Stripe: Lock payment object while processing refund

src/pretix/plugins/stripe/payment.py

@@ -11,6 +11,7 @@ from django import forms
 from django.conf import settings
 from django.contrib import messages
 from django.core import signing
+from django.db import transaction
 from django.http import HttpRequest
 from django.template.loader import get_template
 from django.urls import reverse
@@ -491,10 +492,12 @@ class StripeMethod(BasePaymentProvider):
         }
         return template.render(ctx)
 
+    @transaction.atomic()
     def execute_refund(self, refund: OrderRefund):
         self._init_api()
 
         payment_info = refund.payment.info_data
+        OrderPayment.objects.select_for_update().get(pk=refund.payment.pk)
 
         if not payment_info:
             raise PaymentException(_('No payment information found.'))

src/pretix/plugins/stripe/views.py

@@ -238,12 +238,13 @@ def charge_webhook(event, event_json, charge_id, rso):
             return HttpResponse('Order not found', status=200)
         payment = None
 
+    with transaction.atomic():
         if not payment:
             payment = order.payments.filter(
                 info__icontains=charge['id'],
                 provider__startswith='stripe',
                 amount=prov._amount_to_decimal(charge['amount']),
-        ).last()
+            ).select_for_update().last()
         if not payment:
             payment = order.payments.create(
                 state=OrderPayment.PAYMENT_STATE_CREATED,