spree_core 3.3.3 → 3.3.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 2733d8bdc6f559cdb36ce0472c8ee4ade4553661
-  data.tar.gz: '092f9dea7f54cadb2ffee7411048e487f55a1dee'
+  metadata.gz: ef97b18bc947e484d5e2b6af1d3c79d1c4d3acc4
+  data.tar.gz: c544d43cc2f5699ec49ac9809de2b26ca987dfeb
 SHA512:
-  metadata.gz: ecbd86b49f4c2cce96708c8d9b174b8ea50eee7f2e66a7c8764a291d0b11b3067495619e1359bd92c40dcc82e675b63c7885f3f029a2b95210fcf80c4fb99a4a
-  data.tar.gz: f1287c901c06a5116fec3009f28a5a7649b2faf949537f6f8039582b7c4071135ab897de158644f21f92ef789a9f8ba42e75907e0cdf61dd0572fddfdf6d0533
+  metadata.gz: 21b387e7572157536d6e520802fd4b9832022fd03d2b2ba2edf0be1bb3e84d305ecac88d2fef304253bdc37b67582b4fad6290796be9174c8ce97a6e82cdb591
+  data.tar.gz: a4b127e56df213db4d280012ecf086501619a71c3b8f4a1dc42a6143581b02a50621267f9b8d7322f62821725b99fcb6dd462cc79ce30ef92082569a656203ce

data/app/models/spree/order.rb

@@ -622,6 +622,22 @@ module Spree
       promotions.pluck(:code).compact.first
     end
 
+    def payments_attributes=(attributes)
+      validate_payments_attributes(attributes)
+      super(attributes)
+    end
+
+    def validate_payments_attributes(attributes)
+      # Ensure the payment methods specified are allowed for this user
+      payment_methods = Spree::PaymentMethod.where(id: available_payment_methods.map(&:id))
+      attributes.each do |payment_attributes|
+        payment_method_id = payment_attributes[:payment_method_id]
+
+        # raise RecordNotFound unless it is an allowed payment method
+        payment_methods.find(payment_method_id) if payment_method_id
+      end
+    end
+
     private
 
     def link_by_email

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
   def self.version
-    "3.3.3"
+    "3.3.4"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_core
 version: !ruby/object:Gem::Version
-  version: 3.3.3
+  version: 3.3.4
 platform: ruby
 authors:
 - Sean Schofield
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-12-08 00:00:00.000000000 Z
+date: 2017-12-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activemerchant