Raphael Michel d10d061e45 Merge branch 'check-csp' into 'master' ...

Check CSP components before rendering, prevent format string traversal

See merge request pretix/pretix!33

2026-07-03 10:26:23 +02:00

..

customersso

Rename confusingly named helpers for URL generation (#6280)

2026-06-22 09:11:55 +02:00

datasync

Rename confusingly named helpers for URL generation (#6280)

2026-06-22 09:11:55 +02:00

exporters

Rename confusingly named helpers for URL generation (#6280)

2026-06-22 09:11:55 +02:00

forms

Improve error messages for name-parts inputs (Z#23234440) (#6187)

2026-05-19 15:23:30 +02:00

invoicing

[SECURITY] Properly escape HTML tags in PDF generation (CVE-2026-57535)

2026-06-25 16:46:13 +02:00

management

Devex: Fix vite devserver capturing stdin (#6267)

2026-06-11 16:25:48 +02:00

migrations

Add support for multiple linked_orderpositions on reusable media (#5666)

2026-06-03 09:12:24 +02:00

models

include settings attribute during type checking (#6323)

2026-07-01 11:32:54 +02:00

secretgenerators

Update license header (#5540)

2025-10-10 15:32:46 +02:00

services

Improve voucher import unique code checks (#6311)

2026-06-29 14:37:41 +02:00

templates

[SECURITY] Centralize framebreaking logic from payment plugins to core (CVE-2026-13602)

2026-07-01 15:15:43 +02:00

templatetags

Fix flake8 issue

2026-07-01 18:01:50 +02:00

views

[SECURITY] Centralize framebreaking logic from payment plugins to core (CVE-2026-13602)

2026-07-01 15:15:43 +02:00

__init__.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

addressvalidation.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

apps.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

auth.py

Pluggable permissions (#5728)

2026-03-17 14:43:56 +01:00

banlist.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

cache.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

channels.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

context.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

decimal.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

email.py

SSRF protection: Edge case handling for CGNAT and v4/v6 mapping (Z#23236468) (#6260)

2026-06-26 16:45:20 +02:00

exporter.py

Exporters: Give access to authentication infos and allow empty permissions (#5979)

2026-04-02 15:44:36 +02:00

i18n.py

Fix babel locale discovery for zh_Hans_US

2026-01-23 11:36:12 +01:00

invoice.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

logentrytype_registry.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

logentrytypes.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

media.py

Check-in API: Add reusable media exchange (#6115)

2026-06-11 16:25:13 +02:00

metrics.py

Use OrderPosition.all instead of .objects in metrics (#6285)

2026-06-21 12:46:07 +02:00

middleware.py

Check CSP components before rendering, prevent format string traversal

2026-07-03 10:26:23 +02:00

modelimport_orders.py

Fix translation for order import (#6165)

2026-05-12 09:03:34 +02:00

modelimport_vouchers.py

Vouchers: Fix field label inconsistency (Z#23222887) (#5902)

2026-02-17 10:16:12 +01:00

modelimport.py

Order import: handle mixed endings of last line (Z#23230806) (#6066)

2026-04-08 13:25:38 +02:00

notifications.py

Rename confusingly named helpers for URL generation (#6280)

2026-06-22 09:11:55 +02:00

payment.py

Rename confusingly named helpers for URL generation (#6280)

2026-06-22 09:11:55 +02:00

pdf.py

[SECURITY] Properly escape HTML tags in PDF generation (CVE-2026-57535)

2026-06-25 16:46:13 +02:00

permissions.py

Pluggable permissions (#5728)

2026-03-17 14:43:56 +01:00

plugins.py

Respect per-event plugin availability in OrganizerPluginEvents view (#5983)

2026-05-04 11:34:05 +02:00

reldate.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

secrets.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

settings.py

Organizer calendar: Respect event_calendar_future_only (Z#23238776) (#6326)

2026-07-02 14:31:44 +02:00

shredder.py

Mail: Handle all rendering in mail.py, return values for log (#5895)

2026-03-10 09:53:09 +01:00

signals.py

Update django to 5.2

2026-03-24 16:33:28 +01:00

ticketoutput.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

timeframes.py

Fix incorrect type annotation

2026-03-09 17:48:38 +01:00

timeline.py

Pluggable permissions (#5728)

2026-03-17 14:43:56 +01:00

timemachine.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

validators.py

Add NoUrlValidator to validators (#6208)

2026-05-22 13:51:28 +02:00