0

I have Magento 1.9.2.1 installed and ran the script to install the latest security patch, SUPEE-6788. I got a fail message because of the .htaccess file. I uploaded the .htaccess file from the clean files of the saved copy of 1.9.2.1 that I have, and was able to successfully run the patch install.

When I compared the patched version of .htaccess with the original clean version, I saw that no changes were actually made to the file.

When I compare the clean/patched version of .htaccess to my working .htaccess file that was causing the script to not run, I see another 200 lines of code + that were added by the install process that my host used when they installed magento to my folders.

Question is: Since no changes were made to the core .htaccess file, am I safe to upload my host's version of .htaccess back to the server now that the patch has run successfully?

Improve this question
1

It is extremely common for the .htaccess file to be modified by either the webhost or the site operator for protecting Magento admin, excluding access to various files/folders, rewrite bare domain to www. subdomain, etc.

This causes a sync issue with patch when it tries to find the appropriate area in the file to make the changes. Quite a few people who applied SUPEE-6788 probably had the patch fail only on .htaccess due to it being modified, a few others had issues also because .htaccess.sample was also removed as it isn't needed and becomes directory littering detritus.

The proper procedure on installing SUPEE-6788 is to:

  1. if it's missing, upload a clean copy of .htaccess.sample from the installer archive
  2. save a copy of your modified .htaccess file
  3. upload a clean copy of .htaccess from the installer archive
  4. successfully run the patch so it makes the changes
  5. save a copy of the patched .htaccess file
  6. merge the changes to the patched .htaccess back into your original saved copy of .htaccess and upload that to your website

The change made in .htaccess was to restrict or prevent web accessibility to Magento's cron.php file with the following:

###########################################
## Deny access to cron.php

<Files cron.php>

############################################
## uncomment next lines to enable cron access with base HTTP authorization
## http://httpd.apache.org/docs/2.2/howto/auth.html
##
## Warning: .htpasswd file should be placed somewhere not accessible from the web.
## This is so that folks cannot download the password file.
## For example, if your documents are served out of /usr/local/apache/htdocs
## you might want to put the password file(s) in /usr/local/apache/.

    #AuthName "Cron auth"
    #AuthUserFile ../.htpasswd
    #AuthType basic
    #Require valid-user

############################################

    Order allow,deny
    Deny from all

</Files>
Improve this answer
  • Thanks for the info. I understand all of this and had no problem running the patch. My main question was that, since .htaccess did not appear to have been changed by this patch, I was wondering if I could just continue to use the host modified .htaccess file after doing the patch with the basic, stock .htaccess file. It appears from your answer that the answer to my question is yes. Can you confirm that? Once confirmed, I will give your answer the check mark. – as_whitley Nov 10 '15 at 20:10
  • If the patch was successful, it will have added the above code to your .htaccess file that was in place during the supposedly successful patch attempt. I'd worry if it didn't. – Fiasco Labs Nov 10 '15 at 21:06
  • The message from the patch said it was successful. Not sure how else I would know if it was because I don't know what changes to look for. – as_whitley Nov 11 '15 at 14:26
0

Did you make any changes to your .htaccess file? If not why would you change it? It seems to me that you can edit a patched file.

Probably the file couldn't be patched because some write or owner issues.

Improve this answer
  • I did not make any changes to the .htaccess file myself. The only reason it was 200 plus lines longer than the basic .htaccess file from a fresh clean install is because Magento was installed by an online installer from my host, and I am assuming they added the additional lines to make their own admins happy. Mostly just need to know if it is OK to use their .htaccess file unchanged since the patch did not appear to make any changes at all to .htaccess. – as_whitley Nov 10 '15 at 20:05
  • true, but it did give an error on patching.. perhaps just add the additional lines to the one that is there. Or revert the patch an put back the "old" one and make sure the owner and write settings are right. – RoRo Nov 11 '15 at 0:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.