5

Magento has released a SUPEE-11295 patch.

Description of vulnerabilities here: https://helpx.adobe.com/security/products/magento/apsb20-02.html

Can be downloaded here: https://magento.com/tech-resources/download

Please share any issue that you have found with this patch!

6

Updated 3/9/2020 - scroll down for IE11 issue

This is an easy one for a change! I applied the full upgrade on both EE and CE (M1). Both upgrades went smoothly and no third-party extensions or other customizations were affected.

EE 1.14.4.3 -> 1.14.4.4
CE 1.9.4.3 -> 1.9.4.4

Fair warning if you're doing the full upgrade - the copyright year changed in nearly every single file! Here is a list of files I found with actual code changes:

CE 1.9.4.4

app\code\core\Mage\Adminhtml\Block\Catalog\Product\Helper\Form\Gallery\Content.php
app\code\core\Mage\Adminhtml\Block\Cms\Wysiwyg\Images\Content\Uploader.php
app\code\core\Mage\Compiler\Block\Process.php
app\code\core\Mage\Compiler\controllers\Adminhtml\Compiler\ProcessController.php
app\code\core\Mage\Compiler\Model\Process.php
app\code\core\Mage\Core\Model\Input\Filter\MaliciousCode.php
app\design\adminhtml\default\default\template\forgotpassword.phtml
app\design\adminhtml\default\default\template\login.phtml
app\design\adminhtml\default\default\template\page\head.phtml
app\design\adminhtml\default\default\template\resetforgottenpassword.phtml
app\locale\en_US\Mage_Compiler.csv
errors\default\images\logo.gif
js\varien\js.js
lib\Mage\Connect\Command\Install.php
lib\Mage\Connect\Package.php

EE 1.14.4.4

app\code\core\Mage\Adminhtml\Block\Catalog\Product\Helper\Form\Gallery\Content.php
app\code\core\Mage\Adminhtml\Block\Cms\Wysiwyg\Images\Content\Uploader.php
app\code\core\Mage\Compiler\Block\Process.php
app\code\core\Mage\Compiler\controllers\Adminhtml\Compiler\ProcessController.php
app\code\core\Mage\Compiler\Model\Process.php
app\code\core\Mage\Core\Model\Input\Filter\MaliciousCode.php
app\design\adminhtml\default\default\template\forgotpassword.phtml
app\design\adminhtml\default\default\template\login.phtml
app\design\adminhtml\default\default\template\page\head.phtml
app\design\adminhtml\default\default\template\resetforgottenpassword.phtml
app\locale\en_US\Mage_Compiler.csv
js\varien\js.js
lib\Mage\Connect\Command\Install.php
lib\Mage\Connect\Package.php

IE11 bug discovered weeks after deployment

Add-to-cart functionality, navigation hover menus, or other JS things might be broken in IE11.

File: /js/varien/js.js

New Method Added by Magento:

function buttonDisabler() {
    const buttons = document.querySelectorAll('button.save');
    buttons.forEach(button => button.disabled = true);
}

Patch for IE11 compatibility:

function buttonDisabler() {
    const buttons = document.querySelectorAll('button.save');
    buttons.forEach(function(button) {button.disabled = true;});
}
| improve this answer | |
  • 1
    +1 installed without any issues! – Icon Jan 30 at 4:44
2

Since there is no patch for 1.6.2, we tried the 1.6.1 patch. Unfortunately it will fail but the fix is easy: In lines 220-222 of the patch file (for app/design/adminhtml/default/default/template/forgotpassword.phtml), just add a semicolon at the end of the PHP statements. Change:

 <title><?php echo Mage::helper('adminhtml')->__('Log into Magento Admin Page') ?></title>
 <link type="text/css" rel="stylesheet" href="<?php echo $this->getSkinUrl('reset.css') ?>" media="all" />
 <link type="text/css" rel="stylesheet" href="<?php echo $this->getSkinUrl('boxes.css') ?>" media="all" />

like this:

 <title><?php echo Mage::helper('adminhtml')->__('Log into Magento Admin Page'); ?></title>
 <link type="text/css" rel="stylesheet" href="<?php echo $this->getSkinUrl('reset.css'); ?>" media="all" />
 <link type="text/css" rel="stylesheet" href="<?php echo $this->getSkinUrl('boxes.css'); ?>" media="all" />

With this small fix, the patch can be applied without any problems (if all previous patches have been applied). So far, everything is smooth and we did not encounter any issues.

| improve this answer | |
  • Still no official patch for version 1.6.2.0. Is it fine to install 1.6.1.0 patch for it? Or maybe this patch isn't needed for 1.6.2.0? – Prashant Feb 18 at 11:00
  • 1
    So far no problems with the 1.6.1.0 patch for us. I'd highly recommend to install it since the security issues fixed in it are relevant for 1.6.2.0, too. – Roland Jäger Feb 19 at 13:11
2

There seems to be a checkout-breaking issue for IE11 both in the patch and Magento 1.9.4.4. I was able to solve it by making the following change in js/varien/js.js:

Replace row 776:

buttons.forEach(button => button.disabled = true);

With:

buttons.forEach(function(button) {
    button.disabled = true;
});

Source: Slightly modified from here: https://community.magento.com/t5/Magento-2-x-Version-Upgrades/Magento-1-9-4-4-has-a-checkout-breaking-JavaScript-bug-for-IE11/td-p/413224#

| improve this answer | |
1

We have faced some console errors and button click issues in our site after upgrading to 1.14.4.4. These errors break place order functionality, toolbar options and compare links in the PLP page.

Console Errors:

'review' is not defined

'decorateTable' is not defined

'setLocation' is not defined

In this release Magento fixed the button issue (button click not changing the state as expected) in Admin->System->Compilation->Tools->Compiler section. For this, they have added a new JS function in

js/varien/js.js

function buttonDisabler() {
  const buttons = document.querySelectorAll('button.save');
  buttons.forEach(button => button.disabled = true);
}

This function caused the issues in IE 11 Browser. The "<" operator is not supported in IE, which throws a syntax error and stops the next functions.

To Fix this, we have updated the function as below (replacing the "<" operator"):

function buttonDisabler() {
    const buttons = document.querySelectorAll('button.save');
    buttons.forEach(function(button) {
        button.disabled = true;
    });
}
| improve this answer | |
1

In the SUPEE-11295 Patchfile v2, the file js/varien/js.js isn't changed anymore. If you download Magento 1.9.4.4, it still has the changed file.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.