Patch with security fix from spree 1.x