TommyJohnWear/spree — pull request #4 by bbuchalter (2014-12-05 15:54:17+00:00)
Title: Fix security issue when updating order by API

From
https://github.com/lalo73/spree/commit/fbe55851ba91b285482434ccd3f1c7c3f75a051b

Non-admin users could modify line_item's price if an admin user've requested that api.

I have two orders R936811378 and R559415068, the first one belongs to a non-admin user, and the other belongs to an admin user.

irb(main):017:0> order1 = Spree::Order.find_by number: "R936811378"
irb(main):018:0> order1.total.to_s
=> "0.0"
irb(main):019:0> order1.user.admin?
=> false

irb(main):014:0> order2 = Spree::Order.find_by number: "R559415068"
irb(main):015:0> order2.total.to_s
=> "0.0"
irb(main):016:0> order2.user.admin?
=> true

if I make this request:

curl -X PUT "http://localhost:3003/api/orders/R936811378" -d "order%5Bline_items_attributes%5D%5B0%5D%5Bprice%5D=1&order%5Bline_items_attributes%5D%5B0%5D%5Bquantity%5D=1&order%5Bline_items_attributes%5D%5B0%5D%5Bvariant_id%5D=11" -H "X-Spree-Token: 6342acb46cbee33c19e75770dce9402fee49e77270f5415e"

The line_item's price will be 4000.00

But if i make this request first:

curl -X PUT "http://localhost:3003/api/orders/R559415068" -d "&order%5Bline_items_attributes%5D%5B0%5D%5Bprice%5D=1&order%5Bline_items_attributes%5D%5B0%5D%5Bquantity%5D=1&order%5Bline_items_attributes%5D%5B0%5D%5Bvariant_id%5D=11" -H "X-Spree-Token: 770977750ee12c6fe2343b75e453c8bbe1ca63b25ae6e5ab"

The line_item's price will be 1

It sets the line_item's price and change class variable defined here (because of `<<`)
https://github.com/spree/spree/blob/master/core/lib/spree/permitted_attributes.rb#L49

It adds [:price, :variant_id, :sku] to the array while server is up

If i repeat the first request, non-admin users will be able to modify line_item's price.