6

I've applied patch 9767 but for some reason, MageReport is saying it is not installed. Does anyone know the specifics of how MageReport determines if this patch is installed?

In my access logs, I can see an about 30 URLs are requested when MageReport runs the test.

  • Which of those URL are used to determine if the patch 9767 is installed?
  • What is the precise response they are looking to determine if the patch 9767 is installed? I have a hunch they are posting data and seeing if the form_key is required...
  • Are they parsing the responses and looking for specific strings? If so, what are they looking for?
Improve this question

4 Answers 4

Reset to default
6

Magereport use behavior-based identification patterns. This is possible because each Magento patch introduces subtle changes in behavior. Apart from that, it is possible to request a few static files and derive the Magento version from that. Our work is shared on Github.

You are missed any file like

app/etc/applied.patches.list

Source : Magereport.

Improve this answer
3
  • Thanks Rama. I saw the same verbiage on their website. I am looking for more specific information than that. I wish they shared the whole project on github :) I updated the question to reflect the specifics I am looking for.
    – Chuck D
    Commented Jun 9, 2017 at 22:29
  • 2
    Also, MageReport does not rely on app/etc/applied.patches.list as anything in app/etc should not be accessible to the public.
    – Chuck D
    Commented Jun 9, 2017 at 22:31
  • Sure i will look more and give soluction
    – Rama Chandran M
    Commented Jun 10, 2017 at 4:40
2

MageReport is doing static code analyses for verifying the installation of patch SUPEE 9767. This is done by requesting the static files that have been modified by applying the patch. It's very likely one of the caches enabled on the shop is still holding the older versions of these files.

MageReport returns "installed" or "not installed" based whether it can detect specific behavior before or after the patch is applied, otherwise it will return "unknown". When these static files are still cached, the old behavior is detected, which will result in "not installed".

Hopefully this will help you to get the patch 9767 'installed'-status in MageReport.

Improve this answer
4
  • Thanks Tim. Can you please be more specific on the analysis? Which static files are part of their analysis of patch 9767?
    – Chuck D
    Commented Jun 12, 2017 at 13:18
  • The question is quiet old but I was wondering how they checking if the code was patched or not. So I manually patched one of my files (SUPEE-9652_v2) and after that it still says uninstalled.
    – Rob D. A.
    Commented Sep 21, 2018 at 14:15
  • so I have a doubts if this scanner is doing all those checks and we can really believe the results.
    – Rob D. A.
    Commented Sep 21, 2018 at 14:51
  • Also, I found that one patch is changing a sequence of code (in patch 9652) then changing it back (in patch 10570) which is in my opinion "st....range" especially that the change is kinda .... cosmetic?! Before there was additional variable then variable was removed then again this variable is restored but it does not change functionality at all. What's the point?!?!? For me it looks like they doing it just to make you thinking "wow there is still a lot to fix" :P:P:P while there is much less than in fact is.
    – Rob D. A.
    Commented Sep 21, 2018 at 15:06
2

If it helps, here are the requests made by Magereport.com with the check I did today:

188.166.64.179 - - [21/Aug/2017:14:39:43 +1000] "GET / HTTP/1.1 "200 14922 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:45 +1000] "GET /js/webforms/upload/index.php HTTP/1.1 "404 11609 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:45 +1000] "GET /get.php/media/css HTTP/1.1 "404 31 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:45 +1000] "GET /.hg/requires HTTP/1.1 "403 134 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:45 +1000] "GET /dev/tests/functional/etc/config.xml HTTP/1.1 "404 134 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:45 +1000] "GET /index.php/rss/order/NEW/new HTTP/1.1 "401 36 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:45 +1000] "GET /robots.txt HTTP/1.1 "200 596 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:45 +1000] "GET /js/mage/adminhtml/sales.js HTTP/1.1 "200 9488 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:45 +1000] "GET /js/webforms/uploaderbro/index.php HTTP/1.1 "404 11614 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:45 +1000] "GET /var/resource_config.json HTTP/1.1 "404 134 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:45 +1000] "GET /.git/config HTTP/1.1 "403 134 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:45 +1000] "GET /dev/tests/functional/composer.json HTTP/1.1 "404 134 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:46 +1000] "GET /skin/adminhtml/default/default/boxes.css HTTP/1.1 "200 18962 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - localhost/ [21/Aug/2017:14:39:46 +1000] "POST /index.php/api/soap/ HTTP/1.1 "500 287 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:46 +1000] "GET /magmi/web/magmi.php HTTP/1.1 "404 11595 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:46 +1000] "GET /skin/error.php HTTP/1.1 "404 11586 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:46 +1000] "GET /js/mage/adminhtml/tools.js HTTP/1.1 "200 6369 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:46 +1000] "GET /checkout/cart/ HTTP/1.1 "200 11347 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:46 +1000] "GET /amfeed/main/download/?file=../../../app/Mage.php HTTP/1.1 "404 11634 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:46 +1000] "GET /index.php/xmlconnect/adminhtml_mobile/ HTTP/1.1 "404 11623 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:46 +1000] "GET / HTTP/1.1 "200 14922 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:46 +1000] "POST /index.php/qquoteadv/download/downloadCustomOption/ HTTP/1.1 "404 11633 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:46 +1000] "POST /index.php/ajaxproducts/index/index/ HTTP/1.1 "404 11614 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:46 +1000] "GET /js/varien/payment.js HTTP/1.1 "200 950 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:47 +1000] "GET /checkout/cart/delete HTTP/1.1 "302 5 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:47 +1000] "GET /skin/adminhtml/default/default/media/uploader.swf HTTP/1.1 "200 180912 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:47 +1000] "GET /customer/account/login/ HTTP/1.1 "200 9902 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:47 +1000] "GET /magmi/conf/magmi.ini HTTP/1.1 "404 11597 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:47 +1000] "GET /xmlconnect/adminhtml_mobile/ HTTP/1.1 "404 11609 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:47 +1000] "GET /amfeed/app/Mage.php HTTP/1.1 "404 11598 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:47 +1000] "GET /includes/magmi/web/magmi.php HTTP/1.1 "404 134 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - Magereport [21/Aug/2017:14:39:48 +1000] "GET /index.phprss/catalog/notifystock/ HTTP/1.1 "401 36 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:48 +1000] "GET /checkout/cart/ HTTP/1.1 "200 11419 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:48 +1000] "GET /customer/account/changeforgotten/ HTTP/1.1 "302 5 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:48 +1000] "GET /index.php/oauth/adminhtml_oauth_consumer/ HTTP/1.1 "404 11648 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:48 +1000] "GET /media/js/e15ccbca311cc4207de108596bd8ddd0.js HTTP/1.1 "200 152407 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:49 +1000] "GET /customer/account/forgotpassword/ HTTP/1.1 "200 9808 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:49 +1000] "GET /admin HTTP/1.1 "404 11574 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:49 +1000] "GET /media/js/d5ff4282ca7d27d2124a715cd43f0742.js HTTP/1.1 "200 2629 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
188.166.64.179 - - [21/Aug/2017:14:39:50 +1000] "GET /media/js/352b66d016329509b6a30eb6016fec14.js HTTP/1.1 "200 1580 "-" "Mozilla/5.0 (www.magereport.com/page/about)" "-"
Improve this answer
2
  • Thanks Ricardo. I saw the same requests in my access logs too. Do you know which of those requests are used to detect if patch 9767 is installed?
    – Chuck D
    Commented Aug 22, 2017 at 14:27
  • Sorry, no idea. :(
    – Ricardo Martins
    Commented Aug 24, 2017 at 1:53
1

Not sure how magereport is checking for it but a redirect on '/index.phpcheckout' (no slash before checkout) is an indicator the store has not been patched. Every unpatched store I've encountered 302 redirects, where the patched ones 404.

$ curl --head https://unpatched.example.com/index.phpcheckout
HTTP/1.1 302 Found

$ curl --head https://patched.example.com/index.phpcheckout
HTTP/1.1 404 Not Found

Looks like Magento's scanner also looks for an upgraded jQuery included in the patch.

-                <action method="addJs"><script>lib/jquery/jquery-1.10.2.min.js</script></action>
+                <action method="addJs"><script>lib/jquery/jquery-1.12.0.min.js</script></action>
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.