User login not work after SUPEE-8788 Patch

Question

our provider has patch our Magento 1.7.02 version today. After this the login from users doesn't work anymore.

After sent username and passwort the fields are empty but nothing changes

Any idea?

Answer 1

Try to add that in your customer login form

<input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->getFormKey() ?>" />

Answer 2

You most likely have to update your custom template files with the changes that this patch introduced to base templates. Files updated include:

M       app/design/frontend/base/default/template/checkout/cart.phtml
M       app/design/frontend/base/default/template/checkout/onepage/review/info.phtml
M       app/design/frontend/base/default/template/wishlist/view.phtml
M       app/design/frontend/base/default/template/sales/reorder/sidebar.phtml
M       app/design/frontend/base/default/template/tag/customer/view.phtml
M       app/design/frontend/base/default/template/persistent/customer/form/login.phtml
M       app/design/frontend/base/default/template/customer/form/login.phtml
M       app/design/frontend/base/default/template/review/form.phtml
M       app/design/frontend/base/default/template/catalog/product/view.phtml

If your local template overwrites any of these files, they need to be updated accordingly.

Most often this will be adding a piece of code to each form:

<?php echo $this->getBlockHtml('formkey'); ?>

but not only. You have to check each file for differences.

Answer 3

A little late but we found the problem in patch SUPEE-8788 V2 which at least applies to the patch files for Magento 1.7.0.2 and 1.7.0.1. Probably this also applies to all prior versions for which a patch version exists. Magento versions from 1.8 on are not affected as the patch doesn't change templates for those.

In detail

The patch is missing a formkey for file app/design/frontend/base/default/template/persistent/checkout/onepage/login.phtml

Without it login doesn't work on onepage checkout (it just doesn't work without error).

Fix

A formkey has to be inserted like in following patch:

diff --git a/app/design/frontend/base/default/template/persistent/checkout/onepage/login.phtml b/app/design/frontend/base/default/template/persistent/checkout/onepage/login.phtml
index 9d15a577b..18483a3c5 100644
--- a/app/design/frontend/base/default/template/persistent/checkout/onepage/login.phtml
+++ b/app/design/frontend/base/default/template/persistent/checkout/onepage/login.phtml
@@ -71,6 +71,7 @@
         <h3><?php echo $this->__('Login') ?></h3>
         <?php echo $this->getMessagesBlock()->getGroupedHtml() ?>
         <form id="login-form" action="<?php echo $this->getPostAction() ?>" method="post">
+        <?php echo $this->getBlockHtml('formkey'); ?>
         <fieldset>
             <h4><?php echo $this->__('Already registered?') ?></h4>
             <p><?php echo $this->__('Please log in below:') ?></p>

Answer 4

Make sure you update all of your template files that @affirmative mention and add just after the beginning of the form tag <form ....><?php echo $this->getBlockHtml('formkey'); ?>

The new patch introduced a if statement for all of the post methods that check's if a formkey was send with the submitted form

/**
 * Submit new review action
 *
 */
public function postAction()
{
    if (!$this->_validateFormKey()) {
        // returns to the product item page
        $this->_redirectReferer();
        return;
    }

if no formkey is send the controller will redirect you back to the page without any errors.

Answer 5

Make sure, that your cookie_lifetime is not 0!

Magento is killing session if the cookie_lifetime is over and this is not interpreted the same way as the set cookie.