Added block to whitelist, but blocks still not showing (6788)

Question

I also have a problem with custom blocks on my home page CMS after 6788. The CMS page uses a slider, which is on the backwards incompatible list because of the old router config. I used supee-6788-toolbox:

I can see the custom block in the permission_block table.

| block_id | block_name           | is_allowed |
+----------+----------------------+------------+
|        1 | core/template        |          1 |
|        2 | catalog/product_new  |          1 |
|        3 | customslider/default |          1 |

The config.xml uses the

<admin>
    <routers>
        <adminhtml>
            <args>
                <modules>
                    <customslideradmin before="Mage_Adminhtml">Custom_Customslider_Adminhtml</customslideradmin>
                </modules>
            </args>
        </adminhtml>
    </routers>

Now the home page is blank. When I remove the custom slider the other blocks load ok. There is only one telltale sign for the blank screen, in var/log/exception.log

SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax

SELECT `main_table`.* FROM `m_customslider_banner` AS `main_table`
LEFT JOIN `m_customslider_value` AS `status` 
ON main_table.banner_id = status.banner_id 
AND status.store_id = 2 AND status.attribute_code = 'status' 
WHERE (`customslider_id` = '2') 
AND (`IF(status`.`value IS NULL, main_table`.`status, status`.`value)` = '0') 
AND (`start_time` <= '2015-10-28') AND (`end_time` >= '2015-10-28') 

Is there another reason that the patch would have caused this?

Answer 1

My guess is that the customslider module is using addFieldToFilter() in a way that is not compatible with the APPSEC-1063 patch detailed here. I've spent a good portion of my day on this one and non-compatible code throws a PDOException. I've been using the toolbox scan as a starting point and it does help with finding code that is incompatible with APPSEC-1063, but it not catch everything.

For example, the SUPEE-6788 modifies this Magento core code from Mage_Eav_Model_Resource_Attribute_Collection

$field = '(CASE WHEN additional_table.is_system = 1 AND additional_table.is_visible = 0 THEN 1 ELSE 0 END)';
return $this->addFieldToFilter($field, 0);

The scan tool uses a regex to match a few characters that will are no good on the same line as the the addFieldToFilter, but in the above since the string is set as a variable on a separate line it will be missed.

As a result, we "patched the patch" and are including this with our patch rollouts, which will alert us as to any code that is incompatible with APPSEC-1063 that the tool could not detect.

Applying this patch to an environment suitable for debugging should help you see where the issue is in the customslider module. Magento has offered some guidance at the link above on how to make resource collections compatible.