1

As many are aware if you have SUPEE 1533 installed you cannot install SUPEE 8788.

I figured that Reversing/uninstalling Supee 1533, we can install SUPEE 8788. But, then we cannot install SUPEE 1533 back. How to approach ? Should we forget about installing SUPEE 1533 after we install SUPEE 8788? Or should we manually modify the

Original DashboardController.php (1.7.0.2- Not pached, Fresh from magento)

  if ($params = unserialize(base64_decode(urldecode($gaData)))) {

1533 Patched DashboardController.php contains the following change

 if ($newHash == $gaHash) {
            $params = json_decode(base64_decode(urldecode($gaData)), true);
            if ($params) {

8788 patch makes the following change in DashboardController.php

 if (hash_equals($newHash, $gaHash)) {
            if ($params = unserialize(base64_decode(urldecode($gaData)))) {

As you can see 8788 has a modified change compared to 1533 so as other suggest its not ideal to manually replace 8788 change with 1533 after installing 8788.

Any suggestions?

3
  • Beware if you applied SUPEE-1533 : you may have to manually revert 1533, apply 8788, manually reapply 1533
    – Mikhail
    Oct 13, 2016 at 8:21
  • For anyone having problems with the .swf updates of the patch, I simply removed lines 5951-9818 from the patch and manually removed the .swf files from /skin/adminhtml/default/default/media - since that's all the patch was doing anyway. Oct 13, 2016 at 9:41
  • 1
    Attention, the line numbers will vary dependent on your Magento version. So review the change before removing lines blindly, it should only remove the diff for *.swf files Oct 13, 2016 at 14:10

2 Answers 2

1

Maybe you'll want to follow this questions: Security Patch SUPEE-8788 - Possible Problems?

You'll find a solution/approach there.

1
  • I am not exactly sure what they mean by 1. Manually revert the changes introduced to that file by SUPEE-1533 2. Apply SUPEE-8788 3. Manually reintroduce the changes introduced to that file by SUPEE-153
    – Icon
    Oct 13, 2016 at 0:53
0

This has worked for me on 1.7.0.2.

Edit the patch file PATCH_SUPEE-8788_CE_1.7.0.2_v1-2016-10-11-06-36-18.sh and remove everything from line 503 to line 516. The key here is that the line numbering remain untouched. This means that line 503 to 516 must still be in the file but will be empty.

Failure to do so will cause the patch script to throw you an error.

Don't forget to make the change you removed from the patch manually in app/code/core/Mage/Adminhtml/controllers/DashboardController.php.

Example gist

9
  • Thanks for the tip! I am confused about this issue, if we skip lines, basically 8788 will not edit DashbaordController.php file, wouldn't it leave the store vulnurable? I've posted above, there is small change in the line between 1533 and 8788 patch. What do you think?
    – Icon
    Oct 13, 2016 at 2:42
  • I've updated the comment with a link to a gist of the patch I used so you see exactly the lines I've removed. Oct 13, 2016 at 2:44
  • @Icon I've adjusted the wording, but you DEFINITELY SHOULD make the changes to Magento as the patch would have. I only removed the section from my patch so the rest of the changes get done by the patch script. Oct 13, 2016 at 2:46
  • Great, I am lookint at it right now. If we skip the DashboardControl.php update, dont you think it will leave the system vulnerable? Seems like 8788 replaced 1533 patch changes. Wherease what we are doing is keeping 1533 patch changes. What you think?
    – Icon
    Oct 13, 2016 at 2:48
  • 1
    My original method was this: Upload 1.7.0.2 Original DashboardControl.php file and replace it with 1533 modified one. Install 8788 patch and forget about manually applying 1533 since 8788 already patches Fresh 1.7.0.2 Dashboardcontroller.php
    – Icon
    Oct 13, 2016 at 2:51

Not the answer you're looking for? Browse other questions tagged or ask your own question.