spree_core 5.2.4 → 5.2.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 71ab78c8a32714ab778383e109efa7639a0ed868b971e05e80c1c31861976b73
-  data.tar.gz: a6bd61a06df7d9bc875e3ec60c247a72cbc0088be0827a88e69dd96adc4e2ce4
+  metadata.gz: 2d349836816cd2c1ec5919e21868926cd4eec24cb0c38c33cb744b37a9402dc9
+  data.tar.gz: 8072164578532d141040fe3aab664d91cb00c2c8571c3b9a043cd4ccb23f1aa1
 SHA512:
-  metadata.gz: 38858f3d772887de4a876568ed5af0f892a6b51e3c82e9268bd735747dc35825848c7665387373fe5dc951623e4df402fae65d3c9d3cb62c62d21684ddf1aa1f
-  data.tar.gz: fbdbfa593a3718e6c59bfa31a2c1ef7e6061b4c21fea192962bb402e4c18421d044503b832b3b0dbd17eee24616ce42523a5cecb4e0a862ea374f826787f3c22
+  metadata.gz: 4ad9ed9392d8cb3b34cf3fa0c294dca288fe2c5162ed20c84616ef82c71e2368ea7debb5264208b26703df22640cb612e4deadb98882dcd872f8622197b8d0e5
+  data.tar.gz: a6cd8afa6b70d0fc758758c9555ab24da37800c7905220b7d5f0251bf19fa06f87d03315aba858476eb181705c32ba6d80fba4e387f419f892f7b1ec16631aac

data/app/models/spree/ability.rb

@@ -143,7 +143,8 @@ module Spree
       can :update, ::Spree::Order do |order, token|
         !order.completed? && (order.user == user || order.token && token == order.token)
       end
-      can :manage, ::Spree::Address, user_id: user.id
+      # Address management - only for persisted users with matching user_id
+      can :manage, ::Spree::Address, user_id: user.id if user.persisted?
       can [:read, :destroy], ::Spree::CreditCard, user_id: user.id
       can :read, ::Spree::Product
       can :read, ::Spree::ProductProperty

data/app/models/spree/permission_sets/default_customer.rb

@@ -43,8 +43,8 @@ module Spree
         can :create, Spree.user_class
         can [:show, :update, :destroy], Spree.user_class, id: user.id
 
-        # Address management
-        can :manage, Spree::Address, user_id: user.id
+        # Address management - only for persisted users with matching user_id
+        can :manage, Spree::Address, user_id: user.id if user.persisted?
 
         # Credit card management
         can [:read, :destroy], Spree::CreditCard, user_id: user.id

data/app/services/spree/checkout/update.rb

@@ -5,6 +5,10 @@ module Spree
       include Spree::Addresses::Helper
 
       def call(order:, params:, permitted_attributes:, request_env:)
+        # Validate address ownership to prevent IDOR attacks
+        address_ownership_error = validate_address_ownership(order, params)
+        return failure(order, address_ownership_error) if address_ownership_error
+
         ship_changed = address_with_country_iso_present?(params, 'ship')
         bill_changed = address_with_country_iso_present?(params, 'bill')
         params[:order][:ship_address_attributes] = replace_country_iso_with_id(params[:order][:ship_address_attributes]) if ship_changed
@@ -26,6 +30,26 @@ module Spree
 
       private
 
+      def validate_address_ownership(order, params)
+        return nil unless params[:order]
+
+        %w[bill ship].each do |address_kind|
+          address_id = params[:order].dig("#{address_kind}_address_attributes".to_sym, :id)
+          next unless address_id
+
+          address = Spree::Address.find_by(id: address_id)
+          next unless address
+
+          # Allow if address has no user (guest address) or belongs to the order's user
+          next if address.user_id.nil?
+          next if order.user_id.present? && address.user_id == order.user_id
+
+          return Spree.t(:address_not_owned_by_user)
+        end
+
+        nil
+      end
+
       def address_with_country_iso_present?(params, address_kind = 'ship')
         return false unless params.dig(:order, "#{address_kind}_address_attributes".to_sym, :country_iso)
         return false if params.dig(:order, "#{address_kind}_address_attributes".to_sym, :country_id)

data/config/locales/en.yml

@@ -667,6 +667,7 @@ en:
       successfully_updated: Updated successfully
       unsuccessfully_saved: There was an error while trying to save your address.
       unsuccessfully_updated: There was an update while trying to update your address.
+    address_not_owned_by_user: The specified address does not belong to this user.
     address_settings: Address settings
     addresses: Addresses
     adjustable: Adjustable

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '5.2.4'.freeze
+  VERSION = '5.2.5'.freeze
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_core
 version: !ruby/object:Gem::Version
-  version: 5.2.4
+  version: 5.2.5
 platform: ruby
 authors:
 - Sean Schofield
@@ -1703,9 +1703,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.2.4
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.2.5
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.2.4
+  source_code_uri: https://github.com/spree/spree/tree/v5.2.5
 rdoc_options: []
 require_paths:
 - lib