157

23rd February 2016 Update: The patch has been updated to V1.1, which fixes a number of important issues listed in this post, here is the list: Cart Merge Patch (SUPEE-7978) : Carts with identical items now merge correctly. Previously, when a cart with one item was merged with another cart that contained the same item, Magento did not merge the cart totals ...


35

One issue I have noticed is that if your site is using a version less than PHP 5.4 the patch is not compatible. In the class Mage_Adminhtml_Helper_Sales around line number 124. The code is: $links = []; I needed to extend this to be: // Patch not compatible with PHP version 5.3: overwrote Magento patch update $links = array(); Another ...


35

Applying patches manually with no SSH access You have a good point here. The patches are supplied as .sh files and there is no solution offered by Magento for FTP only websites. I suggest one would copy his website's code to a local environment through FTP (you would probably have that already). Then apply the patch by running the .sh file. Now you need ...


24

Unfortunately, there's no 'easy' way to install these patches without shell access, but there's two ways to do it. Install patch through PHP Use an FTP client to upload the specific patch to the root of your Magento folder. Create a PHP file called applypatch.php that will run the patch for you, and upload it to the root of your Magento folder. Make sure ...


22

Here's a problem I've found when patching Magento CE with SUPEE-7405. It replaces the line: chmod($destinationFile, 0777); with: chmod($destinationFile, 0640); in the file lib/Varien/File/Uploader.php This stopped my images displaying in the back end, since this file permission should actually be 644. Is there any reason this has been set to 640?


21

When applying for Magento 1.7.0.0 its trying to remove a comment on app/design/adminhtml/default/default/template/authorizenet/directpost/iframe.phtml -/* @var $_helper Mage_Authorizenet_Helper_Data */ 1.7.0.0 - https://raw.githubusercontent.com/OpenMage/magento-mirror/1.7.0.0/app/design/adminhtml/default/default/template/authorizenet/directpost/iframe....


19

these files patched, you can see any possible impact: template: admin templates mostly patched. +++ app/design/frontend/base/default/template/rss/order/details.phtml +++ app/design/frontend/base/default/template/catalog/product/view/options/type/file.phtml +++ app/design/adminhtml/default/default/template/sales/order/view/info.phtml +++ app/design/...


16

23rd February 2016 Edit Magento has released a v1.1 of the patch that addresses that particular issue, I've updated the hacky fix below so it reflects the official fix but I suggest you apply the v1.1 of the patch SUPEE-7405 to fix that issue. 25th January 2016 Bug fix After digging into the bug, I've made a hacky fix for this particular issue: Copy the ...


14

Here is my basic test plan: Apply coupon Login to admin Force admin to change password Export a CSV Import a CSV Reset password as admin and customer Create an order in admin Create and order in the front-end as guest Create and order in the front-end as customer Add an image to a product Create a credit memo Create an invoice


11

To me it looks like the patch was not installed properly. The validateFormKey function is included in the patch. Open the app/code/core/Mage/Core/Model/Session.php file and double check if the validateFormKey function is here If the file is overridden in app/code/local/Mage/Core/Model/Session.php, you have to add the new methods validateFormKey and ...


10

Please be aware of dropped sessions issue recently discovered and fixed (?) by Colin Mollenhour. https://gist.github.com/colinmollenhour/5066a3220881a9c0c2dd42fa1593cbff/revisions


9

If you updated from Magento EE 1.14.2.x to Magento EE 1.14.2.3 instead of applying the patch, and also applied the support patch SUPEE-5984 before, you have to reapply it again because it is not included in the release. This was the patch that fixed the broken indexer: Index error after upgrade to EE 1.14.2.0: table catalog_product_entity_tmp_indexer doesn&#...


9

You need to apply SUPEE-6788 first :)


8

Screenshot for admin order details page, If showing this type issue, Please follow below instruction its working for me !! Solution Change line 124 in app/code/core/Mage/Adminhtml/Helper/Sales.php from $links = []; to $links = array();


8

As of Feb 23 2016, Magento have released a patch for the patch to address many of these problems: https://magento.com/security/patches/supee-7405 You need to apply SUPEE_7405_v1 then SUPEE_7405_v1.1 in order.


7

Whenever we install a patch for one of our clients we use the following checklist: Make a complete backup of the site files & database. Make sure all previous patches have been installed successfully (can be seen in app/etc/applied.patches.list file) After successful installation of the patch, clear the cache and make a test order to ensure everything ...


7

The Nexcess_Turpentine module overrides app/code/core/Mage/Core/Model/Session.php as app/code/local/Mage/Core/Model/Session.php. We just ran into this. This is very likely your issue. To appease this patch without spending excessive time on it, I think the most appropriate solution is to add the patch changes to the local override file. Turpentine overrides ...


7

TL;DR   No, it's not the same. It patches v1.0 to not break stuff If you had no issues with applying SUPEE-7405 causing any of the following issues, you are probably OK. You go to the Sales Order grid, select a Sales Order to view and the page comes up blank. Images uploaded for wysiwyg, categories, etc do not show until the file permissions are ...


7

So basically, the updated version of the patch fixes some of the issues it brought (see details here: Security Patch SUPEE-7405 - possible problems?) The SUPEE-7405 v 1.1 patch bundle includes the following: Cart Merge Patch (SUPEE-7978) Carts with identical items now merge correctly. Previously, when a cart with one item was merged with ...


6

It looks like the website isn't patched for SUPEE 5344. This means that new code snippets such as `$request->setInternallyForwarded()' don't exist in the Observer.php and are making the line numbering incorrect.


6

here affected files for Magento EE > -e 2016-02-11 03:14:54 UTC | SUPEE-7405-EE-1-14-2-2 | EE_1.14.2.2 | v1 | 91465c744a824111902e2911fd63fd8cb6c32f05 | Tue Jan 19 14:27:03 2016 +0200 | e1fc3c59c9..91465c744a patching file app/code/core/Enterprise/Checkout/Block/Adminhtml/Manage/Form/Coupon.php patching file app/code/core/Enterprise/...


6

You'll need to make sure the following previous patches have been applied previously in the following order: SUPEE-5994 SUPEE-6285 SUPEE-6788 SUPEE-7405 I've just test the order on on a clean version of 1.9.1.1 and it all runs successfully.


6

The patches are meant to be applied on older versions to only fix specific issues without updating Magento. As such, they do not increase the version number. If you are already on the latest version you can update Magento with a patch release like 1.9.2.4 instead of applying the patch with the shell script. The difference is: an update replaces all core ...


5

I got following error after installing the SUPEE-7405 patch when try to login to admin. Fatal error: Call to undefined method Mage_Core_Controller_Response_Http::sendHeadersAndExit() in \app\code\core\Mage\Admin\Model\Session.php on line 135 because I had this file overridden in local code pool which does not have sendHeadersAndExit method created ...


5

After applying the SUPEE-7405 on Magento 1.14.1.0 I got the error: Fatal error: Cannot redeclare Mage_Core_Controller_Varien_Router_Admin::_validateControllerInstance() in app/code/core/Mage/Core/Controller/Varien/Router/Admin.php on line 173 The problem was caused by re-declared method _validateControllerInstance in app/code/core/Mage/Core/Controller/...


5

As it was already mentioned here: SUPEE-7504 is a patch bundle for Magento 1.X. Next to this, also the Magento Community Edition 1.9.2.3 and Enterprise Edition 1.14.2.3 were released, as well as the Community and Enterprise Edition 2.0.1. Some of the issues that were fixed for 1.X got also fixed for 2.X: Guest order view protection code vulnerable to ...


5

For anyone wondering, the fix for this exploit was in app/design/adminhtml/default/default/template/sales/order/view/info.phtml and that template was being overridden by cart2quote. Anyone using cart2quote on their magento site should be aware that they are still vulnerable to APPSEC-1213 even after installing SUPEE-7405


5

The easiest way to find out what files are affected in a patch is to take a programmer's text editor like TextPad, sort the lines in the patch and extract all the +++ app/ +++ lib/ and other obvious file path names. A sampling of SUPEE-7405 as follows: +++ app/code/core/Mage/Admin/Model/Observer.php +++ app/code/core/Mage/Admin/Model/Redirectpolicy.php +++ ...


5

The SUPEE-7405 patch is already included in Magento 1.9.2.3. Magento has even released this version so that their latest downloadable version always contains all the necessary patches. Also noted on the Magento download page (select "Release Archive"): The patch addresses different security issues. Your site is no longer vulnerable to these issues. You can ...


4

Magento 1.9.2.3 has already been released here: https://www.magentocommerce.com/download It includes the following patches: SUPEE-5344 SUPEE-5994 SUPEE-6237 SUPEE-6285 SUPEE-6482 SUPEE-6788 SUPEE-7616 SUPEE-7405 So it's your choice either to patch or to upgrade to 1.9.2.3.


Only top voted, non community-wiki answers of a minimum length are eligible