Merge branch 'dev' into master

udpated to actual email address

added name to contributors

CONTRIBUTORS.md

@@ -80,6 +80,7 @@ submit the change with your pull request.
 - Megan Talbot / [meganft](https://github.com/meganft)
 - Arun Kumar / [arun1595](https://github.com/arun1595)
 - Harry Brodsky / [hbrodsk1](https://github.com/hbrodsk1)
+- Jeff Kingswood / [ancyentmariner](https://github.com/ancyentmariner)
 
 ## Bots
 

Gemfile

@@ -7,22 +7,22 @@ gem 'rails', '~> 4.2.8'
 
 gem 'bundler', '>=1.1.5'
 
-gem 'coffee-rails', '~> 4.1.0'
-gem 'haml', '~> 4.0.7'
-gem 'sass-rails', '~> 5.0.4'
+gem 'coffee-rails'
+gem 'haml'
+gem 'sass-rails'
 
 # CSS framework
-gem 'bootstrap-sass', '~> 3.3.6'
+gem 'bootstrap-sass'
 gem 'font-awesome-sass'
 
-gem 'uglifier', '~> 2.7.2' # JavaScript compressor
+gem 'uglifier' # JavaScript compressor
 
 gem 'flickraw'
 gem 'jquery-rails'
-gem 'jquery-ui-rails', '~> 5.0.2'
+gem 'jquery-ui-rails', '~> 5.0.2' # needs careful upgrade with change of location
 gem 'js-routes' # provides access to Rails routes in Javascript
 
-gem 'cancancan', '~> 1.9'          # for checking member privileges
+gem 'cancancan'                    # for checking member privileges
 gem 'csv_shaper'                   # CSV export
 gem 'figaro'                       # for handling config via ENV variables
 gem 'gibbon', '~>1.2.0'            # for Mailchimp newsletter subscriptions
@@ -32,10 +32,10 @@ gem 'pg'
 gem 'ruby-units'                   # for unit conversion
 gem 'unicorn'                      # http server
 
-gem 'comfortable_mexican_sofa', '~> 1.12.0' # content management system
+gem 'comfortable_mexican_sofa'     # content management system
 
 gem 'bootstrap-kaminari-views'     # bootstrap views for kaminari
-gem 'kaminari', '~> 0.17.0'        # pagination
+gem 'kaminari'                     # pagination
 
 gem 'activemerchant'
 gem 'active_utils'
@@ -45,13 +45,13 @@ gem 'sidekiq'
 gem 'bluecloth'
 
 # Pagination
-gem 'will_paginate', '~> 3.0'
+gem 'will_paginate'
 
 # user signup/login/etc
-gem 'devise', '>= 4.0.0'
+gem 'devise'
 
 # nicely formatted URLs
-gem 'friendly_id', '~> 5.0.4'
+gem 'friendly_id'
 
 # gravatars
 gem 'gravatar-ultimate'
@@ -66,7 +66,7 @@ gem 'bootstrap-datepicker-rails'
 gem 'omniauth', '~> 1.3'
 gem 'omniauth-facebook'
 gem 'omniauth-flickr', '>= 0.0.15'
-gem 'omniauth-twitter', '~> 1.2'
+gem 'omniauth-twitter'
 
 # For charting data
 gem 'd3-rails', '~> 3.5' # 4.* produces Error: <spyOn> : could not find an object to spy upon for linear() - see https://travis-ci.org/Growstuff/growstuff/jobs/204461482
@@ -121,7 +121,7 @@ group :development, :test do
   gem 'capybara-email'                  # integration tests for email
   gem 'capybara-screenshot'             # for test debugging
   gem 'coveralls', require: false       # coverage analysis
-  gem 'database_cleaner', '~> 1.5.0'
+  gem 'database_cleaner'
   gem 'factory_girl_rails'              # for creating test data
   gem 'haml-i18n-extractor'
   gem 'haml-rails'                      # HTML templating language

Gemfile.lock

@@ -1,21 +1,21 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    actionmailer (4.2.8)
-      actionpack (= 4.2.8)
-      actionview (= 4.2.8)
-      activejob (= 4.2.8)
+    actionmailer (4.2.9)
+      actionpack (= 4.2.9)
+      actionview (= 4.2.9)
+      activejob (= 4.2.9)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 1.0, >= 1.0.5)
-    actionpack (4.2.8)
-      actionview (= 4.2.8)
-      activesupport (= 4.2.8)
+    actionpack (4.2.9)
+      actionview (= 4.2.9)
+      activesupport (= 4.2.9)
       rack (~> 1.6)
       rack-test (~> 0.6.2)
       rails-dom-testing (~> 1.0, >= 1.0.5)
       rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (4.2.8)
-      activesupport (= 4.2.8)
+    actionview (4.2.9)
+      activesupport (= 4.2.9)
       builder (~> 3.1)
       erubis (~> 2.7.0)
       rails-dom-testing (~> 1.0, >= 1.0.5)
@@ -25,25 +25,25 @@ GEM
       addressable
     active_merchant-paypal-bogus-gateway (0.1.0)
       activemerchant
-    active_utils (3.3.6)
+    active_utils (3.3.7)
       activesupport (>= 3.2, < 5.2.0)
       i18n
-    activejob (4.2.8)
-      activesupport (= 4.2.8)
+    activejob (4.2.9)
+      activesupport (= 4.2.9)
       globalid (>= 0.3.0)
-    activemerchant (1.67.0)
+    activemerchant (1.69.0)
       activesupport (>= 3.2.14, < 6.x)
       builder (>= 2.1.2, < 4.0.0)
       i18n (>= 0.6.9)
       nokogiri (~> 1.4)
-    activemodel (4.2.8)
-      activesupport (= 4.2.8)
+    activemodel (4.2.9)
+      activesupport (= 4.2.9)
       builder (~> 3.1)
-    activerecord (4.2.8)
-      activemodel (= 4.2.8)
-      activesupport (= 4.2.8)
+    activerecord (4.2.9)
+      activemodel (= 4.2.9)
+      activesupport (= 4.2.9)
       arel (~> 6.0)
-    activesupport (4.2.8)
+    activesupport (4.2.9)
       i18n (~> 0.7)
       minitest (~> 5.1)
       thread_safe (~> 0.3, >= 0.3.4)
@@ -55,7 +55,7 @@ GEM
       public_suffix (~> 2.0, >= 2.0.2)
     arel (6.0.4)
     ast (2.3.0)
-    autoprefixer-rails (7.1.1)
+    autoprefixer-rails (7.1.2.3)
       execjs
     bcrypt (3.1.11)
     better_errors (2.1.1)
@@ -78,12 +78,12 @@ GEM
       sass (>= 3.3.4)
     bootstrap_form (2.7.0)
     builder (3.2.3)
-    bullet (5.5.1)
+    bullet (5.6.0)
       activesupport (>= 3.0.0)
       uniform_notifier (~> 1.10.0)
     byebug (9.0.6)
-    cancancan (1.17.0)
-    capybara (2.14.1)
+    cancancan (2.0.0)
+    capybara (2.14.4)
       addressable
       mime-types (>= 1.16)
       nokogiri (>= 1.3.3)
@@ -93,10 +93,10 @@ GEM
     capybara-email (2.5.0)
       capybara (~> 2.4)
       mail
-    capybara-screenshot (1.0.14)
+    capybara-screenshot (1.0.17)
       capybara (>= 1.0, < 3)
       launchy
-    childprocess (0.7.0)
+    childprocess (0.7.1)
       ffi (~> 1.0, >= 1.0.11)
     climate_control (0.2.0)
     cliver (0.3.2)
@@ -107,9 +107,9 @@ GEM
     codemirror-rails (5.16.0)
       railties (>= 3.0, < 6.0)
     coderay (1.1.1)
-    coffee-rails (4.1.1)
+    coffee-rails (4.2.2)
       coffee-script (>= 2.2.0)
-      railties (>= 4.0.0, < 5.1.x)
+      railties (>= 4.0.0)
     coffee-script (2.4.1)
       coffee-script-source
       execjs
@@ -142,7 +142,7 @@ GEM
     d3-rails (3.5.17)
       railties (>= 3.1)
     dalli (2.7.6)
-    database_cleaner (1.5.3)
+    database_cleaner (1.6.1)
     debug_inspector (0.0.3)
     devise (4.3.0)
       bcrypt (~> 3.0)
@@ -170,14 +170,14 @@ GEM
       faraday
       multi_json
     erubis (2.7.0)
-    excon (0.56.0)
+    excon (0.57.1)
     execjs (2.7.0)
     factory_girl (4.8.0)
       activesupport (>= 3.0.0)
     factory_girl_rails (4.8.0)
       factory_girl (~> 4.8.0)
       railties (>= 3.0.0)
-    faraday (0.11.0)
+    faraday (0.12.2)
       multipart-post (>= 1.2, < 3)
     ffi (1.9.18)
     figaro (1.1.1)
@@ -186,7 +186,7 @@ GEM
     font-awesome-sass (4.7.0)
       sass (>= 3.2)
     formatador (0.2.5)
-    friendly_id (5.0.5)
+    friendly_id (5.2.1)
       activerecord (>= 4.0.0)
     geocoder (1.4.4)
     gibbon (1.2.1)
@@ -211,7 +211,8 @@ GEM
       guard (~> 2.1)
       guard-compat (~> 1.1)
       rspec (>= 2.99.0, < 4.0)
-    haml (4.0.7)
+    haml (5.0.1)
+      temple (>= 0.8.0)
       tilt
     haml-i18n-extractor (0.5.9)
       activesupport
@@ -231,7 +232,7 @@ GEM
       rake (>= 10, < 13)
       rubocop (>= 0.47.0)
       sysexits (~> 1.1)
-    hashie (3.5.5)
+    hashie (3.5.6)
     heroku-api (0.4.2)
       excon (~> 0.45)
       multi_json (~> 1.8)
@@ -241,9 +242,9 @@ GEM
       haml (>= 4.0, < 6)
       nokogiri (>= 1.6.0)
       ruby_parser (~> 3.5)
-    httparty (0.15.5)
+    httparty (0.15.6)
       multi_xml (>= 0.5.2)
-    i18n (0.8.4)
+    i18n (0.8.6)
     i18n-tasks (0.9.12)
       activesupport (>= 4.0.2)
       ast (>= 2.1.0)
@@ -259,7 +260,7 @@ GEM
       phantomjs
       rack (>= 1.2.1)
       rake
-    jasmine-core (2.6.3)
+    jasmine-core (2.6.4)
     jquery-rails (4.3.1)
       rails-dom-testing (>= 1, < 3)
       railties (>= 4.2.0)
@@ -271,11 +272,20 @@ GEM
       sprockets-rails
     json (2.1.0)
     jwt (1.5.6)
-    kaminari (0.17.0)
-      actionpack (>= 3.0.0)
-      activesupport (>= 3.0.0)
+    kaminari (1.0.1)
+      activesupport (>= 4.1.0)
+      kaminari-actionview (= 1.0.1)
+      kaminari-activerecord (= 1.0.1)
+      kaminari-core (= 1.0.1)
+    kaminari-actionview (1.0.1)
+      actionview
+      kaminari-core (= 1.0.1)
+    kaminari-activerecord (1.0.1)
+      activerecord
+      kaminari-core (= 1.0.1)
+    kaminari-core (1.0.1)
     kgio (2.11.0)
-    kramdown (1.13.2)
+    kramdown (1.14.0)
     launchy (2.4.3)
       addressable (~> 2.3)
     leaflet-markercluster-rails (0.7.0)
@@ -290,7 +300,7 @@ GEM
     loofah (2.0.3)
       nokogiri (>= 1.5.9)
     lumberjack (1.0.12)
-    mail (2.6.5)
+    mail (2.6.6)
       mime-types (>= 1.16, < 4)
     memcachier (0.0.2)
     method_source (0.8.2)
@@ -299,20 +309,20 @@ GEM
     mime-types-data (3.2016.0521)
     mimemagic (0.3.2)
     mini_portile2 (2.2.0)
-    minitest (5.10.2)
+    minitest (5.10.3)
     multi_json (1.11.3)
     multi_xml (0.6.0)
     multipart-post (2.0.0)
     nenv (0.3.0)
-    newrelic_rpm (4.2.0.334)
+    newrelic_rpm (4.3.0.335)
     nokogiri (1.8.0)
       mini_portile2 (~> 2.2.0)
     notiffany (0.1.1)
       nenv (~> 0.1)
       shellany (~> 0.0)
     oauth (0.5.3)
-    oauth2 (1.3.1)
-      faraday (>= 0.8, < 0.12)
+    oauth2 (1.4.0)
+      faraday (>= 0.8, < 0.13)
       jwt (~> 1.0)
       multi_json (~> 1.3)
       multi_xml (~> 0.5)
@@ -343,7 +353,7 @@ GEM
       mimemagic (~> 0.3.0)
     parser (2.4.0.0)
       ast (~> 2.2)
-    pg (0.20.0)
+    pg (0.21.0)
     phantomjs (2.1.1.0)
     plupload-rails (1.2.1)
       rails (>= 3.1)
@@ -364,16 +374,16 @@ GEM
       rack
     rack-test (0.6.3)
       rack (>= 1.0)
-    rails (4.2.8)
-      actionmailer (= 4.2.8)
-      actionpack (= 4.2.8)
-      actionview (= 4.2.8)
-      activejob (= 4.2.8)
-      activemodel (= 4.2.8)
-      activerecord (= 4.2.8)
-      activesupport (= 4.2.8)
+    rails (4.2.9)
+      actionmailer (= 4.2.9)
+      actionpack (= 4.2.9)
+      actionview (= 4.2.9)
+      activejob (= 4.2.9)
+      activemodel (= 4.2.9)
+      activerecord (= 4.2.9)
+      activesupport (= 4.2.9)
       bundler (>= 1.3.0, < 2.0)
-      railties (= 4.2.8)
+      railties (= 4.2.9)
       sprockets-rails
     rails-deprecated_sanitizer (1.0.3)
       activesupport (>= 4.2.0.alpha)
@@ -391,17 +401,17 @@ GEM
       rails_stdout_logging
     rails_serve_static_assets (0.0.5)
     rails_stdout_logging (0.0.5)
-    railties (4.2.8)
-      actionpack (= 4.2.8)
-      activesupport (= 4.2.8)
+    railties (4.2.9)
+      actionpack (= 4.2.9)
+      activesupport (= 4.2.9)
       rake (>= 0.8.7)
       thor (>= 0.18.1, < 2.0)
     rainbow (2.1.0)
     raindrops (0.18.0)
     rake (12.0.0)
-    rb-fsevent (0.9.8)
-    rb-inotify (0.9.8)
-      ffi (>= 0.5.0)
+    rb-fsevent (0.10.2)
+    rb-inotify (0.9.10)
+      ffi (>= 0.5.0, < 2)
     redis (3.3.3)
     responders (2.4.0)
       actionpack (>= 4.2.0, < 5.3)
@@ -440,23 +450,26 @@ GEM
     ruby-progressbar (1.8.1)
     ruby-units (2.1.0)
     ruby_dep (1.5.0)
-    ruby_parser (3.9.0)
-      sexp_processor (~> 4.1)
+    ruby_parser (3.10.1)
+      sexp_processor (~> 4.9)
     rubyzip (1.2.1)
-    sass (3.4.24)
+    sass (3.5.1)
+      sass-listen (~> 4.0.0)
+    sass-listen (4.0.0)
+      rb-fsevent (~> 0.9, >= 0.9.4)
+      rb-inotify (~> 0.9, >= 0.9.7)
     sass-rails (5.0.6)
       railties (>= 4.0.0, < 6)
       sass (~> 3.1)
       sprockets (>= 2.8, < 4.0)
       sprockets-rails (>= 2.0, < 4.0)
       tilt (>= 1.1, < 3)
-    selenium-webdriver (3.4.0)
+    selenium-webdriver (3.4.4)
       childprocess (~> 0.5)
       rubyzip (~> 1.0)
-      websocket (~> 1.0)
-    sexp_processor (4.9.0)
+    sexp_processor (4.10.0)
     shellany (0.0.1)
-    sidekiq (5.0.2)
+    sidekiq (5.0.4)
       concurrent-ruby (~> 1.0)
       connection_pool (~> 2.2, >= 2.2.0)
       rack-protection (>= 1.5.0)
@@ -477,6 +490,7 @@ GEM
       activesupport (>= 4.0)
       sprockets (>= 3.0.0)
     sysexits (1.2.0)
+    temple (0.8.0)
     term-ansicolor (1.6.0)
       tins (~> 1.0)
     terminal-table (1.8.0)
@@ -484,16 +498,15 @@ GEM
     thor (0.19.4)
     thread (0.2.2)
     thread_safe (0.3.6)
-    tilt (2.0.7)
-    timecop (0.8.1)
-    tins (1.14.0)
+    tilt (2.0.8)
+    timecop (0.9.1)
+    tins (1.15.0)
     trollop (1.16.2)
     tzinfo (1.2.3)
       thread_safe (~> 0.1)
-    uglifier (2.7.2)
-      execjs (>= 0.3.0)
-      json (>= 1.8.0)
-    unicode-display_width (1.2.1)
+    uglifier (3.2.0)
+      execjs (>= 0.3.0, < 3)
+    unicode-display_width (1.3.0)
     unicorn (5.3.0)
       kgio (~> 2.6)
       raindrops (~> 0.7)
@@ -504,7 +517,6 @@ GEM
       nokogiri (>= 1.2.0)
       rack (>= 1.0)
       rack-test (>= 0.5.3)
-    websocket (1.2.4)
     websocket-driver (0.6.5)
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.2)
@@ -526,23 +538,23 @@ DEPENDENCIES
   bonsai-elasticsearch-rails
   bootstrap-datepicker-rails
   bootstrap-kaminari-views
-  bootstrap-sass (~> 3.3.6)
+  bootstrap-sass
   bullet
   bundler (>= 1.1.5)
   byebug
-  cancancan (~> 1.9)
+  cancancan
   capybara
   capybara-email
   capybara-screenshot
   codeclimate-test-reporter
-  coffee-rails (~> 4.1.0)
-  comfortable_mexican_sofa (~> 1.12.0)
+  coffee-rails
+  comfortable_mexican_sofa
   coveralls
   csv_shaper
   d3-rails (~> 3.5)
   dalli
-  database_cleaner (~> 1.5.0)
-  devise (>= 4.0.0)
+  database_cleaner
+  devise
   elasticsearch-api (~> 2.0.0)
   elasticsearch-model
   elasticsearch-rails
@@ -550,13 +562,13 @@ DEPENDENCIES
   figaro
   flickraw
   font-awesome-sass
-  friendly_id (~> 5.0.4)
+  friendly_id
   geocoder
   gibbon (~> 1.2.0)
   gravatar-ultimate
   guard
   guard-rspec
-  haml (~> 4.0.7)
+  haml
   haml-i18n-extractor
   haml-rails
   haml_lint
@@ -567,7 +579,7 @@ DEPENDENCIES
   jquery-rails
   jquery-ui-rails (~> 5.0.2)
   js-routes
-  kaminari (~> 0.17.0)
+  kaminari
   leaflet-markercluster-rails
   leaflet-rails (~> 0.7.7)
   letter_opener
@@ -576,7 +588,7 @@ DEPENDENCIES
   omniauth (~> 1.3)
   omniauth-facebook
   omniauth-flickr (>= 0.0.15)
-  omniauth-twitter (~> 1.2)
+  omniauth-twitter
   pg
   poltergeist
   pry
@@ -590,15 +602,15 @@ DEPENDENCIES
   rspec-rails
   rubocop (<= 0.47.1)
   ruby-units
-  sass-rails (~> 5.0.4)
+  sass-rails
   selenium-webdriver
   sidekiq
   sparkpost_rails
   timecop
-  uglifier (~> 2.7.2)
+  uglifier
   unicorn
   webrat
-  will_paginate (~> 3.0)
+  will_paginate
 
 
 RUBY VERSION

README.md

@@ -57,5 +57,7 @@ Feel free to comment on any of the issues on [Github](https://github.com/Growstu
 
 For more information about this project, contact [info@growstuff.org](mailto:info@growstuff.org).
 
+Security Issues: If you find an authorization bypass or data breach, please contact our maintainers directly at [maintainers@growstuff.org](mailto:maintainers@growstuff.org).
+
 You can also contact us on [Twitter](http://twitter.com/growstufforg/) or
 [Facebook](https://www.facebook.com/pages/Growstuff/1531133417099494) or [Github](https://github.com/Growstuff/growstuff/issues)..