2

I just updated my Magento to 1.9.2 and there is the error log file:

SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '.`value)` = '0') AND (`start_time` = '2015-10-' at line 2, query was: SELECT `main_table`.* FROM `bannerslider_banner` AS `main_table` LEFT JOIN `bannerslider_value` AS `status` ON main_table.banner_id = status.banner_id AND status.store_id = 1 AND status.attribute_code = 'status' WHERE (`bannerslider_id` = '2') AND (`IF(status`.`value IS NULL, main_table`.`status, status`.`value)` = '0') AND (`start_time` = '2015-10-28') ORDER BY order_banner ASC

a:5:{i:0;s:643:"SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '.`value)` = '0') AND (`start_time` = '2015-10-' at line 2, query was: SELECT `main_table`.* FROM `bannerslider_banner` AS `main_table`
 LEFT JOIN `bannerslider_value` AS `status` ON main_table.banner_id = status.banner_id AND status.store_id = 1 AND status.attribute_code = 'status' WHERE (`bannerslider_id` = '2') AND (`IF(status`.`value IS NULL, main_table`.`status, status`.`value)` = '0') AND (`start_time` = '2015-10-28') ORDER BY order_banner ASC";i:1;s:4886:"#0 lib/Varien/Db/Statement/Pdo/Mysql.php(110): Zend_Db_Statement_Pdo->_execute(Array)
#1 app/code/core/Zend/Db/Statement.php(291): Varien_Db_Statement_Pdo_Mysql->_execute(Array)
#2 lib/Zend/Db/Adapter/Abstract.php(480): Zend_Db_Statement->execute(Array)
#3 lib/Zend/Db/Adapter/Pdo/Abstract.php(238): Zend_Db_Adapter_Abstract->query('SELECT `main_ta...', Array)
#4 lib/Varien/Db/Adapter/Pdo/Mysql.php(504): Zend_Db_Adapter_Pdo_Abstract->query('SELECT `main_ta...', Array)
#5 lib/Zend/Db/Adapter/Abstract.php(737): Varien_Db_Adapter_Pdo_Mysql->query('SELECT `main_ta...', Array)
#6 lib/Varien/Data/Collection/Db.php(740): Zend_Db_Adapter_Abstract->fetchAll('SELECT `main_ta...', Array)
#7 app/code/core/Mage/Core/Model/Resource/Db/Collection/Abstract.php(521): Varien_Data_Collection_Db->_fetchAll('SELECT `main_ta...', Array)
#8 lib/Varien/Data/Collection/Db.php(572): Mage_Core_Model_Resource_Db_Collection_Abstract->getData()
#9 lib/Varien/Data/Collection.php(741): Varien_Data_Collection_Db->load()
#10 app/code/community/Magestore/Bannerslider/Block/Default.php(44): Varien_Data_Collection->getIterator()
#11 app/design/frontend/base/default/template/bannerslider/bannerslider.phtml(28): Magestore_Bannerslider_Block_Default->getBlockData()
#12 app/code/core/Mage/Core/Block/Template.php(241): include('/var/www/html/d...')
#13 app/code/core/Mage/Core/Block/Template.php(272): Mage_Core_Block_Template->fetchView('frontend/base/d...')
#14 app/code/community/Magestore/Bannerslider/Block/Bannerslider.php(47): Mage_Core_Block_Template->renderView()
#15 app/code/core/Mage/Core/Block/Abstract.php(919): Magestore_Bannerslider_Block_Bannerslider->_toHtml()
#16 app/code/core/Mage/Core/Block/Text/List.php(43): Mage_Core_Block_Abstract->toHtml()
#17 app/code/core/Mage/Core/Block/Abstract.php(919): Mage_Core_Block_Text_List->_toHtml()
#18 app/code/core/Mage/Core/Block/Abstract.php(637): Mage_Core_Block_Abstract->toHtml()
#19 app/code/core/Mage/Core/Block/Abstract.php(581): Mage_Core_Block_Abstract->_getChildHtml('content', true)
#20 app/design/frontend/base/default/template/page/1column.phtml(48): Mage_Core_Block_Abstract->getChildHtml('content')
#21 app/code/core/Mage/Core/Block/Template.php(241): include('/var/www/html/d...')
#22 app/code/core/Mage/Core/Block/Template.php(272): Mage_Core_Block_Template->fetchView('frontend/base/d...')
#23 app/code/core/Mage/Core/Block/Template.php(286): Mage_Core_Block_Template->renderView()
#24 app/code/core/Mage/Core/Block/Abstract.php(919): Mage_Core_Block_Template->_toHtml()
#25 app/code/core/Mage/Core/Model/Layout.php(555): Mage_Core_Block_Abstract->toHtml()
#26 app/code/core/Mage/Core/Controller/Varien/Action.php(390): Mage_Core_Model_Layout->getOutput()
#27 app/code/core/Mage/Cms/Helper/Page.php(137): Mage_Core_Controller_Varien_Action->renderLayout()
#28 app/code/core/Mage/Cms/Helper/Page.php(52): Mage_Cms_Helper_Page->_renderPage(Object(Mage_Cms_IndexController), 'home')
#29 app/code/core/Mage/Cms/controllers/IndexController.php(45): Mage_Cms_Helper_Page->renderPage(Object(Mage_Cms_IndexController), 'home')
#30 app/code/core/Mage/Core/Controller/Varien/Action.php(418): Mage_Cms_IndexController->indexAction()
#31 app/code/core/Mage/Core/Controller/Varien/Router/Standard.php(254): Mage_Core_Controller_Varien_Action->dispatch('index')
#32 app/code/core/Mage/Core/Controller/Varien/Front.php(172): Mage_Core_Controller_Varien_Router_Standard->match(Object(Mage_Core_Controller_Request_Http))
#33 app/code/core/Mage/Core/Model/App.php(365): Mage_Core_Controller_Varien_Front->dispatch()
#34 app/Mage.php(684): Mage_Core_Model_App->run(Array)
#35 index.php(83): Mage::run('', 'store')
#36 {main}";s:3:"url";s:1:"/";s:11:"script_name";s:10:"/index.php";s:4:"skin";s:7:"default";}

I can not understand where i can find the file causing the problem.

Can you help me out find the file which is causing the problem?

Improve this question
2
  • 1
    Probably is a MySQL injection vulnerability patched away by SUPEE-6788 and will require you to contact the Module developer to get the other half of the patch which is a module upgrade.
    – Fiasco Labs
    Commented Oct 29, 2015 at 2:37
  • 1
    I would discourage to use Magestore modules as their coding quality is really poor. Once again you see that using hardcoded SQL instead of sticking with Magento's ORM solution and PDO style queries is a bad practice.
    – 7ochem
    Commented Nov 5, 2015 at 13:57

3 Answers 3

Reset to default
6

A (temporary - until the developers release a new version) fix that worked for me:

In file

app/code/community/Magestore/Bannerslider/Model/Mysql4/Banner/Collection.php

at line 60 comment the following:

return parent::addFieldToFilter("IF($field.value IS NULL, main_table.$field, $field.value)", $condition);

and replace it with

 $this->getSelect()->where("IF($field.value IS NULL, main_table.$field, $field.value) = 0");

As per answer found here: http://answers.magentocommerce.com/answers/4643-en_us/product/3912/magestore-banner-slider-questions-answers/questions.htm?sort=recentq#BVQASAnswerText598988

Improve this answer
1
  • The query generated in app/code/community/Magestore/Bannerslider/Model/Mysql4/Banner/Collection.php is mangled due to variable escaping after the update. Not the first time we've had problem with bad code from Magestore
    – Dom
    Commented Dec 18, 2015 at 16:12
0

It looks like the bannerslider/bannerslider module is trying to save someting from the CMS page and is having issues saving. When you upgraded make sure you add the bannerslider/bannerslider block to the whitelist table.

Improve this answer
4
  • Where is that whitelist and how can i add bannerslider/bannerslider
    – Venelin Vasilev
    Commented Oct 29, 2015 at 9:22
  • You should be able to see it under system > permissions > blocks and adding it there.
    – rob3000
    Commented Oct 31, 2015 at 7:59
  • In system - permissions i have only users and roles. I do not have blocks..
    – Venelin Vasilev
    Commented Nov 2, 2015 at 12:38
  • As part of the upgrade to 1.9.2.2 it adds those fields so i suspect the upgrade may not have run
    – rob3000
    Commented Nov 2, 2015 at 23:59
0

I agree with the Fiasco Labs labs comment. This is likely an incompatibility between whatever banner slider extension you have installed and APPSEC-1063. The same issue was reported here and I went into detail on what is happening and some ideas on how to debug / mitigate other issues that could pop up from APPSEC-1063.

You can try to contact the extension developer, or you could try to patch it yourself.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.