ACSD-57337: An admin user with access restrictions to specific websites could view companies from all…
An admin user with access restrictions to specific websites could view companies from all websites in the Companies grid. Quality patch ACSD-57337 for magento/module-company applies to Magento Open Source and Adobe Commerce 2.4.4 to 2.4.5-p17.
- Categories
- B2B
- Components
- magento/module-company
- Origin
- adobe-commerce-support
- Since QPT
- 1.1.48
Issue
An admin user with access restrictions to specific websites could view companies from all websites in the Companies grid.
Steps to reproduce
1. Create an additional website, store and storeview. 1. Create a few companies assigned to different websites. 1. Create an admin user role, and set the role scope to the created website. 1. Create an admin, and assign it to the created role. 1. Log in with a new admin. 1. Open Customers > Companies and observe the list of companies.
Adobe's page lists 2.4.4 - 2.4.5-p6 as compatible; the versions below are resolved from the current QPT constraints and are the ones the tool will offer.
Adobe scheduled the permanent fix for 2.5.0.
Install
Install the Quality Patches Tool with composer require magento/quality-patches, apply the prerequisites listed for all files applicable to your distribution and version first, then run vendor/bin/magento-patches apply ACSD-57337. On Cloud, add ACSD-57337 under stage.build.QUALITY_PATCHES in .magento.env.yaml.
For cweagans/composer-patches, choose a compatible version below and download the bundle. Copy its ACSD-57337/ folder into patches/composer/, merge composer.patches.json into composer.json, then run composer install. Bundle prerequisites the same way and list them first. Paths are relative to each package root, using the default -p1 level. Prefer local files when configuring composer-patches; a remote URL can change.
Patch files and compatible versions
magento/magento2-b2b-base >=1.3.3 <1.3.5
- Magento Open Source
- —
- Adobe Commerce
- 2.4.5-p17, 2.4.5-p16, 2.4.5-p15, 2.4.5-p14, 2.4.5-p13, 2.4.5-p12, 2.4.5-p11, 2.4.5-p10, 2.4.5-p9, 2.4.5-p8, 2.4.5-p7, 2.4.5-p6, 2.4.5-p5, 2.4.5-p4, 2.4.5-p3, 2.4.5-p2, 2.4.5-p1, 2.4.5, 2.4.4-p18, 2.4.4-p17, 2.4.4-p16, 2.4.4-p15, 2.4.4-p14, 2.4.4-p13, 2.4.4-p12, 2.4.4-p11, 2.4.4-p10, 2.4.4-p9, 2.4.4-p8, 2.4.4-p7, 2.4.4-p6, 2.4.4-p5, 2.4.4-p4, 2.4.4-p3, 2.4.4-p2, 2.4.4-p1, 2.4.4
- Patch file
- patches/commerce/ACSD-57337_1.3.4.patch
- vendor/magento/module-company/Plugin/Company/CollectionFilter.php (added)
- vendor/magento/module-company/etc/adminhtml/di.xml
