spree_core 2.2.13 → 2.2.14

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 06233152b8be54206a21d59bf2e17a5d4648faed
-  data.tar.gz: 1b924ea30f74b095be4d1e2a422398216769118e
+  metadata.gz: 9abfcb6e2a1a2ca7ab2c85a969e20adf636c1d99
+  data.tar.gz: bc242bb55726abd8ade2e39ab0c916b8f55dcc0b
 SHA512:
-  metadata.gz: 5e0a2c71d5510cb109ef60938f3399de4c4fe15606f021252376901a59472d314c1c1f74c37dbe21919d74fabd4f47c0f126ad3c1922990df6b6edc4c3d5518c
-  data.tar.gz: 7cac8350ffe56e20e061e346920d7dd44aa806ed6f27e8f6a9e1b5cbdf117cca3099d4dac4c97c5cbed11e3b4988987d70bd0c28e06afd829e0a45a380c8ecad
+  metadata.gz: 8a647ec37f24df8c6263501ef76128452751fb2afc06c5734b36fcb37732f4cbfe6bea13ae6f5ad3d4c33d1fcbe72aeb330252c8d412b9e6e816d045ec341f70
+  data.tar.gz: 8c39cb145273c64b9c6fc7f6f01b6222f3b6c235d151e85e2937bb217eab3861a4ec41bc7cebab3b1533eb03bfd89fe826f2096ea5df2ae93259fc3e2d2d59e4

data/app/models/spree/address.rb

@@ -14,6 +14,9 @@ module Spree
     alias_attribute :first_name, :firstname
     alias_attribute :last_name, :lastname
 
+
+    self.whitelisted_ransackable_attributes = %w[firstname lastname]
+
     def self.build_default
       country = Spree::Country.find(Spree::Config[:default_country_id]) rescue Spree::Country.first
       new(country: country)

data/app/models/spree/line_item.rb

@@ -34,6 +34,9 @@ module Spree
 
     attr_accessor :target_shipment
 
+    self.whitelisted_ransackable_associations = ['variant']
+    self.whitelisted_ransackable_attributes = ['variant_id']
+
     def copy_price
       if variant
         self.price = variant.price if price.nil?

data/app/models/spree/option_value.rb

@@ -8,6 +8,8 @@ module Spree
 
     after_touch :touch_all_variants
 
+    self.whitelisted_ransackable_attributes = ['presentation']
+
     def touch_all_variants
       # This can cause a cascade of products to be updated
       # To disable it in Rails 4.1, we can do this:

data/app/models/spree/order.rb

@@ -17,6 +17,9 @@ module Spree
 
     token_resource
 
+    self.whitelisted_ransackable_associations = %w[shipments user promotions bill_address ship_address line_items]
+    self.whitelisted_ransackable_attributes =  %w[completed_at created_at email number state payment_state shipment_state total]
+
     attr_reader :coupon_code
 
     if Spree.user_class

data/app/models/spree/price.rb

@@ -11,6 +11,8 @@ module Spree
     end
     alias :display_price :display_amount
 
+    self.whitelisted_ransackable_attributes = ['amount']
+
     def money
       Spree::Money.new(amount || 0, { currency: currency })
     end

data/app/models/spree/product.rb

@@ -40,7 +40,7 @@ module Spree
       -> { where is_master: true },
       inverse_of: :product,
       class_name: 'Spree::Variant'
-      
+
     has_many :variants,
       -> { where(is_master: false).order("#{::Spree::Variant.quoted_table_name}.position ASC") },
       inverse_of: :product,
@@ -91,6 +91,9 @@ module Spree
 
     after_initialize :ensure_master
 
+    self.whitelisted_ransackable_associations = %w[stores variants_including_master master variants]
+    self.whitelisted_ransackable_attributes = %w[slug]
+
     def to_param
       slug
     end

data/app/models/spree/product_property.rb

@@ -8,6 +8,8 @@ module Spree
 
     default_scope -> { order("#{self.table_name}.position") }
 
+    self.whitelisted_ransackable_attributes = ['value']
+
     # virtual attributes for use with AJAX completion stuff
     def property_name
       property.name if property

data/app/models/spree/promotion.rb

@@ -22,6 +22,8 @@ module Spree
 
     before_save :normalize_blank_values
 
+    self.whitelisted_ransackable_attributes = ['code', 'path', 'promotion_category_id']
+
     def self.advertised
       where(advertise: true)
     end

data/app/models/spree/property.rb

@@ -11,6 +11,8 @@ module Spree
 
     after_touch :touch_all_products
 
+    self.whitelisted_ransackable_attributes = ['presentation']
+
     def self.find_all_by_prototype(prototype)
       id = prototype
       id = prototype.id if prototype.class == Prototype

data/app/models/spree/return_authorization.rb

@@ -22,6 +22,12 @@ module Spree
       end
     end
 
+    self.whitelisted_ransackable_attributes = ['reason']
+
+    def pre_tax_total
+      return_items.sum(:pre_tax_amount)
+    end
+
     def currency
       order.nil? ? Spree::Config[:currency] : order.currency
     end

data/app/models/spree/shipment.rb

@@ -93,6 +93,8 @@ module Spree
       selected_shipping_rate.try(:shipping_method) || shipping_rates.first.try(:shipping_method)
     end
 
+    self.whitelisted_ransackable_attributes = ['number']
+
     def add_shipping_method(shipping_method, selected = false)
       shipping_rates.create(shipping_method: shipping_method, selected: selected, cost: cost)
     end

data/app/models/spree/stock_item.rb

@@ -15,6 +15,8 @@ module Spree
     after_save :conditional_variant_touch, if: :changed?
     after_touch { variant.touch }
 
+    self.whitelisted_ransackable_attributes = ['count_on_hand', 'stock_location_id']
+
     def backordered_inventory_units
       Spree::InventoryUnit.backordered_for_stock_item(self)
     end

data/app/models/spree/stock_movement.rb

@@ -10,6 +10,8 @@ module Spree
 
     scope :recent, -> { order('created_at DESC') }
 
+    self.whitelisted_ransackable_attributes = ['quantity']
+
     def readonly?
       !new_record?
     end

data/app/models/spree/stock_transfer.rb

@@ -7,6 +7,8 @@ module Spree
 
     make_permalink field: :number, prefix: 'T'
 
+    self.whitelisted_ransackable_attributes = %w[reference source_location_id destination_location_id closed_at created_at number]
+
     def to_param
       number
     end

data/app/models/spree/variant.rb

@@ -46,6 +46,9 @@ module Spree
     # default variant scope only lists non-deleted variants
     scope :deleted, lambda { where.not(deleted_at: nil) }
 
+    self.whitelisted_ransackable_associations = %w[option_values product prices default_price]
+    self.whitelisted_ransackable_attributes = %w[weight sku]
+
     def self.active(currency = nil)
       joins(:prices).where(deleted_at: nil).where('spree_prices.currency' => currency || Spree::Config[:currency]).where('spree_prices.amount IS NOT NULL')
     end

data/app/models/spree/zone.rb

@@ -12,6 +12,8 @@ module Spree
     alias :members :zone_members
     accepts_nested_attributes_for :zone_members, allow_destroy: true, reject_if: proc { |a| a['zoneable_id'].blank? }
 
+    self.whitelisted_ransackable_attributes = ['description']
+
     def self.default_tax
       where(default_tax: true).first
     end

data/config/initializers/user_class_extensions.rb

@@ -14,6 +14,14 @@ Spree::Core::Engine.config.to_prepare do
       belongs_to :ship_address, :class_name => 'Spree::Address'
       belongs_to :bill_address, :class_name => 'Spree::Address'
 
+      def self.ransackable_associations(auth_object=nil)
+        %w[bill_address ship_address]
+      end
+
+      def self.ransackable_attributes(auth_object=nil)
+        %w[id email]
+      end
+
       # has_spree_role? simply needs to return true or false whether a user has a role or not.
       def has_spree_role?(role_in_question)
         spree_roles.where(:name => role_in_question.to_s).any?

data/lib/spree/core.rb

@@ -49,6 +49,7 @@ end
 
 require 'spree/core/version'
 
+require 'spree/core/ransackable_attributes'
 require 'spree/core/mail_interceptor'
 require 'spree/core/mail_method'
 require 'spree/core/mail_settings'

data/lib/spree/core/ransackable_attributes.rb

@@ -0,0 +1,15 @@
+ActiveRecord::Base.class_eval do
+  class_attribute :whitelisted_ransackable_associations
+  class_attribute :whitelisted_ransackable_attributes
+
+  class_attribute :default_ransackable_attributes
+  self.default_ransackable_attributes = %w[id name]
+
+  def self.ransackable_associations *arg
+    self.whitelisted_ransackable_associations || []
+  end
+
+  def self.ransackable_attributes *arg
+    self.default_ransackable_attributes | (self.whitelisted_ransackable_attributes || [])
+  end
+end

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
   def self.version
-    '2.2.13'
+    '2.2.14'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_core
 version: !ruby/object:Gem::Version
-  version: 2.2.13
+  version: 2.2.14
 platform: ruby
 authors:
 - Sean Schofield
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-07-28 00:00:00.000000000 Z
+date: 2015-08-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activemerchant
@@ -653,6 +653,7 @@ files:
 - lib/spree/core/permalinks.rb
 - lib/spree/core/product_duplicator.rb
 - lib/spree/core/product_filters.rb
+- lib/spree/core/ransackable_attributes.rb
 - lib/spree/core/routes.rb
 - lib/spree/core/search/base.rb
 - lib/spree/core/token_resource.rb