spree/spree — pull request #3796 by gchernoff (2013-09-30 18:43:55+00:00)
Title: 2 0 stable - security enhancements and unit test coverage reporting

Provided additional parameter validation based on Brakeman venerability reports.

payments_controller.rb:57, Dangerous Send, Priority: High
User controlled method execution near line 58: Payment.find(params[:id]).send("#{(params[:e] or "void_transaction")}!")

orders_controller.rb:89, Dangerous Send, Priority: High
User controlled method execution near line 90: Order.find_by_number!(params[:id], :include => :adjustments).send("#{params[:e]}")

return_authorizations_controller.rb:9, Dangerous Send, Priority: High
User controlled method execution near line 10: @return_authorization.send("can_#{params[:e]}?")

return_authorizations_controller.rb:10, Dangerous Send, Priority: High
User controlled method execution near line 11: @return_authorization.send("#{params[:e]}!")

Enabled unit test coverage reports