[Issue] Add ACL role ID to category tree cache id #28306
Labels
Component: Acl
Component: Backend
Component: Catalog
Fixed in 2.4.x
The issue has been fixed in 2.4-develop branch
Issue: Confirmed
Gate 3 Passed. Manual verification of the issue completed. Issue is confirmed
Issue: Format is valid
Gate 1 Passed. Automatic verification of issue format passed
Issue: Ready for Work
Gate 4. Acknowledged. Issue is added to backlog and ready for development
Priority: P2
A defect with this priority could have functionality issues which are not to expectations.
Reproduced on 2.4.x
The issue has been reproduced on latest 2.4-develop branch
Severity: S1
Affects critical data or functionality and forces users to employ a workaround.
Triage: Done
Has been reviewed and prioritized during Triage with Product Managers
This issue is automatically created based on existing pull request: #27429: Add ACL role ID to category tree cache id
Preconditions: (*)
When an admin user views a product's category tree (by editing a product), the category tree is cached with an ID akin to
CATALOG_PRODUCT_CATEGORY_TREE_0_
(the$filter
option is not used in the Magento codebase).This is not compatible with admin users that have limited Role Scopes. If the first admin user to view a product category tree has access to all websites (e.g.
Administrator
), this then caches the full category tree for all websites. Then the limited admin user will also see this full category tree even if they should be limited to a single website's category tree. Similarly, if the limited admin user views the category tree after the block cache is cleaned, theAdministrator
user will only see a limited category tree.This pull request adds the admin's user's ACL role ID to the cache ID. This is probably about as performant as we can get.
Steps to reproduce: (*)
Default Category/default
and assign it to Main Website Store;Second Category/second_category
for ex.);Second Website
,Second Website Store
,Second Website Store view
) and set Second Category as default;⭕ Admin_GWS functionality
Actual Result: (*)
✖️ The categories from Main Website is shown
Expected Result: (*)
✔️ user should only see a limited category tree
Contribution checklist (*)
The text was updated successfully, but these errors were encountered: