ACSD-50368: Customers group_id is ignored when a customer is created via Async REST API or Async Bulk…
Customers group_id is ignored when a customer is created via Async REST API or Async Bulk REST API. Quality patch ACSD-50368 for magento/module-customer applies to Magento Open Source and Adobe Commerce 2.4.3 to 2.4.4-p11.
- Categories
- Customer, Web API
- Components
- magento/module-customer
- Origin
- adobe-commerce-support
- Since QPT
- 1.1.33
Issue
Customers group_id is ignored when a customer is created via Async REST API or Async Bulk REST API.
Steps to reproduce
1. Use an Async Rest API request to create a customer: curl --location 'https://site.test/rest/default/async/V1/customers' \ --header 'Authorization: Bearer <YOUR_ACCESS_TOKEN>' \ --header 'Content-Type: application/json' \ --header 'Cookie: PHPSESSID=844fltmqq1g15qe4ju3l00tiai' \ --data-raw '{ "customer": { "email": "foo@bar.test", "firstname": "Test", "lastname": "User", "group_id": 2 } } 1. A similar response is returned: { "bulk_uuid": "b101ddcb-b7fd-4208-a2a6-2e84c9e61bcd", "request_items": [ { "id": 0, "data_hash": "6e718a93b02a30a98cb994d1c4e8cf1eeedcb962f384e4a463c" , "status": "accepted" } ], "errors": false } 1. Check the status of this asynchronous request: curl --location 'https://site.test/rest/default/V1/bulk/b101ddcb-b7fd-4208-a2a6-2e84c9e61bcd/detailed-status' \ --header 'Authorization: Bearer <YOUR_ACCESS_TOKEN>' \ --header 'Cookie: PHPSESSID=844fltmqq1g15qe4ju3l00tiai
Adobe's page lists 2.4.3 - 2.4.3-p3 as compatible; the versions below are resolved from the current QPT constraints and are the ones the tool will offer.
Adobe scheduled the permanent fix for 2.4.7.
Additional steps
The patch is partially deprecated, as this issue is addressed by the mandatory security patch MCLOUD-13240/APSB25-08.
Install
Install the Quality Patches Tool with composer require magento/quality-patches, apply the prerequisites listed for all files applicable to your distribution and version first, then run vendor/bin/magento-patches apply ACSD-50368. On Cloud, add ACSD-50368 under stage.build.QUALITY_PATCHES in .magento.env.yaml.
For cweagans/composer-patches, choose a compatible version below and download the bundle. Copy its ACSD-50368/ folder into patches/composer/, merge composer.patches.json into composer.json, then run composer install. Bundle prerequisites the same way and list them first. Paths are relative to each package root, using the default -p1 level. Prefer local files when configuring composer-patches; a remote URL can change.
Patch files and compatible versions
magento/magento2-base >=2.4.3 <2.4.4
- Patch file
- patches/os/ACSD-50368_2.4.4.patch
- vendor/magento/module-customer/Model/AccountManagement.php
- vendor/magento/module-customer/Model/AccountManagementApi.php
- vendor/magento/module-customer/Plugin/AsyncRequestCustomerGroupAuthorization.php (added)
- vendor/magento/module-customer/composer.json
- vendor/magento/module-customer/etc/di.xml
magento/magento2-base >=2.4.4 <2.4.4-p12 deprecated
- Magento Open Source
- 2.4.4-p11, 2.4.4-p10, 2.4.4-p9, 2.4.4-p8, 2.4.4-p7, 2.4.4-p6, 2.4.4-p5, 2.4.4-p4, 2.4.4-p3, 2.4.4-p2, 2.4.4-p1, 2.4.4
- Adobe Commerce
- 2.4.4-p11, 2.4.4-p10, 2.4.4-p9, 2.4.4-p8, 2.4.4-p7, 2.4.4-p6, 2.4.4-p5, 2.4.4-p4, 2.4.4-p3, 2.4.4-p2, 2.4.4-p1, 2.4.4
- Patch file
- patches/os/ACSD-50368_2.4.4.patch
- vendor/magento/module-customer/Model/AccountManagement.php
- vendor/magento/module-customer/Model/AccountManagementApi.php
- vendor/magento/module-customer/Plugin/AsyncRequestCustomerGroupAuthorization.php (added)
- vendor/magento/module-customer/composer.json
- vendor/magento/module-customer/etc/di.xml
