[KB1002844] Sitecore 10.3 – Experience Editor shows duplicated rendering options

Recently, I have been getting an issue in Experience Editor that the list of allowed renderings duplidated when working on placeholder to add components to the page

The issue doesn’t occur before I apply the hotfix [KB1002844] for Sitecore 10.3 https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1002844. Note that [KB1002844] is very important because this is the “Security Bulletin SC2023-002-576660” for critical vulnerability.

The investigation appears that the cause of the issue is from changes regarding placeholder caching in the hotfix. There is an additional pipeline added about logic changes in term of getting the list of allowed renderings. These changes made items in the list duplicated before returning to Experience Editor.

<getPlaceholderRenderings>
	<processor type="Croda.Foundation.SitecoreExtensions.Pipelines.Placeholders.GetDynamicKeyAllowedRenderings, Croda.Foundation.SitecoreExtensions" patch:source="Foundation.SitecoreExtensions.config"/>
	<processor type="Sitecore.Pipelines.GetPlaceholderRenderings.GetAllowedRenderings, Sitecore.Kernel"/>
	<processor type="Sitecore.ExperienceEditor.Pipelines.GetPlaceholderRenderings.GetAllowedRenderings, Sitecore.ExperienceEditor" patch:source="Sitecore.ExperienceEditor.config"/>
	<!--  Ensures that the 'HasPlaceholderSettings' flag is enabled for FXM Template types.  -->
	<processor type="Sitecore.FXM.Pipelines.Rendering.EnableExternalPagePlaceholdersProcessor, Sitecore.FXM" resolve="true" patch:source="Sitecore.FXM.config"/>
	<processor type="Sitecore.Pipelines.GetPlaceholderRenderings.GetPredefinedRenderings, Sitecore.Kernel"/>
	<processor type="Sitecore.Pipelines.GetPlaceholderRenderings.RemoveNonEditableRenderings, Sitecore.Kernel"/>
	<processor type="Sitecore.Pipelines.GetPlaceholderRenderings.GetPlaceholderRenderingsDialogUrl, Sitecore.Kernel"/>
</getPlaceholderRenderings>

The new process added after “Sitecore.Pipelines.GetPlaceholderRenderings.GetAllowedRenderings, Sitecore.Kernel” but seems it doesn’t distinct the list of allowed renderings which is received from this pipline.

To fix this issue, we can either:

1. Change the “\App_Config\Sitecore\Experience Editor\Sitecore.ExperienceEditor.config” file and use “patch:instead” instead of “patch:after” in the mentioned processor
2. Use the following patch that you could put to the “\App_Config\Include” folder:

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/">
<sitecore>
  <pipelines>
    <getPlaceholderRenderings>
        <processor type="Sitecore.Pipelines.GetPlaceholderRenderings.GetAllowedRenderings, Sitecore.Kernel" >
            <patch:delete />
        </processor>
    </getPlaceholderRenderings>
  </pipelines>
</sitecore>
</configuration>

After changing, the experience editor looks good.

Thanks for reading and happy Sitecore coding!