What will be the major changes in the files after installation of patch SUPEE-5344 for Magento 188.8.131.52? I mean that any particular files permission changes something like that... Please help me for the same.
You don't need to understand it. No functionality changes and the API changes are irrelevant for at least 99.99% of developers. If you don't understand it, you are one of those. Just apply it. File permissions are not relevant, as far as I see it prevents an SQL injection through certain requests to the web service.
Specifically for Magento 1.4, the following files have been changed:
Do not use URL parameter
forwardedfor forwarded requests, but property
internaly_forwardedthat cannot be set from outside
Provide getters and setters for this property
field_exprfeature from collection conditions. I tried to use that once and it wasn't useful as it is anyway. The core code does not use it anyway as well. So it's safe to say that this won't affect any extensions/customizations.
The patch file for Magento 1.4 up to 184.108.40.206 is
PATCH_SUPEE-5388_CE_220.127.116.11-18.104.22.168_v1.sh (Note that the number is
5388, but it is the same patch as
5344 for Magento 1.8 and 1.9)
As an example, these files are affected in EE 1.13/1.14:
app/code/core/Enterprise/Logging/Block/Adminhtml/Grid/Filter/Ip.php app/code/core/Enterprise/Logging/Block/Adminhtml/Index/Grid.php app/code/core/Enterprise/Logging/Model/Resource/Event/Collection.php app/code/core/Mage/Admin/Model/Observer.php app/code/core/Mage/Core/Controller/Request/Http.php app/code/core/Mage/Oauth/controllers/Adminhtml/Oauth/AuthorizeController.php app/code/core/Mage/XmlConnect/Model/Observer.php lib/Varien/Db/Adapter/Pdo/Mysql.php
While it looks like some quite important classes are modified the changes are quite small and won't affect most of the shops as @fschmengler said. The attack vector is pretty complex and requires a complex combination of actions. As far as is known no shop has been compromised yet. According to Magento you should check if unknown files can be found in the web server document root directory.
File permissions are not changed.
Here is a list of the filenames for the different patches in case somebody is confused because of the patch number:
CE 1.4.0.x – 1.5.0.x
CE 1.6.1.x – 1.6.2.x
CE 1.8.x – 1.9.x
EE 22.214.171.124 – 126.96.36.199
EE 188.8.131.52 – 184.108.40.206
EE 1.13.x – 1.14.x
[UPDATE] A patch for 220.127.116.11 is now available.
protected by Rajeev K Tomy Apr 24 '15 at 6:28
Thank you for your interest in this question.
Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).
Would you like to answer one of these unanswered questions instead?