magento2-33876: Reviews list Ajax page showing raw output when opened directly
Community fix magento2-33876 merged into magento/magento2 on 2025-06-18, released in 2.4.9; applies cleanly to 33 releases from 2.4.6 to 2.4.8-p5.
Fixes the reviews list Ajax page showing raw output when opened directly edited
- Pull request title
- fix: avoid direct access to reviews list AJAX
- Pull request
- magento/magento2#33876
- Issues
- #37920 pr-derived
- Author
- @Amadeco
- Merged
- 2025-06-18
- Fixed in
- 2.4.9
- Reported on
- —
- Categories
- Catalog/Product
- Components
- magento/module-review
Labels
- Area
- UI Framework
- Component
- Review
- Priority
- P3
- Severity
- —
- Reported on (labels)
- 2.4.x
Issue
Title and steps come from the upstream issue and pull request.
Description
But you can access directly to the reviews list Ajax controller however all others controllers for Ajax URL has a conditional test in code.
Steps to reproduce
/review/product/listAjax/id/9999
=> Display the raw output in the browser.
(9999 = product if from store)
Taken from the upstream pull request.
Code match per tag
Each tag was checked with git apply --check against that tag's files. A clean match means the change applies; it is not a test result. Tags that already contain the fix are marked.
| Line | Code match per tag | Tests |
|---|---|---|
| 2.4.6 | 2.4.6 clean 2.4.6-p1 clean 2.4.6-p2 clean 2.4.6-p3 clean 2.4.6-p4 clean 2.4.6-p5 clean 2.4.6-p6 clean 2.4.6-p7 clean 2.4.6-p8 clean 2.4.6-p9 clean 2.4.6-p10 clean 2.4.6-p11 clean 2.4.6-p12 clean 2.4.6-p13 clean 2.4.6-p14 clean 2.4.6-p15 clean | 2.4.6: no test data 2.4.6-p1: no test data 2.4.6-p2: no test data 2.4.6-p3: no test data 2.4.6-p4: no test data 2.4.6-p5: no test data 2.4.6-p6: no test data 2.4.6-p7: no test data 2.4.6-p8: no test data 2.4.6-p9: no test data 2.4.6-p10: no test data 2.4.6-p11: no test data 2.4.6-p12: no test data 2.4.6-p13: no test data 2.4.6-p14: no test data 2.4.6-p15: no test data |
| 2.4.7 | 2.4.7 clean 2.4.7-p1 clean 2.4.7-p2 clean 2.4.7-p3 clean 2.4.7-p4 clean 2.4.7-p5 clean 2.4.7-p6 clean 2.4.7-p7 clean 2.4.7-p8 clean 2.4.7-p9 clean 2.4.7-p10 clean | 2.4.7: no test data 2.4.7-p1: no test data 2.4.7-p2: no test data 2.4.7-p3: no test data 2.4.7-p4: no test data 2.4.7-p5: no test data 2.4.7-p6: no test data 2.4.7-p7: no test data 2.4.7-p8: no test data 2.4.7-p9: no test data 2.4.7-p10: no test data |
| 2.4.8 | 2.4.8 clean 2.4.8-p1 clean 2.4.8-p2 clean 2.4.8-p3 clean 2.4.8-p4 clean 2.4.8-p5 clean | 2.4.8: no test data 2.4.8-p1: no test data 2.4.8-p2: no test data 2.4.8-p3: no test data 2.4.8-p4: no test data 2.4.8-p5: no test data |
| 2.4.9 | 2.4.9 conflictcontains the fix | 2.4.9: no test data |
Triage
Model @cf/cloudflare/clef. Probability this is a bug fix: 76.8%. Probability it is security relevant: 16.8%.
Show the model's answers and probabilities
| Question | Answer | Probabilities | Confidence |
|---|---|---|---|
| Change kind | bugfix | bugfix 87.7%, refactor 6.7%, feature 3.2%, tests_only 1.0%, docs_only 0.7%, dependency 0.7% | 73.1% |
| Area | frontend | frontend 32.1%, other 20.4%, catalog 20.2% | 8.9% |
| Reported version | unspecified | unspecified 24.0%, 2.4.6 2.7%, 2.4.4-p1 2.5% | 5.5% |
| Scope | 0.41 of 2 | 0 62.9%, 1 32.9%, 2 4.1% | 25.9% |
| Risk | 0.11 of 2 | 0 91.3%, 1 7.0%, 2 1.8% | 75.7% |
| Worth backporting | 1.21 of 2 | 2 46.5%, 1 27.6%, 0 26.0% | 3.9% |
Download
For cweagans/composer-patches, choose a version below and download the bundle. Copy its magento2-33876/ folder into patches/composer/, merge composer.patches.json into composer.json, then run composer install. Test files are always removed; paths are relative to each package root, using the default -p1 level.
Bundle README (what the ZIP ships)
# magento2-33876 Community fix merged upstream into magento/magento2, adapted by magento.watch. This is not a patch published by Adobe. Pull request: https://github.com/magento/magento2/pull/33876 Issue: https://github.com/magento/magento2/issues/37920 Author: @Amadeco Source commit: b4356e43580d36ddc7b595ae6b4e882bbb80c57c Modifications: test files and documentation removed, paths rewritten relative to each Composer package. Licence: OSL-3.0 / AFL-3.0, as the original Magento Open Source code. Maintainer: Łukasz Bajsarowicz (@lbajsarowicz)
Licence: Magento Open Source code under OSL-3.0 and AFL-3.0. The bundle carries the original author, source commit and the list of modifications.
