ACSD-51291: A restricted admin with access to one website can add images/videos to a product assigned…

Categories

Admin

Components

magento/module-catalog, magento/module-product-video, magento/theme-adminhtml-backend, magento/module-admin-gws

Origin

adobe-commerce-support

Since QPT

1.1.32

Issue

A restricted admin with access to one website can add images/videos to a product assigned to multiple websites.

Steps to reproduce

1. Log in as an admin. 1. Create a second website, store, and store view. 1. Create a second admin role with resources only for the second website, store, and store view. 1. Create a second admin, and assign it to the new restricted admin role. 1. Create a new product, and assign it to both the default and the new websites. 1. Log out from the main admin profile. 1. Log in as the new restricted admin. 1. Edit the created product, which has been assigned to both websites. 1. Open the Images and Videos tab.

Adobe's page lists 2.4.4 - 2.4.4-p3, 2.4.5 - 2.4.5-p2 as compatible; the versions below are resolved from the current QPT constraints and are the ones the tool will offer.

Adobe scheduled the permanent fix for 2.4.7.

Install

Install the Quality Patches Tool with composer require magento/quality-patches, apply the prerequisites listed for all files applicable to your distribution and version first, then run vendor/bin/magento-patches apply ACSD-51291. On Cloud, add ACSD-51291 under stage.build.QUALITY_PATCHES in .magento.env.yaml.

For cweagans/composer-patches, choose a compatible version below and download the bundle. Copy its ACSD-51291/ folder into patches/composer/, merge composer.patches.json into composer.json, then run composer install. Bundle prerequisites the same way and list them first. Paths are relative to each package root, using the default -p1 level. Prefer local files when configuring composer-patches; a remote URL can change.

Patch files and compatible versions

Sources

• Adobe documentation for ACSD-51291
• JSON API: /api/v1/patches/ACSD-51291