search

solidusio / solidus_auth_devise

🔑 Devise authentication for your Solidus store.
http://solidus.io
BSD 3-Clause "New" or "Revised" License
52 stars 124 forks source link

Don't save addresses inside update_registration #76

Closed jhawthorn closed 7 years ago

jhawthorn commented 7 years ago

See solidusio/solidus#1588 for reproduction steps.

The checkout_controller has a before_action :setup_for_current_state which builds addresses onto the order association if the order is in the "address state".

Because that before_action was running on all actions of the controller, and our update_registration action used update_attribute, which skips validations, this could sometimes save invalid empty addresses onto guest orders.

This PR solves this by skipping the before action for update_registration. We also switch to using update_attributes so that validation are run (this would have helped us catch this sooner).