spree_api 2.1.11 → 2.1.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 167e764eaf9ea388016831a3d5eb54f5757e473e
-  data.tar.gz: 270eafd69e6df06636b2d449dfac6706228391be
+  metadata.gz: 6a08ed7200c466d0fd9ec9f30a023e25762b0818
+  data.tar.gz: 7e46adff6873f64f2cbfeeb272ea0b9a1cd72ed5
 SHA512:
-  metadata.gz: d3c8d518f36d300c218e2504e59a2c20c9df23e075df05b3fb28050ae4df971d2acdb70a23a6ba2584d94b5e26adf85f1ac73fb38ed9700ac1b2a90db744ee41
-  data.tar.gz: eb668f1902f81379358fd8a53f6d0b17e23f890f255949602a36f120ddeef4c242d1f1bee7461854c166fb0e614632614bc6098f13db21877e02d040b85d7934
+  metadata.gz: e2b70fb725a233dca2913251d058a3ff0ede0ba0f6490eaba055e439a96764db21eaa0a4b2206ad4538cebce2a61fa9215b76cde3d3b50e9463992559e3f713e
+  data.tar.gz: d822c1904e28486d7d6e79e6e4d485a32457bfb03daf035ba039bdaa6c80343a2368bc3ac0c638e2f7eb1e3e3676b12860eaac33823faabef618b75a5a74c701

data/app/controllers/spree/api/checkouts_controller.rb

@@ -53,11 +53,28 @@ module Spree
       end
 
       private
-
         def object_params
-          # For payment step, filter order parameters to produce the expected nested attributes for a single payment and its source, discarding attributes for payment methods other than the one selected
-          # respond_to check is necessary due to issue described in #2910
-          object_params = nested_params
+          modify_payment_attributes params[:order] || {}
+
+          protected_params = if params[:order]
+                               params.require(:order).permit(permitted_checkout_attributes)
+                             else
+                               {}
+                             end
+
+          map_nested_attributes_keys Order, protected_params
+        end
+
+        def user_id
+          params[:order][:user_id] if params[:order]
+        end
+
+        # For payment step, filter order parameters to produce the expected
+        # nested attributes for a single payment and its source, discarding
+        # attributes for payment methods other than the one selected
+        #
+        # respond_to check is necessary due to issue described in #2910
+        def modify_payment_attributes(object_params)
           if @order.has_checkout_step?('payment') && @order.payment?
             if object_params[:payments_attributes].is_a?(Hash)
               object_params[:payments_attributes] = [object_params[:payments_attributes]]
@@ -69,11 +86,6 @@ module Spree
               object_params[:payments_attributes].first[:amount] = @order.total.to_s
             end
           end
-          object_params
-        end
-
-        def user_id
-          params[:order][:user_id] if params[:order]
         end
 
         def nested_params

data/app/controllers/spree/api/orders_controller.rb

@@ -134,7 +134,7 @@ module Spree
 
         def permitted_order_attributes
           if current_api_user.has_spree_role? "admin"
-            super << admin_order_attributes
+            super + admin_order_attributes
           else
             super
           end
@@ -142,7 +142,7 @@ module Spree
 
         def permitted_shipment_attributes
           if current_api_user.has_spree_role? "admin"
-            super << admin_shipment_attributes
+            super + admin_shipment_attributes
           else
             super
           end

data/spec/controllers/spree/api/checkouts_controller_spec.rb

@@ -56,12 +56,28 @@ module Spree
         order
       end
 
-
       before(:each) do
         Order.any_instance.stub(:confirmation_required? => true)
         Order.any_instance.stub(:payment_required? => true)
       end
 
+      it 'should not allow users to change the price of line items' do
+        line_item = order.line_items.first
+        price_was = line_item.price
+        api_put(
+          :update,
+          id: order.to_param,
+          order_token: order.token,
+          order: {
+            line_items: {0 => {id: line_item.id, price: '0.1', quantity: '3'}}
+          }
+        )
+        response.status.should == 200
+        line_item.reload
+        expect(line_item.price).to eq price_was
+        expect(line_item.price).to_not eq 0.1
+      end
+
       it "should transition a recently created order from cart to address" do
         order.state.should eq "cart"
         order.email.should_not be_nil

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_api
 version: !ruby/object:Gem::Version
-  version: 2.1.11
+  version: 2.1.12
 platform: ruby
 authors:
 - Ryan Bigg
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-12-05 00:00:00.000000000 Z
+date: 2014-12-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: spree_core
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.1.11
+        version: 2.1.12
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.1.11
+        version: 2.1.12
 - !ruby/object:Gem::Dependency
   name: rabl
   requirement: !ruby/object:Gem::Requirement