spree_storefront 5.2.6 → 5.2.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c186ef5bda630498c3468d11a61144b479179026bb2178d341b1b10d85ede273
-  data.tar.gz: a83841e5ed48fb94a94511b5b6bf849b56ddbea3ed2ba3039e3b7854e17f52fc
+  metadata.gz: 7fb2441bc12ea872ce547b70933ba3e0cc49708ddaad9e56a244c445740f4583
+  data.tar.gz: '0459101886776cfdb29cf1490d080ba1ce4441486f33cc593655f9a2c176a551'
 SHA512:
-  metadata.gz: 169a0eead13f4e94330d83d93a30e5b66734d8d0a83b40365c24588649c02e040859a611636e1e90c11a119295fcac06f263b4ff89a6529b7795ff89872393ca
-  data.tar.gz: 793f3e4698d50a1f271225ac10cd2f2033774a3bf38bcfb76a8493bdb4c9ba9eec123a5e6d82ae2ec23fc10db6185a911dd1821b279c4795614cafd2bbdaee5b
+  metadata.gz: 03a84bbaab4cf85e553b64491d75c44df68f66507b09a2a33d40c99dd58c941cf185c46b48dd7e2244431bf68015d296c54dcb72e462d33888595d01269bbe93
+  data.tar.gz: fa67b0e76c26d866624447e61e1bf5ce89e9842a12b5f673400146074e5a43371fc2360a08bf2198c862384c3607f672085dc5f51a37a808d95b96cd58743906

data/app/controllers/spree/order_status_controller.rb

@@ -7,7 +7,7 @@ module Spree
     # validate email/order number and redirect to order page
     # POST /order_status
     def create
-      raise ActiveRecord::RecordNotFound if params[:number].blank?
+      raise ActiveRecord::RecordNotFound if params[:number].blank? || params[:email].blank?
 
       @order = order_finder.new(number: params[:number], email: params[:email], store: current_store).execute.first
 

data/app/controllers/spree/orders_controller.rb

@@ -10,11 +10,17 @@ module Spree
 
     before_action :assign_order_with_lock, only: :update
 
+    rescue_from CanCan::AccessDenied do |exception|
+      raise ActiveRecord::RecordNotFound
+    end
+
     # GET /orders/:id
     def show
       @order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first
 
-      raise ActiveRecord::RecordNotFound if @order.blank? || !authorize_access
+      raise ActiveRecord::RecordNotFound if @order.blank?
+
+      authorize! :show, @order, params[:token]
 
       @shipments = @order.shipments.includes(:stock_location, :address, selected_shipping_rate: :shipping_method, inventory_units: :line_item)
     end
@@ -49,9 +55,7 @@ module Spree
     private
 
     def authorize_access
-      return true if @order.user_id.nil?
-
-      @order.user == try_spree_current_user
+      authorize! :show, @order, params[:token]
     end
 
     def find_order_by_cookie
@@ -65,7 +69,7 @@ module Spree
     end
 
     def accurate_title
-      if action_name == 'edit' || action_name == 'update'
+      if ['edit', 'update'].include?(action_name)
         Spree.t(:shopping_cart)
       else
         Spree.t(:order_number, number: @order&.number)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_storefront
 version: !ruby/object:Gem::Version
-  version: 5.2.6
+  version: 5.2.7
 platform: ruby
 authors:
 - Vendo Connect Inc.
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 5.2.6
+        version: 5.2.7
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 5.2.6
+        version: 5.2.7
 - !ruby/object:Gem::Dependency
   name: active_link_to
   requirement: !ruby/object:Gem::Requirement
@@ -557,9 +557,9 @@ licenses:
 - AGPL-3.0-or-later
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.2.6
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.2.7
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.2.6
+  source_code_uri: https://github.com/spree/spree/tree/v5.2.7
 rdoc_options: []
 require_paths:
 - lib