spree_core 4.10.1 → 4.10.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 918652467235e29f0c6defaeddbb7530e77c10f67f12abe2355b6e66c1401b86
-  data.tar.gz: 685c2ec7206e68233b5811dc8f5ab3ab47029a3fd07431db724b79da47175fea
+  metadata.gz: 5a3f970e11df3f92c53436155f90c3d5e10ee3f8dbac77c15096b5b69f23e1a1
+  data.tar.gz: 8b0487012673c1da44270b625b22af7ab74a2bc3db16ead5ccf0bd1ac514a3bd
 SHA512:
-  metadata.gz: e4ab07e13870ed8a97caeb349f37d439090081ed7d693b76858bea8718f698d2546664315f2525c1134dfa7633c2068dd82d9bebc77a41e59f094deb4d7b54ee
-  data.tar.gz: dacf561acf437770b5ad7291c5785a2eed28d53056a30b3eb6480146d862c6332b9849849344cc91e7c69b63cc77e73aeab373c0601ecc760eb2c46f9ed2322b
+  metadata.gz: 6f28e8ac4fbb702c5ff5764d18976b5246bf5d2f89659e3068e2df99e0ec5aa422e8ca7e719e0f724a70bcb9b973ef30b82a6ae4acbe2980b346092bccd6009b
+  data.tar.gz: deab9f6152ded24ae86ec5bff925a0858f17d13d372d0a769cff47dc38c469d66fff8ad58931e59d1eac959f78ef8a62d7c4521ca618ecb38cccef7169f1a265

data/app/models/spree/ability.rb

@@ -73,7 +73,8 @@ module Spree
       can :update, ::Spree::Order do |order, token|
         !order.completed? && (order.user == user || order.token && token == order.token)
       end
-      can :manage, ::Spree::Address, user_id: user.id
+      # Address management - only for persisted users with matching user_id
+      can :manage, ::Spree::Address, user_id: user.id if user.persisted?
       can [:read, :destroy], ::Spree::CreditCard, user_id: user.id
       can :read, ::Spree::Product
       can :read, ::Spree::ProductProperty

data/app/services/spree/checkout/update.rb

@@ -5,6 +5,10 @@ module Spree
       include Spree::Addresses::Helper
 
       def call(order:, params:, permitted_attributes:, request_env:)
+        # Validate address ownership to prevent IDOR attacks
+        address_ownership_error = validate_address_ownership(order, params)
+        return failure(order, address_ownership_error) if address_ownership_error
+
         ship_changed = address_with_country_iso_present?(params, 'ship')
         bill_changed = address_with_country_iso_present?(params, 'bill')
         params[:order][:ship_address_attributes] = replace_country_iso_with_id(params[:order][:ship_address_attributes]) if ship_changed
@@ -18,6 +22,26 @@ module Spree
 
       private
 
+      def validate_address_ownership(order, params)
+        return nil unless params[:order]
+
+        %w[bill ship].each do |address_kind|
+          address_id = params[:order].dig("#{address_kind}_address_attributes".to_sym, :id)
+          next unless address_id
+
+          address = Spree::Address.find_by(id: address_id)
+          next unless address
+
+          # Allow if address has no user (guest address) or belongs to the order's user
+          next if address.user_id.nil?
+          next if order.user_id.present? && address.user_id == order.user_id
+
+          return Spree.t(:address_not_owned_by_user)
+        end
+
+        nil
+      end
+
       def address_with_country_iso_present?(params, address_kind = 'ship')
         return false unless params.dig(:order, "#{address_kind}_address_attributes".to_sym, :country_iso)
         return false if params.dig(:order, "#{address_kind}_address_attributes".to_sym, :country_id)

data/config/locales/en.yml

@@ -548,6 +548,7 @@ en:
       successfully_updated: "Updated successfully"
       unsuccessfully_updated: "There was an update while trying to update your address."
       save: "Save"
+    address_not_owned_by_user: The specified address does not belong to this user.
     adjustable: Adjustable
     adjustment: Adjustment
     adjustment_amount: Amount

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '4.10.1'.freeze
+  VERSION = '4.10.2'.freeze
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_core
 version: !ruby/object:Gem::Version
-  version: 4.10.1
+  version: 4.10.2
 platform: ruby
 authors:
 - Sean Schofield
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-09-06 00:00:00.000000000 Z
+date: 2026-01-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionpack
@@ -1165,9 +1165,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v4.10.1
+  changelog_uri: https://github.com/spree/spree/releases/tag/v4.10.2
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v4.10.1
+  source_code_uri: https://github.com/spree/spree/tree/v4.10.2
 post_install_message:
 rdoc_options: []
 require_paths: