After weeks of waiting for the patch today (27.10.2015) it was released: SUPEE-6788
A lot of things were patched and also is encouraged to review installed modules for possible vulnerabilities.
I open this post in order to get some insights about how to apply the patch. What are the steps to apply the patch? To my understanding this are the steps:
- Fix modules with admin functionality that is not under the admin URL
- Fix modules that use SQL statements as field names or escape fields
- White list blocks or directives that uses variables like
- Addressing potential Exploit with Custom Option File Type (no idea how to do this)
- Apply the patch
Is this the correct procedure?