solidus_core 4.7.1 → 4.7.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 78c29ac128ed3b6ae1572035004a577b125403271d2d331f598a6fae3860003d
-  data.tar.gz: aecc835e960dc5b51f163f41ea9abc07dba2ff27717f24c8623a563b14d5e9ad
+  metadata.gz: d3d8242467851026fff5d6e6c31639174974d747193e9bef00a77acbd7c6e912
+  data.tar.gz: 7336f44aad6dc32d2d477acffe0de1af5acb1df5fa7bd399b3b754e3647269e3
 SHA512:
-  metadata.gz: b9a161abf80858e4511684189d7f66f93e9a0774f091448702f174586ae10a1c13669d6c0efa6afd9f20470602dc95e55a06bad734913e482195915d053b56d6
-  data.tar.gz: ea34f9b2b35829c6888d11ceea67b3b056c1857ab9567fc941827d84c7b23789853ae1f9f2f6aec4381074208fd574742fa571ddbb0d72edee33fb90ccd0c535
+  metadata.gz: e0521407fa49fac2011d849d4fa08f03a165c32751ffdda07656dd985c3aa73a3ea0b90e4d7b6dfc7157a310fc371d3195b9e7e3f1d1b1b517d3c927370d01c8
+  data.tar.gz: 4619fdf8d485b61ba1610d4c579fd83f82e4f0710648719b07c4ec4e246915a6d2de458f351560c375b212c84a37db01d9b9463608f1f141e27e531e363a958f

data/app/helpers/spree/products_helper.rb

@@ -49,7 +49,7 @@ module Spree
       if Spree::Config[:show_raw_product_description]
         raw(product.description)
       else
-        raw(product.description.gsub(/(.*?)\r?\n\r?\n/m, '<p>\1</p>'))
+        sanitize(product.description.gsub(/(.*?)\r?\n\r?\n/m, '<p>\1</p>'))
       end
     end
 

data/app/models/concerns/spree/user_methods.rb

@@ -130,14 +130,14 @@ module Spree
 
     # Updates the roles in keeping with the given ability's permissions
     #
-    # Roles that are not accessible to the given ability will be ignored. It
-    # also ensure not to remove non accessible roles when assigning new
-    # accessible ones.
+    # Roles that the given ability cannot manage will be ignored. It also
+    # ensure not to remove non manageable roles when assigning new manageable
+    # ones.
     #
     # @param given_roles [Spree::Role]
     # @param ability [Spree::Ability]
     def update_spree_roles(given_roles, ability:)
-      accessible_roles = Spree::Role.accessible_by(ability)
+      accessible_roles = Spree::Role.accessible_by(ability, :manage)
       non_accessible_roles = Spree::Role.all - accessible_roles
       new_accessible_roles = given_roles - non_accessible_roles
       self.spree_roles = spree_roles - accessible_roles + new_accessible_roles

data/app/models/spree/payment/processing.rb

@@ -113,7 +113,6 @@ module Spree
       end
 
       def gateway_options
-        order.reload
         options = {
           email: order.email,
           customer: order.email,

data/app/models/spree/payment_create.rb

@@ -8,6 +8,10 @@ module Spree
     #   * :payment_method_id Id of payment method used for this payment
     #   * :source_attributes Attributes used to build the source of this payment. Usually a {CreditCard}
     #     * :wallet_payment_source_id (Integer): The id of a {WalletPaymentSource} to use
+    #     * :gateway_customer_profile_id, :gateway_payment_profile_id (String): Gateway
+    #       identifiers for a new {CreditCard}, e.g. a one-time token. Raises
+    #       ActiveRecord::RecordNotFound if either already belongs to a {CreditCard}
+    #       owned by a different user.
     # @param request_env [Hash] rack env of user creating the payment
     # @param payment [Payment] Internal use only. Instead of making a new payment, change the attributes for an existing one.
     def initialize(order, attributes, payment: nil, request_env: {})
@@ -44,6 +48,7 @@ module Spree
     def build_source
       payment_method = payment.payment_method
       if source_attributes.present? && payment_method.try(:payment_source_class)
+        ensure_gateway_profile_ownership!(payment_method.payment_source_class)
         payment.source = payment_method.payment_source_class.new(source_attributes)
         payment.source.payment_method_id = payment_method.id
         if order && payment.source.respond_to?(:user=)
@@ -52,6 +57,24 @@ module Spree
       end
     end
 
+    # Gateway profile ids may only be submitted for a new source when they are
+    # unknown to the store (e.g. a one-time token) or already belong to the
+    # order's user. Raises if either id is stored on a {CreditCard} owned by a
+    # different user, so customers cannot pay with another customer's stored
+    # gateway credential.
+    def ensure_gateway_profile_ownership!(source_class)
+      return unless source_class <= Spree::CreditCard
+
+      %i[gateway_customer_profile_id gateway_payment_profile_id].each do |attribute|
+        value = source_attributes[attribute]
+        next if value.blank?
+
+        foreign_cards = Spree::CreditCard.where(attribute => value).where.not(user_id: nil)
+        foreign_cards = foreign_cards.where.not(user_id: order.user_id) if order&.user_id
+        raise ActiveRecord::RecordNotFound if foreign_cards.exists?
+      end
+    end
+
     def build_from_wallet_payment_source
       wallet_payment_source_id = source_attributes.fetch(:wallet_payment_source_id)
       raise(ActiveRecord::RecordNotFound) if order.user.nil?

data/app/models/spree/product.rb

@@ -355,14 +355,17 @@ module Spree
       run_callbacks(:touch)
     end
 
-    # Iterate through this product's taxons and taxonomies and touch their timestamps in a batch
+    # Iterate through this product's taxons and taxonomies and touch their timestamps
     def touch_taxons
-      taxons_to_touch = taxons.flat_map(&:self_and_ancestors).uniq
-      unless taxons_to_touch.empty?
-        Spree::Taxon.where(id: taxons_to_touch.map(&:id)).update_all(updated_at: Time.current)
+      taxons_to_touch = taxons.flat_map(&:self_and_ancestors).uniq.sort_by(&:id)
+      return if taxons_to_touch.empty?
 
-        taxonomy_ids_to_touch = taxons_to_touch.flat_map(&:taxonomy_id).uniq
-        Spree::Taxonomy.where(id: taxonomy_ids_to_touch).update_all(updated_at: Time.current)
+      time = Time.current
+      taxons_to_touch.each { |taxon| taxon.update_column(:updated_at, time) }
+
+      taxonomy_ids_to_touch = taxons_to_touch.map(&:taxonomy_id).uniq
+      Spree::Taxonomy.where(id: taxonomy_ids_to_touch).order(:id).each do |taxonomy|
+        taxonomy.touch(time:)
       end
     end
 

data/app/models/spree/return_item.rb

@@ -41,6 +41,7 @@ module Spree
 
     validate :eligible_exchange_variant
     validate :belongs_to_same_customer_order
+    validate :belongs_to_return_authorization_order, if: -> { inventory_unit_id_changed? || return_authorization_id_changed? }
     validate :validate_acceptance_status_for_reimbursement
     validate :validate_no_other_completed_return_items
 
@@ -226,6 +227,14 @@ module Spree
       end
     end
 
+    def belongs_to_return_authorization_order
+      return unless return_authorization && inventory_unit
+
+      if return_authorization.order_id != inventory_unit.order_id
+        errors.add(:base, I18n.t("spree.return_items_cannot_be_associated_with_multiple_orders"))
+      end
+    end
+
     def eligible_exchange_variant
       return unless exchange_variant && exchange_variant_id_changed?
       unless eligible_exchange_variants.include?(exchange_variant)

data/app/models/spree/taxon.rb

@@ -140,8 +140,11 @@ module Spree
     private
 
     def touch_ancestors_and_taxonomy
-      # Touches all ancestors at once to avoid recursive taxonomy touch, and reduce queries.
-      self.class.default_scoped.where(id: ancestors.pluck(:id)).update_all(updated_at: Time.current)
+      # Touches ancestors directly rather than through #touch to avoid a recursive taxonomy touch.
+      time = Time.current
+      self.class.default_scoped.where(id: ancestors.pluck(:id)).order(:id).each do |ancestor|
+        ancestor.update_column(:updated_at, time)
+      end
       # Have taxonomy touch happen in #touch_ancestors_and_taxonomy rather than association option in order for imports to override.
       taxonomy.try!(:touch)
     end

data/app/models/spree/variant/vat_price_generator.rb

@@ -25,6 +25,7 @@ module Spree
       def run
         # Early return if there is no VAT rates in the current store.
         return if !variant.tax_category || variant_vat_rates.empty?
+        return if variant.default_price&.amount.nil?
 
         country_isos_requiring_price.each do |country_iso|
           # Don't re-create the default price

data/lib/spree/core/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Spree
-  VERSION = "4.7.1"
+  VERSION = "4.7.2"
 
   def self.solidus_version = VERSION
 

data/lib/spree/preferences/statically_configurable.rb

@@ -22,7 +22,8 @@ module Spree
 
       def preferences
         if respond_to?(:preference_source) && preference_source
-          self.class.preference_sources[preference_source] || {}
+          source = self.class.preference_sources[preference_source]
+          source ? default_preferences.merge(source.to_hash) : {}
         else
           self[:preferences]
         end

data/lib/spree/testing_support/factories/return_item_factory.rb

@@ -2,7 +2,15 @@
 
 FactoryBot.define do
   factory :return_item, class: "Spree::ReturnItem" do
-    association(:inventory_unit, factory: :inventory_unit, state: :shipped)
+    inventory_unit do
+      # When a return authorization is given, the inventory unit must belong
+      # to the same order.
+      if __override_names__.include?(:return_authorization) && return_authorization&.order
+        association(:inventory_unit, state: :shipped, order: return_authorization.order)
+      else
+        association(:inventory_unit, state: :shipped)
+      end
+    end
     association(:return_reason, factory: :return_reason)
     return_authorization do |_return_item|
       build(:return_authorization, order: inventory_unit.order)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: solidus_core
 version: !ruby/object:Gem::Version
-  version: 4.7.1
+  version: 4.7.2
 platform: ruby
 authors:
 - Solidus Team