diff --git a/src/pretix/api/views/order.py b/src/pretix/api/views/order.py index c90f5e8d07..c24c81495a 100644 --- a/src/pretix/api/views/order.py +++ b/src/pretix/api/views/order.py @@ -1669,6 +1669,9 @@ class PaymentViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet): else: mark_refunded = request.data.get('mark_canceled', False) + if not isinstance(request.data.get("comment", ""), str): + return Response({'comment': 'Invalid type.'}, status=status.HTTP_400_BAD_REQUEST) + if payment.state != OrderPayment.PAYMENT_STATE_CONFIRMED: return Response({'detail': 'Invalid state of payment.'}, status=status.HTTP_400_BAD_REQUEST) @@ -1695,6 +1698,7 @@ class PaymentViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet): amount=amount, provider=payment.provider, info='{}', + comment=request.data.get("comment"), ) payment.order.log_action('pretix.event.order.refund.created', { 'local_id': r.local_id, diff --git a/src/tests/api/test_orders.py b/src/tests/api/test_orders.py index e4cc678faa..da721db9ab 100644 --- a/src/tests/api/test_orders.py +++ b/src/tests/api/test_orders.py @@ -845,6 +845,7 @@ def test_payment_refund_success(token_client, organizer, event, order, monkeypat organizer.slug, event.slug, order.code, p1.local_id ), format='json', data={ 'amount': '23.00', + 'comment': 'Foo', 'mark_canceled': False, }) assert resp.status_code == 200 @@ -853,6 +854,7 @@ def test_payment_refund_success(token_client, organizer, event, order, monkeypat assert r.provider == "stripe" assert r.state == OrderRefund.REFUND_STATE_DONE assert r.source == OrderRefund.REFUND_SOURCE_ADMIN + assert r.comment == "Foo" @pytest.mark.django_db