File Manager

Editing File: /var/softaculous/magento2/changelog.txt

Magento Open Source 2.3.6 Release Notes

Magento Open Source 2.3.6 offers significant platform upgrades, substantial security changes, and performance improvements.

This release includes over 160 functional fixes to the core product and over 15 security enhancements

Quarterly releases may contain backward-incompatible changes (BIC). Magento 2.3.6 contains minor backward-incompatible changes. To review minor backward-incompatible changes, see BIC reference. (Major backward-incompatible issues are described in BIC highlights. Not all releases introduce major BICs.)

We are adding support for PHP 7.4.x in Magento 2.3.7, which is scheduled for release in Q2 2021. This support will introduce breaking changes to Magento 2.3.x deployments. How will this affect your store? See the PHP 7.4 support for Magento 2.3.x release line DevBlog post.
Highlights

Look for the following highlights in this release:
Substantial security enhancements

This release includes the following security enhancements:
Over 15 security enhancements that help close remote code execution (RCE) and cross-site scripting (XSS) vulnerabilities

No confirmed attacks related to these issues have occurred to date. However, certain vulnerabilities can potentially be exploited to access customer information or take over administrator sessions. Most of these issues require that an attacker first obtains access to the Admin. As a result, we remind you to take all necessary steps to protect your Admin, including but not limited to these efforts: IP allowlisting, two-factor authentication, use of a VPN, the use of a unique location rather than /admin, and good password hygiene. See Security Updates Available for Magento for a discussion of these fixed issues.
Security enhancements and fixes to core code

This release includes over 15 security fixes and platform security improvements. Additional security enhancements include:

CAPTCHA protection has been added to the following product areas:

Place Order storefront page and REST and GraphQL endpoints
    Payment-related REST and GraphQL endpoints.

CAPTCHA protection for these additional pages is disabled by default. It can be enabled on the Admin in the same way that other pages covered by CAPTCHA are. This protection has been added as an anti-brute force mechanism to protect stores against carding attacks. See CAPTCHA.

Starting with the release of Magento Commerce 2.3.2, Magento will assign and publish indexed Common Vulnerabilities and Exposures (CVE) numbers with each security bug reported to us by external parties. This allows users of Magento Commerce to more easily identify unaddressed vulnerabilities in their deployment.
Fixed issues

We have fixed hundreds of issues in the Magento 2.3.6 core code.
Installation, upgrade, deployment

Magento now displays an informative error message when some themes are not deployed after running setup:static-content:deploy. Previously, when deployment completed successfully but not all packages were deployed, Magento did not display an error. When the setup:static-content:deploy command is executed with enabled parallel processing and each theme requires more time to be deployed then the specified maximum execution time, this command can finish successfully, although themes are not deployed.

The Use default checkbox for Klarna payments (Stores > Configuration > Sales > Payment methods > Klarna) now remain checked as expected when website scope changes.

Upgrade no longer results in the sudden failure of the Galera cluster. Previously, the Galera cluster exited abruptly after re-indexing immediately after upgrade. During Magento upgrade, index tables are altered and the engine is changed from MEMORY to InnoDB. At this point, the content of these tables becomes out-of-sync between the nodes of the Galera cluster. GitHub-25334

bin/magento setup:di:compile no longer throws a fatal error. Previously, Magento threw an error the first time you ran this command, but the second execution resulted in successful compilation.

Amazon Pay

Clicking Return to standard checkout just before completing checkout with Amazon Pay now returns the shopper to the checkout page that displays all payment methods available the shopper. Previously, no payment methods were displayed.

Analytics

CSV files that are generated by analytics_collect_data are now properly escaped. Previously, these files were not generated with the correct escaping, which prevented the generation of Inventory reports.

Magento successfully generates advance reporting data files and sends them as expected to Inventory on deployments with split databases. Previously, Magento did not generate or send the quotes.csv file to Inventory, and as a result, Inventory did not generate the expected reports.

Backend

The Products in the Comparison List and the Recently Compared Products features now work as expected. Previously, when the comparison list was expanded, Magento did not display products, even though the section indicated that the list contained products.

Bundle products

Re-importing bundle products now works as expected. Previously, the second import did not change the catalog_product_relation table, and the storefront did not display the bundled products because parent-child product relations were not generated correctly.

Magento no longer sets prices for fixed-price bundle product child items in quotes.

Cache

X-Magento-Tags headers no longer exceed the size permitted by the HTTP specification. Previously, category pages that contain many products return an X-Magento-Tag header that resulted in a 503 error.

Cart and checkout

The State/Province/Region input box is now enabled as expected on My account > Address Book > Add new address.

Custom address attributes are now included as expected in the form that is displayed for the Payment step of the checkout workflow.

The shipping method estimator now works as expected when custom address attributes are present on the shipping step of the checkout workflow. Previously, Magento displayed this error message:{"message":"Error occurred during \"custom_attributes\" processing. A custom attribute is specified with a missing attribute code. Verify the code and try again."} GitHub-27505

Custom customer address attributes fields are now displayed as expected in the storefront checkout workflow.

Shoppers can now purchase a virtual gift card using PayPal Braintree without defining a shipment address. Previously, Magento threw an error.

Magento now displays the waiting/spinning icon while prices are updated on the cart.

Merchants can now enable Apply to Shipping Amount in the Action tab of Marketing > Cart Price Rules > Add New Rule when Fixed amount discount for whole cart is applied. GitHub-24422

Catalog

Merchants with multiple websites can now use POST /V1/products to create and update products while preserving image and image-role inheritance. Previously, when a merchant used the REST API to create and update products, and a product was updated for store view, the default image roles were loaded and saved for that store view. As a result, the store-view image roles stopped inheriting from the default scope after update.

Magento now successfully updates attributes labeled Product Type. Previously, because the product_type attribute is reserved in Magento core code, Magento displayed this message when you tried to update it: An attribute with the same code (product_type) already exists.

Problems with product sort order on the storefront have been resolved. Previously, when Magento indexed product prices, it occasionally set a configurable product’s min_price and max_price to 0 in the catalog_product_index_price table, which affected price sort order on the storefront.

Shoppers can now re-order an invoiced order of a product with customizable options as expected. Previously, Magento threw this error when a shopper tried to re-order: {"0":"The product's required option(s) weren't entered. Make sure the options are entered and try again.

Magento now displays all re-enabled products in the storefront as expected. Previously, when a product was disabled and then re-enabled, Magento did not display the product until the Varnish page cache was cleared or the store re-indexed because the page cache was not invalidated after re-enabling a product.

Magento now displays the Recently Compared Products widget only after at least one product has been deleted from a product comparison. Previously, this widget was displayed immediately after a shopper added a product for comparison.

You can now successfully save an image to a category from the Admin. Previously, after you saved the image, part of the URL was missing, and you could not re-open the image.

The Product in Websites checkbox of the new product page is now enabled by default for restricted administrative users in multi-site deployments. Previously, the checkbox for the non-default website was not preselected, and if the administrator left the checkbox unselected, Magento displayed an error message.

The Price condition in Page Builder now works as expected for configurable products.

Saving a category now flushes only the block cache that is related to this category. Previously, Magento flushed cache for all category blocks.

Magento now correctly represents Arabic thousands grouping and Arabic decimal separator symbols. Previously, Arabic symbols were trimmed. GitHub-26676

Consecutive asynchronous price updates no longer interfere with each other and correct status is assigned to each operation. Previously, if an asynchronous price update failed, all subsequent asynchronous price updates will fail until the corresponding queue consumer is restarted.

Changes introduced by an earlier bug fix that resulted in HTML errors on the product list page have been reverted.

Catalog Rule

Product and catalog caches now expire as scheduled. Previously, caches expired daily because сron ran the catalogrule_apply_all task once daily, which re-indexed all catalog rules and dependent indexers, and cleared the cache for all products and categories.

CMS content

Magento now throws an error when a merchant creates a CMS page with the same URL as the Company Structure page. Previously, Magento displayed the CMS page instead of the Company Structure page.

Configurable products

Admin users accounts created from an admin account with a restricted scope can now create a configurable product with attributes as expected. Previously, Magento threw this error: Notice: Undefined index: value_index in 23develop/app/code/Magento/ConfigurableProduct/Helper/Product/Options/Factory.php on line 101.

Magento no longer links a simple product to a configurable product when the API call to link these products fails.

Pagination problems with the Configurable Product Edit Current Variations list have been corrected.

Customer

The State/Province fields are now populated as expected on the Edit Address page (My Account > Address book).

Customer group is no longer automatically changed for a customer who is assigned to a Company when you edit the customer on the Customer grid.

Magento no longer resets a customer’s customer group to the default when a customer saves their account information.

Saving a deleted customer from the Admin now generates an error message only. Previously, Magento displayed a blank page and generated a report that contained this string: "0":"No such entity with customerId = 3","1":"#1 Magento\\Customer\\Model CustomerRegistry->retrieve() called at [app\/code\/Magento\/Customer\/Model\/ResourceModel\/CustomerRepository.php:340".

Magento now honors customer group settings when you create a new customer from the Admin in a multi-site deployment.

The validation logic associated with the Date of Birth field of the Customer Registration form no longer triggers a JavaScript error.

The Admin view of a customer cart now displays all the products that were added to the cart from multiple websites in a multi-website deployment. Previously, when a customer added a product to their cart from a non-default website, the product was not displayed in the Admin even when Share customer account was set to Global.

The Invalid Form Key. Please refresh the page text string on the login page is now translated as expected.

Magento now displays the Credit memo button after the partial refund of an order. Previously, Magento did not display this button after you created a partial refund, and you could not create a credit memo for the rest of the order.

The shopping cart that is accessed from the Admin customer details page now includes only products from the selected customer’s quote. Previously, this cart listed all items in the quote_item table.

Customer creation from the Admin now honors the default customer group setting as expected.

The PHPSessionId is now changed as expected after a customer logs out and then logs back in.

Data scripts are no longer re-run whenever you attempt to upgrade the database by running bin/magento setup:upgrade. Previously, upgrade scripts were re-run unnecessarily, which affected performance. GitHub-19469