9

Magento just sent out an email about a new security patch (SUPEE-11219).

https://magento.com/security/patches/supee-11219

Affected versions:

  • Magento Commerce 1.9.0.0-1.14.4.1
  • Magento Open Source 1.5.0.0-1.9.4.1

There are 3 remote code execution vulnerabilities for authenticated users.

Problems

The first problem I found is that the patch is not available for CE < 1.9.3.0. Usually they provide patches for all the affected versions. I will get in touch with Magento about that and update this post.

Improve this question
14
  • any updates on not available patches?
    – sergio
    Commented Oct 9, 2019 at 9:02
  • 3
    Piotr Kaminski from Magento wrote in a chat yesterday: "note M1.x patches for older versions will be released in next couple of days due to last minute issues found."
    – Matthias Zeis
    Commented Oct 9, 2019 at 14:17
  • 3
    My contacts at Magento also told me "The product team informed me they will have patches released in the next couple of days" for < 1.9.3.0
    – Tyler V.
    Commented Oct 9, 2019 at 22:45
  • 1
    It is about a week, still nothing from magento team yet. Should we wait more? They don't have anything officially on this issue anywhere on their blog or website?
    – djmzfKnm
    Commented Oct 16, 2019 at 8:50
  • 1
    Update from Piotr yesterday: "we need another week. due to scope of changes, it turned extremely difficult to port them down". Source is the same chat.
    – Matthias Zeis
    Commented Oct 18, 2019 at 8:31

11 Answers 11

Reset to default
10

This might be totally just our project related but thought to share this finding. After applying this patch I noticed that if grid, like orders grid, has some custom filtering which uses filter_condition_callback setting. This might produce an error. In our case we have a date field and for the grid it has index recurring_billing_dates and 'filter_condition_callback' => array($this, 'filterRecurringDates'); and that custom callback is just using two different fields from db so the default index shouldn't be used in the filtering at all.

Patch makes the following change:

index 2c8f1623186..52e4f186d05 100644
--- app/code/core/Mage/Adminhtml/Block/Widget/Grid.php
+++ app/code/core/Mage/Adminhtml/Block/Widget/Grid.php
@@ -464,7 +464,7 @@ class Mage_Adminhtml_Block_Widget_Grid extends Mage_Adminhtml_Block_Widget
     {
         if ($this->getCollection()) {
             $field = ( $column->getFilterIndex() ) ? $column->getFilterIndex() : $column->getIndex();
-            if ($column->getFilterConditionCallback()) {
+            if ($column->getFilterConditionCallback() && $column->getFilterConditionCallback()[0] instanceof self) {
                 call_user_func($column->getFilterConditionCallback(), $this->getCollection(), $column);
             } else {
                 $cond = $column->getFilter()->getCondition();

So the change in the if clause might lead one to see error report if the column index isn't same as some column in db and that instanceof self fails. System ends up in the default path without using the call_user_func and tries to use the index directly. In our case the custom field is injected through xml sales_order_grid_update_handle. Now I just probably have to figure out how to change these custom callbacks to work with this patch.

Version we're using is 1.9.4.0.

Edit: Fixed the issue by moving callbacks to another class which extends proper parent class in this case Mage_Adminhtml_Block_Widget_Grid. In the past custom callback functions could basically be in any class and we had these in plain Helper\Data.php which just extended Mage_Core_Helper_Abstract and that didn't work anymore.

Improve this answer
10
  • Thanks for your reply! Can you please explain the fix some more? We currently load the callback functions also in the Helper\Data.php, but we face the same issue. What should be the class to move the callbacks to? See the related question; magento.stackexchange.com/questions/293280/…
    – JGeer
    Commented Oct 22, 2019 at 12:32
  • What I did to solve our problem was that I just created another Helper file, in this case Helper\Grid.php where I declared the class like this: class OurModule_Helper_Grid extends Mage_Adminhtml_Block_Widget_Grid Then I copied all the necessary functions and changed the xml to point to this new helper class: <action method="addColumnAfter"> <columnId>fs_tuoteryhma1</columnId> <arguments helper="ourmodule/grid/getFsTuoteryhma1GridParams"></arguments> <after>status</after> </action>
    – erej
    Commented Oct 24, 2019 at 7:14
  • Probably not the best place to put that new class, but had to fix it in hurry :)
    – erej
    Commented Oct 24, 2019 at 7:21
  • 1
    I installed the module and did fixes for that and got it working. The main reason is that filtering function was in the observer and not in the helper, so that's probably why it didn't work. So what I did with this module Atwix_ExtendedGrid is following: 1. created new file under the Helper directory: Grid.php``` 2. In that file I moved the filterSkus function from the observer.php and from the data getSkusColumnParams In that getSkusColumnParams I changed the filter_condition_callback to array($this, 'filterSkus') so the callback points to function inside this new file.
    – erej
    Commented Oct 24, 2019 at 12:34
  • 1
    and in the design/adminhtml/default/layout/atwix/extendedgrid I changed the arguments to be <arguments helper="atwix_extendedgrid/grid/getSkusColumnParams" /> Also clearing the Magento cache is needed so the changes in xml's affects.
    – erej
    Commented Oct 24, 2019 at 12:35
8

Problem: Line endings js/tiny_mce/plugins/media/editor_plugin_src.js

checking file js/tiny_mce/plugins/media/editor_plugin_src.js
Hunk #1 FAILED at 379 (different line endings).
1 out of 1 hunk FAILED

Solution:

Execute:

dos2unix  js/tiny_mce/plugins/media/editor_plugin_src.js

Now you can apply patch SUPEE-11219

Improve this answer
1
  • Those using git in Magento with a .gitignore entry of "media" vs the correct "/media" may have issues applying this patch as the contents and updates to "js/tiny_mce/plugins/media" could well have been ignored and not propagated forward. The tiny mce media plugin has been patched a couple of times and if a prior patch change has not be retained due to the erroneous gitignore then subsequent [patch] will not apply. Leaving this here as it may help some.
    – Flipmedia
    Commented Nov 27, 2019 at 12:03
6

If you have existing customer accounts with 6-character passwords, this patch will lock them out as the new requirement is 7-character.

This is pretty frustrating because there isn't any way of bulk checking this and notifying them as far as I can tell.

Improve this answer
4
  • Thanks for the information. It was helpful.
    – Parth Thakkar
    Commented Nov 6, 2019 at 6:57
  • 2
    Therefore the class "validate-password" was removed from the password input field in some login.phtml files by this patch. If you have custom templates you can remove this class there to allow existing 6-character passwords again.
    – hellcode
    Commented Nov 6, 2019 at 11:04
  • @hellcode: it was only removed in the rwd theme, not in the base theme, so themes based on the base theme and not having customised the login template will still have trouble logging in unfortunately (this is based on v13 of the patch)
    – Pieter Hoste
    Commented Dec 30, 2019 at 15:05
  • Don't remove the entire "validate-password" class instead add one additional "min-pass-length-6". The validator.js will honour the number after "min-pass-length-". This is again introduced in this patch, but unfortunately not documented. And not used in rwd ...
    – Dimitar Ivanov
    Commented Feb 20, 2020 at 9:25
6

Don't have enough Rep to comment on xyphoids answer, so I'm putting this here.

Passwords with <7 characters still work and users are only locked out if you overrode the templates for persistent/checkout/login.phtml and persistent/customer/form/login.phtml. Since the patch adjusted these templates to no longer validate the password inputs.

If posting this as an answer is bad form i'll delete it.

Improve this answer
2

A > symbol is missing in 2 locations in

app/design/frontend/rwd/default/template/email/catalog/product/list.phtml

Patch File: PATCH_SUPEE-11219_EE_1.14.2.0_v4-2019-10-08-04-31-11.sh

This line:

+ <?php $_wishlistUrl = $this->helper('wishlist')-getAddUrlWithCustomParams($_product, array(), false); ?>

Should Be:

+ <?php $_wishlistUrl = $this->helper('wishlist')->getAddUrlWithCustomParams($_product, array(), false); ?>

on lines 109 and 194

Improve this answer
1
  • Thanks for the useful information.
    – Parth Thakkar
    Commented Nov 5, 2019 at 11:14
2

This patch feels like a joke, there are a bunch of fixes done in the rwd theme which aren't included in the base theme for some reason. I noticed this in version 13 (already!?) of the patch for Magento 1.9.1.0.

I'm noticing at least these ones:

  • catalog/product/list.phtml (some changes in base theme, but the ones for the add to cart button from the rwd theme are missing)
  • catalog/product/view/addto.phtml (no changes in base theme, only in rwd theme)
  • checkout/cart/crosssell.phtml (no changes in base theme, only in rwd theme)
  • persistent/checkout/onepage/login.phtml (no changes in base theme, only in rwd theme, this makes it impossible to login using a password with less then 7 characters)

There are probably a bunch more fixes missing in the base theme, but these were the ones which caught my eye.

I suppose we'll have to wait on version 14, which might contain fixes for these issues (or not ...)

Improve this answer
1
  • I've got confirmation from a Magento security manager today that the base theme files will get patched in the next security patch from April 2020.
    – Pieter Hoste
    Commented Feb 4, 2020 at 19:16
1

The wait is over. SUPEE-11219 for versions below 1.9.3 are finally available - https://magento.com/tech-resources/download.

Improve this answer
2
1

Magento ce-1.9.1.1

$ ./PATCH_SUPEE-11219_CE_1.9.1.0_v9-2019-11-01-09-20-21.sh 
Checking if patch can be applied/reverted successfully...
ERROR: Patch can't be applied/reverted successfully.

...
checking file app/code/core/Mage/Api/Model/Server/Adapter/Soap.php.orig
Reversed (or previously applied) patch detected!  Assume -R? [n] 
Apply anyway? [n] 
Skipping patch.
1 out of 1 hunk ignored
...

Solution:

Change copyright one year back.

in app/code/core/Mage/Api/Model/Server/Adapter/Soap.php.orig Line 23:

 * @copyright  Copyright (c) 2006-2015 X.commerce, Inc. (http://www.magento.com)

replace by

 * @copyright  Copyright (c) 2006-2014 X.commerce, Inc. (http://www.magento.com)
Improve this answer
0

List of files that are modified or created:

app/code/core/Mage/Admin/Model/User.php
app/code/core/Mage/Admin/etc/config.xml
app/code/core/Mage/Admin/sql/admin_setup/upgrade-1.6.1.2-1.6.1.3.php
app/code/core/Mage/Adminhtml/Block/Api/User/Edit/Tab/Main.php
app/code/core/Mage/Adminhtml/Block/Catalog/Product/Attribute/Set/Main.php
app/code/core/Mage/Adminhtml/Block/Customer/Edit/Renderer/Newpass.php
app/code/core/Mage/Adminhtml/Block/Customer/Edit/Tab/Account.php
app/code/core/Mage/Adminhtml/Block/Newsletter/Queue/Preview.php
app/code/core/Mage/Adminhtml/Block/Newsletter/Template/Edit.php
app/code/core/Mage/Adminhtml/Block/Newsletter/Template/Preview.php
app/code/core/Mage/Adminhtml/Block/Permissions/Tab/Useredit.php
app/code/core/Mage/Adminhtml/Block/Permissions/User/Edit/Tab/Main.php
app/code/core/Mage/Adminhtml/Block/Sales/Order/View.php
app/code/core/Mage/Adminhtml/Block/System/Account/Edit/Form.php
app/code/core/Mage/Adminhtml/Block/System/Email/Template/Edit.php
app/code/core/Mage/Adminhtml/Block/Widget/Grid.php
app/code/core/Mage/Adminhtml/Model/Config/Data.php
app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator.php
app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Locale.php
app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Passwordlength.php
app/code/core/Mage/Adminhtml/controllers/Api/UserController.php
app/code/core/Mage/Adminhtml/controllers/Catalog/CategoryController.php
app/code/core/Mage/Adminhtml/controllers/Catalog/Product/AttributeController.php
app/code/core/Mage/Adminhtml/controllers/CustomerController.php
app/code/core/Mage/Adminhtml/controllers/IndexController.php
app/code/core/Mage/Adminhtml/controllers/Newsletter/TemplateController.php
app/code/core/Mage/Adminhtml/controllers/Permissions/BlockController.php
app/code/core/Mage/Adminhtml/controllers/Sales/OrderController.php
app/code/core/Mage/Adminhtml/controllers/System/ConfigController.php
app/code/core/Mage/Adminhtml/controllers/System/Email/TemplateController.php
app/code/core/Mage/Adminhtml/controllers/Tax/RuleController.php
app/code/core/Mage/Api/Model/Server/Adapter/Soap.php.orig
app/code/core/Mage/Api/Model/User.php
app/code/core/Mage/Api/etc/config.xml
app/code/core/Mage/Api/sql/api_setup/mysql4-upgrade-1.6.0.1-1.6.0.2.php
app/code/core/Mage/Catalog/Block/Product/Abstract.php
app/code/core/Mage/Catalog/Block/Product/Compare/List.php
app/code/core/Mage/Catalog/Block/Product/Price.php
app/code/core/Mage/Catalog/Block/Product/View.php
app/code/core/Mage/Catalog/Helper/Product/Compare.php
app/code/core/Mage/Catalog/Model/Design.php
app/code/core/Mage/Catalog/etc/config.xml
app/code/core/Mage/Catalog/sql/catalog_setup/upgrade-1.6.0.0.19.1.5-1.6.0.0.19.1.6.php
app/code/core/Mage/Checkout/Block/Cart/Item/Renderer.php
app/code/core/Mage/Checkout/Helper/Cart.php
app/code/core/Mage/Checkout/Model/Session.php
app/code/core/Mage/Cms/Block/Widget/Block.php
app/code/core/Mage/Core/Block/Abstract.php
app/code/core/Mage/Core/Helper/Data.php
app/code/core/Mage/Core/Helper/String.php
app/code/core/Mage/Core/Model/App.php
app/code/core/Mage/Core/Model/Encryption.php
app/code/core/Mage/Core/Model/File/Uploader.php
app/code/core/Mage/Core/Model/Input/Filter/MaliciousCode.php
app/code/core/Mage/Core/Model/Layout/Validator.php
app/code/core/Mage/Core/Model/Resource/File/Storage/Database.php
app/code/core/Mage/Core/etc/config.xml
app/code/core/Mage/Core/etc/jstranslator.xml
app/code/core/Mage/Core/etc/system.xml
app/code/core/Mage/Core/sql/core_setup/upgrade-1.6.0.8-1.6.0.9.php
app/code/core/Mage/Core/sql/core_setup/upgrade-1.6.0.9-1.6.0.10.php
app/code/core/Mage/Customer/Block/Account/Changeforgotten.php
app/code/core/Mage/Customer/Block/Address/Renderer/Default.php
app/code/core/Mage/Customer/Block/Form/Register.php
app/code/core/Mage/Customer/Model/Customer.php
app/code/core/Mage/Customer/Model/Customer/Attribute/Backend/Password.php
app/code/core/Mage/Customer/controllers/AccountController.php
app/code/core/Mage/Customer/etc/config.xml
app/code/core/Mage/Customer/etc/system.xml
app/code/core/Mage/Dataflow/Model/Convert/Container/Abstract.php
app/code/core/Mage/Dataflow/Model/Convert/Parser/Csv.php
app/code/core/Mage/Dataflow/Model/Convert/Parser/Xml/Excel.php
app/code/core/Mage/Dataflow/Model/Profile.php
app/code/core/Mage/Eav/Model/Entity/Attribute/Backend/Abstract.php
app/code/core/Mage/ImportExport/Model/Import/Adapter/Abstract.php
app/code/core/Mage/ImportExport/Model/Import/Entity/Abstract.php
app/code/core/Mage/Install/Block/Admin.php
app/code/core/Mage/Install/etc/config.xml
app/code/core/Mage/Review/controllers/ProductController.php
app/code/core/Mage/Rss/etc/config.xml
app/code/core/Mage/Widget/controllers/Adminhtml/Widget/InstanceController.php
app/code/core/Mage/Wishlist/Block/Abstract.php
app/code/core/Mage/Wishlist/Block/Customer/Wishlist/Item/Column/Cart.php
app/code/core/Mage/Wishlist/Block/Item/Configure.php
app/code/core/Mage/Wishlist/Block/Share/Email/Items.php
app/code/core/Mage/Wishlist/Helper/Data.php
app/code/core/Mage/XmlConnect/Helper/Translate.php
app/design/adminhtml/default/default/template/resetforgottenpassword.phtml
app/design/frontend/base/default/template/bundle/catalog/product/view/option_tierprices.phtml
app/design/frontend/base/default/template/catalog/product/list.phtml
app/design/frontend/base/default/template/catalog/product/new.phtml
app/design/frontend/base/default/template/catalog/product/price_msrp.phtml
app/design/frontend/base/default/template/catalog/product/price_msrp_item.phtml
app/design/frontend/base/default/template/catalog/product/price_msrp_noform.phtml
app/design/frontend/base/default/template/catalog/product/view/tierprices.phtml
app/design/frontend/base/default/template/reports/home_product_compared.phtml
app/design/frontend/base/default/template/reports/home_product_viewed.phtml
app/design/frontend/base/default/template/wishlist/item/column/remove.phtml
app/design/frontend/base/default/template/wishlist/item/configure/addto.phtml
app/design/frontend/base/default/template/wishlist/render/item/price_msrp_item.phtml
app/design/frontend/rwd/default/template/catalog/product/compare/list.phtml
app/design/frontend/rwd/default/template/catalog/product/list.phtml
app/design/frontend/rwd/default/template/catalog/product/list/related.phtml
app/design/frontend/rwd/default/template/catalog/product/view.phtml
app/design/frontend/rwd/default/template/catalog/product/view/addto.phtml
app/design/frontend/rwd/default/template/catalog/product/view/sharing.phtml
app/design/frontend/rwd/default/template/catalog/product/widget/new/content/new_grid.phtml
app/design/frontend/rwd/default/template/checkout/cart/crosssell.phtml
app/design/frontend/rwd/default/template/checkout/cart/item/default.phtml
app/design/frontend/rwd/default/template/checkout/cart/shipping.phtml
app/design/frontend/rwd/default/template/checkout/cart/sidebar/default.phtml
app/design/frontend/rwd/default/template/checkout/onepage/review/info.phtml
app/design/frontend/rwd/default/template/customer/form/changepassword.phtml
app/design/frontend/rwd/default/template/customer/form/edit.phtml
app/design/frontend/rwd/default/template/customer/form/resetforgottenpassword.phtml
app/design/frontend/rwd/default/template/downloadable/checkout/cart/item/default.phtml
app/design/frontend/rwd/default/template/email/catalog/product/list.phtml
app/design/frontend/rwd/default/template/persistent/checkout/onepage/billing.phtml
app/design/frontend/rwd/default/template/persistent/checkout/onepage/login.phtml
app/design/frontend/rwd/default/template/persistent/customer/form/login.phtml
app/design/frontend/rwd/default/template/persistent/customer/form/register.phtml
app/design/frontend/rwd/default/template/reports/widget/compared/content/compared_grid.phtml
app/design/frontend/rwd/default/template/reports/widget/viewed/content/viewed_grid.phtml
app/design/frontend/rwd/default/template/wishlist/item/column/cart.phtml
app/design/frontend/rwd/default/template/wishlist/shared.phtml
app/design/frontend/rwd/default/template/wishlist/sidebar.phtml
app/design/install/default/default/template/install/create_admin.phtml
app/locale/en_US/Mage_Adminhtml.csv
app/locale/en_US/Mage_Api.csv
app/locale/en_US/Mage_Core.csv
app/locale/en_US/Mage_Customer.csv
app/locale/en_US/Mage_Dataflow.csv
app/locale/en_US/Mage_Eav.csv
app/locale/en_US/Mage_XmlConnect.csv
js/mage/adminhtml/variables.js
js/prototype/validation.js
js/tiny_mce/plugins/media/editor_plugin.js
js/tiny_mce/plugins/media/editor_plugin_src.js
js/varien/js.js
lib/Varien/Filter/FormElementName.php
skin/adminhtml/default/default/boxes.css

Some of the new files in the CE patch have the Enterprise Edition header and license, e.g. app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Passwordlength.php. Does this cause licensing issues?

Improve this answer
0

Couple issues that I have come across after applying the patch on various projects.

  • Minicart delete action not working. This is usually a result of custom theme not using form keys in the form submit. Make sure to update the relevant code
-       onclick="return confirm('__('Are you sure you...
+       onclick="if (confirm('jsQuoteEscape($this->__('Are you sure you would like to remove this item from the shopping cart?')) ?>')) {
+                   customFormSubmit('getDeleteUrlCustom(false) ?>','escapeHtml(json_encode(array('form_key' => $this->getFormKey()))) ?>', 'post') }"

  • Custom admin functionality may not work. For example, customer address render is filtered by regex in (app/code/core/Mage/Customer/Block/Address/Renderer/Default.php). Product attributes in wysiwyg editor will filter out some tags as well. Admin side should be checked more thoroughly than usual.

  • 3rd party modules that are depending on customer password length must be adjusted. For example, M2E module generates a random password when creating an order. It generates 6 characters but minimum has been increased to 7 now.

  • Since minimum password length has been increased make sure all custom forms are adjusted. I have seen cases where frontend validation was hardcoded to 6 characters. Usually not critical but this can cause confusion on client side.
Improve this answer
3
  • Minicart fix doesn't seem to be coded correctly. Minicart still broken.
    – gnicko
    Commented Dec 12, 2019 at 21:27
  • That was just a snippet to demonstrate where to find the responsible code and the idea on how to fix it. Exact code actually depends on the template used and any customization that might be added there.
    – mlagans
    Commented Dec 13, 2019 at 12:36
  • Yeah.... I was looking at it and seeing some stuff in there that didn't make much sense. My bad.
    – gnicko
    Commented Dec 13, 2019 at 15:31
0

I applied SUPEE-11219 v.13 (on EE v.1.14.2.1) and all the admin. passwords were invalidated. Also, we're noticing that the "forgot password" emails are no longer being received. It appears that they are not being sent.

I had applied the patch on two dev copies of the production site and everything seemed to work OK for a few weeks. Except the "remove items from the mini-cart" problem...which I fixed. Then I patched the production site and all three sites developed login problems the next day. (Which makes little to no sense to me) It acted as if, when someone logged in, the password was modified/updated in the database and the user was directed back to the login page where subsequent attempts resulted in an "account locked or not logging in correctly" error message.

I reversed the patch and reset passwords through the admin panel for each user, but it seems that the "forgot" emails are still not working/being received.

Has anyone else had this problem and fixed it?

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.