Calling update_attribute on an order saves it prematurely with invalid/blank addresses

[mike-bourgeous]

Line 11 of checkout_controller_decorator.rb calls update_attribute on an order to set the order's email address, but this saves the order without running validations. This saves blank addresses (all fields nil) into the database, which can conflict with validations performed by other gems.

If possible, we would like to suggest using an alternate means of setting the email address on a guest order that does not cause the order object to be saved without validations, such as simple attribute assignment (order.email = ...).

Thanks.

spree_auth_devise/lib/controllers/frontend/spree/checkout_controller_decorator.rb

Line 11 in 50f60a7

if params[:order][:email] =~ Devise.email_regexp && current_order.update_attribute(:email, params[:order][:email])

[prsanjay]

Hi @mike-bourgeous, I have faced this same issue in Spree 3.7 with latest Spree Auth Devise. I have solved this issue by calling reload on current_order like this :

current_order.reload.update_attribute(:email, params[:order][:email])

I believe this way it would detach associated object of address which have been initialized but not saved yet.

Any comments? Thanks!