We currently have a strange problem on our Magento shop.

When someone fills in the password fields in the checkout, to create an account. In that case when clicking the place order button on the checkout review page, it redirects to the homepage instead of the PSP.

It does create an account and place the order in the backend, but the customer is not re-directed to the payment page of the PSP.


Someone told us it could be related to the SUPEE-10570v1 patch, that could cause this problem. Magento released SUPEE-10570v2 that should solve it. But we are running Magento which should include the SUPEE-10570v2.

But for some reason Magento revert the changes from SUPEE-10570v2 inside SUPEE-10752.

When we are checking the SUPEE-10570v2 .sh file, we see the following lines:

+++ app/code/core/Mage/Customer/Model/Resource/Customer.php
@@ -235,9 +235,8 @@ class Mage_Customer_Model_Resource_Customer extends Mage_Eav_Model_Entity_Abstra
     public function changePassword(Mage_Customer_Model_Customer $customer, $newPassword)
-        $customer->setPassword($newPassword)->setPasswordCreatedAt(time());
+        $customer->setPassword($newPassword);
         $this->saveAttribute($customer, 'password_hash');
-        $this->saveAttribute($customer, 'password_created_at');
         return $this;

That means it removes the lines with the - sign and add the lines with the + sign. So the new file should not have the lines:

$this->saveAttribute($customer, 'password_created_at');

But when we check the file app/code/core/Mage/Customer/Model/Resource/Customer.php of the default Magento install, we see the following:

public function changePassword(Mage_Customer_Model_Customer $customer, $newPassword)
    $this->saveAttribute($customer, 'password_hash');
    $this->saveAttribute($customer, 'password_created_at');
    return $this;

The problem still exists even on a fresh and clean install of Magento But when we apply SUPEE-10570v2 over Magento, the problem is solved. But the code of Magento is newer and should include the right version of SUPEE-10570.

So we are a bit confused. What should we do in this case? Is this still a Magento bug that they should solve? Any help in here.

  • I also have this issue...... If you do find it can you let me know please – Andy Ellis Nov 9 '18 at 15:54
  • Please check the network activity in the developer console and show us the result which shows right after clicking at the button. – Black Nov 21 '18 at 13:30
  • are you asking to fix or why didn't magento include this in the latest release? – Haim Nov 28 '18 at 22:32
  • @Haim Both, but mainly to ask why they did not include the v2 fix in the next releases. – Henk Z Nov 29 '18 at 7:34
  • @HenkZ see my updated answer – Haim Nov 29 '18 at 15:18

Apparently it was never added even in , it seems that the community support for M1 is really dwindling so I'm not sure if this will ever be fixed :-(

You can try reporting it here

Edit: as per Haim's answer this bug should no longer be present in however the lines that were removed in SUPEE-10570v2 should be removed from magento's main repo.

  • 1
    you were wrong :( - look at my updated answer, they fixed it. – Haim Nov 29 '18 at 15:19

If you want to know why Magento didn't include the v2 fix in the next release, then @yehuda's answer is correct. As a matter of fact they didn't even add it to the 1.9.4 release - that file is the same as the release - see here

To fix your issue - you just need to manually apply that piece of the patch.
Replace the changePassword function in app/code/core/Mage/Customer/Model/Resource/Customer.php on line 236

public function changePassword(Mage_Customer_Model_Customer $customer, $newPassword)
    $this->saveAttribute($customer, 'password_hash');
    $this->saveAttribute($customer, 'password_created_at');
    return $this;

with this

    public function changePassword(Mage_Customer_Model_Customer $customer, $newPassword)
    $this->saveAttribute($customer, 'password_hash');
    return $this;

You should always make such changes in the locla directory, so

  • First copy app/code/core/Mage/Customer/Model/Resource/Customer.php to app/code/local/Mage/Customer/Model/Resource/Customer.php
  • Then change the changePassword function and you'll be set.


I was 100% wrong - Magento fixed it. Here's how:

in app/code/core/Mage/Checkout/Model/Type/Onepage.php they added at line 732 to 734

    $passwordCreatedTime = $this->_checkoutSession->getData('_session_validator_data')['session_expire_timestamp']
        - Mage::getSingleton('core/cookie')->getLifetime();

Make sure that your code (magento has that in there and you should be set.

  • I tested it on a clean magento and got the bug
  • I tested it on a clean magento and did not get the bug
  • I tested it on a magento with those three lines commented out and got the bug
  • Many thanks Haim! We are running with the 'updated' Onepage.php file, these lines are already there, but still facing the issue. When creating an account in the checkout, customers are redirected to the homepage. – Henk Z Nov 29 '18 at 15:57
  • Are you using the default Magento one page checkout? – Haim Nov 29 '18 at 15:59
  • Yes, we are running the default Magento checkout. – Henk Z Nov 29 '18 at 21:33
  • very strange - any modules on? did you apply any of the patches? something is causing this behavior but I don't think it's the issue you initially thought it was i.e patch SUPEE-10570v2 – Haim Nov 29 '18 at 21:35
  • Yes it is, we already applied all default code of and that also did not work. Issue is still there. I know, but I really can not find the problem. The main problem is that the log's are also empty, so it is really hard to debug. Any ideas? – Henk Z Nov 30 '18 at 7:31

Got this problem again after updating from to, is there a fix? The problem is it doesn't happend all the time and there are no errors in log!

  • @HenkZ did you find the problem? – Mike Oct 16 at 13:54
  • Find the issue, the password_created_at (attribute_code) in the database eav_attribute was set to entity_type_id 10 instead of 1. Got no idea what rigger this change in de database. Set it back to ID 1 and problem is solved – Mike 2 days ago

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.