0

can anyone help me to implementing a hotfix for PRODSECBUG-2198 on Magento open source 1.9 that doesn't require patching with supee-11086? For yet to be determined reasons, I haven't been able to install the previous four patches without causing a necessary extension to fail. I was ok with this because those patches fixed vulnerabilities which required a would be hacker to already have compromised an administrator account..

We have 1.9.2.2

Thanks!

  • PRODSECBUG-2198 is for Magento 2.X, right? So what is your exact query? – Raj Mohan R Apr 2 at 13:15
  • If you check the patch notes, under PRODSECBUG-2198 "Product(s) Affected", you will see "Magento Open Source prior to 1.9.4.1, and Magento Commerce prior to 1.14.4.1, Magento 2.1 prior to 2.1.17, Magento 2.2 prior to 2.2.8, Magento 2.3 prior to 2.3.1" – Klkcat Apr 2 at 14:05
  • The patch is for Magento 2.X versions only. The same issue has been fixed along with supee-11086 for Magento 1.X versions – Raj Mohan R Apr 2 at 14:36
2

This Security fix is already available with SUPEE-11086. You can find these lines in the patch

diff --git lib/Varien/Db/Adapter/Pdo/Mysql.php lib/Varien/Db/Adapter/Pdo/Mysql.php
index e6f48cf1c30..3d9b8010de8 100644
--- lib/Varien/Db/Adapter/Pdo/Mysql.php
+++ lib/Varien/Db/Adapter/Pdo/Mysql.php
@@ -2947,7 +2947,7 @@ class Varien_Db_Adapter_Pdo_Mysql extends Zend_Db_Adapter_Pdo_Mysql implements V
                 if (isset($condition['to'])) {
                     $query .= empty($query) ? '' : ' AND ';
                     $to     = $this->_prepareSqlDateCondition($condition, 'to');
-                    $query = $this->_prepareQuotedSqlCondition($query . $conditionKeyMap['to'], $to, $fieldName);
+                    $query = $query . $this->_prepareQuotedSqlCondition($conditionKeyMap['to'], $to, $fieldName);
                 }
             } elseif (array_key_exists($key, $conditionKeyMap)) {
                 $value = $condition[$key];

So you can apply the patch SUPEE-11086. Else if you need to only fix apply this fix you can follow the steps provided by Sam

0

Raj is correct in saying the PRODSECBUG-2198 patch is only for Magento 2, and they haven't released an equivalent for Magento 1.

Although if you want to patch PRODSECBUG-2198 on a Magento 1 install, then you can just extract the relevant patch hunks from the full patch and then apply them through a new file.

Create PRODSECBUG-2198.patch file in site root

diff --git lib/Varien/Db/Adapter/Pdo/Mysql.php lib/Varien/Db/Adapter/Pdo/Mysql.php
index db2f605f6c0..b0a790ed0db 100644
--- lib/Varien/Db/Adapter/Pdo/Mysql.php
+++ lib/Varien/Db/Adapter/Pdo/Mysql.php
@@ -2845,7 +2845,7 @@ class Varien_Db_Adapter_Pdo_Mysql extends Zend_Db_Adapter_Pdo_Mysql implements V
                 if (isset($condition['to'])) {
                     $query .= empty($query) ? '' : ' AND ';
                     $to     = $this->_prepareSqlDateCondition($condition, 'to');
-                    $query = $this->_prepareQuotedSqlCondition($query . $conditionKeyMap['to'], $to, $fieldName);
+                    $query = $query . $this->_prepareQuotedSqlCondition($conditionKeyMap['to'], $to, $fieldName);
                 }
             } elseif (array_key_exists($key, $conditionKeyMap)) {
                 $value = $condition[$key];

Then apply it with patch -p0 < PRODSECBUG-2198.patch

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.