, python-brace-format
@@ -4734,16 +4736,22 @@ msgid "Check-in annulled"
 msgstr "Enregistrement annulé"
 #: pretix/base/models/checkin.py:372
 #, fuzzy
 #| msgid "Ticket already used"
 msgid "Ticket already exchanged"
-msgstr "Billet déjà échangé"
+msgstr "Billet déjà utilisé"
 #: pretix/base/models/checkin.py:373
 #, fuzzy
 #| msgid "Reusable media"
 msgid "Reusable medium invalid"
-msgstr "Support réutilisable non valide"
+msgstr "Support réutilisable"
 #: pretix/base/models/checkin.py:374
 #, fuzzy
 #| msgid "Reusable media type"
 msgid "Reusable medium already exists"
-msgstr "Il existe déjà un support réutilisable"
+msgstr "Type de support réutilisable"
 #: pretix/base/models/customers.py:63
 msgid "Provider name"
@@ -5335,8 +5343,10 @@ msgstr ""
 "deux."
 #: pretix/base/models/event.py:1884
 #, fuzzy
 #| msgid "The bundled item must belong to the same event as the item."
 msgid "Property and event must belong to the same organizer."
-msgstr "La propriété et l'événement doivent appartenir au même organisateur."
+msgstr "L’élément groupé doit appartenir au même événement que l’élément."
 #: pretix/base/models/event.py:1928 pretix/base/models/organizer.py:627
 msgid "Link text"
@@ -5591,6 +5601,8 @@ msgstr ""
 "indisponibilité"
 #: pretix/base/models/items.py:458 pretix/base/models/items.py:786
 #, fuzzy
 #| msgid "Don't use re-usable media, use regular one-off tickets"
 msgid "Don't use reusable media, use regular one-off tickets"
 msgstr ""
 "N'utilisez pas de supports réutilisables, mais plutôt des tickets uniques "
@@ -5601,30 +5613,32 @@ msgid "Require a previously unknown medium to be newly added"
 msgstr "Exiger l'ajout d'un support inconnu jusqu'alors"
 #: pretix/base/models/items.py:460
 #, fuzzy
 #| msgid "Require an existing medium to be re-used"
 msgid "Require an existing medium to be reused, replacing any previous tickets"
 msgstr "Exiger la réutilisation d'un support existant"
 #: pretix/base/models/items.py:461
 #, fuzzy
 #| msgid "Require either an existing or a new medium to be used"
 msgid ""
 "Require either an existing or a new medium to be used, replacing any "
 "previous tickets"
-msgstr ""
+msgstr "Nécessiter l'utilisation d'un support existant ou d'un nouveau support"
 "Exiger l'utilisation d'un support existant ou d'un nouveau support, en "
 "remplacement de tout billet antérieur"
 #: pretix/base/models/items.py:462
 #, fuzzy
 #| msgid "Require an existing medium to be re-used"
 msgid "Require an existing medium to be reused, adding to any previous tickets"
-msgstr ""
+msgstr "Exiger la réutilisation d'un support existant"
 "Exiger la réutilisation d'un support existant, en ajoutant cette demande à "
 "tout ticket précédent"
 #: pretix/base/models/items.py:464
 #, fuzzy
 #| msgid "Require either an existing or a new medium to be used"
 msgid ""
 "Require either an existing or a new medium to be used, adding to any "
 "previous tickets"
-msgstr ""
+msgstr "Nécessiter l'utilisation d'un support existant ou d'un nouveau support"
 "Exiger l'utilisation d'un support existant ou d'un nouveau support, en "
 "complément des tickets précédents"
 #: pretix/base/models/items.py:480 pretix/base/models/items.py:1468
 msgid "Category"
@@ -5987,6 +6001,14 @@ msgid "Reusable media policy"
 msgstr "Politique relative aux médias réutilisables"
 #: pretix/base/models/items.py:777
 #, fuzzy
 #| msgid ""
 #| "If this product should be stored on a re-usable physical medium, you can "
 #| "attach a physical media policy. This is not required for regular tickets, "
 #| "which just use a one-time barcode, but only for products like renewable "
 #| "season tickets or re-chargeable gift card wristbands. This is an advanced "
 #| "feature that also requires specific configuration of ticketing and "
 #| "printing settings."
 msgid ""
 "If this product should be stored on a reusable physical medium, you can "
 "attach a physical media policy. This is not required for regular tickets, "
@@ -6051,10 +6073,6 @@ msgid ""
 "prior to their usage. Therefore, the selected media policy does not make "
 "sense for this media type."
 msgstr ""
 "Le type de support sélectionné exige que tous les supports soient "
 "enregistrés dans le système avant leur utilisation. Par conséquent, la "
 "politique relative aux supports sélectionnée n'est pas applicable à ce type "
 "de support."
 #: pretix/base/models/items.py:1009
 msgid ""
@@ -6631,16 +6649,18 @@ msgstr "Non distribué"
 #: pretix/base/models/media.py:77
 msgctxt "reusable_medium"
 msgid "Claim token"
-msgstr "Réclamer un jeton"
+msgstr ""
 #: pretix/base/models/media.py:82
 msgctxt "reusable_medium"
 msgid "Label"
-msgstr "Descriptif"
+msgstr ""
 #: pretix/base/models/media.py:105
 #, fuzzy
 #| msgid "Linked ticket"
 msgid "Linked tickets"
-msgstr "Billets liés"
+msgstr "Billet lié"
 #: pretix/base/models/media.py:107
 msgid ""
@@ -6648,9 +6668,6 @@ msgid ""
 "validity. If multiple tickets are valid at once, this will lead to failed "
 "check-ins."
 msgstr ""
 "Si vous associez plusieurs billets, assurez-vous qu'il n'y ait pas de "
 "chevauchement entre leurs périodes de validité. Si plusieurs billets sont "
 "valables en même temps, cela entraînera l'échec de l'enregistrement."
 #: pretix/base/models/memberships.py:44
 #: pretix/presale/templates/pretixpresale/organizers/customer_memberships.html:28
@@ -8420,12 +8437,16 @@ msgid "Atlantis"
 msgstr "Atlantide"
 #: pretix/base/pdf.py:376
 #, fuzzy
 #| msgid "Invoice recipient email"
 msgid "Invoice custom recipient field"
-msgstr "Champ personnalisé destinataire de la facture"
+msgstr "E-mail du destinataire de la facture"
 #: pretix/base/pdf.py:377
 #, fuzzy
 #| msgid "Custom recipient field label"
 msgid "Custom recipient field"
-msgstr "Champ de destinataire personnalisé"
+msgstr "Libellé personnalisé du champ destinataire"
 #: pretix/base/pdf.py:381
 msgid "List of Add-Ons"
@@ -9450,15 +9471,13 @@ msgstr ""
 #: pretix/base/services/checkin.py:1121
 msgid "Ticket needs to be exchanged to a suitable medium."
-msgstr "Le billet doit être échangé contre un support adapté."
+msgstr ""
 #: pretix/base/services/checkin.py:1128
 msgid ""
 "This ticket has already been exchanged for a reusable medium that now needs "
 "to be used instead."
 msgstr ""
 "Ce billet a déjà été échangé contre un support réutilisable qui doit "
 "désormais être utilisé à sa place."
 #: pretix/base/services/checkin.py:1180
 msgid "This ticket has already been redeemed."
@@ -9624,46 +9643,64 @@ msgstr ""
 "Vous recevez cet e-mail parce que vous avez passé une commande pour {event}."
 #: pretix/base/services/media.py:93 pretix/base/services/media.py:95
 #, fuzzy
 #| msgid "Invalid input type."
 msgid "Invalid medium type."
-msgstr "Type de support non valide."
+msgstr "Type d’entrée non valide."
 #: pretix/base/services/media.py:100 pretix/base/services/media.py:102
 #, fuzzy
 #| msgid "The selected media type is not enabled in your organizer settings."
 msgid "Medium type is not enabled for organizer."
-msgstr "Ce type de média n’est pas activé par l'organisateur."
+msgstr ""
 "Le type de média sélectionné n’est pas activé dans les paramètres de votre "
 "organisateur."
 #: pretix/base/services/media.py:107 pretix/base/services/media.py:109
 msgid "Incorrect medium type for product."
-msgstr "Type de support incorrect pour ce produit."
+msgstr ""
 #: pretix/base/services/media.py:114 pretix/base/services/media.py:116
 #, fuzzy
 #| msgid "This ticket has already been redeemed."
 msgid "Ticket is already exchanged for reusable medium."
-msgstr "Le billet a déjà été échangé contre un support réutilisable."
+msgstr "Ce billet a déjà été échangé."
 #: pretix/base/services/media.py:133 pretix/base/services/media.py:135
 #, fuzzy
 #| msgid "Reusable Medium ID"
 msgid "Reusable medium not found."
-msgstr "Support réutilisable introuvable."
+msgstr "Identification de support réutilisable"
 #: pretix/base/services/media.py:140 pretix/base/services/media.py:142
 #: pretix/base/services/media.py:168 pretix/base/services/media.py:170
 #, fuzzy
 #| msgid "The reusable medium has been created."
 msgid "Reusable medium is inactive or expired."
-msgstr "Le support réutilisable est inactif ou a expiré."
+msgstr "Le support réutilisable a été créé."
 #: pretix/base/services/media.py:155 pretix/base/services/media.py:162
 #: pretix/base/services/media.py:176
 #, fuzzy
 #| msgid "The reusable medium has been created."
 msgid "Reusable medium not found and could not be created."
-msgstr "Support réutilisable introuvable et impossible à créer."
+msgstr "Le support réutilisable a été créé."
 #: pretix/base/services/media.py:183
 #, fuzzy
 #| msgid "Reusable media type"
 msgid "Reusable medium already exists."
-msgstr "Le type de support réutilisable existe déjà."
+msgstr "Type de support réutilisable"
 #: pretix/base/services/media.py:189
 #, fuzzy
 #| msgid "The reusable medium has been created."
 msgid "Reusable medium could not be created."
-msgstr "Impossible de créer le support réutilisable."
+msgstr "Le support réutilisable a été créé."
 #: pretix/base/services/media.py:195 pretix/base/services/media.py:197
 msgid "Product does not support medium exchange."
-msgstr "Ce produit ne permet pas de changer de support."
+msgstr ""
 #: pretix/base/services/memberships.py:108
 #, python-brace-format
@@ -10389,10 +10426,17 @@ msgstr ""
 "l’achat."
 #: pretix/base/settings.py:214
 #, fuzzy
 #| msgid "Activate re-usable media"
 msgid "Activate reusable media"
 msgstr "Activer les supports réutilisables"
 #: pretix/base/settings.py:215
 #, fuzzy
 #| msgid ""
 #| "The re-usable media feature allows you to connect tickets and gift cards "
 #| "with physical media such as wristbands or chip cards that may be re-used "
 #| "for different tickets or gift cards later."
 msgid ""
 "The reusable media feature allows you to connect tickets and gift cards with "
 "physical media such as wristbands or chip cards that may be reused for "
@@ -10406,8 +10450,6 @@ msgstr ""
 #: pretix/base/settings.py:226
 msgid "Enforce the usage of issued reusable media for check-in"
 msgstr ""
 "Imposer l'utilisation de supports réutilisables fournis lors de "
 "l'enregistrement"
 #: pretix/base/settings.py:227
 msgid ""
@@ -10415,10 +10457,6 @@ msgid ""
 "medium has been created and linked to a ticket. Keeping this option turned "
 "off will treat the reusable medium and ticket as equals."
 msgstr ""
 "Si cette option est activée, le code-barres d'un billet ne sera plus accepté "
 "dès lors qu'un support réutilisable a été créé et associé à ce billet. Si "
 "cette option reste désactivée, le support réutilisable et le billet seront "
 "considérés comme équivalents."
 #: pretix/base/settings.py:254
 msgid "Length of barcodes"
@@ -18653,12 +18691,16 @@ msgid "The reusable medium has been changed."
 msgstr "Le support réutilisable a été changé."
 #: pretix/control/logdisplay.py:746
 #, fuzzy
 #| msgid "The new member has been added to the team."
 msgid "A new ticket has been added to the medium."
-msgstr "Un nouveau billet a été ajouté sur le support."
+msgstr "Le nouveau membre a été ajouté à l'équipe."
 #: pretix/control/logdisplay.py:747
 #, fuzzy
 #| msgid "{user} has been removed from the team."
 msgid "A ticket has been removed from the medium."
-msgstr "Un billet a été retiré du support."
+msgstr "{user} a été retiré de l'équipe."
 #: pretix/control/logdisplay.py:748
 msgid "The medium has been connected to a new ticket."
@@ -18670,8 +18712,6 @@ msgid ""
 "The ticket #{positionid} was exchanged for reusable medium "
 "{medium_identifier}."
 msgstr ""
 "Le ticket n° {positionid} a été échangé contre un support réutilisable "
 "{medium_identifier}."
 #: pretix/control/logdisplay.py:750
 msgid "The medium has been connected to a new gift card."
@@ -20587,8 +20627,10 @@ msgstr ""
 "l’enregistrement :"
 #: pretix/control/templates/pretixcontrol/checkin/simulator.html:85
 #, fuzzy
 #| msgid "Special attention required"
 msgid "Media exchange required"
-msgstr "Échange de supports requis"
+msgstr "Une attention particulière est requise"
 #: pretix/control/templates/pretixcontrol/checkin/simulator.html:87
 #, python-format
@@ -20596,8 +20638,6 @@ msgid ""
 "This ticket needs to be exchanged into a <strong>%(media_type)s</strong> "
 "reusable medium. <strong>%(media_policy)s</strong>."
 msgstr ""
 "Ce billet doit être échangé contre un support réutilisable <strong>%"
 "(media_type)s</strong>. <strong>%(media_policy)s</strong>."
 #: pretix/control/templates/pretixcontrol/checkin/simulator.html:103
 msgid "Special attention required"
@@ -27192,9 +27232,6 @@ msgid ""
 "Even if a team has no access to a certain category of data, they might still "
 "be able to see parts of this data when it is linked to data they can see."
 msgstr ""
 "Même si une équipe n'a pas accès à une certaine catégorie de données, elle "
 "peut néanmoins être en mesure de consulter certaines parties de ces données "
 "lorsque celles-ci sont liées à des données auxquelles elle a accès."
 #: pretix/control/templates/pretixcontrol/organizers/team_edit.html:35
 msgid ""
@@ -27202,10 +27239,6 @@ msgid ""
 "some information about gift cards linked to a customer account, even if they "
 "generally can't see gift cards directly."
 msgstr ""
 "Par exemple, une personne ayant accès aux comptes clients pourra consulter "
 "certaines informations concernant les cartes cadeaux associées à un compte "
 "client, même si, en règle générale, elle ne peut pas voir directement ces "
 "cartes cadeaux."
 #: pretix/control/templates/pretixcontrol/organizers/team_edit.html:59
 msgid ""
@@ -27213,9 +27246,6 @@ msgid ""
 "information about vouchers used to create an order, even if they generally "
 "can't see vouchers directly."
 msgstr ""
 "Par exemple, une personne ayant accès aux commandes pourra consulter "
 "certaines informations concernant les bons utilisés pour créer une commande, "
 "même si, en règle générale, elle ne peut pas consulter directement ces bons."
 #: pretix/control/templates/pretixcontrol/organizers/team_members.html:21
 msgid "Member"
@@ -28087,22 +28117,30 @@ msgstr ""
 #: pretix/control/templates/pretixcontrol/subevents/detail.html:9
 #: pretix/control/templates/pretixcontrol/subevents/detail.html:13
-#, python-format
+#, fuzzy, python-format
 #| msgid "Quota: %(name)s"
 msgctxt "subevent"
 msgid "Date: %(name)s"
-msgstr "Date : %(name)s"
+msgstr "Quota : %(name)s"
 #: pretix/control/templates/pretixcontrol/subevents/detail.html:234
 #, fuzzy
 #| msgid "Partially paid"
 msgid "partially canceled"
-msgstr "partiellement annulé"
+msgstr "Partiellement payé"
 #: pretix/control/templates/pretixcontrol/subevents/detail.html:282
 #, fuzzy
 #| msgctxt "permission_level"
 #| msgid "View all"
 msgid "View all"
 msgstr "Tout afficher"
 #: pretix/control/templates/pretixcontrol/subevents/detail.html:289
 #, fuzzy
 #| msgid "No archived events found."
 msgid "No orders found."
-msgstr "Aucune commande trouvée."
+msgstr "Aucun événement archivé trouvé."
 #: pretix/control/templates/pretixcontrol/subevents/detail.html:302
 #: pretix/control/templates/pretixcontrol/subevents/edit.html:279
@@ -30900,8 +30938,10 @@ msgid "Voucher {}"
 msgstr "Bon {}"
 #: pretix/control/views/typeahead.py:179 pretix/control/views/typeahead.py:180
 #, fuzzy
 #| msgid "Go to event"
 msgid "No event"
-msgstr "Aucun événement"
+msgstr "Aller à l'événement"
 #: pretix/control/views/user.py:169
 msgid "The password you entered was invalid, please try again."
@@ -7,7 +7,7 @@ msgstr ""
 "Project-Id-Version: French\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-06-28 15:49+0000\n"
-"PO-Revision-Date: 2026-06-29 17:00+0000\n"
+"PO-Revision-Date: 2026-03-18 12:23+0000\n"
 "Last-Translator: CVZ-es <damien.bremont@casadevelazquez.org>\n"
 "Language-Team: French <https://translate.pretix.eu/projects/pretix/pretix-js/"
 "fr/>\n"
@@ -16,7 +16,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n > 1;\n"
-"X-Generator: Weblate 2026.6.1\n"
+"X-Generator: Weblate 5.16.2\n"
 #: pretix/plugins/banktransfer/static/pretixplugins/banktransfer/ui.js:56
 #: pretix/plugins/banktransfer/static/pretixplugins/banktransfer/ui.js:62
@@ -443,11 +443,11 @@ msgstr "Appuyez sur Ctrl-C pour copier !"
 #: pretix/static/pretixcontrol/js/ui/checkinrules/App.vue:80
 msgid "Edit"
-msgstr "Éditer"
+msgstr ""
 #: pretix/static/pretixcontrol/js/ui/checkinrules/App.vue:86
 msgid "Visualize"
-msgstr "Visualiser"
+msgstr ""
 #: pretix/static/pretixcontrol/js/ui/checkinrules/App.vue:96
 msgid ""
@@ -455,14 +455,10 @@ msgid ""
 "or variations are not contained in any of your rule parts so people with "
 "these tickets will not get in:"
 msgstr ""
 "Votre règle effectue toujours un filtrage par produit ou variante, mais les "
 "produits ou variantes suivants ne figurent dans aucune des parties de votre "
 "règle ; par conséquent, les personnes détenant ces billets ne seront pas "
 "admises :"
 #: pretix/static/pretixcontrol/js/ui/checkinrules/App.vue:99
 msgid "Please double-check if this was intentional."
-msgstr "Veuillez vérifier si cela était intentionnel."
+msgstr ""
 #: pretix/static/pretixcontrol/js/ui/checkinrules/constants.ts:4
 msgid "All of the conditions below (AND)"
@@ -8,7 +8,7 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-06-28 14:42+0000\n"
-"PO-Revision-Date: 2026-06-30 16:52+0000\n"
+"PO-Revision-Date: 2026-06-20 17:00+0000\n"
 "Last-Translator: Nikita Mitasov <me@ch4og.com>\n"
 "Language-Team: Russian <https://translate.pretix.eu/projects/pretix/pretix/"
 "ru/>\n"
@@ -35488,8 +35488,10 @@ msgstr "Введите промокод  ниже, чтобы купить эт
 #: pretix/presale/templates/pretixpresale/event/fragment_availability.html:10
 #: pretix/presale/templates/pretixpresale/event/fragment_availability.html:14
 #, fuzzy
 #| msgid "Quota availabilities"
 msgid "Not available yet."
-msgstr "Еще недоступно."
+msgstr "Наличие квот"
 #: pretix/presale/templates/pretixpresale/event/fragment_availability.html:18
 msgid "Not available any more."
@@ -34,6 +34,7 @@
 import json
 import logging
 import urllib.parse
 from collections import OrderedDict
 from decimal import Decimal
@@ -41,6 +42,7 @@ import paypalrestsdk
 import paypalrestsdk.exceptions
 from django import forms
 from django.contrib import messages
 from django.core import signing
 from django.http import HttpRequest
 from django.template.loader import get_template
 from django.urls import reverse
@@ -56,7 +58,6 @@ from pretix.base.forms import SecretKeySettingsField
 from pretix.base.models import Event, Order, OrderPayment, OrderRefund, Quota
 from pretix.base.payment import BasePaymentProvider, PaymentException
 from pretix.base.settings import SettingsSandbox
 from pretix.base.views.redirect import safelink
 from pretix.multidomain.urlreverse import eventreverse_absolute
 from pretix.plugins.paypal.api import Api
 from pretix.plugins.paypal.models import ReferencedPayPalObject
@@ -348,7 +349,11 @@ class Paypal(BasePaymentProvider):
            for link in payment.links:
                if link.method == "REDIRECT" and link.rel == "approval_url":
                    if request.session.get('iframe_session', False):
-                        return safelink(link.href, framebreak=True)
+                        signer = signing.Signer(salt='safe-redirect')
                        return (
                            eventreverse_absolute(request.event, 'plugins:paypal:redirect') + '?url=' +
                            urllib.parse.quote(signer.sign(link.href))
                        )
                    else:
                        return str(link.href)
        else:
@@ -0,0 +1,33 @@
 {% load compress %}
 {% load i18n %}
 {% load static %}
 <!DOCTYPE html>
 <html>
 <head>
    <title>{{ settings.PRETIX_INSTANCE_NAME }}</title>
    {% compress css %}
        <link rel="stylesheet" type="text/x-scss" href="{% static "pretixbase/scss/cachedfiles.scss" %}"/>
    {% endcompress %}
    {% compress js %}
        <script type="text/javascript" src="{% static "jquery/js/jquery-3.6.4.min.js" %}"></script>
    {% endcompress %}
 </head>
 <body>
    <div class="container">
        <h1>{% trans "The payment process has started in a new window." %}</h1>
        <p>
            {% trans "The window to enter your payment data was not opened or was closed?" %}
        </p>
        <p>
            <a href="{{ url }}" target="_blank" class="btn btn-default btn-lg">
                <span class="fa fa-external-link-square"></span>
                {% trans "Click here in order to open the window." %}
            </a>
        </p>
        <script>
            window.open('{{ url|escapejs }}');
        </script>
    </div>
 </body>
 </html>
@@ -21,12 +21,13 @@
 #
 from django.urls import include, re_path
-from .views import abort, oauth_disconnect, success
+from .views import abort, oauth_disconnect, redirect_view, success
 event_patterns = [
    re_path(r'^paypal/', include([
        re_path(r'^abort/$', abort, name='abort'),
        re_path(r'^return/$', success, name='return'),
        re_path(r'^redirect/$', redirect_view, name='redirect'),
        re_path(r'w/(?P<cart_namespace>[a-zA-Z0-9]{16})/abort/', abort, name='abort'),
        re_path(r'w/(?P<cart_namespace>[a-zA-Z0-9]{16})/return/', success, name='return'),
@@ -39,10 +39,13 @@ from decimal import Decimal
 import paypalrestsdk
 import paypalrestsdk.exceptions
 from django.contrib import messages
 from django.core import signing
 from django.db.models import Sum
-from django.http import HttpResponse
+from django.http import HttpResponse, HttpResponseBadRequest
 from django.shortcuts import render
 from django.urls import reverse
 from django.utils.translation import gettext_lazy as _
 from django.views.decorators.clickjacking import xframe_options_exempt
 from django.views.decorators.csrf import csrf_exempt
 from django.views.decorators.http import require_POST
 from django_scopes import scopes_disabled
@@ -58,6 +61,21 @@ from pretix.plugins.paypal.payment import Paypal
 logger = logging.getLogger('pretix.plugins.paypal')
@xframe_options_exempt
 def redirect_view(request, *args, **kwargs):
    signer = signing.Signer(salt='safe-redirect')
    try:
        url = signer.unsign(request.GET.get('url', ''))
    except signing.BadSignature:
        return HttpResponseBadRequest('Invalid parameter')
    r = render(request, 'pretixplugins/paypal/redirect.html', {
        'url': url,
    })
    r._csp_ignore = True
    return r
 def success(request, *args, **kwargs):
    pid = request.GET.get('paymentId')
    token = request.GET.get('token')
@@ -0,0 +1,33 @@
 {% load compress %}
 {% load i18n %}
 {% load static %}
 <!DOCTYPE html>
 <html>
 <head>
    <title>{{ settings.PRETIX_INSTANCE_NAME }}</title>
    {% compress css %}
        <link rel="stylesheet" type="text/x-scss" href="{% static "pretixbase/scss/cachedfiles.scss" %}"/>
    {% endcompress %}
    {% compress js %}
        <script type="text/javascript" src="{% static "jquery/js/jquery-3.6.4.min.js" %}"></script>
    {% endcompress %}
 </head>
 <body>
    <div class="container">
        <h1>{% trans "The payment process has started in a new window." %}</h1>
        <p>
            {% trans "The window to enter your payment data was not opened or was closed?" %}
        </p>
        <p>
            <a href="{{ url }}" target="_blank" class="btn btn-default btn-lg">
                <span class="fa fa-external-link-square"></span>
                {% trans "Click here in order to open the window." %}
            </a>
        </p>
        <script>
            window.open('{{ url|escapejs }}');
        </script>
    </div>
 </body>
 </html>
@@ -22,13 +22,15 @@
 from django.urls import include, re_path
 from .views import (
-    PayView, XHRView, abort, isu_disconnect, isu_return, success, webhook,
+    PayView, XHRView, abort, isu_disconnect, isu_return, redirect_view,
    success, webhook,
 )
 event_patterns = [
    re_path(r'^paypal2/', include([
        re_path(r'^abort/$', abort, name='abort'),
        re_path(r'^return/$', success, name='return'),
        re_path(r'^redirect/$', redirect_view, name='redirect'),
        re_path(r'^xhr/$', XHRView.as_view(), name='xhr'),
        re_path(r'^pay/(?P<order>[^/]+)/(?P<hash>[^/]+)/(?P<payment>[^/]+)/$', PayView.as_view(), name='pay'),
        re_path(r'^(?P<order>[^/][^w]+)/(?P<secret>[A-Za-z0-9]+)/xhr/$', XHRView.as_view(), name='xhr'),
@@ -36,10 +36,13 @@ import logging
 from decimal import Decimal
 from django.contrib import messages
 from django.core import signing
 from django.core.cache import cache
 from django.db import transaction
 from django.db.models import Sum
-from django.http import Http404, HttpResponse, JsonResponse
+from django.http import (
    Http404, HttpResponse, HttpResponseBadRequest, JsonResponse,
 )
 from django.shortcuts import get_object_or_404, redirect, render
 from django.urls import reverse
 from django.utils.decorators import method_decorator
@@ -101,6 +104,21 @@ class PaypalOrderView:
        }) + ('?paid=yes' if self.order.status == Order.STATUS_PAID else ''))
@xframe_options_exempt
 def redirect_view(request, *args, **kwargs):
    signer = signing.Signer(salt='safe-redirect')
    try:
        url = signer.unsign(request.GET.get('url', ''))
    except signing.BadSignature:
        return HttpResponseBadRequest('Invalid parameter')
    r = render(request, 'pretixplugins/paypal2/redirect.html', {
        'url': url,
    })
    r._csp_ignore = True
    return r
@method_decorator(csrf_exempt, name='dispatch')
@method_decorator(xframe_options_exempt, 'dispatch')
 class XHRView(View):
@@ -46,6 +46,7 @@ import stripe
 from django import forms
 from django.conf import settings
 from django.contrib import messages
 from django.core import signing
 from django.db import transaction
 from django.http import HttpRequest
 from django.template.loader import get_template
@@ -71,7 +72,6 @@ from pretix.base.payment import (
 )
 from pretix.base.plugins import get_all_plugins
 from pretix.base.settings import SettingsSandbox
 from pretix.base.views.redirect import safelink
 from pretix.helpers import OF_SELF
 from pretix.helpers.countries import CachedCountries
 from pretix.helpers.http import get_client_ip
@@ -745,7 +745,15 @@ class StripeMethod(BasePaymentProvider):
    def redirect(self, request, url):
        if request.session.get('iframe_session', False):
-            return safelink(url, framebreak=True)
+            return (
                eventreverse_absolute(request.event, 'plugins:stripe:redirect') +
                '?data=' + signing.dumps({
                    'url': url,
                    'session': {
                        'payment_stripe_order_secret': request.session['payment_stripe_order_secret'],
                    },
                }, salt='safe-redirect')
            )
        else:
            return str(url)
@@ -1045,7 +1053,11 @@ class StripeMethod(BasePaymentProvider):
            'hash': payment.order.tagged_secret('plugins:stripe'),
        })
        if not self.redirect_in_widget_allowed and request.session.get('iframe_session', False):
-            return safelink(url, framebreak=True)
+            return eventreverse_absolute(self.event, 'plugins:stripe:redirect') + '?data=' + signing.dumps({
                'url': url,
                'session': {},
            }, salt='safe-redirect')
        return url
    def _confirm_payment_intent(self, request, payment):
@@ -0,0 +1,33 @@
 {% load compress %}
 {% load i18n %}
 {% load static %}
 <!DOCTYPE html>
 <html>
 <head>
    <title>{{ settings.PRETIX_INSTANCE_NAME }}</title>
    {% compress css %}
        <link rel="stylesheet" type="text/x-scss" href="{% static "pretixbase/scss/cachedfiles.scss" %}"/>
    {% endcompress %}
    {% compress js %}
        <script type="text/javascript" src="{% static "jquery/js/jquery-3.6.4.min.js" %}"></script>
    {% endcompress %}
 </head>
 <body>
    <div class="container">
        <h1>{% trans "The payment process has started in a new window." %}</h1>
        <p>
            {% trans "The window to enter your payment data was not opened or was closed?" %}
        </p>
        <p>
            <a href="{{ url }}" target="_blank" class="btn btn-default btn-lg">
                <span class="fa fa-external-link-square"></span>
                {% trans "Click here in order to open the window." %}
            </a>
        </p>
        <script>
            window.open('{{ url|escapejs }}');
        </script>
    </div>
 </body>
 </html>
@@ -25,12 +25,13 @@ from pretix.multidomain import event_url
 from .views import (
    OrganizerSettingsFormView, ReturnView, ScaReturnView, ScaView,
-    oauth_disconnect, oauth_return, webhook,
+    oauth_disconnect, oauth_return, redirect_view, webhook,
 )
 event_patterns = [
    re_path(r'^stripe/', include([
        event_url(r'^webhook/$', webhook, name='webhook', require_live=False),
        re_path(r'^redirect/$', redirect_view, name='redirect'),
        re_path(r'^return/(?P<order>[^/]+)/(?P<hash>[^/]+)/(?P<payment>[0-9]+)/$', ReturnView.as_view(), name='return'),
        re_path(r'^sca/(?P<order>[^/]+)/(?P<hash>[^/]+)/(?P<payment>[0-9]+)/$', ScaView.as_view(), name='sca'),
        re_path(r'^sca/(?P<order>[^/]+)/(?P<hash>[^/]+)/(?P<payment>[0-9]+)/return/$',
@@ -34,11 +34,13 @@
 import json
 import logging
 import urllib.parse
 import requests
 from django.contrib import messages
 from django.core import signing
 from django.db import transaction
-from django.http import Http404, HttpResponse
+from django.http import Http404, HttpResponse, HttpResponseBadRequest
 from django.shortcuts import get_object_or_404, redirect, render
 from django.urls import reverse
 from django.utils.decorators import method_decorator
@@ -62,7 +64,7 @@ from pretix.control.views.event import DecoupleMixin
 from pretix.control.views.organizer import OrganizerDetailViewMixin
 from pretix.helpers import OF_SELF
 from pretix.helpers.http import redirect_to_url
-from pretix.multidomain.urlreverse import eventreverse
+from pretix.multidomain.urlreverse import eventreverse, eventreverse_absolute
 from pretix.plugins.stripe.forms import OrganizerStripeSettingsForm
 from pretix.plugins.stripe.models import ReferencedStripeObject
 from pretix.plugins.stripe.tasks import (
@@ -72,6 +74,28 @@ from pretix.plugins.stripe.tasks import (
 logger = logging.getLogger('pretix.plugins.stripe')
@xframe_options_exempt
 def redirect_view(request, *args, **kwargs):
    try:
        data = signing.loads(request.GET.get('data', ''), salt='safe-redirect')
    except signing.BadSignature:
        return HttpResponseBadRequest('Invalid parameter')
    if 'go' in request.GET:
        if 'session' in data:
            for k, v in data['session'].items():
                request.session[k] = v
        return redirect(data['url'])
    else:
        params = request.GET.copy()
        params['go'] = '1'
        r = render(request, 'pretixplugins/stripe/redirect.html', {
            'url': eventreverse_absolute(request.event, 'plugins:stripe:redirect') + '?' + urllib.parse.urlencode(params),
        })
        r._csp_ignore = True
        return r
@scopes_disabled()
 def oauth_return(request, *args, **kwargs):
    import stripe
@@ -490,6 +514,11 @@ class StripeOrderView:
        return self.request.event.get_payment_providers()[self.payment.provider]
    def _redirect_to_order(self):
        if self.request.session.get('payment_stripe_order_secret') != self.order.secret and not self.payment.provider.startswith('stripe'):
            messages.error(self.request, _('Sorry, there was an error in the payment process. Please check the link '
                                           'in your emails to continue.'))
            return redirect_to_url(eventreverse(self.request.event, 'presale:event.index'))
        return redirect_to_url(eventreverse(self.request.event, 'presale:event.order', kwargs={
            'order': self.order.code,
            'secret': self.order.secret
@@ -2,7 +2,6 @@
 {% load i18n %}
 {% load eventurl %}
 {% load urlreplace %}
 {% load static %}
 {% block content %}
    {% if cart_namespace %}
@@ -24,8 +23,9 @@
               class="btn btn-primary btn-lg" target="_blank">
                {% trans "Continue in new tab" %}
            </a>
-            {{ url|json_script:"framebreak-url" }}
+            <script>
-            <script type="text/javascript" src="{% static "pretixbase/js/framebreak.js" %}"></script>
+                window.open('{{ url|escapejs }}');
            </script>
        </div>
    {% else %}
        <h1>{% trans "Cookies not supported" %}</h1>
@@ -21,21 +21,22 @@
                            data-date="{{ day.date|date_fast:"SHORT_DATE_FORMAT" }}">
                            <p>
                            {% if day.events %}
-                                <a href="#selected-day" class="day-label event hidden-sm hidden-md hidden-lg" aria-describedby="nr-of-events-{{ day.date|date_fast:"Y-m-d" }}">
+                                <a href="#selected-day" class="day-label event hidden-sm hidden-md hidden-lg">
                                    <b aria-hidden="true">{{ day.day }}</b>
                                    <time datetime="{{ day.date|date_fast:"Y-m-d" }}" class="sr-only">
                                        {{ day.date|date_fast:"SHORT_DATE_FORMAT" }}
                                    </time>
-                                    <span class="sr-only" id="nr-of-events-{{ day.date|date_fast:"Y-m-d" }}">{% blocktrans trimmed count count=day.events|length %}
+                                    <span class="sr-only">
-                                        {{ count }} event
+                                        ({% blocktrans trimmed count count=day.events|length %}
-                                    {% plural %}
+                                            {{ count }} event
-                                        {{ count }} events
+                                        {% plural %}
-                                    {% endblocktrans %}</span>
+                                            {{ count }} events
                                        {% endblocktrans %})
                                    </span>
                                </a>
                                <time datetime="{{ day.date|date_fast:"Y-m-d" }}" class="hidden-xs">{{ day.day }}</time>
                            {% else %}
                                <time datetime="{{ day.date|date_fast:"Y-m-d" }}" class="day-label">{{ day.day }}</time>
                                <span class="sr-only">{% trans "No events" %}</span>
                            {% endif %}
                            </p>
                            <ul class="events">
@@ -536,6 +536,7 @@ class EventIndex(EventViewMixin, EventListMixin, CartMixin, TemplateView):
                    **pass_through_url_params,
                })
            })
            r._csp_ignore = True
            return r
        if not request.event.all_sales_channels and request.sales_channel.identifier not in (s.identifier for s in request.event.limit_sales_channels.all()):
@@ -650,10 +650,6 @@ def add_subevents_for_days(qs, before, after, ebd, timezones, sales_channel, eve
            if hide:
                continue
        if s.event_calendar_future_only:
            if (se.date_to or se.date_from) < time_machine_now():
                continue
        timezones.add(s.timezone)
        tz = ZoneInfo(s.timezone)
        datetime_from = se.date_from.astimezone(tz)
@@ -125,6 +125,7 @@ class WaitingView(EventViewMixin, FormView):
                    request.event, "presale:event.waitinglist", kwargs={'cart_namespace': kwargs.get('cart_namespace')}
                ) + '?' + url_replace(request, 'require_cookie', '', 'iframe', '', 'locale', request.GET.get('locale', get_language_without_region()))
            })
            r._csp_ignore = True
            return r
        if not self.itemvars:
@@ -123,7 +123,7 @@ def widget_css_etag(request, version, **kwargs):
 def _use_vite(request):
-    if getattr(settings, 'PRETIX_WIDGET_VITE', False) or "beta" in request.GET:
+    if getattr(settings, 'PRETIX_WIDGET_VITE', False):
        return True
    origin = request.META.get('HTTP_ORIGIN', '')
    gs = GlobalSettingsObject()
@@ -440,7 +440,6 @@ CSRF_COOKIE_NAME = 'pretix_csrftoken'
 SESSION_COOKIE_HTTPONLY = True
 INSTALLED_APPS += [ # noqa
    'django_querytagger',
    'django_filters',
    'django_markup',
    'django_otp',
@@ -506,7 +505,6 @@ MIDDLEWARE = [
    'pretix.helpers.logs.RequestIdMiddleware',
    'pretix.api.middleware.IdempotencyMiddleware',
    'pretix.multidomain.middlewares.MultiDomainMiddleware',
    'django_querytagger.middleware.SetTagMiddleware',  # after MultiDomainMiddleware for correct url resolving
    'pretix.base.middleware.CustomCommonMiddleware',
    'pretix.multidomain.middlewares.SessionMiddleware',
    'pretix.multidomain.middlewares.CsrfViewMiddleware',
@@ -626,9 +624,6 @@ LOGGING = {
        'request_id': {
            '()': 'pretix.helpers.logs.RequestIdFilter'
        },
        'skip_not_found': {
            '()': 'pretix.helpers.logs.SkipNotFoundFilter',
        }
    },
    'handlers': {
        'console': {
@@ -670,7 +665,6 @@ LOGGING = {
            'handlers': ['file', 'console', 'mail_admins'],
            'level': loglevel,
            'propagate': True,
            'filters': ['skip_not_found'],
        },
        'pretix.security.csp': {
            'handlers': ['csp_file'],
@@ -1,3 +0,0 @@
 // Attempt to auto-open page in new tab. Will be ignored by most browser's popup blockers anyways, though.
 var url = JSON.parse(document.getElementById('framebreak-url').innerText)
 window.open(url)
@@ -126,81 +126,3 @@ class LocaleDeterminationTest(TestCase):
        response = c.get('/dummy/dummy/')
        language = response['Content-Language']
        self.assertEqual(language, 'en')
 def test_render_csp():
    from pretix.base.middleware import _render_csp
    assert _render_csp({}) == ""
    assert _render_csp({'default-src': ["'self'"]}) == "default-src 'self'"
    h = {
        'default-src': ["'self'"],
        'script-src': ["'self'"],
        'object-src': ["'none'"],
        'frame-src': ["'self'"],
        'style-src': ["'self'", "'self'"],
        'connect-src': ["'self'", "'self'"],
        'img-src': ["'self'", "'self'", "data:"],
        'font-src': ["'self'"],
        'media-src': ["'self'", "data:"],
        'form-action': ["'self'", "https:"],
    }
    assert _render_csp(h) == (
        "default-src 'self'; script-src 'self'; object-src 'none'; frame-src 'self'; style-src 'self' 'self'; "
        "connect-src 'self' 'self'; img-src 'self' 'self' data:; font-src 'self'; media-src 'self' data:; form-action 'self' https:"
    )
 def test_merge_csp():
    from pretix.base.middleware import _merge_csp, _parse_csp, _render_csp
    h = {
        'default-src': ["'self'"],
        'script-src': ["'self'"],
        'style-src': ["'self'", "'self'"],
        'form-action': ["'self'", "https:"],
        'connect-src': ["'self'", "'self'"],
    }
    assert _render_csp(h) == (
        "default-src 'self'; script-src 'self'; style-src 'self' 'self'; form-action 'self' https:; connect-src 'self' 'self'"
    )
    _merge_csp(h, _parse_csp("style-src 'unsafe-inline'; connect-src https://example.com"))
    assert _render_csp(h) == (
        "default-src 'self'; script-src 'self'; style-src 'self' 'self' 'unsafe-inline'; form-action 'self' "
        "https:; connect-src 'self' 'self' https://example.com"
    )
 def test_roundtrip_csp():
    from pretix.base.middleware import _merge_csp, _parse_csp, _render_csp
    prod_csp = ("default-src 'self' https://pretix.eu https://static.pretix.cloud; script-src 'self' "
                "'sha256-+tmFggeXIPOAC2UgcQ3LW/gPHTkwyWg3/D6FOJ5BHGo=' 'unsafe-eval' https://matomo.rami.io "
                "https://pretix.eu https://static.pretix.cloud https://support.rami.io; object-src 'none'; "
                "frame-src 'self' https://matomo.rami.io https://pretix.eu https://static.pretix.cloud "
                "https://support.rami.io https://www.youtube-nocookie.com; style-src 'self' 'unsafe-inline' "
                "data: https://cdn.pretix.cloud https://pretix.eu https://static.pretix…rt.rami.io; connect-src "
                "'self' https://cdn.pretix.cloud https://matomo.rami.io https://pretix.eu https://static.pretix.cloud "
                "https://support.rami.io ws://support.rami.io; img-src 'self' data: https://cdn.pretix.cloud "
                "https://matomo.rami.io https://pretix.eu https://static.pretix.cloud https://support.rami.io; "
                "font-src 'self' https://pretix.eu https://static.pretix.cloud; media-src 'self' data: "
                "https://cdn.pretix.cloud https://pretix.eu https://static.pretix.cloud; form-action 'self' "
                "https: https://pretix.eu")
    h = _parse_csp(prod_csp)
    _merge_csp(h, _parse_csp(prod_csp))
    assert _render_csp(h) == prod_csp
 def test_sanitize_csp():
    from pretix.base.middleware import _render_csp
    h = {
        'style-src': ["'self'", "https://example.com", "https://example.org https://attack.example.net", "https://\fexample.org",
                      "https://\texample.org", "https://example.org;script-src https://example.org", ],
        'script-src': ["'self'"],
    }
    assert _render_csp(h) == (
        "style-src 'self' https://example.com; script-src 'self'"
    )
@@ -119,7 +119,7 @@ def test_linkify_abs(link):
    assert markdown_compile_email(input) == f"<p>{output}</p>"
-signer = signing.Signer(salt='safelink-url')
+signer = signing.Signer(salt='safe-redirect')
@pytest.mark.parametrize(
@@ -0,0 +1,46 @@
 #
 # This file is part of pretix (Community Edition).
 #
 # Copyright (C) 2014-2020  Raphael Michel and contributors
 # Copyright (C) 2020-today pretix GmbH and contributors
 #
 # This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
 # Public License as published by the Free Software Foundation in version 3 of the License.
 #
 # ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are
 # applicable granting you additional permissions and placing additional restrictions on your usage of this software.
 # Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive
 # this file, see <https://pretix.eu/about/en/license>.
 #
 # This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
 # warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
 # details.
 #
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
 import os
 import subprocess
 import sys
 import tempfile
 def test_start_with_redis_down():
    """
    This is a test that ensures that pretix is able to start without a running redis server,
    even if one is configured.
    """
    with tempfile.NamedTemporaryFile(suffix="cfg") as f:
        f.write(b"[redis]\nlocation=redis://127.0.0.99:65534/2\n")
        f.flush()
        assert subprocess.check_call(
            [
                sys.executable,
                os.path.join(os.path.dirname(__file__), '../manage.py'),
                "noop",
            ],
            env={
                "PRETIX_CONFIG_FILE": f.name,
            }
        ) == 0