spree 0.11.2 → 0.11.3

data/Rakefile

@@ -2,7 +2,7 @@ require(File.join(File.dirname(__FILE__), 'config', 'boot'))
 
 require 'rake'
 require 'rake/testtask'
-require 'rake/rdoctask'
+require 'rdoc/task'
 
 require 'tasks/rails'
 
@@ -23,30 +23,31 @@ begin
     s.executables = ['spree']
     s.rubyforge_project = 'spree'
     s.version = Spree::Version
-    s.add_dependency 'rake', '>= 0.7.1'
-    s.add_dependency 'rails', '= 2.3.8'
+    s.add_dependency 'rake', '>= 0.9.2'
+    s.add_dependency 'rdoc', '>= 3.9.4'
+    s.add_dependency 'rails', '= 2.3.12'
     s.add_dependency 'rack', '>= 1.1.0'
     s.add_dependency 'highline', '= 1.5.1'
     s.add_dependency 'authlogic', '2.1.3'
     s.add_dependency 'authlogic-oid', "1.0.4"
-    s.add_dependency 'activemerchant', '= 1.5.1'
+    s.add_dependency 'activemerchant', '= 1.7.0'
     s.add_dependency 'activerecord-tableless', '= 0.1.0'
     s.add_dependency 'less', "1.2.20"
     s.add_dependency 'stringex', "1.0.3"
     s.add_dependency 'chronic', '0.2.3'
     s.add_dependency 'whenever', "0.3.7"
     s.add_dependency 'searchlogic', "2.3.5"
-    s.add_dependency 'will_paginate', "2.3.14"     
+    s.add_dependency 'will_paginate', "2.3.16"
     s.add_dependency 'state_machine', "0.9.2"
     s.add_dependency 'faker', "0.3.1"
-    s.add_dependency 'paperclip', "= 2.3.1.1"    
+    s.add_dependency 'paperclip', "= 2.3.1.1"
     s.add_dependency 'ruby-openid', '>= 2.0.4'
-    
+
     s.has_rdoc = true
     rdoc_excludes = Dir["**"].reject { |f| !File.directory? f }
     rdoc_excludes.each do |e|
       s.rdoc_options << '--exclude' << e
-    end     
+    end
     files = FileList['**/*']
     files.exclude '**/._*'
     files.exclude '**/*.rej'

data/app/controllers/admin/base_controller.rb

@@ -5,8 +5,39 @@ class Admin::BaseController < Spree::BaseController
 
   before_filter :parse_date_params
 
+  before_filter :check_alerts if Rails.env.production?
+
   protected
 
+  def check_alerts
+    return unless current_user and should_check_alerts?
+
+    unless session.has_key? :alerts
+      begin
+        session[:alerts] = Spree::Alert.current(request.host)
+        filter_dismissed_alerts
+        Spree::Config.set :last_check_for_spree_alerts => DateTime.now.to_s
+      rescue
+        session[:alerts] = nil
+      end
+    end
+  end
+
+  def should_check_alerts?
+    return false if not Spree::Config[:check_for_spree_alerts]
+
+    last_check = Spree::Config[:last_check_for_spree_alerts]
+    return true if last_check.blank?
+
+    DateTime.parse(last_check) < 12.hours.ago
+  end
+
+  def filter_dismissed_alerts
+    return unless session[:alerts]
+    dismissed = (Spree::Config[:dismissed_spree_alerts] || '').split(',')
+    session[:alerts].reject! { |a| dismissed.include? a.id.to_s }
+  end
+
   def ssl_required?
     ssl_supported?
   end

data/app/controllers/admin/general_settings_controller.rb

@@ -10,4 +10,13 @@ class Admin::GeneralSettingsController < Admin::BaseController
     end
   end
 
+  def dismiss_alert
+    if request.xhr? and params[:alert_id]
+      dismissed = Spree::Config[:dismissed_spree_alerts] || ''
+      Spree::Config.set :dismissed_spree_alerts => dismissed.split(',').push(params[:alert_id]).join(',')
+      filter_dismissed_alerts
+      render :nothing => true
+    end
+  end
+
 end

data/app/controllers/admin/orders_controller.rb

@@ -25,10 +25,15 @@ class Admin::OrdersController < Admin::BaseController
     # TODO - possible security check here but right now any admin can before any transition (and the state machine
     # itself will make sure transitions are not applied in the wrong state)
     event = params[:e]
-    Order.transaction do
-      @order.send("#{event}!")
+    if @order.send("can_#{event}?")
+      Order.transaction do
+        @order.send("#{event}!")
+      end
+
+      self.notice = t('order_updated')
+    else
+      flash[:error] = t('cannot_perform_requested_transition')
     end
-    self.notice = t('order_updated')
   rescue Spree::GatewayError => ge
     flash[:error] = "#{ge.message}"
   ensure

data/app/controllers/admin/payments_controller.rb

@@ -40,10 +40,15 @@ class Admin::PaymentsController < Admin::BaseController
     # TODO - possible security check here
     load_object
     return unless event = params[:e] and @payment.source
-    Payment.transaction do
-      @payment.source.send("#{event}", @payment)
+
+    if @payment.source.send("can_#{event}?", @payment)
+      Payment.transaction do
+        @payment.source.send("#{event}", @payment)
+      end
+      self.notice = t('payment_updated')
+    else
+      flash[:error] = t('cannot_perform_requested_transition')
     end
-    self.notice = t('payment_updated')
   rescue Spree::GatewayError => ge
     flash[:error] = "#{ge.message}"
   ensure

data/app/controllers/admin/shipments_controller.rb

@@ -28,8 +28,13 @@ class Admin::ShipmentsController < Admin::BaseController
   destroy.success.wants.js { render_js_for_destroy }
 
   def fire
-    @shipment.send("#{params[:e]}!")
-    self.notice = t('shipment_updated')
+    event = params[:e]
+    if @shipment.send("can_#{event}?")
+      @shipment.send("#{event}!")
+      self.notice = t('shipment_updated')
+    else
+      flash[:error] = t('cannot_perform_requested_transition')
+    end
     redirect_to :back
   end
 

data/app/models/address.rb

@@ -15,32 +15,15 @@ class Address < ActiveRecord::Base
   validates_presence_of :zipcode
   validates_presence_of :country
   validates_presence_of :phone
-  validate :state_name_validate, :if => Proc.new { |address| address.state.blank? && Spree::Config[:address_requires_state] }
+  validate :state_in_country
 
-  before_save :clear_invalid_state
+  before_validation :ensure_valid_single_state
+  before_save :ensure_valid_single_state
 
   def checkouts
     (billing_checkouts + shipping_checkouts).uniq
   end
 
-  # disconnected since there's no code to display error messages yet OR matching client-side validation
-  def phone_validate
-    return if phone.blank?
-    n_digits = phone.scan(/[0-9]/).size
-    valid_chars = (phone =~ /^[-+()\/\s\d]+$/)
-    if !(n_digits > 5 && valid_chars)
-      errors.add(:phone, :invalid)
-    end
-  end
-
-  def state_name_validate
-    country = country_id ? Country.find(country_id) : nil
-    return if country.blank? || country.states.empty?
-    if state_name.blank? || country.states.name_or_abbr_equals(state_name).empty?
-      errors.add(:state, :invalid)
-    end
-  end
-
   def self.default
     new :country => Country.find(Spree::Config[:default_country_id])
   end
@@ -51,7 +34,7 @@ class Address < ActiveRecord::Base
   end
 
   def full_name
-    self.firstname + " " + self.lastname
+    "#{self.firstname} #{self.lastname}".strip
   end
 
   def state_text
@@ -95,9 +78,43 @@ class Address < ActiveRecord::Base
   end
 
   private
+    # disconnected since there's no code to display error messages yet OR matching client-side validation
+    def phone_validate
+      return if phone.blank?
+      n_digits = phone.scan(/[0-9]/).size
+      valid_chars = (phone =~ /^[-+()\/\s\d]+$/)
+      if !(n_digits > 5 && valid_chars)
+        errors.add(:phone, :invalid)
+      end
+    end
 
-  def clear_invalid_state #reset state to nil if it's not from selected country
-    return unless self.state
-    self.state = nil unless self.state.country_id == self.country_id
-  end
+    def state_in_country
+      country.reload if changes.include?("country_id")
+
+      if state.present? and state.country_id != country_id
+        errors.add(:state, :invalid)
+      elsif state_name.present? and country.states.present?
+        errors.add(:state, :invalid)
+      end
+    end
+
+    def ensure_valid_single_state
+      self.state_name = nil if self.changes.include?("state_id") && self.state_id.present? #clear state_name if state_id is being set
+
+      if self.changes.include?("state_name") && self.state_name.present?
+        #check is state_name free text matchs an actual state associated with the country
+        country = (country_id ? Country.find(country_id) : nil)
+
+        if country and state = country.states.find(:first, :conditions => ["lower(states.name) = ? or lower(states.abbr) = ?", self.state_name.downcase, self.state_name.downcase])
+          self.state      = state #set state to actual associated state
+          self.state_name = nil #clear state_name as it's been matched successfully
+        else
+          self.state      = nil #ensure state_id to nil as state_name is being set
+        end
+      end
+
+      #fall back to force single state.
+      self.state_name = nil if self.state_name.present? && self.state_id.present?
+
+    end
 end

data/app/models/app_configuration.rb

@@ -49,6 +49,9 @@ class AppConfiguration < Configuration
   preference :checkout_zone, :string, :default => nil # replace with the name of a zone if you would like to limit the countries
   preference :always_put_site_name_in_title, :boolean, :default => true
   preference :cache_static_content, :boolean, :default => true
+  preference :check_for_spree_alerts, :boolean, :default => true
+  preference :last_check_for_spree_alerts, :string
+  preference :dismissed_spree_alerts, :string
 
   validates_presence_of :name
   validates_uniqueness_of :name

data/app/models/billing_integration.rb

@@ -7,7 +7,7 @@ class BillingIntegration < PaymentMethod
 
   def provider
     integration_options = options
-    ActiveMerchant::Billing::Base.integration_mode = integration_options[:server]
+    ActiveMerchant::Billing::Base.integration_mode = integration_options[:server].to_sym
     integration_options = options
     integration_options[:test] = true if integration_options[:test_mode]
     @provider ||= provider_class.new(integration_options)

data/app/models/line_item.rb

@@ -54,7 +54,7 @@ class LineItem < ActiveRecord::Base
 
   private
   def ensure_not_shipped
-    if shipped_count = order.shipped_units.nil? ? nil : order.shipped_units[variant]
+    if shipped_count = order.try(:shipped_units).nil? ? nil : order.shipped_units[variant]
       errors.add_to_base I18n.t("cannot_destory_line_item_as_inventory_units_have_shipped")
       return false
     end

data/app/models/payment.rb

@@ -100,7 +100,7 @@ class Payment < ActiveRecord::Base
       return unless payment_profiles_supported? and source.number and !source.has_payment_profile?
       source.payment_gateway.create_profile(self)
     rescue ActiveMerchant::ConnectionError => e
-      gateway_error I18n.t(:unable_to_connect_to_gateway)
+      source.gateway_error I18n.t(:unable_to_connect_to_gateway)
     end
 
 end

data/app/models/product_group.rb

@@ -90,10 +90,14 @@ class ProductGroup < ActiveRecord::Base
   end
 
   def add_scope(scope_name, arguments=[])
-    self.product_scopes << ProductScope.new({
-        :name => scope_name.to_s,
-        :arguments => [*arguments]
-      })
+    if scope_name.to_s !~ /eval|send|system|[^a-z0-9_!?]/
+      self.product_scopes << ProductScope.new({
+          :name => scope_name.to_s,
+          :arguments => [*arguments]
+        })
+    else
+      raise ArgumentError.new("'#{scope_name}` can't be used as scope")
+    end
     self
   end
 

data/app/models/spree/alert.rb

@@ -0,0 +1,13 @@
+class Spree::Alert < ActiveResource::Base
+  self.site = "http://alerts.spreecommerce.com/"
+  self.format = :json
+
+  def self.current(host)
+    find(:all, :params => { :version => SPREE_GEM_VERSION,
+                            :name => Spree::Config[:site_name],
+                            :host => host,
+                            :rails_env => Rails.env,
+                            :rails_version => Rails.version })
+  end
+end
+

data/config/boot.rb

@@ -55,7 +55,7 @@ module Spree
   class Boot 
     include Spree::RubyGemsLoader
     def run
-      load_rails("2.3.8")  # note: spree requires this specific version of rails (change at your own risk)
+      load_rails("2.3.12")  # note: spree requires this specific version of rails (change at your own risk)
       load_initializer
       Spree::Initializer.run(:set_load_path)
     end

data/config/environment.rb

@@ -5,7 +5,7 @@
 # ENV['RAILS_ENV'] ||= 'production'
 
 # Specifies gem version of Rails to use when vendor/rails is not present
-SPREE_GEM_VERSION = '0.11.2' unless defined? SPREE_GEM_VERSION
+SPREE_GEM_VERSION = '0.11.3' unless defined? SPREE_GEM_VERSION
 
 # Bootstrap the Rails environment, frameworks, and default configuration
 require File.join(File.dirname(__FILE__), 'boot')
@@ -27,7 +27,7 @@ Spree::Initializer.run do |config|
   # config.gem "aws-s3", :lib => "aws/s3"
 
   config.gem "highline", :version => '1.5.1'
-  config.gem 'authlogic', :version => '>=2.1.3'
+  config.gem 'authlogic', :version => '2.1.3'
   config.gem 'authlogic-oid', :lib => "authlogic_openid", :version => '1.0.4'
   config.gem "activemerchant", :lib => "active_merchant", :version => '1.7.0'
   config.gem 'activerecord-tableless', :lib => 'tableless', :version => '0.1.0'
@@ -36,7 +36,7 @@ Spree::Initializer.run do |config|
   config.gem 'chronic', :version => '0.2.3'
   config.gem 'whenever', :lib => false, :version => '0.3.7'
   config.gem 'searchlogic', :version => '2.3.5'
-  config.gem 'will_paginate', :lib => 'will_paginate', :version => '2.3.14'
+  config.gem 'will_paginate', :lib => 'will_paginate', :version => '2.3.16'
   config.gem 'state_machine', :lib => 'state_machine', :version => '0.9.2'
   config.gem "faker", :version => '0.3.1'
   config.gem 'paperclip', :version => '>=2.3.1.1'

data/config/environments/test.rb

@@ -24,4 +24,4 @@ config.action_controller.allow_forgery_protection = false
 config.gem "shoulda", :lib => "shoulda", :version => "2.10.2"
 config.gem "factory_girl", :lib => "factory_girl", :version => "1.2.3"
 config.gem 'test-unit', :lib => 'test/unit', :version => '~>2.0.9' if RUBY_VERSION.to_f >= 1.9
-config.gem "rspec", :lib => 'spec'
+config.gem "rspec", :lib => 'spec', :version => '1.3.2'

data/config/locales/en_spree.yml

@@ -232,6 +232,8 @@ en:
   allow_ssl_to_be_used_when_in_developement_and_test_modes: Allow SSL to be used when in development and test modes
   allow_ssl_to_be_used_when_in_production_mode: Allow SSL to be used in production mode
   allowed_ssl_in_production_mode: "SSL will %{not} be used in production"
+  spree_alert_checking: "Check for Spree security and release alerts"
+  spree_alert_not_checking: "Not checking for Spree security and release alerts"
   already_registered: Already Registered?
   alternative_phone: Alternative Phone
   amount: Amount
@@ -268,6 +270,7 @@ en:
   canceled: Canceled
   cannot_create_returns: Cannot create returns as this order has not shipped yet.
   cannot_destory_line_item_as_inventory_units_have_shipped: Cannot destory line item as some inventory units have shipped.
+  cannot_perform_requested_transition: "Cannot perform requested transition"
   capture: Capture
   card_code: "Card Code"
   card_details: "Card details"

data/config/routes.rb

@@ -93,7 +93,8 @@ ActionController::Routing::Routes.draw do |map|
     admin.resources :orders do |order|
       order.resources :payments, :member => {:fire => :put, :finalize => :put}
     end
-    admin.resource :general_settings
+    admin.resource :general_settings, :collection => {:dismiss_alert => :post}
+
     admin.resources :taxonomies, :member => { :get_children => :get } do |taxonomy|
       taxonomy.resources :taxons
     end

data/lib/generators/extension/templates/Rakefile

@@ -1,6 +1,6 @@
 require 'rake'
 require 'rake/testtask'
-require 'rake/rdoctask'
+require 'rdoc/task'
 
 desc 'Default: run unit tests.'
 task :default => :test

data/lib/plugins/option_tags_with_disable/Rakefile

@@ -1,6 +1,6 @@
 require 'rake'
 require 'rake/testtask'
-require 'rake/rdoctask'
+require 'rdoc/task'
 
 desc 'Default: run unit tests.'
 task :default => :test

data/lib/spree.rb

@@ -9,7 +9,7 @@ unless defined? Spree::Version
     module Version
       Major = '0'
       Minor = '11'
-      Tiny  = '2'
+      Tiny  = '3'
       Pre   = nil # 'beta'
 
       class << self
@@ -21,4 +21,4 @@ unless defined? Spree::Version
       end
     end
   end
-end
+end

data/lib/spree/checkout/action_options.rb

@@ -4,7 +4,7 @@ module Spree::Checkout
     block_accessor :edit_hook, :update_hook
     
     def dup
-      returning self.class.new do |duplicate|
+      self.class.new.tap do |duplicate|
         duplicate.instance_variable_set(:@collector, wants.dup)
         duplicate.instance_variable_set(:@before, before.dup)             unless before.nil?
         duplicate.instance_variable_set(:@after, after.dup)               unless after.nil?
@@ -15,4 +15,4 @@ module Spree::Checkout
       end
     end
   end
-end
+end

data/lib/spree/extension_loader.rb

@@ -46,7 +46,7 @@ module Spree
         
     def add_extension_paths
       extension_load_paths.reverse_each do |path|
-        configuration.load_paths.unshift path
+        configuration.autoload_paths.unshift path
         $LOAD_PATH.unshift path
       end
     end