{"data":{"id":"magento2-33876","source":"github-pr","sourceRef":"magento/magento2#33876","title":"fix: avoid direct access to reviews list AJAX","pr":{"number":33876,"url":"https://github.com/magento/magento2/pull/33876","author":"Amadeco","mergedAt":"2025-06-18T09:32:39Z","mergeCommit":"14a03dc72fc5525f3bf2d93129dee2b8d9330e05","headCommit":"b4356e43580d36ddc7b595ae6b4e882bbb80c57c","baseRef":"2.4-develop","diffSha256":"49c410ba191b907970abe487355ac3f36c32aac4277b09bb1774ceafe323ac8e"},"issues":[{"number":37920,"url":"https://github.com/magento/magento2/issues/37920","title":"[Issue] Avoid direct access to reviews list Ajax","labels":["Area: UI Framework","Component: Review","Issue: Confirmed","Priority: P3","Progress: PR in progress","Progress: done","Reported on 2.4.x","Reproduced on 2.4.x"],"kind":"pr-derived"}],"fixedIn":"2.4.9","containingTags":["2.4.9"],"reportedOn":null,"codeMatch":{"2.4.6":"clean","2.4.6-p1":"clean","2.4.6-p2":"clean","2.4.6-p3":"clean","2.4.6-p4":"clean","2.4.6-p5":"clean","2.4.6-p6":"clean","2.4.6-p7":"clean","2.4.6-p8":"clean","2.4.6-p9":"clean","2.4.6-p10":"clean","2.4.6-p11":"clean","2.4.6-p12":"clean","2.4.6-p13":"clean","2.4.6-p14":"clean","2.4.6-p15":"clean","2.4.7":"clean","2.4.7-p1":"clean","2.4.7-p2":"clean","2.4.7-p3":"clean","2.4.7-p4":"clean","2.4.7-p5":"clean","2.4.7-p6":"clean","2.4.7-p7":"clean","2.4.7-p8":"clean","2.4.7-p9":"clean","2.4.7-p10":"clean","2.4.8":"clean","2.4.8-p1":"clean","2.4.8-p2":"clean","2.4.8-p3":"clean","2.4.8-p4":"clean","2.4.8-p5":"clean","2.4.9":"conflict"},"affectedVersions":["2.4.6","2.4.6-p1","2.4.6-p2","2.4.6-p3","2.4.6-p4","2.4.6-p5","2.4.6-p6","2.4.6-p7","2.4.6-p8","2.4.6-p9","2.4.6-p10","2.4.6-p11","2.4.6-p12","2.4.6-p13","2.4.6-p14","2.4.6-p15","2.4.7","2.4.7-p1","2.4.7-p2","2.4.7-p3","2.4.7-p4","2.4.7-p5","2.4.7-p6","2.4.7-p7","2.4.7-p8","2.4.7-p9","2.4.7-p10","2.4.8","2.4.8-p1","2.4.8-p2","2.4.8-p3","2.4.8-p4","2.4.8-p5"],"components":["magento/module-review"],"files":[{"path":"app/code/Magento/Review/Controller/Product/ListAjax.php","change":"modified","package":"magento/module-review"}],"stripped":{"tests":[],"docs":[],"outsideCode":[]},"linesChanged":8,"mergeBatched":false,"excluded":null,"sections":{"description":"Do not know wether it is intentional,\nBut you can access directly to the reviews list Ajax controller however all others controllers for Ajax URL has a conditional test in code.","stepsToReproduce":"You can give it a try :\n/review/product/listAjax/id/9999\n=> Display the raw output in the browser.\n\n(9999 = product if from store)","expectedResult":null,"actualResult":null,"source":"pr"},"signatures":[],"labels":{"area":["UI Framework"],"component":["Review"],"priority":"P3","severity":null,"reportedOn":["2.4.x"]},"categories":["Catalog/Product"],"triage":{"model":"@cf/cloudflare/clef","requestHash":"7dc094f92a78ca9b915f77de2d9528497852893b57699eab96c3b5504e4ad605","isBugfix":0.768,"changeKind":{"choice":"bugfix","probabilities":{"bugfix":0.8774,"feature":0.032,"refactor":0.0667,"tests_only":0.0102,"docs_only":0.007,"dependency":0.0067},"confidence":0.7307},"scope":{"score":0.4119,"probabilities":{"0":0.6294,"1":0.3292,"2":0.0414},"confidence":0.2594},"risk":{"score":0.1052,"probabilities":{"0":0.9125,"1":0.0697,"2":0.0178},"confidence":0.7569},"area":{"choice":"frontend","probabilities":{"catalog":0.2023,"checkout":0.0194,"customer":0.0472,"admin":0.0769,"graphql_api":0.0797,"framework":0.0493,"frontend":0.3208,"other":0.2044},"confidence":0.0891},"securityRelevant":0.1682,"reportedVersion":{"choice":"unspecified","probabilities":{"2.4.0":0.0062,"2.4.0-p1":0.0065,"2.4.1":0.0066,"2.4.1-p1":0.0075,"2.4.2":0.0112,"2.4.2-p1":0.0142,"2.4.2-p2":0.0121,"2.4.3":0.0183,"2.4.3-p1":0.0201,"2.4.3-p2":0.016,"2.4.3-p3":0.0102,"2.4.4":0.0207,"2.4.4-p1":0.0247,"2.4.4-p10":0.0083,"2.4.4-p11":0.0102,"2.4.4-p12":0.0087,"2.4.4-p13":0.008,"2.4.4-p14":0.0106,"2.4.4-p15":0.0071,"2.4.4-p16":0.0071,"2.4.4-p17":0.0066,"2.4.4-p18":0.0058,"2.4.4-p2":0.0038,"2.4.4-p3":0.0059,"2.4.4-p4":0.0055,"2.4.4-p5":0.0056,"2.4.4-p6":0.0058,"2.4.4-p7":0.0051,"2.4.4-p8":0.006,"2.4.4-p9":0.0052,"2.4.5":0.0181,"2.4.5-p1":0.0148,"2.4.5-p10":0.0078,"2.4.5-p11":0.011,"2.4.5-p12":0.0092,"2.4.5-p13":0.0087,"2.4.5-p14":0.0097,"2.4.5-p15":0.0071,"2.4.5-p16":0.007,"2.4.5-p17":0.0067,"2.4.5-p2":0.0048,"2.4.5-p3":0.0059,"2.4.5-p4":0.0074,"2.4.5-p5":0.0056,"2.4.5-p6":0.0068,"2.4.5-p7":0.0062,"2.4.5-p8":0.0055,"2.4.5-p9":0.0046,"2.4.6":0.0269,"2.4.6-p1":0.0225,"2.4.6-p10":0.0081,"2.4.6-p11":0.0107,"2.4.6-p12":0.0094,"2.4.6-p13":0.0091,"2.4.6-p14":0.0083,"2.4.6-p15":0.0076,"2.4.6-p2":0.005,"2.4.6-p3":0.0072,"2.4.6-p4":0.008,"2.4.6-p5":0.007,"2.4.6-p6":0.0091,"2.4.6-p7":0.0071,"2.4.6-p8":0.0055,"2.4.6-p9":0.0046,"2.4.7":0.0121,"2.4.7-p1":0.0086,"2.4.7-p10":0.0058,"2.4.7-p2":0.0062,"2.4.7-p3":0.0109,"2.4.7-p4":0.0122,"2.4.7-p5":0.0099,"2.4.7-p6":0.0118,"2.4.7-p7":0.008,"2.4.7-p8":0.0065,"2.4.7-p9":0.0047,"2.4.8":0.0102,"2.4.8-p1":0.0096,"2.4.8-p2":0.0107,"2.4.8-p3":0.0124,"2.4.8-p4":0.0091,"2.4.8-p5":0.0095,"2.4.9":0.0096,"unspecified":0.2396},"confidence":0.0548},"backportWorthy":{"score":1.205,"probabilities":{"0":0.2597,"1":0.2756,"2":0.4647},"confidence":0.039}},"curated":{"title":"Fixes the reviews list Ajax page showing raw output when opened directly","description":"You can access the reviews list Ajax controller directly at /review/product/listAjax/id/9999 and get the raw output in the browser, however all others controllers for Ajax URL have a conditional test in code. The Review ListAjax controller now does a forward to noroute when the call is not Ajax, to restrain this page to Ajax only.","categories":["Catalog/Product"],"author":"claude-code/opus-5.5","date":"2026-10-06","reviewedBy":null},"tests":null},"_documentation":"https://magento.watch/api","_description":"Upstream fix magento2-33876 details"}