The RailsEnvy guys have just launched their new Envy Casts site which is powered by Spree. The site allows you to purchase screencasts and is an excellent example of how one can sell downloadable content using Spree.

The site uses a few new Spree extensions including the Paypal Website Standard Extension. Envycasts also uses an extension to support downloadable content through Amazon’s S3 service. If anyone is interested in turning that code into an official extension just give those dudes a shout and I’m sure they’d be happy to provide the code.

Extensions now support images, javascripts and stylesheets. When you start your Spree application the contents of your extension’s public directory will be copied over to the application’s public directory. This means that extensions can make use of images and scripts now.

Stylesheets are technically available (in that they are copied to the public/stylesheets directory) but there is not currently a mechanism for including the stylesheets in your layout. We’re happy to consider a patch for this if someone out there is interested in writing one.

If you’re curious about the Spree extension system, we’re hoping to add some more information to the website and the wiki in the coming weeks.

There’s been a minor security fix checked into the git repository this morning. The problem relates to users who used the spree gem to create a new spree application but did not change the value of the secret key in config/environment.rb in the newly created app.

Your application is vulnerable if you have the following hash value for config.action_controller_session in your app’s config/environment.rb:

:secret => '2271bed096798b2c9e7b7ec14263e669944808bb94cb56d4befa5757cbb931095a3644c785

To fix it, simply change the value of the hash to some other random hash value with at least 30 characters. This has been fixed in the source and in the upcoming 0.3.0 release so newly generated applications will not have this problem.

For more details please see the related issue report.

We’ve just merged in a series of changes from the restful branch in git. Several of the Spree models are now fully REST. The original source code was written in the early days of REST before it was fully supported in Rails so we took a pass on implementing it until the Rails implementation settled down. We’ll be finishing up the REST conversion in the next couple of weeks.

If you are planning on using the Spree source code you should also familiarize yourself with the resource_controller plugin. Its an excellent way of standardizing and DRYing up your restful controllers. Fabio Akita has also written a very detailed screencast on using this plugin. Reading up on this plugin will help you to understand what’s going on in the newly restful (and very skinny) controllers.

We’ve also refactored the product form. The single massive form has been replaced by a series of tabs. You can also now add a new product and its picture in a single step. Check out the demo for details.