Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more
109 votes

Security Patch SUPEE-8788 - Possible Problems?

Important notes Please note that 1.9.3 is different than 1.9.2.4 + SUPEE-8788. Here's the diff between the two: https://gist.github.com/digitalpianism/14a15cd52baede0e5d600e8c653f33e9 Update October ...
Raphael at Digital Pianism's user avatar
109 votes
Accepted

Security Patch SUPEE-9767 - Possible issues?

Here's my overview of the patch after digging into it TIME SAVER : Experius provides a patch helper that helps you finding the files in custom themes, custom modules or local overwrites that also ...
Raphael at Digital Pianism's user avatar
57 votes

Magento 2: template security: which method to use?

The escaping methods in AbstractBlock all delegate calls to Magento\Framework\Escaper, so you'll find an overview there. Let's look at the public methods and their documentation: escapeHtml() /** *...
Fabian Schmengler's user avatar
44 votes

Security Patch SUPEE-9767 - Possible issues?

Issue1: form_key invalid at checkout onepage Magento add form_key at most of the forms. if you have using default onepage and using custom theme, then you will start getting **form_key issue at ...
Amit Bera's user avatar
  • 77.5k
36 votes
Accepted

SUPEE-9767 Patch/CE 1.9.3.3 - One Page Checkout - Customer Registration issue

Ok here's the real bug fix I came up with. Edit /skin/frontend/base/default/js/opcheckout.js and edit the setMethod() method by replacing: setMethod: function(){ if ($('login:guest') && ...
Raphael at Digital Pianism's user avatar
31 votes
Accepted

Security Patch SUPEE-10570 - Possible issues?

Here is the list of modified files by the SUPEE-10570 patch: app/Mage.php app/code/core/Mage/Admin/Helper/Data.php app/code/core/Mage/Admin/Model/Block.php app/code/core/Mage/Admin/Model/Resource/...
DarkCowboy's user avatar
30 votes

Security Patch SUPEE-8788 - Possible Problems?

When applying the patch this error can happen: checking file skin/adminhtml/default/default/media/flex.swf checking file skin/adminhtml/default/default/media/uploader.swf checking file skin/adminhtml/...
infabo's user avatar
  • 648
28 votes

Security Patch SUPEE-9767 - Possible issues?

Based on my first pass at review of the patch file... A new setting admin/security/validate_formkey_checkout has been added. When turned on, checkout forms are checked for presence of a form key. If ...
mpchadwick's user avatar
  • 1,234
27 votes
Accepted

Security Patch SUPEE-8788 - Possible Problems?

Here's a summary of what I (and others) encountered so far, I'm trying to keep it sorted, feel free to add or link anything that's missing, the post is a Community Wiki: Reasons for failed patch If ...
26 votes

Security Patch SUPEE-8788 - Possible Problems?

If you've previously applied SUPEE-1533 then the patch will fail on app/code/core/Mage/Adminhtml/controllers/DashboardController.php. I solved this by... Manually revert the changes introduced to ...
mpchadwick's user avatar
  • 1,234
26 votes

Security Patch SUPEE-10415 - Possible Issues?

The below files are updated/added after applied patch SUPEE - 10415. app/Mage.php app/code/core/Mage/Adminhtml/Block/Report/Review/Detail.php app/code/core/Mage/Adminhtml/Block/Report/Tag/Product/...
Rama Chandran M's user avatar
26 votes

Magento 2.3.5-p1 CSP font-src self unsafe-inline

Magento 2.3.5 p1 added a new module module-csp ( Magento_Csp ) which supports Content Security Policies ( CSP ) headers and provides ways to configure them. The policies can be configured for backend ...
Suman Pradhan's user avatar
25 votes
Accepted

SecurityPatch 9652: Possible problems after SUPEE-9652 applied

It's a super tiny patch, here's the diff: diff --git lib/Zend/Mail/Transport/Sendmail.php lib/Zend/Mail/Transport/Sendmail.php index b24026b..9323f58 100644 --- lib/Zend/Mail/Transport/Sendmail.php ++...
Raphael at Digital Pianism's user avatar
24 votes

Security Patch SUPEE-8788 - Possible Problems?

If you get Call to undefined function hash_equals() error even if your patch was successful then it may mean that you have copied functions.php in app/code/local/Mage/Core. You will have to ...
Claudiu Creanga's user avatar
24 votes
Accepted

How to apply the Magento 2 patches?

Traditional On Magento Cloud you just need to add the patch inside your m2-hotfixes folder. You can use the traditional method: git apply MAGEPatch-20181106.patch or patch -p1 < MDVA-14172_EE_2....
Joshua Fricke's user avatar
21 votes

Security Patch SUPEE-11086 - Possible issues?

The biggest problem, which was found: Mage::log() works incorrectly. If you call this function with custom log file (and it does not exist yet), log will not be written to the file, because of ...
Aswerer's user avatar
  • 375
19 votes

Security Patch SUPEE-10752 - Possible issues?

As Mentioned by Official Docs By Magento: Conflicts during installation of the patch SUPEE-10752 are caused most often by having version 1 of the previous patch installed (SUPEE-10570v1). Please ...
Meetanshi's user avatar
  • 979
18 votes

Security Patch SUPEE-8788 - Possible Problems?

In PATCH_SUPEE-8788_EE_1.14.2.0_v1-2016-10-10-02-27-03.sh, a file test_oauth.php is created in the Magento root directory. You will want to delete this one (or at least not deploy it to production) ...
Matthias Zeis's user avatar
18 votes

Security Patch SUPEE-8788 - Possible Problems?

THIS APPLIES FOR 1.7 MAGENTO VERSIONS If you are running 1.7.0.2 version 2 of SUPEE 8788 will fail on line 372 trying to apply changes to Curl.php: patching file downloader/lib/Mage/HTTP/Client/Curl....
Icon's user avatar
  • 2,439
18 votes
Accepted

Magento 2: template security: which method to use?

This is for Magento 2.0. For 2.1, refer to Fabian's answer escapeHtml Use this function in the case of a string output that should not contain HTML. Example: <span class='label'><?php ...
Raphael at Digital Pianism's user avatar
18 votes
Accepted

SUPEE-9767 V2 Possible problems and solved Issues

SUPEE-9767 V2 released July 12th 2017 addresses bugs and issues identified by the community following the release of version 1 of the SUPEE-9767 security update (Magento CE 1.9.3.3) on May 31st 2017. ...
paj's user avatar
  • 5,874
16 votes

Newsletter Spam Subscriber

You can use newsletter subscription confirmation feature in Magento. Enable this from: admin-login >> System >> Configuration >> Customer >> Newsletter >> select Yes from Need to confirm drop-...
Nits's user avatar
  • 2,506
16 votes

Security Patch SUPEE-9767 - Possible issues?

Below base/default file affected with this patch, if this files were in your theme then please make changes accordingly app/design/frontend/base/default/template/checkout/cart/shipping.phtml app/...
Murtuza Zabuawala's user avatar
16 votes
Accepted

Sanitizing HTML output in templates in 2.4

In 2.4 simply calling $escaper->escapeHtml() works. $escaper is an instance of Magento\Framework\Escaper sent directly to the template in the same way as $block is an instance of the current block ...
Marius's user avatar
  • 198k
15 votes

Security Patch SUPEE-8788 - Possible Problems?

Original DashboardController.php (1.7.0.2- Not pached, Fresh from magento) if ($params = unserialize(base64_decode(urldecode($gaData)))) { 1533 Patched DashboardController.php contains the ...
Icon's user avatar
  • 2,439
15 votes

SUPEE-9767 Patch/CE 1.9.3.3 - One Page Checkout - Customer Registration issue

When you select register and continue, the JS script calls checkout.setMethod(), which is located in skin/frontend/base/default/js/opcheckout.js. From there we can see it makes an AJAX POST request to ...
Peter O'Callaghan's user avatar
14 votes

Security Patch SUPEE-8788 - Possible Problems?

Half tempted to flag this post as primarily opinion based or without a clear answer ;) Form keys have been added to a couple of controllers, the number varies depending on your magento version. If ...
Luke Rodgers's user avatar
  • 4,452
13 votes

Security Patch SUPEE-10266 - Possible issues?

Some of the important information share with here.Most of the files from Magento backend. The file lists: app/code/core/Mage/Admin/Model/Session.php app/code/core/Mage/Adminhtml/Block/Notification/...
Rama Chandran M's user avatar
12 votes

Security Patch SUPEE-10415 - Possible Issues?

SUPEE 10415 Requires 8788 v2 patch I encountered the same error as a previous post but it seems to have been removed. a:5:{i:0;s:23:"Unsupported data type N";i:1;s:2942:"#0 /chroot/home/mywebroot/...
danmentzer's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible