We have installed patches to out Magento sites (v1.9, patches 1533 5994 and 6285 (both versions)). However, despite installation reported successful, and after taking note of steps in Applied Patches but still getting a vulnerable message? We are still being told by http://magento.com/security-patch that the site is vulnerable. Checking on https://templates-master.com/supeechecker lists the 3 patches we have applied as those missing. Is there any other steps that are required, but not mentioned in the post mentioned above?
Add a comment
|
1 Answer
You missed the one patch that addresses the "Shoplift" exploit SUPEE-5345 And this is the only one that the byte shoplift tester on magento.com tests for.
I don't know how reliable the templates-master tool is, but to be absolutely sure that the patches have been installed, please refer to: How to check if Magento patch has been installed?
Update:
Please check if you have copies in app/code/local of any of the files listed in etc/applied.patches.list which would render the patch useless. Class rewrites could also be a problem, if they copy lots of code from the original class.
See also:
- How do I get a list of all class rewrites?
- A tool to find overrides in
app/code/local: https://github.com/aoepeople/mpmd
answered Jul 20, 2015 at 6:42
-
Thanks for your input, however I have now installed 5345 (as 5344 for v1.9), cleared cache, restarted apache, checked applied.patches.list, and all appears good, but tools are still reporting vulnerabilities?? Commented Jul 20, 2015 at 7:29
-
-
Still no good sadly. Could not get the rewrites list to work. No files in app/code/local that match applied patch list either. Commented Jul 21, 2015 at 6:05