shopify_app 8.2.2 → 8.2.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 93440d005afce88a4646870516c40726b913cd0f
-  data.tar.gz: 5a7731dba7c7b5137260482d8dc6e9e54390b47f
+  metadata.gz: e1662a396a08cd1ba5550280392d00fe2886e0ca
+  data.tar.gz: 8b8744e2ae2ece532aa36973cc6057642cba49cd
 SHA512:
-  metadata.gz: 989f10667b7db17df7836a1c7fcff04b6ed6fa26f6c6e23580d1905d02e1e4badd1c676da3b476b367ac9c9ee2c86d2dcfe3ceb08878eb308fa0f3fba471b3ef
-  data.tar.gz: 4324ad1083d794cf274275bb7064226dee041f9fd384d2c904f0bc178d47b61da97a01f26b2aac52976f47a59f336fbcc1e67d5ed5473a54a37be08e44395344
+  metadata.gz: 1cd6fd0df8ecddb2dfc28a5cd301dac2606cb729e62261d7363a06c7044568466eb9ee13fa2225f1a599b3c7c7bacdb53cbc7fe5f73597437abcd59b156e0128
+  data.tar.gz: 0f1ef949777a3f65b857b69e2bb328db7b449450cd7ac3fc3eb3924106791e6fd91dc40a4f1bd2d25026685f5e33bc0e02449e10cc5c33bf03b7651615a753a0

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+8.2.4
+-----
+* Add CSRF protection through `protect_from_forgery with: :exception` on `ShopifyApp::AuthenticatedController`
+
+8.2.3
+-----
+* Send head :forbidden instead of :unauthorized when AppProxyVerification fails
+
 8.2.2
 -----
 * Changes how the ESDK concern allows iframes. Fixes an issue with the first request for some people

data/README.md

@@ -8,6 +8,7 @@ Shopify App
 
 Shopify Application Rails engine and generator
 
+#### NOTE : Versions 8.0.0 through 8.2.3 contained a CSRF vulnerability that was addressed in version 8.2.4. Please update to version 8.2.4 if you're using an old version.
 
 Table of Contents
 -----------------
@@ -275,20 +276,27 @@ ShopifyApp.configure do |config|
 end
 ```
 
-If you'd rather implement your own controller then you'll want to use the WebhookVerfication module to verify your webhooks:
+If you'd rather implement your own controller then you'll want to use the WebhookVerfication module to verify your webhooks, example:
 
 ```ruby
 class CustomWebhooksController < ApplicationController
   include ShopifyApp::WebhookVerification
 
   def carts_update
-    SomeJob.perform_later(shopify_domain: shop_domain, webhook: params)
-    head :ok
+    params.permit!
+    SomeJob.perform_later(shop_domain: shop_domain, webhook: webhook_params.to_h)
+    head :no_content
+  end
+
+  private
+
+  def webhook_params
+    params.except(:controller, :action, :type)
   end
 end
 ```
 
-The module skips the `verify_authenticity_token` before_action and adds an action to verify that the webhook came from Shopify.
+The module skips the `verify_authenticity_token` before_action and adds an action to verify that the webhook came from Shopify. You can now add a post route to your application pointing to the controller and action to accept the webhook data from Shopify.
 
 The WebhooksManager uses ActiveJob, if ActiveJob is not configured then by default Rails will run the jobs inline. However it is highly recommended to configure a proper background processing queue like sidekiq or resque in production.
 

data/app/controllers/shopify_app/authenticated_controller.rb

@@ -4,6 +4,7 @@ module ShopifyApp
     include ShopifyApp::LoginProtection
     include ShopifyApp::EmbeddedApp
 
+    protect_from_forgery with: :exception
     before_action :login_again_if_different_shop
     around_action :shopify_session
   end

data/app/controllers/shopify_app/webhooks_controller.rb

@@ -5,7 +5,7 @@ module ShopifyApp
     class ShopifyApp::MissingWebhookJobError < StandardError; end
 
     def receive
-      params.try(:permit!)
+      params.permit!
       job_args = {shop_domain: shop_domain, webhook: webhook_params.to_h}
       webhook_job_klass.perform_later(job_args)
       head :no_content

data/lib/generators/shopify_app/install/templates/_flash_messages.html.erb

@@ -1,8 +1,8 @@
 <% content_for :javascript do %>
 <script type="text/javascript">
-  var eventName = typeof(Turbolinks) !== 'undefined' ? 'page:change' : 'DOMContentLoaded';
+  var eventName = typeof(Turbolinks) !== 'undefined' ? 'turbolinks:load' : 'DOMContentLoaded';
 
-  document.addEventListener(eventName, function() {
+  document.addEventListener(eventName, function flash() {
     <% if flash[:notice] %>
       ShopifyApp.flashNotice("<%= j flash[:notice].html_safe %>");
     <% end %>
@@ -10,6 +10,8 @@
     <% if flash[:error] %>
       ShopifyApp.flashError("<%= j flash[:error].html_safe %>");
     <% end %>
+                             
+    document.removeEventListener(eventName, flash)
   });
 </script>
 <% end %>

data/lib/shopify_app/controller_concerns/app_proxy_verification.rb

@@ -8,7 +8,7 @@ module ShopifyApp
     end
 
     def verify_proxy_request
-      return head :unauthorized unless query_string_valid?(request.query_string)
+      return head :forbidden unless query_string_valid?(request.query_string)
     end
 
     private

data/lib/shopify_app/version.rb

@@ -1,3 +1,3 @@
 module ShopifyApp
-  VERSION = '8.2.2'
+  VERSION = '8.2.4'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: shopify_app
 version: !ruby/object:Gem::Version
-  version: 8.2.2
+  version: 8.2.4
 platform: ruby
 authors:
 - Shopify
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-10-06 00:00:00.000000000 Z
+date: 2017-11-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -215,7 +215,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.5.2
+rubygems_version: 2.5.2.1
 signing_key: 
 specification_version: 4
 summary: This gem is used to get quickly started with the Shopify API