Magento 1.9.2.1 SUPEE-7405 admin not working

Question

I installed the new patch today - SUPEE-7405 via FTP from this site.

https://magentary.com/kb/install-supee-7405-without-ssh/

Now, it looks like my front end store is still working, however when I try to login into the /admin it takes me to the login/password page... once I login i get an error.

Invalid method Mage_Core_Model_Session::validateFormKey(Array
(
    [0] => y6h9TjgvchV8hCZT
)
)

Trace:
#0 /home/a0cegcom/public_html/app/code/core/Mage/Admin/Model/Observer.php(73): Varien_Object->__call('validateFormKey', Array)
#1 /home/a0cegcom/public_html/app/code/core/Mage/Admin/Model/Observer.php(73): Mage_Core_Model_Session->validateFormKey('y6h9TjgvchV8hCZ...')
#2 /home/a0cegcom/public_html/app/code/core/Mage/Core/Model/App.php(1357): Mage_Admin_Model_Observer->actionPreDispatchAdmin(Object(Varien_Event_Observer))
#3 /home/a0cegcom/public_html/app/code/core/Mage/Core/Model/App.php(1336): Mage_Core_Model_App->_callObserverMethod(Object(Mage_Admin_Model_Observer), 'actionPreDispat...', Object(Varien_Event_Observer))
#4 /home/a0cegcom/public_html/app/Mage.php(448): Mage_Core_Model_App->dispatchEvent('controller_acti...', Array)
#5 /home/a0cegcom/public_html/app/code/core/Mage/Core/Controller/Varien/Action.php(527): Mage::dispatchEvent('controller_acti...', Array)
#6 /home/a0cegcom/public_html/app/code/core/Mage/Adminhtml/Controller/Action.php(160): Mage_Core_Controller_Varien_Action->preDispatch()
#7 /home/a0cegcom/public_html/app/code/core/Mage/Core/Controller/Varien/Action.php(407): Mage_Adminhtml_Controller_Action->preDispatch()
#8 /home/a0cegcom/public_html/app/code/core/Mage/Core/Controller/Varien/Router/Standard.php(254): Mage_Core_Controller_Varien_Action->dispatch('index')
#9 /home/a0cegcom/public_html/app/code/core/Mage/Core/Controller/Varien/Front.php(172): Mage_Core_Controller_Varien_Router_Standard->match(Object(Mage_Core_Controller_Request_Http))
#10 /home/a0cegcom/public_html/app/code/core/Mage/Core/Model/App.php(365): Mage_Core_Controller_Varien_Front->dispatch()
#11 /home/a0cegcom/public_html/app/Mage.php(684): Mage_Core_Model_App->run(Array)
#12 /home/a0cegcom/public_html/index.php(88): Mage::run('', 'store')
#13 {main}

any ideas? I already cleared my var/cache and var/session with no luck

Answer 1

To me it looks like the patch was not installed properly.

The validateFormKey function is included in the patch.

• Open the app/code/core/Mage/Core/Model/Session.php file and double check if the validateFormKey function is here

• If the file is overridden in app/code/local/Mage/Core/Model/Session.php, you have to add the new methods validateFormKey and renewFormKey manually in the overridden file. Also change line 60 from:

  $this->setData('_form_key', Mage::helper('core')->getRandomString(16));
  

  to

  $this->renewFormKey();
  

• If it's here, it's definitely a caching/compilation problem. Flush your cache, as well as any other cache (Varnish / APC etc...)

• If you have compilation enable, please disable compilation then recompile.
• If the function is not here, that means the files have not been uploaded properly. Please note that when you extract the archive from Magentary, the files are extracted in a SUPEE-7405-1.9.2.1 folder, you must open this folder and extract the files from this folder to your Magento root, transfering the entire SUPEE-7405-1.9.2.1 folder will not apply the patch.

Answer 2

The Nexcess_Turpentine module overrides app/code/core/Mage/Core/Model/Session.php as app/code/local/Mage/Core/Model/Session.php. We just ran into this. This is very likely your issue. To appease this patch without spending excessive time on it, I think the most appropriate solution is to add the patch changes to the local override file. Turpentine overrides that file, I believe, because a rewrite did not work for the particular scenario they need to cover. I don't think this can be converted to a rewrite.

Here is the patch change that needs to be applied:

--- a/app/code/core/Mage/Core/Model/Session.php
+++ b/app/code/core/Mage/Core/Model/Session.php
@@ -36,7 +36,7 @@
  */
 class Mage_Core_Model_Session extends Mage_Core_Model_Session_Abstract
 {
-    public function __construct($data=array())
+    public function __construct($data = array())
     {
         $name = isset($data['name']) ? $data['name'] : null;
         $this->init('core', $name);
@@ -50,8 +50,27 @@ class Mage_Core_Model_Session extends Mage_Core_Model_Session_Abstract
     public function getFormKey()
     {
         if (!$this->getData('_form_key')) {
-            $this->setData('_form_key', Mage::helper('core')->getRandomString(16));
+            $this->renewFormKey();
         }
         return $this->getData('_form_key');
     }
+
+    /**
+     * Creates new Form key
+     */
+    public function renewFormKey()
+    {
+        $this->setData('_form_key', Mage::helper('core')->getRandomString(16));
+    }
+
+    /**
+     * Validates Form key
+     *
+     * @param string|null $formKey
+     * @return bool
+     */
+    public function validateFormKey($formKey)
+    {
+        return ($formKey === $this->getFormKey());
+    }
}

Answer 3

My sites had a varnish/turpentine modified version of the Session.php file in the app/code/local/Mage/Core/Model/ directory.

Make the appropriate functions within that file now look like the following and everything should work again.

public function getFormKey()
{
    if (Mage::registry('replace_form_key') &&
            !Mage::app()->getRequest()->getParam('form_key', false)) {
        // flag request for ESI processing
        Mage::register('turpentine_esi_flag', true, true);
        return '{{form_key_esi_placeholder}}';
    } else {
        return $this->real_getFormKey();
    }
}

public function real_getFormKey()
{
    if (!$this->getData('_form_key')) {
        //$this->setData('_form_key', Mage::helper('core')->getRandomString(16));
        $this->renewFormKey();
    }
    return $this->getData('_form_key');
}

public function renewFormKey()
{
    $this->setData('_form_key', Mage::helper('core')->getRandomString(16));
}

public function validateFormKey($formKey)
{
    return ($formKey === $this->getFormKey());
}

Answer 4

Also make sure you do not modify app/code/core/Mage/Core/Model/Session.php directly, but copy the file to app/code/local/Mage/Core/Model/Session.php and make the appropriate modification.

(Magento will check the local directory path before using the core path.

Answer 5

Add the below functions to 3rd Party/Custom Module . If not implement/extend the functions properly .

/**
* Creates new Form key
*/
public function renewFormKey()
{
$this->setData('_form_key', Mage::helper('core')->getRandomString(16));
}

/**
* Validates Form key
*
* @param string|null $formKey
* @return bool
*/
public function validateFormKey($formKey)
{
return ($formKey === $this->getFormKey());
}
}

Thanks!

Answer 6

I had the same error, for me I had to roll back the patch (using the -R after the .sh file, but don't know how you'd do via PHP)

Then in Magento goto system -> general -> web -> session validation settings

I changed 'Validate HTTP_X_FORWARDED_FOR' to 'no' and 'Validate HTTP_USER_AGENT' to 'yes. Make sure your cookie domain is correctly set also like 'yourdomain.com'

Once I did this, re-applied the patch and can log in. Hope this helps you resolve it - it seems any incorrect session params will cause the form key issue.

Make sure you clear your browser cookies also before testing