MC-42528: GraphQL query of categoryList shows all categories

The MC-42528 patch solves the issue where the GraphQL query of categoryList returns both assigned and unassigned categories when the Browsing Category of a particular category is set to “Deny”. This patch is available when the Quality Patches Tool (QPT) 1.1.4 is installed. The patch ID is MC-42528. Please note that the issue is scheduled to be fixed in Adobe Commerce 2.4.4.

Affected products and versions

The patch is created for Adobe Commerce version:

  • Adobe Commerce (all deployment methods) 2.4.3

Compatible with Adobe Commerce versions:

  • Adobe Commerce (all deployment methods) 2.4.3 - 2.4.3-p1
NOTE

The patch might become applicable to other versions with new Quality Patches Tool releases. To check if the patch is compatible with your Adobe Commerce version, update the magento/quality-patches package to the latest version and check the compatibility on the QPT landing page. Use the patch ID as a search keyword to locate the patch.

Issue

GraphQL query of categoryList returns both assigned and unassigned categories.

Steps to reproduce:

  1. Create two categories, CAT1 and CAT2, and assign few products to each category.
  2. Create a private shared catalog.
  3. Create a company user and assign it to the created shared catalog.
  4. Assign CAT1 to the custom catalog and set the category permission to “Allow” Browsing Category for the customer group of the private catalog.
  5. Set the category permission for CAT2 to “Deny” Browsing Category for the customer group of private catalog.
  6. Run the categoryList or categories GraphQL query as the company user.

Expected results:

Only the CAT1 shows up in the response.

Actual results:

All the categories show up in the response regardless of the browsing permissions of category.

Apply the patch

To apply individual patches, use the following links depending on your deployment method:

To learn more about Quality Patches Tool, refer to:

For info about other patches available in QPT, refer to the Patches available in QPT section.

On this page