i got this message from Magento

"Critical Reminder: Download and install Magento security patches. Download now."

and after i installed the required patches successfully i still got that message, so my question is how i insure these patches installed successfully? and if should i remove that alert manually?


3 Answers 3


One of the main files patched is app/core/Mage/Core/Controller/Request/Http.php

For example in Magento, doing a diff between the patched file and the original shows the following added code.

Compare: (<)V:\Magento\Magento 1.6\Changes\20150217 Patches\5346\Http.php (15698 bytes)
   with: (>)V:\Magento\Magento 1.6\Changes\20150217 Patches\5346\Http.php.old (15031 bytes)

<      * Flag for recognizing if request internally forwarded
<      *
<      * @var bool
<      */
<     protected $_internallyForwarded = false;
<     /**
<     /**
<      * Define that request was forwarded internally
<      *
<      * @param boolean $flag
<      * @return Mage_Core_Controller_Request_Http
<      */
<     public function setInternallyForwarded($flag = true)
<     {
<         $this->_internallyForwarded = (bool)$flag;
<         return $this;
<     }
<     /**
<      * Checks if request was forwarded internally
<      *
<      * @return bool
<      */
<     public function getInternallyForwarded()
<     {
<         return $this->_internallyForwarded;
<     }

The following command line entry can quickly tell if this file has been patched by looking for the added _internallyForwarded flag. Run it in your Magento root folder:

grep "_internallyForwarded" app/code/core/Mage/Core/Controller/Request/Http.php

The following shows the file has been patched.

public_html$ grep "_internallyForwarded" app/code/core/Mage/Core/Controller/Request/Http.php
     protected $_internallyForwarded = false;
        $this->_internallyForwarded = (bool)$flag;
        return $this->_internallyForwarded;

Other files that may have been patched:


Also check app/etc/applied.patches.list to see what the latest patch applications are at the end of the list.

Watch in case Magento's totally excellent internal quality control identifies the patch as 5346 instead of 5344 as advertised on the download. They got it (something?) in the append message.

  • Hi, I have checked applied.patches.list for getting sure which files are patched, then I can see .....SUPEE-5345 | EE_1.12.0.2 | v1 |....I guess this should be SUPEE-5345 | CE_1.7.0.2 instead SUPEE-5345 | EE_1.12.0.2 Is this correct ? Because I am not sure whether that is correct or not . As I am using magento CE_1.7.0.2 edition that's why I have been confused whether these are correct or not.so can you please confirm the same ? You can see the files I have downloaded are PATCH_SUPEE-1533_EE_1.12.x_v1-2015-02-10-08-19-16.sh and PATCH_SUPEE-5345_CE_1.7.0.2_v1-2015-02-10-08-11-22.sh Apr 20, 2015 at 6:51
  • When you scan through the patch code, the 5344 patch internally is reported as 5344, 5345, 5346 so far, depending on the version of Magento being patched. Apr 23, 2015 at 3:41

That message is coming from Magento's RSS feed - it's not based on whether or not you have installed the patch, so if you installed the patch you can remove the alert manually.

There is a scanner at https://shoplift.byte.nl/ which checks whether you've installed the SUPEE-5344 patch correctly.

  • Oh great, thank you very much for your reply. Apr 18, 2015 at 23:56


Reminder is implemented in Mage_AdminNotification module.

There is no check if patches were installed or not.

To remove reminder:

  • Login to backend
  • Navigate to System → Notification
  • Mark reminder as read or remove it


To apply patches:

Which patches were applied?

  • Check file /app/etc/applied.patches.list

Not the answer you're looking for? Browse other questions tagged or ask your own question.