3

Once a patch has been applied, does the patch file need to be deleted from the httpdocs directory? Or is leaving it there any kind of security risk? Or doesn't it matter?

1
  • I guess, it is always better to delete if a particular file or code served its purpose and will not be used in future. Jul 12, 2015 at 14:42

2 Answers 2

2

If the file can be accessed by URL, should delete it for the following reason:

  • if an attacker can access the file by URL, this is a potential disclosure of your magento version and can be a hint to other vulnerabilities this version is known for

Personally, I prefer to clean up behind me and not let scripts lying around. If the file can not be accessed from the outside, though, I think it's safe to leave it there if you want to.

3
  • That leads to another question then, if you run the script twice, does the second time you run it make the files return to their original state?
    – Atomic
    Jul 12, 2015 at 15:03
  • Afaik, this is the case. Not sure though Jul 12, 2015 at 15:04
  • 1
    No, only if called with -R or --revert parameter. Jul 12, 2015 at 15:37
1

While the default .htaccess of Magento disallows access to RELEASE_NOTES.txt to not disclose too many details about the used Magento version, it does not disallow access to .sh files in the root directory.

A potential attacker could use this information disclosure. You might think that it is not harmful if they know that you are patched, but consider this possible approach:

  1. crawl Magento shops for publicly accessible patch files of a previous patch (like SUPEE-5994)
  2. if found, check if the patch file of the latest patch is also present
  3. if not, assume that the patch has not been applied and you have found a target.

So, you definitely don't want to keep patch files lying around on public sites.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.