spree_core 5.1.8 → 5.1.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: faafdd12eff02906a36f5bb9fd89cf7a18b406299b6a2a8590296617ec91d793
-  data.tar.gz: b5c27ee712ea65fa8f4ab6d64b465c740b01338269753a880dc3fb04090470a1
+  metadata.gz: b1748c4271482ee3e96c5906e46485ac20338b04bebd95afd212c745057c8e8c
+  data.tar.gz: 9b09bdfee4bab45b6459ae45613fb7ab5cbc954a35c4faf068af8d6307cd3c49
 SHA512:
-  metadata.gz: '0951f885c20e251d7ec9238d6ab8f3ab32a73d0bafa9ac7978a1afeaacd34f0dfb9cbc94e99a0d96a73e7effa80077a0d5bed960536aee70c802a8abe6ec69ff'
-  data.tar.gz: f1afa96f4c463494168c1a6831effb3ea81c95a42ff72691ab8b1b351ad037da784cd2343c1002af72c574939b4cd2eff772837f888b3b67dd1a14c3b3151e68
+  metadata.gz: 0ead21adfcd25154f5bd90ecc61fed2fc698d3b6732f6b32338428528fc5b56ed84592fd8f758f04286cf75bc0db42cc05ea68eb8e3760bd7da50cec1104c885
+  data.tar.gz: 0fa9c777974240732b85adcb82cb1e2160684e7a0bcd795bb97f90e9145c9a645c1fb0e742786430c236cb88017abf2c55b1ecba3b91e256de2a985afd778888

data/app/models/spree/ability.rb

@@ -78,7 +78,8 @@ module Spree
       can :update, ::Spree::Order do |order, token|
         !order.completed? && (order.user == user || order.token && token == order.token)
       end
-      can :manage, ::Spree::Address, user_id: user.id
+      # Address management - only for persisted users with matching user_id
+      can :manage, ::Spree::Address, user_id: user.id if user.persisted?
       can [:read, :destroy], ::Spree::CreditCard, user_id: user.id
       can :read, ::Spree::Product
       can :read, ::Spree::ProductProperty

data/app/services/spree/checkout/update.rb

@@ -5,6 +5,10 @@ module Spree
       include Spree::Addresses::Helper
 
       def call(order:, params:, permitted_attributes:, request_env:)
+        # Validate address ownership to prevent IDOR attacks
+        address_ownership_error = validate_address_ownership(order, params)
+        return failure(order, address_ownership_error) if address_ownership_error
+
         ship_changed = address_with_country_iso_present?(params, 'ship')
         bill_changed = address_with_country_iso_present?(params, 'bill')
         params[:order][:ship_address_attributes] = replace_country_iso_with_id(params[:order][:ship_address_attributes]) if ship_changed
@@ -26,6 +30,26 @@ module Spree
 
       private
 
+      def validate_address_ownership(order, params)
+        return nil unless params[:order]
+
+        %w[bill ship].each do |address_kind|
+          address_id = params[:order].dig("#{address_kind}_address_attributes".to_sym, :id)
+          next unless address_id
+
+          address = Spree::Address.find_by(id: address_id)
+          next unless address
+
+          # Allow if address has no user (guest address) or belongs to the order's user
+          next if address.user_id.nil?
+          next if order.user_id.present? && address.user_id == order.user_id
+
+          return Spree.t(:address_not_owned_by_user)
+        end
+
+        nil
+      end
+
       def address_with_country_iso_present?(params, address_kind = 'ship')
         return false unless params.dig(:order, "#{address_kind}_address_attributes".to_sym, :country_iso)
         return false if params.dig(:order, "#{address_kind}_address_attributes".to_sym, :country_id)

data/config/locales/en.yml

@@ -642,6 +642,7 @@ en:
       successfully_updated: Updated successfully
       unsuccessfully_saved: There was an error while trying to save your address.
       unsuccessfully_updated: There was an update while trying to update your address.
+    address_not_owned_by_user: The specified address does not belong to this user.
     address_settings: Address settings
     addresses: Addresses
     adjustable: Adjustable

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '5.1.8'.freeze
+  VERSION = '5.1.9'.freeze
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_core
 version: !ruby/object:Gem::Version
-  version: 5.1.8
+  version: 5.1.9
 platform: ruby
 authors:
 - Sean Schofield
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-10-30 00:00:00.000000000 Z
+date: 2026-01-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n-tasks
@@ -1383,9 +1383,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.1.8
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.1.9
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.1.8
+  source_code_uri: https://github.com/spree/spree/tree/v5.1.9
 post_install_message:
 rdoc_options: []
 require_paths: