109 votes
Accepted

Security Patch SUPEE-9767 - Possible issues?

Here's my overview of the patch after digging into it TIME SAVER : Experius provides a patch helper that helps you finding the files in custom themes, custom modules or local overwrites that also ...
44 votes

Security Patch SUPEE-9767 - Possible issues?

Issue1: form_key invalid at checkout onepage Magento add form_key at most of the forms. if you have using default onepage and using custom theme, then you will start getting **form_key issue at ...
  • 76.2k
36 votes
Accepted

SUPEE-9767 Patch/CE 1.9.3.3 - One Page Checkout - Customer Registration issue

Ok here's the real bug fix I came up with. Edit /skin/frontend/base/default/js/opcheckout.js and edit the setMethod() method by replacing: setMethod: function(){ if ($('login:guest') && ...
29 votes
Accepted

Watermark get black background when transparent

I had the same issue after patching 1.9.2.2 and 1.9.2.3. SUPEE-9767 adds an extended validate method in app/code/core/Mage/Core/Model/File/Validator/Image.php Mine was: public function validate($...
28 votes

Security Patch SUPEE-9767 - Possible issues?

Based on my first pass at review of the patch file... A new setting admin/security/validate_formkey_checkout has been added. When turned on, checkout forms are checked for presence of a form key. If ...
  • 1,234
22 votes
Accepted

How to enable symlinks after SUPEE-9767 V2 install?

You can only do it on DB at the moment. 1. SQL Either ... UPDATE core_config_data SET value = '1' WHERE path = 'dev/template/allow_symlink'; Or if entry does not exist ... INSERT INTO ...
  • 11.5k
18 votes
Accepted

SUPEE-9767 V2 Possible problems and solved Issues

SUPEE-9767 V2 released July 12th 2017 addresses bugs and issues identified by the community following the release of version 1 of the SUPEE-9767 security update (Magento CE 1.9.3.3) on May 31st 2017. ...
  • 5,635
16 votes

Security Patch SUPEE-9767 - Possible issues?

Below base/default file affected with this patch, if this files were in your theme then please make changes accordingly app/design/frontend/base/default/template/checkout/cart/shipping.phtml app/...
15 votes

SUPEE-9767 Patch/CE 1.9.3.3 - One Page Checkout - Customer Registration issue

When you select register and continue, the JS script calls checkout.setMethod(), which is located in skin/frontend/base/default/js/opcheckout.js. From there we can see it makes an AJAX POST request to ...
14 votes
Accepted

SUPEE-9767, modman and symlinks

Here are some clarifications regarding this change: First read this explanation from Peter O'Callaghan this will give you great understanding: https://peterocallaghan.co.uk/2017/06/appsec-1281-...
14 votes
Accepted

SUPEE-9767 Magento CE 1.9.3.3 Onestep Checkout not working with Form Key Validation On Checkout enabled

My problem was caused by dynamic code (paypal plus) in the one page checkout process overwriting the fieldset element in the one step method form html - deleting or disabling (with css) the hidden ...
  • 5,635
11 votes

Security Patch SUPEE-9767 - Possible issues?

Issue: Using php7 sometimes throws the following error: Decoding failed: Syntax error #0 /______/app/code/core/Enterprise/PageCache/Model/Observer.php(179): Zend_Json::decode('') #1 /______/app/code/...
11 votes

Security Patch SUPEE-9767 - Possible issues?

Issue: Missing fixes in head-simple.phtml app/design/adminhtml/default/default/template/oauth/authorize/head-simple.phtml need the same fixes as app/design/adminhtml/default/default/template/page/...
11 votes

Security Patch SUPEE-9767 - Possible issues?

Issue: Dynamic code or css disables form key input element at checkout An issue I have seen is where dynamic code (paypal plus) in the one page checkout process overwrites the fieldset element in the ...
  • 5,635
11 votes

Security Patch SUPEE-9767 - Possible issues?

Note that Symlinks have always been disabled by default on new Magento installations admin YES/NO config values default to 'NO'. The update now explicitly disables symlinks in config.xml and as an ...
  • 5,635
10 votes

Security Patch SUPEE-9767 - Possible issues?

ISSUE: Customer Registration Fails when using generic Magento 5-step checkout. This issue is only presented when we ENABLE form key authentication. Version used: 1.7.0.2, but looks like someone has ...
  • 2,439
10 votes
Accepted

Admin menu path to: Enable Form Key Validation On Checkout

Close! It's under System > Configuration > Admin > Security > Enable Form Key Validation On Checkout
9 votes

Security Patch SUPEE-9767 - Possible issues?

UPDATE 13/07/2017 [ THE ISSUE IS FIXED ] Magento team has released SUPEE-9767 V2 in this version of the patch the problem with transparent gif's and png's is fixed. You should revert all changes to ...
9 votes

How to enable symlinks after SUPEE-9767 V2 install?

The simplest way is to use n98-magerun which is a very useful command line dev tool for Magento Toggle symlinks on or off for all store views with n98-magerun.phar dev:symlinks 0 To check if ...
  • 5,635
8 votes

Security Patch SUPEE-9767 - Possible issues?

Issue: EE shipping template not patched I patched an EE 1.13.1.0 install, and the enterprise shipping template (app/design/frontend/enterprise/default/template/checkout/onepage/shipping.phtml) did ...
  • 2,695
8 votes

Security Patch SUPEE-9767 - Possible issues?

Issue: Allow symlink notification not shown to admins The symlink notification will not be shown in the admin notification area as it is not included in the <block type="core/text_list" name="...
  • 81
8 votes

Security Patch SUPEE-9767 - Possible issues?

Little tip for #patchday; after copying 1.9.3.3 over your install, run git diff -w --stat | grep -v " 2 +" | grep -v " 0" to quickly see bigger changes in files.
7 votes

SUPEE-9767 issue : Add to cart issue, Enterprise Full Page Cache

The issue is caused by the Enterprise Page Cache. The form key is created at: app/code/core/Enterprise/PageCache/Model/Processor.php:422 which ultimately calls setcookie(). Then the cookie value is ...
  • 381
6 votes

SUPEE-9767, modman and symlinks

The issue is not symlinks, the issue is paths that reach up levels such as ../../../../../media/tmp/hahaha.png. If I am wrong on this please enlighten me. The "fix" was titled "Allow symlinks" and ...
  • 561
6 votes

How does MageReport determine if patch 9767 is installed?

Magereport use behavior-based identification patterns. This is possible because each Magento patch introduces subtle changes in behavior. Apart from that, it is possible to request a few static files ...
5 votes

Security Patch SUPEE-9767 - Possible issues?

There is an issue with Magento EE versions that are patched with SUPEE-9767 (so not with upgrades to 1.14.3.3). The form key on that page will be cached. So when I flush my cache and then go to a ...
5 votes

SUPEE-9767 issue : Design Exceptions with Enterprise Full Page cache

This issue is caused by the patch using Zend_Json to encode values into the cache in the Enterprise PageCache Observer where previously serialize was used. The Fix (copy the file to local to avoid ...
  • 381
5 votes
Accepted

SUPEE-9767 V2 - V1 Patch reversal errors

You have issue in app/code/core/Mage/Customer/Model/Session.php. patches does not applied on that files that why you getting the issue. To resolved this issue, you should remove patches code for ...
  • 76.2k
4 votes

SUPEE-9767 ERROR: Patch can't be applied/reverted successfully

This issue has been resolved and the patch is applied with the following method. There are two reasons you might experience issues with the patch. If you have previously applied patch PATCH_SUPEE-...
4 votes

Patch 9767 getting invalid Form Key

open your below file and add form key into it app/design/frontend/YourPackage/YourTheme/template/checkout/onepage/billing.phtml and add below form key code into it <?php echo $this->...

Only top scored, non community-wiki answers of a minimum length are eligible