Timeline for Security Patch SUPEE-8788 - Possible Problems?
Current License: CC BY-SA 3.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 13, 2016 at 4:47 | comment | added | William Zhao | Icon, look at my diff above, in your way you need to change back the line updated by SUPEE 1533 in 'app/code/core/Mage/Adminhtml/Block/Dashboard/Graph.php' as well if you already have SUPEE 1533 patched. Otherwise Graph.php will fire out json format params and you wont be able to decode it by unserialize() | |
| Oct 13, 2016 at 4:16 | comment | added | Icon | Great, I was thinkin of doing slightly other way, on my test site I uploaded clean DashboardController.php (stock magento file) and installed SUPEE 8788. However, I read on this forum and a gentleman mentioned to manually reintroduce supee 1533 changes to Supee 8988 modified file. What you think about my method? | |
| Oct 13, 2016 at 4:01 | comment | added | William Zhao | Yes the purpose of 1533 replacing serialize() by json_encode() was to reduce the chance of attack pass ($newHash == $gaHash). While 8788 adds hash_equals() for the same purpose | |
| Oct 13, 2016 at 3:35 | comment | added | Icon | As I understand the 8788 overrides changes in DashboardController.php, and original 1533 changes will be eliminated? | |
| Oct 13, 2016 at 3:17 | history | edited | William Zhao | CC BY-SA 3.0 |
added 968 characters in body
|
| Oct 13, 2016 at 3:04 | history | answered | William Zhao | CC BY-SA 3.0 |