SUPEE-6788 released and admin routing changes turned off by default. This means that the patch include the fix, but that it will be disabled when installed. This will give you some additional time to make updates to your code and will give merchants flexibility to turn on this part of the patch once their extensions and customizations have been updated to ...
I managed to change my custom module to use the Magento new way as recommended with the patch 6788. So I give here as a reference for other, also answer the question in this thread.
Change to router in the config.xml file:
Along the lines of other comments about detecting conflicts, we at ParadoxLabs have created a script to track down everything affected by APPSEC-1034 (admin controllers) and APPSEC-1057 (whitelist). It will also attempt to fix any bad controllers, since that's a fairly precise and invasive change to make.
It doesn't cover APPSEC-1063 (SQL injection) or ...
You created an infinite loop:
you request a URL starting with "test"
your router sets module, controller and action to "moduletest", "test", and "test"
you forward, using this request (the URL is still starting with "test")
Go to (1).
The inchoo article also explains that:
Forwarding means that it will break current routers loop and start the loop again ...
I lost hours figuring this out. Just because the Devs at Magento aren't capable of making an understandable configuration, or yet even documenting their code in a way a human being would be able to read it.
Let's have a look at the config.xml first
There are some words that you cannot use for class names.
Basically the reserved php words like new, public, static, ...
To overcome this and still allow these words in the urls Magento adds the suffix Action when the class is autoloaded.
This means that new maps to NewAction.php, public to PublicAction.php.
You can find in the class \Magento\Framework\...
Here's an analysis/fix tool for extension and customization conflicts resulting from the Magento SUPEE-6788 patch.
Note: Before applying any patch or patch fix, it is always recommended to make backup of your website and database.
You can only analyze what need to fixed.
To analyze: Run from SSH: php -f ...
If your code is perfect and you still get an error, Then you have to check your sortOrder of router plugin class in di.xml.
As magento official say :
For frontend :
For admin :
Your sort order should be in between of magento standard router and default router sort order.
I don't think there is a way to do this without removing the routers tag from the config.xml or adding some observers on the predispatch event that will redirect you to a 404 page.
But I may be wrong. In case I'm wrong here is a place to start.
The routers section of the config.xml files is parsed in Mage_Core_Controller_Varien_Router_Standard::collectRoutes....
If you had secrete settings enabled for Admin URl, it will redirect you to dashboard when you try to run URL without it.
Check settings in admin
Admin -> System -> Configuration -> Advanced (Bottom Left) -> Admin -> Security(Tab) -> Check Field "Add Secret Key to URLs"
If you want to access URL without secret key try to set value No and ...
I know it's late to answer but it would be helpful for others.
In magento 2.1.10, the standard router sortOrder has been changed to 30, making the custom router (which sortOrder is 22) forward request infinite loop. Change the custom router order > 30 solves the issue.
I ended up adding a plugin for Magento\Framework\App\Router\ActionList
<!-- File: app/code/Package/Namespace/etc/di.xml -->
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
In this case, I was accessing the wrong route, rather than /adminurl/vendor_module/store/ which caused the error message about an invalid key, I needed to go to /adminurl/vendor_module/store/index/.
I still think Magento should return a 404 or some other error message that would be much more helpful to debug but in this case that was all I did wrong.
@benmarks answer is already good. But you will still have issues if your product URLs match your CMS page URLs. The URL rewrites from the table core_url_rewrite are checked before the routers are checked - see Mage_Core_Controller_Varien_Front::dispatch:
public function dispatch()
From index.php, before anything initializes? Realistically, you can't. You could add an explicit check for your admin path in the URL, and skip it if so, but that entire thing makes for a very dirty solution that would just be overwritten every time you upgrade. The easiest solution isn't always best.
You should rewrite your code as a proper Magento module, ...
I've honestly never tried, but best I can make out looking at examples from core, you should just need to add:
To each of your other extensions in order to register the modules controllers for that route.
My host is Nexcess, this issue was resolved by them when I opened a ticket about the issue . They updated the apache mod_security that was apparently blocking the POST action to the URL. Problem solved.
Plugins are defined on interface. So if you define plugin for concrete interface
<plugin name="log" type="Magento\Logging\App\Action\Plugin\Log" sortOrder="95"/>
then plugin will be work on all classes that implements it and IT will generate interceptor proxies for them. That'...
This php script might be useful in identifying Magento code affected by the proposed SUPEE-6788 patch.
This is in no way a foolproof security check for this patch, but might be useful to quickly scan your installation for the modules and code affected.
Install the script with
Alternatively, you could extend the preDispatch method of your controller, check which actions are allowed and which not (I recommend you against calling exit, send a proper HTTP status instead), and redirect the request to a single action in your controller, say foobarAction, by using $this->_forward('foobar').
I tested my solution, have a look ...
Define two routes in routes.xml
<route frontName="name1" id="name1">
<route frontName="name2" id="name2">
Create different layout file for router
There is already a big list available with all the extensions that will break with SUPEE-6788
More info here: https://docs.google.com/spreadsheets/d/1LHJL6D6xm3vD349DJsDF88FBI_6PZvx_u3FioC_1-rg/edit#gid=0
It seams you cannot use __call in controllers starting from version CE - 1.8 (and EE 1.13)
it was possible up to 1.7 because of the method Mage_Core_Controller_Varien_Action::hasAction.
in 1.7 and lower it looked like this:
return is_callable(array($this, $this->getActionMethodName($action)));
The reason was to avoid messy declarations with too short identifiers (same as too short variable limitations in PHP code style analyzers).
It was applied to multiple field types. Route front name has this limitation by mistake. It will be fixed
The second one has been introduced somewhere between Magento 1.4 and 1.5 and is since then the preferred way.
It also has more flexibility, with this configuration any module can add itself as listener to a route and they are matched in order of priortiy until the requested controller action is found.
The first one is the old way, still works but is not ...
It was only a naming convention issue, I tried to rename my module Vmap_Import instead of VM_import and it worked.
The lower/uppercase construction of the module's name was the only problem, and magento error messages, did not help at all.
I have added a custom no route handler using the following code
<argument name="handlerClassesList" xsi:type="array">
<item name="hello" xsi:type="array">
After check the core modules, found that parameter node in webapi.xml is only used in Customer Module for self resource type.
Below file is responsible for Convert parameter placeholder with value.
* Replaces a "%customer_id%" value with the real customer id
Now there are two ways to pass ...
please use Mage_Core_Controller_Varien_Router_Standard class, validateControllerClassName method to debug controller class name and controller file name. Hope it will help.
Update: For deeper understanding of magento routing please familiarize with this wonderful article from one of
the best magento blogers exists - Alan Storm.
Please follow below steps:
Step-1: go to "app" from root directory of Magento 2 and create new directory code. Then create two more directories in app/code, Namespace and Module Name. The final directory will look like this: app/code/Demo/MobileVerification
Demo as Namespace and MobileVerification as module name.
Please find below Steps:
Step-2: create "...