28

Magento has released a new security patch for M1, and updates for M1 and M2.

What common issues do you have to watch out for when applying this patch/upgrade?

Magento 1

https://magento.com/security/patches/supee-11155

Magento 2

This should be the last release in the 2.1 series which reaches its EOL at the end of this month.

  • 1
    has anybody tested what in the world this means: "Quotes created by customers who are logged in as guest are no longer accessible after a Magento update. Third-party checkout extensions and closed security cases will either not not work securely or will not work at all." ? – Kalvin Klien Jun 25 at 19:31
  • I am quite interested in the changes referenced by fixed bug PRODSECBUG-2330 – Richie Frame Jun 27 at 0:27

18 Answers 18

11

This patch is incompatible with the PHP 7.2 support patch. Removing lines 1711 to 1761 allows to apply the patch. This patch tries to patch files that have been removed by the 7.2 support patch. Removing these lines should be safe.

  • 1
    Which M1 version are you on (or which patch version did you download)? We're on a custom patched 1.7 so we'll need to take a closer look – Laura Jun 26 at 16:26
  • 1
    @Laura I'm on 1.9.2 – Michael Thessel Jun 26 at 18:11
  • 1
    There's a new version of the patch out, v4, that handles PHP 7.2. – Laura Aug 1 at 22:06
11

Error installing on 1.7.0.2 CE with all previous patches installed (see below).

EDIT: Issue (#1) was caused by missing file - app/code/core/Mage/Catalog/Model/Product/Option/Type/File.php.orig

Issue (#1) resolved by removing lines 874 - 1702 (referring to File.php.orig) from the patch script.

Issue (#2) was caused due to improper formatting of patch and file - js/tiny_mce/plugins/media/js/media.js

Issue (#2) was resolved by running dos2unix command for both patch file and media.js file

Patch installed successfully after resolution of the two described issues.

Checking if patch can be applied/reverted successfully...

ERROR: Patch can't be applied/reverted successfully.

patching file app/Mage.php patching file app/code/core/Mage/Admin/Model/Block.php patching file app/code/core/Mage/Admin/Model/User.php patching file app/code/core/Mage/AdminNotification/etc/system.xml patching file app/code/core/Mage/Adminhtml/Block/Api/Role/Grid/User.php patching file app/code/core/Mage/Adminhtml/Block/Catalog/Product/Edit/Tab/Super/Config.php patching file app/code/core/Mage/Adminhtml/Block/Newsletter/Queue/Preview.php patching file app/code/core/Mage/Adminhtml/Block/Newsletter/Template/Preview.php patching file app/code/core/Mage/Adminhtml/Block/Permissions/Role/Grid/User.php patching file app/code/core/Mage/Adminhtml/Block/Sales/Creditmemo/Grid.php patching file app/code/core/Mage/Adminhtml/Block/Sales/Invoice/Grid.php patching file app/code/core/Mage/Adminhtml/Block/Sales/Order/Create/Header.php patching file app/code/core/Mage/Adminhtml/Block/Sales/Order/Creditmemo/Create.php patching file app/code/core/Mage/Adminhtml/Block/Sales/Order/Grid.php patching file app/code/core/Mage/Adminhtml/Block/Sales/Order/Invoice/Create.php patching file app/code/core/Mage/Adminhtml/Block/Sales/Order/Shipment/Create.php patching file app/code/core/Mage/Adminhtml/Block/Sales/Order/View.php patching file app/code/core/Mage/Adminhtml/Block/Sales/Shipment/Grid.php patching file app/code/core/Mage/Adminhtml/Block/Sales/Transactions/Grid.php patching file app/code/core/Mage/Adminhtml/Block/System/Email/Template/Preview.php patching file app/code/core/Mage/Adminhtml/Block/Template.php patching file app/code/core/Mage/Adminhtml/Block/Widget/Grid/Column/Renderer/Abstract.php patching file app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator.php patching file app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Baseurl.php patching file app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Locale.php patching file app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Serialized/Array.php patching file app/code/core/Mage/Adminhtml/controllers/Catalog/Product/AttributeController.php patching file app/code/core/Mage/Adminhtml/controllers/Catalog/Product/ReviewController.php patching file app/code/core/Mage/Adminhtml/controllers/Catalog/ProductController.php patching file app/code/core/Mage/Adminhtml/controllers/Checkout/AgreementController.php patching file app/code/core/Mage/Adminhtml/controllers/Newsletter/TemplateController.php patching file app/code/core/Mage/Adminhtml/controllers/Promo/CatalogController.php patching file app/code/core/Mage/Adminhtml/controllers/Promo/QuoteController.php patching file app/code/core/Mage/Adminhtml/controllers/Sales/Order/CreateController.php patching file app/code/core/Mage/Adminhtml/controllers/SitemapController.php patching file app/code/core/Mage/Adminhtml/controllers/System/Email/TemplateController.php patching file app/code/core/Mage/Catalog/Helper/Product.php The next

patch would delete the file app/code/core/Mage/Catalog/Model/Product/Option/Type/File.php.orig, which does not exist!
Assume -R? [n]
Apply anyway? [n]
Skipping patch. 1 out of 1 hunk ignored patching file

app/code/core/Mage/Catalog/controllers/Product/CompareController.php patching file app/code/core/Mage/Checkout/Model/Session.php patching file app/code/core/Mage/Checkout/controllers/OnepageController.php patching file app/code/core/Mage/Cms/Helper/Data.php patching file app/code/core/Mage/Cms/Model/Wysiwyg/Config.php patching file app/code/core/Mage/Cms/etc/config.xml patching file app/code/core/Mage/Compiler/Model/Process.php patching file app/code/core/Mage/Core/Helper/Abstract.php patching file app/code/core/Mage/Core/Helper/Data.php patching file app/code/core/Mage/Core/Model/Design/Package.php patching file app/code/core/Mage/Core/Model/Email/Template/Filter.php patching file app/code/core/Mage/Core/Model/File/Validator/AvailablePath.php patching file app/code/core/Mage/Core/Model/Observer.php patching file app/code/core/Mage/Core/etc/config.xml patching file app/code/core/Mage/Core/functions.php patching file app/code/core/Mage/CurrencySymbol/Model/System/Currencysymbol.php patching file app/code/core/Mage/Downloadable/controllers/DownloadController.php patching file app/code/core/Mage/SalesRule/Model/Coupon/Massgenerator.php patching file app/code/core/Mage/SalesRule/Model/Resource/Report/Rule/Createdat.php patching file app/code/core/Mage/Sendfriend/etc/config.xml patching file app/code/core/Mage/Sendfriend/etc/system.xml patching file app/design/adminhtml/default/default/template/catalog/product/composite/fieldset/configurable.phtml patching file app/design/adminhtml/default/default/template/catalog/product/helper/gallery.phtml patching file app/design/adminhtml/default/default/template/catalog/product/tab/inventory.phtml patching file app/design/adminhtml/default/default/template/currencysymbol/grid.phtml patching file app/design/adminhtml/default/default/template/customer/tab/addresses.phtml patching file app/design/adminhtml/default/default/template/customer/tab/view.phtml patching file app/design/adminhtml/default/default/template/notification/window.phtml patching file app/design/adminhtml/default/default/template/sales/order/create/data.phtml patching file app/design/adminhtml/default/default/template/sales/order/view/info.phtml patching file app/design/adminhtml/default/default/template/system/currency/rate/matrix.phtml patching file app/locale/en_US/Mage_Adminhtml.csv patching file app/locale/en_US/Mage_Core.csv patching file app/locale/en_US/Mage_Sales.csv patching file app/locale/en_US/Mage_Sitemap.csv patching file js/mage/adminhtml/wysiwyg/tiny_mce/setup.js patching file js/tiny_mce/plugins/media/js/media.js

Hunk #1 FAILED at 434. 1 out of 1 hunk FAILED -- saving rejects to file js/tiny_mce/plugins/media/js/media.js.rej patching file

js/varien/js.js patching file lib/phpseclib/PHP/Compat/Function/array_fill.php patching file lib/phpseclib/PHP/Compat/Function/bcpowmod.php patching file lib/phpseclib/PHP/Compat/Function/str_split.php

  • Thank you. These two issues were also the ones I faced with 1.7.0.2 and PATCH_SUPEE-11155_CE_1.7.0.2_v3-2019-06-18-08-07-47.sh – Anthony Jun 26 at 23:00
  • Spot on for 1.7.0.2 issues. – shaune Jul 2 at 16:55
9

Magento 1.9.1.0.

Patch was applied successfully.

After adding a product to the cart and then logging in, the cart is empty again.

I don't think the issue was there before and there seem to be changes made to app/code/core/Mage/Checkout/Model/Session.php

UPDATE:

I've debugged this a little bit.

When I revert the patched version of app/code/core/Mage/Checkout/Model/Session.php it works again for me. So I'm pretty sure it has to do with the patch.

I first thought that it was in conjunction with $quote->unsetData(); but my tests were inconclusive and it wouldn't be a fix anyway to remove it.

Since I'm on vacation right now I have limited time to investigate this further.

  • Magento has a note in release notes: "Quotes created by customers who are logged in as guest are no longer accessible after a Magento update. Third-party checkout extensions and closed security cases will either not not work securely or will not work at all.". I'm asking them right now for clarification. devdocs.magento.com/guides/m1x/ce19-ee114/… – Kalvin Klien Jun 26 at 15:15
  • Hi @Claudio, have you found any solution/answer to that issue? I'm currently facing the same one: add to cart -> checkout -> account creation -> back to homepage, empty cart, but logged in... Thank you in advance. – Antoine Kociuba Sep 11 at 18:56
  • Hey @AntoineKociuba, unfortunately not. I haven't really looked for a solutionen though to be honest. – Claudio yesterday
7

On M1, specifically 1.9.2.1 w/ all previous patches applied. I got the following error:

Hunk #1 FAILED at 483.
1 out of 1 hunk FAILED -- saving rejects to file js/tiny_mce/plugins/media/js/media.js.rej

Removing the lines about that file from the patch file and manually applying that change worked for me when I re-applied the patch file.

When I looked at the difference between the js/tiny_mce/plugins/media/js/media.js file and the one from OpenMage Mirror they were identical files.

  • That file hasnt been touched by any patches or manual updates at all. This seems like a problem in the patch? Looking at the name of it, it looks like there has been already 1-3 versions before it was released. – Kalvin Klien Jun 25 at 19:59
  • Had this problem on 1.9.1.1 with all previous patches applied. Replacing js/tiny_mce/plugins/media/js/media.js with the file from the OpenMage Mirror worked for me. Although the content of the files were identical, I think the line endings on my existing file were wrong for some reason. – wr125 Jun 26 at 11:24
  • 5
    Running dos2unix on the patch before applying fixed the issue for us. Previously failing as per above, completed successfully after. – joesk Jun 26 at 11:58
  • Running dos2unix on the patch file solved this issue for me on 1.9.2.3, but I didn't find it was required on 1.9.2.1 (I tried it out of curiosity and it caused the patch to fail). – Dave Herbert Jun 26 at 13:27
5

1.9.1.0, after applied patch successfully, get below error when login admin

Fatal error: Call to undefined function random_int() in /app/code/core/Mage/Core/Helper/Data.php on line 257 

how to fix?

  • Also following upgrade from 1.9.4.1 to 1.9.4.2 we experience the same issue. – joesk Jun 26 at 12:04
  • I get the same issue in 1.9.4.1 with 11155. – seanbreeden Jun 26 at 14:38
  • 7
    The problem turned out to be an override of app/code/core/Mage/Core/functions.php. Make sure no one has overridden this file or the patch will fail with the call to undefined function error. Look in "app/code/local/Mage/Core/functions.php" – seanbreeden Jun 26 at 15:48
  • 1
    you are very right. – jun Jul 12 at 14:11
  • 1
    Thank you very much @seanbreeden! – Mauricio Paz Sep 4 at 13:24
3

On M1, 1.9.1.0 with all previous patches applied, I get numerous errors:

checking file app/Mage.php 
Hunk #1 FAILED at 813. 
1 out of 1 hunk FAILED

checking file app/code/core/Mage/Adminhtml/Block/Catalog/Product/Edit/Tab/Super/Config.php
Hunk #1 FAILED at 155.
1 out of 1 hunk FAILED

checking file app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator.php
Hunk #1 FAILED at 180.
1 out of 1 hunk FAILED

checking file app/code/core/Mage/Cms/Helper/Data.php
Hunk #1 FAILED at 37.
Hunk #2 succeeded at 58 with fuzz 2 (offset -16 lines).
1 out of 2 hunks FAILED

checking file app/design/adminhtml/default/default/template/catalog/product/helper/gallery.phtml
Hunk #1 FAILED at 59.
1 out of 1 hunk FAILED

checking file js/tiny_mce/plugins/media/js/media.js
Hunk #1 FAILED at 483 (different line endings).
1 out of 1 hunk FAILED

Taking a look at the code itself in the patch file, it appears that it doesn't match the PHP in my installation at all.

Maybe I missed a patch somewhere along the way?

  • I think you have skipped a patch probably. Check your /app/etc/applied.patches.list – Kalvin Klien Jun 25 at 20:01
  • see: magento.stackexchange.com/a/280148/202 regarding Hunk #1 FAILED at 59 on gallery.phtml - possible you have that change in your code as well? – ProxiBlue Jun 29 at 1:09
  • @Matt Did you figure out which patch you missed? – rupi Jul 8 at 14:35
3

Magento 1.7.0.2

I'm getting:

Hunk #1 succeeded at 113 with fuzz 2 (offset 4 lines).
checking file js/tiny_mce/plugins/media/js/media.js
checking file js/varien/js.js

Hunk #1 succeeded at 707 (offset 5 lines).
checking file lib/phpseclib/PHP/Compat/Function/array_fill.php
checking file lib/phpseclib/PHP/Compat/Function/bcpowmod.php
checking file lib/phpseclib/PHP/Compat/Function/str_split.php

Are these from PHP 7.2 patch?

UPDATE: looks like those files were actually ok, it was just empty space offset.

The problem file was:

checking file app/code/core/Mage/Catalog/Model/Product/Option/Type/File.php.orig

I think it was some file that was left over by one of the patches. The new patch just deletes that file. I didn't have it in that directory, so the error showed up.

UPDATE: list of affected files on Magento 1.7.0.2

app/Mage.php
app/code/core/Mage/Admin/Model/Block.php
app/code/core/Mage/Admin/Model/User.php
app/code/core/Mage/AdminNotification/etc/system.xml
app/code/core/Mage/Adminhtml/Block/Api/Role/Grid/User.php
app/code/core/Mage/Adminhtml/Block/Catalog/Product/Edit/Tab/Super/Config.php
app/code/core/Mage/Adminhtml/Block/Newsletter/Queue/Preview.php
app/code/core/Mage/Adminhtml/Block/Newsletter/Template/Preview.php
app/code/core/Mage/Adminhtml/Block/Permissions/Role/Grid/User.php
app/code/core/Mage/Adminhtml/Block/Sales/Creditmemo/Grid.php
app/code/core/Mage/Adminhtml/Block/Sales/Invoice/Grid.php
app/code/core/Mage/Adminhtml/Block/Sales/Order/Create/Header.php
app/code/core/Mage/Adminhtml/Block/Sales/Order/Creditmemo/Create.php
app/code/core/Mage/Adminhtml/Block/Sales/Order/Grid.php
app/code/core/Mage/Adminhtml/Block/Sales/Order/Invoice/Create.php
app/code/core/Mage/Adminhtml/Block/Sales/Order/Shipment/Create.php
app/code/core/Mage/Adminhtml/Block/Sales/Order/View.php
app/code/core/Mage/Adminhtml/Block/Sales/Shipment/Grid.php
app/code/core/Mage/Adminhtml/Block/Sales/Transactions/Grid.php
app/code/core/Mage/Adminhtml/Block/System/Email/Template/Preview.php
app/code/core/Mage/Adminhtml/Block/Template.php
app/code/core/Mage/Adminhtml/Block/Widget/Grid/Column/Renderer/Abstract.php
app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator.php
app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Baseurl.php
app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Locale.php
app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Serialized/Array.php
app/code/core/Mage/Adminhtml/controllers/Catalog/Product/AttributeController.php
app/code/core/Mage/Adminhtml/controllers/Catalog/Product/ReviewController.php
app/code/core/Mage/Adminhtml/controllers/Catalog/ProductController.php
app/code/core/Mage/Adminhtml/controllers/Checkout/AgreementController.php
app/code/core/Mage/Adminhtml/controllers/Newsletter/TemplateController.php
app/code/core/Mage/Adminhtml/controllers/Promo/CatalogController.php
app/code/core/Mage/Adminhtml/controllers/Promo/QuoteController.php
app/code/core/Mage/Adminhtml/controllers/Sales/Order/CreateController.php
app/code/core/Mage/Adminhtml/controllers/SitemapController.php
app/code/core/Mage/Adminhtml/controllers/System/Email/TemplateController.php
app/code/core/Mage/Catalog/Helper/Product.php
app/code/core/Mage/Catalog/controllers/Product/CompareController.php
app/code/core/Mage/Checkout/Model/Session.php
app/code/core/Mage/Checkout/controllers/OnepageController.php
app/code/core/Mage/Cms/Helper/Data.php
app/code/core/Mage/Cms/Model/Wysiwyg/Config.php
app/code/core/Mage/Cms/etc/config.xml
app/code/core/Mage/Compiler/Model/Process.php
app/code/core/Mage/Core/Helper/Abstract.php
app/code/core/Mage/Core/Helper/Data.php
app/code/core/Mage/Core/Model/Design/Package.php
app/code/core/Mage/Core/Model/Email/Template/Filter.php
app/code/core/Mage/Core/Model/File/Validator/AvailablePath.php
app/code/core/Mage/Core/Model/Observer.php
app/code/core/Mage/Core/etc/config.xml
app/code/core/Mage/Core/functions.php
app/code/core/Mage/CurrencySymbol/Model/System/Currencysymbol.php
app/code/core/Mage/Downloadable/controllers/DownloadController.php
app/code/core/Mage/SalesRule/Model/Coupon/Massgenerator.php
app/code/core/Mage/SalesRule/Model/Resource/Report/Rule/Createdat.php
app/code/core/Mage/Sendfriend/etc/config.xml
app/code/core/Mage/Sendfriend/etc/system.xml
app/design/adminhtml/default/default/template/catalog/product/composite/fieldset/configurable.phtml
app/design/adminhtml/default/default/template/catalog/product/helper/gallery.phtml
app/design/adminhtml/default/default/template/catalog/product/tab/inventory.phtml
app/design/adminhtml/default/default/template/currencysymbol/grid.phtml
app/design/adminhtml/default/default/template/customer/tab/addresses.phtml
app/design/adminhtml/default/default/template/customer/tab/view.phtml
app/design/adminhtml/default/default/template/notification/window.phtml
app/design/adminhtml/default/default/template/sales/order/create/data.phtml
app/design/adminhtml/default/default/template/sales/order/view/info.phtml
app/design/adminhtml/default/default/template/system/currency/rate/matrix.phtml
app/etc/applied.patches.list
app/locale/en_US/Mage_Adminhtml.csv
app/locale/en_US/Mage_Core.csv
app/locale/en_US/Mage_Sales.csv
app/locale/en_US/Mage_Sitemap.csv
js/mage/adminhtml/wysiwyg/tiny_mce/setup.js
js/mage/adminhtml/wysiwyg/tiny_mce/setup.js.orig
js/tiny_mce/plugins/media/js/media.js
js/varien/js.js
js/varien/js.js.orig
lib/phpseclib/PHP/Compat/Function/array_fill.php
lib/phpseclib/PHP/Compat/Function/bcpowmod.php
lib/phpseclib/PHP/Compat/Function/str_split.php
2

Using open-mage-lts 1.9.4.1

checking file app/design/adminhtml/default/default/template/catalog/product/helper/gallery.phtml Hunk #1 FAILED at 59. 1 out of 1 hunk FAILED

Comparing -lts to core:

00:20 $ diff app/design/adminhtml/default/default/template/catalog/product/helper/gallery.phtml /tmp/gallery.phtml 
62c62
<                 <th><?php echo str_replace("&lt;br/&gt;","<br/>",$this->escapeHtml($type['label'])); ?></th>
---
>                 <th><?php echo $this->escapeHtml($type['label']); ?></th>

which was introduced by this PR in -lts

https://github.com/OpenMage/magento-lts/pull/596

https://github.com/OpenMage/magento-lts/pull/788


Patched code:

-                <th><?php echo $this->escapeHtml($type['label']); ?></th>
+                <th><?php echo $this->escapeHtml($type['label'], array('br')); ?></th>
  • If using enterprise edition 1.14.4.0 the same error code is caused by previous security patch 10888. A fix for this in to update Line 61 of app/design/adminhtml/default/default/template/catalog/product/helper/gallery.phtml From:<?php foreach ($_block->getImageTypes() as $typeId => $type): ?> To: <?php foreach ($_block->getImageTypes() as $typeId=>$type): ?> – Baber Jul 3 at 13:30
2

Something missing with SUPEE-11155 (CE/EE) is that, on Mage_Catalog_Helper_Product class file, getDefaultProductValue method has been introduced, and rely on DEFAULT_QTY constant variable.

The problem is that this variable does not exist on many different patch files, and only present on few of them: https://ibb.co/LzcL0gn

Shall we patch it ourselves? Magento, are you aware about that?

Thx all

  • What makes you say the variable not being in the patch is a problem? The variable likely exists in those version of Magento already. – Peter O'Callaghan Jul 2 at 20:48
  • @PeterO'Callaghan Nop, the problem is that this variable does not exist all the time on those version. Tested on a EE 1.14.0.1 and EE 1.14.2.2, and nothing. To confirm that, we can see that, on CE 1.8 versions, this variable is not included in the patch, and not present by default on the source code neither (see github.com/OpenMage/magento-mirror/blob/magento-1.8/app/code/…). So pretty sure we have unfortunately a problem here, on multiple CE/EE versions. – Antoine Kociuba Jul 3 at 13:00
2

Is it just me or doesn't this look like a bug?

PATCH_SUPEE-11155_EE_1.14.2.0_v3-2019-06-18-08-46-48.sh

  • The function is written to get a default product value by field name but will always return either:
    • $fieldData['inventory']; (inventory)
    • self::DEFAULT_QTY (this constant isn't defined)

Am I missing something here?

   1026 diff --git app/code/core/Mage/Catalog/Helper/Product.php app/code/core/Mage/Catalog/Helper/Product.php
   1027 index 45756bf74dc..476483f35bb 100755
   1028 --- app/code/core/Mage/Catalog/Helper/Product.php
   1029 +++ app/code/core/Mage/Catalog/Helper/Product.php
   1030 @@ -485,4 +485,41 @@ class Mage_Catalog_Helper_Product extends Mage_Core_Helper_Url
   1031      {
   1032          return $this->_skipSaleableCheck;
   1033      }
   1034 +
   1035 +    /**
   1036 +     * Get default product value by field name
   1037 +     *
   1038 +     * @param string $fieldName
   1039 +     * @param string $productType
   1040 +     * @return int
   1041 +     */
   1042 +    public function getDefaultProductValue($fieldName, $productType)
   1043 +    {
   1044 +        $fieldData = $this->getFieldset($fieldName) ? (array) $this->getFieldset($fieldName) : null;
   1045 +        if (
   1046 +            count($fieldData)
   1047 +            && array_key_exists($productType, $fieldData['product_type'])
   1048 +            && (bool)$fieldData['use_config']
   1049 +        ) {
   1050 +            return $fieldData['inventory'];
   1051 +        }
   1052 +        return self::DEFAULT_QTY;
   1053 +    }
   1054 +
   1055 +    /**
   1056 +     * Return array from config by fieldset name and area
   1057 +     *
   1058 +     * @param null|string $field
   1059 +     * @param string $fieldset
   1060 +     * @param string $area
   1061 +     * @return array|null
   1062 +     */
   1063 +    public function getFieldset($field = null, $fieldset = 'catalog_product_dataflow', $area = 'admin')
   1064 +    {
   1065 +        $fieldsetData = Mage::getConfig()->getFieldset($fieldset, $area);
   1066 +        if ($fieldsetData) {
   1067 +            return $fieldsetData ? $fieldsetData->$field : $fieldsetData;
   1068 +        }
   1069 +        return $fieldsetData;
   1070 +    }

The Good News is that it's only called via one area in the code and as long as you have a valid product ID you won't call this function. But if there isn't a valid product ID or someone attempts to use this function based on how it was designed issues likely will surface.

app/design/adminhtml/default/default/template/catalog/product/tab/inventory.phtml

<?php echo (bool)$this->getProduct()->getId() ? (int)$this->getFieldValue('min_sale_qty') : Mage::helper('catalog/product')->getDefaultProductValue('min_sale_qty', $this->getProduct()->getTypeId()) ?>
2

EE 1.13.1.0 running PHP 7.0.x with the Inchoo PHP7 module:

Promotions > Shopping Cart Rules (probably others, as well): you can't save a rule, an exception, "Wrong rule specified," is thrown.

We resolved this by rewriting Mage_Adminhtml_Helper_Data::removeTags with the one from 1.14.x.x (I used 1.14.4.0 - not sure of the exact version that changed it).

Updated version:

public function removeTags($html)
{
    $html = preg_replace_callback(
        "# <(?![/a-z]) | (?<=\s)>(?![a-z]) #xi",
        function ($matches) {
            return htmlentities($matches[0]);
        },
        $html
    );
    $html =  strip_tags($html);
    return htmlspecialchars_decode($html);
}
1

Had the same issue as @Mat

On M1, 1.9.1.0 with all previous patches applied, I get numerous errors:

My line endings were not set to unix/macosx on the repo (another dev using Win-dows).

used dos2unix to convert the necessary files and worked.

And as @chaoticgeek, I have the:

Hunk #1 FAILED at 483. 1 out of 1 hunk FAILED -- saving rejects to file js/tiny_mce/plugins/media/js/media.js.rej

It has happened on all repos (6) so far, 1.9.2.4, 1.9.3.8 x 2, 1.9.3.2 x 2, and 1.9.2.1.

  • Confirmed the same issue on EE 1.13.10 – Laura Jun 27 at 18:59
1

On M1 version 1.9.4.0 with all previous patches applied I got the following error

checking file app/Mage.php
Hunk #1 FAILED at 816.
1 out of 1 hunk FAILED

as I can see from the patch file, it's looking for

diff --git app/Mage.php app/Mage.php
index 1136f6e9351..eb9e6db3a9e 100644
--- app/Mage.php
+++ app/Mage.php
@@ -816,9 +816,9 @@ final class Mage
             ',',
             (string) self::getConfig()->getNode('dev/log/allowedFileExtensions', Mage_Core_Model_Store::DEFAULT_CODE)
         );
-        $logValidator = new Zend_Validate_File_Extension($_allowedFileExtensions);
         $logDir = self::getBaseDir('var') . DS . 'log';
-        if (!$logValidator->isValid($logDir . DS . $file)) {
+        $validatedFileExtension = pathinfo($file, PATHINFO_EXTENSION);
+        if (!$validatedFileExtension || !in_array($validatedFileExtension, $_allowedFileExtensions)) {
             return;
         }

but instead, here's what I've got

        }

        try {
            if (!isset($loggers[$file])) {
                $logDir  = self::getBaseDir('var') . DS . 'log';
                $logFile = $logDir . DS . $file;

                if (!is_dir($logDir)) {
                    mkdir($logDir);

I confirmed on https://raw.githubusercontent.com/OpenMage/magento-mirror/1.9.4.0/app/Mage.php that we have the correct code and version.

Will update if I find the solution

  • Same issue with 1.9.3.7 – veli Jun 28 at 9:24
  • I am agree with @Haim . I am also getting the same issue after apply the SUPEE -11155 patch On M1 version 1.9.4.0. Below one error Checking if patch can be applied/reverted successfully... -e ERROR: Patch can't be applied/reverted successfully. checking file app/Mage.php Hunk #1 FAILED at 816. 1 out of 1 hunk FAILED Let me know if anybody find the solution – Vikas Gupta Jul 3 at 15:43
1

For those who are using PHP 5.3 (or less than 5.4), then here are some parts of the patch you would need to change.

For reference, this is for PATCH_SUPEE-11155_CE_1.7.0.2_v4-2019-08-01-03-58-34

app/code/core/Mage/Adminhtml/controllers/Newsletter/TemplateController.php

$allowedHtmlTags = ['text', 'styles'];

FIX:
$allowedHtmlTags = array('text', 'styles');

app/code/core/Mage/Adminhtml/controllers/System/Email/TemplateController.php

$allowedHtmlTags = ['template_text', 'styles']

FIX:
$allowedHtmlTags = array('template_text', 'styles');

app/code/core/Mage/Cms/Helper/Data.php

$statusSwf = $statusSwf->asArray()[0];

FIX:
$statusSwf = $statusSwf->asArray();
$statusSwf = $statusSwf[0];

Note: If you're changing these in the patch file, remember to change the length positions as well since you are adding a newline in the patch file. For example for the last one mentioned above:

@@ -74,4 +75,19 @@ class Mage_Cms_Helper_Data extends Mage_Core_Helper_Abstract

change to 

@@ -74,4 +75,20 @@ class Mage_Cms_Helper_Data extends Mage_Core_Helper_Abstract
             ^^ incremented
0

On M1, 1.9.1.0 I've got

Hunk #1 FAILED at 483 (different line endings).

Even when I run

find . -type f -exec dos2unix {} \;

nothing changes.

How can I know which file it is ? 486 is path line ?

  • Could find any solution so I had to run path in Win environment. Since patching works only with files there is no need to have web server. – Hypo Jun 26 at 13:40
0

I'm currently on v1.9.3.1 and got several conflicts. I'm using the third version of the patch (see the filename):

EDIT: After some check we are actually missing some previous patches. Will update later.

PATCH_SUPEE-11155_CE_1.9.3.1_v3-2019-06-18-08-15-43.sh: 14: PATCH_SUPEE-11155_CE_1.9.3.1_v3-2019-06-18-08-15-43.sh: 127: not found
PATCH_SUPEE-11155_CE_1.9.3.1_v3-2019-06-18-08-15-43.sh: 14: PATCH_SUPEE-11155_CE_1.9.3.1_v3-2019-06-18-08-15-43.sh: 127: not found
PATCH_SUPEE-11155_CE_1.9.3.1_v3-2019-06-18-08-15-43.sh: 25: PATCH_SUPEE-11155_CE_1.9.3.1_v3-2019-06-18-08-15-43.sh: 0: not found
Checking if patch can be applied/reverted successfully...
-e ERROR: Patch can\'t be applied/reverted successfully.

checking file app/Mage.php
checking file app/code/core/Mage/Admin/Model/Block.php
checking file app/code/core/Mage/Admin/Model/User.php
Hunk #1 succeeded at 586 (offset -4 lines).
checking file app/code/core/Mage/AdminNotification/etc/system.xml
checking file app/code/core/Mage/Adminhtml/Block/Api/Role/Grid/User.php
checking file app/code/core/Mage/Adminhtml/Block/Catalog/Product/Edit/Tab/Super/Config.php
Hunk #1 FAILED at 155.
1 out of 1 hunk FAILED
checking file app/code/core/Mage/Adminhtml/Block/Newsletter/Queue/Preview.php
checking file app/code/core/Mage/Adminhtml/Block/Newsletter/Template/Preview.php
checking file app/code/core/Mage/Adminhtml/Block/Permissions/Role/Grid/User.php
checking file app/code/core/Mage/Adminhtml/Block/Sales/Creditmemo/Grid.php
checking file app/code/core/Mage/Adminhtml/Block/Sales/Invoice/Grid.php
checking file app/code/core/Mage/Adminhtml/Block/Sales/Order/Create/Header.php
checking file app/code/core/Mage/Adminhtml/Block/Sales/Order/Creditmemo/Create.php
checking file app/code/core/Mage/Adminhtml/Block/Sales/Order/Grid.php
checking file app/code/core/Mage/Adminhtml/Block/Sales/Order/Invoice/Create.php
checking file app/code/core/Mage/Adminhtml/Block/Sales/Order/Shipment/Create.php
checking file app/code/core/Mage/Adminhtml/Block/Sales/Order/View.php
checking file app/code/core/Mage/Adminhtml/Block/Sales/Shipment/Grid.php
checking file app/code/core/Mage/Adminhtml/Block/Sales/Transactions/Grid.php
checking file app/code/core/Mage/Adminhtml/Block/System/Email/Template/Preview.php
checking file app/code/core/Mage/Adminhtml/Block/Template.php
checking file app/code/core/Mage/Adminhtml/Block/Widget/Grid/Column/Renderer/Abstract.php
checking file app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator.php
Hunk #1 FAILED at 180.
1 out of 1 hunk FAILED
1 out of 1 hunk FAILED
checking file app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Baseurl.php
checking file app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Locale.php
checking file app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Serialized/Array.php
checking file app/code/core/Mage/Adminhtml/controllers/Catalog/Product/AttributeController.php
checking file app/code/core/Mage/Adminhtml/controllers/Catalog/Product/ReviewController.php
checking file app/code/core/Mage/Adminhtml/controllers/Catalog/ProductController.php
checking file app/code/core/Mage/Adminhtml/controllers/Checkout/AgreementController.php
checking file app/code/core/Mage/Adminhtml/controllers/Newsletter/TemplateController.php
checking file app/code/core/Mage/Adminhtml/controllers/Promo/CatalogController.php
checking file app/code/core/Mage/Adminhtml/controllers/Promo/QuoteController.php
checking file app/code/core/Mage/Adminhtml/controllers/Sales/Order/CreateController.php
checking file app/code/core/Mage/Adminhtml/controllers/SitemapController.php
checking file app/code/core/Mage/Adminhtml/controllers/System/Email/TemplateController.php
checking file app/code/core/Mage/Catalog/Helper/Product.php
checking file app/code/core/Mage/Catalog/controllers/Product/CompareController.php
checking file app/code/core/Mage/Checkout/Model/Session.php
checking file app/code/core/Mage/Checkout/controllers/OnepageController.php
Hunk #1 succeeded at 570 (offset 8 lines).
checking file app/code/core/Mage/Cms/Helper/Data.php
checking file app/code/core/Mage/Cms/Model/Wysiwyg/Config.php
checking file app/code/core/Mage/Cms/etc/config.xml
checking file app/code/core/Mage/Compiler/Model/Process.php
checking file app/code/core/Mage/Core/Helper/Abstract.php
checking file app/code/core/Mage/Core/Helper/Data.php
checking file app/code/core/Mage/Core/Model/Design/Package.php
checking file app/code/core/Mage/Core/Model/Email/Template/Filter.php
checking file app/code/core/Mage/Core/Model/File/Validator/AvailablePath.php
checking file app/code/core/Mage/Core/Model/Observer.php
checking file app/code/core/Mage/Core/etc/config.xml
checking file app/code/core/Mage/Core/functions.php
checking file app/code/core/Mage/CurrencySymbol/Model/System/Currencysymbol.php
checking file app/code/core/Mage/Downloadable/controllers/DownloadController.php
checking file app/code/core/Mage/SalesRule/Model/Coupon/Massgenerator.php
checking file app/code/core/Mage/SalesRule/Model/Resource/Report/Rule/Createdat.php
checking file app/code/core/Mage/Sendfriend/etc/config.xml
checking file app/code/core/Mage/Sendfriend/etc/system.xml
checking file app/design/adminhtml/default/default/template/catalog/product/composite/fieldset/configurable.phtml
checking file app/design/adminhtml/default/default/template/catalog/product/helper/gallery.phtml
Hunk #1 FAILED at 59.
1 out of 1 hunk FAILED
checking file app/design/adminhtml/default/default/template/catalog/product/tab/inventory.phtml
checking file app/design/adminhtml/default/default/template/currencysymbol/grid.phtml
checking file app/design/adminhtml/default/default/template/customer/tab/addresses.phtml
checking file app/design/adminhtml/default/default/template/customer/tab/view.phtml
checking file app/design/adminhtml/default/default/template/notification/window.phtml
checking file app/design/adminhtml/default/default/template/sales/order/create/data.phtml
checking file app/design/adminhtml/default/default/template/sales/order/view/info.phtml
Hunk #4 succeeded at 176 (offset 22 lines).
Hunk #5 succeeded at 189 with fuzz 1 (offset 22 lines).
checking file app/design/adminhtml/default/default/template/system/currency/rate/matrix.phtml
checking file app/locale/en_US/Mage_Adminhtml.csv
checking file app/locale/en_US/Mage_Core.csv
checking file app/locale/en_US/Mage_Sales.csv
checking file app/locale/en_US/Mage_Sitemap.csv
checking file js/mage/adminhtml/wysiwyg/tiny_mce/setup.js
checking file js/tiny_mce/plugins/media/js/media.js
checking file js/varien/js.js
checking file lib/phpseclib/PHP/Compat/Function/array_fill.php
checking file lib/phpseclib/PHP/Compat/Function/bcpowmod.php
checking file lib/phpseclib/PHP/Compat/Function/str_split.php
0

I am currently faced with this issue when updating from 1.9.4.1 to 1.9.4.2. Whereby, admin order create, and frontend checkout now result in 500 internal server errors without any error logged or shown.

  • The checkout issue appears to affect php 7.1 and php 7.2 stores that use Authorize.net Direct post. Are you seeing the 500 error with this processor, Paypal or others? We're also concerned about killing checkout with this security update. – themew Jul 20 at 16:27
  • 1
    @themew I managed to fix the error by overriding the module. The error for me was/is incompatible code with PHP 5.4 – Vaishal Patel Jul 20 at 17:36
0

same issue on Magento CE 1.8.1 with all patches applied:

checking file app/Mage.php Hunk #1 FAILED at 813. 1 out of 1 hunk FAILED

any help/idea out there?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.