ACSD-51819: Multiple orders can be placed with the same quote ID

Categories

Order/Checkout

Components

magento/module-quote, magento/module-quote-graph-ql, magento/module-async-order

Origin

adobe-commerce-support

Since QPT

1.1.41

Issue

Multiple orders can be placed with the same quote ID.

Steps to reproduce

1. Log in as a user. 1. Add items to the cart and proceed to checkout. 1. Choose any payment method but do not click on the Place Order button. 1. Log in to the same account in another browser. 1. Proceed to checkout with the same items without clicking on the Place Order button. 1. Click on the Place Order button in both the systems at the same time. 1. Validate the orders placed in both browsers.

Adobe's page lists 2.4.4 - 2.4.4-p11, 2.4.5-p3 - 2.4.5-p10, 2.4.6 - 2.4.6-p8, 2.4.7 - 2.4.7-p3 as compatible; the versions below are resolved from the current QPT constraints and are the ones the tool will offer.

Adobe scheduled the permanent fix for 2.4.7.

Install

Install the Quality Patches Tool with composer require magento/quality-patches, apply the prerequisites listed for all files applicable to your distribution and version first, then run vendor/bin/magento-patches apply ACSD-51819. On Cloud, add ACSD-51819 under stage.build.QUALITY_PATCHES in .magento.env.yaml.

For cweagans/composer-patches, choose a compatible version below and download the bundle. Copy its ACSD-51819/ folder into patches/composer/, merge composer.patches.json into composer.json, then run composer install. Bundle prerequisites the same way and list them first. Paths are relative to each package root, using the default -p1 level. Prefer local files when configuring composer-patches; a remote URL can change.

Patch files and compatible versions

Sources

• Adobe documentation for ACSD-51819
• JSON API: /api/v1/patches/ACSD-51819