A new security patch is out for Magento 1, addressing 13 APPSEC issues


What common issues do you have to watch out for when applying this patch?

SUPEE-10266, Magento Commerce and Open Source contain multiple security enhancements that help close cross-site request forgery (CSRF), unauthorized data leak, and authenticated Admin user remote code execution vulnerabilities. These releases also include fixes for issues with image reloading and payments using one-step checkout.

11 Answers 11


Some of the important information share with here.Most of the files from Magento backend. The file lists:


The important thing need to check this three files.


app/code/core/Mage/Checkout/controllers/CartController.php additional condition check customer id:

diff --git app/code/core/Mage/Checkout/controllers/CartController.php app/code/core/Mage/Checkout/controllers/CartController.php
index 7c9f28f..bee6034 100644
--- app/code/core/Mage/Checkout/controllers/CartController.php
+++ app/code/core/Mage/Checkout/controllers/CartController.php
@@ -284,14 +284,16 @@ class Mage_Checkout_CartController extends Mage_Core_Controller_Front_Action
     public function addgroupAction()
         $orderItemIds = $this->getRequest()->getParam('order_items', array());
+        $customerId   = $this->_getCustomerSession()->getCustomerId();

-        if (!is_array($orderItemIds) || !$this->_validateFormKey()) {
+        if (!is_array($orderItemIds) || !$this->_validateFormKey() || !$customerId) {

         $itemsCollection = Mage::getModel('sales/order_item')
+            ->addFilterByCustomerId($customerId)
         /* @var $itemsCollection Mage_Sales_Model_Mysql4_Order_Item_Collection */
@@ -709,4 +711,14 @@ class Mage_Checkout_CartController extends Mage_Core_Controller_Front_Action
         $this->getResponse()->setHeader('Content-type', 'application/json');
+    /**
+     * Get customer session model
+     *
+     * @return Mage_Customer_Model_Session
+     */
+    protected function _getCustomerSession()
+    {
+        return Mage::getSingleton('customer/session');
+    }

app/code/core/Mage/Sales/Model/Resource/Order/Item/Collection.php added Additional method addFilterByCustomerId in collection.

diff --git app/code/core/Mage/Sales/Model/Resource/Order/Item/Collection.php app/code/core/Mage/Sales/Model/Resource/Order/Item/Collection.php
index ee83ad48..c02afdf 100644
--- app/code/core/Mage/Sales/Model/Resource/Order/Item/Collection.php
+++ app/code/core/Mage/Sales/Model/Resource/Order/Item/Collection.php
@@ -152,4 +152,20 @@ class Mage_Sales_Model_Resource_Order_Item_Collection extends Mage_Sales_Model_R
         return $this;
+    /**
+     * Filter by customerId
+     *
+     * @param int|array $customerId
+     * @return Mage_Sales_Model_Resource_Order_Item_Collection
+     */
+    public function addFilterByCustomerId($customerId)
+    {
+        $this->getSelect()->joinInner(
+            array('order' => $this->getTable('sales/order')),
+            'main_table.order_id = order.entity_id', array())
+            ->where('order.customer_id IN(?)', $customerId);
+        return $this;
+    }


if 'general/reprocess_images/active' false then skip image reprocessing. NOTE: If you turn off images reprocessing, then your upload images process may cause security risks

diff --git app/code/core/Mage/Core/Model/File/Validator/Image.php app/code/core/Mage/Core/Model/File/Validator/Image.php
index 9d57202..6a939c3 100644
--- app/code/core/Mage/Core/Model/File/Validator/Image.php
+++ app/code/core/Mage/Core/Model/File/Validator/Image.php
@@ -91,6 +91,13 @@ class Mage_Core_Model_File_Validator_Image
         list($imageWidth, $imageHeight, $fileType) = getimagesize($filePath);
         if ($fileType) {
             if ($this->isImageType($fileType)) {
+                /**
+                 * if 'general/reprocess_images/active' false then skip image reprocessing.
+                 * NOTE: If you turn off images reprocessing, then your upload images process may cause security risks.
+                 */
+                if (!Mage::getStoreConfigFlag('general/reprocess_images/active')) {
+                    return null;
+                }
                 //replace tmp image with re-sampled copy to exclude images with malicious data
                 $image = imagecreatefromstring(file_get_contents($filePath));
                 if ($image !== false) {

Hope it will helpful. I think

  • Could you please specify how exacly should we check for CartController.php and Collection.php possible issues. Where exactly to look for possible glitches on the website? – Icon Sep 15 '17 at 14:27
  • I have update the security patch 3 sites, all the three sites are override this two files. Carefully check and update this two files. There is no Gitches happen in all 3 sites – Rama Chandran M Sep 16 '17 at 6:16


Typo on line 726 of the patch: autocomplete="new-pawwsord" (app/design/adminhtml/default/default/template/backup/dialogs.phtml)

The patch appears to miss 2 frontend files:



Not patched:

app\design\frontend\base\default\template\oauth\authorize\form\login-simple.phtml app\design\frontend\rwd\default\template\oauth\authorize\form\login-simple.phtml

Also don't forget to check for local overrides...I had to manually patch a local codepool override of app\design\adminhtml\default\default\template\sales\order\view\info.phtml

See quasiobject's answer for a onepage checkout issue. Enterprise support ticket created, awaiting response from Magento. If you don't want to wait for an updated patch, a potential fix is to modify the "else" statment in app\design\frontend\enterprise\default\template\giftcardaccount\onepage\payment\scripts.phtml to include the form_key element like so:
if (($('p_method_' + methodName) && $('p_method_' + methodName).checked) || elements[i].name == 'form_key') { ...


Typo on line 694 of the patch: autocomplete="new-pawwsord" (app/design/adminhtml/default/default/template/backup/dialogs.phtml)

The TrueOrderEdit extension needs to be patched...change echo $_groupName to echo $this->escapeHtml($_groupName) in the following files:

app\design\adminhtml\default\default\template\orderedit\sales\order\view\edit.phtml app\design\adminhtml\default\default\template\orderedit\sales\order\view\history.phtml app\design\adminhtml\default\default\template\orderedit\sales\order\view\info.phtml

Finally, this core template file should probably also be patched with the same $_groupName update:


All 1.X Versions

If you've deleted the /downloader folder (or /downloader/template) from your codebase, then you may have to manually edit the .sh patch file and remove the last section, starting with diff --git downloader/template/login.phtml downloader/template/login.phtml

Regarding the Invalid Secret Key error, please see my answer here: Magento 1.9 Invalid Secret Key. Please refresh the page

  • I also found the typo for patch. autocomplete="new-pawwsord". Does it in any case affect the code operation? If so, maybe version2 of patch on the way? – Icon Sep 15 '17 at 19:41
  • Essentiall the typo is in the code responsible for FireFox trick. "This is a dummy hidden field to trick firefox from auto filling the password"... looks like nothing major at all. – Icon Sep 15 '17 at 19:43
  • @kmdsax I got a patch from support to fix the issue. Updated my answer with the details. – quasiobject Sep 20 '17 at 18:21
  • could you pls help me to solve my error magento.stackexchange.com/q/204446/57334 – zus Dec 6 '17 at 12:39

We at MageHost.pro found a problem in the patch for Magento, patch file PATCH_SUPEE-10266_CE_1.9.1.1_v1-2017-09-15-04-59-56.sh


checking file app/code/core/Mage/Core/Model/File/Validator/Image.php
Hunk #1 FAILED at 90.
1 out of 1 hunk FAILED

I fixed it by replacing lines 454-472 by 454-471 from PATCH_SUPEE-10266_CE_1.9.1.0_v1-2017-09-13-06-34-33.sh

Old code, line 454-472:

diff --git app/code/core/Mage/Core/Model/File/Validator/Image.php app/code/core/Mage/Core/Model/File/Validator/Image.php
index 7f7b9d0..8a28da2 100644
--- app/code/core/Mage/Core/Model/File/Validator/Image.php
+++ app/code/core/Mage/Core/Model/File/Validator/Image.php
@@ -90,7 +90,13 @@ class Mage_Core_Model_File_Validator_Image
         $fileInfo = getimagesize($filePath);
         if (is_array($fileInfo) and isset($fileInfo[2])) {
             if ($this->isImageType($fileInfo[2])) {
-                return null;
+                /**
+                 * if 'general/reprocess_images/active' false then skip image reprocessing.
+                 * NOTE: If you turn off images reprocessing, then your upload images process may cause security risks.
+                 */
+                if (!Mage::getStoreConfigFlag('general/reprocess_images/active')) {
+                    return null;
+                }
         throw Mage::exception('Mage_Core', Mage::helper('core')->__('Invalid MIME type.'));

New code, lines 454-471:

diff --git app/code/core/Mage/Core/Model/File/Validator/Image.php app/code/core/Mage/Core/Model/File/Validator/Image.php
index 8618bca..d3aba19 100644
--- app/code/core/Mage/Core/Model/File/Validator/Image.php
+++ app/code/core/Mage/Core/Model/File/Validator/Image.php
@@ -90,6 +90,13 @@ class Mage_Core_Model_File_Validator_Image
         list($imageWidth, $imageHeight, $fileType) = getimagesize($filePath);
         if ($fileType) {
             if ($this->isImageType($fileType)) {
+                /**
+                 * if 'general/reprocess_images/active' false then skip image reprocessing.
+                 * NOTE: If you turn off images reprocessing, then your upload images process may cause security risks.
+                 */
+                if (!Mage::getStoreConfigFlag('general/reprocess_images/active')) {
+                    return null;
+                }
                 //replace tmp image with re-sampled copy to exclude images with malicious data
                 $image = imagecreatefromstring(file_get_contents($filePath));
                 if ($image !== false) {
  • Have you looked into other versions ? If yes, is the same problem present? – Icon Sep 17 '17 at 4:50
  • 1
    @Icon We tested ce- ce- ce- ce- ce- ce- ce- ce- ce- ce- ce- ce- ce- ce- ce- ce- ce- ce- ce- ce- ce- ce- All versions had all previous patches installed. The only one with a patch error was ce- – Jeroen Vermeulen - MageHost Sep 17 '17 at 12:34

Only 1 form key appears to have been added in this patch.

diff --git app/code/core/Mage/Adminhtml/Block/Widget/Form/Container.php app/code/core/Mage/Adminhtml/Block/Widget/Form/Container.php
index 8756f3f..1c5cf37 100644
--- app/code/core/Mage/Adminhtml/Block/Widget/Form/Container.php
+++ app/code/core/Mage/Adminhtml/Block/Widget/Form/Container.php
@@ -96,7 +96,10 @@ class Mage_Adminhtml_Block_Widget_Form_Container extends Mage_Adminhtml_Block_Wi

     public function getDeleteUrl()
-        return $this->getUrl('*/*/delete', array($this->_objectId => $this->getRequest()->getParam($this->_objectId)));
+        return $this->getUrl('*/*/delete', array(
+            $this->_objectId => $this->getRequest()->getParam($this->_objectId),
+            Mage_Core_Model_Url::FORM_KEY => $this->getFormKey()
+        ));

So if you have any difficulty deleting a widget from the admin panel ensure your delete url is being generated by the block, and that you have no overrides of this block.


Impossible to checkout on EE 1.11+

In app/design/frontend/enterprise/default/template/giftcardaccount/onepage/payment/scripts.phtml the form key validation code has been removed and it breaks the entire checkout, more info here: https://magento.stackexchange.com/a/193442/2380

Workaround for now (as a V2 for EE 1.11+ will be released to address that issue): rollback the template file for both enterprise/default and rwd/entreprise themes.

Differences between patch and version

EDIT: was released thus this info is not longer relevant

One of the main issue that has been raised for now is that is missing 3 security patches from the patch. Thus I strongly recommend only patching and not updating to yet

  • Do you have any more information on this, such as an example of an unpatched file in – Luke Rodgers Sep 15 '17 at 10:55
  • Is this still ongoing for CE/Open Source? For EE/Commerce there is no download available, only – 7ochem Sep 15 '17 at 11:40
  • On the CE/Open Source download page there's also only (since Sep 14 it says) and no anymore – 7ochem Sep 15 '17 at 13:26
  • 4 was released yesterday, this info is no longer relevant. – Ryan Hoerr Sep 15 '17 at 13:55

Still trying to determine if this unique to our store, due to custom templates. However, it's broken with the patch applied and not broken when we revert. I wanted to post in case others can report the same.

In EE, we're unable to progress past the Payment Information step of checkout with the patch applied. We are current up to SUPEE-9767 v2 before applying the new patch.

Our issue seems to stem from them removing || elements[i].name == 'form_key' from:


It's removed from the enablePaymentMethods loop. That appears to leave the form's hidden form_key input disabled and therefore not passed to the controller when submitted.

<input name="form_key" type="hidden" value="X" disabled="">

Then, $this->_validateFormKey() fails and the controller returns nothing.

Update 1 (2017-09-18): I submitted a ticket to Magento support on Friday and was told it "[hadn't] been reported by any merchants yet". Instead of sending backups, I tried to duplicate on a clean install of and with the applicable patches applied. I was able to duplicate and responded to the ticket. Awaiting a new response.

Note: System > Configuration > Admin > Security > Enable Form Key Validation On Checkout needs to be "Yes". If "No", you won't see the issue.

Update 2 (2017-09-18): Noticed I could not duplicate the issue with, but when I checked the template file above, || elements[i].name == 'form_key' is still there. Seems the patches should not have removed it. Sent this information to Magento support, too.

Update 3 (2017-09-20): I just got a patch to fix the issue for–, which just restores the form_key line to the template. Ask support for SUPEE-10348.

  • Same issue here on – kmdsax Sep 15 '17 at 19:36
  • Thanks @kmdsax. I also submitted a ticket and waiting to get a confirmation from support. – quasiobject Sep 15 '17 at 20:09
  • Have you tried replicate same error on CE version? – Icon Sep 18 '17 at 16:31
  • 1
    @Icon I haven't. I work for a single merchant and we're EE. However, I don't think it would be affected since it's an EE gift card script block. That should not exist in CE. – quasiobject Sep 18 '17 at 16:58

When you go to Magento Connect, and after when you click "Return to Admin" in the top right corner of page. Upon returning back to admin dashboard, you get an error message

red error message: "Invalid Secret Key. Please refresh the page."

Once you refresh page, its gone.

Updated: Sept 15, 2017

If you login to Magento admin, let say Dashboard. Without logging-out from Dashboard panel you go and open another browser window in the same browser and go to example.com/admin, it will auto-login and show exactly same message

red error message: "Invalid Secret Key. Please refresh the page."

So far its the only issue I have found. I am not even sure if its a solid issue as the message goes away after refresh.

  • Maybe this comes from closing Magento Connect: magento.com/blog/magento-news/… – Kevin Krieger Sep 15 '17 at 7:18
  • 1
    @KalvinKlien I am also on .I see this message every time I got back and forth between admin and Magneto Connect (/downloader). I am just trying to find out if others also see it.. Doesn't seem like an major issue. – Icon Sep 15 '17 at 19:38
  • 3
    I'm seeing this in as well. Somebody has already filed a bug report in the Magento bug tracker. – Michael Thessel Sep 19 '17 at 22:30
  • 1
    It's an error in Mage_Adminhtml_Controller_Action::preDispatch(): if ($_keyErrorMsg != '') { Mage::getSingleton('adminhtml/session')->addError($_keyErrorMsg); }; should be if (!$_isValidFormKey){ Mage::getSingleton('adminhtml/session')->addError($_keyErrorMsg); }; – Laura Sep 21 '17 at 22:24
  • 1
    hmmmm, this is a partial solution so far. I still see the error from time to time, not sure if there is another controller that has this issue – Kalvin Klien Oct 6 '17 at 22:44

I asked Magento Support about the following problem


They answered me this morning and released a new patch PATCH_SUPEE-10348.

Magento just solved the problem by doing a revert in this file.

Index: app/design/frontend/enterprise/default/template/giftcardaccount/onepage/payment/scripts.phtml
--- app/design/frontend/enterprise/default/template/giftcardaccount/onepage/payment/scripts.phtml
+++ app/design/frontend/enterprise/default/template/giftcardaccount/onepage/payment/scripts.phtml
@@ -35,6 +35,7 @@
             if (elements[i].name == 'payment[method]'
                 || elements[i].name == 'payment[use_customer_balance]'
                 || elements[i].name == 'payment[use_reward_points]'
+                || elements[i].name == 'form_key'
             ) {
                 methodName = elements[i].value;
                 if ((free && methodName == 'free') || (!free && methodName != 'free')) {
  • 1
    Can confirm that this patch is available in the partner portal. – Luke Rodgers Sep 22 '17 at 13:41
  • Thanks for the information. I was forget to give that information – cghisi Sep 25 '17 at 9:52

I encountered an issue with email templates, custom CSS and modman. If you e.g. have a theme based on rwd/default, have a custom skin/frontend/package/theme/css/email-inline.css and your skin files are included via modman via a symlink, the CSS will not be added to the mail template after applying SUPEE-10266. The issue is that in Mage_Core_Model_Email_Template_Abstract::_getCssFileContent, some checks have been introduced.:

                 '_theme' => $theme,
+        $filePath = realpath($filePath);
+        $positionSkinDirectory = strpos($filePath, Mage::getBaseDir('skin'));
+        $validator = new Zend_Validate_File_Extension('css');

-        if (is_readable($filePath)) {
+        if ($validator->isValid($filePath) && $positionSkinDirectory !== false && is_readable($filePath)) {
             return (string) file_get_contents($filePath);

I solved it with a dirty hack with an app/code/local/Mage/Core/Model/Email/Template/Abstract.php override for the time being. I had to weaken the check, so that it is possible to load the CSS file from the modman directory:

$filePath = realpath($filePath);
$baseDirectory = Mage::getBaseDir();
$fullSkinDirectory = Mage::getBaseDir('skin');
$relativeSkinDirectory = substr($fullSkinDirectory, strlen($baseDirectory));
$positionSkinDirectory = strpos($filePath, $relativeSkinDirectory);
$validator = new Zend_Validate_File_Extension('css');
$noDirectoryTraversal = strpos($filename, '..') === false;

if ($validator->isValid($filePath) && $positionSkinDirectory !== false && $noDirectoryTraversal
    && is_readable($filePath)) {
    return (string) file_get_contents($filePath);

It will not check if the path includes the complete skin directory any more, but will only check if the path contains the string /skin and if it does not include .., which should prevent directory traversal attacks.

  • 1
    Deleted my answer as yours is more complete. The hack I used was to check if (strpos($filename, '..') === false) { $positionSkinDirectory = 1; } on the row after $positionSkinDirectory is originally set. This should help to avoid directory traversal. – Peter O'Callaghan Sep 20 '17 at 10:44
  • I want to note, that weaken in this case means, making it vulnerable again, and that using this solution is a direct security risk – Flyingmana Sep 20 '17 at 15:30
  • @PeterO'Callaghan good idea! I just added your check to my answer code. – Simon Sep 22 '17 at 6:26
  • @Flyingmana this should lower the risk dramatically. – Simon Sep 22 '17 at 6:27

Here is the complete list of patches affected by the autocomplete="new-pawwsord" typo:

CE      PATCH_SUPEE-10266_CE_1.7.0.2_v1-2017-09-13-06-27-12.sh:664
CE      PATCH_SUPEE-10266_CE_1.8.1.0_v1-2017-09-13-06-28-08.sh:665
CE      PATCH_SUPEE-10266_CE_1.9.0.1_v1-2017-09-13-06-31-01.sh:665
CE              PATCH_SUPEE-10266_CE_1.9.1.0_v1-2017-09-13-06-34-33.sh:733
CE              PATCH_SUPEE-10266_CE_1.9.1.1_v1-2017-09-15-04-59-56.sh:734
CE      PATCH_SUPEE-10266_CE_1.9.2.4_v1-2017-09-13-06-37-37.sh:694
CE      PATCH_SUPEE-10266_CE_1.9.3.2_v1-2017-09-13-06-38-58.sh:694
CE      PATCH_SUPEE-10266_CE_1.9.3.4_v1-2017-09-13-06-39-58.sh:694
EE             PATCH_SUPEE-10266_EE_1.12.0.0_v1-2017-09-13-08-09-14.sh:696
EE    PATCH_SUPEE-10266_EE_1.12.0.2_v1-2017-09-13-08-06-57.sh:696
EE    PATCH_SUPEE-10266_EE_1.13.1.0_v1-2017-09-13-08-04-05.sh:696
EE    PATCH_SUPEE-10266_EE_1.14.0.1_v1-2017-09-13-08-01-04.sh:696
EE             PATCH_SUPEE-10266_EE_1.14.1.0_v1-2017-09-13-07-57-59.sh:764
EE             PATCH_SUPEE-10266_EE_1.14.2.0_v1-2017-09-13-07-07-14.sh:764
EE    PATCH_SUPEE-10266_EE_1.14.2.4_v1-2017-09-13-06-57-21.sh:726
EE    PATCH_SUPEE-10266_EE_1.14.3.2_v1-2017-09-13-06-53-35.sh:716
EE    PATCH_SUPEE-10266_EE_1.14.3.3_v1-2017-09-13-06-51-06.sh:716

On Magento 1.8.1 I ran into issues with following files:


I ended up with downloading the latest Magento version which does NOT contain the patch. In this case Magento

Replacing the 'corrupted' files with the one from the download fixed the issue. I was able to apply the patch successfully.

But be careful: I suggest to revert the 3 files after patching again and edit the files manually.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.