Skip to content

Fixed: Configurable product selections leak between shopping carts through the product config cache (OFBIZ-13773) - #2502

Merged
mridulpathak merged 1 commit into
apache:trunkfrom
mridulpathak:OFBIZ-13773
Oct 30, 2026
Merged

mridulpathak merged 1 commit into
apache:trunkfrom
mridulpathak:OFBIZ-13773

Conversation

@mridulpathak

Copy link
Copy Markdown
Contributor

Configurable product selections could leak from one customer's cart into another's, and copied cart lines were not independent of the line they were copied from:

  • ProductConfigWorker.getProductConfigWrapper returned the cached ProductConfigWrapper itself on a cache miss, so the first customer's selections and comments were written into the cache and every later visitor started from them. It now always returns a copy.
  • A copied ConfigOption kept the source option's parent ConfigItem, so isDefault and the offset prices of a copy were computed against the source's selections. Copied options now belong to the copied item.
  • A copied ConfigOption shared the source's componentOptions map, so a variant chosen on one copy changed the other. The map is now copied.

… cache

ProductConfigWorker.getProductConfigWrapper returned the cached ProductConfigWrapper itself on a cache miss, so the first customer's selections and comments were written into the cache and copied to every later visitor. It now always returns a copy. Copies were not independent either: a copied ConfigOption kept the source option's parent ConfigItem and shared its componentOptions map, so copied options now belong to the copied item and get their own map.
@github-actions github-actions Bot added the bug label Oct 30, 2026
@mridulpathak
mridulpathak merged commit 50d5485 into apache:trunk Oct 30, 2026
7 checks passed
@mridulpathak
mridulpathak deleted the OFBIZ-13773 branch October 30, 2026 10:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant