diff --git a/src/pretix/base/payment.py b/src/pretix/base/payment.py index 03abf8e0d..122169944 100644 --- a/src/pretix/base/payment.py +++ b/src/pretix/base/payment.py @@ -750,7 +750,10 @@ class OffsettingProvider(BasePaymentProvider): def execute_refund(self, refund: OrderRefund): code = refund.info_data['orders'][0] - order = self.event.orders.get(code=code) + try: + order = Order.objects.get(code=code, event__organizer=self.event.organizer) + except Order.DoesNotExist: + raise PaymentException(_('You entered an order that could not be found.')) p = order.payments.create( state=OrderPayment.PAYMENT_STATE_PENDING, amount=refund.amount, diff --git a/src/pretix/control/views/orders.py b/src/pretix/control/views/orders.py index a2daa5ed8..492b18447 100644 --- a/src/pretix/control/views/orders.py +++ b/src/pretix/control/views/orders.py @@ -497,7 +497,8 @@ class OrderRefundView(OrderView): if offsetting_value: refund_selected += offsetting_value try: - order = Order.objects.get(code=self.request.POST.get('order-offsetting')) + order = Order.objects.get(code=self.request.POST.get('order-offsetting'), + event__organizer=self.request.organizer) except Order.DoesNotExist: messages.error(self.request, _('You entered an order that could not be found.')) is_valid = False