When we load up incomplete orders, make sure that they have a user associated if the user is logged in

Also associate customer ONLY if one already exists. This is required to prevent unauthorised access to customer-only shopfronts.
This commit is contained in:
Rob Harrington
2016-04-21 14:42:34 +10:00
parent 302bdfd628
commit 48d4c8733d

View File

@@ -47,6 +47,11 @@ class EnterprisesController < BaseController
order.distributor = distributor
if user = try_spree_current_user
order.associate_user!(user) if (order.user.blank? || order.email.blank?)
order.send(:associate_customer) if order.customer.nil? # Only associates existing customers
end
order_cycle_options = OrderCycle.active.with_distributor(distributor)
order.order_cycle = order_cycle_options.first if order_cycle_options.count == 1
order.save!