MDVA-39031: Adding a product to the cart via GraphQL is possible even…

Categories

GraphQL, Shopping Cart

Components

magento/module-quote, magento/module-quote-graph-ql

Origin

adobe-commerce-support

Since QPT

1.1.6

Issue

Adding a product to the cart via GraphQL is possible even if it is not assigned to the target website.

Steps to reproduce

1. Create a secondary website. 1. Create a product and assign it to the primary website. 1. Create an empty cart for the secondary website using GraphQL. <pre> <code class="language-graphql"> mutation{ createEmptyCart } </code> </pre> With headers like: <pre> <code class="language-graphql"> { "Store":"en_au" } </code> </pre> 1. Add the product assigned to the primary website to the cart in secondary website. <pre> <code class="language-graphql"> mutation { addProductsToCart( cartId: "XHrUN2nJ37OqDByhtL0VC8OxYsEZs41c" cartItems: [ { quantity: 1 sku: "p1" } ] ) { cart { items { product { name sku } quantity } } } } </code> </pre> Headers <pre> <code class="language-graphql"> { "Store":"en_au" } </code> </pre>

Adobe's page lists 2.4.2 - 2.4.3-p1 as compatible; the versions below are resolved from the current QPT constraints and are the ones the tool will offer.

Adobe scheduled the permanent fix for 2.4.4.

Install

Install the Quality Patches Tool with composer require magento/quality-patches, apply the prerequisites listed for all files applicable to your distribution and version first, then run vendor/bin/magento-patches apply MDVA-39031. On Cloud, add MDVA-39031 under stage.build.QUALITY_PATCHES in .magento.env.yaml.

For cweagans/composer-patches, choose a compatible version below and download the bundle. Copy its MDVA-39031/ folder into patches/composer/, merge composer.patches.json into composer.json, then run composer install. Bundle prerequisites the same way and list them first. Paths are relative to each package root, using the default -p1 level. Prefer local files when configuring composer-patches; a remote URL can change.

Patch files and compatible versions

Sources

• Adobe documentation for MDVA-39031
• JSON API: /api/v1/patches/MDVA-39031