2

So I have fixed my form key validation issues but my admin is still showing an error message.

Important: Formkey validation on checkout disabled. This may expose security risks. We strongly recommend to Enable Form Key Validation On Checkout in Admin / Security Section, for protect your own checkout process.

Does anyone know how i can get rid of this error? What file is this text on?

2
  • Have you set "Yes" for Enable Form Key Validation On Checkout at Admin / Security ?
    – Pawan
    Dec 17, 2018 at 17:18
  • Please see my updates in answer
    – Pawan
    Dec 18, 2018 at 17:30

1 Answer 1

1

You need to set "Yes" for Enable Form Key Validation On Checkout atAdmin / Security.

If you set Yes above error will gone!.

Important! Enabling this option means that your custom templates used in checkout process contain form_key output. Otherwise checkout may not work.

Update I

If you need to hide message without enabling Yes. You need to create a small module. In this module we will override system.xml and create a new source model.

Idea is if we set Enable Form Key Validation On Checkout to No message will display. You don't want to set it to Yes, So we need a third option.

Create following files:

app/etc/modules/Mago_Pawan.xml

<?xml version="1.0"?>
<config>
    <modules>
        <Mago_Pawan>
            <active>true</active>
            <codePool>local</codePool>
            <depends>
                <Mage_Catalog />
            </depends>
        </Mago_Pawan>
    </modules>
</config> 

app/code/local/Mago/Pawan/etc/config.xml

<?xml version="1.0"?>
<config>
    <modules>
        <Mago_Pawan>
            <version>0.0.1</version>
        </Mago_Pawan>
    </modules>
    <global>
        <models>
            <pawan>
                <class>Mago_Pawan_Model</class>
            </pawan>
        </models>
    </global>
</config>

app/code/local/Mago/Pawan/etc/system.xml

<?xml version="1.0"?>
<config>
    <sections>
        <admin>
            <groups>
                <security>
                    <fields>
                        <validate_formkey_checkout translate="label">
                            <label>Enable Form Key Validation On Checkout$$$$@@@</label>
                            <frontend_type>select</frontend_type>
                            <source_model>pawan/system_config_source_yesno</source_model>
                            <sort_order>4</sort_order>
                            <comment><![CDATA[<strong style="color:red">Important!</strong> Enabling this option means
                            that your custom templates used in checkout process contain form_key output.
                            Otherwise checkout may not work.]]></comment>
                            <show_in_default>1</show_in_default>
                        </validate_formkey_checkout>
                    </fields>
                </security>
            </groups>
        </admin>
    </sections>
</config>

app/code/local/Mago/Pawan/Model/System/Config/Source/Yesno.php

<?php
class Mago_Pawan_Model_System_Config_Source_Yesno
{

    /**
     * Options getter
     *
     * @return array
     */
    public function toOptionArray()
    {
        return array(
            array('value' => 2, 'label'=>Mage::helper('adminhtml')->__('I will manage')),
            array('value' => 1, 'label'=>Mage::helper('adminhtml')->__('Yes')),
            array('value' => 0, 'label'=>Mage::helper('adminhtml')->__('No')),
        );
    }

    /**
     * Get options in "key-value" format
     *
     * @return array
     */
    public function toArray()
    {
        return array(
            0 => Mage::helper('adminhtml')->__('No'),
            1 => Mage::helper('adminhtml')->__('Yes'),
            2 => Mage::helper('adminhtml')->__('I will manage'),
        );
    }

}

Note: After successful create/install module, you will see a third option. Just select this and it will work!

Update II

If you want comment/hide message without module you can check below file:

app/design/adminhtml/default/default/template/notification/formkey.phtml

<?php if ($this->canShow()): ?>
    <div class="notification-global notification-global-warning">
        <strong style="color:red">Important: </strong>
        <span>Formkey validation on checkout disabled. This may expose security risks.
        We strongly recommend to Enable Form Key Validation On Checkout in
        <a href="<?php echo $this->getSecurityAdminUrl(); ?>">Admin / Security Section</a>,
        for protect your own checkout process. </span>
    </div>
<?php endif; ?>

You can comment/hide entire code, above file is responsible for showing only this form_key message so it will not harm any other functionality.

If you look block class for above phtml, there is a function

public function canShow()
    {
        return !Mage::getStoreConfigFlag('admin/security/validate_formkey_checkout');
    } 

It is checking value of system config and based on value showing message in admin.

5
  • I have already fixed the issue but I do not want to set config to yes. I would like to remove the error from the code. Any idea where I can find this error?
    – DevAnd
    Dec 17, 2018 at 18:20
  • thank you. Is there a simpler way to hide this notice? Where is this notice in the code?
    – DevAnd
    Dec 18, 2018 at 18:50
  • it is very short module and only take less than 5 min. I have another solution, see my updates II in answer
    – Pawan
    Dec 19, 2018 at 3:27
  • Thanks so much! the second one worked fine.
    – DevAnd
    Dec 19, 2018 at 19:33
  • Great!, Always welcome :)
    – Pawan
    Dec 20, 2018 at 3:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.