fix: adjustCreditMemoItemQuantities causes a fatal error on missing order/invoice#40787
fix: adjustCreditMemoItemQuantities causes a fatal error on missing order/invoice#40787SamJUK wants to merge 1 commit intomagento:2.4-developfrom
Conversation
|
Hi @SamJUK. Thank you for your contribution!
Allowed build names are:
You can find more information about the builds here For more details, review the Code Contributions documentation. |
|
The security team has been informed about this pull request due to the presence of risky security keywords. For security vulnerability reports, please visit Adobe's vulnerability disclosure program on HackerOne or email psirt@adobe.com. |
|
@magento run all tests |
|
@magento run Unit Tests |
|
@magento create issue |
|
The security team has been informed about this pull request due to the presence of risky security keywords. For security vulnerability reports, please visit Adobe's vulnerability disclosure program on HackerOne or email psirt@adobe.com. |
Preconditions and environment
order_id,creditmemo_id, orinvoice_idis passed to the credit memo save actionSteps to reproduce
order_id/creditmemo_idparameter (e.g. via a stale or manipulated POST request toadmin/sales/order_creditmemo/save).Expected result
The controller handles the failed credit memo load gracefully and redirects to the
noroutepage (or back with an appropriate error), without throwing a fatal error.Actual result
A
TypeErroris thrown and logged as aCRITICALerror, crashing the request:Additional information
Root cause: In
Save::execute(),adjustCreditMemoItemQuantities($creditmemo)is called on line 94 before theif ($creditmemo)guard on line 95. WhenCreditmemoLoader::load()returnsfalse, the typed method receivesfalseinstead of aCreditmemoinstance, triggering theTypeError.Fix: Move the
adjustCreditMemoItemQuantities($creditmemo)call inside theif ($creditmemo)block so it is only invoked when a valid credit memo object has been loaded.Release note
Fixed a
TypeErrorcrash in the admin credit memo save controller (Magento\Sales\Controller\Adminhtml\Order\Creditmemo\Save) that occurred when the credit memo could not be loaded. TheadjustCreditMemoItemQuantitiescall is now correctly guarded by the existingif ($creditmemo)check.Resolved issues: