feat!: prevent catalog and sales rules from being disclosed publicly …

[damienwebdev]

…by default

Description (*)

In magento/magento2@efcc63b and magento/magento2@a2689a0 upstream introduced an unexpected information disclosure. These commits allow anonymous actors to call the graphql api and retrieve the list of all active discounts on the store.

curl --location 'https://www.yourmagentostore.com/graphql' \
--header 'Content-Type: application/json' \
--data '{"query":"query {\n    allCartRules {\n        name\n    }\n}","variables":{}}'

Manual testing scenarios (*)

1. Run the above cURL command and see Sharing Cart Rules information is disabled or not configured.

Contribution checklist (*)

• Pull request has a meaningful description of its purpose
• All commits are accompanied by meaningful commit messages
• All new or changed code is covered with unit/integration tests (if applicable)
• README.md files for modified modules are updated and included in the pull request if any README.md predefined sections require an update
• All automated tests passed successfully (all builds are green)

[fballiano]

I think this is an important fix for 1.1, @rhoerr?

[rhoerr]

Yes. Let's see test results. Looks good to me in theory.

[rhoerr]

LGTM, thank you

[hostep]

Should we also disable the config field customer/account_information/graphql_share_all_customer_groups that was introduced in Magento 2.4.8? This also exposes info publicly via graphql, which shopowners may consider to be private information.