8

So I just installed recent critical patches SUPEE-5994 + SUPEE-5344 + SUPEE-1533 - through SSH on my server.

I did the following steps for installing each patch:

Downloaded the patches from: https://www.magentocommerce.com/products/downloads/magento/

  1. Uploaded each patch to my Magento root folder
  2. Ran SSH command: sh patch_name.sh
  3. Got success message from console: Patch was applied/reverted successfully

My website works and all is good. It all installed instantly.

Lets say I'm suspicious to whether the patches actually DID get installed - is it possible to check somewhere which patches has been installed?? - either through SSH, FTP or similar?

1
  • 1
    I would add this as a comment, but cannot find the button on the mobile SE app. Your version control system should indicate whether or not the patch was applied. Just run a differential and see what has changed. May 25, 2015 at 20:14

6 Answers 6

5

You can use Philwinkle_AppliedPatches to see a list of applied patches. If you don't want to install an extension you can check the app/etc/applied.patches.list file. Check the module's source for more info.

Be careful with this file. This file isn't the current status of the patch files, but only an information that it was applied in the past.

This means:

  • Applying the patch and not commiting the file means no (or old) file and applied patches
  • Not commiting the patched files, but the applied.patches.list file means misinformation!
1
  • Just a note app/etc/ is where Magento stores its file for a list of applied patches.
    – B00MER
    Jul 20, 2015 at 7:04
5

Simply use SSH to check if your shop is patched

You can scan your site with magereport.com to see if a patch is installed or not. If a check comes up grey it’s possible the files that are needed for the check are relocated. Therefore it can’t see whether your shop is patched or not. No worries. Simply use SSH to check if your shop is patched.

Every check that’s been installed can easily be found in the content of your shop. More specifically it’s logged in app/etc/applied.patches.list

So you run this command 'grep' on SSH to access the list of applied security patches:

grep '|' app/etc/applied.patches.list

The output will look like this:

-e 2015-04-14 08:34:22 UTC | SUPEE-5344 | EE_1.14.1.0 | v1 | a5c9abcb6a387aabd6b33ebcb79f6b7a97bbde77 | Thu Feb 5 19:14:49 2015 +0200 | v1.14.1.0..HEAD

For More information kindly visit below URL:- https://support.hypernode.com/knowledgebase/how-to-apply-magento-patches/

Hope It's helpful for anyone.

2

If you're really that suspicious, use a version control system, so you can see what has changed and if this matches the bug description.

However, if you want to check if the functionality that the security leak used has been patched, this is different for each patch. As mentioned there's a test tool for the shoplifting bug. For the most recent patch, there's an elaborate description most of which you can test by requesting or altering URLs.

I'm not aware of a test tool for these.

1
updatedb
for file in $(locate applied.patches.list)
do
echo "===================================================================="
echo ${file}
cat ${file}
echo "===================================================================="
done

svn is here also:
svn.magentocommerce.com/source/branches/1.9

1

https://shoplift.byte.nl/

use this. Enter your details and check.

1

Please check your app/etc/ directory ,there you can find applied.patches.list

also verify it from https://shoplift.byte.nl/

If you are still unsure you can use this extension for verfication

https://www.magecomp.com/magento-applied-security-patches.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.