spree_core 3.4.2 → 3.4.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 68cb55c21ddd24f8248dca5549bc6cdb7ce2460c
-  data.tar.gz: b4ca12837622c5f82832b9e7e074e5b77a2fb294
+  metadata.gz: b40b001a02d80dd28675476b606bad24d0b6ca37
+  data.tar.gz: ef12f4025bdf9dccc1f6c309fd8e10e60afddd4b
 SHA512:
-  metadata.gz: 0eae5883047bcd05bae1feeb7f6cd1bea296466e28a2b12311f4dddb5c1d7c380e9a60844dfa91e017979bce09f4e85c1d689de4f104a4161b4d1c83acbc2a2f
-  data.tar.gz: a32117843440c4a5c6233bc52feac36293bdaf34ae3568c06df67901c2f4fa3b973d56346bb7a620ef4bef93a850fa517cbea09ff1a95fbf74eded59003a2007
+  metadata.gz: c0e5fe4e45e6f9a80ec20e7fdbd8a3f289b98de4a6b5f729c149e39796bfa04dfaaf8c9d98725e8754faa4a0eb6ad77090f5dd505d60a983aa12426e168f3cc7
+  data.tar.gz: 80a5b7eccac0e49e8cd5d287d8dff818a1965086476b6b2fb440a9c7bdc8a5d87f4c2f59d81d3500dc978cdaf74f350a0e7c01d4382af564122203515d4b62e4

data/app/models/spree/order.rb

@@ -620,6 +620,22 @@ module Spree
       promotions.pluck(:code).compact.first
     end
 
+    def payments_attributes=(attributes)
+      validate_payments_attributes(attributes)
+      super(attributes)
+    end
+
+    def validate_payments_attributes(attributes)
+      # Ensure the payment methods specified are allowed for this user
+      payment_methods = Spree::PaymentMethod.where(id: available_payment_methods.map(&:id))
+      attributes.each do |payment_attributes|
+        payment_method_id = payment_attributes[:payment_method_id]
+
+        # raise RecordNotFound unless it is an allowed payment method
+        payment_methods.find(payment_method_id) if payment_method_id
+      end
+    end
+
     private
 
     def link_by_email

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
   def self.version
-    '3.4.2'
+    '3.4.3'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_core
 version: !ruby/object:Gem::Version
-  version: 3.4.2
+  version: 3.4.3
 platform: ruby
 authors:
 - Sean Schofield
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-12-08 00:00:00.000000000 Z
+date: 2017-12-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activemerchant