Magento2: 2.1.9 Item not added to the Wishlist if the user is not logged at the moment he click on the button to add it.

[carloricci84]

Preconditions

1. Magento 2.1.9 installed

Steps to reproduce

1. Create an user account.
2. Logout from the user account
3. Add a product to your Wishlist , you will get redirected to the login page
4. Login

Expected result

1. You are redirected to the customer account Wishlist page and the product is added.

Actual result

1. You are redirected to the customer account Wishlist page but the product is not added.

Looking at the bug fix "APPSEC-1755: Anti-CSRF form_key is not changed after login" here https://magento.com/security/patches/magento-2016-and-219-security-update , it seems that since the form key is now changed after the login, the form key used for the Wishlist in vendor/magento/module-wishlist/Controller/Index/Add.php does not validate at the beginning of the execute function.

public function execute()
{
    /** @var \Magento\Framework\Controller\Result\Redirect $resultRedirect */
    $resultRedirect = $this->resultFactory->create(ResultFactory::TYPE_REDIRECT);
    if (!$this->formKeyValidator->validate($this->getRequest())) {
        return $resultRedirect->setPath('*/');
    }

[magento-engcom-team]

@carloricci84, thank you for your report.
We've created internal ticket(s) MAGETWO-82985 to track progress on the issue.

[osrecio]

I am working on it at #mm17es

[okorshenko]

The issue has been fixed and delivered to 2.1-develop, 2.2-develop and 2.3-develop branches. Will be available with upcoming patch release

[thaddeusmt]

Are we sure this is fixed in 2.2.2? I am seeing this exact same bug. If you go through the login form, the form_key changes and when module-wishlist/Controller/Index/Add.php::execute() runs it fails at the $this->formKeyValidator->validate($this->getRequest()) line, just as described.

[osrecio]

Hi @thaddeusmt I tested with branch 2.2-develop with sample data and works fine.

This issue will be added to 2.2.4

[lalit-algoworks]

I am facing issue with magento 2.2.2 wishlist. Item are not added in wishlist if user logged out.
Here are the steps with sample data
Steps to reproduce.

1. Click on item when user is not logged in
   
2. It redirect to login screen.
   
3. After login it shows.
   

There is one more issue in wishlist.
If user have some item in their wishlist it should highlight on that item page/category page, but it not.

Please provide way to solve it.

[osrecio]

Hi @lalit-algoworks this issue will be fixed in 2.2.4

[thaddeusmt]

Magento support gave us a patch for 2.2.2, so perhaps it will be fixed in 2.2.3+

[sivajik34]

can you share me the patch

[thaddeusmt]

magento_2.2.2_add-to-wishlist-login-register_patch.txt

[matheus0608]

not work, add item wishlist magento 2.3 Invalid Form Key,