23rd February 2016 Update: The patch has been updated to V1.1, which fixes a number of important issues listed in this post, here is the list:
Cart Merge Patch (SUPEE-7978) : Carts with identical items now merge correctly. Previously, when a cart with one item was merged with another cart that contained the same item, Magento did not merge the cart totals ...
One issue I have noticed is that if your site is using a version less than PHP 5.4 the patch is not compatible.
In the class Mage_Adminhtml_Helper_Sales around line number 124. The code is:
$links = ;
I needed to extend this to be:
// Patch not compatible with PHP version 5.3: overwrote Magento patch update
$links = array();
Applying patches manually with no SSH access
You have a good point here. The patches are supplied as .sh files and there is no solution offered by Magento for FTP only websites.
I suggest one would copy his website's code to a local environment through FTP (you would probably have that already). Then apply the patch by running the .sh file.
Now you need ...
Unfortunately, there's no 'easy' way to install these patches without shell access, but there's two ways to do it.
Install patch through PHP
Use an FTP client to upload the specific patch to the root of your Magento folder.
Create a PHP file called applypatch.php that will run the patch for you, and upload it to the root of your Magento folder. Make sure ...
Here's a problem I've found when patching Magento CE with SUPEE-7405. It replaces the line:
in the file lib/Varien/File/Uploader.php
This stopped my images displaying in the back end, since this file permission should actually be 644. Is there any reason this has been set to 640?
When applying for Magento 18.104.22.168 its trying to remove a comment on app/design/adminhtml/default/default/template/authorizenet/directpost/iframe.phtml
-/* @var $_helper Mage_Authorizenet_Helper_Data */
22.214.171.124 - https://raw.githubusercontent.com/OpenMage/magento-mirror/126.96.36.199/app/design/adminhtml/default/default/template/authorizenet/directpost/iframe....
these files patched, you can see any possible impact:
template: admin templates mostly patched.
23rd February 2016 Edit
Magento has released a v1.1 of the patch that addresses that particular issue, I've updated the hacky fix below so it reflects the official fix but I suggest you apply the v1.1 of the patch SUPEE-7405 to fix that issue.
25th January 2016 Bug fix
After digging into the bug, I've made a hacky fix for this particular issue:
Copy the ...
Here is my basic test plan:
Login to admin
Force admin to change password
Export a CSV
Import a CSV
Reset password as admin and customer
Create an order in admin
Create and order in the front-end as guest
Create and order in the front-end as customer
Add an image to a product
Create a credit memo
Create an invoice
To me it looks like the patch was not installed properly.
The validateFormKey function is included in the patch.
Open the app/code/core/Mage/Core/Model/Session.php file and double check if the validateFormKey function is here
If the file is overridden in app/code/local/Mage/Core/Model/Session.php, you have to add the new methods validateFormKey and ...
If you updated from Magento EE 1.14.2.x to Magento EE 188.8.131.52 instead of applying the patch, and also applied the support patch SUPEE-5984 before, you have to reapply it again because it is not included in the release.
This was the patch that fixed the broken indexer: Index error after upgrade to EE 184.108.40.206: table catalog_product_entity_tmp_indexer doesn...
Screenshot for admin order details page, If showing this type issue, Please follow below instruction its working for me !!
Change line 124 in app/code/core/Mage/Adminhtml/Helper/Sales.php from $links = ; to $links = array();
As of Feb 23 2016, Magento have released a patch for the patch to address many of these problems: https://magento.com/security/patches/supee-7405
You need to apply SUPEE_7405_v1 then SUPEE_7405_v1.1 in order.
Whenever we install a patch for one of our clients we use the following checklist:
Make a complete backup of the site files & database.
Make sure all previous patches have been installed successfully (can be seen in app/etc/applied.patches.list file)
After successful installation of the patch, clear the cache and make a test order to ensure everything ...
The Nexcess_Turpentine module overrides app/code/core/Mage/Core/Model/Session.php as app/code/local/Mage/Core/Model/Session.php. We just ran into this. This is very likely your issue. To appease this patch without spending excessive time on it, I think the most appropriate solution is to add the patch changes to the local override file. Turpentine overrides ...
TL;DR No, it's not the same. It patches v1.0 to not break stuff
If you had no issues with applying SUPEE-7405 causing any of the following issues, you are probably OK.
You go to the Sales Order grid, select a Sales Order to view and the page comes up blank.
Images uploaded for wysiwyg, categories, etc do not show until the file permissions are ...
So basically, the updated version of the patch fixes some of the issues it brought (see details here: Security Patch SUPEE-7405 - possible problems?)
The SUPEE-7405 v 1.1 patch bundle includes the following:
Cart Merge Patch (SUPEE-7978)
Carts with identical items now merge correctly. Previously, when a
cart with one item was merged with ...
I got following error after installing the SUPEE-7405 patch when try to login to admin.
Fatal error: Call to undefined method
\app\code\core\Mage\Admin\Model\Session.php on line 135
because I had this file overridden in local code pool which does not have
sendHeadersAndExit method created ...
After applying the SUPEE-7405 on Magento 220.127.116.11 I got the error:
Fatal error: Cannot redeclare Mage_Core_Controller_Varien_Router_Admin::_validateControllerInstance() in app/code/core/Mage/Core/Controller/Varien/Router/Admin.php on line 173
The problem was caused by re-declared method _validateControllerInstance in
It looks like the website isn't patched for SUPEE 5344. This means that new code snippets such as `$request->setInternallyForwarded()' don't exist in the Observer.php and are making the line numbering incorrect.
You'll need to make sure the following previous patches have been applied previously in the following order:
I've just test the order on on a clean version of 18.104.22.168 and it all runs successfully.
The patches are meant to be applied on older versions to only fix specific issues without updating Magento. As such, they do not increase the version number.
If you are already on the latest version you can update Magento with a patch release like 22.214.171.124 instead of applying the patch with the shell script.
The difference is:
an update replaces all core ...
As it was already mentioned here: SUPEE-7504 is a patch bundle for Magento 1.X.
Next to this, also the Magento Community Edition 126.96.36.199 and Enterprise Edition 188.8.131.52 were released, as well as the Community and Enterprise Edition 2.0.1.
Some of the issues that were fixed for 1.X got also fixed for 2.X:
Guest order view protection code vulnerable to ...
For anyone wondering, the fix for this exploit was in app/design/adminhtml/default/default/template/sales/order/view/info.phtml and that template was being overridden by cart2quote. Anyone using cart2quote on their magento site should be aware that they are still vulnerable to APPSEC-1213 even after installing SUPEE-7405
The easiest way to find out what files are affected in a patch is to take a programmer's text editor like TextPad, sort the lines in the patch and extract all the +++ app/ +++ lib/ and other obvious file path names. A sampling of SUPEE-7405 as follows:
The SUPEE-7405 patch is already included in Magento 184.108.40.206. Magento has even released this version so that their latest downloadable version always contains all the necessary patches.
Also noted on the Magento download page (select "Release Archive"):
The patch addresses different security issues. Your site is no longer vulnerable to these issues. You can ...
The message is misleading. The patch scripts from Magento actually revert every change they made, as soon as they encounter a problem, that means:
no files are patched
no .rej files are created
The error you see, happens when a file is not exactly the same that the patch expects, this can mean one of these things:
the file was changed manually (somebody ...