6

Magento have released new Magento 1 versions

  • 1.14.4.5
  • 1.9.4.5

The patch number is SUPEE-11314 and is available at https://magento.com/tech-resources/download

A summary (covering both M1 and M2 so it's hard to discern) is available at https://helpx.adobe.com/security/products/magento/apsb20-22.html

Did you encounter any compatibility problems or bugs after applying the patch?

  • 2
    Can't speak about the patch but the notable things in 1.9.4.5 compared to 1.9.4.4 seem to be introduction or changes to formkey submission on various frontend forms (add to cart, wishlist, etc) and forcing an upgrade of the hash on admin user, customer, and API user passwords. Need to do some more testing but its possible that custom themes may need updating for the formkey changes. – BlueC Apr 30 at 10:31
6

Be aware that it isn't possible to revert this update, it updates the password hashes so you won't be able to login on the admin or front end if you install then revert back to 1.9.4.4.

Ebizmarts SagePay extension MOTO admin payments stopped working in 1.9.4.5, the payments on the frontend were unaffected.

Server error 5006: Unable to redirect to Vendor's web site. The Vendor
failed to provide a RedirectionURL.

The Ebizmarts SagePay extension uses an Admin SID to get the response from SagePay to the Magento Admin. To get working I had to override the following to re-enable Admin SID's: app/code/core/Mage/Admin/etc/config.xml

<use_admin_sid>1</use_admin_sid>

I am also having a problem with it creating multiple NULL, NULL users with a different password hash in the admin_user table, I have not figured out what is causing it yet. Is anyone else having this problem?

| improve this answer | |
6

UPDATE: Magento released a v2 patch that adds these lines in the Observer.php file


Patch seems to be missing a few lines that are present in a vanilla 1.9.4.5 installation for Mage/Admin/Model/Observer.php, not sure if that is intentional or not, but adding them in helped with some of the problems mentioned here like the NULL entries in admin_user table.

Patch:

+    /**
+     * Validate admin password and upgrade hash version
+     *
+     * @param Varien_Event_Observer $observer
+     */
+    public function actionAdminAuthenticate($observer)
+    {
+        $password = $observer->getEvent()->getPassword();
+        $user = $observer->getEvent()->getUser();
+
+        if (
+            !(bool) $user->getPasswordUpgraded()
+            && !Mage::helper('core')->getEncryptor()->validateHashByVersion(
+                $password,
+                $user->getPassword(),
+                Mage_Core_Model_Encryption::HASH_VERSION_SHA256
+            )
+        ) {
+            Mage::getModel('admin/user')->load($user->getId())
+                ->setNewPassword($password)->setForceNewPassword(true)
+                ->save();
+            $user->setPasswordUpgraded(true);
+        }
+    }

Vanilla 1.9.4.5 (as seen on magento-mirror github) https://github.com/OpenMage/magento-mirror/blob/magento-1.9/app/code/core/Mage/Admin/Model/Observer.php#L136

    /**
     * Validate admin password and upgrade hash version
     *
     * @param Varien_Event_Observer $observer
     */
    public function actionAdminAuthenticate($observer)
    {
        $password = $observer->getEvent()->getPassword();
        $user = $observer->getEvent()->getUser();
//// Not Present in Patch
        $authResult = $observer->getEvent()->getResult();

        if (!$authResult) {
            return;
        }
//// End
        if (
            !(bool) $user->getPasswordUpgraded()
            && !Mage::helper('core')->getEncryptor()->validateHashByVersion(
                $password,
                $user->getPassword(),
                Mage_Core_Model_Encryption::HASH_VERSION_SHA256
            )
        ) {
            Mage::getModel('admin/user')->load($user->getId())
                ->setNewPassword($password)->setForceNewPassword(true)
                ->save();
            $user->setPasswordUpgraded(true);
        }
    }
| improve this answer | |
  • 1
    This is fixed in the v2 of the patch released yesterday. It's actually a huge security hole, since the password hash gets upgraded even if the login attempt failed effectively changing the user's password. – Russ Wilde May 13 at 12:55
  • 1
    Thank you, I checked the v2 patch and it is the exact same except with these lines added. – frostitution May 13 at 16:19
3

Uploading images causes admin session to logout

In Magento 1.9.1.0 (edit: and also 1.9.3.4) we experience an issue with uploading images in de adminhtml. The upload button on both product images and cms (through the wysiwyg editor) makes a POST request with a SID parameter in the URL. The patch changes the logic of the admin Session to the following:

/**
 * Logout user if was logged not from admin
 */
protected function logoutIndirect()
{
    $user = $this->getUser();
    if ($user) {
        $extraData = $user->getExtra();
        if (
            !is_null(Mage::app()->getRequest()->getParam('SID'))
            && !$this->allowAdminSid()
            || isset($extraData['indirect_login'])
            && $this->getIndirectLogin()
        ) {
            $this->unsetData('user');
            $this->setIndirectLogin(false);
        }
    }
}

The part !is_null(Mage::app()->getRequest()->getParam('SID')) && !$this->allowAdminSid() is true in this case. The allowAdminSid() method returns an XML only config (app/code/core/Mage/Core/etc/config.xml) value which is false by default (and not available in the adminhtml settings). The upload image POST request always has an SID parameter in the URL by this code in: app/code/core/Mage/Adminhtml/Block/Cms/Wysiwyg/Images/Content/Uploader.php Regardless of this hidden xml config setting.

The result is that your admin session always gets terminated after uploading an image in the backend.

Quick Solution

Local overwrite of this bugged class: app/code/core/Mage/Adminhtml/Block/Cms/Wysiwyg/Images/Content/Uploader.php class and the class app/code/core/Mage/Adminhtml/Block/Catalog/Product/Helper/Form/Gallery/Content.php

Copy the above files over to: app/code/local/Mage/Adminhtml/Block/Cms/Wysiwyg/Images/Content/Uploader.php and app/code/local/Mage/Adminhtml/Block/Catalog/Product/Helper/Form/Gallery/Content.php

And remove the ->addSessionParam() method respectively from around line 47 and line 58

| improve this answer | |
  • 1
    You sir are a rockstar, thankyou for the fix – Vlad Patru May 26 at 11:46
2

I have had the issue with admin_user table and multiple NULL users following this patch. I could replicate the issue by attempting to log in with incorrect credentials. The issue was compounded by an apparent brute force attack on our admin, resulting in many NULL admin users.

This can be fixed by making the following changes to the observer to update password hash in: Mage_Admin_Model_Observer (I recommend creating a module to override this class, please don't make changes to core files etc etc...) Basically we are checking that $observer->getEvent()->getUser() is returning an actual user before attempting to update the password.

public function actionAdminAuthenticate($observer)
{
    $password = $observer->getEvent()->getPassword();
    $user = $observer->getEvent()->getUser();

    if($user->getId()) {

        if (
            !(bool) $user->getPasswordUpgraded()
            && !Mage::helper('core')->getEncryptor()->validateHashByVersion(
                $password,
                $user->getPassword(),
                Mage_Core_Model_Encryption::HASH_VERSION_SHA256
            )
        ) {
            Mage::getModel('admin/user')->load($user->getId())
                ->setNewPassword($password)->setForceNewPassword(true)
                ->save();
            $user->setPasswordUpgraded(true);
        }

    }

}

I think there could be a second issue. The admin user attribute password_upgraded referenced above is set but never saved. This attribute doesn't exist in the admin_user table. I have added a field password_upgraded to admin_user and that seems to have fixed this second issue.

| improve this answer | |
  • Yes, I have the same problem. A new patch was made available yesterday May 12 that fixed the issue. In this method, instead of $user->getId() they are using $authResult = $observer->getEvent()->getResult(); if (!$authResult) { return; } However the other issues was not fixed. – Vanderson Ramos May 13 at 23:15
1

We just experience an issue with the M1.9.4.5 update. Could not log into admin or customer accounts. Explored all the normal fixes for these issues and nothing worked until we reverted back to 1.9.4.4.

| improve this answer | |
  • The patch modifies how passwords are saved/hashed. And should rehash your password on the next login. Apparently something in your shop is stopping this from happening. – René Schep May 4 at 12:30
1

Enterprise Edition 1.12

app/code/core/Enterprise/Pci/Mode/Observer undefined method _getCoreHelper on upgradeApiKey method.

old:

$coreHelper = Mage::helper('core');

New:

$coreHelper = $this->_getCoreHelper();

You can create a module to fix this.

| improve this answer | |
  • What was the symptom of this error? Where was it breaking? – Luke Rodgers May 5 at 9:08
  • In integration, the service could not connect, the soup message was: Call to undefined method Enterprise_Pci_Model_Observer::_getCoreHelper(), I checked the store version before patch, and I saw the difference – Vanderson Ramos May 5 at 13:25
1

I observed the following problem on Magento 1.9.0.1 fully patched:

Patch SUPEE-11314 breaks correct wishlist adding behaviour on product detail view of configurable products.

Before:

By clicking "Add to Wishlist" you save the configurable product with selected option correctly to your wishlist. In the wishlist you can edit the wishlist item and change the selected option later.

After applying SUPEE-11314:

The selected configurable option is not correctly saved to wishlist. Instead the configurable product gets saved to wishlist without the selected option. Editing the wishlist item doesn't work anymore.

The patches' changes to app/design/frontend/base/default/template/catalog/product/view/addto.phtml seem to be the reason for this problem:

Before the patch client side JS was used to submit the selected product:

onclick="productAddToCartForm.submitLight(this, this.href); return false;"

After the patch an url is used which is generated by PHP - so the selection is not checked:

onclick="customFormSubmit('<?php echo $this->helper('wishlist')->getAddUrlWithCustomParams($_product, array(), false) ?>', '<?php echo $this->escapeHtml(json_encode(array('form_key' => $this->getFormKey()))) ?>', 'post')"
| improve this answer | |
0

This patch ads same updates to Base templates as SUPEE-11219 did to rwd. Also it ads observer to update password hash on next login.

these are the places where problems can show up

| improve this answer | |
0

On Magento 1.9.3.1 we seem to experience a 500 error when a customer logs in... Trying to log in a second time and it works fine... 500 trace

| improve this answer | |
  • In case anyone has this issue, make sure to check if the attribute password_created_at exists. It was missing on my end – JELLEJ May 18 at 8:16

Not the answer you're looking for? Browse other questions tagged or ask your own question.