-
Notifications
You must be signed in to change notification settings - Fork 9.4k
Set isSecureArea before deleting customer #38462
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Set isSecureArea before deleting customer #38462
Conversation
Deletion of the customer is only possible if isSecureArea is true. If it is not set deletion will fail with an exception and the customer will not know why the registration failed and will not be able to register again due to the existing entity.
|
Hi @DanieliMi. Thank you for your contribution! Add the comment under your pull request to deploy test or vanilla Magento instance:
❗ Automated tests can be triggered manually with an appropriate comment:
Allowed build names are:
You can find more information about the builds here For more details, review the Code Contributions documentation. |
|
This problem has also happened to me. Thanks for the solution @DanieliMi But I think the process itself should be rewritten here. The address validation is tightly coupled with customer address saving process in here We should somehow move/copy it from there and perform before we do any savings What do you think? |
|
Alright, here is the fix for my use case We have customer address fields within a registration form, so we receive this error when the address is invalid. So I created a little plugin that validates the address BEFORE Magento saves anything <?php
declare(strict_types=1);
namespace Vendor\CustomerAddress\Plugin\Account;
use Magento\Customer\Api\AccountManagementInterface;
use Magento\Customer\Api\Data\AddressInterface;
use Magento\Customer\Api\Data\CustomerInterface;
use Magento\Framework\Validator\Exception;
use Magento\Framework\Validator\Factory;
class ValidateAddressBeforeRegistrationPlugin
{
public function __construct(private readonly Factory $validatorFactory)
{
}
/**
* @throws Exception
*/
public function beforeCreateAccountWithPasswordHash(
AccountManagementInterface $subject,
CustomerInterface $customer
): null {
foreach ($customer->getAddresses() ?? [] as $address) {
$this->validateAddress($address);
}
return null;
}
/**
* @throws Exception
*/
private function validateAddress(AddressInterface $address): void
{
$validator = $this->validatorFactory->createValidator('customer_address', 'save');
if (!$validator->isValid($address)) {
throw new Exception(null, null, $validator->getMessages());
}
}
}<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
<type name="Magento\Customer\Api\AccountManagementInterface">
<plugin name="vendor_validate_address_before_registration"
type="Vendor\CustomerAddress\Plugin\Account\ValidateAddressBeforeRegistrationPlugin"/>
</type>
</config> |
|
@VladyslavSikailo, could you please create it as a pull request? |
|
Yeah I agree, it would be much better to validate first, before even creating the customer! Would be awesome to replace this PR with a better solution! Another approach could be to wrap it within a transaction. |
|
@ihor-sviziev I am not really sure it should be merged into the core like that. |
|
@magento run all tests |
engcom-Hotel
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hello @DanieliMi,
Thank you for the contribution!
I agree with the @VladyslavSikailo's comment here.
However, since the delete customer functionality does not work if the isSecureArea flag is not set to true, the current implementation is also not functioning as expected. Therefore, I believe we can proceed with this PR.
Please review and resolve the static test failure.
Thanks
|
Hi @engcom-Hotel, I have extracted the new code into a separate method which should fix the static tests. Do they run automatically or do I have to start them manually? |
|
Hello @DanieliMi, Thanks for making the changes to fix the static test failures. To run the automate test, we need to run the below command manually: @magento run all tests |
|
@magento run all tests |
|
@magento run all tests |
|
@magento run all tests |
|
@magento create issue |
|
The security team has been informed about this pull request due to the presence of risky security keywords. For security vulnerability reports, please visit Adobe's vulnerability disclosure program on HackerOne or email [email protected]. |
|
Hi @DanieliMi, Thanks for the collaboration & contribution! ✔️ QA PassedPreconditions:
Manual testing scenarios
Before: ✖️
After: ✔️ Now Deletion is Possible and customer can register again successfully. Builds are failed. Hence, moving this PR to Extended Testing. Thanks. |
|
@magento run all tests |
|
@magento run Functional Tests B2B, Functional Tests CE, Functional Tests EE, Integration Tests |
|
@magento run Functional Tests CE |
|
@magento run Functional Tests B2B |
22e91fb
into
magento:2.4-develop







Deletion of the customer is only possible if isSecureArea is true. If it is not set deletion will fail with an exception and the customer will not know why the registration failed and will not be able to register again due to the existing entity.
Description (*)
When the address form is enabled in the registration and an required address field is missing the registration will fail with the message "Delete operation is forbidden for current area". This is because first the customer is created and then the address is saved. When the address cannot be saved due to validation errors the customer needs to be deleted which will fail in a non secure area. Then the customer cannot register again because the customer entity already exists. Deletion is not possible because isSecureArea is not set at this point. This PR sets isSecureArea for the deletion process.
Related Pull Requests
Fixed Issues (if relevant)
Manual testing scenarios (*)
Questions or comments
Contribution checklist (*)
Resolved issues: