solidus_core 3.1.4 → 3.1.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cabe9b97feb5c88754e6be9c0cb22e63977a3972805c725f88861bfa2c3d8beb
-  data.tar.gz: 3c44f84249aa9dba36fa4afba31ae40943cf80b4484d8adf979c946374b25904
+  metadata.gz: 17023a55872c98530a41d6e9dcfa86f9cb2273d6bda4f90138414fef73faf408
+  data.tar.gz: 025eea8e4777138faceebbd8c8747a1529c0d56218ac908e2a42c12ef69da5b0
 SHA512:
-  metadata.gz: b488346a08197d39759e4781fdfe087daeb362b76a6f4dd4262c730e7eda328c55a427f7a503c2c301e286814b82106dff5339602e927fc38bf7152f40c1be2c
-  data.tar.gz: 2156b59d9f751645dfcb80a5905d990d2e65945ee60733181eda7e3ba49b2a4a4628517c00c4179560e2ec06af73842047fd8aa1b65d8f99bb4f04ada1c871a3
+  metadata.gz: 10b6f6770fdb30bd9b2269731fbc749c32221f37c8c04c1034bf3a8621869c52df31669d80cf2d47d5f4b04eaa25305ab36f1dcda72a3aaa06fa53eda0f492b4
+  data.tar.gz: 62b8b420c98f055c40faea148d36769a33d7cb3e6a878dcc0a930ecf0b3b40195f6421a4e2d7150c4086770f4bdb42c2bcdca0a4c947f6bd8ab42903c799bda0

data/app/models/concerns/spree/active_storage_adapter/attachment.rb

@@ -30,7 +30,9 @@ module Spree
         size = style_to_size(style)
         @attachment.variant(
           resize_to_limit: size,
-          strip: true
+          saver: {
+            strip: true
+          }
         ).processed
       end
 
@@ -58,7 +60,7 @@ module Spree
       end
 
       def normalize_styles(styles)
-        styles.transform_values { |v| v.split('x') }
+        styles.transform_values { |v| v.split('x').map(&:to_i) }
       end
 
       def style_to_size(style)

data/app/models/spree/log_entry.rb

@@ -2,10 +2,83 @@
 
 module Spree
   class LogEntry < Spree::Base
+    # Classes used in core that can be present in serialized details
+    #
+    # Users can add their own classes in
+    # `Spree::Config#log_entry_permitted_classes`.
+    #
+    # @see Spree::AppConfiguration#log_entry_permitted_classes
+    CORE_PERMITTED_CLASSES = [
+      ActiveMerchant::Billing::Response,
+      ActiveSupport::TimeWithZone,
+      Time,
+      ActiveSupport::TimeZone
+    ].freeze
+
+    # Raised when a disallowed class is tried to be loaded
+    class DisallowedClass < RuntimeError
+      attr_reader :psych_exception
+
+      def initialize(psych_exception:)
+        @psych_exception = psych_exception
+        super(default_message)
+      end
+
+      private
+
+      def default_message
+        <<~MSG
+          #{psych_exception.message}
+
+          You can specify custom classes to be loaded in config/initializers/spree.rb. E.g:
+
+          Spree.config do |config|
+            config.log_entry_permitted_classes = ['MyClass']
+          end
+        MSG
+      end
+    end
+
+    # Raised when YAML contains aliases and they're not enabled
+    class BadAlias < RuntimeError
+      attr_reader :psych_exception
+
+      def initialize(psych_exception:)
+        @psych_exception = psych_exception
+        super(default_message)
+      end
+
+      private
+
+      def default_message
+        <<~MSG
+          #{psych_exception.message}
+
+          You can explicitly enable aliases in config/initializers/spree.rb. E.g:
+
+          Spree.config do |config|
+            config.log_entry_allow_aliases = true
+          end
+        MSG
+      end
+    end
+
+    def self.permitted_classes
+      CORE_PERMITTED_CLASSES + Spree::Config.log_entry_permitted_classes.map(&:constantize)
+    end
+
     belongs_to :source, polymorphic: true, optional: true
 
     def parsed_details
-      @details ||= YAML.load(details)
+      @details ||= YAML.safe_load(
+        details,
+        permitted_classes: self.class.permitted_classes,
+        aliases: Spree::Config.log_entry_allow_aliases
+      )
+    rescue Psych::DisallowedClass => e
+      raise DisallowedClass.new(psych_exception: e)
+    rescue Psych::BadAlias => e
+      raise BadAlias.new(psych_exception: e)
     end
   end
 end

data/app/models/spree/order_shipping.rb

@@ -62,18 +62,15 @@ class Spree::OrderShipping
     end
 
     inventory_units.map(&:shipment).uniq.each do |shipment|
-      # Temporarily propagate the tracking number to the shipment as well
-      # TODO: Remove tracking numbers from shipments.
-      shipment.update!(tracking: tracking_number)
-
-      next unless shipment.inventory_units.reload.all? { |iu| iu.shipped? || iu.canceled? }
-      # TODO: make OrderShipping#ship_shipment call Shipment#ship! rather than
-      # having Shipment#ship! call OrderShipping#ship_shipment. We only really
-      # need this `update_columns` for the specs, until we make that change.
-      shipment.update_columns(state: 'shipped', shipped_at: Time.current)
+      if shipment.inventory_units.reload.all? { |iu| iu.shipped? || iu.canceled? }
+        shipment.update!(state: "shipped", shipped_at: Time.current, tracking: tracking_number)
+      else
+        shipment.update!(tracking: tracking_number)
+      end
     end
 
     send_shipment_emails(carton) if stock_location.fulfillable? && !suppress_mailer # e.g. digital gift cards that aren't actually shipped
+    @order.shipments.reload
     @order.recalculate
 
     carton

data/app/models/spree/product.rb

@@ -45,6 +45,7 @@ module Spree
 
     has_many :variants,
       -> { where(is_master: false).order(:position) },
+      inverse_of: :product,
       class_name: 'Spree::Variant'
 
     has_many :variants_including_master,

data/app/models/spree/promotion_code.rb

@@ -5,12 +5,12 @@ class Spree::PromotionCode < Spree::Base
   belongs_to :promotion_code_batch, class_name: "Spree::PromotionCodeBatch", optional: true
   has_many :adjustments
 
+  before_validation :normalize_code
+
   validates :value, presence: true, uniqueness: { allow_blank: true, case_sensitive: true }
   validates :promotion, presence: true
   validate :promotion_not_apply_automatically, on: :create
 
-  before_save :normalize_code
-
   self.whitelisted_ransackable_attributes = ['value']
 
   # Whether the promotion code has exceeded its usage restrictions

data/app/models/spree/refund.rb

@@ -31,6 +31,14 @@ module Spree
       end
     end
 
+    # Sets this price's amount to a new value, parsing it if the new value is
+    # a string.
+    #
+    # @param price [String, #to_d] a new amount
+    def amount=(price)
+      self[:amount] = Spree::LocalizedNumber.parse(price)
+    end
+
     def description
       payment.payment_method.name
     end

data/app/models/spree/store_credit.rb

@@ -40,6 +40,14 @@ class Spree::StoreCredit < Spree::PaymentSource
   extend Spree::DisplayMoney
   money_methods :amount, :amount_used, :amount_authorized
 
+  # Sets this store credit's amount to a new value,
+  # parsing it as a localized number if the new value is a string.
+  #
+  # @param number [String, #to_d] a new amount
+  def amount=(number)
+    self[:amount] = Spree::LocalizedNumber.parse(number)
+  end
+
   def amount_remaining
     return 0.0.to_d if invalidated?
     amount - amount_used - amount_authorized

data/lib/generators/solidus/install/install_generator.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'rails/generators'
+require 'rails/version'
 
 module Solidus
   # @private
@@ -15,7 +16,7 @@ module Solidus
     class_option :migrate, type: :boolean, default: true, banner: 'Run Solidus migrations'
     class_option :seed, type: :boolean, default: true, banner: 'Load seed data (migrations must be run)'
     class_option :sample, type: :boolean, default: true, banner: 'Load sample data (migrations must be run)'
-    class_option :active_storage, type: :boolean, default: true, banner: 'Install ActiveStorage as image attachments handler for products and taxons'
+    class_option :active_storage, type: :boolean, default: Rails.gem_version >= Gem::Version.new("6.1.0"), banner: 'Install ActiveStorage as image attachments handler for products and taxons'
     class_option :auto_accept, type: :boolean
     class_option :user_class, type: :string
     class_option :admin_email, type: :string

data/lib/spree/app_configuration.rb

@@ -165,6 +165,22 @@ module Spree
     #   @return [String] URL of logo used on frontend (default: +'logo/solidus.svg'+)
     preference :logo, :string, default: 'logo/solidus.svg'
 
+    # @!attribute [rw] log_entry_permitted_classes
+    #   @return [Array<String>] An array of extra classes that are allowed to be
+    #     loaded from a serialized YAML as details in {Spree::LogEntry}
+    #     (defaults to a non-frozen empty array, so that extensions can add
+    #     their own classes).
+    #   @example
+    #     config.log_entry_permitted_classes = ['Date']
+    preference :log_entry_permitted_classes, :array, default: []
+
+    # @!attribute [rw] log_entry_allow_aliases
+    #   @return [Boolean] Whether YAML aliases are allowed when loading
+    #     serialized data in {Spree::LogEntry}. It defaults to true. Depending
+    #     on the source of your data, you may consider disabling it to prevent
+    #     entity expansion attacks.
+    preference :log_entry_allow_aliases, :boolean, default: true
+
     # @!attribute [rw] mails_from
     #   @return [String] Email address used as +From:+ field in transactional emails.
     preference :mails_from, :string, default: 'solidus@example.com'

data/lib/spree/core/engine.rb

@@ -15,6 +15,12 @@ module Spree
         generator.test_framework :rspec
       end
 
+      if ActiveRecord.respond_to?(:yaml_column_permitted_classes) || ActiveRecord::Base.respond_to?(:yaml_column_permitted_classes)
+        config.active_record.yaml_column_permitted_classes ||= []
+        config.active_record.yaml_column_permitted_classes |=
+          [Symbol, BigDecimal, ActiveSupport::HashWithIndifferentAccess]
+      end
+
       initializer "spree.environment", before: :load_config_initializers do |app|
         app.config.spree = Spree::Config.environment
       end

data/lib/spree/core/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Spree
-  VERSION = "3.1.4"
+  VERSION = "3.1.7"
 
   def self.solidus_version
     VERSION

data/lib/spree/testing_support/dummy_app.rb

@@ -96,6 +96,7 @@ module DummyApp
           }
         }
         config.active_storage.service = :test
+        config.active_storage.variant_processor = ENV.fetch('ACTIVE_STORAGE_VARIANT_PROCESSOR', :mini_magick).to_sym
       end
     end
 

data/lib/spree/testing_support/factories/user_factory.rb

@@ -21,6 +21,12 @@ FactoryBot.define do
       end
     end
 
+    trait :with_orders do
+      after(:create) do |user, _|
+        create(:order, user: user)
+      end
+    end
+
     factory :admin_user do
       after(:create) do |user, _|
         admin_role = Spree::Role.find_by(name: 'admin') || create(:role, name: 'admin')

data/solidus_core.gemspec

@@ -40,6 +40,7 @@ Gem::Specification.new do |s|
   s.add_dependency 'mini_magick', '~> 4.10'
   s.add_dependency 'monetize', '~> 1.8'
   s.add_dependency 'kt-paperclip', '~> 6.3'
+  s.add_dependency 'psych', ['>= 3.1.0', '< 5.0']
   s.add_dependency 'ransack', '~> 2.0'
   s.add_dependency 'state_machines-activerecord', '~> 0.6'
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: solidus_core
 version: !ruby/object:Gem::Version
-  version: 3.1.4
+  version: 3.1.7
 platform: ruby
 authors:
 - Solidus Team
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-12-07 00:00:00.000000000 Z
+date: 2022-07-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionmailer
@@ -344,6 +344,26 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '6.3'
+- !ruby/object:Gem::Dependency
+  name: psych
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.1.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '5.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.1.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '5.0'
 - !ruby/object:Gem::Dependency
   name: ransack
   requirement: !ruby/object:Gem::Requirement