SUPEE-8788 in Magento 1.9.3.7 Failed by curl.php

Question

I upgraded a Magento shop from 1.8.1.0 to 1.9.3.7.

I upgraded in Steps 1.8.1.0 -> 1.9.01 -> 1.9.2.4 -> 1.9.3.7

The shop is running and it really fits.

I did a test on magereport.com and everything is green. Only a patch is displayed as not installed: SUPEE-8788 - This is not good.

I then downloaded and installed the last version of the patch from Magento. Almost everything was skipped (hunk ignored).

This one is failed:

checking file downloader/lib/Mage/HTTP/Client/Curl.php

Hunk #1 FAILED at 373.

1 out of 1 hunk FAILED

I tried different solutions. I used a completely new "downloader" folder from the current Magento 1.9.3.7 and tried again to patch. It just does not work. It is only the file curl.php that is causing problems. Unfortunately I can not find a v1 version of the patch 8788 (1.9.2.4). To patch first v1 and then v2. That would be worth a try.

What can I do to patch a 1.9.3.7 shop with SUPEE-8788?

Thanks in advance

Answer 1

I doubt that you upgraded your shop properly. "Upgrading" does not just mean copying new files over the old ones. Yet, the issue with checking for patch SUPEE-8788 does happen in exactly this situations.

But one after the other. First of all, Magento 1.9.3.7 does include SUPEE-8788 already! Hence, all your tries of applying this patch are meant to fail. Do NOT try to force its installation!

ver 1.9.3.7 - Added Nov 28, 2017

Includes patches: SUPEE-5344, SUPEE-5994, SUPEE-6237, SUPEE-6285, SUPEE-6482, SUPEE-6788, SUPEE-7616, SUPEE-7405, SUPEE-7405 v1.1, SUPEE-8788, SUPEE-9652, SUPEE-8167, SUPEE-9767v2, SUPEE-10266, SUPEE-10415

Source: https://magento.com/tech-resources/download

Secondly, MageReport.com does not hack into your shop to see what version of Magento is running. It rather uses a punch of different methods such as checksums and curl (or similar) to get some particular URLs of your store. Furthermore, in this particular case MageReport.com will test your shop against the following:

Magereport checks for the following static assets that should have been removed:

/skin/adminhtml/default/default/media/flex.swf /skin/adminhtml/default/default/media/uploader.swf /skin/adminhtml/default/default/media/uploaderSingle.swf It also checks for the following files that have been modified:

/js/mage/adminhtml/uploader/instance.js should contain "fustyFlowFactory" /skin/adminhtml/default/default/boxes.css should contain "background:url(images/blank.gif) repeat;"

Source: https://support.hypernode.com/knowledgebase/magento-patch-supee-8788-release-1-9-3/

You can find some related information about MageReport.com's testing here: Some Security patches Shows Error executing check in magereport

That being said, please check for the above mentioned files. Most likely there are still these .swf files located in your file base - hence the test will fail.

Long story short: These files are to be removed (SUPEE-8788 would do that, yet Magento expects you to update your shop properly and therefore does not provide this patch for versions after SUPEE-8788 was released).

---

Now, why is that so? Well, basically because when you just copy a new file base (i.e. an updated version of the core) over the old one you will only address files that are there in both, new and old source or in the new source only. Files that are present in the old source only will not be touched and remain as is.

So, in order to upgrade a shop it is better to set up a test/development environment and merge the old source step by step for old to new core.