157

23rd February 2016 Update: The patch has been updated to V1.1, which fixes a number of important issues listed in this post, here is the list: Cart Merge Patch (SUPEE-7978) : Carts with identical items now merge correctly. Previously, when a cart with one item was merged with another cart that contained the same item, Magento did not merge the cart totals ...


129

As written here: If you use restricted admin accounts, some menus of third party extensions might not work anymore for them. The reason is that the default return value of Mage_Adminhtml_Controller_Action::_isAllowed() has been changed from true to Mage::getSingleton('admin/session')->isAllowed('admin'). Extensions that do not override this method in ...


108

Here's my overview of the patch after digging into it TIME SAVER : Experius provides a patch helper that helps you finding the files in custom themes, custom modules or local overwrites that also might need to be patched manually, you can find it here: https://github.com/experius/Magento-1-Experius-Patch-Helper#magento Checkout form keys As said in the ...


107

Important notes Please note that 1.9.3 is different than 1.9.2.4 + SUPEE-8788. Here's the diff between the two: https://gist.github.com/digitalpianism/14a15cd52baede0e5d600e8c653f33e9 Update October 14th: v2 of the patch has been released (see below) As of October 13th, the patches for 1.5.x to 1.8.x have been taken down from the Magento website because of ...


66

I'm assuming you do have FTP access. When patches are applied a file named applied.patches.list is added in the app/etc/ directory. Next to that the patch is nothing more than a diff file so you can see what it should change when you open it and check in the targeted file if it is indeed changed


55

SUPEE-6788 released and admin routing changes turned off by default. This means that the patch include the fix, but that it will be disabled when installed. This will give you some additional time to make updates to your code and will give merchants flexibility to turn on this part of the patch once their extensions and customizations have been updated to ...


43

Issue1: form_key invalid at checkout onepage Magento add form_key at most of the forms. if you have using default onepage and using custom theme, then you will start getting **form_key issue at checkout each step **; you should add form key at <?php echo $this->getBlockHtml('formkey') ?> to form of each checkout step files if below files ...


40

Symlinks aren't necessarily bad. First of all: If trying to open a symlink target, the file permissions of the target are in effect. If you're not allowed to read/write/execute the symlink target, nothing happens. But: You might be able to run files outside your document root (sometimes that's actually what you want to do with them, right?). The problem ...


39

From my experience, these are important things to get information about when taking over a new shop from a security point of view. This list is not ordered & complete yet, I will continue to work on the list. Magento Security HTTPS used (all over the shop, only for checkout)? Custom Admin Path? Access to admin path restricted? How many Admins? Any ...


36

As already mentioned, the patched vulnerabilities are described in detail on this official page (new merchant docs): http://merch.docs.magento.com/ce/user_guide/Magento_Community_Edition_User_Guide.html#magento/patch-releases-2015.html Summary This bundle includes protection against the following security-related issues: Customer Information Leak ...


36

Ok here's the real bug fix I came up with. Edit /skin/frontend/base/default/js/opcheckout.js and edit the setMethod() method by replacing: setMethod: function(){ if ($('login:guest') && $('login:guest').checked) { this.method = 'guest'; new Ajax.Request( this.saveMethodUrl, {method: 'post', onFailure: ...


35

Just put a .htaccess (or if nginx/whatever a config) into the downloader directory with Disallow from all in it to forbid any request on the directory. If you wanted to allow a few IP addresses in (like your own), try something like this in your .htaccess order deny,allow deny from all allow from 1.2.3.4 5.6.7.8 Where 1.2.3.4 and 5.6.7.8 are IP ...


35

Applying patches manually with no SSH access You have a good point here. The patches are supplied as .sh files and there is no solution offered by Magento for FTP only websites. I suggest one would copy his website's code to a local environment through FTP (you would probably have that already). Then apply the patch by running the .sh file. Now you need ...


35

One issue I have noticed is that if your site is using a version less than PHP 5.4 the patch is not compatible. In the class Mage_Adminhtml_Helper_Sales around line number 124. The code is: $links = []; I needed to extend this to be: // Patch not compatible with PHP version 5.3: overwrote Magento patch update $links = array(); Another ...


35

The escaping methods in AbstractBlock all delegate calls to Magento\Framework\Escaper, so you'll find an overview there. Let's look at the public methods and their documentation: escapeHtml() /** * Escape string for HTML context. allowedTags will not be escaped, except the following: script, img, embed, * iframe, video, source, object, audio * * @...


33

There are several helper method depending on the context. All are defined in Mage_Core_Helper_Abstract but also in Mage_Core_Block_Abstract, so you can use them with $this->...() in every template: escapeHtml(): It actually leverages htmlspecialchars with the recommended parameters to escape HTML: $result = htmlspecialchars($result, ENT_COMPAT, 'UTF-8', ...


33

In general, you can apply the patch as all previous ones. Have a look at the official documentation and check this SE post. But yes, there are some additional points you should check when applying this patch. Byte/Hypernode has a nice post about it. Check if your theme has a custom template/customer/form/register.phtml or custom template/persistent/customer/...


32

Is it good practice (from a security standpoint) to send a customer the password they provided during registration via email? No, it is most definitely not! Do we frequently change this for clients? No. Unfortunately we do not. We probably should, but it's typically one of the lowest items on the worry list. In the past 5 years, I only recall a single ...


29

When applying the patch this error can happen: checking file skin/adminhtml/default/default/media/flex.swf checking file skin/adminhtml/default/default/media/uploader.swf checking file skin/adminhtml/default/default/media/uploaderSingle.swf Reversed (or previously applied) patch detected! Assume -R? [n] Apply anyway? [n] Skipping patch. 1 out of 1 hunk ...


29

Here is the list of modified files by the SUPEE-10570 patch: app/Mage.php app/code/core/Mage/Admin/Helper/Data.php app/code/core/Mage/Admin/Model/Block.php app/code/core/Mage/Admin/Model/Resource/Block.php app/code/core/Mage/Admin/Model/User.php app/code/core/Mage/Adminhtml/Block/Catalog/Category/Edit/Form.php app/code/core/Mage/Adminhtml/Block/Catalog/...


27

Based on my first pass at review of the patch file... A new setting admin/security/validate_formkey_checkout has been added. When turned on, checkout forms are checked for presence of a form key. If the template files are overriden in the theme they'll need to be updated there. This setting seems to be off by default Symlinks seem to be disallowed by ...


26

The below files are updated/added after applied patch SUPEE - 10415. app/Mage.php app/code/core/Mage/Adminhtml/Block/Report/Review/Detail.php app/code/core/Mage/Adminhtml/Block/Report/Tag/Product/Detail.php app/code/core/Mage/Adminhtml/Block/Review/Add.php app/code/core/Mage/Adminhtml/Block/Review/Edit/Form.php app/code/core/Mage/Adminhtml/Controller/Action....


25

If you've previously applied SUPEE-1533 then the patch will fail on app/code/core/Mage/Adminhtml/controllers/DashboardController.php. I solved this by... Manually revert the changes introduced to that file by SUPEE-1533 Apply SUPEE-8788 Manually reintroduce the changes introduced to that file by SUPEE-1533 Removing the change from the SUPEE-8788 is ...


25

Here's a summary of what I (and others) encountered so far, I'm trying to keep it sorted, feel free to add or link anything that's missing, the post is a Community Wiki: Reasons for failed patch If you see "ERROR: Patch can't be applied/reverted successfully", look for "Hunk #1 FAILED" in the log messages to check at which file the patch failed. ...


25

It's a super tiny patch, here's the diff: diff --git lib/Zend/Mail/Transport/Sendmail.php lib/Zend/Mail/Transport/Sendmail.php index b24026b..9323f58 100644 --- lib/Zend/Mail/Transport/Sendmail.php +++ lib/Zend/Mail/Transport/Sendmail.php @@ -119,14 +119,19 @@ class Zend_Mail_Transport_Sendmail extends Zend_Mail_Transport_Abstract ); ...


24

Unfortunately, there's no 'easy' way to install these patches without shell access, but there's two ways to do it. Install patch through PHP Use an FTP client to upload the specific patch to the root of your Magento folder. Create a PHP file called applypatch.php that will run the patch for you, and upload it to the root of your Magento folder. Make sure ...


23

If you get Call to undefined function hash_equals() error even if your patch was successful then it may mean that you have copied functions.php in app/code/local/Mage/Core. You will have to insert that function there too because that file overwrites the core one. So insert in app/code/local/Mage/Core/functions.php at the end: if (!function_exists('...


22

Here's a problem I've found when patching Magento CE with SUPEE-7405. It replaces the line: chmod($destinationFile, 0777); with: chmod($destinationFile, 0640); in the file lib/Varien/File/Uploader.php This stopped my images displaying in the back end, since this file permission should actually be 644. Is there any reason this has been set to 640?


21

Just translate it You should always be using the standard translate function In a block instance <?php echo $this->__('Text goes here'); ?> Anywhere else <?php echo Mage::helper('core')->__('Text goes here'); ?> And use it the same way you would use sprintf with PHP Eg. <?php $foo = 'rocks'; ?> <?php echo $this->__('...


21

For the specific answer to your question see, https://magento.stackexchange.com/a/72700/361 Background Firstly, there is no specific exploit - there are a series of articles doing the rounds at the moment that have misread and misunderstood the source article. The original article merely said (and I'm paraphrasing), If a hacker were able to get access ...


Only top voted, non community-wiki answers of a minimum length are eligible