ACSD-60584: The API token created for the user on one website allows you to access customer…
The API token created for the user on one website allows you to access customer information, create a cart, and add products to the cart on other website views. Quality patch ACSD-60584 for magento/module-customer-graph-ql applies to Magento Open Source and Adobe Commerce 2.4.5 to 2.4.6-p14.
- Categories
- GraphQL, Customer
- Components
- magento/module-customer-graph-ql
- Origin
- adobe-commerce-support
- Since QPT
- 1.1.53
Issue
The API token created for the user on one website allows you to access customer information, create a cart, and add products to the cart on other website views.
Steps to reproduce
1. Ensure Share Customer Accounts configuration is set to Per Website. 1. Create additional website, store, and storeview. 1. Create two customers with the same email on the main website and the website from the previous step. 1. Generate a customer token via GraphQL on the main website. 1. Using the generated token, send a customer GraphQL query with the second website in the header to retrieve customer information. 1. Observe the returned result.
Adobe's page lists 2.4.5 - 2.4.6-p8 as compatible; the versions below are resolved from the current QPT constraints and are the ones the tool will offer.
Adobe scheduled the permanent fix for 2.4.8.
Install
Install the Quality Patches Tool with composer require magento/quality-patches, apply the prerequisites listed for all files applicable to your distribution and version first, then run vendor/bin/magento-patches apply ACSD-60584. On Cloud, add ACSD-60584 under stage.build.QUALITY_PATCHES in .magento.env.yaml.
For cweagans/composer-patches, choose a compatible version below and download the bundle. Copy its ACSD-60584/ folder into patches/composer/, merge composer.patches.json into composer.json, then run composer install. Bundle prerequisites the same way and list them first. Paths are relative to each package root, using the default -p1 level. Prefer local files when configuring composer-patches; a remote URL can change.
Patch files and compatible versions
magento/magento2-base >=2.4.5 <2.4.5-p17 || >=2.4.6 <2.4.6-p15
- Magento Open Source
- 2.4.6-p14, 2.4.6-p13, 2.4.6-p12, 2.4.6-p11, 2.4.6-p10, 2.4.6-p9, 2.4.6-p8, 2.4.6-p7, 2.4.6-p6, 2.4.6-p5, 2.4.6-p4, 2.4.6-p3, 2.4.6-p2, 2.4.6-p1, 2.4.6, 2.4.5-p16, 2.4.5-p15, 2.4.5-p14, 2.4.5-p13, 2.4.5-p12, 2.4.5-p11, 2.4.5-p10, 2.4.5-p9, 2.4.5-p8, 2.4.5-p7, 2.4.5-p6, 2.4.5-p5, 2.4.5-p4, 2.4.5-p3, 2.4.5-p2, 2.4.5-p1, 2.4.5
- Adobe Commerce
- 2.4.6-p14, 2.4.6-p13, 2.4.6-p12, 2.4.6-p11, 2.4.6-p10, 2.4.6-p9, 2.4.6-p8, 2.4.6-p7, 2.4.6-p6, 2.4.6-p5, 2.4.6-p4, 2.4.6-p3, 2.4.6-p2, 2.4.6-p1, 2.4.6, 2.4.5-p16, 2.4.5-p15, 2.4.5-p14, 2.4.5-p13, 2.4.5-p12, 2.4.5-p11, 2.4.5-p10, 2.4.5-p9, 2.4.5-p8, 2.4.5-p7, 2.4.5-p6, 2.4.5-p5, 2.4.5-p4, 2.4.5-p3, 2.4.5-p2, 2.4.5-p1, 2.4.5
- Patch file
- patches/os/ACSD-60584_2.4.6-p1.patch
- vendor/magento/module-customer-graph-ql/Model/Context/AddUserInfoToContext.php
