1

While reverting the SUPEE-6285 patch (in order to install SUPEE-6285-V2), I get errors like

patching file downloader/template/connect/packages_prepare.phtml Hunk #1 FAILED at 33. 1 out of 1 hunk FAILED -- saving rejects to file downloader/template/connect/packages_prepare.phtml.rej

I've had these before with different patches, but usually replacing these files with a file solves the problem. With this patch however, replacing with files from both magento 1.9.2 pre and post the SUPEE-6285 V2 patch doesn't work.

I'm running 1.9.2. Is anyone else facing this problem? And what is best practice for patching? I would guess you should do something with the .rej file, they aren't created.

Improve this question
2
  • You are upgraded to 1.9.2.0, correct? It was supposed to be completely patched to include patches: SUPEE-5344, SUPEE-5994, SUPEE-6285 and needs no further interference.
    – Fiasco Labs
    Jul 11, 2015 at 21:30
  • Well, it looks like I read the patch notes a little too fast. Thanks for clearing things up for me :)
    – Frank
    Jul 12, 2015 at 14:35

2 Answers 2

Reset to default
1

Update: this answer applies to Magento 1.9.1.1 and earlier, Magento 1.9.2.0 does not need any of the current patches (up to SUPEE-6285), which is also the reason for your error messages.

You need to apply SUPEE-5994 first, because it patched the same file and it is the first patch that is not already contained in Magento 1.9.1.1

Improve this answer
3
  • 1
    Applying an unneeded patch on 1.9.2.0
    – Fiasco Labs
    Jul 11, 2015 at 22:05
  • My fault, didn't read the version correctly. Of course 1.9.2 does not need any of the current patches
    – Fabian Schmengler
    Jul 12, 2015 at 7:57
  • My bad, I didn't read the patch notes completely. I'll accept your answer because it might help others.
    – Frank
    Jul 12, 2015 at 14:37
2

app/design/frontend/rwd/default/template/checkout/cart.phtml

The SUPEE-6285 V2 Patch adds the quoteEscape() function to take care of the XSS issue.

If you are running 1.9.2.0, it is already patched with SUPEE-5344, SUPEE-5994 and SUPEE-6285. The Continue Shopping button is escaped to prevent XSS as follows (as extracted from Magento 1.9.2.0 archive file):

<?php if($this->getContinueShoppingUrl()): ?>
    <button type="button" title="<?php echo $this->quoteEscape($this->__('Continue Shopping')) ?>" class="button2 btn-continue" onclick="setLocation('<?php echo Mage::helper('core')->quoteEscape($this->getContinueShoppingUrl()) ?>')"><span><span><?php echo $this->__('Continue Shopping') ?></span></span></button>
<?php endif; ?>

The code in 1.9.1.1 allows for XSS and is as follows (as extracted from Magento 1.9.1.1 archive file):

<?php if($this->getContinueShoppingUrl()): ?>
    <button type="button" title="<?php echo $this->__('Continue Shopping') ?>" class="button2 btn-continue" onclick="setLocation('<?php echo $this->getContinueShoppingUrl() ?>')"><span><span><?php echo $this->__('Continue Shopping') ?></span></span></button>
<?php endif; ?>

What the SUPEE-6285 v2 patch does to app/design/frontend/rwd/default/template/checkout/cart.phtml in 1.9.x.x prior to 1.9.2.0 which already includes the fix:

    <?php if($this->getContinueShoppingUrl()): ?>
-       <button type="button" title="<?php echo $this->__('Continue Shopping') ?>" class="button2 btn-continue" onclick="setLocation('<?php echo $this->getContinueShoppingUrl() ?>')"><span><span><?php echo $this->__('Continue Shopping') ?></span></span></button>
+       <button type="button" title="<?php echo $this->quoteEscape($this->__('Continue Shopping')) ?>" class="button2 btn-continue" onclick="setLocation('<?php echo Mage::helper('core')->quoteEscape($this->getContinueShoppingUrl()) ?>')"><span><span><?php echo $this->__('Continue Shopping') ?></span></span></button>
    <?php endif; ?>

Diff of SUPEE-6285 V1 vs. V2 shows the only change was the RWD template:

160c160
< SUPEE-6285 | CE_1.9.1.1 | v1 | 7226d88b1eeb07a5fbc4e62be189a5219457cc14 | Mon Jun 22 16:32:26 2015 +0300 | 202596e441..7226d88b1e
---
> SUPEE-6285 | CE_1.9.1.1 | v2 | 7226d88b1eeb07a5fbc4e62be189a5219457cc14 | Mon Jun 22 16:32:26 2015 +0300 | 202596e441..7226d88b1e
1065a1065,1077
> diff --git app/design/frontend/rwd/default/template/checkout/cart.phtml app/design/frontend/rwd/default/template/checkout/cart.phtml
> index 7bceece..88753c3 100644
> --- app/design/frontend/rwd/default/template/checkout/cart.phtml
> +++ app/design/frontend/rwd/default/template/checkout/cart.phtml
> @@ -115,7 +115,7 @@
>                          <span class="or">-<?php echo $this->__('or'); ?>-</span>
>  
>                          <?php if($this->getContinueShoppingUrl()): ?>
> -                            <button type="button" title="<?php echo $this->__('Continue Shopping') ?>" class="button2 btn-continue" onclick="setLocation('<?php echo $this->getContinueShoppingUrl() ?>')"><span><span><?php echo $this->__('Continue Shopping') ?></span></span></button>
> +                            <button type="button" title="<?php echo $this->quoteEscape($this->__('Continue Shopping')) ?>" class="button2 btn-continue" onclick="setLocation('<?php echo Mage::helper('core')->quoteEscape($this->getContinueShoppingUrl()) ?>')"><span><span><?php echo $this->__('Continue Shopping') ?></span></span></button>
>                          <?php endif; ?>
>                          <!--[if lt IE 8]>
>                          <input type="hidden" id="update_cart_action_container" />
Improve this answer
1
  • Great explanation about the patch. Thanks. (Unfortunately I just didn't read, see also the comment below my question)
    – Frank
    Jul 12, 2015 at 14:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.