Merge branch 'dev' for release 5.5.7

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog Fab-manager
 
+## v5.5.7 2022 December 13
+
+- Fix a bug: unable to update/delete a space
+- Fix a bug: unable to credit wallet
+- Fix a security issue: updated nokogiri to 1.13.10 to fix [CVE-2022-23476](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23476)
+
 ## v5.5.6 2022 December 05
 
 - Updated FabAnalytics reports to include new features

Gemfile.lock

@@ -236,7 +236,7 @@ GEM
     multi_xml (0.6.0)
     multipart-post (2.1.1)
     nio4r (2.5.8)
-    nokogiri (1.13.9)
+    nokogiri (1.13.10)
       mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
     notify_with (0.0.2)
@@ -305,7 +305,7 @@ GEM
     pundit (2.1.0)
       activesupport (>= 3.0.0)
     raabro (1.4.0)
-    racc (1.6.0)
+    racc (1.6.1)
     rack (2.2.4)
     rack-oauth2 (1.19.0)
       activesupport

app/controllers/api/spaces_controller.rb

@@ -27,7 +27,7 @@ class API::SpacesController < API::ApiController
   end
 
   def update
-    authorize Space
+    authorize @space
     if @space.update(space_params)
       render :show, status: :ok, location: @space
     else
@@ -45,7 +45,7 @@ class API::SpacesController < API::ApiController
   private
 
   def set_space
-    Space.friendly.find(params[:id])
+    @space = Space.friendly.find(params[:id])
   end
 
   def space_params

app/controllers/api/wallet_controller.rb

@@ -23,7 +23,7 @@ class API::WalletController < API::ApiController
     @wallet = Wallet.find(credit_params[:id])
     authorize @wallet
     service = WalletService.new(user: current_user, wallet: @wallet)
-    transaction = service.credit(credit_params[:amount])
+    transaction = service.credit(credit_params[:amount].to_f)
     if transaction
       service.create_avoir(transaction, credit_params[:avoir_date], credit_params[:avoir_description]) if credit_params[:avoir]
       render :show

app/models/wallet.rb

@@ -15,7 +15,7 @@ class Wallet < ApplicationRecord
 
   def credit(amount)
     if amount.is_a?(Numeric) && amount >= 0
-      self.amount += amount
+      self.amount = (BigDecimal(self.amount.to_s) + BigDecimal(amount.to_s)).to_f
       return save
     end
     false
@@ -23,7 +23,7 @@ class Wallet < ApplicationRecord
 
   def debit(amount)
     if amount.is_a?(Numeric) && amount >= 0
-      self.amount -= amount
+      self.amount = (BigDecimal(self.amount.to_s) - BigDecimal(amount.to_s)).to_f
       return save
     end
     false

package.json

@@ -1,6 +1,6 @@
 {
   "name": "fab-manager",
-  "version": "5.5.6",
+  "version": "5.5.7",
   "description": "Fab-manager is the FabLab management solution. It provides a comprehensive, web-based, open-source tool to simplify your administrative tasks and your marker's projects.",
   "keywords": [
     "fablab",