solidus_core 4.6.2 → 4.6.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 54346c8f091dd2395832f0e0118d80c50e52f6fc7bda852c0147164061f28055
-  data.tar.gz: 445ada16ce8a53ae7f4904fdacae27215954de7f2f1387a39ae4f6b8c8ee73be
+  metadata.gz: 9ab7d28a51c8f5ad031bf0613a5dc1c3fddff295f09edf5032ee6b5173d22ca3
+  data.tar.gz: 4e5e1b57bb62eeff08f426242c042603eb8112804afaca7490b618739fc4e564
 SHA512:
-  metadata.gz: 92d7572979dddd22c078e452a0ade011ac4f230876ea24cbb130917d7c088086d316685e2efe6618d73ed5317a24aa17aeb9376cb6d18c4a4704c56f0f3caf51
-  data.tar.gz: e815c14e8992cdb3549c44711338c43e24f8dfe2195b6f0540b9427f0f7043832d94e7f78c32028af579ea842a53a8edbb53714d5fa7ee97fda962e12b8b19c6
+  metadata.gz: 9a04c4401ce4d6b775b9f0ef450315941cc944722429d8cbc066d8f608ffd567b41d6aa53060ce1fe90a76292676b359c0ca15d6255a59f54cbeaea3dfa02c20
+  data.tar.gz: a178b017f4121166d78af2ce80ce2ba9dbbfc04e87c677f30d0bca86874f4c02ee2cd3511b3b2cb5caef70cf2c5ffdbc85ef8a8afa4c721381b3e490eb4458bb

data/app/helpers/spree/core/controller_helpers/strong_parameters.rb

@@ -14,19 +14,19 @@ module Spree
 
         def permitted_credit_card_update_attributes
           permitted_attributes.credit_card_update_attributes + [
-            address_attributes: permitted_address_attributes
+            { address_attributes: permitted_address_attributes }
           ]
         end
 
         def permitted_payment_attributes
           permitted_attributes.payment_attributes + [
-            source_attributes: permitted_source_attributes
+            { source_attributes: permitted_source_attributes }
           ]
         end
 
         def permitted_source_attributes
           permitted_attributes.source_attributes + [
-            address_attributes: permitted_address_attributes
+            { address_attributes: permitted_address_attributes }
           ]
         end
 
@@ -52,20 +52,22 @@ module Spree
             permitted_checkout_payment_attributes +
             permitted_attributes.customer_metadata_attributes +
             permitted_checkout_confirm_attributes + [
-            line_items_attributes: permitted_line_item_attributes
+            { line_items_attributes: permitted_line_item_attributes }
           ]
         end
 
         def permitted_product_attributes
           permitted_attributes.product_attributes + [
-            product_properties_attributes: permitted_product_properties_attributes
+            { product_properties_attributes: permitted_product_properties_attributes }
           ]
         end
 
         def permitted_user_attributes
           permitted_attributes.user_attributes + [
-            bill_address_attributes: permitted_address_attributes,
-            ship_address_attributes: permitted_address_attributes
+            {
+              bill_address_attributes: permitted_address_attributes,
+              ship_address_attributes: permitted_address_attributes
+            }
           ]
         end
       end

data/app/helpers/spree/products_helper.rb

@@ -49,7 +49,7 @@ module Spree
       if Spree::Config[:show_raw_product_description]
         raw(product.description)
       else
-        raw(product.description.gsub(/(.*?)\r?\n\r?\n/m, '<p>\1</p>'))
+        sanitize(product.description.gsub(/(.*?)\r?\n\r?\n/m, '<p>\1</p>'))
       end
     end
 

data/app/models/concerns/spree/user_methods.rb

@@ -130,14 +130,14 @@ module Spree
 
     # Updates the roles in keeping with the given ability's permissions
     #
-    # Roles that are not accessible to the given ability will be ignored. It
-    # also ensure not to remove non accessible roles when assigning new
-    # accessible ones.
+    # Roles that the given ability cannot manage will be ignored. It also
+    # ensure not to remove non manageable roles when assigning new manageable
+    # ones.
     #
     # @param given_roles [Spree::Role]
     # @param ability [Spree::Ability]
     def update_spree_roles(given_roles, ability:)
-      accessible_roles = Spree::Role.accessible_by(ability)
+      accessible_roles = Spree::Role.accessible_by(ability, :manage)
       non_accessible_roles = Spree::Role.all - accessible_roles
       new_accessible_roles = given_roles - non_accessible_roles
       self.spree_roles = spree_roles - accessible_roles + new_accessible_roles

data/app/models/spree/payment_create.rb

@@ -8,6 +8,10 @@ module Spree
     #   * :payment_method_id Id of payment method used for this payment
     #   * :source_attributes Attributes used to build the source of this payment. Usually a {CreditCard}
     #     * :wallet_payment_source_id (Integer): The id of a {WalletPaymentSource} to use
+    #     * :gateway_customer_profile_id, :gateway_payment_profile_id (String): Gateway
+    #       identifiers for a new {CreditCard}, e.g. a one-time token. Raises
+    #       ActiveRecord::RecordNotFound if either already belongs to a {CreditCard}
+    #       owned by a different user.
     # @param request_env [Hash] rack env of user creating the payment
     # @param payment [Payment] Internal use only. Instead of making a new payment, change the attributes for an existing one.
     def initialize(order, attributes, payment: nil, request_env: {})
@@ -44,6 +48,7 @@ module Spree
     def build_source
       payment_method = payment.payment_method
       if source_attributes.present? && payment_method.try(:payment_source_class)
+        ensure_gateway_profile_ownership!(payment_method.payment_source_class)
         payment.source = payment_method.payment_source_class.new(source_attributes)
         payment.source.payment_method_id = payment_method.id
         if order && payment.source.respond_to?(:user=)
@@ -52,6 +57,24 @@ module Spree
       end
     end
 
+    # Gateway profile ids may only be submitted for a new source when they are
+    # unknown to the store (e.g. a one-time token) or already belong to the
+    # order's user. Raises if either id is stored on a {CreditCard} owned by a
+    # different user, so customers cannot pay with another customer's stored
+    # gateway credential.
+    def ensure_gateway_profile_ownership!(source_class)
+      return unless source_class <= Spree::CreditCard
+
+      %i[gateway_customer_profile_id gateway_payment_profile_id].each do |attribute|
+        value = source_attributes[attribute]
+        next if value.blank?
+
+        foreign_cards = Spree::CreditCard.where(attribute => value).where.not(user_id: nil)
+        foreign_cards = foreign_cards.where.not(user_id: order.user_id) if order&.user_id
+        raise ActiveRecord::RecordNotFound if foreign_cards.exists?
+      end
+    end
+
     def build_from_wallet_payment_source
       wallet_payment_source_id = source_attributes.fetch(:wallet_payment_source_id)
       raise(ActiveRecord::RecordNotFound) if order.user.nil?

data/app/models/spree/permission_sets/default_customer.rb

@@ -63,18 +63,18 @@ module Spree
         can :create, ReturnAuthorization do |return_authorization|
           return_authorization.order.user == user
         end
-        can [:read, :update], CreditCard, user_id: user.id
+        can [:read, :update], CreditCard, user_id: user.id if user.persisted?
         can :read, Product
         can :read, ProductProperty
         can :read, Property
         can :create, Spree.user_class
-        can [:show, :update, :update_email], Spree.user_class, id: user.id
+        can [:show, :update, :update_email], Spree.user_class, id: user.id if user.persisted?
         can :read, State
         can :read, StockItem, stock_location: { active: true }
         can :read, StockLocation, active: true
         can :read, Taxon
         can :read, Taxonomy
-        can [:save_in_address_book, :remove_from_address_book], Spree.user_class, id: user.id
+        can [:save_in_address_book, :remove_from_address_book], Spree.user_class, id: user.id if user.persisted?
         can [:read, :view_out_of_stock], Variant
         can :read, Zone
       end

data/app/models/spree/product.rb

@@ -147,6 +147,11 @@ module Spree
       super || Spree::TaxCategory.find_by(is_default: true)
     end
 
+    # @return [Integer] tax category id for this product, or the default tax category id
+    def tax_category_id
+      super || tax_category&.id
+    end
+
     # Ensures option_types and product_option_types exist for keys in
     # option_values_hash.
     #
@@ -359,14 +364,17 @@ module Spree
       run_callbacks(:touch)
     end
 
-    # Iterate through this product's taxons and taxonomies and touch their timestamps in a batch
+    # Iterate through this product's taxons and taxonomies and touch their timestamps
     def touch_taxons
-      taxons_to_touch = taxons.flat_map(&:self_and_ancestors).uniq
-      unless taxons_to_touch.empty?
-        Spree::Taxon.where(id: taxons_to_touch.map(&:id)).update_all(updated_at: Time.current)
+      taxons_to_touch = taxons.flat_map(&:self_and_ancestors).uniq.sort_by(&:id)
+      return if taxons_to_touch.empty?
+
+      time = Time.current
+      taxons_to_touch.each { |taxon| taxon.update_column(:updated_at, time) }
 
-        taxonomy_ids_to_touch = taxons_to_touch.flat_map(&:taxonomy_id).uniq
-        Spree::Taxonomy.where(id: taxonomy_ids_to_touch).update_all(updated_at: Time.current)
+      taxonomy_ids_to_touch = taxons_to_touch.map(&:taxonomy_id).uniq
+      Spree::Taxonomy.where(id: taxonomy_ids_to_touch).order(:id).each do |taxonomy|
+        taxonomy.touch(time:)
       end
     end
 

data/app/models/spree/return_item.rb

@@ -41,6 +41,7 @@ module Spree
 
     validate :eligible_exchange_variant
     validate :belongs_to_same_customer_order
+    validate :belongs_to_return_authorization_order, if: -> { inventory_unit_id_changed? || return_authorization_id_changed? }
     validate :validate_acceptance_status_for_reimbursement
     validate :validate_no_other_completed_return_items
 
@@ -177,16 +178,16 @@ module Spree
       exchange_requested? || sibling_intended_for_exchange('unexchanged')
     end
 
+    def currency
+      return_authorization.try(:currency) || Spree::Config[:currency]
+    end
+
     private
 
     def persist_acceptance_status_errors
       update(acceptance_status_errors: validator.errors)
     end
 
-    def currency
-      return_authorization.try(:currency) || Spree::Config[:currency]
-    end
-
     def process_inventory_unit!
       inventory_unit.return!
 
@@ -225,6 +226,14 @@ module Spree
       end
     end
 
+    def belongs_to_return_authorization_order
+      return unless return_authorization && inventory_unit
+
+      if return_authorization.order_id != inventory_unit.order_id
+        errors.add(:base, I18n.t("spree.return_items_cannot_be_associated_with_multiple_orders"))
+      end
+    end
+
     def eligible_exchange_variant
       return unless exchange_variant && exchange_variant_id_changed?
       unless eligible_exchange_variants.include?(exchange_variant)

data/app/models/spree/taxon.rb

@@ -141,8 +141,11 @@ module Spree
     private
 
     def touch_ancestors_and_taxonomy
-      # Touches all ancestors at once to avoid recursive taxonomy touch, and reduce queries.
-      self.class.default_scoped.where(id: ancestors.pluck(:id)).update_all(updated_at: Time.current)
+      # Touches ancestors directly rather than through #touch to avoid a recursive taxonomy touch.
+      time = Time.current
+      self.class.default_scoped.where(id: ancestors.pluck(:id)).order(:id).each do |ancestor|
+        ancestor.update_column(:updated_at, time)
+      end
       # Have taxonomy touch happen in #touch_ancestors_and_taxonomy rather than association option in order for imports to override.
       taxonomy.try!(:touch)
     end

data/app/models/spree/user_address.rb

@@ -25,6 +25,6 @@ module Spree
       all
     }
 
-    default_scope -> { order([default: :desc, updated_at: :desc]) }
+    default_scope -> { order([{ default: :desc, updated_at: :desc }]) }
   end
 end

data/app/models/spree/variant/vat_price_generator.rb

@@ -25,6 +25,7 @@ module Spree
       def run
         # Early return if there is no VAT rates in the current store.
         return if !variant.tax_category || variant_vat_rates.empty?
+        return if variant.default_price&.amount.nil?
 
         country_isos_requiring_price.each do |country_iso|
           # Don't re-create the default price

data/app/views/layouts/spree/base_mailer.html.erb

@@ -3,6 +3,7 @@
 <head>
 	<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
 	<meta name="viewport" content="width=device-width">
+	<%# The Ink CSS below is MIT licensed; see ink.license.txt in this directory. %>
 	<style>
 /**********************************************
 * Ink v1.0.5 - Copyright 2013 ZURB Inc        *

data/app/views/layouts/spree/ink.license.txt

@@ -0,0 +1,28 @@
+The mailer layout in this directory (base_mailer.html.erb) inlines the
+CSS of Ink v1.0.5, ZURB's responsive email framework, from
+https://github.com/foundation/foundation-emails (formerly zurb/ink).
+
+--------------------------------------------------------------------------------
+
+Copyright (c) 2013 ZURB, inc.
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/db/migrate/20180322142651_add_amount_remaining_to_store_credit_events.rb

@@ -36,7 +36,6 @@ class AddAmountRemainingToStoreCreditEvents < ActiveRecord::Migration[5.0]
           # These actions do not change the amount_remaining so the previous
           # amount available is used (either the credit's amount or the
           # amount_remaining coming from the event right before this one).
-          credit_amount
         when StoreCredit::AUTHORIZE_ACTION,
              StoreCredit::INVALIDATE_ACTION
           # These actions remove the amount from the available credit amount.

data/lib/spree/core/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Spree
-  VERSION = "4.6.2"
+  VERSION = "4.6.4"
 
   def self.solidus_version = VERSION
 

data/lib/spree/permitted_attributes.rb

@@ -73,7 +73,7 @@ module Spree
 
     @@option_type_attributes = [:name, :presentation, option_values_attributes: option_value_attributes]
 
-    @@payment_attributes = [:amount, :payment_method_id, :payment_method, customer_metadata: {}]
+    @@payment_attributes = [:payment_method_id, :payment_method, customer_metadata: {}]
 
     @@product_properties_attributes = [:property_name, :value, :position]
 
@@ -165,6 +165,7 @@ module Spree
 
     @@checkout_payment_attributes = [
       payments_attributes: payment_attributes + [
+        :amount,
         source_attributes:
       ]
     ]

data/lib/spree/testing_support/factories/return_item_factory.rb

@@ -2,7 +2,15 @@
 
 FactoryBot.define do
   factory :return_item, class: 'Spree::ReturnItem' do
-    association(:inventory_unit, factory: :inventory_unit, state: :shipped)
+    inventory_unit do
+      # When a return authorization is given, the inventory unit must belong
+      # to the same order.
+      if __override_names__.include?(:return_authorization) && return_authorization&.order
+        association(:inventory_unit, state: :shipped, order: return_authorization.order)
+      else
+        association(:inventory_unit, state: :shipped)
+      end
+    end
     association(:return_reason, factory: :return_reason)
     return_authorization do |_return_item|
       build(:return_authorization, order: inventory_unit.order)

data/lib/spree/testing_support/factories/store_credit_event_factory.rb

@@ -8,11 +8,11 @@ FactoryBot.define do
     action               { Spree::StoreCredit::AUTHORIZE_ACTION }
 
     factory :store_credit_auth_event, class: 'Spree::StoreCreditEvent' do
-      action             { Spree::StoreCredit::AUTHORIZE_ACTION }
+      action { Spree::StoreCredit::AUTHORIZE_ACTION }
     end
 
     factory :store_credit_capture_event do
-      action             { Spree::StoreCredit::CAPTURE_ACTION }
+      action { Spree::StoreCredit::CAPTURE_ACTION }
     end
 
     factory :store_credit_adjustment_event do

data/lib/spree/testing_support/order_walkthrough.rb

@@ -10,7 +10,7 @@ module Spree
       def up_to(state, user: nil)
         # Need to create a valid zone too...
         @zone = ::FactoryBot.create(:zone)
-        @country = ::FactoryBot.create(:country)
+        @country = Spree::Country.find_by(iso: "US") || ::FactoryBot.create(:country)
         @state = ::FactoryBot.create(:state, country: @country)
 
         @zone.members << Spree::ZoneMember.create(zoneable: @country)

data/vendor/assets/javascripts/jquery.payment.license.txt

@@ -0,0 +1,25 @@
+This license covers the vendored jQuery.payment v1.3.2 (jquery.payment.js
+in this directory), from https://github.com/stripe-archive/jquery.payment.
+
+--------------------------------------------------------------------------------
+
+Copyright (c) 2014 Stripe
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/vendor/assets/javascripts/jsuri.license.txt

@@ -0,0 +1,12 @@
+This license covers the vendored jsUri v1.1.1 (jsuri.js in this
+directory), from https://github.com/derek-watson/jsUri.
+
+--------------------------------------------------------------------------------
+
+Copyright (c) 2014, Derek Watson
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: solidus_core
 version: !ruby/object:Gem::Version
-  version: 4.6.2
+  version: 4.6.4
 platform: ruby
 authors:
 - Solidus Team
@@ -768,6 +768,7 @@ files:
 - app/subscribers/spree/order_mailer_subscriber.rb
 - app/subscribers/spree/reimbursement_mailer_subscriber.rb
 - app/views/layouts/spree/base_mailer.html.erb
+- app/views/layouts/spree/ink.license.txt
 - app/views/spree/carton_mailer/shipped_email.html.erb
 - app/views/spree/carton_mailer/shipped_email.text.erb
 - app/views/spree/order_mailer/cancel_email.html.erb
@@ -1070,7 +1071,9 @@ files:
 - lib/tasks/solidus/delete_prices_with_nil_amount.rake
 - solidus_core.gemspec
 - vendor/assets/javascripts/jquery.payment.js
+- vendor/assets/javascripts/jquery.payment.license.txt
 - vendor/assets/javascripts/jsuri.js
+- vendor/assets/javascripts/jsuri.license.txt
 - vendor/assets/stylesheets/normalize.css
 homepage: http://solidus.io
 licenses:
@@ -1114,7 +1117,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.8.23
 requirements: []
-rubygems_version: 3.7.2
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Essential models, mailers, and classes for the Solidus e-commerce project.
 test_files: []