7

I just had trouble to install the SUPEE-1533 and SUPEE-5344 on CE 1.7.0.0. I did it through the FTP method from Magentary.

Question is then : how can I make sure that my Magento install got all security patches properly installed?

Improve this question
2
  • 2
    call a hacker, no , seriously, check for applied.patches.list in /app/etc/
    – user2857
    Commented Apr 23, 2015 at 11:16
  • thanks, but as I had to use the FTP method, it is not there... moreover, it tells me there what is applied, not what is not applied while it should be. Do you have a good hacker phone number ? :)
    – Memes
    Commented Apr 28, 2015 at 10:37

6 Answers 6

Reset to default
7

If you want to be sure the patches are installed properly (and more security checks, check https://www.MageReport.com (shoplift.byte.nl also redirects now)

Improve this answer
7

Ways how you can ensure you have all latest security patches applied:

  • Upgrade to the latest version CE 1.9.2.1 or EE 1.14.2.1 - these versions have all latest patches included
  • Apply patches in development systems via SSH to have the added to /etc/applied.patches.list

Additionally:

  • Run MageScan (tool by Steve Robbins) to check your sites status (this will not give you information about the patches though)
  • Run the Shoplift tester (as already mentioned above by Willem)
  • Hire a Magento developer to check your site (which will be a hard task if updates where done via FTP).
  • It's probably easier trying to apply the patches again via SSH and see if they work or fail and then check the files.
Improve this answer
6

Test if your site is still vulnerable at https://shoplift.byte.nl

Improve this answer
2
  • 2
    Magento also has their own check page at => Shoplift bug test
    – Fiasco Labs
    Commented May 5, 2015 at 19:26
  • your comment worth to be an answer actually, but as Magento did it with Byte, Iwon't complain much :)
    – Memes
    Commented May 6, 2015 at 6:40
3

While this is self-promotion, I am still posting it as I think this may help someone who is looking for such kind of security extension for their Magento store.

We have developed an extension that checks for common misconfigurations and vulnerabilities in Magento and gives you exact information on how to fix/resolve them. FYI, it also includes ShopLift test to let you know if you are vulnerable to it. Magento connect page of MageSecure: http://www.magentocommerce.com/magento-connect/magesecure-security-extension.html

Improve this answer
1

All other methods (like Securi, MageReport...) check front end files only. If you started patch installation and something went wrong, this tools will tell you you are good, although you might not be.

MageFence security extension check all files from back end. It scan for necessary changes in ALL files that had to be patched for each separate Magento patch from Magento CE 1.7 to 1.9.2.2. Further more, it will report not only missing security patches but all patches for your version of Magento CE. This extension has many more security features that will detect, protect and enforce your Magento shop.

Improve this answer
0

Get the latest patches, security updates, and best practices for your Magento sites

https://magento.com/security

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.