7

After applying patch SUPEE-6285 on Magento 1.9.1.0, I am seeing the following error in system.log several times a day:

Undefined index: form_key in ... downloader/Maged/Model/Session.php on line 252

I haven't found any other references online so I'm posting this question to see if anybody else is getting this error message.

Improve this question

2 Answers 2

Reset to default
6

Form key validation in Magento Connect has been added in SUPEE-6285. The form key input has been added to the following templates in /downloader:

  • downloader/template/connect/packages.phtml
  • downloader/template/connect/packages_prepare.phtml
  • downloader/template/login.phtml
  • downloader/template/settings.phtml

Since you obviously get requests to the downloader without form key, I see the following possible reasons:

  1. you did not patch one of the above files. This is unlikely because if the patch script cannot patch one file, the whole patch fails
  2. you have added a custom form pointing to the downloader somewhere
  3. somebody tries to attack your shop (for example with brute force login) but the form key prevents it

If it is (1) or (2) should be easy to find out because you should know about unpatched files or additional templates.

If not, check your server's access log at the times where this error comes to see what kind of request it is and from which IP it comes. Also look for other malicious requests around it.

And since it is possible that you already got hacked before the patch was applied, examine your installation carefully for:

  • unknown admin accounts
  • added extensions
  • added PHP files (especially hidden in non-source folders like /media and /var)

See also:

Improve this answer
2
  • Thanks for your help. Your answer helped me understand the problem, which is namely #3 ("somebody tries to attack your shop (for example with brute force login) but the form key prevents it"). Checking the server logs, I see that is exactly what was happening on the downloader folder. I did not even realize that the downloader was accessible directly from that directory -- scary! My solution was to password protect this directory.
    – Chrysippus
    Commented Jul 20, 2015 at 20:40
  • I also had #3. I used .htaccess to deny access to this directory to anyone except my ip.
    – Deus777
    Commented Apr 6, 2016 at 9:29
0

I did find what I believe to be an error in Magento's Code that does relate to this error.

Go to this file: app/code/core/Mage/Core/Model/Session/Abstract/Varien.php

Search for "Forvarded" I found 4 instances in which the word "Forwarded" was misspelled as "Forvarded" I hope this helps.

This is in version 1.9.2.4

I am not sure if this will fix your problem specifically, but it couldn't hurt. It did fix a "Undefined index:" error for me though.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.