From 72e3438632452d477805e889519d9af1aa2d03b2 Mon Sep 17 00:00:00 2001
From: Kara Engelhardt <engelhardt@pretix.eu>
Date: Mon, 27 Apr 2026 15:10:09 +0200
Subject: [PATCH] Ignore expiry date for payments created via api (Z#23232671)

---
 src/pretix/api/views/order.py |  4 +++-
 src/tests/api/test_orders.py  | 28 ++++++++++++++++++++++++++++
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/src/pretix/api/views/order.py b/src/pretix/api/views/order.py
index 850ff06615..e94665d7ee 100644
--- a/src/pretix/api/views/order.py
+++ b/src/pretix/api/views/order.py
@@ -1658,6 +1658,7 @@ class PaymentViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet):
                         count_waitinglist=False,
                         force=request.data.get('force', False),
                         send_mail=send_mail,
+                        ignore_date=True,
                     )
                 except Quota.QuotaExceededException:
                     pass
@@ -1693,7 +1694,8 @@ class PaymentViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet):
                             auth=self.request.auth,
                             count_waitinglist=False,
                             send_mail=send_mail,
-                            force=force)
+                            force=force,
+                            ignore_date=True)
         except Quota.QuotaExceededException as e:
             return Response({'detail': str(e)}, status=status.HTTP_400_BAD_REQUEST)
         except PaymentException as e:
diff --git a/src/tests/api/test_orders.py b/src/tests/api/test_orders.py
index 570178974c..77ea17edc6 100644
--- a/src/tests/api/test_orders.py
+++ b/src/tests/api/test_orders.py
@@ -730,6 +730,34 @@ def test_payment_create_confirmed(token_client, organizer, event, order):
     assert len(djmail.outbox) == 0
 
 
+@pytest.mark.django_db
+def test_payment_create_confirmed_after_expiry(token_client, organizer, event, order):
+    djmail.outbox = []
+    order.expires = now() - datetime.timedelta(days=2)
+    order.save()
+    event.settings.payment_term_last = (now() - datetime.timedelta(days=2)).strftime('%Y-%m-%d')
+
+    resp = token_client.post('/api/v1/organizers/{}/events/{}/orders/{}/payments/'.format(
+        organizer.slug, event.slug, order.code
+    ), format='json', data={
+        'provider': 'banktransfer',
+        'state': 'confirmed',
+        'amount': order.total,
+        'send_email': False,
+        'info': {
+            'foo': 'bar'
+        }
+    })
+    with scopes_disabled():
+        p = order.payments.last()
+    assert resp.status_code == 201
+    assert p.state == OrderPayment.PAYMENT_STATE_CONFIRMED
+    assert p.info_data == {'foo': 'bar'}
+    order.refresh_from_db()
+    assert order.status == Order.STATUS_PAID
+    assert len(djmail.outbox) == 0
+
+
 @pytest.mark.django_db
 def test_payment_create_pending(token_client, organizer, event, order):
     resp = token_client.post('/api/v1/organizers/{}/events/{}/orders/{}/payments/'.format(