spree_storefront 5.1.9 → 5.1.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6128c8f6759d5c61bb829501ea818758e80ee6d6c0d4b766ae48c1e8b0449411
-  data.tar.gz: 5bc065803d2e89835f5890d92f488eb006f43b594b8c17ede3011729685996db
+  metadata.gz: 519724e639ea8813263acafdb14519c4fbd230210550087cd415cc5053d0b3a9
+  data.tar.gz: 1e769594b5e303ad31298be26593d978dbe5d2143526b05f7c09a64a1e9230d0
 SHA512:
-  metadata.gz: 6567f8bd0dd742f910187147b4e93aa53e4f3f64692ae71889b27c214fc8e28dfa7d5e4ab198fb5faf7a0bb41097f3564647ed713354dfb640a73023c0128620
-  data.tar.gz: d73d41b17139af7a941e3ade312510db6d550d0e88e950565b9c4c80c01a016de6fbb0ef3c89bdbdf6639836f47b24ceabde14295e3c83fccc0a0fef9ed9815e
+  metadata.gz: d31e19fa8f85233fb7524942cf9e4238c6fd34fb492797497e29a557e9ac24ccdc2977c44df61e926b0508a41fefb85902e367b6a5242c9e7ef34821eeb22407
+  data.tar.gz: 43925bb6658a0e0439391f2ebd68fa16b3a2e19757bccb6e69b3b10979577ad584f27bc97808bc1ac7149f31121ec05eb6b1ac3cf80c31c7cc18221d5b22d40e

data/app/controllers/spree/order_status_controller.rb

@@ -7,7 +7,7 @@ module Spree
     # validate email/order number and redirect to order page
     # POST /order_status
     def create
-      raise ActiveRecord::RecordNotFound if params[:number].blank?
+      raise ActiveRecord::RecordNotFound if params[:number].blank? || params[:email].blank?
 
       @order = order_finder.new(number: params[:number], email: params[:email], store: current_store).execute.first
 

data/app/controllers/spree/orders_controller.rb

@@ -10,11 +10,17 @@ module Spree
 
     before_action :assign_order_with_lock, only: :update
 
+    rescue_from CanCan::AccessDenied do |exception|
+      raise ActiveRecord::RecordNotFound
+    end
+
     # GET /orders/:id
     def show
       @order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first
 
-      raise ActiveRecord::RecordNotFound if @order.blank? || !authorize_access
+      raise ActiveRecord::RecordNotFound if @order.blank?
+
+      authorize! :show, @order, params[:token]
 
       @shipments = @order.shipments.includes(:stock_location, :address, selected_shipping_rate: :shipping_method, inventory_units: :line_item)
     end
@@ -49,9 +55,7 @@ module Spree
     private
 
     def authorize_access
-      return true if @order.user_id.nil?
-
-      @order.user == try_spree_current_user
+      authorize! :show, @order, params[:token]
     end
 
     def find_order_by_cookie
@@ -65,7 +69,7 @@ module Spree
     end
 
     def accurate_title
-      if action_name == 'edit' || action_name == 'update'
+      if ['edit', 'update'].include?(action_name)
         Spree.t(:shopping_cart)
       else
         Spree.t(:order_number, number: @order&.number)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_storefront
 version: !ruby/object:Gem::Version
-  version: 5.1.9
+  version: 5.1.10
 platform: ruby
 authors:
 - Vendo Connect Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-01-08 00:00:00.000000000 Z
+date: 2026-02-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: spree_core
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 5.1.9
+        version: 5.1.10
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 5.1.9
+        version: 5.1.10
 - !ruby/object:Gem::Dependency
   name: active_link_to
   requirement: !ruby/object:Gem::Requirement
@@ -562,9 +562,9 @@ licenses:
 - AGPL-3.0-or-later
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.1.9
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.1.10
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.1.9
+  source_code_uri: https://github.com/spree/spree/tree/v5.1.10
 post_install_message:
 rdoc_options: []
 require_paths: