5

Magento released SUPEE 8167, IPN patch, basically after JUNE 30, 2017, PayPal will start using HTTPS URL (secured) for IPN communication. Currently they are accepting HTTP requests.

Is it safe to install the patch RIGHT NOW, or it better to wait closer to Deadline ?

2
  • 1
    Ensure that the store has a valid ssl certificate setup and is working properly then install the patch. No reason to wait.
    – Eirik
    May 19 '17 at 4:05
  • Great, light patch, easy install.
    – Icon
    May 19 '17 at 16:46
5

It seems safe to update already as the change mentioned on the PayPal page mentions to accept HTTPS only after this date. Currently they are accepting HTTP and HTTPS requests. Thus you can already send your requests via HTTPS already.

See also: https://www.paypal-knowledge.com/infocenter/index?page=content&id=FAQ1916

6
  • Great, I've updated, everything works fine. At least I haven't found issues :)
    – Icon
    May 19 '17 at 17:09
  • Good to hear :) May 19 '17 at 17:11
  • 1
    @AnnaVölkl I wanted to check this patch to make sure the code affected wasn't extended anywhere in my shops, strange thing is the patch is has an EE prefix and I cannot find the changes it makes in the latest 1.9.3.3 code at app/code/core/Mage/Paypal/Model/Ipn.php at all, am I missing something here?
    – paj
    Jun 14 '17 at 7:26
  • @paj look closely the changes should be made in 19.3.3. They mentioned it in the release notes. devdocs.magento.com/guides/m1x/ce19-ee114/…
    – Icon
    Jun 15 '17 at 15:22
  • do you guys knows what happened to this patch, it is not available anymore ...
    – Fra
    Jun 19 '17 at 15:27
2

See here to clear up confusion of this patch's differences to magento 1.9.3.3: https://community.magento.com/t5/Security-Patches/SUPEE-8167-not-included-in-1-9-3-3/m-p/68857

1

I run the patch as a php script because I have no ssh-access:

<?php
 print("<PRE>");
 passthru("/bin/bash PATCH_SUPEE-8167_EE_1.14.0.0_1.14.0.1_v1-2017-05-08-02-41-29.sh");
 print("</PRE>");
 echo "Done";
?>

and it said "Done" (nothing else, maybe it was too fast). How can I check if everything worked? If I check the last edited time stamp on the ftp server in /htdocs/app/code/core/Mage/Paypal/Model/Ipn.php it still gives me a old date (january 2017)

3
  • The only way you can check is by going to app/etc/applied.patches and view the list. See if SUPEE-8167 in installed.
    – Icon
    Jun 16 '17 at 2:48
  • However, if you see ipn.php dated as of Jan 2017. most likely it didn't install
    – Icon
    Jun 16 '17 at 2:48
  • 1
    You can also look at file app/code/core/Mage/Paypal/Model/Ipn.php. If DEFAULT_POSTBACK_URL and SANDBOX_POSTBACK_URL are declared and using https urls, the patch was applied.
    – Ryre
    Jun 20 '17 at 4:54
1

You can install it now, Because all higher version of magento [ Magento 1.9.3.3 >] already have the patch installed so its good to install it before the deadline. You can find more instruction of instillation here. http://www.tricoreitsolutions.com/how-to-install-supee-8167

You can find commands for installation through SSH.

1
  • Note : Here you need to set POST back URL of PayPal to https:// instead of http://. It does not mean that you need to install SSL on your store for your IPN to run on. Jun 19 '17 at 8:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.