spree_storefront 5.0.7 → 5.0.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 16b5c919b10c9c0f2a34dc40dacf3a809c5f754c551546281ad6124aa1baec78
-  data.tar.gz: c8727a618f08b2c767bedfa80cb920da63012fd414358f8682623b3345662c7d
+  metadata.gz: f35db1c87b4dc4879d43540fd16b3ba365adee73d7e34de31cb3965b701e98b9
+  data.tar.gz: 2ca044b71a2df68ffb74018a31da80439b6d05d6d674a079c8b4f0a4a1a39b06
 SHA512:
-  metadata.gz: 385cff172a5e9fd776fab541b67edeb1ba3b57c68d4d8faebb18e53556eba99b00453a086b9216b58d5f6da7b1cd81429f98d6468d24b70b8d2c49a4f82f842e
-  data.tar.gz: 3d08529d902f3e68eb96dc714425c30b77d5d63ef37144ee03404d62dd123e6d49a5778becef1e412c4e8bbf9146c52ae5acdd8c19f4a77708191d31933a11b5
+  metadata.gz: d768a84932a8edf31945d96bd302a30e4ed99d60244df75a1009b925fc1780187e4d9ae156c0f4d1ced093db487e0579e51c1961187b7b0bd49edf79fb98e529
+  data.tar.gz: 5e6868d1a33d2da1698926f9380e2beed5ba17654c34221c8fbdba67b51d5950f2bcb1a6bf163653104832222bcd6547d46ce7c9fdac09b523ab1dd236a92e5a

data/app/controllers/spree/order_status_controller.rb

@@ -7,7 +7,7 @@ module Spree
     # validate email/order number and redirect to order page
     # POST /order_status
     def create
-      raise ActiveRecord::RecordNotFound if params[:number].blank?
+      raise ActiveRecord::RecordNotFound if params[:number].blank? || params[:email].blank?
 
       @order = order_finder.new(number: params[:number], email: params[:email], store: current_store).execute.first
 

data/app/controllers/spree/orders_controller.rb

@@ -10,11 +10,17 @@ module Spree
 
     before_action :assign_order_with_lock, only: :update
 
+    rescue_from CanCan::AccessDenied do |exception|
+      raise ActiveRecord::RecordNotFound
+    end
+
     # GET /orders/:id
     def show
       @order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first
 
-      raise ActiveRecord::RecordNotFound if @order.blank? || !authorize_access
+      raise ActiveRecord::RecordNotFound if @order.blank?
+
+      authorize! :show, @order, params[:token]
 
       @shipments = @order.shipments.includes(:stock_location, :address, selected_shipping_rate: :shipping_method, inventory_units: :line_item)
     end
@@ -49,9 +55,7 @@ module Spree
     private
 
     def authorize_access
-      return true if @order.user_id.nil?
-
-      @order.user == try_spree_current_user
+      authorize! :show, @order, params[:token]
     end
 
     def find_order_by_cookie
@@ -65,7 +69,7 @@ module Spree
     end
 
     def accurate_title
-      if action_name == 'edit' || action_name == 'update'
+      if ['edit', 'update'].include?(action_name)
         Spree.t(:shopping_cart)
       else
         Spree.t(:order_number, number: @order&.number)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_storefront
 version: !ruby/object:Gem::Version
-  version: 5.0.7
+  version: 5.0.8
 platform: ruby
 authors:
 - Vendo Connect Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-01-08 00:00:00.000000000 Z
+date: 2026-02-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: spree_core
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 5.0.7
+        version: 5.0.8
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 5.0.7
+        version: 5.0.8
 - !ruby/object:Gem::Dependency
   name: active_link_to
   requirement: !ruby/object:Gem::Requirement
@@ -548,9 +548,9 @@ licenses:
 - AGPL-3.0-or-later
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.0.7
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.0.8
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.0.7
+  source_code_uri: https://github.com/spree/spree/tree/v5.0.8
 post_install_message:
 rdoc_options: []
 require_paths: