Magento Stack Exchange is a question and answer site for users of the Magento e-Commerce platform. It only takes a minute to sign up.
Sign up to join this community
Magento have released new Magento 1 versions
The patch number is SUPEE-11314 and is available at https://magento.com/tech-resources/download
A summary (covering both M1 and M2 so it's hard to discern) is available at https://helpx.adobe.com/security/products/magento/apsb20-22.html
Did you encounter any compatibility problems or bugs after applying the patch?
Be aware that it isn't possible to revert this update, it updates the password hashes so you won't be able to login on the admin or front end if you install then revert back to 1.9.4.4.
Ebizmarts SagePay extension MOTO admin payments stopped working in 1.9.4.5, the payments on the frontend were unaffected.
Server error 5006: Unable to redirect to Vendor's web site. The Vendor
failed to provide a RedirectionURL.
The Ebizmarts SagePay extension uses an Admin SID to get the response from SagePay to the Magento Admin. To get working I had to override the following to re-enable Admin SID's: app/code/core/Mage/Admin/etc/config.xml
<use_admin_sid>1</use_admin_sid>
I am also having a problem with it creating multiple NULL, NULL users with a different password hash in the admin_user table, I have not figured out what is causing it yet. Is anyone else having this problem?
UPDATE: Magento released a v2 patch that adds these lines in the Observer.php file
Patch seems to be missing a few lines that are present in a vanilla 1.9.4.5 installation for Mage/Admin/Model/Observer.php, not sure if that is intentional or not, but adding them in helped with some of the problems mentioned here like the NULL entries in admin_user table.
Patch:
+ /**
+ * Validate admin password and upgrade hash version
+ *
+ * @param Varien_Event_Observer $observer
+ */
+ public function actionAdminAuthenticate($observer)
+ {
+ $password = $observer->getEvent()->getPassword();
+ $user = $observer->getEvent()->getUser();
+
+ if (
+ !(bool) $user->getPasswordUpgraded()
+ && !Mage::helper('core')->getEncryptor()->validateHashByVersion(
+ $password,
+ $user->getPassword(),
+ Mage_Core_Model_Encryption::HASH_VERSION_SHA256
+ )
+ ) {
+ Mage::getModel('admin/user')->load($user->getId())
+ ->setNewPassword($password)->setForceNewPassword(true)
+ ->save();
+ $user->setPasswordUpgraded(true);
+ }
+ }
Vanilla 1.9.4.5 (as seen on magento-mirror github) https://github.com/OpenMage/magento-mirror/blob/magento-1.9/app/code/core/Mage/Admin/Model/Observer.php#L136
/**
* Validate admin password and upgrade hash version
*
* @param Varien_Event_Observer $observer
*/
public function actionAdminAuthenticate($observer)
{
$password = $observer->getEvent()->getPassword();
$user = $observer->getEvent()->getUser();
//// Not Present in Patch
$authResult = $observer->getEvent()->getResult();
if (!$authResult) {
return;
}
//// End
if (
!(bool) $user->getPasswordUpgraded()
&& !Mage::helper('core')->getEncryptor()->validateHashByVersion(
$password,
$user->getPassword(),
Mage_Core_Model_Encryption::HASH_VERSION_SHA256
)
) {
Mage::getModel('admin/user')->load($user->getId())
->setNewPassword($password)->setForceNewPassword(true)
->save();
$user->setPasswordUpgraded(true);
}
}
Uploading images causes admin session to logout
In Magento 1.9.1.0 (edit: and also 1.9.3.4) we experience an issue with uploading images in de adminhtml. The upload button on both product images and cms (through the wysiwyg editor) makes a POST request with a SID parameter in the URL. The patch changes the logic of the admin Session to the following:
/**
* Logout user if was logged not from admin
*/
protected function logoutIndirect()
{
$user = $this->getUser();
if ($user) {
$extraData = $user->getExtra();
if (
!is_null(Mage::app()->getRequest()->getParam('SID'))
&& !$this->allowAdminSid()
|| isset($extraData['indirect_login'])
&& $this->getIndirectLogin()
) {
$this->unsetData('user');
$this->setIndirectLogin(false);
}
}
}
The part !is_null(Mage::app()->getRequest()->getParam('SID')) && !$this->allowAdminSid() is true in this case. The allowAdminSid() method returns an XML only config (app/code/core/Mage/Core/etc/config.xml) value which is false by default (and not available in the adminhtml settings). The upload image POST request always has an SID parameter in the URL by this code in: app/code/core/Mage/Adminhtml/Block/Cms/Wysiwyg/Images/Content/Uploader.php Regardless of this hidden xml config setting.
The result is that your admin session always gets terminated after uploading an image in the backend.
Quick Solution
Local overwrite of this bugged class: app/code/core/Mage/Adminhtml/Block/Cms/Wysiwyg/Images/Content/Uploader.php class and the class app/code/core/Mage/Adminhtml/Block/Catalog/Product/Helper/Form/Gallery/Content.php
Copy the above files over to: app/code/local/Mage/Adminhtml/Block/Cms/Wysiwyg/Images/Content/Uploader.php and app/code/local/Mage/Adminhtml/Block/Catalog/Product/Helper/Form/Gallery/Content.php
And remove the ->addSessionParam() method respectively from around line 47 and line 58
I have had the issue with admin_user table and multiple NULL users following this patch. I could replicate the issue by attempting to log in with incorrect credentials. The issue was compounded by an apparent brute force attack on our admin, resulting in many NULL admin users.
This can be fixed by making the following changes to the observer to update password hash in: Mage_Admin_Model_Observer (I recommend creating a module to override this class, please don't make changes to core files etc etc...) Basically we are checking that $observer->getEvent()->getUser() is returning an actual user before attempting to update the password.
public function actionAdminAuthenticate($observer)
{
$password = $observer->getEvent()->getPassword();
$user = $observer->getEvent()->getUser();
if($user->getId()) {
if (
!(bool) $user->getPasswordUpgraded()
&& !Mage::helper('core')->getEncryptor()->validateHashByVersion(
$password,
$user->getPassword(),
Mage_Core_Model_Encryption::HASH_VERSION_SHA256
)
) {
Mage::getModel('admin/user')->load($user->getId())
->setNewPassword($password)->setForceNewPassword(true)
->save();
$user->setPasswordUpgraded(true);
}
}
}
I think there could be a second issue. The admin user attribute password_upgraded referenced above is set but never saved. This attribute doesn't exist in the admin_user table. I have added a field password_upgraded to admin_user and that seems to have fixed this second issue.
We just experience an issue with the M1.9.4.5 update. Could not log into admin or customer accounts. Explored all the normal fixes for these issues and nothing worked until we reverted back to 1.9.4.4.
Enterprise Edition 1.12
app/code/core/Enterprise/Pci/Mode/Observer undefined method _getCoreHelper on upgradeApiKey method.
old:
$coreHelper = Mage::helper('core');
New:
$coreHelper = $this->_getCoreHelper();
You can create a module to fix this.
On Magento 1.9.3.1 we seem to experience a 500 error when a customer logs in... Trying to log in a second time and it works fine... 
I observed the following problem on Magento 1.9.0.1 fully patched:
Patch SUPEE-11314 breaks correct wishlist adding behaviour on product detail view of configurable products.
Before:
By clicking "Add to Wishlist" you save the configurable product with selected option correctly to your wishlist. In the wishlist you can edit the wishlist item and change the selected option later.
After applying SUPEE-11314:
The selected configurable option is not correctly saved to wishlist. Instead the configurable product gets saved to wishlist without the selected option. Editing the wishlist item doesn't work anymore.
The patches' changes to app/design/frontend/base/default/template/catalog/product/view/addto.phtml seem to be the reason for this problem:
Before the patch client side JS was used to submit the selected product:
onclick="productAddToCartForm.submitLight(this, this.href); return false;"
After the patch an url is used which is generated by PHP - so the selection is not checked:
onclick="customFormSubmit('<?php echo $this->helper('wishlist')->getAddUrlWithCustomParams($_product, array(), false) ?>', '<?php echo $this->escapeHtml(json_encode(array('form_key' => $this->getFormKey()))) ?>', 'post')"
This patch ads same updates to Base templates as SUPEE-11219 did to rwd. Also it ads observer to update password hash on next login.
these are the places where problems can show up
Thanks JELLEJ for pointing out customer login error Not sure where to add this attribute password_created_at
This fixes the issue for me Move App\Code\Core\Mage\Customer\Model\Resource\Customer.php to local folder App\Code\Local\Mage\Customer\Model\Resource\Customer.php
and comment out line 240 $this->saveAttribute($customer, 'password_created_at');
