2

I just updated my Magento to 1.9.2 and there is the error log file:

SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '.`value)` = '0') AND (`start_time` = '2015-10-' at line 2, query was: SELECT `main_table`.* FROM `bannerslider_banner` AS `main_table` LEFT JOIN `bannerslider_value` AS `status` ON main_table.banner_id = status.banner_id AND status.store_id = 1 AND status.attribute_code = 'status' WHERE (`bannerslider_id` = '2') AND (`IF(status`.`value IS NULL, main_table`.`status, status`.`value)` = '0') AND (`start_time` = '2015-10-28') ORDER BY order_banner ASC

a:5:{i:0;s:643:"SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '.`value)` = '0') AND (`start_time` = '2015-10-' at line 2, query was: SELECT `main_table`.* FROM `bannerslider_banner` AS `main_table`
 LEFT JOIN `bannerslider_value` AS `status` ON main_table.banner_id = status.banner_id AND status.store_id = 1 AND status.attribute_code = 'status' WHERE (`bannerslider_id` = '2') AND (`IF(status`.`value IS NULL, main_table`.`status, status`.`value)` = '0') AND (`start_time` = '2015-10-28') ORDER BY order_banner ASC";i:1;s:4886:"#0 lib/Varien/Db/Statement/Pdo/Mysql.php(110): Zend_Db_Statement_Pdo->_execute(Array)
#1 app/code/core/Zend/Db/Statement.php(291): Varien_Db_Statement_Pdo_Mysql->_execute(Array)
#2 lib/Zend/Db/Adapter/Abstract.php(480): Zend_Db_Statement->execute(Array)
#3 lib/Zend/Db/Adapter/Pdo/Abstract.php(238): Zend_Db_Adapter_Abstract->query('SELECT `main_ta...', Array)
#4 lib/Varien/Db/Adapter/Pdo/Mysql.php(504): Zend_Db_Adapter_Pdo_Abstract->query('SELECT `main_ta...', Array)
#5 lib/Zend/Db/Adapter/Abstract.php(737): Varien_Db_Adapter_Pdo_Mysql->query('SELECT `main_ta...', Array)
#6 lib/Varien/Data/Collection/Db.php(740): Zend_Db_Adapter_Abstract->fetchAll('SELECT `main_ta...', Array)
#7 app/code/core/Mage/Core/Model/Resource/Db/Collection/Abstract.php(521): Varien_Data_Collection_Db->_fetchAll('SELECT `main_ta...', Array)
#8 lib/Varien/Data/Collection/Db.php(572): Mage_Core_Model_Resource_Db_Collection_Abstract->getData()
#9 lib/Varien/Data/Collection.php(741): Varien_Data_Collection_Db->load()
#10 app/code/community/Magestore/Bannerslider/Block/Default.php(44): Varien_Data_Collection->getIterator()
#11 app/design/frontend/base/default/template/bannerslider/bannerslider.phtml(28): Magestore_Bannerslider_Block_Default->getBlockData()
#12 app/code/core/Mage/Core/Block/Template.php(241): include('/var/www/html/d...')
#13 app/code/core/Mage/Core/Block/Template.php(272): Mage_Core_Block_Template->fetchView('frontend/base/d...')
#14 app/code/community/Magestore/Bannerslider/Block/Bannerslider.php(47): Mage_Core_Block_Template->renderView()
#15 app/code/core/Mage/Core/Block/Abstract.php(919): Magestore_Bannerslider_Block_Bannerslider->_toHtml()
#16 app/code/core/Mage/Core/Block/Text/List.php(43): Mage_Core_Block_Abstract->toHtml()
#17 app/code/core/Mage/Core/Block/Abstract.php(919): Mage_Core_Block_Text_List->_toHtml()
#18 app/code/core/Mage/Core/Block/Abstract.php(637): Mage_Core_Block_Abstract->toHtml()
#19 app/code/core/Mage/Core/Block/Abstract.php(581): Mage_Core_Block_Abstract->_getChildHtml('content', true)
#20 app/design/frontend/base/default/template/page/1column.phtml(48): Mage_Core_Block_Abstract->getChildHtml('content')
#21 app/code/core/Mage/Core/Block/Template.php(241): include('/var/www/html/d...')
#22 app/code/core/Mage/Core/Block/Template.php(272): Mage_Core_Block_Template->fetchView('frontend/base/d...')
#23 app/code/core/Mage/Core/Block/Template.php(286): Mage_Core_Block_Template->renderView()
#24 app/code/core/Mage/Core/Block/Abstract.php(919): Mage_Core_Block_Template->_toHtml()
#25 app/code/core/Mage/Core/Model/Layout.php(555): Mage_Core_Block_Abstract->toHtml()
#26 app/code/core/Mage/Core/Controller/Varien/Action.php(390): Mage_Core_Model_Layout->getOutput()
#27 app/code/core/Mage/Cms/Helper/Page.php(137): Mage_Core_Controller_Varien_Action->renderLayout()
#28 app/code/core/Mage/Cms/Helper/Page.php(52): Mage_Cms_Helper_Page->_renderPage(Object(Mage_Cms_IndexController), 'home')
#29 app/code/core/Mage/Cms/controllers/IndexController.php(45): Mage_Cms_Helper_Page->renderPage(Object(Mage_Cms_IndexController), 'home')
#30 app/code/core/Mage/Core/Controller/Varien/Action.php(418): Mage_Cms_IndexController->indexAction()
#31 app/code/core/Mage/Core/Controller/Varien/Router/Standard.php(254): Mage_Core_Controller_Varien_Action->dispatch('index')
#32 app/code/core/Mage/Core/Controller/Varien/Front.php(172): Mage_Core_Controller_Varien_Router_Standard->match(Object(Mage_Core_Controller_Request_Http))
#33 app/code/core/Mage/Core/Model/App.php(365): Mage_Core_Controller_Varien_Front->dispatch()
#34 app/Mage.php(684): Mage_Core_Model_App->run(Array)
#35 index.php(83): Mage::run('', 'store')
#36 {main}";s:3:"url";s:1:"/";s:11:"script_name";s:10:"/index.php";s:4:"skin";s:7:"default";}

I can not understand where i can find the file causing the problem.

Can you help me out find the file which is causing the problem?

  • 1
    Probably is a MySQL injection vulnerability patched away by SUPEE-6788 and will require you to contact the Module developer to get the other half of the patch which is a module upgrade. – Fiasco Labs Oct 29 '15 at 2:37
  • 1
    I would discourage to use Magestore modules as their coding quality is really poor. Once again you see that using hardcoded SQL instead of sticking with Magento's ORM solution and PDO style queries is a bad practice. – 7ochem Nov 5 '15 at 13:57
6

A (temporary - until the developers release a new version) fix that worked for me:

In file

app/code/community/Magestore/Bannerslider/Model/Mysql4/Banner/Collection.php

at line 60 comment the following:

return parent::addFieldToFilter("IF($field.value IS NULL, main_table.$field, $field.value)", $condition);

and replace it with

 $this->getSelect()->where("IF($field.value IS NULL, main_table.$field, $field.value) = 0");

As per answer found here: http://answers.magentocommerce.com/answers/4643-en_us/product/3912/magestore-banner-slider-questions-answers/questions.htm?sort=recentq#BVQASAnswerText598988

  • The query generated in app/code/community/Magestore/Bannerslider/Model/Mysql4/Banner/Collection.php is mangled due to variable escaping after the update. Not the first time we've had problem with bad code from Magestore – Dom Dec 18 '15 at 16:12
0

It looks like the bannerslider/bannerslider module is trying to save someting from the CMS page and is having issues saving. When you upgraded make sure you add the bannerslider/bannerslider block to the whitelist table.

  • Where is that whitelist and how can i add bannerslider/bannerslider – Venelin Vasilev Oct 29 '15 at 9:22
  • You should be able to see it under system > permissions > blocks and adding it there. – rob3000 Oct 31 '15 at 7:59
  • In system - permissions i have only users and roles. I do not have blocks.. – Venelin Vasilev Nov 2 '15 at 12:38
  • As part of the upgrade to 1.9.2.2 it adds those fields so i suspect the upgrade may not have run – rob3000 Nov 2 '15 at 23:59
0

I agree with the Fiasco Labs labs comment. This is likely an incompatibility between whatever banner slider extension you have installed and APPSEC-1063. The same issue was reported here and I went into detail on what is happening and some ideas on how to debug / mitigate other issues that could pop up from APPSEC-1063.

You can try to contact the extension developer, or you could try to patch it yourself.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.