Raphael MichelandMira Weller c9781f012b [SECURITY] Centralize framebreaking logic from payment plugins to core (CVE-2026-13602) ...

- Add central framebreaker page via safelink helper
- Update paypal, paypal2 and stripe plugins to use central framebreaker
- Add CSP header to cookies.html

---------

Co-authored-by: Mira Weller <weller@pretix.eu>

2026-07-01 15:15:43 +02:00

..

autocheckin

Pluggable permissions (#5728)

2026-03-17 14:43:56 +01:00

badges

Badges: Add export layout for 4x3" on letter (Z#23232464) (#6128)

2026-04-29 15:31:54 +02:00

banktransfer

banktransfer import: Fix prefix confusion if shorter event name contains dash (Z#23234167) (#6189)

2026-05-21 13:03:30 +02:00

checkinlists

[SECURITY] Properly escape HTML tags in PDF generation (CVE-2026-57535)

2026-06-25 16:46:13 +02:00

manualpayment

Update license header (#5540)

2025-10-10 15:32:46 +02:00

paypal

[SECURITY] Centralize framebreaking logic from payment plugins to core (CVE-2026-13602)

2026-07-01 15:15:43 +02:00

paypal2

[SECURITY] Centralize framebreaking logic from payment plugins to core (CVE-2026-13602)

2026-07-01 15:15:43 +02:00

pretixdroid

Update license header (#5540)

2025-10-10 15:32:46 +02:00

reports

[SECURITY] Properly escape HTML tags in PDF generation (CVE-2026-57535)

2026-06-25 16:46:13 +02:00

returnurl

Pluggable permissions (#5728)

2026-03-17 14:43:56 +01:00

sendmail

sendmail: Add missing cleanup migration (#6158)

2026-05-11 14:53:47 +02:00

statistics

Pluggable permissions (#5728)

2026-03-17 14:43:56 +01:00

stripe

[SECURITY] Centralize framebreaking logic from payment plugins to core (CVE-2026-13602)

2026-07-01 15:15:43 +02:00

ticketoutputpdf

[SECURITY] Add missing session check for cached files (CVE-2026-9712)

2026-05-27 16:27:42 +02:00

webcheckin

Migrate vue2 control components and widget to vue3 and vite (#5989)

2026-05-11 15:05:06 +02:00

__init__.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00