Critical Reminder: Download and install Magento security patches. (FTP with no SSH access)

Question

The Magento security patches look like they are .sh files, how would someone apply these patches without SSH access to their Magento installations?

Also, are these patches cumulative? IE: Will they be included in future version of Magento or do they need to be reapplied?

I'm asking this question because I logged into my admin panel and received a critical security warning:

Download and implement 2 important security patches (SUPEE-5344 and SUPEE-1533) from the Magento Community Edition download page (https://www.magentocommerce.com/products/downloads/magento/).

If you have not done so already, download and install 2 previously-released patches that prevent an attacker from remotely executing code on Magento software. These issues affect all versions of Magento Community Edition.

A press release from Check Point Software Technologies in the coming days will make one of these issues widely known, possibly alerting hackers who may try to exploit it. Ensure the patches are in place as a preventative measure before the issue is publicized.

and this as of May 14, 2015:

It is important for you to download and install a new security patch (SUPEE-5994) from the Magento Community Edition download page (https://www.magentocommerce.com/products/downloads/magento/). Please apply this critical update immediately to help protect your site from exposure to multiple security vulnerabilities impacting all versions of the Magento Community Edition software. Please note that this patch should be installed in addition to the recent Shoplift patch (SUPEE-5344).

I also received the following email:

Dear Magento Merchant,

To further secure the Magento platform from potential attacks, we are releasing a new patch (SUPEE-5994) with multiple critical security fixes today. The patch addresses a range of issues, including scenarios where attackers can gain access to customer information. These vulnerabilities were gathered through our multi-point security program, and we have received no reports of merchants or their customers being impacted by these issues.

All versions of Magento Community Edition software are impacted and we strongly recommend that you work with your Solution Partner or developer to immediately deploy this critical patch. Please note that this patch should be installed in addition to the recent Shoplift patch (SUPEE-5344). More information about the security issues is available in the Appendix of the Magento Community Edition user guide.

You can download the patch from the Community Edition download page. Look for the SUPEE-5994 patch. The patch is available for Community Edition 1.4.1– 1.9.1.1.

Be sure to implement and test the patch in a development environment first to confirm that it works as expected before deploying it to a production site. Information about installing patches on Magento Community Edition is available online.

Thank you for your attention to this issue.

UPDATE JULY 7 - 2015

July 7, 2015: New Magento Security Patch (SUPEE-6285) – Install Immediately
Today we are providing a new security patch (SUPEE-6285) that addresses critical security vulnerabilities. The patch is available for Community Edition 1.4.1 to 1.9.1.1 and is part of the core code of our latest release, Community Edition 1.9.2, available for download today. PLEASE NOTE: You must first implement SUPEE-5994 to ensure SUPEE-6285 works properly. Download Community Edition 1.9.2 or the patch from the Community Edition download page: https://www.magentocommerce.com/products/downloads/magento/

UPDATE AUG 4 - 2015

August 4, 2015: New Magento Security Patch (SUPEE-6482) – Install Immediately
Today we are providing a new security patch (SUPEE-6482) that addresses 4 security issues; two issues related to APIs and two cross-site scripting risks. The patch is available for Community Edition 1.4 and later releases and is part of the core code of Community Edition 1.9.2.1, which is available for download today. Before implementing this new security patch, you must first implement all previous security patches. Download Community Edition 1.9.2.1 or the patch from the Community Edition download page at https://www.magentocommerce.com/products/downloads/magento/

UPDATE OCT 27 - 2015

October 27, 2015: New Magento Security Patch (SUPEE-6788) – Install Immediately
Today, we are releasing a new patch (SUPEE-6788) and Community Edition 1.9.2.2/Enterprise Edition 1.14.2.2 to address 10+ security issues, including remote code execution and information leak vulnerabilities. This patch is unrelated to the Guruincsite malware issue. Be sure to test the patch in a development environment first, as it can affect extensions and customizations. Download the patch from the Community Edition Download page/Enterprise Edition Support Portal and learn more at http://magento.com/security/patches/supee-6788.

UPDATE JAN 20 - 2016

Important: New Security Patch (SUPEE-7405) and Release – 1/20/2016
Today, we are releasing a new patch (SUPEE-7405) and Community Edition 1.9.2.3/Enterprise Edition 1.14.2.3 to improve the security of Magento sites. There are no confirmed attacks related to the security issues, but certain vulnerabilities can potentially be exploited to access customer information or take over administrator sessions. You can download the patch and release from Community Edition Download page/MyAccount and learn more at https://magento.com/security/patches/supee-7405.

UPDATE FEB 23 - 2016

Updated versions of the SUPEE7405 patch are now available. The updates add support for PHP 5.3 and address issues with upload file permissions, merging carts, and SOAP APIs experienced with the original release. They DO NOT address any new security issues. You can download the patch and release from Community Edition Download page/MyAccount and learn more at https://magento.com/security/patches/supee-7405.

Answer 1

Applying patches manually with no SSH access

You have a good point here. The patches are supplied as .sh files and there is no solution offered by Magento for FTP only websites.

I suggest one would copy his website's code to a local environment through FTP (you would probably have that already). Then apply the patch by running the .sh file.

Now you need to find out which files you need to upload again. If you would open the .sh patch file, then you will see it consist of two sections:

1. Bash shell code to apply the patch. This code is general for every patch.
2. The actual patch in the form of a unified patch format. This indicates only the lines in files that were changed (including some context lines). This starts below the line __PATCHFILE_FOLLOWS__

From the second section you could read which files were/are affected by the patch. You need to upload these files again to your FTP or... you could just upload everything.

Applying manually without bash/shell

1. If you can't run .sh files (in Windows), then you could extract the second section of the patch (the unified patch) and apply it manually with a patching tool (or for example through PHPStorm).
2. The website Magentary.com provides ZIP files for each Magento version containing the patched files only.

Patches in current & future releases?

The patches that are released right now apply to all versions that were already released. Of course, might Magento release a new version (major or minor). Then they will contain all security patches as Magento will also apply the patches to their development code base naturally (these patches even originate from that code base ;)).

UPDATE:
Every last patch Magento has also released new versions of Magento CE and EE already containing the specific latest patch. See the Release Archive tab on the Magento download page.

Check this sheet, maintained by JH, for which patches to install for which Magento CE and EE version: https://docs.google.com/spreadsheets/d/1MTbU9Bq130zrrsJwLIB9d8qnGfYZnkm4jBlfNaBF19M

Answer 2

Unfortunately, there's no 'easy' way to install these patches without shell access, but there's two ways to do it.

Install patch through PHP

1. Use an FTP client to upload the specific patch to the root of your Magento folder.
2. Create a PHP file called applypatch.php that will run the patch for you, and upload it to the root of your Magento folder. Make sure to use the right patch name here, if you don't use the patch for version 1.8.x-1.9.x

<?php
print("<PRE>");
passthru("/bin/bash PATCH_SUPEE-5344_CE_1.8.0.0_v1.sh");
print("</PRE>");
?>

3. Visit the file at http://your.domain.com/applypatch.php, and check if the output looks as expected.

Install patch manually

The .sh file contains a 'DIFF' patch. These show what lines were removed and added. While I don't advise it, you should be able to manually download the files through FTP, and edit these files in your editor of choice, and then reupload them again through FTP. The format isn't too hard to interpret, so you can do this for all the files and shouldn't take more then a few minutes.

Answer 3

In My case I use bitbucket for version Maintenance and make live my changes via bitBucket only.

So What I do When I apply the patches is, apply that patch In my local system and test all things. that my website is working.

and push all chnages to bitbucket and at live site pull all changes and my patch is applied.

In case what you do if you do not have ssh access is

1) Apply patch in local and push changes to bitbucket. Bitbucket tell you which files were changed from last commit.

2) upload those file manually via FTP and your patch is applied.

Answer 4

Applying Magento patches via FTP/sFTP or FileManager / File Upload.

Method 1 :-

To apply patches in this way we simply replace changed files. This way can not be used blindly if you or your developers have changed any core Magento files (which is a big no-no, by the way). Such changes should be re-applied to patched files, or you loose these changes.

kindly visit below URLs to download following patches:-

https://magentary.com/kb/install-supee-9652-without-ssh/

https://magentary.com/kb/install-supee-8788-without-ssh/

https://magentary.com/kb/install-supee-7405-without-ssh/

https://magentary.com/kb/install-supee-6788-without-ssh/

http://magentary.com/kb/install-supee-6482-without-ssh/

http://magentary.com/kb/install-supee-6285-without-ssh/

https://magentary.com/kb/install-supee-5994-without-ssh/

https://magentary.com/kb/apply-supee-5344-and-supee-1533-without-ssh/

Method 2 :-

Download patch file to https://magento.com/tech-resources/download#download1972 Upload patch files in the root of magento.

Make one file with the name of patch.php, write following code in it,

<?php
print("<PRE>");
passthru("/bin/bash PATCH_SUPEE-9652.sh");
print("</PRE>");
echo "Done";
?>

You run patch.php from the browser.

If you are getting error like this,

"Error! Some required system tools, that are utilized in this sh script, are not installed; Tool (s) "patch" is (are) missed, please install it(them).

That means system tools aren’t installed in your server to run the sh script.

Answer 5

I don't think it's possible to do that without SSH access but you can always create a SSH account on the cpanel or any other panel you got and there is a huge chance that you might find the tutorials for creating an SSH account by your Hosting Company just google the "name-of-your-hosting company + ssh creating".

Answer 6

Download the patches (Actually only 1, as 1 is for EE and the other for CE) Suggest you run quick back first....

cp -r public_html backup (replace public_html with full magento installation)

FTP the patch to the backup directory first and check all ok by running it on the backup.. sh patchname.sh

All ok? FTP the patch to your actual install & run

http://devdocs.magento.com/guides/m1x/other/ht_install-patches.html

the guide also advises "To reapply ownership to the files changed by the patch: Find the web server user: ps -o "user group command" -C httpd,apache2 The value in the USER column is the web server user name. Typically, the Apache web server user on CentOS is apache and the Apache web server user on Ubuntu is www-data. As a user with root privileges, enter the following command from the Magento installation directory: chown -R web-server-user-name . For example, on Ubuntu where Apache usually runs as www-data, enter chown -R www-data "

running the ps command as root , i only got root as user and ran chown -R root and buggered up my install, i ran it again with the username of the user account its installed on and all was good