spree_core 0.50.3 → 0.50.4

data/app/models/product_group.rb

@@ -90,10 +90,14 @@ class ProductGroup < ActiveRecord::Base
   end
 
   def add_scope(scope_name, arguments=[])
-    self.product_scopes << ProductScope.new({
-        :name => scope_name.to_s,
-        :arguments => [*arguments]
-      })
+    if scope_name.to_s !~ /eval|send|system|[^a-z0-9_!?]/
+      self.product_scopes << ProductScope.new({
+          :name => scope_name.to_s,
+          :arguments => [*arguments]
+        })
+    else
+      raise ArgumentError.new("'#{scope_name}` can't be used as scope")
+    end
     self
   end
 

data/app/models/product_scope.rb

@@ -31,7 +31,7 @@ class ProductScope < ActiveRecord::Base
                       Product.send(self.name.intern, *array)
                   end
     else
-      relation2 = Product.search({self.name.intern => array}).relation
+      relation2 = Product.metasearch({self.name.intern => array}).relation
     end
     unless another_scope.class == ActiveRecord::Relation
       another_scope = another_scope.send(:relation)

data/lib/spree_core/version.rb

@@ -1,5 +1,5 @@
 module Spree
   def self.version
-    "0.50.3"
+    "0.50.4"
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: spree_core
 version: !ruby/object:Gem::Version 
-  hash: 209
+  hash: 223
   prerelease: 
   segments: 
   - 0
   - 50
-  - 3
-  version: 0.50.3
+  - 4
+  version: 0.50.4
 platform: ruby
 authors: 
 - Sean Schofield