solidus_core 4.6.3 → 4.6.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 03c5f9ed344221d9efde0c16e7d40604521c067f36abbf3e09b050fbc9efd3de
-  data.tar.gz: 920e1ac4c8266d2110c1eed180d5ffe32e8d16bab3a92ff02eab5446ecba6a2c
+  metadata.gz: 9ab7d28a51c8f5ad031bf0613a5dc1c3fddff295f09edf5032ee6b5173d22ca3
+  data.tar.gz: 4e5e1b57bb62eeff08f426242c042603eb8112804afaca7490b618739fc4e564
 SHA512:
-  metadata.gz: 3f81fd0110e433d54dc81e4f73f9f3c0e3dfc37a81c30a443ea2e9c72d0e9882362e917f121b917bfac36300cd2aae7495eec86b40c624873c4cfc5d070d6bf8
-  data.tar.gz: 3cedf567b53ad2a9ddee3b4da7f863787092c9d72daccc7fbd02fa4244d9447a1a8a5e3a84c9eeec080b759e57656c8a56dd3ae173f982283cb531169e715aed
+  metadata.gz: 9a04c4401ce4d6b775b9f0ef450315941cc944722429d8cbc066d8f608ffd567b41d6aa53060ce1fe90a76292676b359c0ca15d6255a59f54cbeaea3dfa02c20
+  data.tar.gz: a178b017f4121166d78af2ce80ce2ba9dbbfc04e87c677f30d0bca86874f4c02ee2cd3511b3b2cb5caef70cf2c5ffdbc85ef8a8afa4c721381b3e490eb4458bb

data/app/helpers/spree/core/controller_helpers/strong_parameters.rb

@@ -14,19 +14,19 @@ module Spree
 
         def permitted_credit_card_update_attributes
           permitted_attributes.credit_card_update_attributes + [
-            address_attributes: permitted_address_attributes
+            { address_attributes: permitted_address_attributes }
           ]
         end
 
         def permitted_payment_attributes
           permitted_attributes.payment_attributes + [
-            source_attributes: permitted_source_attributes
+            { source_attributes: permitted_source_attributes }
           ]
         end
 
         def permitted_source_attributes
           permitted_attributes.source_attributes + [
-            address_attributes: permitted_address_attributes
+            { address_attributes: permitted_address_attributes }
           ]
         end
 
@@ -52,20 +52,22 @@ module Spree
             permitted_checkout_payment_attributes +
             permitted_attributes.customer_metadata_attributes +
             permitted_checkout_confirm_attributes + [
-            line_items_attributes: permitted_line_item_attributes
+            { line_items_attributes: permitted_line_item_attributes }
           ]
         end
 
         def permitted_product_attributes
           permitted_attributes.product_attributes + [
-            product_properties_attributes: permitted_product_properties_attributes
+            { product_properties_attributes: permitted_product_properties_attributes }
           ]
         end
 
         def permitted_user_attributes
           permitted_attributes.user_attributes + [
-            bill_address_attributes: permitted_address_attributes,
-            ship_address_attributes: permitted_address_attributes
+            {
+              bill_address_attributes: permitted_address_attributes,
+              ship_address_attributes: permitted_address_attributes
+            }
           ]
         end
       end

data/app/helpers/spree/products_helper.rb

@@ -49,7 +49,7 @@ module Spree
       if Spree::Config[:show_raw_product_description]
         raw(product.description)
       else
-        raw(product.description.gsub(/(.*?)\r?\n\r?\n/m, '<p>\1</p>'))
+        sanitize(product.description.gsub(/(.*?)\r?\n\r?\n/m, '<p>\1</p>'))
       end
     end
 

data/app/models/concerns/spree/user_methods.rb

@@ -130,14 +130,14 @@ module Spree
 
     # Updates the roles in keeping with the given ability's permissions
     #
-    # Roles that are not accessible to the given ability will be ignored. It
-    # also ensure not to remove non accessible roles when assigning new
-    # accessible ones.
+    # Roles that the given ability cannot manage will be ignored. It also
+    # ensure not to remove non manageable roles when assigning new manageable
+    # ones.
     #
     # @param given_roles [Spree::Role]
     # @param ability [Spree::Ability]
     def update_spree_roles(given_roles, ability:)
-      accessible_roles = Spree::Role.accessible_by(ability)
+      accessible_roles = Spree::Role.accessible_by(ability, :manage)
       non_accessible_roles = Spree::Role.all - accessible_roles
       new_accessible_roles = given_roles - non_accessible_roles
       self.spree_roles = spree_roles - accessible_roles + new_accessible_roles

data/app/models/spree/payment_create.rb

@@ -8,6 +8,10 @@ module Spree
     #   * :payment_method_id Id of payment method used for this payment
     #   * :source_attributes Attributes used to build the source of this payment. Usually a {CreditCard}
     #     * :wallet_payment_source_id (Integer): The id of a {WalletPaymentSource} to use
+    #     * :gateway_customer_profile_id, :gateway_payment_profile_id (String): Gateway
+    #       identifiers for a new {CreditCard}, e.g. a one-time token. Raises
+    #       ActiveRecord::RecordNotFound if either already belongs to a {CreditCard}
+    #       owned by a different user.
     # @param request_env [Hash] rack env of user creating the payment
     # @param payment [Payment] Internal use only. Instead of making a new payment, change the attributes for an existing one.
     def initialize(order, attributes, payment: nil, request_env: {})
@@ -44,6 +48,7 @@ module Spree
     def build_source
       payment_method = payment.payment_method
       if source_attributes.present? && payment_method.try(:payment_source_class)
+        ensure_gateway_profile_ownership!(payment_method.payment_source_class)
         payment.source = payment_method.payment_source_class.new(source_attributes)
         payment.source.payment_method_id = payment_method.id
         if order && payment.source.respond_to?(:user=)
@@ -52,6 +57,24 @@ module Spree
       end
     end
 
+    # Gateway profile ids may only be submitted for a new source when they are
+    # unknown to the store (e.g. a one-time token) or already belong to the
+    # order's user. Raises if either id is stored on a {CreditCard} owned by a
+    # different user, so customers cannot pay with another customer's stored
+    # gateway credential.
+    def ensure_gateway_profile_ownership!(source_class)
+      return unless source_class <= Spree::CreditCard
+
+      %i[gateway_customer_profile_id gateway_payment_profile_id].each do |attribute|
+        value = source_attributes[attribute]
+        next if value.blank?
+
+        foreign_cards = Spree::CreditCard.where(attribute => value).where.not(user_id: nil)
+        foreign_cards = foreign_cards.where.not(user_id: order.user_id) if order&.user_id
+        raise ActiveRecord::RecordNotFound if foreign_cards.exists?
+      end
+    end
+
     def build_from_wallet_payment_source
       wallet_payment_source_id = source_attributes.fetch(:wallet_payment_source_id)
       raise(ActiveRecord::RecordNotFound) if order.user.nil?

data/app/models/spree/product.rb

@@ -364,14 +364,17 @@ module Spree
       run_callbacks(:touch)
     end
 
-    # Iterate through this product's taxons and taxonomies and touch their timestamps in a batch
+    # Iterate through this product's taxons and taxonomies and touch their timestamps
     def touch_taxons
-      taxons_to_touch = taxons.flat_map(&:self_and_ancestors).uniq
-      unless taxons_to_touch.empty?
-        Spree::Taxon.where(id: taxons_to_touch.map(&:id)).update_all(updated_at: Time.current)
+      taxons_to_touch = taxons.flat_map(&:self_and_ancestors).uniq.sort_by(&:id)
+      return if taxons_to_touch.empty?
 
-        taxonomy_ids_to_touch = taxons_to_touch.flat_map(&:taxonomy_id).uniq
-        Spree::Taxonomy.where(id: taxonomy_ids_to_touch).update_all(updated_at: Time.current)
+      time = Time.current
+      taxons_to_touch.each { |taxon| taxon.update_column(:updated_at, time) }
+
+      taxonomy_ids_to_touch = taxons_to_touch.map(&:taxonomy_id).uniq
+      Spree::Taxonomy.where(id: taxonomy_ids_to_touch).order(:id).each do |taxonomy|
+        taxonomy.touch(time:)
       end
     end
 

data/app/models/spree/return_item.rb

@@ -41,6 +41,7 @@ module Spree
 
     validate :eligible_exchange_variant
     validate :belongs_to_same_customer_order
+    validate :belongs_to_return_authorization_order, if: -> { inventory_unit_id_changed? || return_authorization_id_changed? }
     validate :validate_acceptance_status_for_reimbursement
     validate :validate_no_other_completed_return_items
 
@@ -225,6 +226,14 @@ module Spree
       end
     end
 
+    def belongs_to_return_authorization_order
+      return unless return_authorization && inventory_unit
+
+      if return_authorization.order_id != inventory_unit.order_id
+        errors.add(:base, I18n.t("spree.return_items_cannot_be_associated_with_multiple_orders"))
+      end
+    end
+
     def eligible_exchange_variant
       return unless exchange_variant && exchange_variant_id_changed?
       unless eligible_exchange_variants.include?(exchange_variant)

data/app/models/spree/taxon.rb

@@ -141,8 +141,11 @@ module Spree
     private
 
     def touch_ancestors_and_taxonomy
-      # Touches all ancestors at once to avoid recursive taxonomy touch, and reduce queries.
-      self.class.default_scoped.where(id: ancestors.pluck(:id)).update_all(updated_at: Time.current)
+      # Touches ancestors directly rather than through #touch to avoid a recursive taxonomy touch.
+      time = Time.current
+      self.class.default_scoped.where(id: ancestors.pluck(:id)).order(:id).each do |ancestor|
+        ancestor.update_column(:updated_at, time)
+      end
       # Have taxonomy touch happen in #touch_ancestors_and_taxonomy rather than association option in order for imports to override.
       taxonomy.try!(:touch)
     end

data/app/models/spree/user_address.rb

@@ -25,6 +25,6 @@ module Spree
       all
     }
 
-    default_scope -> { order([default: :desc, updated_at: :desc]) }
+    default_scope -> { order([{ default: :desc, updated_at: :desc }]) }
   end
 end

data/app/models/spree/variant/vat_price_generator.rb

@@ -25,6 +25,7 @@ module Spree
       def run
         # Early return if there is no VAT rates in the current store.
         return if !variant.tax_category || variant_vat_rates.empty?
+        return if variant.default_price&.amount.nil?
 
         country_isos_requiring_price.each do |country_iso|
           # Don't re-create the default price

data/db/migrate/20180322142651_add_amount_remaining_to_store_credit_events.rb

@@ -36,7 +36,6 @@ class AddAmountRemainingToStoreCreditEvents < ActiveRecord::Migration[5.0]
           # These actions do not change the amount_remaining so the previous
           # amount available is used (either the credit's amount or the
           # amount_remaining coming from the event right before this one).
-          credit_amount
         when StoreCredit::AUTHORIZE_ACTION,
              StoreCredit::INVALIDATE_ACTION
           # These actions remove the amount from the available credit amount.

data/lib/spree/core/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Spree
-  VERSION = "4.6.3"
+  VERSION = "4.6.4"
 
   def self.solidus_version = VERSION
 

data/lib/spree/testing_support/factories/return_item_factory.rb

@@ -2,7 +2,15 @@
 
 FactoryBot.define do
   factory :return_item, class: 'Spree::ReturnItem' do
-    association(:inventory_unit, factory: :inventory_unit, state: :shipped)
+    inventory_unit do
+      # When a return authorization is given, the inventory unit must belong
+      # to the same order.
+      if __override_names__.include?(:return_authorization) && return_authorization&.order
+        association(:inventory_unit, state: :shipped, order: return_authorization.order)
+      else
+        association(:inventory_unit, state: :shipped)
+      end
+    end
     association(:return_reason, factory: :return_reason)
     return_authorization do |_return_item|
       build(:return_authorization, order: inventory_unit.order)

data/lib/spree/testing_support/factories/store_credit_event_factory.rb

@@ -8,11 +8,11 @@ FactoryBot.define do
     action               { Spree::StoreCredit::AUTHORIZE_ACTION }
 
     factory :store_credit_auth_event, class: 'Spree::StoreCreditEvent' do
-      action             { Spree::StoreCredit::AUTHORIZE_ACTION }
+      action { Spree::StoreCredit::AUTHORIZE_ACTION }
     end
 
     factory :store_credit_capture_event do
-      action             { Spree::StoreCredit::CAPTURE_ACTION }
+      action { Spree::StoreCredit::CAPTURE_ACTION }
     end
 
     factory :store_credit_adjustment_event do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: solidus_core
 version: !ruby/object:Gem::Version
-  version: 4.6.3
+  version: 4.6.4
 platform: ruby
 authors:
 - Solidus Team