8

Magento just sent out an email about a new security patch (SUPEE-11219).

https://magento.com/security/patches/supee-11219

Affected versions:

  • Magento Commerce 1.9.0.0-1.14.4.1
  • Magento Open Source 1.5.0.0-1.9.4.1

There are 3 remote code execution vulnerabilities for authenticated users.

Problems

The first problem I found is that the patch is not available for CE < 1.9.3.0. Usually they provide patches for all the affected versions. I will get in touch with Magento about that and update this post.

  • any updates on not available patches? – sergio Oct 9 at 9:02
  • 3
    Piotr Kaminski from Magento wrote in a chat yesterday: "note M1.x patches for older versions will be released in next couple of days due to last minute issues found." – Matthias Zeis Oct 9 at 14:17
  • 3
    My contacts at Magento also told me "The product team informed me they will have patches released in the next couple of days" for < 1.9.3.0 – Tyler V. Oct 9 at 22:45
  • 1
    It is about a week, still nothing from magento team yet. Should we wait more? They don't have anything officially on this issue anywhere on their blog or website? – Prashant Oct 16 at 8:50
  • 1
    Update from Piotr yesterday: "we need another week. due to scope of changes, it turned extremely difficult to port them down". Source is the same chat. – Matthias Zeis Oct 18 at 8:31
6

This might be totally just our project related but thought to share this finding. After applying this patch I noticed that if grid, like orders grid, has some custom filtering which uses filter_condition_callback setting. This might produce an error. In our case we have a date field and for the grid it has index recurring_billing_dates and 'filter_condition_callback' => array($this, 'filterRecurringDates'); and that custom callback is just using two different fields from db so the default index shouldn't be used in the filtering at all.

Patch makes the following change:

index 2c8f1623186..52e4f186d05 100644
--- app/code/core/Mage/Adminhtml/Block/Widget/Grid.php
+++ app/code/core/Mage/Adminhtml/Block/Widget/Grid.php
@@ -464,7 +464,7 @@ class Mage_Adminhtml_Block_Widget_Grid extends Mage_Adminhtml_Block_Widget
     {
         if ($this->getCollection()) {
             $field = ( $column->getFilterIndex() ) ? $column->getFilterIndex() : $column->getIndex();
-            if ($column->getFilterConditionCallback()) {
+            if ($column->getFilterConditionCallback() && $column->getFilterConditionCallback()[0] instanceof self) {
                 call_user_func($column->getFilterConditionCallback(), $this->getCollection(), $column);
             } else {
                 $cond = $column->getFilter()->getCondition();

So the change in the if clause might lead one to see error report if the column index isn't same as some column in db and that instanceof self fails. System ends up in the default path without using the call_user_func and tries to use the index directly. In our case the custom field is injected through xml sales_order_grid_update_handle. Now I just probably have to figure out how to change these custom callbacks to work with this patch.

Version we're using is 1.9.4.0.

Edit: Fixed the issue by moving callbacks to another class which extends proper parent class in this case Mage_Adminhtml_Block_Widget_Grid. In the past custom callback functions could basically be in any class and we had these in plain Helper\Data.php which just extended Mage_Core_Helper_Abstract and that didn't work anymore.

  • Thanks for your reply! Can you please explain the fix some more? We currently load the callback functions also in the Helper\Data.php, but we face the same issue. What should be the class to move the callbacks to? See the related question; magento.stackexchange.com/questions/293280/… – Henk Z Oct 22 at 12:32
  • What I did to solve our problem was that I just created another Helper file, in this case Helper\Grid.php where I declared the class like this: class OurModule_Helper_Grid extends Mage_Adminhtml_Block_Widget_Grid Then I copied all the necessary functions and changed the xml to point to this new helper class: <action method="addColumnAfter"> <columnId>fs_tuoteryhma1</columnId> <arguments helper="ourmodule/grid/getFsTuoteryhma1GridParams"></arguments> <after>status</after> </action> – erej Oct 24 at 7:14
  • Probably not the best place to put that new class, but had to fix it in hurry :) – erej Oct 24 at 7:21
  • Thanks! @erej! I tried that, but I can not get it right for some reason, still facing the same issue. Can you please check it with our module? – Henk Z Oct 24 at 12:10
  • Sure, I'll see what happens if I install and make changes straight to that module. Just a sec and I'll get back to you. – erej Oct 24 at 12:16
5

Problem: Line endings js/tiny_mce/plugins/media/editor_plugin_src.js

checking file js/tiny_mce/plugins/media/editor_plugin_src.js
Hunk #1 FAILED at 379 (different line endings).
1 out of 1 hunk FAILED

Solution:

Execute:

dos2unix  js/tiny_mce/plugins/media/editor_plugin_src.js

Now you can apply patch SUPEE-11219

4

If you have existing customer accounts with 6-character passwords, this patch will lock them out as the new requirement is 7-character.

This is pretty frustrating because there isn't any way of bulk checking this and notifying them as far as I can tell.

  • Thanks for the information. It was helpful. – Parth Thakkar Nov 6 at 6:57
  • 1
    Therefore the class "validate-password" was removed from the password input field in some login.phtml files by this patch. If you have custom templates you can remove this class there to allow existing 6-character passwords again. – hellcode Nov 6 at 11:04
3

Don't have enough Rep to comment on xyphoids answer, so I'm putting this here.

Passwords with <7 characters still work and users are only locked out if you overrode the templates for persistent/checkout/login.phtml and persistent/customer/form/login.phtml. Since the patch adjusted these templates to no longer validate the password inputs.

If posting this as an answer is bad form i'll delete it.

1

A > symbol is missing in 2 locations in

app/design/frontend/rwd/default/template/email/catalog/product/list.phtml

Patch File: PATCH_SUPEE-11219_EE_1.14.2.0_v4-2019-10-08-04-31-11.sh

This line:

+ <?php $_wishlistUrl = $this->helper('wishlist')-getAddUrlWithCustomParams($_product, array(), false); ?>

Should Be:

+ <?php $_wishlistUrl = $this->helper('wishlist')->getAddUrlWithCustomParams($_product, array(), false); ?>

on lines 109 and 194

  • Thanks for the useful information. – Parth Thakkar Nov 5 at 11:14
1

The wait is over. SUPEE-11219 for versions below 1.9.3 are finally available - https://magento.com/tech-resources/download.

1

Magento ce-1.9.1.1

$ ./PATCH_SUPEE-11219_CE_1.9.1.0_v9-2019-11-01-09-20-21.sh 
Checking if patch can be applied/reverted successfully...
ERROR: Patch can't be applied/reverted successfully.

...
checking file app/code/core/Mage/Api/Model/Server/Adapter/Soap.php.orig
Reversed (or previously applied) patch detected!  Assume -R? [n] 
Apply anyway? [n] 
Skipping patch.
1 out of 1 hunk ignored
...

Solution:

Change copyright one year back.

in app/code/core/Mage/Api/Model/Server/Adapter/Soap.php.orig Line 23:

 * @copyright  Copyright (c) 2006-2015 X.commerce, Inc. (http://www.magento.com)

replace by

 * @copyright  Copyright (c) 2006-2014 X.commerce, Inc. (http://www.magento.com)
0

List of files that are modified or created:

app/code/core/Mage/Admin/Model/User.php
app/code/core/Mage/Admin/etc/config.xml
app/code/core/Mage/Admin/sql/admin_setup/upgrade-1.6.1.2-1.6.1.3.php
app/code/core/Mage/Adminhtml/Block/Api/User/Edit/Tab/Main.php
app/code/core/Mage/Adminhtml/Block/Catalog/Product/Attribute/Set/Main.php
app/code/core/Mage/Adminhtml/Block/Customer/Edit/Renderer/Newpass.php
app/code/core/Mage/Adminhtml/Block/Customer/Edit/Tab/Account.php
app/code/core/Mage/Adminhtml/Block/Newsletter/Queue/Preview.php
app/code/core/Mage/Adminhtml/Block/Newsletter/Template/Edit.php
app/code/core/Mage/Adminhtml/Block/Newsletter/Template/Preview.php
app/code/core/Mage/Adminhtml/Block/Permissions/Tab/Useredit.php
app/code/core/Mage/Adminhtml/Block/Permissions/User/Edit/Tab/Main.php
app/code/core/Mage/Adminhtml/Block/Sales/Order/View.php
app/code/core/Mage/Adminhtml/Block/System/Account/Edit/Form.php
app/code/core/Mage/Adminhtml/Block/System/Email/Template/Edit.php
app/code/core/Mage/Adminhtml/Block/Widget/Grid.php
app/code/core/Mage/Adminhtml/Model/Config/Data.php
app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator.php
app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Locale.php
app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Passwordlength.php
app/code/core/Mage/Adminhtml/controllers/Api/UserController.php
app/code/core/Mage/Adminhtml/controllers/Catalog/CategoryController.php
app/code/core/Mage/Adminhtml/controllers/Catalog/Product/AttributeController.php
app/code/core/Mage/Adminhtml/controllers/CustomerController.php
app/code/core/Mage/Adminhtml/controllers/IndexController.php
app/code/core/Mage/Adminhtml/controllers/Newsletter/TemplateController.php
app/code/core/Mage/Adminhtml/controllers/Permissions/BlockController.php
app/code/core/Mage/Adminhtml/controllers/Sales/OrderController.php
app/code/core/Mage/Adminhtml/controllers/System/ConfigController.php
app/code/core/Mage/Adminhtml/controllers/System/Email/TemplateController.php
app/code/core/Mage/Adminhtml/controllers/Tax/RuleController.php
app/code/core/Mage/Api/Model/Server/Adapter/Soap.php.orig
app/code/core/Mage/Api/Model/User.php
app/code/core/Mage/Api/etc/config.xml
app/code/core/Mage/Api/sql/api_setup/mysql4-upgrade-1.6.0.1-1.6.0.2.php
app/code/core/Mage/Catalog/Block/Product/Abstract.php
app/code/core/Mage/Catalog/Block/Product/Compare/List.php
app/code/core/Mage/Catalog/Block/Product/Price.php
app/code/core/Mage/Catalog/Block/Product/View.php
app/code/core/Mage/Catalog/Helper/Product/Compare.php
app/code/core/Mage/Catalog/Model/Design.php
app/code/core/Mage/Catalog/etc/config.xml
app/code/core/Mage/Catalog/sql/catalog_setup/upgrade-1.6.0.0.19.1.5-1.6.0.0.19.1.6.php
app/code/core/Mage/Checkout/Block/Cart/Item/Renderer.php
app/code/core/Mage/Checkout/Helper/Cart.php
app/code/core/Mage/Checkout/Model/Session.php
app/code/core/Mage/Cms/Block/Widget/Block.php
app/code/core/Mage/Core/Block/Abstract.php
app/code/core/Mage/Core/Helper/Data.php
app/code/core/Mage/Core/Helper/String.php
app/code/core/Mage/Core/Model/App.php
app/code/core/Mage/Core/Model/Encryption.php
app/code/core/Mage/Core/Model/File/Uploader.php
app/code/core/Mage/Core/Model/Input/Filter/MaliciousCode.php
app/code/core/Mage/Core/Model/Layout/Validator.php
app/code/core/Mage/Core/Model/Resource/File/Storage/Database.php
app/code/core/Mage/Core/etc/config.xml
app/code/core/Mage/Core/etc/jstranslator.xml
app/code/core/Mage/Core/etc/system.xml
app/code/core/Mage/Core/sql/core_setup/upgrade-1.6.0.8-1.6.0.9.php
app/code/core/Mage/Core/sql/core_setup/upgrade-1.6.0.9-1.6.0.10.php
app/code/core/Mage/Customer/Block/Account/Changeforgotten.php
app/code/core/Mage/Customer/Block/Address/Renderer/Default.php
app/code/core/Mage/Customer/Block/Form/Register.php
app/code/core/Mage/Customer/Model/Customer.php
app/code/core/Mage/Customer/Model/Customer/Attribute/Backend/Password.php
app/code/core/Mage/Customer/controllers/AccountController.php
app/code/core/Mage/Customer/etc/config.xml
app/code/core/Mage/Customer/etc/system.xml
app/code/core/Mage/Dataflow/Model/Convert/Container/Abstract.php
app/code/core/Mage/Dataflow/Model/Convert/Parser/Csv.php
app/code/core/Mage/Dataflow/Model/Convert/Parser/Xml/Excel.php
app/code/core/Mage/Dataflow/Model/Profile.php
app/code/core/Mage/Eav/Model/Entity/Attribute/Backend/Abstract.php
app/code/core/Mage/ImportExport/Model/Import/Adapter/Abstract.php
app/code/core/Mage/ImportExport/Model/Import/Entity/Abstract.php
app/code/core/Mage/Install/Block/Admin.php
app/code/core/Mage/Install/etc/config.xml
app/code/core/Mage/Review/controllers/ProductController.php
app/code/core/Mage/Rss/etc/config.xml
app/code/core/Mage/Widget/controllers/Adminhtml/Widget/InstanceController.php
app/code/core/Mage/Wishlist/Block/Abstract.php
app/code/core/Mage/Wishlist/Block/Customer/Wishlist/Item/Column/Cart.php
app/code/core/Mage/Wishlist/Block/Item/Configure.php
app/code/core/Mage/Wishlist/Block/Share/Email/Items.php
app/code/core/Mage/Wishlist/Helper/Data.php
app/code/core/Mage/XmlConnect/Helper/Translate.php
app/design/adminhtml/default/default/template/resetforgottenpassword.phtml
app/design/frontend/base/default/template/bundle/catalog/product/view/option_tierprices.phtml
app/design/frontend/base/default/template/catalog/product/list.phtml
app/design/frontend/base/default/template/catalog/product/new.phtml
app/design/frontend/base/default/template/catalog/product/price_msrp.phtml
app/design/frontend/base/default/template/catalog/product/price_msrp_item.phtml
app/design/frontend/base/default/template/catalog/product/price_msrp_noform.phtml
app/design/frontend/base/default/template/catalog/product/view/tierprices.phtml
app/design/frontend/base/default/template/reports/home_product_compared.phtml
app/design/frontend/base/default/template/reports/home_product_viewed.phtml
app/design/frontend/base/default/template/wishlist/item/column/remove.phtml
app/design/frontend/base/default/template/wishlist/item/configure/addto.phtml
app/design/frontend/base/default/template/wishlist/render/item/price_msrp_item.phtml
app/design/frontend/rwd/default/template/catalog/product/compare/list.phtml
app/design/frontend/rwd/default/template/catalog/product/list.phtml
app/design/frontend/rwd/default/template/catalog/product/list/related.phtml
app/design/frontend/rwd/default/template/catalog/product/view.phtml
app/design/frontend/rwd/default/template/catalog/product/view/addto.phtml
app/design/frontend/rwd/default/template/catalog/product/view/sharing.phtml
app/design/frontend/rwd/default/template/catalog/product/widget/new/content/new_grid.phtml
app/design/frontend/rwd/default/template/checkout/cart/crosssell.phtml
app/design/frontend/rwd/default/template/checkout/cart/item/default.phtml
app/design/frontend/rwd/default/template/checkout/cart/shipping.phtml
app/design/frontend/rwd/default/template/checkout/cart/sidebar/default.phtml
app/design/frontend/rwd/default/template/checkout/onepage/review/info.phtml
app/design/frontend/rwd/default/template/customer/form/changepassword.phtml
app/design/frontend/rwd/default/template/customer/form/edit.phtml
app/design/frontend/rwd/default/template/customer/form/resetforgottenpassword.phtml
app/design/frontend/rwd/default/template/downloadable/checkout/cart/item/default.phtml
app/design/frontend/rwd/default/template/email/catalog/product/list.phtml
app/design/frontend/rwd/default/template/persistent/checkout/onepage/billing.phtml
app/design/frontend/rwd/default/template/persistent/checkout/onepage/login.phtml
app/design/frontend/rwd/default/template/persistent/customer/form/login.phtml
app/design/frontend/rwd/default/template/persistent/customer/form/register.phtml
app/design/frontend/rwd/default/template/reports/widget/compared/content/compared_grid.phtml
app/design/frontend/rwd/default/template/reports/widget/viewed/content/viewed_grid.phtml
app/design/frontend/rwd/default/template/wishlist/item/column/cart.phtml
app/design/frontend/rwd/default/template/wishlist/shared.phtml
app/design/frontend/rwd/default/template/wishlist/sidebar.phtml
app/design/install/default/default/template/install/create_admin.phtml
app/locale/en_US/Mage_Adminhtml.csv
app/locale/en_US/Mage_Api.csv
app/locale/en_US/Mage_Core.csv
app/locale/en_US/Mage_Customer.csv
app/locale/en_US/Mage_Dataflow.csv
app/locale/en_US/Mage_Eav.csv
app/locale/en_US/Mage_XmlConnect.csv
js/mage/adminhtml/variables.js
js/prototype/validation.js
js/tiny_mce/plugins/media/editor_plugin.js
js/tiny_mce/plugins/media/editor_plugin_src.js
js/varien/js.js
lib/Varien/Filter/FormElementName.php
skin/adminhtml/default/default/boxes.css

Some of the new files in the CE patch have the Enterprise Edition header and license, e.g. app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Passwordlength.php. Does this cause licensing issues?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.