ACSD-47920: Orders can be placed via Rest API as a guest user even…
Orders can be placed via Rest API as a guest user even when the Allow Guest Checkout is turned off. Quality patch ACSD-47920 for magento/module-checkout applies to Magento Open Source and Adobe Commerce 2.4.0 to 2.4.5-p12.
- Categories
- Order/Checkout, Web API
- Components
- magento/module-checkout, magento/module-async-order
- Origin
- adobe-commerce-support
- Since QPT
- 1.1.24
Issue
Orders can be placed via Rest API as a guest user even when the Allow Guest Checkout is turned off.
Steps to reproduce
1. Go to Adobe Commerce Admin > Stores > Settings > Configuration > Sales > Sales > Checkout > Checkout Options > and set the Allow Guest Checkout to _No_. 1. Use REST API to add a product to a cart and place an order.
Adobe's page lists 2.4.0 - 2.4.5-p1 as compatible; the versions below are resolved from the current QPT constraints and are the ones the tool will offer.
Adobe scheduled the permanent fix for 2.4.6.
Install
Install the Quality Patches Tool with composer require magento/quality-patches, apply the prerequisites listed for all files applicable to your distribution and version first, then run vendor/bin/magento-patches apply ACSD-47920. On Cloud, add ACSD-47920 under stage.build.QUALITY_PATCHES in .magento.env.yaml.
For cweagans/composer-patches, choose a compatible version below and download the bundle. Copy its ACSD-47920/ folder into patches/composer/, merge composer.patches.json into composer.json, then run composer install. Bundle prerequisites the same way and list them first. Paths are relative to each package root, using the default -p1 level. Prefer local files when configuring composer-patches; a remote URL can change.
Patch files and compatible versions
magento/magento2-base >=2.4.0 <2.4.4-p13 || >=2.4.5 <2.4.5-p13
- Magento Open Source
- 2.4.5-p12, 2.4.5-p11, 2.4.5-p10, 2.4.5-p9, 2.4.5-p8, 2.4.5-p7, 2.4.5-p6, 2.4.5-p5, 2.4.5-p4, 2.4.5-p3, 2.4.5-p2, 2.4.5-p1, 2.4.5, 2.4.4-p12, 2.4.4-p11, 2.4.4-p10, 2.4.4-p9, 2.4.4-p8, 2.4.4-p7, 2.4.4-p6, 2.4.4-p5, 2.4.4-p4, 2.4.4-p3, 2.4.4-p2, 2.4.4-p1, 2.4.4, 2.4.3-p3, 2.4.3-p2, 2.4.3-p1, 2.4.3, 2.4.2-p2, 2.4.2-p1, 2.4.2, 2.4.1-p1, 2.4.1, 2.4.0-p1, 2.4.0
- Adobe Commerce
- 2.4.5-p12, 2.4.5-p11, 2.4.5-p10, 2.4.5-p9, 2.4.5-p8, 2.4.5-p7, 2.4.5-p6, 2.4.5-p5, 2.4.5-p4, 2.4.5-p3, 2.4.5-p2, 2.4.5-p1, 2.4.5, 2.4.4-p12, 2.4.4-p11, 2.4.4-p10, 2.4.4-p9, 2.4.4-p8, 2.4.4-p7, 2.4.4-p6, 2.4.4-p5, 2.4.4-p4, 2.4.4-p3, 2.4.4-p2, 2.4.4-p1, 2.4.4, 2.4.3-p3, 2.4.3-p2, 2.4.3-p1, 2.4.3, 2.4.2-p2, 2.4.2-p1, 2.4.2, 2.4.1-p1, 2.4.1, 2.4.0-p1, 2.4.0
- Patch file
- patches/os/ACSD-47920_2.4.3-p1.patch
- vendor/magento/module-checkout/Plugin/Api/VerifyIsGuestCheckoutEnabledBeforeAssignBillingAddress.php (added)
- vendor/magento/module-checkout/Plugin/Api/VerifyIsGuestCheckoutEnabledBeforePlaceOrder.php (added)
- vendor/magento/module-checkout/Plugin/Api/VerifyIsGuestCheckoutEnabledBeforeSavePaymentInformation.php (added)
- vendor/magento/module-checkout/Plugin/Api/VerifyIsGuestCheckoutEnabledBeforeSaveShippingInformation.php (added)
- vendor/magento/module-checkout/Plugin/Api/VerifyIsGuestCheckoutEnabledBeforeSetPaymentMethod.php (added)
- vendor/magento/module-checkout/etc/webapi_rest/di.xml (added)
- vendor/magento/module-checkout/etc/webapi_soap/di.xml (added)
magento/magento2-ee-base >=2.4.0 <2.4.4-p13 || >=2.4.5 <2.4.5-p13
- Magento Open Source
- —
- Adobe Commerce
- 2.4.5-p12, 2.4.5-p11, 2.4.5-p10, 2.4.5-p9, 2.4.5-p8, 2.4.5-p7, 2.4.5-p6, 2.4.5-p5, 2.4.5-p4, 2.4.5-p3, 2.4.5-p2, 2.4.5-p1, 2.4.5, 2.4.4-p12, 2.4.4-p11, 2.4.4-p10, 2.4.4-p9, 2.4.4-p8, 2.4.4-p7, 2.4.4-p6, 2.4.4-p5, 2.4.4-p4, 2.4.4-p3, 2.4.4-p2, 2.4.4-p1, 2.4.4, 2.4.3-p3, 2.4.3-p2, 2.4.3-p1, 2.4.3, 2.4.2-p2, 2.4.2-p1, 2.4.2, 2.4.1-p1, 2.4.1, 2.4.0-p1, 2.4.0
- vendor/magento/module-async-order/Plugin/Api/VerifyIsGuestCheckoutEnabledBeforeSavePaymentInformationAndPlaceOrder.php (added)
- vendor/magento/module-async-order/etc/webapi_rest/di.xml (added)
- vendor/magento/module-async-order/etc/webapi_soap/di.xml (added)
