Cancel orders (fixing #24)

src/pretix/presale/templates/pretixpresale/event/order.html

@@ -47,10 +47,10 @@
     {% if order.status == "n" %}
         <div class="row">
             <div class="col-md-12 text-right">
-                <form action="" method="post">
-                    {% csrf_token %}
-                    <button type="submit" class="btn btn-danger">{% trans "Cancel order" %}</button>
-                </form>
+                <p>
+                    <a href="{% url 'presale:event.order.cancel' event=request.event.slug organizer=request.event.organizer.slug order=order.code %}"
+                       class="btn btn-danger">{% trans "Cancel order" %}</a>
+                </p>
             </div>
         </div>
     {% endif %}

src/pretix/presale/templates/pretixpresale/event/order_cancel.html

@@ -0,0 +1,32 @@
+{% extends "pretixpresale/event/base.html" %}
+{% load i18n %}
+{% block title %}{% trans "Cancel order" %}{% endblock %}
+{% block content %}
+    <h2>
+        {% blocktrans trimmed with code=order.code %}
+            Cancel order: {{ code }}
+        {% endblocktrans %}
+    </h2>
+    <p>{% blocktrans trimmed %}
+        Do you really want to cancel this order? You cannot revert this action.
+    {% endblocktrans %}</p>
+
+    <form method="post" href="">
+        {% csrf_token %}
+        <div class="row checkout-button-row">
+            <div class="col-md-4">
+                <a class="btn btn-block btn-default btn-lg"
+                   href="{% url "presale:event.order" event=request.event.slug organizer=request.event.organizer.slug order=order.code %}">
+                    {% trans "No, take me back" %}
+                </a>
+            </div>
+            <div class="col-md-4 col-md-offset-4">
+                <button class="btn btn-block btn-danger btn-lg" type="submit">
+                    {% trans "Yes, cancel order" %}
+                </button>
+            </div>
+            <div class="clearfix"></div>
+        </div>
+    </form>
+
+{% endblock %}

src/pretix/presale/urls.py

@@ -21,6 +21,8 @@ urlpatterns = patterns(
                 name='event.checkout.confirm'),
             url(r'^order/(?P<order>[^/]+)/$', pretix.presale.views.order.OrderDetails.as_view(),
                 name='event.order'),
+            url(r'^order/(?P<order>[^/]+)/cancel$', pretix.presale.views.order.OrderCancel.as_view(),
+                name='event.order.cancel'),
             url(r'^login$', pretix.presale.views.event.EventLogin.as_view(), name='event.checkout.login'),
         )
     )),

src/pretix/presale/views/order.py

@@ -1,15 +1,16 @@
 from itertools import groupby
-from django.db.models import Q
+from django.core.urlresolvers import reverse
+from django.shortcuts import redirect
+from django.utils.translation import ugettext_lazy as _
 from django.utils.functional import cached_property
 from django.views.generic import TemplateView
-from django.http import HttpResponseNotFound
+from django.http import HttpResponseNotFound, HttpResponseForbidden
 from pretix.base.models import Order, OrderPosition
 from pretix.base.signals import register_payment_providers
 from pretix.presale.views import EventViewMixin, EventLoginRequiredMixin, CartDisplayMixin
 
 
-class OrderDetails(EventViewMixin, EventLoginRequiredMixin, CartDisplayMixin, TemplateView):
-    template_name = "pretixpresale/event/order.html"
+class OrderDetailMixin:
 
     @cached_property
     def order(self):
@@ -18,14 +19,19 @@ class OrderDetails(EventViewMixin, EventLoginRequiredMixin, CartDisplayMixin, Te
                 user=self.request.user,
                 event=self.request.event,
                 code=self.kwargs['order'],
-            )
+                )
         except Order.DoesNotExist:
             return None
 
+
+class OrderDetails(EventViewMixin, EventLoginRequiredMixin, OrderDetailMixin,
+                   CartDisplayMixin, TemplateView):
+    template_name = "pretixpresale/event/order.html"
+
     def get(self, request, *args, **kwargs):
         self.kwargs = kwargs
         if not self.order:
-            return HttpResponseNotFound
+            return HttpResponseNotFound(_('Unknown order code or order does belong to another user.'))
         return super().get(request, *args, **kwargs)
 
     def itemlist_cartlike(self):
@@ -88,3 +94,36 @@ class OrderDetails(EventViewMixin, EventLoginRequiredMixin, CartDisplayMixin, Te
         elif self.order.status == Order.STATUS_PAID:
             ctx['payment'] = self.payment_provider.order_paid_render(self.request, self.order)
         return ctx
+
+
+class OrderCancel(EventViewMixin, EventLoginRequiredMixin, OrderDetailMixin,
+                  TemplateView):
+    template_name = "pretixpresale/event/order_cancel.html"
+
+    def post(self, request, *args, **kwargs):
+        self.kwargs = kwargs
+        if not self.order:
+            return HttpResponseNotFound(_('Unknown order code or order does belong to another user.'))
+        if self.order.status != Order.STATUS_PENDING:
+            return HttpResponseForbidden(_('You cannot cancel this order'))
+        order = self.order.clone()
+        order.status = Order.STATUS_CANCELLED
+        order.save()
+        return redirect(reverse('presale:event.order', kwargs={
+            'event': self.request.event.slug,
+            'organizer': self.request.event.organizer.slug,
+            'order': order.code,
+        }))
+
+    def get(self, request, *args, **kwargs):
+        self.kwargs = kwargs
+        if not self.order:
+            return HttpResponseNotFound(_('Unknown order code or order does belong to another user.'))
+        if self.order.status != Order.STATUS_PENDING:
+            return HttpResponseForbidden(_('You cannot cancel this order'))
+        return super().get(request, *args, **kwargs)
+
+    def get_context_data(self, **kwargs):
+        ctx = super().get_context_data(**kwargs)
+        ctx['order'] = self.order
+        return ctx