106

Here's my overview of the patch after digging into it TIME SAVER : Experius provides a patch helper that helps you finding the files in custom themes, custom modules or local overwrites that also might need to be patched manually, you can find it here: https://github.com/experius/Magento-1-Experius-Patch-Helper#magento Checkout form keys As said in the ...


41

Issue1: form_key invalid at checkout onepage Magento add form_key at most of the forms. if you have using default onepage and using custom theme, then you will start getting **form_key issue at checkout each step **; you should add form key at <?php echo $this->getBlockHtml('formkey') ?> to form of each checkout step files if below files ...


36

Ok here's the real bug fix I came up with. Edit /skin/frontend/base/default/js/opcheckout.js and edit the setMethod() method by replacing: setMethod: function(){ if ($('login:guest') && $('login:guest').checked) { this.method = 'guest'; new Ajax.Request( this.saveMethodUrl, {method: 'post', onFailure: ...


29

I had the same issue after patching 1.9.2.2 and 1.9.2.3. SUPEE-9767 adds an extended validate method in app/code/core/Mage/Core/Model/File/Validator/Image.php Mine was: public function validate($filePath) { $fileInfo = getimagesize($filePath); if (is_array($fileInfo) and isset($fileInfo[2])) { if ($this->isImageType($fileInfo[2])) { ...


25

Based on my first pass at review of the patch file... A new setting admin/security/validate_formkey_checkout has been added. When turned on, checkout forms are checked for presence of a form key. If the template files are overriden in the theme they'll need to be updated there. This setting seems to be off by default Symlinks seem to be disallowed by ...


19

You can only do it on DB at the moment. 1. SQL Either ... UPDATE core_config_data SET value = '1' WHERE path = 'dev/template/allow_symlink'; Or if entry does not exist ... INSERT INTO core_config_data (config_id, scope, scope_id, path, value) VALUES (NULL , 'default', '0', 'dev/template/allow_symlink', '1'); Note: Don't forget to add table prefix if ...


18

SUPEE-9767 V2 released July 12th 2017 addresses bugs and issues identified by the community following the release of version 1 of the SUPEE-9767 security update (Magento CE 1.9.3.3) on May 31st 2017. Specifically the following changes have been made in SUPEE-9767 V2 (Magento CE 1.9.3.4) General Fixes restored missing strip_tags functionality ...


15

When you select register and continue, the JS script calls checkout.setMethod(), which is located in skin/frontend/base/default/js/opcheckout.js. From there we can see it makes an AJAX POST request to this.saveMethodUrl, but the only paramter it passes is method. If we look at Mage_Checkout_OnepageController::saveMethodAction, which is the target of that ...


14

Below base/default file affected with this patch, if this files were in your theme then please make changes accordingly app/design/frontend/base/default/template/checkout/cart/shipping.phtml app/design/frontend/base/default/template/checkout/multishipping/billing.phtml app/design/frontend/base/default/template/checkout/multishipping/shipping.phtml app/...


14

Here are some clarifications regarding this change: First read this explanation from Peter O'Callaghan this will give you great understanding: https://peterocallaghan.co.uk/2017/06/appsec-1281-dangerous-symlinks/ Also another interesting read is this post by Max Chadwick https://maxchadwick.xyz/blog/what-allow-symlinks-actually-does This modification is ...


14

My problem was caused by dynamic code (paypal plus) in the one page checkout process overwriting the fieldset element in the one step method form html - deleting or disabling (with css) the hidden form_key element. The fix is to ensure the formkey element is not being affected by dynamic code or css. Moving the formkey code outside of the fieldset may help ...


10

Close! It's under System > Configuration > Admin > Security > Enable Form Key Validation On Checkout


9

Issue: Using php7 sometimes throws the following error: Decoding failed: Syntax error #0 /______/app/code/core/Enterprise/PageCache/Model/Observer.php(179): Zend_Json::decode('') #1 /______/app/code/core/Enterprise/PageCache/Model/Observer.php(215): Enterprise_PageCache_Model_Observer->_loadDesignExceptions() #2 /______/app/code/core/Enterprise/...


9

Issue: Missing fixes in head-simple.phtml app/design/adminhtml/default/default/template/oauth/authorize/head-simple.phtml need the same fixes as app/design/adminhtml/default/default/template/page/head.phtml


9

Issue: Dynamic code or css disables form key input element at checkout An issue I have seen is where dynamic code (paypal plus) in the one page checkout process overwrites the fieldset element in the one step payment method form html - deleting or disabling (with css) the hidden form_key element. The fix is to ensure the formkey element is not being ...


9

Note that Symlinks have always been disabled by default on new Magento installations admin YES/NO config values default to 'NO'. The update now explicitly disables symlinks in config.xml and as an extra precaution also removes the template section from admin->developer which contained the configuration option. This will not affect your current symlink ...


9

The simplest way is to use n98-magerun which is a very useful command line dev tool for Magento Toggle symlinks on or off for all store views with n98-magerun.phar dev:symlinks 0 To check if symlinks are enabled use n98-magerun.phar config:dump | grep symlink


8

ISSUE: Customer Registration Fails when using generic Magento 5-step checkout. This issue is only presented when we ENABLE form key authentication. Version used: 1.7.0.2, but looks like someone has posted that same issue occurs on 1.9.3 version too. SUPEE-9767 Patch/CE 1.9.3.3 - One Page Checkout - Customer Registration issue When Go to checkout, we are ...


8

UPDATE 13/07/2017 [ THE ISSUE IS FIXED ] Magento team has released SUPEE-9767 V2 in this version of the patch the problem with transparent gif's and png's is fixed. You should revert all changes to the file that was discussed in this thread. Then revert the applied V1 patch and finally apply the new version V2. PRE - SUPEE-9767 V2 Please don't use the ...


7

Issue: EE shipping template not patched I patched an EE 1.13.1.0 install, and the enterprise shipping template (app/design/frontend/enterprise/default/template/checkout/onepage/shipping.phtml) did not have the formkey added, but the billing and payment templates did. app/design/frontend/base/default/template/checkout/onepage/shipping.phtml was patched.


7

Issue: Allow symlink notification not shown to admins The symlink notification will not be shown in the admin notification area as it is not included in the <block type="core/text_list" name="notifications" as="notifications"> The patch for both CE and EE below: --- app/design/adminhtml/default/default/layout/main.xml +++ app/design/adminhtml/...


7

Little tip for #patchday; after copying 1.9.3.3 over your install, run git diff -w --stat | grep -v " 2 +" | grep -v " 0" to quickly see bigger changes in files.


7

The issue is caused by the Enterprise Page Cache. The form key is created at: app/code/core/Enterprise/PageCache/Model/Processor.php:422 which ultimately calls setcookie(). Then the cookie value is retrieved at: app/code/core/Enterprise/PageCache/Model/Observer.php:1043 in the same request. As the headers/cookies have not been sent the value returned is ...


6

The issue is not symlinks, the issue is paths that reach up levels such as ../../../../../media/tmp/hahaha.png. If I am wrong on this please enlighten me. The "fix" was titled "Allow symlinks" and enabling this disables the check which was implemented using realpath(). In my opinion a fix that is just as secure, more performant and still compatible with ...


6

Magereport use behavior-based identification patterns. This is possible because each Magento patch introduces subtle changes in behavior. Apart from that, it is possible to request a few static files and derive the Magento version from that. Our work is shared on Github. You are missed any file like app/etc/applied.patches.list Source : Magereport.


5

This issue is caused by the patch using Zend_Json to encode values into the cache in the Enterprise PageCache Observer where previously serialize was used. The Fix (copy the file to local to avoid editing core): app/code/core/Enterprise/PageCache/Model/Processor.php:195 Change: $exceptions = @unserialize($exceptions); To: $exceptions = @Zend_Json::...


5

You have issue in app/code/core/Mage/Customer/Model/Session.php. patches does not applied on that files that why you getting the issue. To resolved this issue, you should remove patches code for that class from Version1 file sh PATCH_SUPEE-9767_CE_1.7.0.2_v1-2017-05-25-09-31-32.sh` remove the code below code from That Sh files diff --git app/code/core/...


4

There is an issue with Magento EE versions that are patched with SUPEE-9767 (so not with upgrades to 1.14.3.3). The form key on that page will be cached. So when I flush my cache and then go to a product page and make sure the page is completely cached (refresh a couple of times), I should be able to add that product to my cart. Now, when I open a different ...


4

This issue has been resolved and the patch is applied with the following method. There are two reasons you might experience issues with the patch. If you have previously applied patch PATCH_SUPEE-9805_EE_1.14.3.2_v1.sh, the fixed from this patch is included in the security patch. If you have PATCH_SUPEE-9805_EE_1.14.3.2_v1.sh applied you should revert it ...


4

open your below file and add form key into it app/design/frontend/YourPackage/YourTheme/template/checkout/onepage/billing.phtml and add below form key code into it <?php echo $this->getBlockHtml('formkey') ?> Solution 2 If you are not able to do this then download below patch https://gist.github.com/schmengler/...


Only top voted, non community-wiki answers of a minimum length are eligible