I recently went with all the workarounds that Magento supplied after the v1 of the patch had some issues, and now have finally successfully installed v2 of SUPEE-8788.

sh PATCH_SUPEE-8788_CE_1.9.0.1_v2-2016-10-14-09-37-14.sh
Checking if patch can be applied/reverted successfully...
Patch was applied/reverted successfully.

As well as being listed in the applied.patches.list.

However when scanning through magereport.com to assure everything is working correctly, it still alerts me stating that I am unpatched for 8788. Should I just bypass this as a possible error on their side or could there still be something more I need to do?

  • 2
    Hi! Please see possible causes (Cloudflare or other caches) at support.hypernode.com/knowledgebase/… If you still feel the report is wrong, could you please submit your URL to [email protected] ? Thanks a lot for improving Magereport!
    – Willem
    Commented Oct 18, 2016 at 14:17
  • @willem I have checked and confirmed all the listed ways it checks, so I will send in the URL. Appreciate the help, love MageReport, thats why I need to see that green! :)
    – ne0nlight
    Commented Oct 18, 2016 at 14:23

4 Answers 4


How Magereport detects the patch

Magereport checks for the following static assets that should have been removed:


It also checks for the following files that have been modified:

/js/mage/adminhtml/uploader/instance.js should contain "fustyFlowFactory"
/skin/adminhtml/default/default/boxes.css should contain "background:url(images/blank.gif) repeat;"

If you get an unexpected result

Are you running multiple Magento installations on the same domain? Due to the way Magento routing works, MageReport cannot distinguish between multiple installations on the same domain. So if you want to test an upgrade, you could put it on its own domain (eg. test.yourdomain.com).

Log on to SSH (shell)

Every check that’s been installed can easily be found in the content of your shop. More specifically it’s logged in app/etc/applied.patches.list.

So you run this command 'grep' via SSH to access the list of applied security patches:

grep '|' app/etc/applied.patches.list

Hope It's helpful for any one.


This seems to be happening very often so here's the definite answer.

For the SUPEE-8788 patch, MageReport test works like this:

It checks for the following static assets that should have been removed:


It also checks for the following files that have been modified:

  • /js/mage/adminhtml/uploader/instance.js should contain "fustyFlowFactory"
  • /skin/adminhtml/default/default/boxes.css should contain "background:url(images/blank.gif) repeat;"

So here are the possibilites in your case:

  • One of the .swf file has not been deleted when you ran the patch
  • The patch did not apply properly on the /js/mage/adminhtml/uploader/instance.js or the /skin/adminhtml/default/default/boxes.css
  • so is the answer here to delete the files in /skin/adminhtml/default/default/media/ manually? I did that to test and I passed in magereport. When I put files back on there, it failed.
    – frshjb373
    Commented Jul 14, 2017 at 16:26
  • @frshjb373 yes that's what the patch is supposed to do Commented Jul 16, 2017 at 17:56

I too had something similar to this happened to me, this is what I ended up doing:

  1. If you have the compiler enabled, recompile. The old code will be trapped in the include system until this is done.
  2. Completely flush the cache so it reloads the refreshed code.

I was running on an Enterprise edition, not sure what you're on but I hope this helps!


You need to remove all files listed in files-to-delete.txt comes with 8788 Patch., otherwise magereport will not detect this patch



Note : Do not rename files , delete it

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.