ACSD-68391: Category-related permissions are not applied correctly in Quick Order and Requisition…

Categories

B2B, Admin

Components

magento/module-bundle-requisition-list, magento/module-quick-order, magento/module-requisition-list, magento/module-requisition-list-graph-ql

Origin

adobe-commerce-support

Since QPT

1.1.73

Issue

Category-related permissions are not applied correctly in Quick Order and Requisition Lists.

Steps to reproduce

1. Enable Quick Order and Requisition Lists. 1. Go to Stores > Configuration > Catalog > Catalog. 1. Scroll to Category Permissions and set Enable to Yes. 1. Set category permissions to deny price visibility for the "NOT LOGGED IN" customer group. 1. Open the category as a guest user on the storefront and confirm prices are hidden. 1. Use Quick Order to search for a product assigned to this category. 1. Add the product to the Requisition Lists.

Adobe's page lists 2.4.8 - 2.4.8-p3 as compatible; the versions below are resolved from the current QPT constraints and are the ones the tool will offer.

Adobe scheduled the permanent fix for 2.4.9.

Install

Install the Quality Patches Tool with composer require magento/quality-patches, apply the prerequisites listed for all files applicable to your distribution and version first, then run vendor/bin/magento-patches apply ACSD-68391. On Cloud, add ACSD-68391 under stage.build.QUALITY_PATCHES in .magento.env.yaml.

For cweagans/composer-patches, choose a compatible version below and download the bundle. Copy its ACSD-68391/ folder into patches/composer/, merge composer.patches.json into composer.json, then run composer install. Bundle prerequisites the same way and list them first. Paths are relative to each package root, using the default -p1 level. Prefer local files when configuring composer-patches; a remote URL can change.

Patch files and compatible versions

Sources

• Adobe documentation for ACSD-68391
• JSON API: /api/v1/patches/ACSD-68391