0

Patched Magento Open Source 1.9.3.6 with SUPEE-10415.

Message:

Formkey validation on checkout disabled. This may expose security risks. We strongly recommend to Enable Form Key Validation On Checkout in Admin / Security Section, for protect your own checkout process. still appears.

What to do?

Improve this question

2 Answers 2

Reset to default
1

You still need to enable the form key validation on the checkout as per SUPEE-9767/Magento 1.9.3.6. Login to admin and go to:

System > Configuration > Advanced/Admin > Security > Enable Form Key Validation On Checkout >> Yes

Warning You will need to ensure any custom templates have the formkey outputted otherwise your checkout process will not work.

Please refer to Checkout form keys on https://magento.stackexchange.com/a/176958/41117 for more information

Improve this answer
0

Make sure you have added a patch and added a Form key in all checkout phtml files which is using form tag.

Go to System->Configuration->Advanced->Admin and set Enable Form Key Validation On Checkout = Yes http://ift.tt/2Ao6mTE

If any checkout has any form key is missing then your checkout should not work correctly.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.