For 1533 Patched site just replace below line from PATCH_SUPEE-8788*****.sh : diff --git app/code/core/Mage/Adminhtml/controllers/DashboardController.php app/code/core/Mage/Adminhtml/controllers/DashboardController.php index 09ffc4c..367bf8e 100644 --- app/code/core/Mage/Adminhtml/controllers/DashboardController.php +++ app/code/core/Mage/Adminhtml/controllers/DashboardController.php @@ -91,7 +91,7 @@ class Mage_Adminhtml_DashboardController extends Mage_Adminhtml_Controller_Actio $gaHash = $this->getRequest()->getParam('h'); if ($gaData && $gaHash) { $newHash = Mage::helper('adminhtml/dashboard_data')->getChartDataHash($gaData); - if ($newHash == $gaHash) { + if (hash_equals($newHash, $gaHash)) { if ($params = unserialize(base64_decode(urldecode($gaData)))) { $response = $httpClient->setUri(Mage_Adminhtml_Block_Dashboard_Graph::API_URL) ->setParameterGet($params) by: diff --git a/app/code/core/Mage/Adminhtml/controllers/DashboardController.php b/app/code/core/Mage/Adminhtml/controllers/DashboardController.php index ab2d654..367bf8e 100644 --- a/app/code/core/Mage/Adminhtml/controllers/DashboardController.php +++ b/app/code/core/Mage/Adminhtml/controllers/DashboardController.php @@ -91,9 +91,8 @@ class Mage_Adminhtml_DashboardController extends Mage_Adminhtml_Controller_Actio $gaHash = $this->getRequest()->getParam('h'); if ($gaData && $gaHash) { $newHash = Mage::helper('adminhtml/dashboard_data')->getChartDataHash($gaData); - if ($newHash == $gaHash) { - $params = json_decode(base64_decode(urldecode($gaData)), true); - if ($params) { + if (hash_equals($newHash, $gaHash)) { + if ($params = unserialize(base64_decode(urldecode($gaData)))) { $response = $httpClient->setUri(Mage_Adminhtml_Block_Dashboard_Graph::API_URL) ->setParameterGet($params) ->setConfig(array('timeout' => 5)) diff --git a/app/code/core/Mage/Adminhtml/Block/Dashboard/Graph.php b/app/code/core/Mage/Adminhtml/Block/Dashboard/Graph.php index da1b14a..b6d72c0 100644 --- a/app/code/core/Mage/Adminhtml/Block/Dashboard/Graph.php +++ b/app/code/core/Mage/Adminhtml/Block/Dashboard/Graph.php @@ -444,7 +444,7 @@ class Mage_Adminhtml_Block_Dashboard_Graph extends Mage_Adminhtml_Block_Dashboar } return self::API_URL . '?' . implode('&', $p); } else { - $gaData = urlencode(base64_encode(json_encode($params))); + $gaData = urlencode(base64_encode(serialize($params))); $gaHash = Mage::helper('adminhtml/dashboard_data')->getChartDataHash($gaData); $params = array('ga' => $gaData, 'h' => $gaHash); return $this->getUrl('*/*/tunnel', array('_query' => $params)); Basically it just reverted the 1533 and left 8788 along.