solidus_backend 4.8.0 → 4.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 104314666fb50bdd5e7cc3e8fbc081e1afa34eb8185ade8ce88df7d1d4b88e25
-  data.tar.gz: 57d9f572581147b66418b92effab01a8bd9119ef9c17547df745eb2424f264ce
+  metadata.gz: 1e2dd21b6547ad72960f07baf7639d4ed147cc00caa2a161f905ae28f024c25b
+  data.tar.gz: 4fc08f6ece484c6dff419fa64cf9894342adf70a03f259bf6500abccab6b11d5
 SHA512:
-  metadata.gz: c85f87960d56610de96bc3feb045f13dbddd3b8bc0fd1c5711f8fb864b81c6cabd14bc133bd484cb4ec590752057c3692bf0c3d09ce35928dd10b6c01e0a8d03
-  data.tar.gz: 88d757fb7b14d23a9d05079191287628b1c4fd57b4af2239e8019454a35569be766c2b3b3e92a64d69dc6e5f9fc20bf90b6a74600ab2ddfc5f0b771aa0d62011
+  metadata.gz: 050c816b101d8f3566b6b1555271844a619bb86cd6a8f02a08602a7ddd7842161236aa9a4bb177c445123235fea8da1ad0e7d3a46e4744efc48ef2160a2d0531
+  data.tar.gz: 6af99a26aad693f48612ca4f4a0846485cbfa3b3a1526618c977beb8dc796f7a9b0dd13c3b2e9604f35c1f0af0160936f20d310f266645c601a712bb8a62ebed

data/app/controllers/spree/admin/adjustment_reasons_controller.rb

@@ -3,6 +3,11 @@
 module Spree
   module Admin
     class AdjustmentReasonsController < ResourceController
+      private
+
+      def permitted_resource_params
+        params.require(:adjustment_reason).permit(:name, :code, :active)
+      end
     end
   end
 end

data/app/controllers/spree/admin/adjustments_controller.rb

@@ -21,6 +21,10 @@ module Spree
 
       private
 
+      def permitted_resource_params
+        params.require(:adjustment).permit(:amount, :label, :adjustment_reason_id)
+      end
+
       def find_adjustment
         # Need to assign to @object here to keep ResourceController happy
         @adjustment = @object = parent.all_adjustments.find(params[:id])

data/app/controllers/spree/admin/images_controller.rb

@@ -9,6 +9,13 @@ module Spree
 
       private
 
+      def permitted_resource_params
+        # We remove viewable_type because it is explicitly set by set_viewable.
+        # The field isn't editable with the current UI, so we don't want to
+        # allow it to be set via mass assignment.
+        params.require(:image).permit(permitted_image_attributes - [:viewable_type])
+      end
+
       def location_after_destroy
         admin_product_images_url(@product)
       end

data/app/controllers/spree/admin/option_types_controller.rb

@@ -17,6 +17,16 @@ module Spree
 
       private
 
+      def permitted_resource_params
+        attributes = permitted_option_type_attributes.map do |attribute|
+          next attribute unless attribute.is_a?(Hash) && attribute.key?(:option_values_attributes)
+
+          attribute.merge(option_values_attributes: [:id, *permitted_option_value_attributes])
+        end
+
+        params.require(:option_type).permit(attributes)
+      end
+
       def location_after_save
         edit_admin_option_type_url(@option_type)
       end

data/app/controllers/spree/admin/payment_methods_controller.rb

@@ -67,7 +67,12 @@ module Spree
       end
 
       def payment_method_params
-        params.require(:payment_method).permit!
+        params.require(:payment_method).permit(
+          :name, :description, :type, :preference_source, :auto_capture,
+          :active, :available_to_admin, :available_to_users,
+          *@payment_method_type.permitted_preference_attributes,
+          store_ids: []
+        )
       end
 
       def build_resource

data/app/controllers/spree/admin/prices_controller.rb

@@ -23,6 +23,12 @@ module Spree
 
       def edit
       end
+
+      private
+
+      def permitted_resource_params
+        params.require(:price).permit(:variant_id, :country_iso, :price, :currency)
+      end
     end
   end
 end

data/app/controllers/spree/admin/product_properties_controller.rb

@@ -10,6 +10,10 @@ module Spree
 
       private
 
+      def permitted_resource_params
+        params.require(:product_property).permit(permitted_product_properties_attributes)
+      end
+
       def find_properties
         @properties = Spree::Property.pluck(:name)
       end

data/app/controllers/spree/admin/products_controller.rb

@@ -47,6 +47,22 @@ module Spree
 
       private
 
+      def permitted_resource_params
+        # update_before may clear params[:product] when removing all product properties
+        params.require(:product).permit(
+          *(permitted_attributes.product_attributes - [:deleted_at, :option_values_hash]),
+          :slug, :meta_title, :rebuild_vat_prices, :promotionable, :track_inventory,
+          taxon_ids: [],
+          option_type_ids: [],
+          product_properties_attributes: [:id, *permitted_product_properties_attributes],
+          variant_property_rules_attributes: [
+            :id, :apply_to_all,
+            option_value_ids: [],
+            values_attributes: [:id, :property_name, :value]
+          ]
+        )
+      end
+
       def set_default_tax_category
         @product.tax_category_id ||= @default_tax_category&.id
       end

data/app/controllers/spree/admin/properties_controller.rb

@@ -9,6 +9,10 @@ module Spree
 
       private
 
+      def permitted_resource_params
+        params.require(:property).permit(permitted_property_attributes)
+      end
+
       def collection
         return @collection if @collection
         # params[:q] can be blank upon pagination

data/app/controllers/spree/admin/refund_reasons_controller.rb

@@ -3,6 +3,11 @@
 module Spree
   module Admin
     class RefundReasonsController < ResourceController
+      private
+
+      def permitted_resource_params
+        params.require(:refund_reason).permit(:name, :code, :active)
+      end
     end
   end
 end

data/app/controllers/spree/admin/refunds_controller.rb

@@ -50,7 +50,11 @@ module Spree
       end
 
       def refund_params
-        params.require(:refund).permit!
+        params.require(:refund).permit(:amount, :refund_reason_id)
+      end
+
+      def permitted_resource_params
+        params.require(:refund).permit(:refund_reason_id)
       end
 
       def build_resource

data/app/controllers/spree/admin/reimbursements_controller.rb

@@ -20,6 +20,12 @@ module Spree
 
       private
 
+      def permitted_resource_params
+        params.fetch(:reimbursement, {}).permit(
+          return_items_attributes: [:id, :amount, :override_reimbursement_type_id, :exchange_variant_id]
+        )
+      end
+
       def recalculate_order
         @reimbursement.order.recalculate
       end

data/app/controllers/spree/admin/resource_controller.rb

@@ -274,11 +274,25 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
     spree
   end
 
-  # Allow all attributes to be updatable.
+  # Any subclasses should override it to limit the params to a safe list of
+  # attributes.
   #
-  # Other controllers can, should, override it to set custom logic
+  # Previously, this method would permit all attributes, but that is not safe.
+  # That legacy behaviour is preserved here behind a configuration flag. We
+  # strongly recommend disabling the flag and implementing this method in your
+  # controller to explicitly permit only the attributes you want to allow.
   def permitted_resource_params
-    params[object_name].present? ? params.require(object_name).permit! : ActionController::Parameters.new.permit!
+    if Spree::Backend::Config.permit_all_resource_params_fallback
+      Spree.deprecator.warn(
+        "Using `permit_all_resource_params_fallback` is not safe and will be " \
+        "removed in a future version of Solidus. Please implement " \
+        "`permitted_resource_params` in your controller to explicitly permit only " \
+        "the attributes you want to allow."
+      )
+      params[object_name].present? ? params.require(object_name).permit! : ActionController::Parameters.new.permit!
+    else
+      raise NotImplementedError, "You must implement permitted_resource_params in your controller"
+    end
   end
 
   def collection_actions

data/app/controllers/spree/admin/return_authorizations_controller.rb

@@ -26,6 +26,18 @@ module Spree
 
       private
 
+      def permitted_resource_params
+        attributes = permitted_return_authorization_attributes.map do |attribute|
+          next attribute unless attribute.is_a?(Hash) && attribute.key?(:return_items_attributes)
+
+          attribute.except(:customer_metadata).merge(
+            return_items_attributes: [:id, :_destroy, :amount, *attribute[:return_items_attributes]]
+          )
+        end
+
+        params.require(:return_authorization).permit(attributes)
+      end
+
       def load_form_data
         load_return_items
         load_reimbursement_types

data/app/controllers/spree/admin/return_items_controller.rb

@@ -5,6 +5,10 @@ module Spree
     class ReturnItemsController < ResourceController
       private
 
+      def permitted_resource_params
+        params.require(:return_item).permit(:acceptance_status, :reception_status_event)
+      end
+
       def location_after_save
         url_for([:edit, :admin, @return_item.customer_return.order, @return_item.customer_return])
       end

data/app/controllers/spree/admin/return_reasons_controller.rb

@@ -3,6 +3,11 @@
 module Spree
   module Admin
     class ReturnReasonsController < ResourceController
+      private
+
+      def permitted_resource_params
+        params.require(:return_reason).permit(:name, :active)
+      end
     end
   end
 end

data/app/controllers/spree/admin/search_controller.rb

@@ -30,8 +30,6 @@ module Spree
         end
 
         @products = list_products
-        expires_in 15.minutes, public: true
-        headers["Surrogate-Control"] = "max-age=#{15.minutes}"
       end
 
       private

data/app/controllers/spree/admin/shipping_categories_controller.rb

@@ -3,6 +3,11 @@
 module Spree
   module Admin
     class ShippingCategoriesController < ResourceController
+      private
+
+      def permitted_resource_params
+        params.require(:shipping_category).permit(:name)
+      end
     end
   end
 end

data/app/controllers/spree/admin/shipping_methods_controller.rb

@@ -20,6 +20,22 @@ module Spree
 
       private
 
+      def permitted_resource_params
+        params.require(:shipping_method).permit(
+          :name, :admin_name, :code, :carrier, :service_level, :tracking_url,
+          :available_to_all, :available_to_users, :tax_category_id, :calculator_type,
+          store_ids: [],
+          stock_location_ids: [],
+          calculator_attributes: [:id, *calculator_attributes]
+        )
+      end
+
+      def calculator_attributes
+        @calculators.flat_map do |calculator_class|
+          calculator_class.permitted_preference_attributes
+        end
+      end
+
       def set_shipping_category
         return true if params["shipping_method"][:shipping_categories] == ""
         @shipping_method.shipping_categories = Spree::ShippingCategory.where(id: params["shipping_method"][:shipping_categories])

data/app/controllers/spree/admin/stock_locations_controller.rb

@@ -7,6 +7,13 @@ module Spree
 
       private
 
+      def permitted_resource_params
+        params.require(:stock_location).permit(
+          *permitted_stock_location_attributes,
+          :code, :admin_name, :default, :restock_inventory, :fulfillable, :check_stock_on_transfer
+        )
+      end
+
       def set_country
         @stock_location.country = Spree::Country.default
       rescue ActiveRecord::RecordNotFound

data/app/controllers/spree/admin/store_credit_reasons_controller.rb

@@ -3,6 +3,11 @@
 module Spree
   module Admin
     class StoreCreditReasonsController < ResourceController
+      private
+
+      def permitted_resource_params
+        params.require(:store_credit_reason).permit(:name, :active)
+      end
     end
   end
 end

data/app/controllers/spree/admin/stores_controller.rb

@@ -14,18 +14,18 @@ module Spree
       private
 
       def permitted_resource_params
-        super.tap do |store_params|
-          without_address_parameters = store_params[:address_attributes]&.except(:country_id, :state_id, :reverse_charge_status)&.compact_blank&.empty?
-          store_params.delete(:address_attributes) if without_address_parameters
+        store_params.tap do |permitted|
+          without_address_parameters = permitted[:address_attributes]&.except(:country_id, :state_id, :reverse_charge_status)&.compact_blank&.empty?
+          permitted.delete(:address_attributes) if without_address_parameters
         end
       end
 
       def store_params
-        params.require(:store).permit(permitted_params)
-      end
-
-      def permitted_params
-        Spree::PermittedAttributes.store_attributes
+        params.require(:store).permit(
+          *permitted_store_attributes,
+          :code,
+          available_locales: []
+        )
       end
     end
   end

data/app/controllers/spree/admin/tax_categories_controller.rb

@@ -3,6 +3,11 @@
 module Spree
   module Admin
     class TaxCategoriesController < ResourceController
+      private
+
+      def permitted_resource_params
+        params.require(:tax_category).permit(:name, :description, :is_default, :tax_code)
+      end
     end
   end
 end

data/app/controllers/spree/admin/tax_rates_controller.rb

@@ -7,6 +7,21 @@ module Spree
 
       private
 
+      def permitted_resource_params
+        params.require(:tax_rate).permit(
+          :name, :amount, :included_in_price, :level, :zone_id, :show_rate_in_label,
+          :starts_at, :expires_at, :calculator_type,
+          tax_category_ids: [],
+          calculator_attributes: [:id, *calculator_attributes]
+        )
+      end
+
+      def calculator_attributes
+        @calculators.flat_map do |calculator_class|
+          calculator_class.permitted_preference_attributes
+        end
+      end
+
       def load_data
         @available_zones = Spree::Zone.order(:name)
         @available_categories = Spree::TaxCategory.order(:name)

data/app/controllers/spree/admin/taxonomies_controller.rb

@@ -5,6 +5,10 @@ module Spree
     class TaxonomiesController < ResourceController
       private
 
+      def permitted_resource_params
+        params.require(:taxonomy).permit(permitted_taxonomy_attributes)
+      end
+
       def location_after_save
         if @taxonomy.created_at == @taxonomy.updated_at
           edit_admin_taxonomy_url(@taxonomy)

data/app/controllers/spree/admin/variants_controller.rb

@@ -12,6 +12,10 @@ module Spree
 
       private
 
+      def permitted_resource_params
+        params.require(:variant).permit(permitted_variant_attributes)
+      end
+
       def new_before
         @object.attributes = @object.product.master.attributes.except("id", "created_at", "deleted_at",
           "sku", "is_master")

data/app/controllers/spree/admin/zones_controller.rb

@@ -11,6 +11,10 @@ module Spree
 
       private
 
+      def permitted_resource_params
+        params.require(:zone).permit(:name, :description, :kind, country_ids: [], state_ids: [])
+      end
+
       def collection
         params[:q] ||= {}
         params[:q][:s] ||= "name asc"

data/lib/spree/backend_configuration.rb

@@ -7,6 +7,8 @@ module Spree
   class BackendConfiguration < Preferences::Configuration
     preference :locale, :string, default: I18n.default_locale
 
+    preference :permit_all_resource_params_fallback, :boolean, default: false
+
     # @!attribute [rw] themes
     #   @return [Hash] A hash containing the themes that are available for the admin panel
     preference :themes, :hash, default: {

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: solidus_backend
 version: !ruby/object:Gem::Version
-  version: 4.8.0
+  version: 4.8.1
 platform: ruby
 authors:
 - Solidus Team
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.8.0
+        version: 4.8.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.8.0
+        version: 4.8.1
 - !ruby/object:Gem::Dependency
   name: solidus_core
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.8.0
+        version: 4.8.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.8.0
+        version: 4.8.1
 - !ruby/object:Gem::Dependency
   name: font-awesome-rails
   requirement: !ruby/object:Gem::Requirement
@@ -880,7 +880,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.8.23
 requirements: []
-rubygems_version: 4.0.20
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Admin interface for the Solidus e-commerce framework.
 test_files: []