1

I have a magento 1.9.2 installed for the past two years and never applied SUPEE security patches. I looked up so many articles online on how to apply these patches but there are some doubts I need to be explained from your experience.

  • How do I know what patches that are not installed?
  • Once I install them, how do I know they are actually installed?
  • Is there a possibility patching can cause issues with the installation (theme & extension) or it is unrelated?
  • Sever environment I have is shared, and all articles mention SSH commands to install the patches. Is there another way around without SSH to install SUPEEs.
  • If I am missing several patches, do they need to be installed in a sequence. Older one first, etc.
2
  • How do I know what patches that are not installed?
  • Once I install them, how do I know they are actually installed?

For this you can use https://github.com/philwinkle/Philwinkle_AppliedPatches that will show all applied patches in footer.

  • Is there a possibility patching can cause issues with the installation (theme & extension) or it is unrelated?

Yes! Nearly all bigger patches cause issues with themes and extensions - BUT (special thanks to Raphael at Digital Pianism) you'll find all issues, recommandations here on SE.

  • Sever environment I have is shared, and all articles mention SSH commands to install the patches. Is there another way around without SSH to install SUPEEs.

Even on shared hosting SSH is possible - just ask your hoster. If not - at least for the last time "Magento" has released a new version including latest patches. So, just update to latest version.

  • If I am missing several patches, do they need to be installed in a sequence. Older one first, etc.

According to Annas comment all patches need to be installed in the order of release, but normaly its written in patch notes at https://magento.com/tech-resources/download like ...

  • Revert SUPEE-8788 v1/
  • Revert SUPEE-1533 (if installed)
  • Install SUPEE-3941 (if not installed yet)
  • Install SUPEE-8788 v2
  • 1
    Yes, all patches need to be installed in the order of release. – Anna Völkl Jul 19 '17 at 12:38
0

https://www.magereport.com/ can scan your website and has a clear list of which patches it can detect, how to apply them, and what they're used for.


In addition, security is always key. Here's the code for a RewriteCond based IP Whitelist that I use to allow only approved IPs into the Admin, Downloader, and Magmi. Copy this code into your .htaccess file.

RewriteCond %{REQUEST_URI} ^/(index.php/)?admin/ [NC]
RewriteCond %{REQUEST_URI} ^/(index.php/)?downloader/ [NC]
RewriteCond %{REQUEST_URI} ^/(index.php/)?magmi/ [NC]

## THIS IS MY HOME/OFFICE IP - Added July 18, 2017 ##
RewriteCond %{REMOTE_ADDR} !^YOUR.IP.ADDRESS.HERE

RewriteRule ^(.*)$ https://%{HTTP_HOST}/ [R=301,L]

Any IPs not on that list will be redirected to the base URL of your site. I recommend commenting out notes for each IP you add to know when and why you added them, and regularly going through to remove any that do not need access anymore. You may need to update the last line to "http" if you do not have an SSL installed on your server.

  • Thanks Steven. Great. Where do I find all patches for my version? I am assuming announced patches have descriptions for which versions they should be applied. Correct? – Super Man Jul 18 '17 at 16:56
  • 1
    Did you perform a scan on your site? If you've never applied patches manually, you would only have the patches that were included up to the version you were using. New versions of CE are released when a patch comes out, so you can start from scratch with all applied, or use their shell commands to update just the individual files affected by the patch. Magento's website has a good list of patches released and what they do/how they are helpful. – Steven J Jul 18 '17 at 17:03
  • 2
    Nice of you being patient with me Steve. Thanks alot. From my understanding, I can go with magento.com/tech-resources/download and walk thru all patches starting from the 1.9.2.3 up to 1.9.3.4 if my current version is 1.9.2.2. I did not run the report yet as I am working with hosting provider to bring server up as I was a victim of brute force attack. So I am using this time to learn this part without magereport.com. Thanks again – Super Man Jul 18 '17 at 17:07
  • Yes, that sounds like a good plan. I'll edit my answer to add an IP Whitelist RewriteCond that sits in the .htaccess and has greatly helped with any unwanted/unapproved admin access – Steven J Jul 18 '17 at 17:22
  • Answer has been updated. If you feel this answers your question, please mark it as so. – Steven J Jul 18 '17 at 17:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.