spree_core 5.0.6 → 5.0.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 964d9b4646aa2d9c5ac22647f126c304bc7756b3034757b8bda9b0f9faa6d496
-  data.tar.gz: '07803df2f7c528d8a35c10b04f02f591b4c2ffe859163c7b2c94e5ad0edfc388'
+  metadata.gz: c87f4abd941d499270077f37fb1f2e7d3905796e81bdebba35cb20f66349cdb0
+  data.tar.gz: 33286e4357f7051a22ef1bfe56dcd1292f1931beb0cff4bb02396db79568b85f
 SHA512:
-  metadata.gz: 36a5518a9bfd31ed6b6b3a74df7953534a8568cc36a7204acf0eca5499e93bd0b88068f35bd8b7dcbc52d09b9f47ea629cfa582a39d24d717d61c9803e865748
-  data.tar.gz: 46fb9aab1ceafb1d44f872e870908e3ff0df44458c4b6248a4bc6e54655f4de4e457b47c9a5c8c133b16cc631f93226a0280585cb8ebee3920b677cd48acee40
+  metadata.gz: f8dd54b9b45f81dac694b61c8fc6520c9a26c4b995637413dc195552e8e5931ac57c236af3a4f5ccf3100fdf18ac97a84eecbb2b261dd250a7452572ae2fbd9a
+  data.tar.gz: 9db37625c009f49a5d1e4a6c5d7207f9a4dda570f3f33fd01abdb2117972138a247b2cc0ff37b4f9350b3d3e863d82103fd864eeb672190baba6de05d3e58c1d

data/app/models/spree/ability.rb

@@ -75,7 +75,8 @@ module Spree
       can :update, ::Spree::Order do |order, token|
         !order.completed? && (order.user == user || order.token && token == order.token)
       end
-      can :manage, ::Spree::Address, user_id: user.id
+      # Address management - only for persisted users with matching user_id
+      can :manage, ::Spree::Address, user_id: user.id if user.persisted?
       can [:read, :destroy], ::Spree::CreditCard, user_id: user.id
       can :read, ::Spree::Product
       can :read, ::Spree::ProductProperty

data/app/services/spree/checkout/update.rb

@@ -5,6 +5,10 @@ module Spree
       include Spree::Addresses::Helper
 
       def call(order:, params:, permitted_attributes:, request_env:)
+        # Validate address ownership to prevent IDOR attacks
+        address_ownership_error = validate_address_ownership(order, params)
+        return failure(order, address_ownership_error) if address_ownership_error
+
         ship_changed = address_with_country_iso_present?(params, 'ship')
         bill_changed = address_with_country_iso_present?(params, 'bill')
         params[:order][:ship_address_attributes] = replace_country_iso_with_id(params[:order][:ship_address_attributes]) if ship_changed
@@ -26,6 +30,26 @@ module Spree
 
       private
 
+      def validate_address_ownership(order, params)
+        return nil unless params[:order]
+
+        %w[bill ship].each do |address_kind|
+          address_id = params[:order].dig("#{address_kind}_address_attributes".to_sym, :id)
+          next unless address_id
+
+          address = Spree::Address.find_by(id: address_id)
+          next unless address
+
+          # Allow if address has no user (guest address) or belongs to the order's user
+          next if address.user_id.nil?
+          next if order.user_id.present? && address.user_id == order.user_id
+
+          return Spree.t(:address_not_owned_by_user)
+        end
+
+        nil
+      end
+
       def address_with_country_iso_present?(params, address_kind = 'ship')
         return false unless params.dig(:order, "#{address_kind}_address_attributes".to_sym, :country_iso)
         return false if params.dig(:order, "#{address_kind}_address_attributes".to_sym, :country_id)

data/config/locales/en.yml

@@ -608,6 +608,7 @@ en:
       successfully_updated: Updated successfully
       unsuccessfully_saved: There was an error while trying to save your address.
       unsuccessfully_updated: There was an update while trying to update your address.
+    address_not_owned_by_user: The specified address does not belong to this user.
     addresses: Addresses
     adjustable: Adjustable
     adjustment: Adjustment

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '5.0.6'.freeze
+  VERSION = '5.0.7'.freeze
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_core
 version: !ruby/object:Gem::Version
-  version: 5.0.6
+  version: 5.0.7
 platform: ruby
 authors:
 - Sean Schofield
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-08-06 00:00:00.000000000 Z
+date: 2026-01-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n-tasks
@@ -1312,9 +1312,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.0.6
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.0.7
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.0.6
+  source_code_uri: https://github.com/spree/spree/tree/v5.0.7
 post_install_message:
 rdoc_options: []
 require_paths: