158
votes
Accepted
Security Patch SUPEE-7405 - Possible Problems?
23rd February 2016 Update: The patch has been updated to V1.1, which fixes a number of important issues listed in this post, here is the list:
Cart Merge Patch (SUPEE-7978) : Carts with identical ...
131
votes
Accepted
Access Denied errors after installing SUPEE-6285
As written here:
If you use restricted admin accounts, some menus of third party extensions might not work anymore for them. The reason is that the default return value of ...
- 65.4k
109
votes
Security Patch SUPEE-8788 - Possible Problems?
Important notes
Please note that 1.9.3 is different than 1.9.2.4 + SUPEE-8788. Here's the diff between the two: https://gist.github.com/digitalpianism/14a15cd52baede0e5d600e8c653f33e9
Update October ...
109
votes
Accepted
Security Patch SUPEE-9767 - Possible issues?
Here's my overview of the patch after digging into it
TIME SAVER : Experius provides a patch helper that helps you finding the files in custom themes, custom modules or local overwrites that also ...
67
votes
Accepted
How to check the latest patch version applied to magento?
I'm assuming you do have FTP access. When patches are applied a file named applied.patches.list is added in the app/etc/ directory.
Next to that the patch is nothing more than a diff file so you can ...
- 37.5k
57
votes
Magento 2: template security: which method to use?
The escaping methods in AbstractBlock all delegate calls to Magento\Framework\Escaper, so you'll find an overview there.
Let's look at the public methods and their documentation:
escapeHtml()
/**
*...
- 65.4k
55
votes
Accepted
How to check which modules are affected by security patch SUPEE-6788
SUPEE-6788 released and admin routing changes turned off by default. This means that the patch include the fix, but that it will be disabled when installed. This will give you some additional time to ...
- 2,100
44
votes
Security Patch SUPEE-9767 - Possible issues?
Issue1: form_key invalid at checkout onepage
Magento add form_key at most of the forms.
if you have using default onepage and using custom theme, then you will start getting **form_key issue at ...
- 76.7k
39
votes
Accepted
Magento Security Punch list
From my experience, these are important things to get information about when taking over a new shop from a security point of view. This list is not ordered & complete yet, I will continue to work ...
- 17.3k
36
votes
Accepted
SUPEE-6285 patch, what has been changed?
As already mentioned, the patched vulnerabilities are described in detail on this official page (new merchant docs): http://merch.docs.magento.com/ce/user_guide/Magento_Community_Edition_User_Guide....
- 65.4k
36
votes
Security Patch SUPEE-7405 - Possible Problems?
One issue I have noticed is that if your site is using a version less than PHP 5.4 the patch is not compatible.
In the class Mage_Adminhtml_Helper_Sales around line number 124. The code is:
$links ...
- 491
36
votes
Accepted
SUPEE-9767 Patch/CE 1.9.3.3 - One Page Checkout - Customer Registration issue
Ok here's the real bug fix I came up with.
Edit /skin/frontend/base/default/js/opcheckout.js and edit the setMethod() method by replacing:
setMethod: function(){
if ($('login:guest') && ...
35
votes
Accepted
Critical Reminder: Download and install Magento security patches. (FTP with no SSH access)
Applying patches manually with no SSH access
You have a good point here. The patches are supplied as .sh files and there is no solution offered by Magento for FTP only websites.
I suggest one would ...
- 7,432
33
votes
Accepted
New patch supee-6788 how to apply patch
In general, you can apply the patch as all previous ones. Have a look at the official documentation and check this SE post. But yes, there are some additional points you should check when applying ...
- 5,657
31
votes
Accepted
Security Patch SUPEE-10570 - Possible issues?
Here is the list of modified files by the SUPEE-10570 patch:
app/Mage.php
app/code/core/Mage/Admin/Helper/Data.php
app/code/core/Mage/Admin/Model/Block.php
app/code/core/Mage/Admin/Model/Resource/...
- 775
30
votes
Security Patch SUPEE-8788 - Possible Problems?
When applying the patch this error can happen:
checking file skin/adminhtml/default/default/media/flex.swf
checking file skin/adminhtml/default/default/media/uploader.swf
checking file skin/adminhtml/...
- 648
28
votes
Security Patch SUPEE-9767 - Possible issues?
Based on my first pass at review of the patch file...
A new setting admin/security/validate_formkey_checkout has been added. When turned on, checkout forms are checked for presence of a form key. If ...
- 1,234
27
votes
Accepted
Security Patch SUPEE-8788 - Possible Problems?
Here's a summary of what I (and others) encountered so far, I'm trying to keep it sorted, feel free to add or link anything that's missing, the post is a Community Wiki:
Reasons for failed patch
If ...
26
votes
Security Patch SUPEE-8788 - Possible Problems?
If you've previously applied SUPEE-1533 then the patch will fail on app/code/core/Mage/Adminhtml/controllers/DashboardController.php.
I solved this by...
Manually revert the changes introduced to ...
- 1,234
26
votes
Security Patch SUPEE-10415 - Possible Issues?
The below files are updated/added after applied patch SUPEE - 10415.
app/Mage.php
app/code/core/Mage/Adminhtml/Block/Report/Review/Detail.php
app/code/core/Mage/Adminhtml/Block/Report/Tag/Product/...
- 3,200
26
votes
Magento 2.3.5-p1 CSP font-src self unsafe-inline
Magento 2.3.5 p1 added a new module module-csp ( Magento_Csp ) which supports Content Security Policies ( CSP ) headers and provides ways to configure them. The policies can be configured for backend ...
- 619
25
votes
Accepted
SecurityPatch 9652: Possible problems after SUPEE-9652 applied
It's a super tiny patch, here's the diff:
diff --git lib/Zend/Mail/Transport/Sendmail.php lib/Zend/Mail/Transport/Sendmail.php
index b24026b..9323f58 100644
--- lib/Zend/Mail/Transport/Sendmail.php
++...
24
votes
Critical Reminder: Download and install Magento security patches. (FTP with no SSH access)
Unfortunately, there's no 'easy' way to install these patches without shell access, but there's two ways to do it.
Install patch through PHP
Use an FTP client to upload the specific patch to the ...
24
votes
Security Patch SUPEE-8788 - Possible Problems?
If you get
Call to undefined function hash_equals() error
even if your patch was successful then it may mean that you have copied functions.php in app/code/local/Mage/Core.
You will have to ...
- 6,227
23
votes
Security Patch SUPEE-7405 - Possible Problems?
Here's a problem I've found when patching Magento CE with SUPEE-7405. It replaces the line:
chmod($destinationFile, 0777);
with:
chmod($destinationFile, 0640);
in the file lib/Varien/File/Uploader....
- 1,309
22
votes
Security Patch SUPEE-7405 - Possible Problems?
When applying for Magento 1.7.0.0 its trying to remove a comment on app/design/adminhtml/default/default/template/authorizenet/directpost/iframe.phtml
-/* @var $_helper Mage_Authorizenet_Helper_Data ...
- 2,212
22
votes
Accepted
How to apply the Magento 2 patches?
Traditional
On Magento Cloud you just need to add the patch inside your m2-hotfixes folder.
You can use the traditional method:
git apply MAGEPatch-20181106.patch
or
patch -p1 < MDVA-14172_EE_2....
- 685
21
votes
Accepted
How can I tell if a corrupt image file is being used for credit card skimming?
For the specific answer to your question see, https://magento.stackexchange.com/a/72700/361
Background
Firstly, there is no specific exploit - there are a series of articles doing the rounds at the ...
- 17.6k
21
votes
How to check which modules are affected by security patch SUPEE-6788
Along the lines of other comments about detecting conflicts, we at ParadoxLabs have created a script to track down everything affected by APPSEC-1034 (admin controllers) and APPSEC-1057 (whitelist). ...
- 12.1k
21
votes
Security Patch SUPEE-11086 - Possible issues?
The biggest problem, which was found:
Mage::log() works incorrectly. If you call this function with custom log file (and it does not exist yet), log will not be written to the file, because of ...
- 375
Only top scored, non community-wiki answers of a minimum length are eligible