106

Important notes Please note that 1.9.3 is different than 1.9.2.4 + SUPEE-8788. Here's the diff between the two: https://gist.github.com/digitalpianism/14a15cd52baede0e5d600e8c653f33e9 Update October 14th: v2 of the patch has been released (see below) As of October 13th, the patches for 1.5.x to 1.8.x have been taken down from the Magento website because of ...


29

When applying the patch this error can happen: checking file skin/adminhtml/default/default/media/flex.swf checking file skin/adminhtml/default/default/media/uploader.swf checking file skin/adminhtml/default/default/media/uploaderSingle.swf Reversed (or previously applied) patch detected! Assume -R? [n] Apply anyway? [n] Skipping patch. 1 out of 1 hunk ...


25

Here's a summary of what I (and others) encountered so far, I'm trying to keep it sorted, feel free to add or link anything that's missing, the post is a Community Wiki: Reasons for failed patch If you see "ERROR: Patch can't be applied/reverted successfully", look for "Hunk #1 FAILED" in the log messages to check at which file the patch failed. ...


25

If you've previously applied SUPEE-1533 then the patch will fail on app/code/core/Mage/Adminhtml/controllers/DashboardController.php. I solved this by... Manually revert the changes introduced to that file by SUPEE-1533 Apply SUPEE-8788 Manually reintroduce the changes introduced to that file by SUPEE-1533 Removing the change from the SUPEE-8788 is ...


23

If you get Call to undefined function hash_equals() error even if your patch was successful then it may mean that you have copied functions.php in app/code/local/Mage/Core. You will have to insert that function there too because that file overwrites the core one. So insert in app/code/local/Mage/Core/functions.php at the end: if (!function_exists('...


18

THIS APPLIES FOR 1.7 MAGENTO VERSIONS If you are running 1.7.0.2 version 2 of SUPEE 8788 will fail on line 372 trying to apply changes to Curl.php: patching file downloader/lib/Mage/HTTP/Client/Curl.php Hunk #1 FAILED at 372. 1 out of 1 hunk FAILED -- saving rejects to file downloader/lib/Mage/HTTP/Client The instructions say that we should revert SUPEE-...


18

In PATCH_SUPEE-8788_EE_1.14.2.0_v1-2016-10-10-02-27-03.sh, a file test_oauth.php is created in the Magento root directory. You will want to delete this one (or at least not deploy it to production) because it could expose a complete exception stack trace to the person calling the URL https://thedomain.tld/test_oauth.php.


17

Mage_Adminhtml_Block_Media_Uploader is deprecated on after SUPEE-8788 (and 1.9.3). Thus there are several backward incompatibility changes which breaks module using the uploader. I first thought a small change would fix it but there's actually way more to do. Make a module using the gallery compatible with 1.9.2 and 1.9.3 So if you're a module provider, ...


15

Original DashboardController.php (1.7.0.2- Not pached, Fresh from magento) if ($params = unserialize(base64_decode(urldecode($gaData)))) { 1533 Patched DashboardController.php contains the following change if ($newHash == $gaHash) { $params = json_decode(base64_decode(urldecode($gaData)), true); if ($params) { 8788 patch makes ...


14

Half tempted to flag this post as primarily opinion based or without a clear answer ;) Form keys have been added to a couple of controllers, the number varies depending on your magento version. If you experience trouble Removing an item from the wishlist Deleting a customers address from the store view Updating a quote item in your basket You'll need to ...


11

I met the same problem in swf in 1.9.2.4. Fox Fixed - Please follow below steps. Step 1. Download security patch 8788 SSH file to this Link :- https://magento.com/tech-resources/downloads/magento/ Step 2. After download security patch 8788 SSH file Please put into one folder and make same folder Zip file. Step 3. Please upload Zip folder to ...


10

After appyling SUPEE-8788 I was no longer able to load "Import" profiles using Unirgy_RapidFlow 2.0.0.18, getting a 500 error (nothing in Apache or HTTPD logs). I am still in the process of debugging and working with Unirgy to resolve, but it appears that the uploader block is causing the issue (Unirgy_RapidFlow_Block_Adminhtml_Profile_Edit_Tab_Upload). ...


8

Uploader breaks when you upload the same file for samples and links at the same time for downloadable products. Note that this only happens if you use the same file in both areas. (It used to work correctly before the patch.) To reproduce, edit a downloadable product and click on the Downloadable Information tab: Open the Samples row of the accordion and ...


8

Looks like Magento will be releasing updated version of the SUPEE 8788, to fix the SUPEE 1533 compatibility. I am not sure if its good idea to apply manually fixes right now. Manual changes may compromise future patch updates. Would like to hear your thoughts. It has been confirmed by Magento Community Manager. As oct 13, 3pm EST.. all patches for ...


8

Here's what I'm getting Hunk #1 FAILED at 373. 1 out of 1 hunk FAILED -- saving rejects to file downloader/lib/Mage/HTTP/Client/Curl.php.rej patching file js/lib/uploader/flow.min.js patching file js/lib/uploader/fusty-flow-factory.js patching file js/lib/uploader/fusty-flow.js patching file js/mage/adminhtml/product.js patching file js/mage/adminhtml/...


8

Patch on 1.9.0.0 fails too (probably 1.8.0.0 until 1.9.0.1 affected) because of SUPEE-3941. 3941 patches downloader/lib/Mage/HTTP/Client/Curl.php and now the 8788 fails. checking file downloader/lib/Mage/HTTP/Client/Curl.php Hunk #1 FAILED at 378. 1 out of 1 hunk FAILED checking file js/lib/uploader/flow.min.js Workaround for 1.9.0.1 below. Changes are too ...


8

We are getting reports of the following new issues that I don't see in other posts: Exception in the new releases in some cases - addCrumbs() method call (in case getStoreConfig(web/default/show_cms_breadcrumbs) is undefined). Should not affect the patch, only the 1.9.3/1.14.3 release 'Exception' with message 'Unsupported data type N' in /lib/Unserialize/...


8

I got the following message when executing the patch script: can't find file to patch at input line 4753 Perhaps you used the wrong -p or --strip option? The text leading up to this was: -------------------------- |diff --git downloader/lib/Mage/HTTP/Client/Curl.php downloader/lib/Mage/HTTP/Client/Curl.php |index 6d0607e..5757be3 100644 |--- downloader/lib/...


8

Details about the problem SUPEE-8788 replaces the old flash uploader with a new uploader system that sits in Mage/Uploader module. By default 1.7.0.2 has got the following code in app/code/core/Mage/Adminhtml/Block/Catalog/Product/Helper/Form/Gallery/Content.php $this->setChild('uploader', $this->getLayout()->createBlock('adminhtml/...


7

Try to add that in your customer login form <input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->getFormKey() ?>" />


6

Yes, I did encounter other issue when login, it will always return this: I found that is because on class Enterprise_Pci_Model_Observer line 165, Instead of: if (!Mage::helper('core')->getEncryptor()->validateHashByVersion($password, $model->getPassword())) { This will fix: if (!Mage::helper('core')->getEncryptor()->validateHashByVersion($...


6

Editing Patch File If anyone has to edit the patch file, you should not being do it in an editor as this will break the binary files encapsulated in the patch. If you have a command line handy ie. linux/*unix try using sed utility to remove specific lines. Props to @fooman for the tip. See his original gist Example sed -ie '101,111d' PATCH_SUPEE-...


5

A little late but we found a problem in patch SUPEE-8788 V2 which at least applies to the patch files for Magento 1.7.0.2 and 1.7.0.1. Probably this also applies to all prior versions for which a patch version exists. Magento version from 1.8 on are not affected as the patch doesn't change templates for those. In detail The patch is missing a formkey for ...


5

CE 1.6.2.0 & SUPEE-3941 To apply security patch SUPEE-8788 (Version 2), (http://devdocs.magento.com/guides/m1x/other/ht_install-patches.html#apply-8788-new) it is suggested to apply SUPEE-3941 first. However, on the patch download page, there is no SUPEE-3941 patch for CE 1.6.2.0. The patch is available only for CE 1.8 and 1.9. As mentioned in this ...


5

SUPEE 8788 V2 fixes the following problems introduced by SUPEE 8788 V1: conflict with 1533 patch conflict with 3941 patch Unsupported data type N error in /lib/Unserialize/Reader/ArrValue.php in 1.9.1.0 and possibly earlier versions If you apply the patch V2 don't forget to follow this procedure: revert SUPEE-8788 v1 revert SUPEE-1533 (if installed) ...


4

For 1533 Patched site just replace below line from PATCH_SUPEE-8788*****.sh : diff --git app/code/core/Mage/Adminhtml/controllers/DashboardController.php app/code/core/Mage/Adminhtml/controllers/DashboardController.php index 09ffc4c..367bf8e 100644 --- app/code/core/Mage/Adminhtml/controllers/DashboardController.php +++ app/code/core/Mage/Adminhtml/...


4

Authorize.net capture is broken after applying the patch. Authorizing works good, but when capturing the payment to invoice it gives "Gateway error: Credit card number is required". Payment log file shows x_type param passes value auth_capture now, but before the patch it used to pass prior_auth_capture which worked well. Anyone experiencing this issue? ...


4

I have patched a copy of Magento 1.9.2.4 using SSH with SUPEE-8788 I have patched another copy of Magento 1.9.2.4 using ftp with SUPEE-8788 I have patched a copy of magento 1.9.1.0 using SSH with SUPEE-8788 I have used a fresh copy of magento 1.9.3.1 In all these magento web sites with SUPEE-8788 i experience the same problem (maybe a bug of the patch) ...


4

With version 2 of the patch you don't need to revert the previous patches anymore, that was one of the problems of version 1 that has been fixed. Update: I only had looked at the diff between the patch versions and came to the wrong conclusion. After trying it out I can confirm that actually v2 works like this: fixes the 3941 compatibility issue: patch now ...


4

Brent Peterson has an updated repo of all the patches you can find it here: https://github.com/brentwpeterson/magento-patches?files=1


Only top voted, non community-wiki answers of a minimum length are eligible