28

Magento has released a new security patch for M1, and updates for M1 and M2.

What common issues do you have to watch out for when applying this patch/upgrade?

Magento 1

https://magento.com/security/patches/supee-11155

Magento 2

This should be the last release in the 2.1 series which reaches its EOL at the end of this month.

  • 1
    has anybody tested what in the world this means: "Quotes created by customers who are logged in as guest are no longer accessible after a Magento update. Third-party checkout extensions and closed security cases will either not not work securely or will not work at all." ? – Kalvin Klien Jun 25 '19 at 19:31
  • I am quite interested in the changes referenced by fixed bug PRODSECBUG-2330 – Richie Frame Jun 27 '19 at 0:27

20 Answers 20

12

Error installing on 1.7.0.2 CE with all previous patches installed (see below).

EDIT: Issue (#1) was caused by missing file - app/code/core/Mage/Catalog/Model/Product/Option/Type/File.php.orig

Issue (#1) resolved by removing lines 874 - 1702 (referring to File.php.orig) from the patch script.

Issue (#2) was caused due to improper formatting of patch and file - js/tiny_mce/plugins/media/js/media.js

Issue (#2) was resolved by running dos2unix command for both patch file and media.js file

Patch installed successfully after resolution of the two described issues.

Checking if patch can be applied/reverted successfully...

ERROR: Patch can't be applied/reverted successfully.

patching file app/Mage.php patching file app/code/core/Mage/Admin/Model/Block.php patching file app/code/core/Mage/Admin/Model/User.php patching file app/code/core/Mage/AdminNotification/etc/system.xml patching file app/code/core/Mage/Adminhtml/Block/Api/Role/Grid/User.php patching file app/code/core/Mage/Adminhtml/Block/Catalog/Product/Edit/Tab/Super/Config.php patching file app/code/core/Mage/Adminhtml/Block/Newsletter/Queue/Preview.php patching file app/code/core/Mage/Adminhtml/Block/Newsletter/Template/Preview.php patching file app/code/core/Mage/Adminhtml/Block/Permissions/Role/Grid/User.php patching file app/code/core/Mage/Adminhtml/Block/Sales/Creditmemo/Grid.php patching file app/code/core/Mage/Adminhtml/Block/Sales/Invoice/Grid.php patching file app/code/core/Mage/Adminhtml/Block/Sales/Order/Create/Header.php patching file app/code/core/Mage/Adminhtml/Block/Sales/Order/Creditmemo/Create.php patching file app/code/core/Mage/Adminhtml/Block/Sales/Order/Grid.php patching file app/code/core/Mage/Adminhtml/Block/Sales/Order/Invoice/Create.php patching file app/code/core/Mage/Adminhtml/Block/Sales/Order/Shipment/Create.php patching file app/code/core/Mage/Adminhtml/Block/Sales/Order/View.php patching file app/code/core/Mage/Adminhtml/Block/Sales/Shipment/Grid.php patching file app/code/core/Mage/Adminhtml/Block/Sales/Transactions/Grid.php patching file app/code/core/Mage/Adminhtml/Block/System/Email/Template/Preview.php patching file app/code/core/Mage/Adminhtml/Block/Template.php patching file app/code/core/Mage/Adminhtml/Block/Widget/Grid/Column/Renderer/Abstract.php patching file app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator.php patching file app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Baseurl.php patching file app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Locale.php patching file app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Serialized/Array.php patching file app/code/core/Mage/Adminhtml/controllers/Catalog/Product/AttributeController.php patching file app/code/core/Mage/Adminhtml/controllers/Catalog/Product/ReviewController.php patching file app/code/core/Mage/Adminhtml/controllers/Catalog/ProductController.php patching file app/code/core/Mage/Adminhtml/controllers/Checkout/AgreementController.php patching file app/code/core/Mage/Adminhtml/controllers/Newsletter/TemplateController.php patching file app/code/core/Mage/Adminhtml/controllers/Promo/CatalogController.php patching file app/code/core/Mage/Adminhtml/controllers/Promo/QuoteController.php patching file app/code/core/Mage/Adminhtml/controllers/Sales/Order/CreateController.php patching file app/code/core/Mage/Adminhtml/controllers/SitemapController.php patching file app/code/core/Mage/Adminhtml/controllers/System/Email/TemplateController.php patching file app/code/core/Mage/Catalog/Helper/Product.php The next

patch would delete the file app/code/core/Mage/Catalog/Model/Product/Option/Type/File.php.orig, which does not exist!
Assume -R? [n]
Apply anyway? [n]
Skipping patch. 1 out of 1 hunk ignored patching file

app/code/core/Mage/Catalog/controllers/Product/CompareController.php patching file app/code/core/Mage/Checkout/Model/Session.php patching file app/code/core/Mage/Checkout/controllers/OnepageController.php patching file app/code/core/Mage/Cms/Helper/Data.php patching file app/code/core/Mage/Cms/Model/Wysiwyg/Config.php patching file app/code/core/Mage/Cms/etc/config.xml patching file app/code/core/Mage/Compiler/Model/Process.php patching file app/code/core/Mage/Core/Helper/Abstract.php patching file app/code/core/Mage/Core/Helper/Data.php patching file app/code/core/Mage/Core/Model/Design/Package.php patching file app/code/core/Mage/Core/Model/Email/Template/Filter.php patching file app/code/core/Mage/Core/Model/File/Validator/AvailablePath.php patching file app/code/core/Mage/Core/Model/Observer.php patching file app/code/core/Mage/Core/etc/config.xml patching file app/code/core/Mage/Core/functions.php patching file app/code/core/Mage/CurrencySymbol/Model/System/Currencysymbol.php patching file app/code/core/Mage/Downloadable/controllers/DownloadController.php patching file app/code/core/Mage/SalesRule/Model/Coupon/Massgenerator.php patching file app/code/core/Mage/SalesRule/Model/Resource/Report/Rule/Createdat.php patching file app/code/core/Mage/Sendfriend/etc/config.xml patching file app/code/core/Mage/Sendfriend/etc/system.xml patching file app/design/adminhtml/default/default/template/catalog/product/composite/fieldset/configurable.phtml patching file app/design/adminhtml/default/default/template/catalog/product/helper/gallery.phtml patching file app/design/adminhtml/default/default/template/catalog/product/tab/inventory.phtml patching file app/design/adminhtml/default/default/template/currencysymbol/grid.phtml patching file app/design/adminhtml/default/default/template/customer/tab/addresses.phtml patching file app/design/adminhtml/default/default/template/customer/tab/view.phtml patching file app/design/adminhtml/default/default/template/notification/window.phtml patching file app/design/adminhtml/default/default/template/sales/order/create/data.phtml patching file app/design/adminhtml/default/default/template/sales/order/view/info.phtml patching file app/design/adminhtml/default/default/template/system/currency/rate/matrix.phtml patching file app/locale/en_US/Mage_Adminhtml.csv patching file app/locale/en_US/Mage_Core.csv patching file app/locale/en_US/Mage_Sales.csv patching file app/locale/en_US/Mage_Sitemap.csv patching file js/mage/adminhtml/wysiwyg/tiny_mce/setup.js patching file js/tiny_mce/plugins/media/js/media.js

Hunk #1 FAILED at 434. 1 out of 1 hunk FAILED -- saving rejects to file js/tiny_mce/plugins/media/js/media.js.rej patching file

js/varien/js.js patching file lib/phpseclib/PHP/Compat/Function/array_fill.php patching file lib/phpseclib/PHP/Compat/Function/bcpowmod.php patching file lib/phpseclib/PHP/Compat/Function/str_split.php

| improve this answer | |
  • Thank you. These two issues were also the ones I faced with 1.7.0.2 and PATCH_SUPEE-11155_CE_1.7.0.2_v3-2019-06-18-08-07-47.sh – Anthony Jun 26 '19 at 23:00
  • Spot on for 1.7.0.2 issues. – shaune Jul 2 '19 at 16:55
11

This patch is incompatible with the PHP 7.2 support patch. Removing lines 1711 to 1761 allows to apply the patch. This patch tries to patch files that have been removed by the 7.2 support patch. Removing these lines should be safe.

| improve this answer | |
  • 1
    Which M1 version are you on (or which patch version did you download)? We're on a custom patched 1.7 so we'll need to take a closer look – Laura Jun 26 '19 at 16:26
  • 1
    @Laura I'm on 1.9.2 – Michael Thessel Jun 26 '19 at 18:11
  • 1
    There's a new version of the patch out, v4, that handles PHP 7.2. – Laura Aug 1 '19 at 22:06
9

Magento 1.9.1.0.

Patch was applied successfully.

After adding a product to the cart and then logging in, the cart is empty again.

I don't think the issue was there before and there seem to be changes made to app/code/core/Mage/Checkout/Model/Session.php

UPDATE:

I've debugged this a little bit.

When I revert the patched version of app/code/core/Mage/Checkout/Model/Session.php it works again for me. So I'm pretty sure it has to do with the patch.

I first thought that it was in conjunction with $quote->unsetData(); but my tests were inconclusive and it wouldn't be a fix anyway to remove it.

Since I'm on vacation right now I have limited time to investigate this further.

UPDATE 2:

This issue seems to be resolved with the latest patch (SUPEE-11219). There were changes to app/code/core/Mage/Checkout/Model/Session.php included.

| improve this answer | |
  • Magento has a note in release notes: "Quotes created by customers who are logged in as guest are no longer accessible after a Magento update. Third-party checkout extensions and closed security cases will either not not work securely or will not work at all.". I'm asking them right now for clarification. devdocs.magento.com/guides/m1x/ce19-ee114/… – Kalvin Klien Jun 26 '19 at 15:15
  • Hi @Claudio, have you found any solution/answer to that issue? I'm currently facing the same one: add to cart -> checkout -> account creation -> back to homepage, empty cart, but logged in... Thank you in advance. – Antoine Kociuba Sep 11 '19 at 18:56
  • Hey @AntoineKociuba, unfortunately not. I haven't really looked for a solutionen though to be honest. – Claudio Sep 21 '19 at 18:18
  • This issue seems to be resolved with the latest patch (SUPEE-11219). There were changes to app/code/core/Mage/Checkout/Model/Session.php included. – Claudio Nov 21 '19 at 9:53
7

On M1, specifically 1.9.2.1 w/ all previous patches applied. I got the following error:

Hunk #1 FAILED at 483.
1 out of 1 hunk FAILED -- saving rejects to file js/tiny_mce/plugins/media/js/media.js.rej

Removing the lines about that file from the patch file and manually applying that change worked for me when I re-applied the patch file.

When I looked at the difference between the js/tiny_mce/plugins/media/js/media.js file and the one from OpenMage Mirror they were identical files.

| improve this answer | |
  • That file hasnt been touched by any patches or manual updates at all. This seems like a problem in the patch? Looking at the name of it, it looks like there has been already 1-3 versions before it was released. – Kalvin Klien Jun 25 '19 at 19:59
  • Had this problem on 1.9.1.1 with all previous patches applied. Replacing js/tiny_mce/plugins/media/js/media.js with the file from the OpenMage Mirror worked for me. Although the content of the files were identical, I think the line endings on my existing file were wrong for some reason. – wr125 Jun 26 '19 at 11:24
  • 5
    Running dos2unix on the patch before applying fixed the issue for us. Previously failing as per above, completed successfully after. – joesk Jun 26 '19 at 11:58
  • Running dos2unix on the patch file solved this issue for me on 1.9.2.3, but I didn't find it was required on 1.9.2.1 (I tried it out of curiosity and it caused the patch to fail). – Dave Herbert Jun 26 '19 at 13:27
5

1.9.1.0, after applied patch successfully, get below error when login admin

Fatal error: Call to undefined function random_int() in /app/code/core/Mage/Core/Helper/Data.php on line 257 

how to fix?

| improve this answer | |
  • Also following upgrade from 1.9.4.1 to 1.9.4.2 we experience the same issue. – joesk Jun 26 '19 at 12:04
  • I get the same issue in 1.9.4.1 with 11155. – seanbreeden Jun 26 '19 at 14:38
  • 7
    The problem turned out to be an override of app/code/core/Mage/Core/functions.php. Make sure no one has overridden this file or the patch will fail with the call to undefined function error. Look in "app/code/local/Mage/Core/functions.php" – seanbreeden Jun 26 '19 at 15:48
  • 1
    you are very right. – jun Jul 12 '19 at 14:11
  • 1
    Thank you very much @seanbreeden! – Mauricio Paz Sep 4 '19 at 13:24
3

On M1, 1.9.1.0 with all previous patches applied, I get numerous errors:

checking file app/Mage.php 
Hunk #1 FAILED at 813. 
1 out of 1 hunk FAILED

checking file app/code/core/Mage/Adminhtml/Block/Catalog/Product/Edit/Tab/Super/Config.php
Hunk #1 FAILED at 155.
1 out of 1 hunk FAILED

checking file app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator.php
Hunk #1 FAILED at 180.
1 out of 1 hunk FAILED

checking file app/code/core/Mage/Cms/Helper/Data.php
Hunk #1 FAILED at 37.
Hunk #2 succeeded at 58 with fuzz 2 (offset -16 lines).
1 out of 2 hunks FAILED

checking file app/design/adminhtml/default/default/template/catalog/product/helper/gallery.phtml
Hunk #1 FAILED at 59.
1 out of 1 hunk FAILED

checking file js/tiny_mce/plugins/media/js/media.js
Hunk #1 FAILED at 483 (different line endings).
1 out of 1 hunk FAILED

Taking a look at the code itself in the patch file, it appears that it doesn't match the PHP in my installation at all.

Maybe I missed a patch somewhere along the way?

| improve this answer | |
  • I think you have skipped a patch probably. Check your /app/etc/applied.patches.list – Kalvin Klien Jun 25 '19 at 20:01
  • see: magento.stackexchange.com/a/280148/202 regarding Hunk #1 FAILED at 59 on gallery.phtml - possible you have that change in your code as well? – ProxiBlue Jun 29 '19 at 1:09
  • @Matt Did you figure out which patch you missed? – rupi Jul 8 '19 at 14:35
3

Magento 1.7.0.2

I'm getting:

Hunk #1 succeeded at 113 with fuzz 2 (offset 4 lines).
checking file js/tiny_mce/plugins/media/js/media.js
checking file js/varien/js.js

Hunk #1 succeeded at 707 (offset 5 lines).
checking file lib/phpseclib/PHP/Compat/Function/array_fill.php
checking file lib/phpseclib/PHP/Compat/Function/bcpowmod.php
checking file lib/phpseclib/PHP/Compat/Function/str_split.php

Are these from PHP 7.2 patch?

UPDATE: looks like those files were actually ok, it was just empty space offset.

The problem file was:

checking file app/code/core/Mage/Catalog/Model/Product/Option/Type/File.php.orig

I think it was some file that was left over by one of the patches. The new patch just deletes that file. I didn't have it in that directory, so the error showed up.

UPDATE: list of affected files on Magento 1.7.0.2

app/Mage.php
app/code/core/Mage/Admin/Model/Block.php
app/code/core/Mage/Admin/Model/User.php
app/code/core/Mage/AdminNotification/etc/system.xml
app/code/core/Mage/Adminhtml/Block/Api/Role/Grid/User.php
app/code/core/Mage/Adminhtml/Block/Catalog/Product/Edit/Tab/Super/Config.php
app/code/core/Mage/Adminhtml/Block/Newsletter/Queue/Preview.php
app/code/core/Mage/Adminhtml/Block/Newsletter/Template/Preview.php
app/code/core/Mage/Adminhtml/Block/Permissions/Role/Grid/User.php
app/code/core/Mage/Adminhtml/Block/Sales/Creditmemo/Grid.php
app/code/core/Mage/Adminhtml/Block/Sales/Invoice/Grid.php
app/code/core/Mage/Adminhtml/Block/Sales/Order/Create/Header.php
app/code/core/Mage/Adminhtml/Block/Sales/Order/Creditmemo/Create.php
app/code/core/Mage/Adminhtml/Block/Sales/Order/Grid.php
app/code/core/Mage/Adminhtml/Block/Sales/Order/Invoice/Create.php
app/code/core/Mage/Adminhtml/Block/Sales/Order/Shipment/Create.php
app/code/core/Mage/Adminhtml/Block/Sales/Order/View.php
app/code/core/Mage/Adminhtml/Block/Sales/Shipment/Grid.php
app/code/core/Mage/Adminhtml/Block/Sales/Transactions/Grid.php
app/code/core/Mage/Adminhtml/Block/System/Email/Template/Preview.php
app/code/core/Mage/Adminhtml/Block/Template.php
app/code/core/Mage/Adminhtml/Block/Widget/Grid/Column/Renderer/Abstract.php
app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator.php
app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Baseurl.php
app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Locale.php
app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Serialized/Array.php
app/code/core/Mage/Adminhtml/controllers/Catalog/Product/AttributeController.php
app/code/core/Mage/Adminhtml/controllers/Catalog/Product/ReviewController.php
app/code/core/Mage/Adminhtml/controllers/Catalog/ProductController.php
app/code/core/Mage/Adminhtml/controllers/Checkout/AgreementController.php
app/code/core/Mage/Adminhtml/controllers/Newsletter/TemplateController.php
app/code/core/Mage/Adminhtml/controllers/Promo/CatalogController.php
app/code/core/Mage/Adminhtml/controllers/Promo/QuoteController.php
app/code/core/Mage/Adminhtml/controllers/Sales/Order/CreateController.php
app/code/core/Mage/Adminhtml/controllers/SitemapController.php
app/code/core/Mage/Adminhtml/controllers/System/Email/TemplateController.php
app/code/core/Mage/Catalog/Helper/Product.php
app/code/core/Mage/Catalog/controllers/Product/CompareController.php
app/code/core/Mage/Checkout/Model/Session.php
app/code/core/Mage/Checkout/controllers/OnepageController.php
app/code/core/Mage/Cms/Helper/Data.php
app/code/core/Mage/Cms/Model/Wysiwyg/Config.php
app/code/core/Mage/Cms/etc/config.xml
app/code/core/Mage/Compiler/Model/Process.php
app/code/core/Mage/Core/Helper/Abstract.php
app/code/core/Mage/Core/Helper/Data.php
app/code/core/Mage/Core/Model/Design/Package.php
app/code/core/Mage/Core/Model/Email/Template/Filter.php
app/code/core/Mage/Core/Model/File/Validator/AvailablePath.php
app/code/core/Mage/Core/Model/Observer.php
app/code/core/Mage/Core/etc/config.xml
app/code/core/Mage/Core/functions.php
app/code/core/Mage/CurrencySymbol/Model/System/Currencysymbol.php
app/code/core/Mage/Downloadable/controllers/DownloadController.php
app/code/core/Mage/SalesRule/Model/Coupon/Massgenerator.php
app/code/core/Mage/SalesRule/Model/Resource/Report/Rule/Createdat.php
app/code/core/Mage/Sendfriend/etc/config.xml
app/code/core/Mage/Sendfriend/etc/system.xml
app/design/adminhtml/default/default/template/catalog/product/composite/fieldset/configurable.phtml
app/design/adminhtml/default/default/template/catalog/product/helper/gallery.phtml
app/design/adminhtml/default/default/template/catalog/product/tab/inventory.phtml
app/design/adminhtml/default/default/template/currencysymbol/grid.phtml
app/design/adminhtml/default/default/template/customer/tab/addresses.phtml
app/design/adminhtml/default/default/template/customer/tab/view.phtml
app/design/adminhtml/default/default/template/notification/window.phtml
app/design/adminhtml/default/default/template/sales/order/create/data.phtml
app/design/adminhtml/default/default/template/sales/order/view/info.phtml
app/design/adminhtml/default/default/template/system/currency/rate/matrix.phtml
app/etc/applied.patches.list
app/locale/en_US/Mage_Adminhtml.csv
app/locale/en_US/Mage_Core.csv
app/locale/en_US/Mage_Sales.csv
app/locale/en_US/Mage_Sitemap.csv
js/mage/adminhtml/wysiwyg/tiny_mce/setup.js
js/mage/adminhtml/wysiwyg/tiny_mce/setup.js.orig
js/tiny_mce/plugins/media/js/media.js
js/varien/js.js
js/varien/js.js.orig
lib/phpseclib/PHP/Compat/Function/array_fill.php
lib/phpseclib/PHP/Compat/Function/bcpowmod.php
lib/phpseclib/PHP/Compat/Function/str_split.php
| improve this answer | |
3

Something missing with SUPEE-11155 (CE/EE) is that, on Mage_Catalog_Helper_Product class file, getDefaultProductValue method has been introduced, and rely on DEFAULT_QTY constant variable.

The problem is that this variable does not exist on many different patch files, and only present on few of them: https://ibb.co/LzcL0gn

Shall we patch it ourselves? Magento, are you aware about that?

Thx all

| improve this answer | |
  • What makes you say the variable not being in the patch is a problem? The variable likely exists in those version of Magento already. – Peter O'Callaghan Jul 2 '19 at 20:48
  • @PeterO'Callaghan Nop, the problem is that this variable does not exist all the time on those version. Tested on a EE 1.14.0.1 and EE 1.14.2.2, and nothing. To confirm that, we can see that, on CE 1.8 versions, this variable is not included in the patch, and not present by default on the source code neither (see github.com/OpenMage/magento-mirror/blob/magento-1.8/app/code/…). So pretty sure we have unfortunately a problem here, on multiple CE/EE versions. – Antoine Kociuba Jul 3 '19 at 13:00
  • Just stumbled over this too in 1.9.1.0. We have a custom product type. Whenever a new product from this type was created, the constant was used but not available. The current workaround was to copy an existing product. Patched it now manually (wuargh) – Claudio Dec 22 '19 at 12:01
3

Is it just me or doesn't this look like a bug?

PATCH_SUPEE-11155_EE_1.14.2.0_v3-2019-06-18-08-46-48.sh

  • The function is written to get a default product value by field name but will always return either:
    • $fieldData['inventory']; (inventory)
    • self::DEFAULT_QTY (this constant isn't defined)

Am I missing something here?

   1026 diff --git app/code/core/Mage/Catalog/Helper/Product.php app/code/core/Mage/Catalog/Helper/Product.php
   1027 index 45756bf74dc..476483f35bb 100755
   1028 --- app/code/core/Mage/Catalog/Helper/Product.php
   1029 +++ app/code/core/Mage/Catalog/Helper/Product.php
   1030 @@ -485,4 +485,41 @@ class Mage_Catalog_Helper_Product extends Mage_Core_Helper_Url
   1031      {
   1032          return $this->_skipSaleableCheck;
   1033      }
   1034 +
   1035 +    /**
   1036 +     * Get default product value by field name
   1037 +     *
   1038 +     * @param string $fieldName
   1039 +     * @param string $productType
   1040 +     * @return int
   1041 +     */
   1042 +    public function getDefaultProductValue($fieldName, $productType)
   1043 +    {
   1044 +        $fieldData = $this->getFieldset($fieldName) ? (array) $this->getFieldset($fieldName) : null;
   1045 +        if (
   1046 +            count($fieldData)
   1047 +            && array_key_exists($productType, $fieldData['product_type'])
   1048 +            && (bool)$fieldData['use_config']
   1049 +        ) {
   1050 +            return $fieldData['inventory'];
   1051 +        }
   1052 +        return self::DEFAULT_QTY;
   1053 +    }
   1054 +
   1055 +    /**
   1056 +     * Return array from config by fieldset name and area
   1057 +     *
   1058 +     * @param null|string $field
   1059 +     * @param string $fieldset
   1060 +     * @param string $area
   1061 +     * @return array|null
   1062 +     */
   1063 +    public function getFieldset($field = null, $fieldset = 'catalog_product_dataflow', $area = 'admin')
   1064 +    {
   1065 +        $fieldsetData = Mage::getConfig()->getFieldset($fieldset, $area);
   1066 +        if ($fieldsetData) {
   1067 +            return $fieldsetData ? $fieldsetData->$field : $fieldsetData;
   1068 +        }
   1069 +        return $fieldsetData;
   1070 +    }

The Good News is that it's only called via one area in the code and as long as you have a valid product ID you won't call this function. But if there isn't a valid product ID or someone attempts to use this function based on how it was designed issues likely will surface.

app/design/adminhtml/default/default/template/catalog/product/tab/inventory.phtml

<?php echo (bool)$this->getProduct()->getId() ? (int)$this->getFieldValue('min_sale_qty') : Mage::helper('catalog/product')->getDefaultProductValue('min_sale_qty', $this->getProduct()->getTypeId()) ?>
| improve this answer | |
3

EE 1.13.1.0 running PHP 7.0.x with the Inchoo PHP7 module:

Promotions > Shopping Cart Rules (probably others, as well): you can't save a rule, an exception, "Wrong rule specified," is thrown.

We resolved this by rewriting Mage_Adminhtml_Helper_Data::removeTags with the one from 1.14.x.x (I used 1.14.4.0 - not sure of the exact version that changed it).

Updated version:

public function removeTags($html)
{
    $html = preg_replace_callback(
        "# <(?![/a-z]) | (?<=\s)>(?![a-z]) #xi",
        function ($matches) {
            return htmlentities($matches[0]);
        },
        $html
    );
    $html =  strip_tags($html);
    return htmlspecialchars_decode($html);
}
| improve this answer | |
2

On M1 version 1.9.4.0 with all previous patches applied I got the following error

checking file app/Mage.php
Hunk #1 FAILED at 816.
1 out of 1 hunk FAILED

as I can see from the patch file, it's looking for

diff --git app/Mage.php app/Mage.php
index 1136f6e9351..eb9e6db3a9e 100644
--- app/Mage.php
+++ app/Mage.php
@@ -816,9 +816,9 @@ final class Mage
             ',',
             (string) self::getConfig()->getNode('dev/log/allowedFileExtensions', Mage_Core_Model_Store::DEFAULT_CODE)
         );
-        $logValidator = new Zend_Validate_File_Extension($_allowedFileExtensions);
         $logDir = self::getBaseDir('var') . DS . 'log';
-        if (!$logValidator->isValid($logDir . DS . $file)) {
+        $validatedFileExtension = pathinfo($file, PATHINFO_EXTENSION);
+        if (!$validatedFileExtension || !in_array($validatedFileExtension, $_allowedFileExtensions)) {
             return;
         }

but instead, here's what I've got

        }

        try {
            if (!isset($loggers[$file])) {
                $logDir  = self::getBaseDir('var') . DS . 'log';
                $logFile = $logDir . DS . $file;

                if (!is_dir($logDir)) {
                    mkdir($logDir);

I confirmed on https://raw.githubusercontent.com/OpenMage/magento-mirror/1.9.4.0/app/Mage.php that we have the correct code and version.

Will update if I find the solution

| improve this answer | |
  • Same issue with 1.9.3.7 – veli Jun 28 '19 at 9:24
  • I am agree with @Haim . I am also getting the same issue after apply the SUPEE -11155 patch On M1 version 1.9.4.0. Below one error Checking if patch can be applied/reverted successfully... -e ERROR: Patch can't be applied/reverted successfully. checking file app/Mage.php Hunk #1 FAILED at 816. 1 out of 1 hunk FAILED Let me know if anybody find the solution – Vikas Gupta Jul 3 '19 at 15:43
2

Using open-mage-lts 1.9.4.1

checking file app/design/adminhtml/default/default/template/catalog/product/helper/gallery.phtml Hunk #1 FAILED at 59. 1 out of 1 hunk FAILED

Comparing -lts to core:

00:20 $ diff app/design/adminhtml/default/default/template/catalog/product/helper/gallery.phtml /tmp/gallery.phtml 
62c62
<                 <th><?php echo str_replace("&lt;br/&gt;","<br/>",$this->escapeHtml($type['label'])); ?></th>
---
>                 <th><?php echo $this->escapeHtml($type['label']); ?></th>

which was introduced by this PR in -lts

https://github.com/OpenMage/magento-lts/pull/596

https://github.com/OpenMage/magento-lts/pull/788


Patched code:

-                <th><?php echo $this->escapeHtml($type['label']); ?></th>
+                <th><?php echo $this->escapeHtml($type['label'], array('br')); ?></th>
| improve this answer | |
  • If using enterprise edition 1.14.4.0 the same error code is caused by previous security patch 10888. A fix for this in to update Line 61 of app/design/adminhtml/default/default/template/catalog/product/helper/gallery.phtml From:<?php foreach ($_block->getImageTypes() as $typeId => $type): ?> To: <?php foreach ($_block->getImageTypes() as $typeId=>$type): ?> – Baber Jul 3 '19 at 13:30
2

For those who are using PHP 5.3 (or less than 5.4), then here are some parts of the patch you would need to change.

For reference, this is for PATCH_SUPEE-11155_CE_1.7.0.2_v4-2019-08-01-03-58-34

app/code/core/Mage/Adminhtml/controllers/Newsletter/TemplateController.php

$allowedHtmlTags = ['text', 'styles'];

FIX:
$allowedHtmlTags = array('text', 'styles');

app/code/core/Mage/Adminhtml/controllers/System/Email/TemplateController.php

$allowedHtmlTags = ['template_text', 'styles']

FIX:
$allowedHtmlTags = array('template_text', 'styles');

app/code/core/Mage/Cms/Helper/Data.php

$statusSwf = $statusSwf->asArray()[0];

FIX:
$statusSwf = $statusSwf->asArray();
$statusSwf = $statusSwf[0];

Note: If you're changing these in the patch file, remember to change the length positions as well since you are adding a newline in the patch file. For example for the last one mentioned above:

@@ -74,4 +75,19 @@ class Mage_Cms_Helper_Data extends Mage_Core_Helper_Abstract

change to 

@@ -74,4 +75,20 @@ class Mage_Cms_Helper_Data extends Mage_Core_Helper_Abstract
             ^^ incremented
| improve this answer | |
1

Had the same issue as @Mat

On M1, 1.9.1.0 with all previous patches applied, I get numerous errors:

My line endings were not set to unix/macosx on the repo (another dev using Win-dows).

used dos2unix to convert the necessary files and worked.

And as @chaoticgeek, I have the:

Hunk #1 FAILED at 483. 1 out of 1 hunk FAILED -- saving rejects to file js/tiny_mce/plugins/media/js/media.js.rej

It has happened on all repos (6) so far, 1.9.2.4, 1.9.3.8 x 2, 1.9.3.2 x 2, and 1.9.2.1.

| improve this answer | |
  • Confirmed the same issue on EE 1.13.10 – Laura Jun 27 '19 at 18:59
1

same issue on Magento CE 1.8.1 with all patches applied:

checking file app/Mage.php Hunk #1 FAILED at 813. 1 out of 1 hunk FAILED

any help/idea out there?

| improve this answer | |
1

after applied Supee-11155 patch am getting issue with newsletter transnational email template saving then i changed in

app\code\core\Mage\Adminhtml\controllers\System\Email\TemplateController.php

$allowedHtmlTags = ['template_text', 'styles'];

to

$allowedHtmlTags = ['template_text', 'styles', 'variables'];

now working fine me .

| improve this answer | |
1

app/code/core/Mage/Adminhtml/controllers/System/ConfigController.php

change this to:

->setGroupsSelector($groups) to ->setGroups($groups)

| improve this answer | |
0

On M1, 1.9.1.0 I've got

Hunk #1 FAILED at 483 (different line endings).

Even when I run

find . -type f -exec dos2unix {} \;

nothing changes.

How can I know which file it is ? 486 is path line ?

| improve this answer | |
  • Could find any solution so I had to run path in Win environment. Since patching works only with files there is no need to have web server. – Hypo Jun 26 '19 at 13:40
0

I'm currently on v1.9.3.1 and got several conflicts. I'm using the third version of the patch (see the filename):

EDIT: After some check we are actually missing some previous patches. Will update later.

PATCH_SUPEE-11155_CE_1.9.3.1_v3-2019-06-18-08-15-43.sh: 14: PATCH_SUPEE-11155_CE_1.9.3.1_v3-2019-06-18-08-15-43.sh: 127: not found
PATCH_SUPEE-11155_CE_1.9.3.1_v3-2019-06-18-08-15-43.sh: 14: PATCH_SUPEE-11155_CE_1.9.3.1_v3-2019-06-18-08-15-43.sh: 127: not found
PATCH_SUPEE-11155_CE_1.9.3.1_v3-2019-06-18-08-15-43.sh: 25: PATCH_SUPEE-11155_CE_1.9.3.1_v3-2019-06-18-08-15-43.sh: 0: not found
Checking if patch can be applied/reverted successfully...
-e ERROR: Patch can\'t be applied/reverted successfully.

checking file app/Mage.php
checking file app/code/core/Mage/Admin/Model/Block.php
checking file app/code/core/Mage/Admin/Model/User.php
Hunk #1 succeeded at 586 (offset -4 lines).
checking file app/code/core/Mage/AdminNotification/etc/system.xml
checking file app/code/core/Mage/Adminhtml/Block/Api/Role/Grid/User.php
checking file app/code/core/Mage/Adminhtml/Block/Catalog/Product/Edit/Tab/Super/Config.php
Hunk #1 FAILED at 155.
1 out of 1 hunk FAILED
checking file app/code/core/Mage/Adminhtml/Block/Newsletter/Queue/Preview.php
checking file app/code/core/Mage/Adminhtml/Block/Newsletter/Template/Preview.php
checking file app/code/core/Mage/Adminhtml/Block/Permissions/Role/Grid/User.php
checking file app/code/core/Mage/Adminhtml/Block/Sales/Creditmemo/Grid.php
checking file app/code/core/Mage/Adminhtml/Block/Sales/Invoice/Grid.php
checking file app/code/core/Mage/Adminhtml/Block/Sales/Order/Create/Header.php
checking file app/code/core/Mage/Adminhtml/Block/Sales/Order/Creditmemo/Create.php
checking file app/code/core/Mage/Adminhtml/Block/Sales/Order/Grid.php
checking file app/code/core/Mage/Adminhtml/Block/Sales/Order/Invoice/Create.php
checking file app/code/core/Mage/Adminhtml/Block/Sales/Order/Shipment/Create.php
checking file app/code/core/Mage/Adminhtml/Block/Sales/Order/View.php
checking file app/code/core/Mage/Adminhtml/Block/Sales/Shipment/Grid.php
checking file app/code/core/Mage/Adminhtml/Block/Sales/Transactions/Grid.php
checking file app/code/core/Mage/Adminhtml/Block/System/Email/Template/Preview.php
checking file app/code/core/Mage/Adminhtml/Block/Template.php
checking file app/code/core/Mage/Adminhtml/Block/Widget/Grid/Column/Renderer/Abstract.php
checking file app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator.php
Hunk #1 FAILED at 180.
1 out of 1 hunk FAILED
1 out of 1 hunk FAILED
checking file app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Baseurl.php
checking file app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Locale.php
checking file app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Serialized/Array.php
checking file app/code/core/Mage/Adminhtml/controllers/Catalog/Product/AttributeController.php
checking file app/code/core/Mage/Adminhtml/controllers/Catalog/Product/ReviewController.php
checking file app/code/core/Mage/Adminhtml/controllers/Catalog/ProductController.php
checking file app/code/core/Mage/Adminhtml/controllers/Checkout/AgreementController.php
checking file app/code/core/Mage/Adminhtml/controllers/Newsletter/TemplateController.php
checking file app/code/core/Mage/Adminhtml/controllers/Promo/CatalogController.php
checking file app/code/core/Mage/Adminhtml/controllers/Promo/QuoteController.php
checking file app/code/core/Mage/Adminhtml/controllers/Sales/Order/CreateController.php
checking file app/code/core/Mage/Adminhtml/controllers/SitemapController.php
checking file app/code/core/Mage/Adminhtml/controllers/System/Email/TemplateController.php
checking file app/code/core/Mage/Catalog/Helper/Product.php
checking file app/code/core/Mage/Catalog/controllers/Product/CompareController.php
checking file app/code/core/Mage/Checkout/Model/Session.php
checking file app/code/core/Mage/Checkout/controllers/OnepageController.php
Hunk #1 succeeded at 570 (offset 8 lines).
checking file app/code/core/Mage/Cms/Helper/Data.php
checking file app/code/core/Mage/Cms/Model/Wysiwyg/Config.php
checking file app/code/core/Mage/Cms/etc/config.xml
checking file app/code/core/Mage/Compiler/Model/Process.php
checking file app/code/core/Mage/Core/Helper/Abstract.php
checking file app/code/core/Mage/Core/Helper/Data.php
checking file app/code/core/Mage/Core/Model/Design/Package.php
checking file app/code/core/Mage/Core/Model/Email/Template/Filter.php
checking file app/code/core/Mage/Core/Model/File/Validator/AvailablePath.php
checking file app/code/core/Mage/Core/Model/Observer.php
checking file app/code/core/Mage/Core/etc/config.xml
checking file app/code/core/Mage/Core/functions.php
checking file app/code/core/Mage/CurrencySymbol/Model/System/Currencysymbol.php
checking file app/code/core/Mage/Downloadable/controllers/DownloadController.php
checking file app/code/core/Mage/SalesRule/Model/Coupon/Massgenerator.php
checking file app/code/core/Mage/SalesRule/Model/Resource/Report/Rule/Createdat.php
checking file app/code/core/Mage/Sendfriend/etc/config.xml
checking file app/code/core/Mage/Sendfriend/etc/system.xml
checking file app/design/adminhtml/default/default/template/catalog/product/composite/fieldset/configurable.phtml
checking file app/design/adminhtml/default/default/template/catalog/product/helper/gallery.phtml
Hunk #1 FAILED at 59.
1 out of 1 hunk FAILED
checking file app/design/adminhtml/default/default/template/catalog/product/tab/inventory.phtml
checking file app/design/adminhtml/default/default/template/currencysymbol/grid.phtml
checking file app/design/adminhtml/default/default/template/customer/tab/addresses.phtml
checking file app/design/adminhtml/default/default/template/customer/tab/view.phtml
checking file app/design/adminhtml/default/default/template/notification/window.phtml
checking file app/design/adminhtml/default/default/template/sales/order/create/data.phtml
checking file app/design/adminhtml/default/default/template/sales/order/view/info.phtml
Hunk #4 succeeded at 176 (offset 22 lines).
Hunk #5 succeeded at 189 with fuzz 1 (offset 22 lines).
checking file app/design/adminhtml/default/default/template/system/currency/rate/matrix.phtml
checking file app/locale/en_US/Mage_Adminhtml.csv
checking file app/locale/en_US/Mage_Core.csv
checking file app/locale/en_US/Mage_Sales.csv
checking file app/locale/en_US/Mage_Sitemap.csv
checking file js/mage/adminhtml/wysiwyg/tiny_mce/setup.js
checking file js/tiny_mce/plugins/media/js/media.js
checking file js/varien/js.js
checking file lib/phpseclib/PHP/Compat/Function/array_fill.php
checking file lib/phpseclib/PHP/Compat/Function/bcpowmod.php
checking file lib/phpseclib/PHP/Compat/Function/str_split.php
| improve this answer | |
0

After installing patch SUPEE-11155 on Magento 1.8.0.0 we are no longer able to create simple products. After choosing the prodyct type and attribute set, there will be a display with some stock settings, but you cannot do anything else.

Someone familiar with this problem?

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.