spree_core 2.4.9 → 2.4.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: a521e65bfd71b442a333dda2b8a985f260271bb5
-  data.tar.gz: 74ef210d20467f665bf8291f0809faa233dd35ad
+  metadata.gz: 920d1116f3ab6e3411d25cbb20a68d9a3219dc54
+  data.tar.gz: 5ce011d689d7dc2c8b5daa7af24fa35cda922a75
 SHA512:
-  metadata.gz: 2869743bc9699dcf28957325fd4ad920e78291c727159365572f370dab947a2a9079ff07b3274726687ae07c00e4dc0e32d1de2baaa0825b63a7bcc727f8f207
-  data.tar.gz: 826b25d6ed1d4261afd38c27f50b9a3d98443199a17d64edfa6d421ea169af2b6a8c94d226dc0de5f59e4e6d993c7892e8643df9355b7f52ee7f060c56a5d8a4
+  metadata.gz: 1904b47e5b0daea447eac9c638e2ea0b781758ed32e8f8e30f07e361bfa1e8bfbdce55d100f2678043d6bbe80a2ef3a130628d5b619790d615d6cd1830108392
+  data.tar.gz: bcad22a5914ca2dfc426588ec7ccaaefe6169801d4f8b3e0366e3f71b517e1042e84a60d819bd0eed13d39b76ca435c93359fc1dafa854c05f9303e0832ed227

data/app/models/concerns/spree/ransackable_attributes.rb

@@ -0,0 +1,19 @@
+module Spree::RansackableAttributes
+  extend ActiveSupport::Concern
+  included do
+    class_attribute :whitelisted_ransackable_associations
+    class_attribute :whitelisted_ransackable_attributes
+
+    class_attribute :default_ransackable_attributes
+    self.default_ransackable_attributes = %w[id name]
+
+    def self.ransackable_associations(*args)
+      self.whitelisted_ransackable_associations || []
+    end
+
+    def self.ransackable_attributes(*args)
+      self.default_ransackable_attributes | (self.whitelisted_ransackable_attributes || [])
+    end
+  end
+
+end

data/app/models/spree/address.rb

@@ -16,6 +16,8 @@ module Spree
     alias_attribute :first_name, :firstname
     alias_attribute :last_name, :lastname
 
+    self.whitelisted_ransackable_attributes = %w[firstname lastname]
+
     def self.build_default
       country = Spree::Country.find(Spree::Config[:default_country_id]) rescue Spree::Country.first
       new(country: country)

data/app/models/spree/app_configuration.rb

@@ -36,7 +36,7 @@ module Spree
     preference :auto_capture, :boolean, default: false # automatically capture the credit card (as opposed to just authorize and capture later)
     preference :auto_capture_on_dispatch, :boolean, default: false # Captures payment for each shipment in Shipment#after_ship callback, and makes Shipment.ready when payment authorized.
     preference :binary_inventory_cache, :boolean, default: false # only invalidate product cache when a stock item changes whether it is in_stock
-    preference :check_for_spree_alerts, :boolean, default: true
+    preference :check_for_spree_alerts, :boolean, default: false
     preference :checkout_zone, :string, default: nil # replace with the name of a zone if you would like to limit the countries
     preference :company, :boolean, default: false # Request company field for billing and shipping addr
     preference :currency, :string, default: "USD"

data/app/models/spree/base.rb

@@ -1,6 +1,9 @@
 class Spree::Base < ActiveRecord::Base
   include Spree::Preferences::Preferable
   serialize :preferences, Hash
+
+  include Spree::RansackableAttributes
+
   after_initialize do
     self.preferences = default_preferences.merge(preferences) if has_attribute?(:preferences)
   end

data/app/models/spree/line_item.rb

@@ -35,6 +35,9 @@ module Spree
 
     attr_accessor :target_shipment
 
+    self.whitelisted_ransackable_associations = ['variant']
+    self.whitelisted_ransackable_attributes = ['variant_id']
+
     def copy_price
       if variant
         self.price = variant.price if price.nil?

data/app/models/spree/option_value.rb

@@ -9,6 +9,8 @@ module Spree
 
     after_touch :touch_all_variants
 
+    self.whitelisted_ransackable_attributes = ['presentation']
+
     def touch_all_variants
       variants.update_all(updated_at: Time.current)
     end

data/app/models/spree/order.rb

@@ -21,6 +21,9 @@ module Spree
       remove_transition from: :delivery, to: :confirm
     end
 
+    self.whitelisted_ransackable_associations = %w[shipments user promotions bill_address ship_address line_items]
+    self.whitelisted_ransackable_attributes =  %w[completed_at created_at email number state payment_state shipment_state total considered_risky]
+
     attr_reader :coupon_code
     attr_accessor :temporary_address, :temporary_credit_card
 

data/app/models/spree/price.rb

@@ -12,6 +12,8 @@ module Spree
     end
     alias :display_price :display_amount
 
+    self.whitelisted_ransackable_attributes = ['amount']
+
     def money
       Spree::Money.new(amount || 0, { currency: currency })
     end

data/app/models/spree/product.rb

@@ -99,6 +99,9 @@ module Spree
 
     alias :options :product_option_types
 
+    self.whitelisted_ransackable_associations = %w[stores variants_including_master master variants]
+    self.whitelisted_ransackable_attributes = %w[slug]
+
     # the master variant is not a member of the variants array
     def has_variants?
       variants.any?

data/app/models/spree/product_property.rb

@@ -11,6 +11,8 @@ module Spree
 
     default_scope -> { order("#{self.table_name}.position") }
 
+    self.whitelisted_ransackable_attributes = ['value']
+
     # virtual attributes for use with AJAX completion stuff
     def property_name
       property.name if property

data/app/models/spree/promotion.rb

@@ -32,6 +32,8 @@ module Spree
 
     scope :applied, -> { joins("INNER JOIN #{order_join_table} ON #{order_join_table}.promotion_id = #{table_name}.id").uniq }
 
+    self.whitelisted_ransackable_attributes = ['code', 'path', 'promotion_category_id']
+
     def self.advertised
       where(advertise: true)
     end

data/app/models/spree/property.rb

@@ -11,6 +11,8 @@ module Spree
 
     after_touch :touch_all_products
 
+    self.whitelisted_ransackable_attributes = ['presentation']
+
     private
 
     def touch_all_products

data/app/models/spree/reimbursement.rb

@@ -83,9 +83,9 @@ module Spree
     end
 
     def calculated_total
-      # rounding down to handle edge cases for consecutive partial returns where rounding
-      # might cause us to try to reimburse more than was originally billed
-      return_items.to_a.sum(&:total).to_d.round(2, :down)
+      # rounding every return item individually to handle edge cases for consecutive partial
+      # returns where rounding might cause us to try to reimburse more than was originally billed
+      return_items.map { |ri| ri.total.to_d.round(2) }.sum
     end
 
     def paid_amount

data/app/models/spree/reimbursement_type/credit.rb

@@ -4,7 +4,7 @@ module Spree
 
     class << self
       def reimburse(reimbursement, return_items, simulate)
-        unpaid_amount = return_items.sum(&:total).round(2, :down)
+        unpaid_amount = return_items.map { |ri| ri.total.to_d.round(2) }.sum
         reimbursement_list, unpaid_amount = create_credits(reimbursement, unpaid_amount, simulate)
         reimbursement_list
       end

data/app/models/spree/reimbursement_type/original_payment.rb

@@ -3,7 +3,7 @@ class Spree::ReimbursementType::OriginalPayment < Spree::ReimbursementType
 
   class << self
     def reimburse(reimbursement, return_items, simulate)
-      unpaid_amount = return_items.sum(&:total).round(2, :down)
+      unpaid_amount = return_items.map { |ri| ri.total.to_d.round(2) }.sum
       payments = reimbursement.order.payments.completed
 
       refund_list, unpaid_amount = create_refunds(reimbursement, payments, unpaid_amount, simulate)

data/app/models/spree/return_authorization.rb

@@ -34,6 +34,8 @@ module Spree
 
     end
 
+    self.whitelisted_ransackable_attributes = ['memo']
+
     def pre_tax_total
       return_items.sum(:pre_tax_amount)
     end

data/app/models/spree/shipment.rb

@@ -76,6 +76,8 @@ module Spree
       end
     end
 
+    self.whitelisted_ransackable_attributes = ['number']
+
     def add_shipping_method(shipping_method, selected = false)
       shipping_rates.create(shipping_method: shipping_method, selected: selected, cost: cost)
     end

data/app/models/spree/stock_item.rb

@@ -19,6 +19,8 @@ module Spree
     after_save :conditional_variant_touch, if: :changed?
     after_touch { variant.touch }
 
+    self.whitelisted_ransackable_attributes = ['count_on_hand', 'stock_location_id']
+
     def backordered_inventory_units
       Spree::InventoryUnit.backordered_for_stock_item(self)
     end

data/app/models/spree/stock_movement.rb

@@ -15,6 +15,8 @@ module Spree
 
     scope :recent, -> { order('created_at DESC') }
 
+    self.whitelisted_ransackable_attributes = ['quantity']
+
     def readonly?
       !new_record?
     end

data/app/models/spree/stock_transfer.rb

@@ -7,6 +7,8 @@ module Spree
 
     make_permalink field: :number, prefix: 'T'
 
+    self.whitelisted_ransackable_attributes = %w[reference source_location_id destination_location_id closed_at created_at number]
+
     def to_param
       number
     end

data/app/models/spree/variant.rb

@@ -43,6 +43,9 @@ module Spree
 
     scope :in_stock, -> { joins(:stock_items).where('count_on_hand > ? OR track_inventory = ?', 0, false) }
 
+    self.whitelisted_ransackable_associations = %w[option_values product prices default_price]
+    self.whitelisted_ransackable_attributes = %w[weight sku]
+
     def self.active(currency = nil)
       joins(:prices).where(deleted_at: nil).where('spree_prices.currency' => currency || Spree::Config[:currency]).where('spree_prices.amount IS NOT NULL')
     end

data/app/models/spree/zone.rb

@@ -11,6 +11,8 @@ module Spree
     alias :members :zone_members
     accepts_nested_attributes_for :zone_members, allow_destroy: true, reject_if: proc { |a| a['zoneable_id'].blank? }
 
+    self.whitelisted_ransackable_attributes = ['description']
+
     def self.default_tax
       where(default_tax: true).first
     end

data/config/initializers/user_class_extensions.rb

@@ -15,6 +15,14 @@ Spree::Core::Engine.config.to_prepare do
       belongs_to :ship_address, class_name: 'Spree::Address'
       belongs_to :bill_address, class_name: 'Spree::Address'
 
+      def self.ransackable_associations(auth_object=nil)
+        %w[bill_address ship_address]
+      end
+
+      def self.ransackable_attributes(auth_object=nil)
+        %w[id email]
+      end
+
       # has_spree_role? simply needs to return true or false whether a user has a role or not.
       def has_spree_role?(role_in_question)
         spree_roles.where(name: role_in_question.to_s).any?

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
   def self.version
-    '2.4.9'
+    '2.4.10'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_core
 version: !ruby/object:Gem::Version
-  version: 2.4.9
+  version: 2.4.10
 platform: ruby
 authors:
 - Sean Schofield
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-07-28 00:00:00.000000000 Z
+date: 2015-08-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activemerchant
@@ -381,6 +381,7 @@ files:
 - app/models/concerns/spree/calculated_adjustments.rb
 - app/models/concerns/spree/default_price.rb
 - app/models/concerns/spree/named_type.rb
+- app/models/concerns/spree/ransackable_attributes.rb
 - app/models/concerns/spree/user_address.rb
 - app/models/concerns/spree/user_api_authentication.rb
 - app/models/concerns/spree/user_payment_source.rb