SUPEE-10888 is a new security patch for Magento 1 which addresses 12 security issues.

https://magento.com/security/patches/supee-10888

SUPEE-10888, Magento Commerce 1.14.3.10 and Open Source 1.9.3.10 contain multiple security enhancements that help close cross-site scripting (XSS), cross-site request forgery (CSRF) and other vulnerabilities.

The patch can be found at https://magento.com/tech-resources/download#download2243

What common issues do you have to watch out for when applying this patch?

  • Cannot send password via email to customers who register during checkout – Haim Sep 18 at 21:14
  • @Haim in these StackExchange questions about patch issue it is common practise to create an "Answer" where you explain on which Magento version with which patch file you experience a certain problem. – Jeroen Vermeulen - MageHost Sep 20 at 10:34
  • @JeroenVermeulen-MageHost Understood. That's not really a patch issue, just something that Magento themselves mention on the release of the patch – Haim Sep 20 at 14:24

16 Answers 16

Below files have been changed/created after the patch is applied

app/code/core/Mage/Admin/Model/User.php 
app/code/core/Mage/Admin/etc/config.xml 
app/code/core/Mage/Adminhtml/Block/Catalog/Product/Edit/Tab/Super/Config.php 
app/code/core/Mage/Adminhtml/Block/Widget/Grid/Massaction/Abstract.php 
app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator.php 
app/code/core/Mage/Adminhtml/controllers/Catalog/ProductController.php 
app/code/core/Mage/Adminhtml/controllers/Permissions/UserController.php 
app/code/core/Mage/Adminhtml/etc/config.xml 
app/code/core/Mage/Checkout/Model/Api/Resource/Customer.php 
app/code/core/Mage/Checkout/Model/Type/Onepage.php 
app/code/core/Mage/Cms/Model/Wysiwyg/Images/Storage.php 
app/code/core/Mage/Core/etc/config.xml 
app/code/core/Mage/Core/etc/system.xml 
app/code/core/Mage/Customer/Helper/Data.php 
app/code/core/Mage/Customer/Model/Customer.php 
app/code/core/Mage/Customer/Model/Resource/Customer.php 
app/code/core/Mage/Customer/controllers/AccountController.php 
app/code/core/Mage/Customer/etc/config.xml app/code/core/Mage/Customer/etc/config.xml
app/code/core/Mage/Customer/sql/customer_setup/upgrade-1.6.2.0.6.1.1-1.6.2.0.6.1.2.php 
app/code/core/Mage/Paypal/Model/Express/Checkout.php 
app/code/core/Mage/XmlConnect/controllers/ReviewController.php 
app/code/core/Zend/Filter/PregReplace.php app/code/core/Zend/Filter/PregReplace.php
app/design/adminhtml/default/default/template/bundle/product/edit/bundle/option.phtml 
app/design/adminhtml/default/default/template/bundle/sales/creditmemo/create/items/renderer.phtml 
app/design/adminhtml/default/default/template/bundle/sales/creditmemo/view/items/renderer.phtml 
app/design/adminhtml/default/default/template/bundle/sales/invoice/create/items/renderer.phtml 
app/design/adminhtml/default/default/template/bundle/sales/invoice/view/items/renderer.phtml 
app/design/adminhtml/default/default/template/bundle/sales/order/view/items/renderer.phtml 
app/design/adminhtml/default/default/template/bundle/sales/shipment/create/items/renderer.phtml 
app/design/adminhtml/default/default/template/bundle/sales/shipment/view/items/renderer.phtml 
app/design/adminhtml/default/default/template/catalog/product/helper/gallery.phtml 
app/design/frontend/base/default/template/bundle/email/order/items/creditmemo/default.phtml 
app/design/frontend/base/default/template/bundle/email/order/items/invoice/default.phtml 
app/design/frontend/base/default/template/bundle/email/order/items/order/default.phtml 
app/design/frontend/base/default/template/bundle/email/order/items/shipment/default.phtml 
app/design/frontend/base/default/template/bundle/sales/order/creditmemo/items/renderer.phtml 
app/design/frontend/base/default/template/bundle/sales/order/invoice/items/renderer.phtml 
app/design/frontend/base/default/template/bundle/sales/order/items/renderer.phtml 
app/design/frontend/base/default/template/bundle/sales/order/shipment/items/renderer.phtml 
app/design/frontend/base/default/template/downloadable/checkout/multishipping/item/downloadable.phtml 
app/design/frontend/base/default/template/downloadable/email/order/items/creditmemo/downloadable.phtml 
app/design/frontend/base/default/template/downloadable/email/order/items/invoice/downloadable.phtml 
app/design/frontend/base/default/template/downloadable/email/order/items/order/downloadable.phtml 
app/design/frontend/base/default/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml 
app/design/frontend/base/default/template/downloadable/sales/order/invoice/items/renderer/downloadable.phtml 
app/design/frontend/default/iphone/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml 
app/design/frontend/default/iphone/template/downloadable/sales/order/invoice/items/renderer/downloadable.phtml 
app/design/frontend/default/iphone/template/downloadable/sales/order/items/renderer/downloadable.phtml 
app/design/frontend/rwd/default/template/bundle/email/order/items/creditmemo/default.phtml 
app/design/frontend/rwd/default/template/bundle/email/order/items/invoice/default.phtml 
app/design/frontend/rwd/default/template/bundle/email/order/items/order/default.phtml 
app/design/frontend/rwd/default/template/bundle/email/order/items/shipment/default.phtml 
app/design/frontend/rwd/default/template/bundle/sales/order/items/renderer.phtml 
app/design/frontend/rwd/default/template/downloadable/email/order/items/creditmemo/downloadable.phtml 
app/design/frontend/rwd/default/template/downloadable/email/order/items/invoice/downloadable.phtml 
app/design/frontend/rwd/default/template/downloadable/email/order/items/order/downloadable.phtml 
app/locale/en_US/Mage_Adminhtml.csv app/locale/en_US/Mage_Adminhtml.csv
app/locale/en_US/Mage_Customer.csv app/locale/en_US/Mage_Customer.csv
app/locale/en_US/template/email/account_password_reset_confirmation.html 
app/locale/en_US/template/email/admin_new_user_notification.html 
downloader/Maged/Controller.php downloader/Maged/Controller.php
skin/adminhtml/default/enterprise/images/placeholder/thumbnail.jpg 
  • 2
    This does not provide an answer to the question. – Simon Sep 25 at 13:31

In the original v1 patches with 2018-09-18 in the filename:

File skin/adminhtml/default/enterprise/images/placeholder/thumbnail.jpg: git binary diffs are not supported.

Magento did silently fix this issue by releasing new patch files. Still v1 but with 2018-09-19 in the filename.

  • My solution is to skip this change by removing the line starting with diff --git skin/adminhtml/default/enterprise/images/placeholder/thumbnail.jpg and all following lines from the patch file – Jeroen Vermeulen - MageHost Sep 19 at 11:23
  • I think Magento will come with a V2 version for this patch with this issue fixed in the next couple of days... – Akif Sep 19 at 14:10
  • 1
    pretty sure the patches have been updated, but keeping the number as v1? redownload and check. – Luke Rodgers Sep 19 at 18:54
  • 2
    @LukeRodgers They did! How sneaky! I will edit this issue. – Jeroen Vermeulen - MageHost Sep 20 at 8:17
  • 1.7.02 CE version of the patch is still not updated. – danmentzer Oct 5 at 18:21

Problem with patch PATCH_SUPEE-10888_CE_v1.9.0.1_v1-2018-09-18-02-54-39.sh on vanilla Magento 1.8.1.0, with all previous patches installed:

can't find file to patch at input line 1019
Perhaps you used the wrong -p or --strip option?
The text leading up to this was:
--------------------------
|diff --git app/design/frontend/rwd/default/template/bundle/sales/order/items/renderer.phtml app/design/frontend/rwd/default/template/bundle/sales/order/items/renderer.phtml
|index b1ec5eb0460..ca3e8b32474 100644
|--- app/design/frontend/rwd/default/template/bundle/sales/order/items/renderer.phtml
|+++ app/design/frontend/rwd/default/template/bundle/sales/order/items/renderer.phtml
--------------------------

Indeed the file app/design/frontend/rwd/default/template/bundle/sales/order/items/renderer.phtml does not exist in 1.8.1.0 so I removed this change from the patch file.

I did not succeeded in doing this with the updated, 2018-09-19 version of the patch. Only succeeded with file PATCH_SUPEE-10888_CE_v1.8.1.0_v1-2018-09-18-02-54-39 after also removing the thumbnail.jpg change like explained in my comment on https://magento.stackexchange.com/a/242823/13642

  • Do you think it makes sense for them to release v2 version? and how did the patch install on 1.7.0.2 ? – Icon Sep 20 at 2:16
  • This is because you are trying to patch 1.8.1.0 using the patch for 1.9.0.1. Look carefully at the name of the patch you are using "PATCH_SUPEE-10888_CE_v1.9.0.1_...." - "...CE_v1.9.0.1..." – Andrey Borgoyakov Sep 20 at 6:21
  • 1
    @AndreyBorgoyakov I am using the right patch. The patches are named the after the highest version they are compatible with. You can check on magento.com/tech-resources/download#download2243. The path file I am using is SUPEE-10888 for CE 1.8.1.0-1.9.0.1 (0.06 MB) – Jeroen Vermeulen - MageHost Sep 20 at 8:14
  • 1
    @Icon after fixing magento.stackexchange.com/a/242823/13642 the patch installed well on 1.7.0.2. This is the order of the patches we installed on 1.7.0.2: SUPEE-2677 SUPEE-2629 SUPEE-1049 SUPEE-1868-1-12-0-2 SUPEE-4334-v1.11.1.0 SUPEE-5345 SUPEE-5994 SUPEE-6237 SUPEE-6285 SUPEE-6482 SUPEE-6788 SUPEE-7405-CE-1-7-0-2 SUPEE-7405 SUPEE-7616 SUPEE-8167 SUPEE-8788 SUPEE-8967 SUPEE-9652 PATCH_SUPEE-9767_CE_1.7.0.2_v2 SUPEE-10336_v1.13.0.2 SUPEE-10266-CE-1.7.0.2 SUPEE-10415-ce-1.7.0.2 SUPEE-10570_CE_v1.7.0.2 SUPEE-10752_CE_v1.7.0.2 SUPEE-10888_CE_v1.7.0.2 – Jeroen Vermeulen - MageHost Sep 20 at 8:36
  • I looked over the patch description, haven't found any Critital improvements as we've seen in other patches. No particular urgency to install, what do you think? – Icon Sep 20 at 14:49

As outlined in https://magento.stackexchange.com/a/243531/142, you need to check all your custom frontend template files and include the changes from the patch there manually.

Besides of that, you need to check your account_password_reset_confirmation.html mail template. Depending on your store, either under app/locale/[LANG]/template/email/ or in the backend under System > Transactional Emails for all languages. In all respective templates, you need to change _query_id=$customer.id to _query_id=$customer.rp_customer_id. The change has been implemented in a backwards-compatible manner, but if you want to include all security improvements, you should not miss this change.

If you are using custom theme and your theme overrides any of below file then you need to add changes manually in your theme

app/design/frontend/base/default/template/bundle/email/order/items/creditmemo/default.phtml 
app/design/frontend/base/default/template/bundle/email/order/items/invoice/default.phtml 
app/design/frontend/base/default/template/bundle/email/order/items/order/default.phtml 
app/design/frontend/base/default/template/bundle/email/order/items/shipment/default.phtml 
app/design/frontend/base/default/template/bundle/sales/order/creditmemo/items/renderer.phtml 
app/design/frontend/base/default/template/bundle/sales/order/invoice/items/renderer.phtml 
app/design/frontend/base/default/template/bundle/sales/order/items/renderer.phtml 
app/design/frontend/base/default/template/bundle/sales/order/shipment/items/renderer.phtml 
app/design/frontend/base/default/template/downloadable/checkout/multishipping/item/downloadable.phtml 
app/design/frontend/base/default/template/downloadable/email/order/items/creditmemo/downloadable.phtml 
app/design/frontend/base/default/template/downloadable/email/order/items/invoice/downloadable.phtml 
app/design/frontend/base/default/template/downloadable/email/order/items/order/downloadable.phtml 
app/design/frontend/base/default/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml 
app/design/frontend/base/default/template/downloadable/sales/order/invoice/items/renderer/downloadable.phtml 
app/design/frontend/default/iphone/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml 
app/design/frontend/default/iphone/template/downloadable/sales/order/invoice/items/renderer/downloadable.phtml 
app/design/frontend/default/iphone/template/downloadable/sales/order/items/renderer/downloadable.phtml 
app/design/frontend/rwd/default/template/bundle/email/order/items/creditmemo/default.phtml 
app/design/frontend/rwd/default/template/bundle/email/order/items/invoice/default.phtml 
app/design/frontend/rwd/default/template/bundle/email/order/items/order/default.phtml 
app/design/frontend/rwd/default/template/bundle/email/order/items/shipment/default.phtml 
app/design/frontend/rwd/default/template/bundle/sales/order/items/renderer.phtml 
app/design/frontend/rwd/default/template/downloadable/email/order/items/creditmemo/downloadable.phtml 
app/design/frontend/rwd/default/template/downloadable/email/order/items/invoice/downloadable.phtml 
app/design/frontend/rwd/default/template/downloadable/email/order/items/order/downloadable.phtml 

for example if you have added

 app/design/frontend/base/default/template/bundle/email/order/items/creditmemo/default.phtml

in your theme , then you have to do changes manually in

app/design/frontend/[YourPackge]/[YourTheme]/template/bundle/email/order/items/creditmemo/default.phtml

For example Find these line

$attributes['option_label']

and replace with below

$this->escapeHtml($attributes['option_label']);

Today Morning I have applied the patch. The major files are in Magento backend.

app/code/core/Mage/Admin/Model/User.php
app/code/core/Mage/Admin/etc/config.xml
app/code/core/Mage/Adminhtml/Block/Catalog/Product/Edit/Tab/Super/Config.php
app/code/core/Mage/Adminhtml/Block/Widget/Grid/Massaction/Abstract.php
app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator.php
app/code/core/Mage/Adminhtml/controllers/Catalog/ProductController.php
app/code/core/Mage/Adminhtml/controllers/Permissions/UserController.php
app/code/core/Mage/Adminhtml/etc/config.xml
app/code/core/Mage/Checkout/Model/Api/Resource/Customer.php
app/code/core/Mage/Checkout/Model/Type/Onepage.php
app/code/core/Mage/Cms/Model/Wysiwyg/Images/Storage.php
app/code/core/Mage/Core/etc/config.xml
app/code/core/Mage/Core/etc/system.xml
app/code/core/Mage/Customer/Helper/Data.php
app/code/core/Mage/Customer/Model/Customer.php
app/code/core/Mage/Customer/Model/Resource/Customer.php
app/code/core/Mage/Customer/controllers/AccountController.php
app/code/core/Mage/Customer/etc/config.xml
app/code/core/Mage/Customer/sql/customer_setup/upgrade-1.6.2.0.5.1.2-1.6.2.0.5.1.3.php
app/code/core/Mage/Paypal/Model/Express/Checkout.php
app/code/core/Mage/XmlConnect/controllers/ReviewController.php
app/code/core/Zend/Filter/PregReplace.php
app/locale/en_US/Mage_Adminhtml.csv
app/locale/en_US/Mage_Customer.csv
app/locale/en_US/template/email/account_password_reset_confirmation.html
app/locale/en_US/template/email/admin_new_user_notification.html
downloader/Maged/Controller.php
skin/adminhtml/default/enterprise/images/placeholder/thumbnail.jpg

Escapehtml added files

app/design/adminhtml/default/default/template/bundle/product/edit/bundle/option.phtml
app/design/adminhtml/default/default/template/bundle/sales/creditmemo/create/items/renderer.phtml
app/design/adminhtml/default/default/template/bundle/sales/creditmemo/view/items/renderer.phtml
app/design/adminhtml/default/default/template/bundle/sales/invoice/create/items/renderer.phtml
app/design/adminhtml/default/default/template/bundle/sales/invoice/view/items/renderer.phtml
app/design/adminhtml/default/default/template/bundle/sales/order/view/items/renderer.phtml
app/design/adminhtml/default/default/template/bundle/sales/shipment/create/items/renderer.phtml
app/design/adminhtml/default/default/template/bundle/sales/shipment/view/items/renderer.phtml
app/design/adminhtml/default/default/template/catalog/product/helper/gallery.phtml
app/design/frontend/base/default/template/bundle/email/order/items/creditmemo/default.phtml
app/design/frontend/base/default/template/bundle/email/order/items/invoice/default.phtml
app/design/frontend/base/default/template/bundle/email/order/items/order/default.phtml
app/design/frontend/base/default/template/bundle/email/order/items/shipment/default.phtml
app/design/frontend/base/default/template/bundle/sales/order/creditmemo/items/renderer.phtml
app/design/frontend/base/default/template/bundle/sales/order/invoice/items/renderer.phtml
app/design/frontend/base/default/template/bundle/sales/order/items/renderer.phtml
app/design/frontend/base/default/template/bundle/sales/order/shipment/items/renderer.phtml
app/design/frontend/base/default/template/downloadable/checkout/multishipping/item/downloadable.phtml
app/design/frontend/base/default/template/downloadable/email/order/items/creditmemo/downloadable.phtml
app/design/frontend/base/default/template/downloadable/email/order/items/invoice/downloadable.phtml
app/design/frontend/base/default/template/downloadable/email/order/items/order/downloadable.phtml
app/design/frontend/base/default/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml
app/design/frontend/base/default/template/downloadable/sales/order/invoice/items/renderer/downloadable.phtml
app/design/frontend/rwd/default/template/bundle/email/order/items/creditmemo/default.phtml
app/design/frontend/rwd/default/template/bundle/email/order/items/invoice/default.phtml
app/design/frontend/rwd/default/template/bundle/email/order/items/order/default.phtml
app/design/frontend/rwd/default/template/bundle/email/order/items/shipment/default.phtml
app/design/frontend/rwd/default/template/bundle/sales/order/items/renderer.phtml
app/design/frontend/rwd/default/template/downloadable/email/order/items/creditmemo/downloadable.phtml
app/design/frontend/rwd/default/template/downloadable/email/order/items/invoice/downloadable.phtml
app/design/frontend/rwd/default/template/downloadable/email/order/items/order/downloadable.phtml

In Magento commerce added files other than the above files:

app/code/core/Enterprise/GiftRegistry/Helper/Data.php
app/code/core/Enterprise/GiftRegistry/Model/Attribute/Processor.php
app/design/frontend/enterprise/default/template/cms/hierarchy/pagination.phtml
app/design/frontend/enterprise/iphone/template/bundle/sales/order/items/renderer.phtml
app/design/frontend/enterprise/iphone/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml
app/design/frontend/enterprise/iphone/template/downloadable/sales/order/invoice/items/renderer/downloadable.phtml
app/design/frontend/enterprise/iphone/template/downloadable/sales/order/items/renderer/downloadable.phtml
app/design/frontend/rwd/enterprise/template/cms/hierarchy/pagination.phtml
app/design/frontend/rwd/enterprise/template/rma/return/view.phtml

I do not face any issue till now.

In Magento EE 1.13.1.0

Patch is looking for wrong file (community file, I believe).

Had to delete these lines from patch file and apply. It applied successfully.

Have notified Magento core team, yet to receive feedback.

diff --git app/design/frontend/rwd/default/template/bundle/sales/order/items/renderer.phtml app/design/frontend/rwd/default/template/bundle/sales/order/items/renderer.phtml
index b3e997f59f3..f34c2bba6a2 100644
--- app/design/frontend/rwd/default/template/bundle/sales/order/items/renderer.phtml
+++ app/design/frontend/rwd/default/template/bundle/sales/order/items/renderer.phtml
@@ -43,7 +43,7 @@
     <?php $attributes = $this->getSelectionAttributes($_item) ?>
     <?php if ($_prevOptionId != $attributes['option_id']): ?>
     <tr class="bundle label<?php if($_item->getLastRow()): ?> last<?php endif; ?>">
-        <td><div class="option-label"><?php echo $attributes['option_label'] ?></div></td>
+        <td><div class="option-label"><?php echo $this->escapeHtml($attributes['option_label']); ?></div></td>
         <td data-rwd-label="SKU" class="lin-hide">&nbsp;</td>
         <td data-rwd-label="Price" class="lin-hide">&nbsp;</td>
         <td data-rwd-label="Qty" class="lin-hide">&nbsp;</td>
  • Did you ever hear back about this? – Laura Oct 2 at 16:02
  • Yes, they sent me another patch in the ticket. – Adarsh Khatri Oct 2 at 23:19

Password reset form no longer works after installing the patch on CE 1.7.0.2 with all previous patches installed.

(PATCH_SUPEE-10888_CE_v1.7.0.2_v1-2018-09-18-03-00-22.sh)

EDIT:

Issue no longer occures after reverting patch from September 18 (v1) and applying the updated patch from September 19 (v1) + cache refresh and clearing magento cache.

(PATCH_SUPEE-10888_CE_v1.7.0.2_v1-2018-09-19-03-01-22.sh)

Thanks, Robb for the clue.

SUPEE-10752 was needed to be applied. I also applied, the PHP 7.2 compatibility patch and removed the Inchoo_PHP7 compatibility patch before installing SUPEE-10888. Worked without a problem.

Found a little typo in the patch for 1.14.2.0 to 1.14.2.4

In the file app/design/frontend/enterprise/iphone/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml, it mistakenly makes the following change:

<dt><?php echo $this->escspeHtml($this->getLinksTitle()); ?></dt>

instead of

<dt><?php echo $this->escapeHtml($this->getLinksTitle()); ?></dt>

Here's the diff for reference:

diff --git app/design/frontend/enterprise/iphone/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml app/design/frontend/enterprise/iphone/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml index 6ed3cd9bfd4..f8b1573605a 100644 --- app/design/frontend/enterprise/iphone/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml +++ app/design/frontend/enterprise/iphone/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml @@ -55,7 +55,7 @@ <!-- downloadable --> <?php if ($links = $this->getLinks()): ?> <dl class="item-options"> - <dt><?php echo $this->getLinksTitle() ?></dt> + <dt><?php echo $this->escspeHtml($this->getLinksTitle()); ?></dt> <?php foreach ($links->getPurchasedItems() as $link): ?> <dd><?php echo $this->escapeHtml($link->getLinkTitle()); ?></dd> <?php endforeach; ?>

There is a typo inside /app/code/core/Mage/Core/etc/system.xml at <crate_admin_user_notification translate="label comment"> it should be <create_admin_user_notification translate="label comment"> but it's non breaking because the usages is also spelled wrong at if(Mage::getStoreConfigFlag('admin/security/crate_admin_user_notification')

Currently failing here on Magento CE 1.9.1.0.

patching file app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator.php
Hunk #2 FAILED at 57.

A visual check of the source files confirms that the relevant code isn't there.

patching file app/code/core/Mage/Customer/controllers/AccountController.php
Hunk #3 FAILED at 845.

...

can't find file to patch at input line 600
Perhaps you used the wrong -p or --strip option?
The text leading up to this was:
--------------------------
|diff --git app/code/core/Zend/Filter/PregReplace.php app/code/core/Zend/Filter/PregReplace.php

As indicated, there's no such file.

patching file app/design/adminhtml/default/default/template/bundle/product/edit/bundle/option.phtml
Hunk #1 FAILED at 209.
  • This turned out to be because SUPEE-10752 had not been applied previously. – Robb Sep 25 at 13:43

Magento CE 1.6.2.0

Following error once patch is applied when trying to reset customer account password on the frontend.

Fatal error: Call to a member function getBackend() on a non-object in app/code/core/Mage/Eav/Model/Entity/Abstract.php on line 1536.

Turns out, the patch hadn't ran the SQL upgrade script (app/code/core/Mage/Customer/sql/customer_setup/upgrade-1.6.1.0.1.2-1.6.1.0.1.3.php) which created a new attribute called rp_customer_id.

Check that you've cleared Magento Cache, but more importantly if you have varnish cache enabled, clear it. After I disabled all of the cache, and cleaned varnish cache, the SQL script created the new attribute in the database.

Just an FYI for EE users, since this patch requires SUPEE-10752 you might encounter some sessions being randomly dropped or your checkout redirects to the homepage instead of the success page.

We went to the usual process of applying the following patches in this order:

  1. SUPEE-10570v2 (PATCH_SUPEE-10570_EE_v1.14.2.4_v2-2018-03-22-10-57-00.sh)
  2. SUPEE-10752 (PATCH_SUPEE-10752_EE_v1.14.2.4_v1-2018-06-25-09-53-38.sh)
  3. SUPEE-10888 (PATCH_SUPEE-10888_EE_v1.14.2.4_v1-2018-09-19-03-07-06.sh)

However, the patch SUPEE-10752 for EE contains the following changes: app/code/core/Mage/Core/Model/Session/Abstract/Varien.php

+    const VALIDATOR_PASSWORD_CREATE_TIMESTAMP   = 'password_create_timestamp';


+    /**
+     * Use password creation timestamp in validator key
+     *
+     * @return bool
+     */
+    public function useValidateSessionPasswordTimestamp()
+    {
+        return true;
+    }


+        if ($this->useValidateSessionPasswordTimestamp()
+            && isset($validatorData[self::VALIDATOR_PASSWORD_CREATE_TIMESTAMP])
+            && isset($sessionData[self::VALIDATOR_SESSION_EXPIRE_TIMESTAMP])
+            && $validatorData[self::VALIDATOR_PASSWORD_CREATE_TIMESTAMP]
+            > $sessionData[self::VALIDATOR_SESSION_EXPIRE_TIMESTAMP] - $this->getCookie()->getLifetime()
+        ) {
+            return false;
+        }

I had to apply at the last part the invalid_session_fix-2018-03-14-05-10-19.patch below which is found in https://magento.com/tech-resources/download under SUPEE-10570 > invalid_session_fix.patch (0 MB)

diff --git a/app/code/core/Mage/Core/Model/Session/Abstract/Varien.php b/app/code/core/Mage/Core/Model/Session/Abstract/Varien.php
index 59b3ea8..35155f1 100644
--- a/app/code/core/Mage/Core/Model/Session/Abstract/Varien.php
+++ b/app/code/core/Mage/Core/Model/Session/Abstract/Varien.php
@@ -485,7 +485,7 @@ class Mage_Core_Model_Session_Abstract_Varien extends Varien_Object
             && isset($validatorData[self::VALIDATOR_PASSWORD_CREATE_TIMESTAMP])
             && isset($sessionData[self::VALIDATOR_SESSION_EXPIRE_TIMESTAMP])
             && $validatorData[self::VALIDATOR_PASSWORD_CREATE_TIMESTAMP]
-            > $sessionData[self::VALIDATOR_SESSION_EXPIRE_TIMESTAMP] - $this->getCookie()->getLifetime()
+            > $sessionData[self::VALIDATOR_SESSION_EXPIRE_TIMESTAMP]
         ) {
             return false;
         }
  • I am getting the same issue, I am using Magento CE ver. 1.9.3.1, if you found a resolution please let me know – shyopat Nov 21 at 13:24

I have seen an issue with quite a few customers where they call us that they are unable to login and view their account.

The email and password are correct - no login error message, page just reloads to the home page or login page, they can't seem to get into their account! This happened after applying the patch 10888, and we do have 10752 applied.

After digging I found in table customer_entity, and it sparked to me that the affected customers have a timestamp of created_date AFTER the updated_date. I think it shouldn't be that way right?

So to test, I changed the created_date to be BEFORE the updated_date, even by one minute. For some users this alone helped them to get back into their accounts. While for other users I also had to update their password via SQL, using query:

update customer_entity_varchar set value = md5('123456') 
   where where entity_id = 105 /*enter customer's entity_id found in customer_entity */
   and attribute_id in 
      (select attribute_id from eav_attribute where attribute_code = 'password_hash' 
        and entity_type_id = 1);

I haven't got to fully investigate the changes SUPEE 10888 does to customer core files, but there are definitely issues with the patch.

Furthermore, I can't seem to update the customers password via admin panel as I normally would, when saving, the page results in an error.

Using 1.9.2.4

  • i have the same issue , did you found any solution for this issue ? – Pravin Oct 29 at 17:02

I am using Magento 1.9.3.7 . Os is ubuntu. PHP version is 7.0.

When tried to applied path SUPPER-10888 getting below error.

Checking if a patch can be applied/reverted successfully...

ERROR: Patch can't be applied/reverted successfully.

checking file app/code/core/Mage/Admin/Model/User.php Hunk #2 succeeded at 676 (offset -20 lines). checking file app/code/core/Mage/Admin/etc/config.xml checking file app/code/core/Mage/Adminhtml/Block/Catalog/Product/Edit/Tab/Super/Config.php checking file app/code/core/Mage/Adminhtml/Block/Widget/Grid/Massaction/Abstract.php checking file app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator.php Hunk #2 FAILED at 57. Hunk #3 succeeded at 80 (offset -12 lines). Hunk #4 succeeded at 115 with fuzz 2 (offset -12 lines). Hunk #5 succeeded at 139 with fuzz 1 (offset -21 lines). Hunk #6 succeeded at 161 (offset -21 lines). 1 out of 6 hunks FAILED checking file app/code/core/Mage/Adminhtml/controllers/Catalog/ProductController.php Hunk #1 succeeded at 1020 (offset -11 lines). checking file app/code/core/Mage/Adminhtml/controllers/Permissions/UserController.php checking file app/code/core/Mage/Adminhtml/etc/config.xml checking file app/code/core/Mage/Checkout/Model/Api/Resource/Customer.php Hunk #1 succeeded at 151 with fuzz 1 (offset -1 lines). checking file app/code/core/Mage/Checkout/Model/Type/Onepage.php Hunk #1 succeeded at 731 with fuzz 1 (offset -3 lines). checking file app/code/core/Mage/Cms/Model/Wysiwyg/Images/Storage.php checking file app/code/core/Mage/Core/etc/config.xml checking file app/code/core/Mage/Core/etc/system.xml checking file app/code/core/Mage/Customer/Helper/Data.php checking file app/code/core/Mage/Customer/Model/Customer.php checking file app/code/core/Mage/Customer/Model/Resource/Customer.php Hunk #1 succeeded at 332 (offset -1 lines). checking file app/code/core/Mage/Customer/controllers/AccountController.php Hunk #1 succeeded at 755 (offset -1 lines). Hunk #2 succeeded at 810 (offset -1 lines). Hunk #3 FAILED at 871. Hunk #4 succeeded at 883 (offset -2 lines). 1 out of 4 hunks FAILED checking file app/code/core/Mage/Customer/etc/config.xml Hunk #1 FAILED at 28. 1 out of 1 hunk FAILED checking file app/code/core/Mage/Customer/sql/customer_setup/upgrade-1.6.2.0.5.1.2-1.6.2.0.5.1.3.php checking file app/code/core/Mage/Paypal/Model/Express/Checkout.php checking file app/code/core/Mage/XmlConnect/controllers/ReviewController.php can't find file to patch at input line 600 Perhaps you used the wrong -p or --strip option?

The text leading up to this was:

|diff --git app/code/core/Zend/Filter/PregReplace.php app/code/core/Zend/Filter/PregReplace.php |index 586c0fe20a0..d6fa2dac0ec 100644 |--- app/code/core/Zend/Filter/PregReplace.php

|+++ app/code/core/Zend/Filter/PregReplace.php

File to patch: Skip this patch? [y] Skipping patch. 2 out of 2 hunks ignored checking file app/design/adminhtml/default/default/template/bundle/product/edit/bundle/option.phtml Hunk #1 FAILED at 209. 1 out of 1 hunk FAILED checking file app/design/adminhtml/default/default/template/bundle/sales/creditmemo/create/items/renderer.phtml checking file app/design/adminhtml/default/default/template/bundle/sales/creditmemo/view/items/renderer.phtml checking file app/design/adminhtml/default/default/template/bundle/sales/invoice/create/items/renderer.phtml checking file app/design/adminhtml/default/default/template/bundle/sales/invoice/view/items/renderer.phtml checking file app/design/adminhtml/default/default/template/bundle/sales/order/view/items/renderer.phtml checking file app/design/adminhtml/default/default/template/bundle/sales/shipment/create/items/renderer.phtml checking file app/design/adminhtml/default/default/template/bundle/sales/shipment/view/items/renderer.phtml checking file app/design/adminhtml/default/default/template/catalog/product/helper/gallery.phtml checking file app/design/frontend/base/default/template/bundle/email/order/items/creditmemo/default.phtml checking file app/design/frontend/base/default/template/bundle/email/order/items/invoice/default.phtml checking file app/design/frontend/base/default/template/bundle/email/order/items/order/default.phtml checking file app/design/frontend/base/default/template/bundle/email/order/items/shipment/default.phtml checking file app/design/frontend/base/default/template/bundle/sales/order/creditmemo/items/renderer.phtml checking file app/design/frontend/base/default/template/bundle/sales/order/invoice/items/renderer.phtml checking file app/design/frontend/base/default/template/bundle/sales/order/items/renderer.phtml checking file app/design/frontend/base/default/template/bundle/sales/order/shipment/items/renderer.phtml checking file app/design/frontend/base/default/template/downloadable/checkout/multishipping/item/downloadable.phtml checking file app/design/frontend/base/default/template/downloadable/email/order/items/creditmemo/downloadable.phtml checking file app/design/frontend/base/default/template/downloadable/email/order/items/invoice/downloadable.phtml checking file app/design/frontend/base/default/template/downloadable/email/order/items/order/downloadable.phtml checking file app/design/frontend/base/default/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml checking file app/design/frontend/base/default/template/downloadable/sales/order/invoice/items/renderer/downloadable.phtml checking file app/design/frontend/default/iphone/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml checking file app/design/frontend/default/iphone/template/downloadable/sales/order/invoice/items/renderer/downloadable.phtml checking file app/design/frontend/default/iphone/template/downloadable/sales/order/items/renderer/downloadable.phtml checking file app/design/frontend/rwd/default/template/bundle/email/order/items/creditmemo/default.phtml checking file app/design/frontend/rwd/default/template/bundle/email/order/items/invoice/default.phtml checking file app/design/frontend/rwd/default/template/bundle/email/order/items/order/default.phtml checking file app/design/frontend/rwd/default/template/bundle/email/order/items/shipment/default.phtml checking file app/design/frontend/rwd/default/template/bundle/sales/order/items/renderer.phtml checking file app/design/frontend/rwd/default/template/downloadable/email/order/items/creditmemo/downloadable.phtml checking file app/design/frontend/rwd/default/template/downloadable/email/order/items/invoice/downloadable.phtml checking file app/design/frontend/rwd/default/template/downloadable/email/order/items/order/downloadable.phtml checking file app/locale/en_US/Mage_Adminhtml.csv checking file app/locale/en_US/Mage_Customer.csv checking file app/locale/en_US/template/email/account_password_reset_confirmation.html checking file app/locale/en_US/template/email/admin_new_user_notification.html checking file downloader/Maged/Controller.php checking file skin/adminhtml/default/enterprise/images/placeholder/thumbnail.jpg

Any idea what is missing?

protected by Community Nov 19 at 15:48

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.