The Stack Overflow podcast is back! Listen to an interview with our new CEO.
129

As written here: If you use restricted admin accounts, some menus of third party extensions might not work anymore for them. The reason is that the default return value of Mage_Adminhtml_Controller_Action::_isAllowed() has been changed from true to Mage::getSingleton('admin/session')->isAllowed('admin'). Extensions that do not override this method in ...


36

As already mentioned, the patched vulnerabilities are described in detail on this official page (new merchant docs): http://merch.docs.magento.com/ce/user_guide/Magento_Community_Edition_User_Guide.html#magento/patch-releases-2015.html Summary This bundle includes protection against the following security-related issues: Customer Information Leak ...


7

Via @ http://blog.philwinkle.com/supee-6285-broken-down/ Generally this involves adding an _isAllowed protected method which returns a boolean. Sometimes this boolean is a result of an ACL check, as with the update to Adminhtml/controllers/Catalog/Category/WidgetController. Sometimes this is hard-coded to true, as with Adminhtml/controllers/...


7

For future reference, if patches can't be applied, check: Are you using the right patch version for your Magento version? Do the files that the patch fails to update present or have they been changed? Replace them with original files from your Magento version and apply the patch again


5

This is not an error. This is just a notification. You can go to the Messages inbox and "Mark as Read" . To check if the patch is successfully installed, go to the app/etc/ directory When patches are applied a file named applied.patches.list is added in the app/etc/ directory. Next to that the patch is nothing more than a diff file so you can see what ...


4

That's an easy one that I ran across on my first installation attempt on this patch. downloader/Maged/.htaccess already exists, the patch can't deal with it and reports an unsuccessful patch run. Simply delete downloader/Maged/.htaccess before running the SUPEE-6285 patch and it will run successfully and recreate the .htaccess file.


3

If you have a lot of community / local extensions you’re going to want to pay particular attention to this change in SUPEE-6285 which affects app/code/core/Mage/Adminhtml/Controller/Action.php and is around line 666 depending on your patch version (this is EE 1.14.0.1 patchfile): protected function _isAllowed() { - return true; + return ...


2

In my case for third party modules, adding below code to the adminhtml controllers worked: protected function _isAllowed() { return true; }


2

Patches aren't tolerant to inconsistent source files. If they in any way do not match what is expected (even from something as simple as a line break), it can cause the patch to be rejected. If you were already running 1.9.1.1, you'd probably be easier just grabbing a fresh 1.9.2.0 source and replacing your current source with it. The patches are pre-...


2

failed to open stream: Permission denied Try to set permissions as following for magento 1.5+ find . -type f -exec chmod 644 {} \; find . -type d -exec chmod 755 {} \; chmod o+w var var/.htaccess app/etc chmod 550 mage chmod -R o+w media


2

app/design/frontend/rwd/default/template/checkout/cart.phtml The SUPEE-6285 V2 Patch adds the quoteEscape() function to take care of the XSS issue. If you are running 1.9.2.0, it is already patched with SUPEE-5344, SUPEE-5994 and SUPEE-6285. The Continue Shopping button is escaped to prevent XSS as follows (as extracted from Magento 1.9.2.0 archive file): ...


2

There are two different patch files for 1.8.0.0 and 1.8.1.0, that means at least some of the files affected by the patch have been changed in between. That being said, you should find a way to apply the patch instead of downloading files from third party sites. For example, if you cannot get it done on your installation, download a fresh 1.8.0.0 Magento, ...


2

These notifications come from this RSS feed: http://notifications.magentocommerce.com/community/notifications.rss There is no additional logic behind them, so this message won't disappear after you applied the patch, only when you go to System > Notifications and mark it as read. If you saw the message "Patch has been applied successfully" after running ...


2

The error you see is not an error. It is a notification and Magento won't recognize if this patch has been installed. You can install it correctly and it will still show up. You can mark it as read or delete it by going to your messages inbox. Still these patches are rather important. You can check whether it was installed. In app/etc/applied.patches.list ...


2

You removed the default/modern theme but the patch tries to patch cart.phtml in this theme too. Solution: Add app/design/frontend/default/modern from a fresh Magento download (should be the same version as your shop). You can also use this mirror: https://github.com/firegento/magento. Then after applying the patch successfully you may remove the theme again....


2

The extensions are probably very outdated or at least follow deprecated coding style. Before Magento 1.4, there was no adminhtml.xml and the ACL and admin menus were configured in config.xml. This still works for backwards compatibility As you can see in Mage_Admin_Model_Config: /** * @deprecated after 1.4.0.0-alpha2 * support backwards ...


1

I can see you are using <sales> node, which might be playing the role for you. Sales is most cases used by magento. I don't know how whole adminhtml.xml looks like? But after looking at acl, Change these as follow: Controller class class Vtrio_OfflineOrders_Adminhtml_OrderController extends Mage_Adminhtml_Controller_Action { protected function ...


1

do you have the previous patches installed? If not, you will need to install them before SUPEE-6285. This is likely what is causing the problem. Alternatively, you can upgrade to 1.9.2 which includes SUPEE-5344, SUPEE-5994 and SUPEE-6285.


1

The patch failed because it couldn't modify the file. It looks like its a template so it is more than likely because it has been changed. Look at the patch file and find where the problem file is referenced and comment out that patch. Now run the patch file again it should apply. Now you should try and manually apply the patch lines to the template if they ...


1

Some reasons this would happen: You've downloaded the wrong version of the patch for your install Core Magento files have been modified You are patching an unsupported Magento version Can you confirm which one you downloaded? And what version of Magento are you currently running?


1

if app/design/frontend/rwd/default/template/checkout/cart.phtml doesn'T exist, get it: https://github.com/OpenMage/magento-mirror/blob/magento-1.9/app/design/frontend/rwd/default/template/checkout/cart.phtml Or even better, reinstall your magento. If this file is missing ,there are more missing files.


1

Update: this answer applies to Magento 1.9.1.1 and earlier, Magento 1.9.2.0 does not need any of the current patches (up to SUPEE-6285), which is also the reason for your error messages. You need to apply SUPEE-5994 first, because it patched the same file and it is the first patch that is not already contained in Magento 1.9.1.1


1

It seems the patch release page has been updated with info on what it affects. I have yet to install on a production site and test


Only top voted, non community-wiki answers of a minimum length are eligible