spree_backend 3.0.6.1 → 3.0.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 6159f897facb5cec41999c468ce1bd5e25a31647
-  data.tar.gz: 438dd8f6e50b5f03db44b7d85d1865920cf53bef
+  metadata.gz: d13f9d0f8ce88f502cc8ee55faa2af5fd98b3dc6
+  data.tar.gz: 4236a33d9301e30a573c0bbbe704492c9e41de01
 SHA512:
-  metadata.gz: d8dd0d9f4c09418031f5c02b607c5e815e801d7a03e77dea2c2ad089dcc4da77a01a4f23960228696341aba93707885db8588888f73a10a8b438d817682779a3
-  data.tar.gz: 6ffcd65e07c3191f4b49fb328dd123494aa981b320c13e7109b0b0f6bf98a7e3fc7122359986bedcef291deaa1cfa0cad2af7b54c006768e096d6331981e2f4e
+  metadata.gz: 50b5936d9b443716bfa26296c5a1b5e36c56d46300ebb0c7344f43afefe571f5d7d3601221e43eb0651674869463db774917b000b3d6906d82cb517be8e82475
+  data.tar.gz: d3234fde967703238bcd74fbcf30d8e81a304ba50000c110ec63f7a5c9cbd89f38094f9af9e974814af8fc13903b9af3e44cc9c4f396e864515cfa61bb3a98e0

data/app/assets/javascripts/spree/backend/checkouts/edit.js

@@ -25,7 +25,7 @@ $(document).ready(function() {
           }
         },
         results: function(data, page) {
-          return { results: data }
+          return { results: data.users }
         }
       },
       dropdownCssClass: 'customer_search',
@@ -53,7 +53,7 @@ $(document).ready(function() {
             });
           });
         }
-        return customer.email;
+        return Select2.util.escapeMarkup(customer.email);
       }
     })
   }

data/app/assets/javascripts/spree/backend/option_type_autocomplete.js

@@ -1,6 +1,10 @@
 $(document).ready(function () {
   'use strict';
 
+  function formatOptionType(option_type) {
+    return Select2.util.escapeMarkup(option_type.presentation + ' (' + option_type.name + ')');
+  }
+
   if ($('#product_option_type_ids').length > 0) {
     $('#product_option_type_ids').select2({
       placeholder: Spree.translations.option_type_placeholder,
@@ -32,12 +36,8 @@ $(document).ready(function () {
           };
         }
       },
-      formatResult: function (option_type) {
-        return option_type.presentation + ' (' + option_type.name + ')';
-      },
-      formatSelection: function (option_type) {
-        return option_type.presentation + ' (' + option_type.name + ')';
-      }
+      formatResult: formatOptionType,
+      formatSelection: formatOptionType
     });
   }
 });

data/app/assets/javascripts/spree/backend/product_picker.js

@@ -5,6 +5,10 @@ $.fn.productAutocomplete = function (options) {
   options = options || {};
   var multiple = typeof(options.multiple) !== 'undefined' ? options.multiple : true;
 
+  function formatProduct(product) {
+    return Select2.util.escapeMarkup(product.name);
+  }
+
   this.select2({
     minimumInputLength: 3,
     multiple: multiple,
@@ -36,12 +40,8 @@ $.fn.productAutocomplete = function (options) {
         };
       }
     },
-    formatResult: function (product) {
-      return product.name;
-    },
-    formatSelection: function (product) {
-      return product.name;
-    }
+    formatResult: formatProduct,
+    formatSelection: formatProduct
   });
 };
 

data/app/assets/javascripts/spree/backend/stock_movement.js.coffee

@@ -15,5 +15,5 @@ jQuery ->
         return { results: data.stock_items, more: more }
     formatResult: (stock_item) ->
       variantTemplate({ variant: stock_item.variant })
-    formatSelection: (stock_item) ->
-      "#{stock_item.variant.name} (#{stock_item.variant.options_text})"
+    formatSelection: (stock_item, container, excapeMarkup) ->
+      Select2.util.escapeMarkup("#{stock_item.variant.name} (#{stock_item.variant.options_text})")

data/app/assets/javascripts/spree/backend/taxon_autocomplete.js

@@ -1,6 +1,10 @@
 'use strict';
 
 var set_taxon_select = function(selector){
+  function formatTaxon(taxon) {
+    return Select2.util.escapeMarkup(taxon.pretty_name);
+  }
+
   if ($(selector).length > 0) {
     $(selector).select2({
       placeholder: Spree.translations.taxon_placeholder,
@@ -36,12 +40,8 @@ var set_taxon_select = function(selector){
           };
         }
       },
-      formatResult: function (taxon) {
-        return taxon.pretty_name;
-      },
-      formatSelection: function (taxon) {
-        return taxon.pretty_name;
-      }
+      formatResult: formatTaxon,
+      formatSelection: formatTaxon
     });
   }
 }

data/app/assets/javascripts/spree/backend/taxons.js.coffee

@@ -1,8 +1,10 @@
 $(document).ready ->
   window.productTemplate = Handlebars.compile($('#product_template').text());
   $('#taxon_products').sortable({
-      handle: ".js-sort-handle"
-    });
+    handle: ".js-sort-handle"
+  });
+  formatTaxon = (taxon) ->
+    Select2.util.escapeMarkup(taxon.pretty_name)
   $('#taxon_products').on "sortstop", (event, ui) ->
     $.ajax
       url: Spree.routes.classifications_api,
@@ -32,10 +34,8 @@ $(document).ready ->
           more = page < data.pages;
           results: data['taxons'],
           more: more
-      formatResult: (taxon) ->
-        taxon.pretty_name;
-      formatSelection: (taxon) ->
-        taxon.pretty_name;
+      formatResult: formatTaxon,
+      formatSelection: formatTaxon
 
   $('#taxon_id').on "change", (e) ->
     el = $('#taxon_products')

data/app/assets/javascripts/spree/backend/user_picker.js

@@ -1,6 +1,10 @@
 $.fn.userAutocomplete = function () {
   'use strict';
 
+  function formatUser(user) {
+    return Select2.util.escapeMarkup(user.email);
+  }
+
   this.select2({
     minimumInputLength: 1,
     multiple: true,
@@ -8,7 +12,7 @@ $.fn.userAutocomplete = function () {
       $.get(Spree.routes.user_search, {
         ids: element.val()
       }, function (data) {
-        callback(data);
+        callback(data.users);
       });
     },
     ajax: {
@@ -22,16 +26,12 @@ $.fn.userAutocomplete = function () {
       },
       results: function (data) {
         return {
-          results: data
+          results: data.users
         };
       }
     },
-    formatResult: function (user) {
-      return user.email;
-    },
-    formatSelection: function (user) {
-      return user.email;
-    }
+    formatResult: formatUser,
+    formatSelection: formatUser
   });
 };
 

data/app/assets/javascripts/spree/backend/variant_autocomplete.js.coffee

@@ -31,8 +31,8 @@ $.fn.variantAutocomplete = ->
         results: data["variants"]
 
     formatResult: formatVariantResult
-    formatSelection: (variant) ->
+    formatSelection: (variant, container, escapeMarkup) ->
       if !!variant.options_text
-        variant.name + " (#{variant.options_text})"
+        Select2.util.escapeMarkup("#{variant.name} (#{variant.options_text})")
       else
-        variant.name
+        Select2.util.escapeMarkup(variant.name)

data/app/helpers/spree/admin/adjustments_helper.rb

@@ -22,7 +22,7 @@ module Spree
         parts << variant.product.name
         parts << "(#{variant.options_text})" if variant.options_text.present?
         parts << line_item.display_total
-        parts.join("<br>").html_safe
+        safe_join(parts, "<br />".html_safe)
       end
 
       def display_shipment(shipment)

data/app/helpers/spree/admin/base_helper.rb

@@ -7,8 +7,8 @@ module Spree
           flash_class = "danger" if flash[:error]
           flash_class = "info" if flash[:notice]
           flash_class = "success" if flash[:success]
-          flash_div = content_tag(:div, message, class: "alert alert-#{flash_class} alert-auto-dissapear")
-          content_tag(:div, flash_div, class: 'col-md-12')          
+          flash_div = content_tag(:div, message, class: "alert alert-#{flash_class} alert-auto-disappear")
+          content_tag(:div, flash_div, class: 'col-md-12')
         end
       end
 
@@ -26,7 +26,7 @@ module Spree
         obj = object.respond_to?(:errors) ? object : instance_variable_get("@#{object}")
 
         if obj && obj.errors[method].present?
-          errors = obj.errors[method].map { |err| h(err) }.join('<br />').html_safe
+          errors = safe_join(obj.errors[method], '<br />'.html_safe)
           content_tag(:span, errors, class: 'formError')
         else
           ''
@@ -117,12 +117,13 @@ module Spree
 
       def preference_fields(object, form)
         return unless object.respond_to?(:preferences)
-        object.preferences.keys.map{ |key|
-        if object.has_preference?(key)
-          form.label("preferred_#{key}", Spree.t(key) + ": ") +
-            preference_field_for(form, "preferred_#{key}", type: object.preference_type(key))
-        end
-        }.join("<br />").html_safe
+        fields = object.preferences.keys.map { |key|
+          if object.has_preference?(key)
+            form.label("preferred_#{key}", Spree.t(key) + ": ") +
+              preference_field_for(form, "preferred_#{key}", type: object.preference_type(key))
+          end
+        }
+        safe_join(fields, '<br />'.html_safe)
       end
 
       # renders hidden field and link to remove record using nested_attributes

data/app/helpers/spree/admin/navigation_helper.rb

@@ -152,7 +152,7 @@ module Spree
         options[:class] = (options[:class].to_s + " icon-link with-tip action-#{icon_name}").strip
         options[:class] += ' no-text' if options[:no_text]
         options[:title] = text if options[:no_text]
-        text = options[:no_text] ? '' : raw("<span class='text'>#{text}</span>")
+        text = options[:no_text] ? '' : content_tag(:span, text, class: 'text')
         options.delete(:no_text)
         if icon_name
           icon = content_tag(:span, '', class: "icon icon-#{icon_name}")

data/app/helpers/spree/admin/orders_helper.rb

@@ -12,7 +12,7 @@ module Spree
                                     :data => { :confirm => Spree.t(:order_sure_want_to, :event => Spree.t(event)) })
           end
         end
-        links.join(' ').html_safe
+        safe_join(links, ' '.html_safe)
       end
 
       def line_item_shipment_price(line_item, quantity)

data/app/helpers/spree/admin/products_helper.rb

@@ -9,7 +9,8 @@ module Spree
                       :selected => ('selected' if selected)) do
             (taxon.ancestors.pluck(:name) + [taxon.name]).join(" -> ")
           end
-        end.join("").html_safe
+        end
+        safe_join(options)
       end
 
       def option_types_options_for(product)
@@ -20,7 +21,8 @@ module Spree
                       :selected => ('selected' if selected)) do
             option_type.name
           end
-        end.join("").html_safe
+        end
+        safe_join(options)
       end
     end
   end

data/app/helpers/spree/admin/stock_movements_helper.rb

@@ -15,9 +15,9 @@ module Spree
 
       def display_variant(stock_movement)
         variant = stock_movement.stock_item.variant
-        output = variant.name
-        output += "<br>(#{variant.options_text})" unless variant.options_text.blank?
-        output.html_safe
+        output = [variant.name]
+        output << variant.options_text unless variant.options_text.blank?
+        safe_join(output, '<br />'.html_safe)
       end
     end
   end

data/app/views/spree/admin/search/users.rabl

@@ -1,4 +1,4 @@
-collection(@users)
+collection(@users => :users)
 attributes :email, :id
 address_fields = [:firstname, :lastname,
   :address1, :address2,

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_backend
 version: !ruby/object:Gem::Version
-  version: 3.0.6.1
+  version: 3.0.7
 platform: ruby
 authors:
 - Sean Schofield
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-02-18 00:00:00.000000000 Z
+date: 2016-02-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: spree_api
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.0.6.1
+        version: 3.0.7
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.0.6.1
+        version: 3.0.7
 - !ruby/object:Gem::Dependency
   name: spree_core
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.0.6.1
+        version: 3.0.7
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.0.6.1
+        version: 3.0.7
 - !ruby/object:Gem::Dependency
   name: bootstrap-sass
   requirement: !ruby/object:Gem::Requirement