9

Magento just sent out an email about a new security patch (SUPEE-11219).

https://magento.com/security/patches/supee-11219

Affected versions:

  • Magento Commerce 1.9.0.0-1.14.4.1
  • Magento Open Source 1.5.0.0-1.9.4.1

There are 3 remote code execution vulnerabilities for authenticated users.

Problems

The first problem I found is that the patch is not available for CE < 1.9.3.0. Usually they provide patches for all the affected versions. I will get in touch with Magento about that and update this post.

  • any updates on not available patches? – sergio Oct 9 '19 at 9:02
  • 3
    Piotr Kaminski from Magento wrote in a chat yesterday: "note M1.x patches for older versions will be released in next couple of days due to last minute issues found." – Matthias Zeis Oct 9 '19 at 14:17
  • 3
    My contacts at Magento also told me "The product team informed me they will have patches released in the next couple of days" for < 1.9.3.0 – Tyler V. Oct 9 '19 at 22:45
  • 1
    It is about a week, still nothing from magento team yet. Should we wait more? They don't have anything officially on this issue anywhere on their blog or website? – Prashant Oct 16 '19 at 8:50
  • 1
    Update from Piotr yesterday: "we need another week. due to scope of changes, it turned extremely difficult to port them down". Source is the same chat. – Matthias Zeis Oct 18 '19 at 8:31

11 Answers 11

8

This might be totally just our project related but thought to share this finding. After applying this patch I noticed that if grid, like orders grid, has some custom filtering which uses filter_condition_callback setting. This might produce an error. In our case we have a date field and for the grid it has index recurring_billing_dates and 'filter_condition_callback' => array($this, 'filterRecurringDates'); and that custom callback is just using two different fields from db so the default index shouldn't be used in the filtering at all.

Patch makes the following change:

index 2c8f1623186..52e4f186d05 100644
--- app/code/core/Mage/Adminhtml/Block/Widget/Grid.php
+++ app/code/core/Mage/Adminhtml/Block/Widget/Grid.php
@@ -464,7 +464,7 @@ class Mage_Adminhtml_Block_Widget_Grid extends Mage_Adminhtml_Block_Widget
     {
         if ($this->getCollection()) {
             $field = ( $column->getFilterIndex() ) ? $column->getFilterIndex() : $column->getIndex();
-            if ($column->getFilterConditionCallback()) {
+            if ($column->getFilterConditionCallback() && $column->getFilterConditionCallback()[0] instanceof self) {
                 call_user_func($column->getFilterConditionCallback(), $this->getCollection(), $column);
             } else {
                 $cond = $column->getFilter()->getCondition();

So the change in the if clause might lead one to see error report if the column index isn't same as some column in db and that instanceof self fails. System ends up in the default path without using the call_user_func and tries to use the index directly. In our case the custom field is injected through xml sales_order_grid_update_handle. Now I just probably have to figure out how to change these custom callbacks to work with this patch.

Version we're using is 1.9.4.0.

Edit: Fixed the issue by moving callbacks to another class which extends proper parent class in this case Mage_Adminhtml_Block_Widget_Grid. In the past custom callback functions could basically be in any class and we had these in plain Helper\Data.php which just extended Mage_Core_Helper_Abstract and that didn't work anymore.

| improve this answer | |
  • Thanks for your reply! Can you please explain the fix some more? We currently load the callback functions also in the Helper\Data.php, but we face the same issue. What should be the class to move the callbacks to? See the related question; magento.stackexchange.com/questions/293280/… – JGeer Oct 22 '19 at 12:32
  • What I did to solve our problem was that I just created another Helper file, in this case Helper\Grid.php where I declared the class like this: class OurModule_Helper_Grid extends Mage_Adminhtml_Block_Widget_Grid Then I copied all the necessary functions and changed the xml to point to this new helper class: <action method="addColumnAfter"> <columnId>fs_tuoteryhma1</columnId> <arguments helper="ourmodule/grid/getFsTuoteryhma1GridParams"></arguments> <after>status</after> </action> – erej Oct 24 '19 at 7:14
  • Probably not the best place to put that new class, but had to fix it in hurry :) – erej Oct 24 '19 at 7:21
  • Thanks! @erej! I tried that, but I can not get it right for some reason, still facing the same issue. Can you please check it with our module? – JGeer Oct 24 '19 at 12:10
  • Sure, I'll see what happens if I install and make changes straight to that module. Just a sec and I'll get back to you. – erej Oct 24 '19 at 12:16
7

Problem: Line endings js/tiny_mce/plugins/media/editor_plugin_src.js

checking file js/tiny_mce/plugins/media/editor_plugin_src.js
Hunk #1 FAILED at 379 (different line endings).
1 out of 1 hunk FAILED

Solution:

Execute:

dos2unix  js/tiny_mce/plugins/media/editor_plugin_src.js

Now you can apply patch SUPEE-11219

| improve this answer | |
  • Those using git in Magento with a .gitignore entry of "media" vs the correct "/media" may have issues applying this patch as the contents and updates to "js/tiny_mce/plugins/media" could well have been ignored and not propagated forward. The tiny mce media plugin has been patched a couple of times and if a prior patch change has not be retained due to the erroneous gitignore then subsequent [patch] will not apply. Leaving this here as it may help some. – Flipmedia Nov 27 '19 at 12:03
6

If you have existing customer accounts with 6-character passwords, this patch will lock them out as the new requirement is 7-character.

This is pretty frustrating because there isn't any way of bulk checking this and notifying them as far as I can tell.

| improve this answer | |
  • Thanks for the information. It was helpful. – Parth Thakkar Nov 6 '19 at 6:57
  • 2
    Therefore the class "validate-password" was removed from the password input field in some login.phtml files by this patch. If you have custom templates you can remove this class there to allow existing 6-character passwords again. – hellcode Nov 6 '19 at 11:04
  • @hellcode: it was only removed in the rwd theme, not in the base theme, so themes based on the base theme and not having customised the login template will still have trouble logging in unfortunately (this is based on v13 of the patch) – Pieter Hoste Dec 30 '19 at 15:05
  • Don't remove the entire "validate-password" class instead add one additional "min-pass-length-6". The validator.js will honour the number after "min-pass-length-". This is again introduced in this patch, but unfortunately not documented. And not used in rwd ... – Dimitar Ivanov Feb 20 at 9:25
6

Don't have enough Rep to comment on xyphoids answer, so I'm putting this here.

Passwords with <7 characters still work and users are only locked out if you overrode the templates for persistent/checkout/login.phtml and persistent/customer/form/login.phtml. Since the patch adjusted these templates to no longer validate the password inputs.

If posting this as an answer is bad form i'll delete it.

| improve this answer | |
2

This patch feels like a joke, there are a bunch of fixes done in the rwd theme which aren't included in the base theme for some reason. I noticed this in version 13 (already!?) of the patch for Magento 1.9.1.0.

I'm noticing at least these ones:

  • catalog/product/list.phtml (some changes in base theme, but the ones for the add to cart button from the rwd theme are missing)
  • catalog/product/view/addto.phtml (no changes in base theme, only in rwd theme)
  • checkout/cart/crosssell.phtml (no changes in base theme, only in rwd theme)
  • persistent/checkout/onepage/login.phtml (no changes in base theme, only in rwd theme, this makes it impossible to login using a password with less then 7 characters)

There are probably a bunch more fixes missing in the base theme, but these were the ones which caught my eye.

I suppose we'll have to wait on version 14, which might contain fixes for these issues (or not ...)

| improve this answer | |
  • I've got confirmation from a Magento security manager today that the base theme files will get patched in the next security patch from April 2020. – Pieter Hoste Feb 4 at 19:16
1

A > symbol is missing in 2 locations in

app/design/frontend/rwd/default/template/email/catalog/product/list.phtml

Patch File: PATCH_SUPEE-11219_EE_1.14.2.0_v4-2019-10-08-04-31-11.sh

This line:

+ <?php $_wishlistUrl = $this->helper('wishlist')-getAddUrlWithCustomParams($_product, array(), false); ?>

Should Be:

+ <?php $_wishlistUrl = $this->helper('wishlist')->getAddUrlWithCustomParams($_product, array(), false); ?>

on lines 109 and 194

| improve this answer | |
  • Thanks for the useful information. – Parth Thakkar Nov 5 '19 at 11:14
1

The wait is over. SUPEE-11219 for versions below 1.9.3 are finally available - https://magento.com/tech-resources/download.

| improve this answer | |
1

Magento ce-1.9.1.1

$ ./PATCH_SUPEE-11219_CE_1.9.1.0_v9-2019-11-01-09-20-21.sh 
Checking if patch can be applied/reverted successfully...
ERROR: Patch can't be applied/reverted successfully.

...
checking file app/code/core/Mage/Api/Model/Server/Adapter/Soap.php.orig
Reversed (or previously applied) patch detected!  Assume -R? [n] 
Apply anyway? [n] 
Skipping patch.
1 out of 1 hunk ignored
...

Solution:

Change copyright one year back.

in app/code/core/Mage/Api/Model/Server/Adapter/Soap.php.orig Line 23:

 * @copyright  Copyright (c) 2006-2015 X.commerce, Inc. (http://www.magento.com)

replace by

 * @copyright  Copyright (c) 2006-2014 X.commerce, Inc. (http://www.magento.com)
| improve this answer | |
0

List of files that are modified or created:

app/code/core/Mage/Admin/Model/User.php
app/code/core/Mage/Admin/etc/config.xml
app/code/core/Mage/Admin/sql/admin_setup/upgrade-1.6.1.2-1.6.1.3.php
app/code/core/Mage/Adminhtml/Block/Api/User/Edit/Tab/Main.php
app/code/core/Mage/Adminhtml/Block/Catalog/Product/Attribute/Set/Main.php
app/code/core/Mage/Adminhtml/Block/Customer/Edit/Renderer/Newpass.php
app/code/core/Mage/Adminhtml/Block/Customer/Edit/Tab/Account.php
app/code/core/Mage/Adminhtml/Block/Newsletter/Queue/Preview.php
app/code/core/Mage/Adminhtml/Block/Newsletter/Template/Edit.php
app/code/core/Mage/Adminhtml/Block/Newsletter/Template/Preview.php
app/code/core/Mage/Adminhtml/Block/Permissions/Tab/Useredit.php
app/code/core/Mage/Adminhtml/Block/Permissions/User/Edit/Tab/Main.php
app/code/core/Mage/Adminhtml/Block/Sales/Order/View.php
app/code/core/Mage/Adminhtml/Block/System/Account/Edit/Form.php
app/code/core/Mage/Adminhtml/Block/System/Email/Template/Edit.php
app/code/core/Mage/Adminhtml/Block/Widget/Grid.php
app/code/core/Mage/Adminhtml/Model/Config/Data.php
app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator.php
app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Locale.php
app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Passwordlength.php
app/code/core/Mage/Adminhtml/controllers/Api/UserController.php
app/code/core/Mage/Adminhtml/controllers/Catalog/CategoryController.php
app/code/core/Mage/Adminhtml/controllers/Catalog/Product/AttributeController.php
app/code/core/Mage/Adminhtml/controllers/CustomerController.php
app/code/core/Mage/Adminhtml/controllers/IndexController.php
app/code/core/Mage/Adminhtml/controllers/Newsletter/TemplateController.php
app/code/core/Mage/Adminhtml/controllers/Permissions/BlockController.php
app/code/core/Mage/Adminhtml/controllers/Sales/OrderController.php
app/code/core/Mage/Adminhtml/controllers/System/ConfigController.php
app/code/core/Mage/Adminhtml/controllers/System/Email/TemplateController.php
app/code/core/Mage/Adminhtml/controllers/Tax/RuleController.php
app/code/core/Mage/Api/Model/Server/Adapter/Soap.php.orig
app/code/core/Mage/Api/Model/User.php
app/code/core/Mage/Api/etc/config.xml
app/code/core/Mage/Api/sql/api_setup/mysql4-upgrade-1.6.0.1-1.6.0.2.php
app/code/core/Mage/Catalog/Block/Product/Abstract.php
app/code/core/Mage/Catalog/Block/Product/Compare/List.php
app/code/core/Mage/Catalog/Block/Product/Price.php
app/code/core/Mage/Catalog/Block/Product/View.php
app/code/core/Mage/Catalog/Helper/Product/Compare.php
app/code/core/Mage/Catalog/Model/Design.php
app/code/core/Mage/Catalog/etc/config.xml
app/code/core/Mage/Catalog/sql/catalog_setup/upgrade-1.6.0.0.19.1.5-1.6.0.0.19.1.6.php
app/code/core/Mage/Checkout/Block/Cart/Item/Renderer.php
app/code/core/Mage/Checkout/Helper/Cart.php
app/code/core/Mage/Checkout/Model/Session.php
app/code/core/Mage/Cms/Block/Widget/Block.php
app/code/core/Mage/Core/Block/Abstract.php
app/code/core/Mage/Core/Helper/Data.php
app/code/core/Mage/Core/Helper/String.php
app/code/core/Mage/Core/Model/App.php
app/code/core/Mage/Core/Model/Encryption.php
app/code/core/Mage/Core/Model/File/Uploader.php
app/code/core/Mage/Core/Model/Input/Filter/MaliciousCode.php
app/code/core/Mage/Core/Model/Layout/Validator.php
app/code/core/Mage/Core/Model/Resource/File/Storage/Database.php
app/code/core/Mage/Core/etc/config.xml
app/code/core/Mage/Core/etc/jstranslator.xml
app/code/core/Mage/Core/etc/system.xml
app/code/core/Mage/Core/sql/core_setup/upgrade-1.6.0.8-1.6.0.9.php
app/code/core/Mage/Core/sql/core_setup/upgrade-1.6.0.9-1.6.0.10.php
app/code/core/Mage/Customer/Block/Account/Changeforgotten.php
app/code/core/Mage/Customer/Block/Address/Renderer/Default.php
app/code/core/Mage/Customer/Block/Form/Register.php
app/code/core/Mage/Customer/Model/Customer.php
app/code/core/Mage/Customer/Model/Customer/Attribute/Backend/Password.php
app/code/core/Mage/Customer/controllers/AccountController.php
app/code/core/Mage/Customer/etc/config.xml
app/code/core/Mage/Customer/etc/system.xml
app/code/core/Mage/Dataflow/Model/Convert/Container/Abstract.php
app/code/core/Mage/Dataflow/Model/Convert/Parser/Csv.php
app/code/core/Mage/Dataflow/Model/Convert/Parser/Xml/Excel.php
app/code/core/Mage/Dataflow/Model/Profile.php
app/code/core/Mage/Eav/Model/Entity/Attribute/Backend/Abstract.php
app/code/core/Mage/ImportExport/Model/Import/Adapter/Abstract.php
app/code/core/Mage/ImportExport/Model/Import/Entity/Abstract.php
app/code/core/Mage/Install/Block/Admin.php
app/code/core/Mage/Install/etc/config.xml
app/code/core/Mage/Review/controllers/ProductController.php
app/code/core/Mage/Rss/etc/config.xml
app/code/core/Mage/Widget/controllers/Adminhtml/Widget/InstanceController.php
app/code/core/Mage/Wishlist/Block/Abstract.php
app/code/core/Mage/Wishlist/Block/Customer/Wishlist/Item/Column/Cart.php
app/code/core/Mage/Wishlist/Block/Item/Configure.php
app/code/core/Mage/Wishlist/Block/Share/Email/Items.php
app/code/core/Mage/Wishlist/Helper/Data.php
app/code/core/Mage/XmlConnect/Helper/Translate.php
app/design/adminhtml/default/default/template/resetforgottenpassword.phtml
app/design/frontend/base/default/template/bundle/catalog/product/view/option_tierprices.phtml
app/design/frontend/base/default/template/catalog/product/list.phtml
app/design/frontend/base/default/template/catalog/product/new.phtml
app/design/frontend/base/default/template/catalog/product/price_msrp.phtml
app/design/frontend/base/default/template/catalog/product/price_msrp_item.phtml
app/design/frontend/base/default/template/catalog/product/price_msrp_noform.phtml
app/design/frontend/base/default/template/catalog/product/view/tierprices.phtml
app/design/frontend/base/default/template/reports/home_product_compared.phtml
app/design/frontend/base/default/template/reports/home_product_viewed.phtml
app/design/frontend/base/default/template/wishlist/item/column/remove.phtml
app/design/frontend/base/default/template/wishlist/item/configure/addto.phtml
app/design/frontend/base/default/template/wishlist/render/item/price_msrp_item.phtml
app/design/frontend/rwd/default/template/catalog/product/compare/list.phtml
app/design/frontend/rwd/default/template/catalog/product/list.phtml
app/design/frontend/rwd/default/template/catalog/product/list/related.phtml
app/design/frontend/rwd/default/template/catalog/product/view.phtml
app/design/frontend/rwd/default/template/catalog/product/view/addto.phtml
app/design/frontend/rwd/default/template/catalog/product/view/sharing.phtml
app/design/frontend/rwd/default/template/catalog/product/widget/new/content/new_grid.phtml
app/design/frontend/rwd/default/template/checkout/cart/crosssell.phtml
app/design/frontend/rwd/default/template/checkout/cart/item/default.phtml
app/design/frontend/rwd/default/template/checkout/cart/shipping.phtml
app/design/frontend/rwd/default/template/checkout/cart/sidebar/default.phtml
app/design/frontend/rwd/default/template/checkout/onepage/review/info.phtml
app/design/frontend/rwd/default/template/customer/form/changepassword.phtml
app/design/frontend/rwd/default/template/customer/form/edit.phtml
app/design/frontend/rwd/default/template/customer/form/resetforgottenpassword.phtml
app/design/frontend/rwd/default/template/downloadable/checkout/cart/item/default.phtml
app/design/frontend/rwd/default/template/email/catalog/product/list.phtml
app/design/frontend/rwd/default/template/persistent/checkout/onepage/billing.phtml
app/design/frontend/rwd/default/template/persistent/checkout/onepage/login.phtml
app/design/frontend/rwd/default/template/persistent/customer/form/login.phtml
app/design/frontend/rwd/default/template/persistent/customer/form/register.phtml
app/design/frontend/rwd/default/template/reports/widget/compared/content/compared_grid.phtml
app/design/frontend/rwd/default/template/reports/widget/viewed/content/viewed_grid.phtml
app/design/frontend/rwd/default/template/wishlist/item/column/cart.phtml
app/design/frontend/rwd/default/template/wishlist/shared.phtml
app/design/frontend/rwd/default/template/wishlist/sidebar.phtml
app/design/install/default/default/template/install/create_admin.phtml
app/locale/en_US/Mage_Adminhtml.csv
app/locale/en_US/Mage_Api.csv
app/locale/en_US/Mage_Core.csv
app/locale/en_US/Mage_Customer.csv
app/locale/en_US/Mage_Dataflow.csv
app/locale/en_US/Mage_Eav.csv
app/locale/en_US/Mage_XmlConnect.csv
js/mage/adminhtml/variables.js
js/prototype/validation.js
js/tiny_mce/plugins/media/editor_plugin.js
js/tiny_mce/plugins/media/editor_plugin_src.js
js/varien/js.js
lib/Varien/Filter/FormElementName.php
skin/adminhtml/default/default/boxes.css

Some of the new files in the CE patch have the Enterprise Edition header and license, e.g. app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Passwordlength.php. Does this cause licensing issues?

| improve this answer | |
0

Couple issues that I have come across after applying the patch on various projects.

  • Minicart delete action not working. This is usually a result of custom theme not using form keys in the form submit. Make sure to update the relevant code
-       onclick="return confirm('__('Are you sure you...
+       onclick="if (confirm('jsQuoteEscape($this->__('Are you sure you would like to remove this item from the shopping cart?')) ?>')) {
+                   customFormSubmit('getDeleteUrlCustom(false) ?>','escapeHtml(json_encode(array('form_key' => $this->getFormKey()))) ?>', 'post') }"
  • Custom admin functionality may not work. For example, customer address render is filtered by regex in (app/code/core/Mage/Customer/Block/Address/Renderer/Default.php). Product attributes in wysiwyg editor will filter out some tags as well. Admin side should be checked more thoroughly than usual.

  • 3rd party modules that are depending on customer password length must be adjusted. For example, M2E module generates a random password when creating an order. It generates 6 characters but minimum has been increased to 7 now.

  • Since minimum password length has been increased make sure all custom forms are adjusted. I have seen cases where frontend validation was hardcoded to 6 characters. Usually not critical but this can cause confusion on client side.
| improve this answer | |
  • Minicart fix doesn't seem to be coded correctly. Minicart still broken. – Greg Nickoloff Dec 12 '19 at 21:27
  • That was just a snippet to demonstrate where to find the responsible code and the idea on how to fix it. Exact code actually depends on the template used and any customization that might be added there. – mlagans Dec 13 '19 at 12:36
  • Yeah.... I was looking at it and seeing some stuff in there that didn't make much sense. My bad. – Greg Nickoloff Dec 13 '19 at 15:31
0

I applied SUPEE-11219 v.13 (on EE v.1.14.2.1) and all the admin. passwords were invalidated. Also, we're noticing that the "forgot password" emails are no longer being received. It appears that they are not being sent.

I had applied the patch on two dev copies of the production site and everything seemed to work OK for a few weeks. Except the "remove items from the mini-cart" problem...which I fixed. Then I patched the production site and all three sites developed login problems the next day. (Which makes little to no sense to me) It acted as if, when someone logged in, the password was modified/updated in the database and the user was directed back to the login page where subsequent attempts resulted in an "account locked or not logging in correctly" error message.

I reversed the patch and reset passwords through the admin panel for each user, but it seems that the "forgot" emails are still not working/being received.

Has anyone else had this problem and fixed it?

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.