8

I installed the new patch today - SUPEE-7405 via FTP from this site.

https://magentary.com/kb/install-supee-7405-without-ssh/

Now, it looks like my front end store is still working, however when I try to login into the /admin it takes me to the login/password page... once I login i get an error.

Invalid method Mage_Core_Model_Session::validateFormKey(Array
(
    [0] => y6h9TjgvchV8hCZT
)
)

Trace:
#0 /home/a0cegcom/public_html/app/code/core/Mage/Admin/Model/Observer.php(73): Varien_Object->__call('validateFormKey', Array)
#1 /home/a0cegcom/public_html/app/code/core/Mage/Admin/Model/Observer.php(73): Mage_Core_Model_Session->validateFormKey('y6h9TjgvchV8hCZ...')
#2 /home/a0cegcom/public_html/app/code/core/Mage/Core/Model/App.php(1357): Mage_Admin_Model_Observer->actionPreDispatchAdmin(Object(Varien_Event_Observer))
#3 /home/a0cegcom/public_html/app/code/core/Mage/Core/Model/App.php(1336): Mage_Core_Model_App->_callObserverMethod(Object(Mage_Admin_Model_Observer), 'actionPreDispat...', Object(Varien_Event_Observer))
#4 /home/a0cegcom/public_html/app/Mage.php(448): Mage_Core_Model_App->dispatchEvent('controller_acti...', Array)
#5 /home/a0cegcom/public_html/app/code/core/Mage/Core/Controller/Varien/Action.php(527): Mage::dispatchEvent('controller_acti...', Array)
#6 /home/a0cegcom/public_html/app/code/core/Mage/Adminhtml/Controller/Action.php(160): Mage_Core_Controller_Varien_Action->preDispatch()
#7 /home/a0cegcom/public_html/app/code/core/Mage/Core/Controller/Varien/Action.php(407): Mage_Adminhtml_Controller_Action->preDispatch()
#8 /home/a0cegcom/public_html/app/code/core/Mage/Core/Controller/Varien/Router/Standard.php(254): Mage_Core_Controller_Varien_Action->dispatch('index')
#9 /home/a0cegcom/public_html/app/code/core/Mage/Core/Controller/Varien/Front.php(172): Mage_Core_Controller_Varien_Router_Standard->match(Object(Mage_Core_Controller_Request_Http))
#10 /home/a0cegcom/public_html/app/code/core/Mage/Core/Model/App.php(365): Mage_Core_Controller_Varien_Front->dispatch()
#11 /home/a0cegcom/public_html/app/Mage.php(684): Mage_Core_Model_App->run(Array)
#12 /home/a0cegcom/public_html/index.php(88): Mage::run('', 'store')
#13 {main}

any ideas? I already cleared my var/cache and var/session with no luck

11

To me it looks like the patch was not installed properly.

The validateFormKey function is included in the patch.

  • Open the app/code/core/Mage/Core/Model/Session.php file and double check if the validateFormKey function is here
  • If the file is overridden in app/code/local/Mage/Core/Model/Session.php, you have to add the new methods validateFormKey and renewFormKey manually in the overridden file. Also change line 60 from:

    $this->setData('_form_key', Mage::helper('core')->getRandomString(16));
    

    to

    $this->renewFormKey();
    
  • If it's here, it's definitely a caching/compilation problem. Flush your cache, as well as any other cache (Varnish / APC etc...)

  • If you have compilation enable, please disable compilation then recompile.
  • If the function is not here, that means the files have not been uploaded properly. Please note that when you extract the archive from Magentary, the files are extracted in a SUPEE-7405-1.9.2.1 folder, you must open this folder and extract the files from this folder to your Magento root, transfering the entire SUPEE-7405-1.9.2.1 folder will not apply the patch.
7

The Nexcess_Turpentine module overrides app/code/core/Mage/Core/Model/Session.php as app/code/local/Mage/Core/Model/Session.php. We just ran into this. This is very likely your issue. To appease this patch without spending excessive time on it, I think the most appropriate solution is to add the patch changes to the local override file. Turpentine overrides that file, I believe, because a rewrite did not work for the particular scenario they need to cover. I don't think this can be converted to a rewrite.

Here is the patch change that needs to be applied:

--- a/app/code/core/Mage/Core/Model/Session.php
+++ b/app/code/core/Mage/Core/Model/Session.php
@@ -36,7 +36,7 @@
  */
 class Mage_Core_Model_Session extends Mage_Core_Model_Session_Abstract
 {
-    public function __construct($data=array())
+    public function __construct($data = array())
     {
         $name = isset($data['name']) ? $data['name'] : null;
         $this->init('core', $name);
@@ -50,8 +50,27 @@ class Mage_Core_Model_Session extends Mage_Core_Model_Session_Abstract
     public function getFormKey()
     {
         if (!$this->getData('_form_key')) {
-            $this->setData('_form_key', Mage::helper('core')->getRandomString(16));
+            $this->renewFormKey();
         }
         return $this->getData('_form_key');
     }
+
+    /**
+     * Creates new Form key
+     */
+    public function renewFormKey()
+    {
+        $this->setData('_form_key', Mage::helper('core')->getRandomString(16));
+    }
+
+    /**
+     * Validates Form key
+     *
+     * @param string|null $formKey
+     * @return bool
+     */
+    public function validateFormKey($formKey)
+    {
+        return ($formKey === $this->getFormKey());
+    }
}
3

My sites had a varnish/turpentine modified version of the Session.php file in the app/code/local/Mage/Core/Model/ directory.

Make the appropriate functions within that file now look like the following and everything should work again.

public function getFormKey()
{
    if (Mage::registry('replace_form_key') &&
            !Mage::app()->getRequest()->getParam('form_key', false)) {
        // flag request for ESI processing
        Mage::register('turpentine_esi_flag', true, true);
        return '{{form_key_esi_placeholder}}';
    } else {
        return $this->real_getFormKey();
    }
}

public function real_getFormKey()
{
    if (!$this->getData('_form_key')) {
        //$this->setData('_form_key', Mage::helper('core')->getRandomString(16));
        $this->renewFormKey();
    }
    return $this->getData('_form_key');
}

public function renewFormKey()
{
    $this->setData('_form_key', Mage::helper('core')->getRandomString(16));
}

public function validateFormKey($formKey)
{
    return ($formKey === $this->getFormKey());
}
2

Also make sure you do not modify app/code/core/Mage/Core/Model/Session.php directly, but copy the file to app/code/local/Mage/Core/Model/Session.php and make the appropriate modification.

(Magento will check the local directory path before using the core path.

  • I forgot and essentially had Magento 1.9.2.4 running with app/code/local/Mage/Core/ from an earlier magento version in local ... hence my admin log in would break on POST. – BENN1TH Apr 19 '17 at 10:41
1

Add the below functions to 3rd Party/Custom Module . If not implement/extend the functions properly .

/**
* Creates new Form key
*/
public function renewFormKey()
{
$this->setData('_form_key', Mage::helper('core')->getRandomString(16));
}

/**
* Validates Form key
*
* @param string|null $formKey
* @return bool
*/
public function validateFormKey($formKey)
{
return ($formKey === $this->getFormKey());
}
}

Thanks!

0

I had the same error, for me I had to roll back the patch (using the -R after the .sh file, but don't know how you'd do via PHP)

Then in Magento goto system -> general -> web -> session validation settings

I changed 'Validate HTTP_X_FORWARDED_FOR' to 'no' and 'Validate HTTP_USER_AGENT' to 'yes. Make sure your cookie domain is correctly set also like 'yourdomain.com'

Once I did this, re-applied the patch and can log in. Hope this helps you resolve it - it seems any incorrect session params will cause the form key issue.

Make sure you clear your browser cookies also before testing

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.