spree_core 2.3.12 → 2.3.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 65ea4c6536760142878867963831fef1329d7df0
-  data.tar.gz: e12480669bff9bbc377cc0dd6e8a217691372748
+  metadata.gz: 01725f9ca0e549175b6eff9da2061ad94f0e24c6
+  data.tar.gz: 812d8b5e508a5ccbd8e0a53728335a5d43a25b30
 SHA512:
-  metadata.gz: de264bbcb4b2ea76676cd1375181762ee9005b2501d5ed5683abba07bd502131ea5fe96bb72c21854feff74e8835d0034d2da96549c0463d3a1c9603bb926802
-  data.tar.gz: 388c0871a6518c6f045ed376d1b8121204cb8cf3a07b70a4f6761fe9e0311e9daa68ef1d4dc37677325dd59ba766fc67b6d63f3e7eb3b25100e0251d6f6f35ef
+  metadata.gz: a56c3a3d6b44d2b584668fbeebace2bcb389d2962a8959345fa84f676b315417eeedf61b56152e6a3b42ede1c0173efcb401715a5c244d0c99a27370cf93aa34
+  data.tar.gz: 0c4f145ce06584f368f388c3c7a1825a7f5458109abb68ba2c297b748428b7ff04e897568deb072fb55ccfaee5a3fa6e7badf6eda55014dd3a69fdeac0480ea2

data/app/models/concerns/spree/ransackable_attributes.rb

@@ -0,0 +1,19 @@
+module Spree::RansackableAttributes
+  extend ActiveSupport::Concern
+  included do
+    class_attribute :whitelisted_ransackable_associations
+    class_attribute :whitelisted_ransackable_attributes
+
+    class_attribute :default_ransackable_attributes
+    self.default_ransackable_attributes = %w[id name]
+
+    def self.ransackable_associations(*args)
+      self.whitelisted_ransackable_associations || []
+    end
+
+    def self.ransackable_attributes(*args)
+      self.default_ransackable_attributes | (self.whitelisted_ransackable_attributes || [])
+    end
+  end
+
+end

data/app/models/spree/address.rb

@@ -14,6 +14,9 @@ module Spree
     alias_attribute :first_name, :firstname
     alias_attribute :last_name, :lastname
 
+
+    self.whitelisted_ransackable_attributes = %w[firstname lastname]
+
     def self.build_default
       country = Spree::Country.find(Spree::Config[:default_country_id]) rescue Spree::Country.first
       new(country: country)

data/app/models/spree/base.rb

@@ -1,6 +1,9 @@
 class Spree::Base < ActiveRecord::Base
   include Spree::Preferences::Preferable
   serialize :preferences, Hash
+
+  include Spree::RansackableAttributes
+
   after_initialize do
     self.preferences = default_preferences.merge(preferences) if has_attribute?(:preferences)
   end

data/app/models/spree/line_item.rb

@@ -35,6 +35,9 @@ module Spree
 
     attr_accessor :target_shipment
 
+    self.whitelisted_ransackable_associations = ['variant']
+    self.whitelisted_ransackable_attributes = ['variant_id']
+
     def copy_price
       if variant
         self.price = variant.price if price.nil?

data/app/models/spree/option_value.rb

@@ -8,6 +8,8 @@ module Spree
 
     after_touch :touch_all_variants
 
+    self.whitelisted_ransackable_attributes = ['presentation']
+
     def touch_all_variants
       # This can cause a cascade of products to be updated
       # To disable it in Rails 4.1, we can do this:

data/app/models/spree/order.rb

@@ -15,6 +15,9 @@ module Spree
       remove_transition from: :delivery, to: :confirm
     end
 
+    self.whitelisted_ransackable_associations = %w[shipments user promotions bill_address ship_address line_items]
+    self.whitelisted_ransackable_attributes =  %w[completed_at created_at email number state payment_state shipment_state total considered_risky]
+
     attr_reader :coupon_code
     attr_accessor :temporary_address
 

data/app/models/spree/price.rb

@@ -12,6 +12,8 @@ module Spree
     end
     alias :display_price :display_amount
 
+    self.whitelisted_ransackable_attributes = ['amount']
+
     def money
       Spree::Money.new(amount || 0, { currency: currency })
     end

data/app/models/spree/product.rb

@@ -97,6 +97,9 @@ module Spree
 
     alias :options :product_option_types
 
+    self.whitelisted_ransackable_associations = %w[stores variants_including_master master variants]
+    self.whitelisted_ransackable_attributes = %w[slug]
+
     # the master variant is not a member of the variants array
     def has_variants?
       variants.any?

data/app/models/spree/product_property.rb

@@ -9,6 +9,8 @@ module Spree
 
     default_scope -> { order("#{self.table_name}.position") }
 
+    self.whitelisted_ransackable_attributes = ['value']
+
     # virtual attributes for use with AJAX completion stuff
     def property_name
       property.name if property

data/app/models/spree/promotion.rb

@@ -25,6 +25,8 @@ module Spree
     scope :coupons, ->{ where("#{table_name}.code IS NOT NULL") }
     scope :applied, -> { joins(:orders).uniq }
 
+    self.whitelisted_ransackable_attributes = ['code', 'path', 'promotion_category_id']
+
     def self.advertised
       where(advertise: true)
     end

data/app/models/spree/property.rb

@@ -11,6 +11,8 @@ module Spree
 
     after_touch :touch_all_products
 
+    self.whitelisted_ransackable_attributes = ['presentation']
+
     def self.find_all_by_prototype(prototype)
       id = prototype
       id = prototype.id if prototype.class == Prototype

data/app/models/spree/return_authorization.rb

@@ -22,6 +22,12 @@ module Spree
       end
     end
 
+    self.whitelisted_ransackable_attributes = ['reason']
+
+    def pre_tax_total
+      return_items.sum(:pre_tax_amount)
+    end
+
     def currency
       order.nil? ? Spree::Config[:currency] : order.currency
     end

data/app/models/spree/shipment.rb

@@ -93,6 +93,8 @@ module Spree
       selected_shipping_rate.try(:shipping_method) || shipping_rates.first.try(:shipping_method)
     end
 
+    self.whitelisted_ransackable_attributes = ['number']
+
     def add_shipping_method(shipping_method, selected = false)
       shipping_rates.create(shipping_method: shipping_method, selected: selected, cost: cost)
     end

data/app/models/spree/stock_item.rb

@@ -19,6 +19,8 @@ module Spree
     after_save :conditional_variant_touch, if: :changed?
     after_touch { variant.touch }
 
+    self.whitelisted_ransackable_attributes = ['count_on_hand', 'stock_location_id']
+
     def backordered_inventory_units
       Spree::InventoryUnit.backordered_for_stock_item(self)
     end

data/app/models/spree/stock_movement.rb

@@ -15,6 +15,8 @@ module Spree
 
     scope :recent, -> { order('created_at DESC') }
 
+    self.whitelisted_ransackable_attributes = ['quantity']
+
     def readonly?
       !new_record?
     end

data/app/models/spree/stock_transfer.rb

@@ -7,6 +7,8 @@ module Spree
 
     make_permalink field: :number, prefix: 'T'
 
+    self.whitelisted_ransackable_attributes = %w[reference source_location_id destination_location_id closed_at created_at number]
+
     def to_param
       number
     end

data/app/models/spree/variant.rb

@@ -49,6 +49,9 @@ module Spree
 
     after_touch :clear_in_stock_cache
 
+    self.whitelisted_ransackable_associations = %w[option_values product prices default_price]
+    self.whitelisted_ransackable_attributes = %w[weight sku]
+
     def self.active(currency = nil)
       joins(:prices).where(deleted_at: nil).where('spree_prices.currency' => currency || Spree::Config[:currency]).where('spree_prices.amount IS NOT NULL')
     end

data/app/models/spree/zone.rb

@@ -11,6 +11,8 @@ module Spree
     alias :members :zone_members
     accepts_nested_attributes_for :zone_members, allow_destroy: true, reject_if: proc { |a| a['zoneable_id'].blank? }
 
+    self.whitelisted_ransackable_attributes = ['description']
+
     def self.default_tax
       where(default_tax: true).first
     end

data/config/initializers/user_class_extensions.rb

@@ -15,6 +15,14 @@ Spree::Core::Engine.config.to_prepare do
       belongs_to :ship_address, class_name: 'Spree::Address'
       belongs_to :bill_address, class_name: 'Spree::Address'
 
+      def self.ransackable_associations(auth_object=nil)
+        %w[bill_address ship_address]
+      end
+
+      def self.ransackable_attributes(auth_object=nil)
+        %w[id email]
+      end
+
       # has_spree_role? simply needs to return true or false whether a user has a role or not.
       def has_spree_role?(role_in_question)
         spree_roles.where(name: role_in_question.to_s).any?

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
   def self.version
-    '2.3.12'
+    '2.3.13'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_core
 version: !ruby/object:Gem::Version
-  version: 2.3.12
+  version: 2.3.13
 platform: ruby
 authors:
 - Sean Schofield
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-07-28 00:00:00.000000000 Z
+date: 2015-08-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activemerchant
@@ -334,6 +334,7 @@ files:
 - app/mailers/spree/order_mailer.rb
 - app/mailers/spree/shipment_mailer.rb
 - app/mailers/spree/test_mailer.rb
+- app/models/concerns/spree/ransackable_attributes.rb
 - app/models/concerns/spree/user_api_authentication.rb
 - app/models/concerns/spree/user_reporting.rb
 - app/models/spree/ability.rb