We’re rewarding the question askers & reputations are being recalculated! Read more.

Hot answers tagged

157

23rd February 2016 Update: The patch has been updated to V1.1, which fixes a number of important issues listed in this post, here is the list: Cart Merge Patch (SUPEE-7978) : Carts with identical items now merge correctly. Previously, when a cart with one item was merged with another cart that contained the same item, Magento did not merge the cart totals ...


129

As written here: If you use restricted admin accounts, some menus of third party extensions might not work anymore for them. The reason is that the default return value of Mage_Adminhtml_Controller_Action::_isAllowed() has been changed from true to Mage::getSingleton('admin/session')->isAllowed('admin'). Extensions that do not override this method in ...


108

Here's my overview of the patch after digging into it TIME SAVER : Experius provides a patch helper that helps you finding the files in custom themes, custom modules or local overwrites that also might need to be patched manually, you can find it here: https://github.com/experius/Magento-1-Experius-Patch-Helper#magento Checkout form keys As said in the ...


107

Important notes Please note that 1.9.3 is different than 1.9.2.4 + SUPEE-8788. Here's the diff between the two: https://gist.github.com/digitalpianism/14a15cd52baede0e5d600e8c653f33e9 Update October 14th: v2 of the patch has been released (see below) As of October 13th, the patches for 1.5.x to 1.8.x have been taken down from the Magento website because of ...


66

I'm assuming you do have FTP access. When patches are applied a file named applied.patches.list is added in the app/etc/ directory. Next to that the patch is nothing more than a diff file so you can see what it should change when you open it and check in the targeted file if it is indeed changed


55

SUPEE-6788 released and admin routing changes turned off by default. This means that the patch include the fix, but that it will be disabled when installed. This will give you some additional time to make updates to your code and will give merchants flexibility to turn on this part of the patch once their extensions and customizations have been updated to ...


43

Issue1: form_key invalid at checkout onepage Magento add form_key at most of the forms. if you have using default onepage and using custom theme, then you will start getting **form_key issue at checkout each step **; you should add form key at <?php echo $this->getBlockHtml('formkey') ?> to form of each checkout step files if below files ...


38

Have you switched off and cleared compilation? via the console/ssh you can use $ php -f shell/compiler.php -- disable $ php -f shell/compiler.php -- clear $ php -f shell/compiler.php -- compile $ php -f shell/compiler.php -- enable might need the fourth line...not sure. It might be a problem with the line that comes before the code you showed $...


38

For the sake of completeness, you can manually add blocks and variables to the white lists under System > Permissions > Variables and System > Permissions > Blocks. The codes you add there are in the form web/unsecure/base_url (config path) or rss/order_new (block class alias). Original answer My upgrade script looks like this: /* * Make sure the upgrade ...


36

As already mentioned, the patched vulnerabilities are described in detail on this official page (new merchant docs): http://merch.docs.magento.com/ce/user_guide/Magento_Community_Edition_User_Guide.html#magento/patch-releases-2015.html Summary This bundle includes protection against the following security-related issues: Customer Information Leak ...


36

Ok here's the real bug fix I came up with. Edit /skin/frontend/base/default/js/opcheckout.js and edit the setMethod() method by replacing: setMethod: function(){ if ($('login:guest') && $('login:guest').checked) { this.method = 'guest'; new Ajax.Request( this.saveMethodUrl, {method: 'post', onFailure: ...


35

Applying patches manually with no SSH access You have a good point here. The patches are supplied as .sh files and there is no solution offered by Magento for FTP only websites. I suggest one would copy his website's code to a local environment through FTP (you would probably have that already). Then apply the patch by running the .sh file. Now you need ...


35

One issue I have noticed is that if your site is using a version less than PHP 5.4 the patch is not compatible. In the class Mage_Adminhtml_Helper_Sales around line number 124. The code is: $links = []; I needed to extend this to be: // Patch not compatible with PHP version 5.3: overwrote Magento patch update $links = array(); Another ...


33

In general, you can apply the patch as all previous ones. Have a look at the official documentation and check this SE post. But yes, there are some additional points you should check when applying this patch. Byte/Hypernode has a nice post about it. Check if your theme has a custom template/customer/form/register.phtml or custom template/persistent/customer/...


29

When applying the patch this error can happen: checking file skin/adminhtml/default/default/media/flex.swf checking file skin/adminhtml/default/default/media/uploader.swf checking file skin/adminhtml/default/default/media/uploaderSingle.swf Reversed (or previously applied) patch detected! Assume -R? [n] Apply anyway? [n] Skipping patch. 1 out of 1 hunk ...


29

I had the same issue after patching 1.9.2.2 and 1.9.2.3. SUPEE-9767 adds an extended validate method in app/code/core/Mage/Core/Model/File/Validator/Image.php Mine was: public function validate($filePath) { $fileInfo = getimagesize($filePath); if (is_array($fileInfo) and isset($fileInfo[2])) { if ($this->isImageType($fileInfo[2])) { ...


29

Here is the list of modified files by the SUPEE-10570 patch: app/Mage.php app/code/core/Mage/Admin/Helper/Data.php app/code/core/Mage/Admin/Model/Block.php app/code/core/Mage/Admin/Model/Resource/Block.php app/code/core/Mage/Admin/Model/User.php app/code/core/Mage/Adminhtml/Block/Catalog/Category/Edit/Form.php app/code/core/Mage/Adminhtml/Block/Catalog/...


27

Based on my first pass at review of the patch file... A new setting admin/security/validate_formkey_checkout has been added. When turned on, checkout forms are checked for presence of a form key. If the template files are overriden in the theme they'll need to be updated there. This setting seems to be off by default Symlinks seem to be disallowed by ...


26

The below files are updated/added after applied patch SUPEE - 10415. app/Mage.php app/code/core/Mage/Adminhtml/Block/Report/Review/Detail.php app/code/core/Mage/Adminhtml/Block/Report/Tag/Product/Detail.php app/code/core/Mage/Adminhtml/Block/Review/Add.php app/code/core/Mage/Adminhtml/Block/Review/Edit/Form.php app/code/core/Mage/Adminhtml/Controller/Action....


25

If you've previously applied SUPEE-1533 then the patch will fail on app/code/core/Mage/Adminhtml/controllers/DashboardController.php. I solved this by... Manually revert the changes introduced to that file by SUPEE-1533 Apply SUPEE-8788 Manually reintroduce the changes introduced to that file by SUPEE-1533 Removing the change from the SUPEE-8788 is ...


25

Here's a summary of what I (and others) encountered so far, I'm trying to keep it sorted, feel free to add or link anything that's missing, the post is a Community Wiki: Reasons for failed patch If you see "ERROR: Patch can't be applied/reverted successfully", look for "Hunk #1 FAILED" in the log messages to check at which file the patch failed. ...


25

It's a super tiny patch, here's the diff: diff --git lib/Zend/Mail/Transport/Sendmail.php lib/Zend/Mail/Transport/Sendmail.php index b24026b..9323f58 100644 --- lib/Zend/Mail/Transport/Sendmail.php +++ lib/Zend/Mail/Transport/Sendmail.php @@ -119,14 +119,19 @@ class Zend_Mail_Transport_Sendmail extends Zend_Mail_Transport_Abstract ); ...


24

Unfortunately, there's no 'easy' way to install these patches without shell access, but there's two ways to do it. Install patch through PHP Use an FTP client to upload the specific patch to the root of your Magento folder. Create a PHP file called applypatch.php that will run the patch for you, and upload it to the root of your Magento folder. Make sure ...


23

If you get Call to undefined function hash_equals() error even if your patch was successful then it may mean that you have copied functions.php in app/code/local/Mage/Core. You will have to insert that function there too because that file overwrites the core one. So insert in app/code/local/Mage/Core/functions.php at the end: if (!function_exists('...


22

Here's a problem I've found when patching Magento CE with SUPEE-7405. It replaces the line: chmod($destinationFile, 0777); with: chmod($destinationFile, 0640); in the file lib/Varien/File/Uploader.php This stopped my images displaying in the back end, since this file permission should actually be 644. Is there any reason this has been set to 640?


21

Along the lines of other comments about detecting conflicts, we at ParadoxLabs have created a script to track down everything affected by APPSEC-1034 (admin controllers) and APPSEC-1057 (whitelist). It will also attempt to fix any bad controllers, since that's a fairly precise and invasive change to make. It doesn't cover APPSEC-1063 (SQL injection) or ...


21

When applying for Magento 1.7.0.0 its trying to remove a comment on app/design/adminhtml/default/default/template/authorizenet/directpost/iframe.phtml -/* @var $_helper Mage_Authorizenet_Helper_Data */ 1.7.0.0 - https://raw.githubusercontent.com/OpenMage/magento-mirror/1.7.0.0/app/design/adminhtml/default/default/template/authorizenet/directpost/iframe....


20

SUPEE-10415... Resolves some admin panel XSS issues in the following areas: Product reviews report Product tags report Product reviews add/edit interface Billing agreements xmlconnect content editor tab Serialized rules Restricts file extensions that can be used for the system and exception log files. Allowed file extensions: .log, .txt, .html, .csv ...


20

The biggest problem, which was found: Mage::log() works incorrectly. If you call this function with custom log file (and it does not exist yet), log will not be written to the file, because of additional validation, added in the SUPEE-11086.


19

these files patched, you can see any possible impact: template: admin templates mostly patched. +++ app/design/frontend/base/default/template/rss/order/details.phtml +++ app/design/frontend/base/default/template/catalog/product/view/options/type/file.phtml +++ app/design/adminhtml/default/default/template/sales/order/view/info.phtml +++ app/design/...


Only top voted, non community-wiki answers of a minimum length are eligible