55

SUPEE-6788 released and admin routing changes turned off by default. This means that the patch include the fix, but that it will be disabled when installed. This will give you some additional time to make updates to your code and will give merchants flexibility to turn on this part of the patch once their extensions and customizations have been updated to ...


44

I managed to change my custom module to use the Magento new way as recommended with the patch 6788. So I give here as a reference for other, also answer the question in this thread. Change to router in the config.xml file: Before: <admin> <routers> <adminhello> <use>admin</use> <args> ...


39

For the sake of completeness, you can manually add blocks and variables to the white lists under System > Permissions > Variables and System > Permissions > Blocks. The codes you add there are in the form web/unsecure/base_url (config path) or rss/order_new (block class alias). Original answer My upgrade script looks like this: /* * Make sure the upgrade ...


33

In general, you can apply the patch as all previous ones. Have a look at the official documentation and check this SE post. But yes, there are some additional points you should check when applying this patch. Byte/Hypernode has a nice post about it. Check if your theme has a custom template/customer/form/register.phtml or custom template/persistent/customer/...


21

Along the lines of other comments about detecting conflicts, we at ParadoxLabs have created a script to track down everything affected by APPSEC-1034 (admin controllers) and APPSEC-1057 (whitelist). It will also attempt to fix any bad controllers, since that's a fairly precise and invasive change to make. It doesn't cover APPSEC-1063 (SQL injection) or ...


21

The patch adds a new form key to app/design/frontend/base/default/template/customer/form/register.phtml and to app/design/frontend/base/default/template/persistent/customer/form/register.phtml If your theme overrides these, simply add - <?php echo $this->getBlockHtml('formkey'); ?> right after this line - <form action="<?php echo $...


17

I lost hours figuring this out. Just because the Devs at Magento aren't capable of making an understandable configuration, or yet even documenting their code in a way a human being would be able to read it. Let's have a look at the config.xml first <routers> <adminhtml> <args> <modules> <admin_adminhello ...


16

You can add them manually in the Magento backend under System > Permissions > Variables and System > Permissions > Blocks once Magento 1.9.2.2 is installed. Plugins that use custom variables of blocks will need to add a data upgrade script with code similar as shown below. if (Mage::getModel('admin/block')) { $installer = $this; $installer->...


15

It appears that changes to my .htaccess as well as a missing .htaccess.sample are the culprit. After restoring a stock copy of both files (both were required) the patch appears to apply successfully. To solve this, without losing (needed) modifications, I followed these steps: Create a backup of .htaccess and .htaccess.sample–either with your ...


12

I think it's pretty easy to lull yourself into a false sense of security whith this. Admin routing compatibility mode for extensions: Enabled (=Default) This is the default setting after applying the patch. Your extensions won't break with this setting. Security is limited though. Admin routing compatibility mode for extensions: Disabled Only with a ...


10

I guess the problem is that you have also rewritten the customer/form/register.phtml file in your template. Those templates have been changed by SUPEE-6788. app/design/frontend/base/default/template/customer/form/register.phtml app/design/frontend/base/default/template/customer/form/resetforgottenpassword.phtml app/design/frontend/base/default/template/...


10

Did you whitelist the blocks and vars in the backend? Try to know which block to whitelist by printing debug information in app/code/core/Mage/Core/Model/Email/Template/Filter.php If not try the following: Download https://raw.githubusercontent.com/rhoerr/supee-6788-toolbox/master/fixSUPEE6788.php to magentoroot/shell/ directory Change into magentoroot/...


8

Here's an analysis/fix tool for extension and customization conflicts resulting from the Magento SUPEE-6788 patch. https://github.com/rhoerr/supee-6788-toolbox Note: Before applying any patch or patch fix, it is always recommended to make backup of your website and database. You can only analyze what need to fixed. To analyze: Run from SSH: php -f ...


7

Answered in comments. You will need to clear the cache a reload the homepage in order for magento's update scripts to be called. Alternatively you can download N98-magerun and run the sys:setup:run command to run the updates.


7

app/design/adminhtml/default/default/layout/admin.xml This error is generated when layout cache hasn't been updated or admin.xml is missing the following code. <!-- admin permissions block edit page --> <adminhtml_permissions_block_edit> <reference name="content"> <block type="adminhtml/permissions_block_edit" name="...


6

First of all, these messages stand apart from whether or not you need it or you already applied it. Second: You do need to patch your Magento CE 1.4.x.x The security issues also affect this version. The problem is that Magento does not supply patches for these older versions as they are no longer in "official" support. You should either upgrade your ...


6

I had the same problem and this solution saved my day! Go to: app/design/frontend/base/default/template/customer/form/register.phtml and app/design/frontend/base/default/template/persistent/customer/form/register.phtml Add this line of code: <?php echo $this->getBlockHtml('formkey'); ?> after <form action="<?php echo $this->...


6

There is a check file which helps you to identify issues: https://github.com/gaiterjones/magento-appsec-file-check I made a CLI script out of it. https://github.com/Schrank/magento-appsec-file-check


5

I would recommend using the https://github.com/rhoerr/supee-6788-toolbox tool from Paradox Labs. It scans your codebase for each of the issues listed in your question.


5

You can find there are new tables after SUPEE-6788 patch has been installed permission_variable permission_block And you can add some config variables or blocks to these whitelist tables.


5

This php script might be useful in identifying Magento code affected by the proposed SUPEE-6788 patch. This is in no way a foolproof security check for this patch, but might be useful to quickly scan your installation for the modules and code affected. Install the script with wget https://raw.githubusercontent.com/gaiterjones/magento-appsec-file-check/...


5

You probably set up your cronjob to call cron.php via HTTP, which is now forbidden by default. This is the new rule in .htaccess: ########################################### ## Deny access to cron.php <Files cron.php> ############################################ ## uncomment next lines to enable cron access with base HTTP authorization ## http://...


5

This means patch's 'admin_setup' update script was executed before and somehow it was overwritten at core_resource table, so Magento trying to run it again but getting exception, thrown initially by Mysql as tables that this upgrade script trying to create is already there. I'd follow below steps to fix it: Check app/code/core/Mage/Admin/sql/admin_setup/...


5

I just had the same and found out by debugging that there was an invalid rewrite for the layout model Mage_Core_Model_Layout. In fact, I had an incomplete install of Inchoo_PHP7 where the config.xml file was in place but the class Inchoo_PHP7_Model_Layout which was given as a rewrite was not. Thus, the solution was to add the full module Inchoo_PHP7 module (...


5

If you check the Filter.php file after applying 6788 patch, you will find it is adding below bit of code. if ($this->_permissionBlock->isTypeAllowed($blockParameters['type'])) { $type = $blockParameters['type']; $block = $layout->createBlock($type, null, $blockParameters); } This $this->_permissionBlock is object of Mage::getModel('admin/...


5

To fix this: Download the latest version of Magento (currently v1.9.3.0) and replace the downloader/Maged/View.php file with the one from the latest release. Then remove this function (around line: 156): /** * Retrieve Session Form Key * * @return string */ public function getFormKey() { return $this->controller()->getFormKey();...


4

There is already a big list available with all the extensions that will break with SUPEE-6788 More info here: https://docs.google.com/spreadsheets/d/1LHJL6D6xm3vD349DJsDF88FBI_6PZvx_u3FioC_1-rg/edit#gid=0


4

I tried downloading stock versions of .htaccess and .htaccess.sample and the patch still would not apply even after using the stock versions. For anyone else experiencing this problem take a look at this article it explains how to remove the .htaccess and htaccess.sample parts from the patch itself then manually add them in after: http://www.atwix.com/...


4

The tables should be created as part of the upgrade of Mage_Admin from version 1.6.1.1 to 1.6.1.2. You can verify that the setup/upgrade scripts succeeded by checking the version and data_version fields in the core_resource table: select * from core_resource where code = 'admin_setup'; Both values should show version 1.6.1.2, if either of them do not have ...


4

Try the solution posted on this answer. The patch is sensitive to changes in .htaccess files, and also requires all previous security patches to have been applied.


Only top voted, non community-wiki answers of a minimum length are eligible