MAGETWO-51390: Private Data of Registered Customer May Be Retrieved with Quote Web API by Anonymous

Author: irenelagno

app/code/Magento/Quote/Model/QuoteManagement.php

@@ -269,13 +269,13 @@ public function assignCustomer($cartId, $customerId, $storeId)
 
         $quote->setCustomer($customer);
         $quote->setCustomerIsGuest(0);
-        $this->quoteRepository->save($quote);
         $quoteIdMaskFactory = $this->getQuoteIdMaskFactory();
         /** @var  \Magento\Quote\Model\QuoteIdMask $quoteIdMask */
         $quoteIdMask = $quoteIdMaskFactory->create()->load($cartId, 'quote_id');
         if ($quoteIdMask->getId()) {
             $quoteIdMask->delete();
         }
+        $this->quoteRepository->save($quote);
         return true;
 
     }