Raphael MichelandGitHub 4a4cff3c41 Drop all csp_ignore statements from core (except stripe, for now) (#6337) ...

* Add proper CSP policy for HTML email preview

* Handle safe types centrally

* Precompile schema validation function to get rid of ajv2020

* Fix tests

* adjust more tests

2026-07-15 09:39:42 +02:00

..

customersso

Rename confusingly named helpers for URL generation (#6280)

2026-06-22 09:11:55 +02:00

datasync

Rename confusingly named helpers for URL generation (#6280)

2026-06-22 09:11:55 +02:00

exporters

Rename confusingly named helpers for URL generation (#6280)

2026-06-22 09:11:55 +02:00

forms

Question form: Do not store invalid False values for required boolean questions (Z#23239887) (#6366)

2026-07-10 16:42:10 +02:00

invoicing

[SECURITY] Properly escape HTML tags in PDF generation (CVE-2026-57535)

2026-06-25 16:46:13 +02:00

management

Fix isort

2026-07-07 15:43:00 +02:00

migrations

Drop nullability on Order.organizer and OrderPosition.organizer (#4278)

2026-07-07 17:44:19 +02:00

models

Use SafeStrings for plugin signals returning HTML that should be rendered (#6343)

2026-07-09 17:50:26 +02:00

secretgenerators

Update license header (#5540)

2025-10-10 15:32:46 +02:00

services

Revert "Update redis requirement from ==7.4.* to ==8.0.* (#6226)"

2026-07-09 00:45:32 +02:00

templates

Improve admin-facing email templates (#6216)

2026-07-06 17:25:52 +02:00

templatetags

Use SafeStrings for plugin signals returning HTML that should be rendered (#6343)

2026-07-09 17:50:26 +02:00

views

Fix customer views using wrong csrf middleware (#6027)

2026-07-10 13:25:40 +02:00

__init__.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

addressvalidation.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

apps.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

auth.py

Pluggable permissions (#5728)

2026-03-17 14:43:56 +01:00

banlist.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

cache.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

channels.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

context.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

decimal.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

email.py

SSRF protection: Edge case handling for CGNAT and v4/v6 mapping (Z#23236468) (#6260)

2026-06-26 16:45:20 +02:00

exporter.py

Exporters: Give access to authentication infos and allow empty permissions (#5979)

2026-04-02 15:44:36 +02:00

i18n.py

Fix babel locale discovery for zh_Hans_US

2026-01-23 11:36:12 +01:00

invoice.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

logentrytype_registry.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

logentrytypes.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

media.py

Check-in API: Add reusable media exchange (#6115)

2026-06-11 16:25:13 +02:00

metrics.py

Use OrderPosition.all instead of .objects in metrics (#6285)

2026-06-21 12:46:07 +02:00

middleware.py

Drop all csp_ignore statements from core (except stripe, for now) (#6337)

2026-07-15 09:39:42 +02:00

modelimport_orders.py

Fix translation for order import (#6165)

2026-05-12 09:03:34 +02:00

modelimport_vouchers.py

Vouchers: Fix field label inconsistency (Z#23222887) (#5902)

2026-02-17 10:16:12 +01:00

modelimport.py

Order import: handle mixed endings of last line (Z#23230806) (#6066)

2026-04-08 13:25:38 +02:00

notifications.py

Rename confusingly named helpers for URL generation (#6280)

2026-06-22 09:11:55 +02:00

payment.py

Add base class for historical payment providers (#6336)

2026-07-10 11:10:32 +02:00

pdf.py

Add event placeholder support to more fields (#6098)

2026-07-06 17:18:04 +02:00

permissions.py

Pluggable permissions (#5728)

2026-03-17 14:43:56 +01:00

plugins.py

Respect per-event plugin availability in OrganizerPluginEvents view (#5983)

2026-05-04 11:34:05 +02:00

reldate.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

secrets.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

settings.py

Add contact URL setting (#6132)

2026-07-06 17:49:55 +02:00

shredder.py

Mail: Handle all rendering in mail.py, return values for log (#5895)

2026-03-10 09:53:09 +01:00

signals.py

Use SafeStrings for plugin signals returning HTML that should be rendered (#6343)

2026-07-09 17:50:26 +02:00

ticketoutput.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

timeframes.py

Fix incorrect type annotation

2026-03-09 17:48:38 +01:00

timeline.py

Pluggable permissions (#5728)

2026-03-17 14:43:56 +01:00

timemachine.py

Update license header (#5540)

2025-10-10 15:32:46 +02:00

validators.py

Add NoUrlValidator to validators (#6208)

2026-05-22 13:51:28 +02:00