how to remove security patches from magento site

Question

we installed magento security patches before one month

after that we did lot of chnages to our site.

now some features are not working that was working before one month.

we are not sure whether security patches is the reason or not.

is there any way to remove the security patches .

Answer 1

Open a patch file in a text editor and you'll find it's nothing more than

• Which file
• What to add on which line (indicated by + symbols)
• What to remove on which line (indicated by - symbols)

So you could do it manually. But the kind folks of Magento also included a Revert option in the patch files. If you check the usage menu you'll find it.

Usage: sh $BASE_NAME [--help] [-R|--revert] [--list]
Apply embedded patch.

-R, --revert    Revert previously applied embedded patch
--list          Show list of applied patches
--help          Show this help message

Now before you start reverting that stuff

Don't.

The patches are there for a reason, generally a security issue. So instead of removing them fix whatever is not working to work together WITH the security patch.

And honestly. If a security patch broke a functionality it's probably because the functionality is doing things it shouldn't be doing that way in the first place

Answer 2

If you applied the patch via shellscript (.sh) file via SSH, you can revert the patch (as Sander already explained in his answer here). If you applied it manually/via FTP, you have to go through the list of files mentioned in the patch and go through the files manually.

Please keep in mind: No feature can be as important to remove any security patches from your shop.

You should only disable/rollback the changes for testing/debugging purposes, fix it, apply the patch and update your feature changes. I hope you have a development system set up somewhere where you can test those changes and don't work on the live system.

Answer 3

Best practice: Just revert the commit of the security update in your version control (e.g. git). If you say "we don't use version control" you should should fix that issue first :)

I would prefer to keep the security patch in your system and you should try to determine why your extensions aren't working anymore. In the most cases you have missed some important things which haven't been that important before the update.

Summary:

• Use version control
• Apply all patches to your installation
• No need to remove a security patch (since there is no reason)
• Don't be lazy and fix your extensions to work with the current (and most secure) environment
• Never change the core...