Do not allow self-service cancel of pending orders if they have any payments

src/pretix/base/models/orders.py

@@ -638,12 +638,13 @@ class Order(LockModel, LoggedModel):
                 return False
         if self.user_cancel_deadline and now() > self.user_cancel_deadline:
             return False
-        if self.status == Order.STATUS_PENDING:
+
-            return self.event.settings.cancel_allow_user
+        if self.status == Order.STATUS_PAID or self.payment_refund_sum > Decimal('0.00'):
-        elif self.status == Order.STATUS_PAID:
             if self.total == Decimal('0.00'):
                 return self.event.settings.cancel_allow_user
             return self.event.settings.cancel_allow_user_paid
+        elif self.status == Order.STATUS_PENDING:
+            return self.event.settings.cancel_allow_user
         return False
 
     def propose_auto_refunds(self, amount: Decimal, payments: list=None):

src/tests/presale/test_orders.py

@@ -710,6 +710,21 @@ class OrdersTest(BaseOrdersTest):
         with scopes_disabled():
             assert self.order.refunds.count() == 0
 
+    def test_orders_cancel_forbidden_if_any_payment_made(self):
+        self.event.settings.set('cancel_allow_user', True)
+        self.event.settings.set('cancel_allow_user_paid', False)
+        with scopes_disabled():
+            self.order.payments.create(
+                state=OrderPayment.PAYMENT_STATE_CONFIRMED,
+                amount=12,
+                provider='manual',
+            )
+        self.client.post(
+            '/%s/%s/order/%s/%s/cancel/do' % (self.orga.slug, self.event.slug, self.order.code, self.order.secret), {
+            }, follow=True)
+        self.order.refresh_from_db()
+        assert self.order.status == Order.STATUS_PENDING
+
     def test_orders_cancel_forbidden(self):
         self.event.settings.set('cancel_allow_user', False)
         self.client.post(