SUPEE-10975 has been released, it would be great to know if anyone runs into any issues while trying to apply this, will this conflict with the most recent patch that adds 7.2 support?

So far these are the changed files I can see


Has anyone ran into any issues with these changes?

15 Answers 15


So far, I have come across the following issues with the SUPEE-10975 patch:

  • It is not possible anymore to delete customer groups via the admin because of a missing return statement in the new method Mage_Adminhtml_Block_Customer_Group_Edit::getDeleteUrl (issue found by @mikhail-chelevich). This is the case when secret keys are enabled for the admin, which is the default. The issue is also present in This issue is fixed by the SUPEE-11043 patch, which has not been offically released, but is available as a GitHub Gist.
  • The Mage_Sendfriend module cannot be disabled without also disabling the Mage_Captcha module. Otherwise, the following core exception occurs: Module "Mage_Captcha" requires module "Mage_Sendfriend". (issue found by @zlep)
  • The changes to the sendfriend/send.phtml template that have been made in the rwd/default theme are not made in the base/default theme. This means that for the base/default theme the CAPTCHA cannot be enabled, and also that names and emails of previously entered recipients are not shown on the page (for the typical case of a form submit that triggers a server-side validation error).
  • The new method Mage_Sendfriend_Block_Send::getRecipientsCount introduces a PHP 7.2 incompatibility because a count is performed on a NULL value when loading the page without any recipients (which is the default on fresh page load). This issue has been fixed in

Note that I have only checked the patch for, but I suspect the issues are present in all versions of the patch.

  • Where to check for "count is performed on a NULL" issue ? Commented Oct 28, 2020 at 6:44
  • app/code/core/Mage/Sendfriend/Block/Send.php Commented Oct 29, 2020 at 14:06

Missing return parent::getDeleteUrl() in app/code/core/Mage/Adminhtml/Block/Customer/Group/Edit.php

+    public function getDeleteUrl()
+    {
+        if (!Mage::getSingleton('adminhtml/url')->useSecretKey()) {
+            return $this->getUrl('*/*/delete', array(
+                $this->_objectId => $this->getRequest()->getParam($this->_objectId),
+                'form_key' => Mage::getSingleton('core/session')->getFormKey()
+            ));
+        } else {
+            parent::getDeleteUrl();
+        }
+    }
  • What Magento version was this for?
    – danmentzer
    Commented Nov 29, 2018 at 19:27
  • 1
    I can confirm this issue: it is not possible anymore to delete customer groups via the admin. This happens when secret keys are enabled for the admin, which is the default. This is present in de the SUPEE-10975 patch, and also in Magento Open Source Commented Nov 30, 2018 at 13:20
  • An additional patch has been created to resolve this SUPEE-11043
    – Andrew
    Commented Dec 1, 2018 at 19:06
  • @andrew I cant find anything about SUPEE-11043. can you link some sources?
    – darnok
    Commented Dec 3, 2018 at 13:02
  • 1
    So the fix should be replacing parent::getDeleteUrl(); in app/code/core/Mage/Adminhtml/Block/Customer/Group/Edit.php with return parent::getDeleteUrl(); Commented Dec 5, 2018 at 14:59

I ran into an issue with the 10975 patch. After some investigation I was able to track down the answer as to where the patch was messing up and why.

To summarize the below check and make sure you patched SUPEE 9767 V2 properly. That is the root of my issue.

sh PATCH_SUPEE-10975_EE_v1.12.0.2_v1-2018-11-27-10-36-30.sh
Checking if patch can be applied/reverted successfully...
ERROR: Patch can't be applied/reverted successfully.

patching file app/code/core/Enterprise/PageCache/Model/Processor.php
Hunk #1 succeeded at 690 (offset -3 lines).
patching file app/code/core/Enterprise/Pci/etc/config.xml
patching file app/code/core/Enterprise/Wishlist/Block/Customer/Sharing.php
patching file app/code/core/Mage/Adminhtml/Block/Customer/Group/Edit.php
patching file app/code/core/Mage/Adminhtml/Block/Newsletter/Template/Edit.php
patching file app/code/core/Mage/Adminhtml/controllers/Cms/BlockController.php
patching file app/code/core/Mage/Adminhtml/controllers/Customer/GroupController.php
patching file app/code/core/Mage/Adminhtml/controllers/SitemapController.php
patching file app/code/core/Mage/Adminhtml/controllers/System/BackupController.php
patching file app/code/core/Mage/Captcha/Model/Observer.php
patching file app/code/core/Mage/Captcha/Model/Zend.php
patching file app/code/core/Mage/Captcha/etc/config.xml
patching file app/code/core/Mage/Catalog/Model/Api2/Product/Image/Rest/Admin/V1.php
patching file app/code/core/Mage/Catalog/Model/Product/Attribute/Media/Api.php
patching file app/code/core/Mage/Cms/Model/Wysiwyg/Images/Storage.php
patching file app/code/core/Mage/Core/etc/config.xml
Hunk #1 FAILED at 28.
1 out of 3 hunks FAILED -- saving rejects to file app/code/core/Mage/Core/etc/config.xml.rej
patching file app/code/core/Mage/Core/sql/core_setup/upgrade-
patching file app/code/core/Mage/Dataflow/Model/Convert/Container/Abstract.php
patching file app/code/core/Mage/ImportExport/Model/Import/Entity/Customer.php
patching file app/code/core/Mage/ImportExport/Model/Import/Entity/Customer/Address.php
patching file app/code/core/Mage/Payment/etc/config.xml
patching file app/code/core/Mage/Payment/etc/system.xml
patching file app/code/core/Mage/Payment/sql/payment_setup/upgrade-
patching file app/code/core/Mage/Wishlist/controllers/IndexController.php
patching file app/code/core/Zend/Controller/Request/Http.php
patching file app/design/adminhtml/default/default/template/cms/browser/content/files.phtml
patching file app/design/adminhtml/default/default/template/enterprise/cms/page/preview/revision.phtml
patching file app/design/adminhtml/default/default/template/enterprise/customersegment/report/detail/grid/container.phtml
patching file app/design/adminhtml/default/default/template/enterprise/giftregistry/customer/form.phtml
patching file app/design/adminhtml/default/default/template/enterprise/staging/log/information/merge.phtml
patching file app/design/adminhtml/default/default/template/enterprise/staging/log/information/rollback.phtml
patching file app/design/frontend/base/default/layout/captcha.xml
patching file app/design/frontend/base/default/template/wishlist/sharing.phtml
patching file app/design/frontend/enterprise/iphone/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml
patching file app/etc/modules/Mage_All.xml
patching file app/etc/modules/Mage_Captcha.xml
patching file app/locale/en_US/Enterprise_Wishlist.csv
patching file app/locale/en_US/Mage_Wishlist.csv
patching file js/enterprise/adminhtml/staging.js

Above is the error I hit which is specific to this file.


The error comes from this line of the patch.

diff --git app/code/core/Mage/Core/etc/config.xml app/code/core/Mage/Core/etc/config.xml
index 4aebdcdc2cf..4b28f2765a1 100644
--- app/code/core/Mage/Core/etc/config.xml
+++ app/code/core/Mage/Core/etc/config.xml
@@ -28,7 +28,7 @@
-            <version></version>
+            <version></version>

The version listed here doesn't match correctly because of manually patching

SUPEE 9767 v2

That patch came with this line that I missed when manually patching.

diff --git app/code/core/Mage/Core/etc/config.xml app/code/core/Mage/Core/etc/config.xml
index 4a0ff1b..d0de702 100644
--- app/code/core/Mage/Core/etc/config.xml
+++ app/code/core/Mage/Core/etc/config.xml
@@ -28,7 +28,7 @@
-            <version></version>
+            <version></version>

Firstly, sorry for the duplicate of erej's answer, i can't comment nor edit because of my reputation score.

The patch creates a new file here : app/code/core/Zend/Controller/Request/Http.php

Which is added to override this file : lib/Zend/Controller/Request/Http.php

Problem is for Magento under (EE :

This method :

 * Everything in REQUEST_URI before PATH_INFO
 * <form action="<?=$baseUrl?>/news/submit" method="POST"/>
 * @return string
public function getBaseUrl($raw = false)
    if (null === $this->_baseUrl) {

    return (($raw == false) ? urldecode($this->_baseUrl) : $this->_baseUrl);

Is overridden in Magento Core file app/code/core/Mage/Core/Controller/Request/Http.php

public function getBaseUrl()
    $url = parent::getBaseUrl();
    $url = str_replace('\\', '/', $url);
    return $url;

Which does'nt take any arguments.

So it fires this strict notice on any website url, front & admin :

Strict Notice: Declaration of Mage_Core_Controller_Request_Http::getBaseUrl() should be compatible with Zend_Controller_Request_Http::getBaseUrl($raw = false) in /var/www/htdocs/app/code/core/Mage/Core/Controller/Request/Http.php on line 36

If someone knows if any V2 of that patch is on the way, please let me know.

Waiting for their update, you can redefine method in app/code/core/Mage/Core/Controller/Request/Http.php like that:

 * @param bool $raw - Added manually to correct SUPEE-10975 oversight
 *      See https://magento.stackexchange.com/questions/251317/supee-10975-potential-issues
 *      for more information
 * @return mixed|string
public function getBaseUrl($raw = false)
    $url = parent::getBaseUrl($raw); // Argument added manually to correct SUPEE-10975 oversight
    $url = str_replace('\\', '/', $url);
    return $url;

With version after applying this patch we also had to change app/code/core/Mage/Core/Controller/Request/Http.php::getBaseUrl() function to be

public function getBaseUrl($raw = false)
    $url = parent::getBaseUrl($raw);
    $url = str_replace('\\', '/', $url);
    return $url;

because this patch adds app/code/core/Zend/Controller/Request/Http.php file and getBaseUrl() function is declared with parameter $raw = false.

  • It shouldn't be necessary to add this function. It will just always default to not raw, because any functionality calling this function should not have $raw set in 1.8.1. Commented Dec 5, 2018 at 14:51

I have a problem with 'Hunk #1 FAILED at 28'

Rejects are supposedly saved to config.xml.rej but this file doesn't exist, neither is there any description of what part of the script failed in my terminal window. Basically the patch fails and there is no indication why - at least not to a dumbass like me!

On first run the patch attempted to delete three jquery v 1.12.0 files which didn't exist, I replaced these and applied the patch again but it now fails without any useful description.

Magento fully patched apart from the PHP 7.2 compatibility update, it will remain unpatched unless I can work it out or someone on here can give me a clue (please!) Thanks H

PS I'm not sure if my post contravenes SE guidelines, I am answering the original question but I'm also asking for help.

  • 1
    I ran into this issue as well it is related to the patch 9767 v2 it adds a new version number to the Mage/Core/etc/config.xml You should just need to add onto the current version number .1.2 I will also be writing an answer for this as well.
    – danmentzer
    Commented Nov 29, 2018 at 19:02

The Mage_Backup Module will be disabled by the patch.

This is mentioned in the official release notes (https://devdocs.magento.com/guides/m1x/ce19-ee114/ce1.9_release-notes.html#ce19-1940).

However the suggested solution to re-enable it is wrong:

("Alternatively, you can use one of these two methods to enable database backups")

You actually need to use both methods mentioned to fully re-enable it.

  • 2
    Also remember that re-enabling the Mage_Backup module opens you up to: "remote code execution (RCE), cross-site scripting (XSS), and cross-site request forgery (CSRF) issues." Commented Dec 5, 2018 at 13:26

There can be issues with handling tax calculation correctly.

As is customary in many countries, our customer uses the "prices include taxes" configuration of Magento.

So, after the update from to, the tax got added to the grand total in checkout, on top of the item prices already including taxes.

I tracked the issue down to a change in the configuration in file app/code/core/Mage/Sales/etc/config.xml, where "msrp" was added to the node sales/quote/totals/shipping/after.

I did not find anything regarding MSRP in the release notes and I hope that this is an isolated change without any side-effects.

My solution was to change this node back to its original value "subtotal,freeshipping,tax_subtotal" without the "msrp". I did so in the etc/config.xml of my own module.


Specific problem, but if you disabled Mage_Sendfriend (which previously was a module you could safely disable) it will throw an exception error.

  • 1
    They made Mage_Captcha depended on Mage_Sendfriend instead of the other way around. So you need to also deactivate Mage_Captcha to disable Mage_Sendfriend. Which might not be what you want because it disables all Magento default recaptcha's Commented Dec 5, 2018 at 15:08

I tried to upgrade from Magento CE to today and I had multiple errors. Fortunately it didn't mess up the installation. After the installation I got the dreaded - Internal Server Error. I did get locked out and I had to reset all of my file and folder permissions via SSH along with removing the maintenance.flag. I then reindexed and re-enabled the cache. Plus I had to revert to my old .htaccess file in the Root and Download folder. Not sure what the corrective action should be to get a successful installation. I forgot to copy the text from the command-line window. So I can't post all the errors. What I did see was incompatible messages.

  • 1
    I dont think "upgrade" method through downloader ever worked on any installation that is at least a little edited. Am I crazy? Commented Nov 30, 2018 at 21:03
  • The "upgrade" method using Magento Connect works every single time for me. I use it for all three of our M1 sites and they are all heavily (though properly) customized. Commented Jan 21, 2019 at 19:10

Did they remove Scheduled Backup? No Scheduled Backup Section

Or I have some kind of a problem? Why is there no mention of this in any of the notes? This seems to be a pattern with Magento where they dont mention changes like these when updates come out.

UPDATE: looks like they removed it completely from all versions.

UPDATE: had to do backups differently. If anybody interested I posted some of the CRON commands here: Back-up strategy post SUPEE-10975?

  • Is this for any specific version?
    – Razentic
    Commented Nov 30, 2018 at 12:45
  • 2
    Per twitter.com/ryanhoerr/status/1067819214314987520 That is a specific part they removed per this patch.
    – danmentzer
    Commented Nov 30, 2018 at 14:17
  • Oh god...ok classic - gotta find out from some other source then magento about removal / addition of features. Commented Nov 30, 2018 at 16:29
  • 1
    @KalvinKlien actually, first paragraph in the release notes states that it's been deactivated; devdocs.magento.com/guides/m1x/ce19-ee114/… Commented Dec 4, 2018 at 9:40
  • 3
    The change in this patch is that Mage_Backup is deactivated by default and the checks for running the code are stricter (eg. if block output for the module is deactivated the backups wont run). You can still manually re-enable the module by changing false to true in the Mage_Backup section of app/etc/modules/Mage_All.xml. Be careful that re-enabling the backup functionality potentially allows: "remote code execution (RCE), cross-site scripting (XSS), and cross-site request forgery (CSRF) issues." Commented Dec 5, 2018 at 13:13

We saw an issue on a site that was using a custom multi-store configuration by a previous developer. All URLs for stores other than the base store were 404ing. It set the "HTTP_X_REWRITE_URL" server variable/HTTP Header, which changed the URL as processed by the Magento Request.

This variable is/was used by \Zend_Controller_Request_Http::setRequestUri(), but the new version in app/code/core/Zend/Controller/Request/Http.php no longer uses this. The possible fixes were:

  • Set $_SERVER["IIS_WasUrlRewritten"] to '1' and instead set $_SERVER["UNENCODED_URL"]
  • Set $_SERVER["REQUEST_URI"] instead

Either would probably work, but the former is probably less likely to have unintended consequences as it functions closer to the previous system.


Specific error with Payment Method is not available

We got a lot of The requested Payment Method is not available errors thrown by Magento. All on orders where the payment method in the product return was ccsave, which was removed by this supee in config.xml.

The error is being thrown because Magento is looking for a $key (the payment method ccsave in this case) by checking the xml paths: payment/ccsave/model. If it doesn't find it, it throws an error. So we just did a git checkout [insert supee commit]^ app/code/core/Mage/Payment/etc/config.xml and pushed to master to fix the error.


public function getMethodInstance($code)
    $key = self::XML_PATH_PAYMENT_METHODS.'/'.$code.'/model';
    $class = Mage::getStoreConfig($key);
    return Mage::getModel($class);



Change to app/code/core/Mage/Cms/Model/Wysiwyg/Images/Storage.php causes (another) bug that thumbnails not generated correctly ... details 1.9.4 thumbnails not generated correctly in media dir


Probably not, but version already have both implemented anyway.

  • 1
    These stack posts are specifically so other dev's can be aware of issues your answer to this is not helpful or descriptive about any issue. I would honestly just remove this.
    – danmentzer
    Commented Dec 13, 2018 at 16:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.