Add trace IDs from request to celery task

Celery tasks will log the request ID they were triggered from:

    [2026-07-02 10:33:17,614: INFO/MainProcess] Task pretix.base.services.orders.cancel_order[5f3104b3-0a54-4e49-921e-c866c4dc4c6d] received
    [2026-07-02 10:33:17,614: INFO/MainProcess] Task 5f3104b3-0a54-4e49-921e-c866c4dc4c6d has trace 4d389638-00ab-4c4d-bdec-d73ac322bf44

Nested celery tasks will then contain both the request ID as well as the previous tasks:

    [2026-07-02 10:33:18,354: INFO/MainProcess] Task pretix.base.services.notifications.notify[d52a3a49-9c89-4f67-bdde-9f773586fc07] received
    [2026-07-02 10:33:18,354: INFO/MainProcess] Task d52a3a49-9c89-4f67-bdde-9f773586fc07 has trace 4d389638-00ab-4c4d-bdec-d73ac322bf44 5f3104b3-0a54-4e49-921e-c866c4dc4c6d

pyproject.toml

@@ -53,7 +53,6 @@ dependencies = [
   "django-oauth-toolkit==2.3.*",
   "django-otp==1.7.*",
   "django-phonenumber-field==8.4.*",
-  "django-querytagger==0.0.2",
   "django-redis==6.0.*",
   "django-scopes==2.0.*",
   "django-statici18n==2.7.*",
@@ -94,7 +93,7 @@ dependencies = [
   "redis==7.4.*",
   "reportlab==4.5.*",
   "requests==2.32.*",
-  "sentry-sdk==2.64.*",
+  "sentry-sdk==2.63.*",
   "sepaxml==2.7.*",
   "stripe==7.9.*",
   "text-unidecode==1.*",

src/Makefile

@@ -6,8 +6,8 @@ localecompile:
 	./manage.py compilemessages
 
 localegen:
-	./manage.py makemessages --keep-pot --add-location file --ignore "pretix/static/npm_dir/*" $(LNGS)
-	./manage.py makemessages --keep-pot --add-location file -e js,ts,vue -d djangojs --ignore "pretix/static/npm_dir/*" --ignore "pretix/helpers/*" --ignore "pretix/static/jsi18n/*" --ignore "pretix/static/jsi18n/*" --ignore "pretix/static.dist/*" --ignore "data/*" --ignore "pretix/static/rrule/*" --ignore "build/*" $(LNGS)
+	./manage.py makemessages --keep-pot --ignore "pretix/static/npm_dir/*" $(LNGS)
+	./manage.py makemessages --keep-pot -e js,ts,vue -d djangojs --ignore "pretix/static/npm_dir/*" --ignore "pretix/helpers/*" --ignore "pretix/static/jsi18n/*" --ignore "pretix/static/jsi18n/*" --ignore "pretix/static.dist/*" --ignore "data/*" --ignore "pretix/static/rrule/*" --ignore "build/*" $(LNGS)
 
 staticfiles: npminstall npmbuild jsi18n
 	./manage.py collectstatic --noinput

src/pretix/_base_settings.py

@@ -118,7 +118,6 @@ ALL_LANGUAGES = [
     ('sv', _('Swedish')),
     ('es', _('Spanish')),
     ('es-419', _('Spanish (Latin America)')),
-    ('th', _('Thai')),
     ('tr', _('Turkish')),
     ('uk', _('Ukrainian')),
 ]

src/pretix/base/middleware.py

@@ -19,8 +19,6 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-import logging
-import re
 from collections import OrderedDict
 from urllib.parse import urlparse, urlsplit
 from zoneinfo import ZoneInfo, ZoneInfoNotFoundError
@@ -45,8 +43,6 @@ from pretix.multidomain.urlreverse import (
 )
 from pretix.presale.style import get_fonts
 
-logger = logging.getLogger(__name__)
-
 _supported = None
 
 
@@ -227,26 +223,7 @@ def _parse_csp(header):
     return h
 
 
-VALID_CSP_DIRECTIVES = [
-    "child-src", "connect-src", "default-src", "fenced-frame-src", "font-src", "form-action", "frame-src", "img-src",
-    "manifest-src", "media-src", "object-src", "prefetch-src", "report-uri", "script-src", "script-src-elem",
-    "script-src-attr", "style-src", "style-src-elem", "style-src-attr", "worker-src",
-]
-
-CSP_ILLEGAL_CHARS = re.compile(r'[\s,;]')
-
-
-def _sanitize_csp(h):
-    for k, v in h.items():
-        if k not in VALID_CSP_DIRECTIVES:
-            raise ValueError("Invalid CSP directive " + k)
-        if any(CSP_ILLEGAL_CHARS.search(el) for el in v):
-            logger.warning("Stripping invalid component from CSP: %r", h)
-            h[k] = [el for el in v if not CSP_ILLEGAL_CHARS.search(el)]
-
-
 def _render_csp(h):
-    _sanitize_csp(h)
     return "; ".join(k + ' ' + ' '.join(v) for k, v in h.items() if v)
 
 
@@ -266,7 +243,21 @@ def _merge_csp(a, b):
 
 
 class SecurityMiddleware(MiddlewareMixin):
+    CSP_EXEMPT = (
+        '/api/v1/docs/',
+    )
+
     def process_response(self, request, resp):
+        def nested_dict_values(d):
+            for v in d.values():
+                if isinstance(v, dict):
+                    yield from nested_dict_values(v)
+                else:
+                    if isinstance(v, str):
+                        yield v
+
+        url = resolve(request.path_info)
+
         if settings.DEBUG and resp.status_code >= 400:
             # Don't use CSP on debug error page as it breaks of Django's fancy error
             # pages
@@ -277,15 +268,18 @@ class SecurityMiddleware(MiddlewareMixin):
         # https://github.com/pretix/pretix/issues/765
         resp['P3P'] = 'CP=\"ALL DSP COR CUR ADM TAI OUR IND COM NAV INT\"'
 
-        if not getattr(resp, '_csp_ignore', False):
-            resp['Content-Security-Policy'] = _render_csp(self._build_csp(request, resp))
-        elif 'Content-Security-Policy' in resp:
-            del resp['Content-Security-Policy']
+        img_src = []
+        gs = global_settings_object(request)
+        if gs.settings.leaflet_tiles:
+            img_src.append(gs.settings.leaflet_tiles[:gs.settings.leaflet_tiles.index("/", 10)].replace("{s}", "*"))
 
-        return resp
-
-    def _build_csp(self, request, resp):
-        url = resolve(request.path_info)
+        font_src = set()
+        if hasattr(request, 'event'):
+            for font in get_fonts(request.event, pdf_support_required=False).values():
+                for path in list(nested_dict_values(font)):
+                    font_location = urlparse(path)
+                    if font_location.scheme and font_location.netloc:
+                        font_src.add('{}://{}'.format(font_location.scheme, font_location.netloc))
 
         h = {
             'default-src': ["{static}"],
@@ -294,8 +288,8 @@ class SecurityMiddleware(MiddlewareMixin):
             'frame-src': ['{static}'],
             'style-src': ["{static}", "{media}"],
             'connect-src': ["{dynamic}", "{media}"],
-            'img-src': ["{static}", "{media}", "data:"],
-            'font-src': ["{static}"],
+            'img-src': ["{static}", "{media}", "data:"] + img_src,
+            'font-src': ["{static}"] + list(font_src),
             'media-src': ["{static}", "data:"],
             # form-action is not only used to match on form actions, but also on URLs
             # form-actions redirect to. In the context of e.g. payment providers or
@@ -304,13 +298,6 @@ class SecurityMiddleware(MiddlewareMixin):
             'form-action': ["{dynamic}", "https:"] + (['http:'] if settings.SITE_URL.startswith('http://') else []),
         }
 
-        gs = global_settings_object(request)
-        if gs.settings.leaflet_tiles:
-            h['img-src'].append(gs.settings.leaflet_tiles[:gs.settings.leaflet_tiles.index("/", 10)].replace("{s}", "*"))
-
-        if hasattr(request, 'event'):
-            h['font-src'] += list(self._get_font_origins(request.event))
-
         if settings.VITE_DEV_MODE:
             h['script-src'] += ["http://localhost:5173", "ws://localhost:5173"]
             h['style-src'] += ["'unsafe-inline'"]
@@ -322,7 +309,6 @@ class SecurityMiddleware(MiddlewareMixin):
             if not settings.VITE_DEV_MODE:
                 # can't have 'unsafe-inline' and nonce at the same time
                 h['style-src'].append(nonce)
-
         # Only include pay.google.com for wallet detection purposes on the Payment selection page
         if (
                 url.url_name == "event.order.pay.change" or
@@ -331,32 +317,27 @@ class SecurityMiddleware(MiddlewareMixin):
             h['script-src'].append('https://pay.google.com')
             h['frame-src'].append('https://pay.google.com')
             h['connect-src'].append('https://google.com/pay')
-
         if settings.LOG_CSP:
             h['report-uri'] = ["/csp_report/"]
-
         if 'Content-Security-Policy' in resp:
             _merge_csp(h, _parse_csp(resp['Content-Security-Policy']))
-
         if settings.CSP_ADDITIONAL_HEADER:
             _merge_csp(h, _parse_csp(settings.CSP_ADDITIONAL_HEADER))
 
-        placeholders = {
-            "{static}": ["'self'"],
-            "{dynamic}": ["'self'"],
-            "{media}": ["'self'"],
-        }
+        staticdomain = "'self'"
+        dynamicdomain = "'self'"
+        mediadomain = "'self'"
         if settings.MEDIA_URL.startswith('http'):
-            placeholders["{media}"].append(settings.MEDIA_URL[:settings.MEDIA_URL.find('/', 9)])
+            mediadomain += " " + settings.MEDIA_URL[:settings.MEDIA_URL.find('/', 9)]
         if settings.STATIC_URL.startswith('http'):
-            placeholders["{static}"].append(settings.STATIC_URL[:settings.STATIC_URL.find('/', 9)])
+            staticdomain += " " + settings.STATIC_URL[:settings.STATIC_URL.find('/', 9)]
         if settings.SITE_URL.startswith('http'):
             if settings.SITE_URL.find('/', 9) > 0:
-                placeholders["{static}"].append(settings.SITE_URL[:settings.SITE_URL.find('/', 9)])
-                placeholders["{dynamic}"].append(settings.SITE_URL[:settings.SITE_URL.find('/', 9)])
+                staticdomain += " " + settings.SITE_URL[:settings.SITE_URL.find('/', 9)]
+                dynamicdomain += " " + settings.SITE_URL[:settings.SITE_URL.find('/', 9)]
             else:
-                placeholders["{static}"].append(settings.SITE_URL)
-                placeholders["{dynamic}"].append(settings.SITE_URL)
+                staticdomain += " " + settings.SITE_URL
+                dynamicdomain += " " + settings.SITE_URL
 
         if hasattr(request, 'organizer') and request.organizer:
             if hasattr(request, 'event') and request.event:
@@ -367,29 +348,18 @@ class SecurityMiddleware(MiddlewareMixin):
                 siteurlsplit = urlsplit(settings.SITE_URL)
                 if siteurlsplit.port and siteurlsplit.port not in (80, 443):
                     domain = '%s:%d' % (domain, siteurlsplit.port)
-                placeholders["{dynamic}"].append(domain)
+                dynamicdomain += " " + domain
 
-        for k, v in h.items():
-            h[k] = sorted(set(result for part in v for result in placeholders.get(part, [part])))
+        if request.path not in self.CSP_EXEMPT and not getattr(resp, '_csp_ignore', False):
+            resp['Content-Security-Policy'] = _render_csp(h).format(static=staticdomain, dynamic=dynamicdomain,
+                                                                    media=mediadomain)
+            for k, v in h.items():
+                h[k] = sorted(set(' '.join(v).format(static=staticdomain, dynamic=dynamicdomain, media=mediadomain).split(' ')))
+            resp['Content-Security-Policy'] = _render_csp(h)
+        elif 'Content-Security-Policy' in resp:
+            del resp['Content-Security-Policy']
 
-        return h
-
-    def _get_font_origins(self, event):
-        def nested_dict_values(d):
-            for v in d.values():
-                if isinstance(v, dict):
-                    yield from nested_dict_values(v)
-                else:
-                    if isinstance(v, str):
-                        yield v
-
-        font_src = set()
-        for font in get_fonts(event, pdf_support_required=False).values():
-            for path in list(nested_dict_values(font)):
-                font_location = urlparse(path)
-                if font_location.scheme and font_location.netloc:
-                    font_src.add('{}://{}'.format(font_location.scheme, font_location.netloc))
-        return font_src
+        return resp
 
 
 class RejectInvalidInputMiddleware(MiddlewareMixin):

src/pretix/base/models/auth.py

@@ -647,22 +647,25 @@ class User(AbstractBaseUser, PermissionsMixin, LoggingMixin):
             id__in=self.teams.filter(TeamQuerySet.organizer_permission_q(permission)).values_list('organizer', flat=True)
         )
 
-    def has_active_staff_session(self, session_key):
+    def has_active_staff_session(self, session_key=None):
         """
         Returns whether or not a user has an active staff session (formerly known as superuser session)
         with the given session key.
         """
         return self.get_active_staff_session(session_key) is not None
 
-    def get_active_staff_session(self, session_key):
-        if not self.is_staff or not session_key:
+    def get_active_staff_session(self, session_key=None):
+        if not self.is_staff:
             return None
         if not hasattr(self, '_staff_session_cache'):
             self._staff_session_cache = {}
         if session_key not in self._staff_session_cache:
-            sess = StaffSession.objects.filter(
-                user=self, date_end__isnull=True, session_key=session_key
-            ).first()
+            qs = StaffSession.objects.filter(
+                user=self, date_end__isnull=True
+            )
+            if session_key:
+                qs = qs.filter(session_key=session_key)
+            sess = qs.first()
             if sess:
                 if sess.date_start < now() - timedelta(seconds=settings.PRETIX_SESSION_TIMEOUT_ABSOLUTE):
                     sess.date_end = now()

src/pretix/base/settings.py

@@ -1924,6 +1924,8 @@ DEFAULTS = {
         'serializer_class': serializers.BooleanField,
         'form_kwargs': dict(
             label=_("Hide all past dates from calendar"),
+            help_text=_("This option currently only affects the calendar of this event series, not the organizer-wide "
+                        "calendar.")
         )
     },
     'allow_modifications': {

src/pretix/celery_app.py

@@ -19,14 +19,55 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
+import logging
 import os
 
-from celery import Celery
+from celery import Celery, signals
+from django.dispatch import receiver
 
 os.environ.setdefault("DJANGO_SETTINGS_MODULE", "pretix.settings")
+logger = logging.getLogger(__name__)
 
 from django.conf import settings
 
 app = Celery('pretix')
 app.config_from_object('django.conf:settings', namespace='CELERY')
 app.autodiscover_tasks(lambda: settings.INSTALLED_APPS)
+
+
+@receiver(signals.before_task_publish)
+def on_before_task_publish(sender, body, exchange, routing_key, headers, properties, declare, retry_policy, **kwargs):
+    from pretix.helpers.logs import local
+
+    trace = getattr(local, 'trace', [])
+    request_id = getattr(local, 'request_id', None)
+    if request_id:
+        trace.append(request_id)
+
+    headers["X-Pretix-Trace"] = " ".join(trace)
+
+
+@receiver(signals.task_received)
+def on_task_received(sender, request, **kwargs):
+    trace = request._request_dict.get("X-Pretix-Trace")
+    if trace:
+        logger.info(f"Task {request.id} has trace {trace}")
+
+
+@receiver(signals.task_prerun)
+def on_task_prerun(sender, task_id, task, **kwargs):
+    from pretix.helpers.logs import local
+
+    if "X-Pretix-Trace" in task.request.headers:
+        local.trace = task.request.headers["X-Pretix-Trace"].split(" ")
+    else:
+        local.trace = []
+    local.trace.append(task_id)
+
+
+@receiver(signals.task_postrun)
+def on_task_postrun(sender, task_id, task, **kwargs):
+    from pretix.helpers.logs import local
+
+    local.request_id = None
+    local.trace = []

src/pretix/control/middleware.py

@@ -36,8 +36,7 @@ from urllib.parse import quote, urljoin, urlparse
 
 from django.conf import settings
 from django.contrib.auth import REDIRECT_FIELD_NAME, logout
-from django.contrib.auth.views import redirect_to_login
-from django.http import Http404, HttpResponse
+from django.http import Http404
 from django.shortcuts import get_object_or_404, resolve_url
 from django.template.response import TemplateResponse
 from django.urls import get_script_prefix, resolve, reverse
@@ -98,8 +97,6 @@ class PermissionMiddleware:
         super().__init__()
 
     def _login_redirect(self, request):
-        from django.contrib.auth.views import redirect_to_login
-
         # Taken from django/contrib/auth/decorators.py
         path = request.build_absolute_uri()
         # urlparse chokes on lazy objects in Python 3, force to str
@@ -112,21 +109,10 @@ class PermissionMiddleware:
         if ((not login_scheme or login_scheme == current_scheme) and
                 (not login_netloc or login_netloc == current_netloc)):
             path = request.get_full_path()
+        from django.contrib.auth.views import redirect_to_login
 
-        if request.headers.get("X-Requested-With") == "XMLHttpRequest":
-            # It's not useful to return a 302 redirect on a XMLHttpRequest request,  because
-            # the XMLHttpRequest is unable to detect redirects.
-            return HttpResponse(
-                "Authentication required",
-                status=401,
-                headers={
-                    # Appending ?next= is handled by client, because it should be the top-level context url,
-                    # not the URL called in the background
-                    "X-Login-Url": resolved_login_url,
-                }
-            )
-
-        return redirect_to_login(path, resolved_login_url, REDIRECT_FIELD_NAME)
+        return redirect_to_login(
+            path, resolved_login_url, REDIRECT_FIELD_NAME)
 
     def __call__(self, request):
         url = resolve(request.path_info)
@@ -228,15 +214,12 @@ class AuditLogMiddleware:
                 hijack_history = request.session.get('hijack_history', False)
                 hijacker = get_object_or_404(User, pk=hijack_history[0]["user"])
                 ss = hijacker.get_active_staff_session(request.session.get('hijacker_session'))
-                if not ss:
-                    # Staff session expired or not found
-                    logout(request)
-                    return redirect_to_login(request.get_full_path())
-                ss.logs.create(
-                    url=request.path,
-                    method=request.method,
-                    impersonating=request.user
-                )
+                if ss:
+                    ss.logs.create(
+                        url=request.path,
+                        method=request.method,
+                        impersonating=request.user
+                    )
             else:
                 ss = request.user.get_active_staff_session(request.session.session_key)
                 if ss:

src/pretix/control/templates/pretixcontrol/auth/login.html

@@ -56,4 +56,5 @@
     </form>
     <script type="text/plain" id="good_origin">{{ good_origin }}</script>
     <script type="text/plain" id="bad_origin_report_url">{{ bad_origin_report_url }}</script>
+    <!-- pretix-login-marker -->{# marker required for ajax calls to detect that user session is over #}
 {% endblock %}

src/pretix/control/views/users.py

@@ -31,7 +31,6 @@ from django.contrib.auth import (
 )
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.auth.views import redirect_to_login
-from django.core.exceptions import PermissionDenied
 from django.db import transaction
 from django.shortcuts import get_object_or_404, redirect
 from django.urls import reverse
@@ -222,13 +221,11 @@ class UserImpersonateView(AdministratorPermissionRequiredMixin, RecentAuthentica
 
     def post(self, request, *args, **kwargs):
         self.object = get_object_or_404(User, pk=self.kwargs.get("id"))
-        staff_session = request.user.get_active_staff_session(request.session.session_key)
         self.request.user.log_action('pretix.control.auth.user.impersonated',
                                      user=request.user,
                                      data={
                                          'other': self.kwargs.get("id"),
-                                         'other_email': self.object.email,
-                                         'staff_session': staff_session.pk,
+                                         'other_email': self.object.email
                                      })
         oldkey = request.session.session_key
 
@@ -252,12 +249,6 @@ class UserImpersonateView(AdministratorPermissionRequiredMixin, RecentAuthentica
         with signals.no_update_last_login(), keep_session_age(request.session):
             login(request, hijacked, backend=backend)
 
-        request.session.save()
-        staff_session.logs.create(
-            method='(NOTE)',
-            url=f'Begin impersonating user #{hijacked.pk} (request session {oldkey[:8]} -> {request.session.session_key[:8]})',
-        )
-
         request.session["hijack_history"] = hijack_history
 
         signals.hijack_started.send(
@@ -274,15 +265,13 @@ class UserImpersonateView(AdministratorPermissionRequiredMixin, RecentAuthentica
 class UserImpersonateStopView(LoginRequiredMixin, View):
 
     def post(self, request, *args, **kwargs):
-        staff_session_key = request.session['hijacker_session']
-        prev_session_key = request.session.session_key
+        impersonated = request.user
+
+        hijs = request.session['hijacker_session']
         hijack_history = request.session.get("hijack_history", [])
         hijacked = request.user
         prev_session = hijack_history.pop()
         hijacker = get_object_or_404(get_user_model(), pk=prev_session["user"])
-        staff_session = hijacker.get_active_staff_session(staff_session_key)
-        if not staff_session:
-            raise PermissionDenied
 
         expected_hash = salted_hmac(
             key_salt=b"hijack-history-hash",
@@ -310,22 +299,17 @@ class UserImpersonateStopView(LoginRequiredMixin, View):
             hijacked=hijacked,
         )
 
-        request.session.save()
-        staff_session.session_key = request.session.session_key
-        staff_session.save()
-
-        staff_session.logs.create(
-            method='(NOTE)',
-            url=f'Stop impersonating user #{hijacked.pk} (request session {prev_session_key[:8]}, '
-                f'staff session {staff_session_key[:8]} -> {request.session.session_key[:8]})',
-        )
+        ss = request.user.get_active_staff_session(hijs)
+        if ss:
+            request.session.save()
+            ss.session_key = request.session.session_key
+            ss.save()
 
         request.user.log_action('pretix.control.auth.user.impersonate_stopped',
                                 user=request.user,
                                 data={
-                                    'other': hijacked.pk,
-                                    'other_email': hijacked.email,
-                                    'staff_session': staff_session.pk,
+                                    'other': impersonated.pk,
+                                    'other_email': impersonated.email
                                 })
         return redirect(reverse('control:index'))
 

src/pretix/helpers/logs.py

@@ -20,6 +20,7 @@
 # <https://www.gnu.org/licenses/>.
 #
 import logging
+import uuid
 
 from django.core.signals import request_finished
 from django.dispatch import receiver
@@ -65,7 +66,9 @@ class RequestIdMiddleware:
                 import sentry_sdk
                 sentry_sdk.set_tag("request_id", request.request_id)
         else:
-            local.request_id = request.request_id = None
+            # Web server did not pass a request ID, we still generate one to correlate between django logs and
+            # celery logs
+            local.request_id = request.request_id = str(uuid.uuid4())
 
         return self.get_response(request)
 

src/pretix/plugins/webcheckin/static/pretixplugins/webcheckin/api.ts

@@ -205,8 +205,8 @@ const CSRF_TOKEN = document.querySelector<HTMLInputElement>('input[name=csrfmidd
 function handleAuthError (response: Response): void {
 	if ([401, 403].includes(response.status)) {
 		window.location.href = '/control/login?next=' + encodeURIComponent(
-			window.location.pathname + window.location.search
-		) + window.location.hash
+			window.location.pathname + window.location.search + window.location.hash
+		)
 	}
 }
 

src/pretix/presale/templates/pretixpresale/fragment_calendar.html

@@ -21,21 +21,22 @@
                             data-date="{{ day.date|date_fast:"SHORT_DATE_FORMAT" }}">
                             <p>
                             {% if day.events %}
-                                <a href="#selected-day" class="day-label event hidden-sm hidden-md hidden-lg" aria-describedby="nr-of-events-{{ day.date|date_fast:"Y-m-d" }}">
+                                <a href="#selected-day" class="day-label event hidden-sm hidden-md hidden-lg">
                                     <b aria-hidden="true">{{ day.day }}</b>
                                     <time datetime="{{ day.date|date_fast:"Y-m-d" }}" class="sr-only">
                                         {{ day.date|date_fast:"SHORT_DATE_FORMAT" }}
                                     </time>
-                                    <span class="sr-only" id="nr-of-events-{{ day.date|date_fast:"Y-m-d" }}">{% blocktrans trimmed count count=day.events|length %}
-                                        {{ count }} event
-                                    {% plural %}
-                                        {{ count }} events
-                                    {% endblocktrans %}</span>
+                                    <span class="sr-only">
+                                        ({% blocktrans trimmed count count=day.events|length %}
+                                            {{ count }} event
+                                        {% plural %}
+                                            {{ count }} events
+                                        {% endblocktrans %})
+                                    </span>
                                 </a>
                                 <time datetime="{{ day.date|date_fast:"Y-m-d" }}" class="hidden-xs">{{ day.day }}</time>
                             {% else %}
                                 <time datetime="{{ day.date|date_fast:"Y-m-d" }}" class="day-label">{{ day.day }}</time>
-                                <span class="sr-only">{% trans "No events" %}</span>
                             {% endif %}
                             </p>
                             <ul class="events">

src/pretix/presale/views/organizer.py

@@ -650,10 +650,6 @@ def add_subevents_for_days(qs, before, after, ebd, timezones, sales_channel, eve
             if hide:
                 continue
 
-        if s.event_calendar_future_only:
-            if (se.date_to or se.date_from) < time_machine_now():
-                continue
-
         timezones.add(s.timezone)
         tz = ZoneInfo(s.timezone)
         datetime_from = se.date_from.astimezone(tz)

src/pretix/settings.py

@@ -440,7 +440,6 @@ CSRF_COOKIE_NAME = 'pretix_csrftoken'
 SESSION_COOKIE_HTTPONLY = True
 
 INSTALLED_APPS += [ # noqa
-    'django_querytagger',
     'django_filters',
     'django_markup',
     'django_otp',
@@ -506,7 +505,6 @@ MIDDLEWARE = [
     'pretix.helpers.logs.RequestIdMiddleware',
     'pretix.api.middleware.IdempotencyMiddleware',
     'pretix.multidomain.middlewares.MultiDomainMiddleware',
-    'django_querytagger.middleware.SetTagMiddleware',  # after MultiDomainMiddleware for correct url resolving
     'pretix.base.middleware.CustomCommonMiddleware',
     'pretix.multidomain.middlewares.SessionMiddleware',
     'pretix.multidomain.middlewares.CsrfViewMiddleware',

src/pretix/static/pretixbase/js/asynctask.js

@@ -113,12 +113,6 @@ function async_task_check_error(jqXHR, textStatus, errorThrown) {
     "use strict";
     var respdom = $(jqXHR.responseText);
     var c = respdom.filter('.container');
-    if (jqXHR.status === 401 && jqXHR.getResponseHeader("X-Login-Url")) {
-      // Append location.hash outside the next parameter so it is not unexpectedly sent to the server
-      // The browser will keep it in the redirect.
-      window.location = jqXHR.getResponseHeader("X-Login-Url") + "?next=" + encodeURIComponent(location.pathname + location.search) + location.hash;
-      return;
-    }
     if (respdom.filter('form') && (respdom.filter('.has-error') || respdom.filter('.alert-danger'))) {
         // This is a failed form validation, let's just use it
         $("body").data('ajaxing', false);
@@ -173,12 +167,6 @@ function async_task_callback(data, jqXHR, status) {
 function async_task_error(jqXHR, textStatus, errorThrown) {
     "use strict";
     $("body").data('ajaxing', false);
-    if (jqXHR.status === 401 && jqXHR.getResponseHeader("X-Login-Url")) {
-      // Append location.hash outside the next parameter so it is not unexpectedly sent to the server
-      // The browser will keep it in the redirect.
-      window.location = jqXHR.getResponseHeader("X-Login-Url") + "?next=" + encodeURIComponent(location.pathname + location.search) + location.hash;
-      return;
-    }
     waitingDialog.hide();
     if (textStatus === "timeout") {
         alert(gettext("The request took too long. Please try again."));

src/pretix/static/pretixcontrol/js/ui/main.js

@@ -58,16 +58,13 @@ var i18nToString = function (i18nstring) {
 };
 
 $(document).ajaxError(function (event, jqXHR, settings, thrownError) {
+    waitingDialog.hide();
     var c = $(jqXHR.responseText).filter('.container');
-    if (jqXHR.status === 401 && jqXHR.getResponseHeader("X-Login-Url")) {
-        // Append location.hash outside the next parameter so it is not unexpectedly sent to the server
-        // The browser will keep it in the redirect.
-        window.location = jqXHR.getResponseHeader("X-Login-Url") + "?next=" + encodeURIComponent(location.pathname + location.search) + location.hash;
+    if (jqXHR.responseText && jqXHR.responseText.indexOf("<!-- pretix-login-marker -->") !== -1) {
+        location.href = '/control/login?next=' + encodeURIComponent(location.pathname + location.search + location.hash)
     } else if (c.length > 0) {
-        waitingDialog.hide();
         ajaxErrDialog.show(c.first().html());
     } else if (thrownError !== "abort" && thrownError !== "") {
-        waitingDialog.hide();
         console.error(event, jqXHR, settings, thrownError);
         alert(gettext('Unknown error.'));
     }

src/tests/base/test_middleware.py

@@ -126,81 +126,3 @@ class LocaleDeterminationTest(TestCase):
         response = c.get('/dummy/dummy/')
         language = response['Content-Language']
         self.assertEqual(language, 'en')
-
-
-def test_render_csp():
-    from pretix.base.middleware import _render_csp
-
-    assert _render_csp({}) == ""
-    assert _render_csp({'default-src': ["'self'"]}) == "default-src 'self'"
-
-    h = {
-        'default-src': ["'self'"],
-        'script-src': ["'self'"],
-        'object-src': ["'none'"],
-        'frame-src': ["'self'"],
-        'style-src': ["'self'", "'self'"],
-        'connect-src': ["'self'", "'self'"],
-        'img-src': ["'self'", "'self'", "data:"],
-        'font-src': ["'self'"],
-        'media-src': ["'self'", "data:"],
-        'form-action': ["'self'", "https:"],
-    }
-    assert _render_csp(h) == (
-        "default-src 'self'; script-src 'self'; object-src 'none'; frame-src 'self'; style-src 'self' 'self'; "
-        "connect-src 'self' 'self'; img-src 'self' 'self' data:; font-src 'self'; media-src 'self' data:; form-action 'self' https:"
-    )
-
-
-def test_merge_csp():
-    from pretix.base.middleware import _merge_csp, _parse_csp, _render_csp
-
-    h = {
-        'default-src': ["'self'"],
-        'script-src': ["'self'"],
-        'style-src': ["'self'", "'self'"],
-        'form-action': ["'self'", "https:"],
-        'connect-src': ["'self'", "'self'"],
-    }
-    assert _render_csp(h) == (
-        "default-src 'self'; script-src 'self'; style-src 'self' 'self'; form-action 'self' https:; connect-src 'self' 'self'"
-    )
-
-    _merge_csp(h, _parse_csp("style-src 'unsafe-inline'; connect-src https://example.com"))
-    assert _render_csp(h) == (
-        "default-src 'self'; script-src 'self'; style-src 'self' 'self' 'unsafe-inline'; form-action 'self' "
-        "https:; connect-src 'self' 'self' https://example.com"
-    )
-
-
-def test_roundtrip_csp():
-    from pretix.base.middleware import _merge_csp, _parse_csp, _render_csp
-
-    prod_csp = ("default-src 'self' https://pretix.eu https://static.pretix.cloud; script-src 'self' "
-                "'sha256-+tmFggeXIPOAC2UgcQ3LW/gPHTkwyWg3/D6FOJ5BHGo=' 'unsafe-eval' https://matomo.rami.io "
-                "https://pretix.eu https://static.pretix.cloud https://support.rami.io; object-src 'none'; "
-                "frame-src 'self' https://matomo.rami.io https://pretix.eu https://static.pretix.cloud "
-                "https://support.rami.io https://www.youtube-nocookie.com; style-src 'self' 'unsafe-inline' "
-                "data: https://cdn.pretix.cloud https://pretix.eu https://static.pretix…rt.rami.io; connect-src "
-                "'self' https://cdn.pretix.cloud https://matomo.rami.io https://pretix.eu https://static.pretix.cloud "
-                "https://support.rami.io ws://support.rami.io; img-src 'self' data: https://cdn.pretix.cloud "
-                "https://matomo.rami.io https://pretix.eu https://static.pretix.cloud https://support.rami.io; "
-                "font-src 'self' https://pretix.eu https://static.pretix.cloud; media-src 'self' data: "
-                "https://cdn.pretix.cloud https://pretix.eu https://static.pretix.cloud; form-action 'self' "
-                "https: https://pretix.eu")
-    h = _parse_csp(prod_csp)
-    _merge_csp(h, _parse_csp(prod_csp))
-    assert _render_csp(h) == prod_csp
-
-
-def test_sanitize_csp():
-    from pretix.base.middleware import _render_csp
-
-    h = {
-        'style-src': ["'self'", "https://example.com", "https://example.org https://attack.example.net", "https://\fexample.org",
-                      "https://\texample.org", "https://example.org;script-src https://example.org", ],
-        'script-src': ["'self'"],
-    }
-    assert _render_csp(h) == (
-        "style-src 'self' https://example.com; script-src 'self'"
-    )