MC-42528: GraphQL query of categoryList returns both assigned and unassigned categories

Categories

GraphQL

Components

magento/module-catalog-graph-ql, magento/module-catalog-permissions, magento/module-catalog-permissions-graph-ql, magento/module-catalog-staging-graph-ql

Origin

adobe-commerce-support

Since QPT

1.1.4

Issue

GraphQL query of categoryList returns both assigned and unassigned categories.

Steps to reproduce

1. Create two categories, CAT1 and CAT2, and assign few products to each category. 1. Create a private shared catalog. 1. Create a company user and assign it to the created shared catalog. 1. Assign CAT1 to the custom catalog and set the category permission to "Allow" Browsing Category for the customer group of the private catalog. 1. Set the category permission for CAT2 to "Deny" Browsing Category for the customer group of private catalog. 1. Run the categoryList or categories GraphQL query as the company user.

Adobe's page lists 2.4.3 - 2.4.3-p1 as compatible; the versions below are resolved from the current QPT constraints and are the ones the tool will offer.

Adobe scheduled the permanent fix for 2.4.4.

Install

Install the Quality Patches Tool with composer require magento/quality-patches, apply the prerequisites listed for all files applicable to your distribution and version first, then run vendor/bin/magento-patches apply MC-42528. On Cloud, add MC-42528 under stage.build.QUALITY_PATCHES in .magento.env.yaml.

For cweagans/composer-patches, choose a compatible version below and download the bundle. Copy its MC-42528/ folder into patches/composer/, merge composer.patches.json into composer.json, then run composer install. Bundle prerequisites the same way and list them first. Paths are relative to each package root, using the default -p1 level. Prefer local files when configuring composer-patches; a remote URL can change.

Patch files and compatible versions

Sources

• Adobe documentation for MC-42528
• JSON API: /api/v1/patches/MC-42528