4

What will be the major changes in the files after installation of patch SUPEE-5344 for Magento 1.4.2.0? I mean that any particular files permission changes something like that... Please help me for the same.

  • 3
    This is a patch, check the code? – Fabian Blechschmidt Feb 18 '15 at 13:02
  • 1
    I checked those files.But I didn't understand code.Three files are updated by this patch app/code/core/Mage/Admin/Model/Observer.php, app/code/core/Mage/Core/Controller/Request/Http.php and lib/Varien/Db/Adapter/Pdo/Mysql.php. – MPchan Feb 18 '15 at 13:07
  • 1
    Please note that if you are running Magento CE 1.4.2.0 then the patch you should use is SUPEE-5388 – ForMat Feb 18 '15 at 13:13
  • @ForMat But in the magento download it is mentioned as SUPEE-5344. please check the link magentocommerce.com/download – MPchan Feb 18 '15 at 13:15
  • Once you select your Magento CE 1.4.2.0 version and hit the download button you will see that you will get another patch file (examine the link in your browser). Also check out the list of files for this patch in the answer below by @Matthias – ForMat Feb 18 '15 at 13:35
9

You don't need to understand it. No functionality changes and the API changes are irrelevant for at least 99.99% of developers. If you don't understand it, you are one of those. Just apply it. File permissions are not relevant, as far as I see it prevents an SQL injection through certain requests to the web service.

Specifically for Magento 1.4, the following files have been changed:

  • app/code/core/Mage/Admin/Model/Observer.php

    Do not use URL parameter forwarded for forwarded requests, but property internaly_forwarded that cannot be set from outside

  • app/code/core/Mage/Core/Controller/Request/Http.php

    Provide getters and setters for this property

  • lib/Varien/Data/Collection/Db.php

    Remove field_expr feature from collection conditions. I tried to use that once and it wasn't useful as it is anyway. The core code does not use it anyway as well. So it's safe to say that this won't affect any extensions/customizations.

The patch file for Magento 1.4 up to 1.5.0.1 is PATCH_SUPEE-5388_CE_1.4.0.0-1.5.0.1_v1.sh (Note that the number is 5388, but it is the same patch as 5344 for Magento 1.8 and 1.9)

  • 4
    I value your contribution here, but only the last sentence gives an answer to the OP's question. IMO just saying he doesn't need to understand goes against the whole idea SE stands for, to question things ;) – 7ochem Feb 23 '15 at 9:31
  • 3
    Ignorantly running bash scripts on your machine/server isn't the brightest idea either. – Steve Robbins Apr 22 '15 at 3:39
15

As an example, these files are affected in EE 1.13/1.14:

app/code/core/Enterprise/Logging/Block/Adminhtml/Grid/Filter/Ip.php
app/code/core/Enterprise/Logging/Block/Adminhtml/Index/Grid.php
app/code/core/Enterprise/Logging/Model/Resource/Event/Collection.php
app/code/core/Mage/Admin/Model/Observer.php
app/code/core/Mage/Core/Controller/Request/Http.php
app/code/core/Mage/Oauth/controllers/Adminhtml/Oauth/AuthorizeController.php
app/code/core/Mage/XmlConnect/Model/Observer.php
lib/Varien/Db/Adapter/Pdo/Mysql.php

While it looks like some quite important classes are modified the changes are quite small and won't affect most of the shops as @fschmengler said. The attack vector is pretty complex and requires a complex combination of actions. As far as is known no shop has been compromised yet. According to Magento you should check if unknown files can be found in the web server document root directory.

File permissions are not changed.

Here is a list of the filenames for the different patches in case somebody is confused because of the patch number:

  • CE 1.4.0.x – 1.5.0.x

    PATCH_SUPEE-5388_CE_1.4.0.0-1.5.0.1_v1.sh

  • CE 1.5.1.0

    PATCH_SUPEE-5390_CE_1.5.1.0_v1.sh

  • CE 1.6.0.x

    PATCH_SUPEE-5341_CE_1.6.0.0_v1.sh

  • CE 1.6.1.x – 1.6.2.x

    PATCH_SUPEE-5346_CE_1.6.1.0_v1.sh

  • CE 1.7.x

    PATCH_SUPEE-5345_CE_1.7.0.2_v1.sh

  • CE 1.8.x – 1.9.x

    PATCH_SUPEE-5344_CE_1.8.0.0_v1.sh

  • EE 1.7.0.0 – 1.10.0.2

    PATCH_SUPEE-5388_EE_1.7.0.0_to_1.10.0.2_v1-2015-02-12-06-15-02.sh

  • EE 1.10.1.x

    PATCH_SUPEE-5390_EE_1.10.1.x_v1-2015-02-12-06-25-09.sh

  • EE 1.11.0.x

    PATCH_SUPEE-5341_EE_1.11.0.0_v1-2015-02-10-04-08-59.sh

  • EE 1.11.1.0 – 1.12.1.0

    PATCH_SUPEE-5346_EE_1.11.1.0_v1-2015-02-10-04-13-55.sh

  • EE 1.12.0.x

    PATCH_SUPEE-5345_EE_1.12.0.2_v1-2015-02-10-04-17-49.sh

  • EE 1.13.x – 1.14.x

    PATCH_SUPEE-5344_EE_1.14.1.0_v1-2015-02-10-04-20-13.sh

[UPDATE] A patch for 1.5.1.0 is now available.

  • Would you please share me the link to download the patch file? – MPchan Feb 19 '15 at 7:01
  • It seems the download for 1.4/1.5 has been pulled from the website. I'll try to find out why. – Matthias Zeis Feb 19 '15 at 8:11
  • I got it from another site byte.nl/wiki/Magento_lek_SUPEE-5346 – MPchan Feb 19 '15 at 9:57
  • After the patch installation I got this message.Please help me,what should do now? The result is: Checking if patch can be applied/reverted successfully… ERROR: Patch can’t be applied/reverted successfully. patching file app/code/core/Mage/Admin/Model/Observer.php Hunk #1 FAILED at 37. Hunk #2 FAILED at 44. Hunk #3 FAILED at 55. 3 out of 3 hunks FAILED — saving rejects to file – MPchan Feb 19 '15 at 19:58
  • 1
    You tried to apply patch 5346 which is for CE 1.6 to your 1.4 installation as it looks like from the URL. That won't work. And if you applied the correct patch it means the mentioned file is modified in your installation and couldn't be patched because of this. – Matthias Zeis Feb 19 '15 at 21:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.