3

I can not use sh file so I found zip file on magentary.com. The problem is that I found only zip file for 1.8.1, but on my store I have Magento 1.8.0. Is there any difference between those two versions regarding SUPEE-6285 patch?

2

There are two different patch files for 1.8.0.0 and 1.8.1.0, that means at least some of the files affected by the patch have been changed in between.

That being said, you should find a way to apply the patch instead of downloading files from third party sites.

For example, if you cannot get it done on your installation, download a fresh 1.8.0.0 Magento, apply SUPEE-5994, then SUPEE-6285, then copy the changed files.

Applying SUPEE-5994 first is important because both patches change the same file and SUPEE-6285 will fail if SUPEE-5994 has not been applied first.

To see which files have been changed by the patches, look into app/etc/applied.patches.list

0

There some different between magento 1.8.1 Ce and 1.8.0

Basically Magento C.E 1.8.1 add form key at download folder at magentoDir/downloader

Magento extension is download from at downloader folder using Magento Connect manager.

And Magento connect manager files are managed from this folder.

From fews days,Magento hacker is trying to access magento admin from Folder using magento Connect manager loop hole.

So magento is put more logic and code for prevent this unusall access **

Magento do something to prevent cross access.

Here list of changes:

1. downloader/Maged/Controller.php

--- downloader/Maged/Controller.php
+++ downloader/Maged/Controller.php
@@ -320,6 +320,10 @@ final class Maged_Controller
      */
     public function connectPackagesPostAction()
     {
+        if (!$this->_validateFormKey()) {
+            echo "INVALID POST DATA";
+            return;
+        }
         $actions = isset($_POST['actions']) ? $_POST['actions'] : array();
         if (isset($_POST['ignore_local_modification'])) {
             $ignoreLocalModification = $_POST['ignore_local_modification'];
@@ -334,6 +338,10 @@ final class Maged_Controller
      */
     public function connectPreparePackagePostAction()
     {
+        if (!$this->_validateFormKey()) {
+            echo "INVALID POST DATA";
+            return;
+        }
         if (!$_POST) {
             echo "INVALID POST DATA";
             return;
@@ -355,6 +363,10 @@ final class Maged_Controller
      */
     public function connectInstallPackagePostAction()
     {
+        if (!$this->_validateFormKey()) {
+            echo "INVALID POST DATA";
+            return;
+        }
         if (!$_POST) {
             echo "INVALID POST DATA";
             return;
@@ -444,6 +456,11 @@ final class Maged_Controller
      */
     public function settingsPostAction()
     {
+        if (!$this->_validateFormKey()) {
+            $this->session()->addMessage('error', "Unable to save settings");
+            $this->redirect($this->url('settings'));
+            return;
+        }
         if ($_POST) {
             $ftp = $this->getFtpPost($_POST);

@@ -1103,10 +1120,7 @@ final class Maged_Controller
      */
     protected function _validateFormKey()
     {
-        if (!($formKey = $_REQUEST['form_key']) || $formKey != $this->session()->getFormKey()) {
-            return false;
-        }
-        return true;
+        return $this->session()->validateFormKey();
     }

2. downloader/Maged/Model/Session.php

diff --git downloader/Maged/Model/Session.php downloader/Maged/Model/Session.php
index 8dff44d..91e6410 100644
--- downloader/Maged/Model/Session.php
+++ downloader/Maged/Model/Session.php
@@ -103,6 +103,13 @@ class Maged_Model_Session extends Maged_Model
         }

         try {
+            if (isset($_POST['username']) && !$this->validateFormKey()) {
+                $this->controller()
+                    ->redirect(
+                        $this->controller()->url(),
+                        true
+                    );
+            }
             if ( (isset($_POST['username']) && empty($_POST['username']))
                 || (isset($_POST['password']) && empty($_POST['password']))) {
                 $this->addMessage('error', 'Invalid user name or password');
@@ -234,4 +241,17 @@ class Maged_Model_Session extends Maged_Model
         }
         return $this->get('_form_key');
     }
+
+    /**
+     * Validate Form Key
+     *
+     * @return bool
+     */
+    public function validateFormKey()
+    {
+        if (!($formKey = $_REQUEST['form_key']) || $formKey != $this->getFormKey()) {
+            return false;
+        }
+        return true;
+    }
 }

3. downloader/template/connect/packages.phtml

@@ -85,7 +85,7 @@ Event.observe(window, 'load', changeAvailableArchiveStatus);
 function connectPrepare(form) {
     new Ajax.Request(form.action, {
       method:'post',
-      parameters: {install_package_id: form.install_package_id.value},
+      parameters: {install_package_id: form.install_package_id.value, form_key: form.form_key.value},
       onCreate: function() {
           $('prepare_package_result').update(
                 '<div class="loading-mask" id="loading_mask_loader">'+
@@ -122,6 +122,7 @@ function connectPrepare(form) {
 //-->
 </script>
 <form action="<?php echo $this->url('connectPreparePackagePost')?>" method="post" onsubmit="return connectPrepare(this)">
+    <input name="form_key" type="hidden" value="<?php echo $this->getFormKey() ?>" />
     <ul class="bare-list">
         <li>
             <span class="step-count">1</span> &nbsp; Search for modules via <a href="http://connect.magentocommerce.com/" target="Magento_Connect">Magento Connect</a>.
@@ -176,6 +177,7 @@ function connectPrepare(form) {
 <?php foreach ($packages as $channel=>$pkgs): ?>

 <form id="connect_packages_<?php echo $i ?>" class="connect-packages" action="<?php echo $this->url('connectPackagesPost')?>" method="post" target="connect_iframe">
+    <input name="form_key" type="hidden" value="<?php echo $this->getFormKey() ?>" />
     <div class="no-display">
         <input type="hidden" id="ignore_local_modification" name="ignore_local_modification" value=""/>
         <input type="hidden" name="form_id" value="connect_packages_<?php echo $i ?>"/>

4. downloader/template/connect/packages_prepare.phtml

@@ -33,6 +33,7 @@
 Extension dependencies
 <form action="<?php
     echo $this->url('connectInstallPackagePost')?>" method="post" target="connect_iframe" onsubmit="onSubmit(this)">
+    <input name="form_key" type="hidden" value="<?php echo $this->getFormKey() ?>" />
     <input type="hidden" name="install_package_id" value="<?php echo $this->escapeHtml($this->get('package_id')); ?>">
     <table cellspacing="0" cellpadding="0" width="100%">
         <col width="150" />

5.downloader/template/login.phtml downloader/template/login.phtml

--- downloader/template/login.phtml
+++ downloader/template/login.phtml
@@ -30,6 +30,7 @@
 <?php endif ?>
 <div style="width:300px; padding:20px; margin:90px auto !important; background:#f6f6f6;">
 <form method="post" action="#">
+    <input name="form_key" type="hidden" value="<?php echo $this->getFormKey() ?>" />
     <h2 class="page-head">Log In</h2>
     <p><small>Please re-enter your Magento Adminstration Credentials.<br/>Only administrators with full permissions will be able to log in.</small></p>
     <table class="form-list">

6. downloader/template/settings.phtml

--- downloader/template/settings.phtml
+++ downloader/template/settings.phtml
@@ -50,6 +50,7 @@ function changeDeploymentType (element)
 <div class="settings-page">
     <h2 class="page-head">Settings</h2>
     <form action="<?php echo $this->url('settingsPost') ?>" method="post">
+        <input name="form_key" type="hidden" value="<?php echo $this->getFormKey() ?>" />
         <fieldset>
             <p>Magento Extensions are available in three different versions.</p>
             <ul class="disc">

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.