solidus_core 4.7.1 → 4.7.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 78c29ac128ed3b6ae1572035004a577b125403271d2d331f598a6fae3860003d
-  data.tar.gz: aecc835e960dc5b51f163f41ea9abc07dba2ff27717f24c8623a563b14d5e9ad
+  metadata.gz: 6016be6a4a01809df118c168c5dd345f73ed968f3ad53262c45594680491d4cb
+  data.tar.gz: 64faf68ec42068af0ca862a72f5253fd1f72c99b12b0616178d10c11879e550a
 SHA512:
-  metadata.gz: b9a161abf80858e4511684189d7f66f93e9a0774f091448702f174586ae10a1c13669d6c0efa6afd9f20470602dc95e55a06bad734913e482195915d053b56d6
-  data.tar.gz: ea34f9b2b35829c6888d11ceea67b3b056c1857ab9567fc941827d84c7b23789853ae1f9f2f6aec4381074208fd574742fa571ddbb0d72edee33fb90ccd0c535
+  metadata.gz: c9b6182a1739ef955f53359f927874aee7bcbed451362e4d228b32ee9526ace50bddca9816fa9383662c41352824a03dcbe6a5d6064ab085271a56c0ae02d7bd
+  data.tar.gz: cc30e67a19c56e0f0948501a813e2bdf3810eb19e08ecf18482c771aeff678217d4eb4b1ff050a2f92688cd36bfbb1ca3c55e037fcda9bed71fa4edd04e385c0

data/app/helpers/spree/products_helper.rb

@@ -49,7 +49,7 @@ module Spree
       if Spree::Config[:show_raw_product_description]
         raw(product.description)
       else
-        raw(product.description.gsub(/(.*?)\r?\n\r?\n/m, '<p>\1</p>'))
+        sanitize(product.description.gsub(/(.*?)\r?\n\r?\n/m, '<p>\1</p>'))
       end
     end
 

data/app/jobs/spree/base_job.rb

@@ -2,7 +2,7 @@
 
 module Spree
   # Base class for all Solidus background jobs
-  class BaseJob < ActiveJob::Base # rubocop:disable Rails/ApplicationJob
+  class BaseJob < ActiveJob::Base
     # Automatically retry jobs that encountered a deadlock
     retry_on ActiveRecord::Deadlocked
 

data/app/models/concerns/spree/user_methods.rb

@@ -130,14 +130,14 @@ module Spree
 
     # Updates the roles in keeping with the given ability's permissions
     #
-    # Roles that are not accessible to the given ability will be ignored. It
-    # also ensure not to remove non accessible roles when assigning new
-    # accessible ones.
+    # Roles that the given ability cannot manage will be ignored. It also
+    # ensure not to remove non manageable roles when assigning new manageable
+    # ones.
     #
     # @param given_roles [Spree::Role]
     # @param ability [Spree::Ability]
     def update_spree_roles(given_roles, ability:)
-      accessible_roles = Spree::Role.accessible_by(ability)
+      accessible_roles = Spree::Role.accessible_by(ability, :manage)
       non_accessible_roles = Spree::Role.all - accessible_roles
       new_accessible_roles = given_roles - non_accessible_roles
       self.spree_roles = spree_roles - accessible_roles + new_accessible_roles

data/app/models/spree/order.rb

@@ -321,8 +321,15 @@ module Spree
 
     # Associates the specified user with the order.
     def associate_user!(user, override_email = true)
+      user_changed = user_id != user.try(:id)
       self.user = user
       attrs_to_set = {user_id: user.try(:id)}
+
+      if user_changed
+        self.guest_token = nil
+        attrs_to_set[:guest_token] = create_token
+      end
+
       attrs_to_set[:email] = user.try(:email) if override_email
       attrs_to_set[:created_by_id] = user.try(:id) if created_by.blank?
 

data/app/models/spree/payment/processing.rb

@@ -113,7 +113,6 @@ module Spree
       end
 
       def gateway_options
-        order.reload
         options = {
           email: order.email,
           customer: order.email,

data/app/models/spree/payment_create.rb

@@ -8,6 +8,10 @@ module Spree
     #   * :payment_method_id Id of payment method used for this payment
     #   * :source_attributes Attributes used to build the source of this payment. Usually a {CreditCard}
     #     * :wallet_payment_source_id (Integer): The id of a {WalletPaymentSource} to use
+    #     * :gateway_customer_profile_id, :gateway_payment_profile_id (String): Gateway
+    #       identifiers for a new {CreditCard}, e.g. a one-time token. Raises
+    #       ActiveRecord::RecordNotFound if either already belongs to a {CreditCard}
+    #       owned by a different user or order.
     # @param request_env [Hash] rack env of user creating the payment
     # @param payment [Payment] Internal use only. Instead of making a new payment, change the attributes for an existing one.
     def initialize(order, attributes, payment: nil, request_env: {})
@@ -44,6 +48,7 @@ module Spree
     def build_source
       payment_method = payment.payment_method
       if source_attributes.present? && payment_method.try(:payment_source_class)
+        ensure_gateway_profile_ownership!(payment_method.payment_source_class)
         payment.source = payment_method.payment_source_class.new(source_attributes)
         payment.source.payment_method_id = payment_method.id
         if order && payment.source.respond_to?(:user=)
@@ -52,6 +57,26 @@ module Spree
       end
     end
 
+    # Gateway profile IDs may only be submitted for a new source when they are
+    # unknown to the store (e.g. a one-time token) or already belong to the
+    # order's user. Raises if either id is stored on a {CreditCard} owned by a
+    # different user or no user, so customers cannot pay with another
+    # customer's stored gateway credential.
+    def ensure_gateway_profile_ownership!(source_class)
+      return unless source_class <= Spree::CreditCard
+
+      %i[gateway_customer_profile_id gateway_payment_profile_id].each do |attribute|
+        value = source_attributes[attribute]
+        next if value.blank?
+
+        foreign_cards = Spree::CreditCard.where(attribute => value)
+        if order&.user_id
+          foreign_cards = foreign_cards.where(user_id: nil).or(foreign_cards.where.not(user_id: order.user_id))
+        end
+        raise ActiveRecord::RecordNotFound if foreign_cards.exists?
+      end
+    end
+
     def build_from_wallet_payment_source
       wallet_payment_source_id = source_attributes.fetch(:wallet_payment_source_id)
       raise(ActiveRecord::RecordNotFound) if order.user.nil?

data/app/models/spree/product.rb

@@ -355,14 +355,17 @@ module Spree
       run_callbacks(:touch)
     end
 
-    # Iterate through this product's taxons and taxonomies and touch their timestamps in a batch
+    # Iterate through this product's taxons and taxonomies and touch their timestamps
     def touch_taxons
-      taxons_to_touch = taxons.flat_map(&:self_and_ancestors).uniq
-      unless taxons_to_touch.empty?
-        Spree::Taxon.where(id: taxons_to_touch.map(&:id)).update_all(updated_at: Time.current)
+      taxons_to_touch = taxons.flat_map(&:self_and_ancestors).uniq.sort_by(&:id)
+      return if taxons_to_touch.empty?
 
-        taxonomy_ids_to_touch = taxons_to_touch.flat_map(&:taxonomy_id).uniq
-        Spree::Taxonomy.where(id: taxonomy_ids_to_touch).update_all(updated_at: Time.current)
+      time = Time.current
+      taxons_to_touch.each { |taxon| taxon.update_column(:updated_at, time) }
+
+      taxonomy_ids_to_touch = taxons_to_touch.map(&:taxonomy_id).uniq
+      Spree::Taxonomy.where(id: taxonomy_ids_to_touch).order(:id).each do |taxonomy|
+        taxonomy.touch(time:)
       end
     end
 

data/app/models/spree/return_item.rb

@@ -41,6 +41,7 @@ module Spree
 
     validate :eligible_exchange_variant
     validate :belongs_to_same_customer_order
+    validate :belongs_to_return_authorization_order, if: -> { inventory_unit_id_changed? || return_authorization_id_changed? }
     validate :validate_acceptance_status_for_reimbursement
     validate :validate_no_other_completed_return_items
 
@@ -226,6 +227,14 @@ module Spree
       end
     end
 
+    def belongs_to_return_authorization_order
+      return unless return_authorization && inventory_unit
+
+      if return_authorization.order_id != inventory_unit.order_id
+        errors.add(:base, I18n.t("spree.return_items_cannot_be_associated_with_multiple_orders"))
+      end
+    end
+
     def eligible_exchange_variant
       return unless exchange_variant && exchange_variant_id_changed?
       unless eligible_exchange_variants.include?(exchange_variant)

data/app/models/spree/store.rb

@@ -25,7 +25,7 @@ module Spree
     self.allowed_ransackable_attributes = %w[name url code]
 
     before_save :ensure_default_exists_and_is_unique
-    before_destroy :validate_not_default
+    before_destroy :validate_not_default, prepend: true
 
     enum :reverse_charge_status, {
       disabled: 0,
@@ -73,6 +73,7 @@ module Spree
     def validate_not_default
       if default
         errors.add(:base, :cannot_destroy_default_store)
+        throw :abort
       end
     end
   end

data/app/models/spree/taxon.rb

@@ -140,8 +140,11 @@ module Spree
     private
 
     def touch_ancestors_and_taxonomy
-      # Touches all ancestors at once to avoid recursive taxonomy touch, and reduce queries.
-      self.class.default_scoped.where(id: ancestors.pluck(:id)).update_all(updated_at: Time.current)
+      # Touches ancestors directly rather than through #touch to avoid a recursive taxonomy touch.
+      time = Time.current
+      self.class.default_scoped.where(id: ancestors.pluck(:id)).order(:id).each do |ancestor|
+        ancestor.update_column(:updated_at, time)
+      end
       # Have taxonomy touch happen in #touch_ancestors_and_taxonomy rather than association option in order for imports to override.
       taxonomy.try!(:touch)
     end

data/app/models/spree/variant/vat_price_generator.rb

@@ -25,6 +25,7 @@ module Spree
       def run
         # Early return if there is no VAT rates in the current store.
         return if !variant.tax_category || variant_vat_rates.empty?
+        return if variant.default_price&.amount.nil?
 
         country_isos_requiring_price.each do |country_iso|
           # Don't re-create the default price

data/lib/generators/solidus/install/app_templates/authentication/existing.rb

@@ -4,9 +4,7 @@ begin
   user_class.classify.constantize
 rescue NameError
   say_status :error, "Can't find an existing user class named #{user_class.classify}, plese set up one before using this authentication option.", :red
-  # rubocop:disable Rails/Exit
   abort
-  # rubocop:enable Rails/Exit
 end
 
 generate "spree:custom_user #{user_class.shellescape}"

data/lib/spree/core/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Spree
-  VERSION = "4.7.1"
+  VERSION = "4.7.3"
 
   def self.solidus_version = VERSION
 

data/lib/spree/preferences/preferable_class_methods.rb

@@ -111,5 +111,9 @@ module Spree::Preferences
     def allowed_admin_form_preference_types
       DEFAULT_ADMIN_FORM_PREFERENCE_TYPES
     end
+
+    def permitted_preference_attributes
+      new.admin_form_preference_names.map { |name| :"preferred_#{name}" }
+    end
   end
 end

data/lib/spree/preferences/statically_configurable.rb

@@ -22,7 +22,8 @@ module Spree
 
       def preferences
         if respond_to?(:preference_source) && preference_source
-          self.class.preference_sources[preference_source] || {}
+          source = self.class.preference_sources[preference_source]
+          source ? default_preferences.merge(source.to_hash) : {}
         else
           self[:preferences]
         end

data/lib/spree/testing_support/factories/return_item_factory.rb

@@ -2,7 +2,15 @@
 
 FactoryBot.define do
   factory :return_item, class: "Spree::ReturnItem" do
-    association(:inventory_unit, factory: :inventory_unit, state: :shipped)
+    inventory_unit do
+      # When a return authorization is given, the inventory unit must belong
+      # to the same order.
+      if __override_names__.include?(:return_authorization) && return_authorization&.order
+        association(:inventory_unit, state: :shipped, order: return_authorization.order)
+      else
+        association(:inventory_unit, state: :shipped)
+      end
+    end
     association(:return_reason, factory: :return_reason)
     return_authorization do |_return_item|
       build(:return_authorization, order: inventory_unit.order)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: solidus_core
 version: !ruby/object:Gem::Version
-  version: 4.7.1
+  version: 4.7.3
 platform: ruby
 authors:
 - Solidus Team