spree_api 2.2.8 → 2.2.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: c6cef400669415cd05a55d98c9e2f493c539508a
-  data.tar.gz: 305debfccf5da3c252cf172d8308d59dd68e2b28
+  metadata.gz: 4054c45aa7f1dd4b9117a0c93e50dd091b9127c5
+  data.tar.gz: 9cede9c151509a65bdec3a800ff420f203df7b48
 SHA512:
-  metadata.gz: 607e520fd39c93373e13356e6cd4dc7e929267b5df722101b55a0968d19f6adb6ff4b85bad85d47bbd25b5b6e40398c09d097b1e5089c42736b506944fcfff24
-  data.tar.gz: d948a5dad4cf07bea7371b72e9b2e2deabfea227ce7ac8a19be2ed75b8fa40d9824cb685220ed161c68bc49a01d7e819e2e75756c45227a5418803156358097b
+  metadata.gz: bce419abf3f9a6073307b79a5630c1fcee32a794677824eaa9fa4a1f1f212ac18f5677e50fe9386a6b3aaec113983b176e66f13a86bc7d1a2637137859754daa
+  data.tar.gz: 6a13db2891ded39d5051ea07d7fcc2c3d045f12c5a07aba191d84dabc23fce875fbcd1342bfb9f09de1fb4d5d9d97cfda8a8ed166c610a2e327ead4851a829d9

data/app/controllers/spree/api/checkouts_controller.rb

@@ -53,11 +53,28 @@ module Spree
       end
 
       private
-
         def object_params
-          # For payment step, filter order parameters to produce the expected nested attributes for a single payment and its source, discarding attributes for payment methods other than the one selected
-          # respond_to check is necessary due to issue described in #2910
-          object_params = nested_params
+          modify_payment_attributes params[:order] || {}
+
+          protected_params = if params[:order]
+                               params.require(:order).permit(permitted_checkout_attributes)
+                             else
+                               {}
+                             end
+
+          map_nested_attributes_keys Order, protected_params
+        end
+
+        def user_id
+          params[:order][:user_id] if params[:order]
+        end
+
+        # For payment step, filter order parameters to produce the expected
+        # nested attributes for a single payment and its source, discarding
+        # attributes for payment methods other than the one selected
+        #
+        # respond_to check is necessary due to issue described in #2910
+        def modify_payment_attributes(object_params)
           if @order.has_checkout_step?('payment') && @order.payment?
             if object_params[:payments_attributes].is_a?(Hash)
               object_params[:payments_attributes] = [object_params[:payments_attributes]]
@@ -69,11 +86,6 @@ module Spree
               object_params[:payments_attributes].first[:amount] = @order.total.to_s
             end
           end
-          object_params
-        end
-
-        def user_id
-          params[:order][:user_id] if params[:order]
         end
 
         def nested_params

data/app/controllers/spree/api/orders_controller.rb

@@ -111,7 +111,7 @@ module Spree
 
         def permitted_order_attributes
           if current_api_user.has_spree_role? "admin"
-            super << admin_order_attributes
+            super + admin_order_attributes
           else
             super
           end
@@ -119,7 +119,7 @@ module Spree
 
         def permitted_shipment_attributes
           if current_api_user.has_spree_role? "admin"
-            super << admin_shipment_attributes
+            super + admin_shipment_attributes
           else
             super
           end

data/spec/controllers/spree/api/checkouts_controller_spec.rb

@@ -55,12 +55,28 @@ module Spree
         order
       end
 
-
       before(:each) do
         Order.any_instance.stub(:confirmation_required? => true)
         Order.any_instance.stub(:payment_required? => true)
       end
 
+      it 'should not allow users to change the price of line items' do
+        line_item = order.line_items.first
+        price_was = line_item.price
+        api_put(
+          :update,
+          id: order.to_param,
+          order_token: order.token,
+          order: {
+            line_items: {0 => {id: line_item.id, price: '0.1', quantity: '3'}}
+          }
+        )
+        response.status.should == 200
+        line_item.reload
+        expect(line_item.price).to eq price_was
+        expect(line_item.price).to_not eq 0.1
+      end
+
       it "should transition a recently created order from cart to address" do
         order.state.should eq "cart"
         order.email.should_not be_nil

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_api
 version: !ruby/object:Gem::Version
-  version: 2.2.8
+  version: 2.2.9
 platform: ruby
 authors:
 - Ryan Bigg
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-12-05 00:00:00.000000000 Z
+date: 2014-12-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: spree_core
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.2.8
+        version: 2.2.9
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.2.8
+        version: 2.2.9
 - !ruby/object:Gem::Dependency
   name: rabl
   requirement: !ruby/object:Gem::Requirement