4

What will be the major changes in the files after installation of patch SUPEE-5344 for Magento 1.4.2.0? I mean that any particular files permission changes something like that... Please help me for the same.

7
  • 3
    This is a patch, check the code? Commented Feb 18, 2015 at 13:02
  • 1
    I checked those files.But I didn't understand code.Three files are updated by this patch app/code/core/Mage/Admin/Model/Observer.php, app/code/core/Mage/Core/Controller/Request/Http.php and lib/Varien/Db/Adapter/Pdo/Mysql.php.
    – MPchan
    Commented Feb 18, 2015 at 13:07
  • 1
    Please note that if you are running Magento CE 1.4.2.0 then the patch you should use is SUPEE-5388
    – MatthijsIJ
    Commented Feb 18, 2015 at 13:13
  • @ForMat But in the magento download it is mentioned as SUPEE-5344. please check the link magentocommerce.com/download
    – MPchan
    Commented Feb 18, 2015 at 13:15
  • Once you select your Magento CE 1.4.2.0 version and hit the download button you will see that you will get another patch file (examine the link in your browser). Also check out the list of files for this patch in the answer below by @Matthias
    – MatthijsIJ
    Commented Feb 18, 2015 at 13:35

2 Answers 2

9

You don't need to understand it. No functionality changes and the API changes are irrelevant for at least 99.99% of developers. If you don't understand it, you are one of those. Just apply it. File permissions are not relevant, as far as I see it prevents an SQL injection through certain requests to the web service.

Specifically for Magento 1.4, the following files have been changed:

  • app/code/core/Mage/Admin/Model/Observer.php

    Do not use URL parameter forwarded for forwarded requests, but property internaly_forwarded that cannot be set from outside

  • app/code/core/Mage/Core/Controller/Request/Http.php

    Provide getters and setters for this property

  • lib/Varien/Data/Collection/Db.php

    Remove field_expr feature from collection conditions. I tried to use that once and it wasn't useful as it is anyway. The core code does not use it anyway as well. So it's safe to say that this won't affect any extensions/customizations.

The patch file for Magento 1.4 up to 1.5.0.1 is PATCH_SUPEE-5388_CE_1.4.0.0-1.5.0.1_v1.sh (Note that the number is 5388, but it is the same patch as 5344 for Magento 1.8 and 1.9)

2
  • 4
    I value your contribution here, but only the last sentence gives an answer to the OP's question. IMO just saying he doesn't need to understand goes against the whole idea SE stands for, to question things ;)
    – 7ochem
    Commented Feb 23, 2015 at 9:31
  • 3
    Ignorantly running bash scripts on your machine/server isn't the brightest idea either. Commented Apr 22, 2015 at 3:39
15

As an example, these files are affected in EE 1.13/1.14:

app/code/core/Enterprise/Logging/Block/Adminhtml/Grid/Filter/Ip.php
app/code/core/Enterprise/Logging/Block/Adminhtml/Index/Grid.php
app/code/core/Enterprise/Logging/Model/Resource/Event/Collection.php
app/code/core/Mage/Admin/Model/Observer.php
app/code/core/Mage/Core/Controller/Request/Http.php
app/code/core/Mage/Oauth/controllers/Adminhtml/Oauth/AuthorizeController.php
app/code/core/Mage/XmlConnect/Model/Observer.php
lib/Varien/Db/Adapter/Pdo/Mysql.php

While it looks like some quite important classes are modified the changes are quite small and won't affect most of the shops as @fschmengler said. The attack vector is pretty complex and requires a complex combination of actions. As far as is known no shop has been compromised yet. According to Magento you should check if unknown files can be found in the web server document root directory.

File permissions are not changed.

Here is a list of the filenames for the different patches in case somebody is confused because of the patch number:

  • CE 1.4.0.x – 1.5.0.x

    PATCH_SUPEE-5388_CE_1.4.0.0-1.5.0.1_v1.sh

  • CE 1.5.1.0

    PATCH_SUPEE-5390_CE_1.5.1.0_v1.sh

  • CE 1.6.0.x

    PATCH_SUPEE-5341_CE_1.6.0.0_v1.sh

  • CE 1.6.1.x – 1.6.2.x

    PATCH_SUPEE-5346_CE_1.6.1.0_v1.sh

  • CE 1.7.x

    PATCH_SUPEE-5345_CE_1.7.0.2_v1.sh

  • CE 1.8.x – 1.9.x

    PATCH_SUPEE-5344_CE_1.8.0.0_v1.sh

  • EE 1.7.0.0 – 1.10.0.2

    PATCH_SUPEE-5388_EE_1.7.0.0_to_1.10.0.2_v1-2015-02-12-06-15-02.sh

  • EE 1.10.1.x

    PATCH_SUPEE-5390_EE_1.10.1.x_v1-2015-02-12-06-25-09.sh

  • EE 1.11.0.x

    PATCH_SUPEE-5341_EE_1.11.0.0_v1-2015-02-10-04-08-59.sh

  • EE 1.11.1.0 – 1.12.1.0

    PATCH_SUPEE-5346_EE_1.11.1.0_v1-2015-02-10-04-13-55.sh

  • EE 1.12.0.x

    PATCH_SUPEE-5345_EE_1.12.0.2_v1-2015-02-10-04-17-49.sh

  • EE 1.13.x – 1.14.x

    PATCH_SUPEE-5344_EE_1.14.1.0_v1-2015-02-10-04-20-13.sh

[UPDATE] A patch for 1.5.1.0 is now available.

9
  • Would you please share me the link to download the patch file?
    – MPchan
    Commented Feb 19, 2015 at 7:01
  • It seems the download for 1.4/1.5 has been pulled from the website. I'll try to find out why. Commented Feb 19, 2015 at 8:11
  • I got it from another site byte.nl/wiki/Magento_lek_SUPEE-5346
    – MPchan
    Commented Feb 19, 2015 at 9:57
  • After the patch installation I got this message.Please help me,what should do now? The result is: Checking if patch can be applied/reverted successfully… ERROR: Patch can’t be applied/reverted successfully. patching file app/code/core/Mage/Admin/Model/Observer.php Hunk #1 FAILED at 37. Hunk #2 FAILED at 44. Hunk #3 FAILED at 55. 3 out of 3 hunks FAILED — saving rejects to file
    – MPchan
    Commented Feb 19, 2015 at 19:58
  • 1
    You tried to apply patch 5346 which is for CE 1.6 to your 1.4 installation as it looks like from the URL. That won't work. And if you applied the correct patch it means the mentioned file is modified in your installation and couldn't be patched because of this. Commented Feb 19, 2015 at 21:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.