3. doesn't work in this case. Because the offending plugin will never accept a public repository.

The Experius Module linked above has been since deprecated. We have switched to using the elgentos module instead.

The patch modifies how passwords are saved/hashed. And should rehash your password on the next login. Apparently something in your shop is stopping this from happening.

I just compared the 1.9.2.4 patch with the 1.9.1.0 patch. And it looks like difference between these patches are the 3 files you mention. So it looks like the 1.9.1.0 patch should be used on 1.9.1.1.

From what I've tested is that it works if the file already exists. The first check isValid does is check if the file is readable. If it doesn't exist there is no attempt to create the file and a false is returned.

This is not correct. In app/etc/config.xml the allowedFileExtensions has been added as configuration. If it doesn't exists in the database this will be used. The actual problem is that the new validation function first tries to see if the file already exists, which it might very wel not.

Seeing as app/code/core/Mage/Adminhtml/Block/Customer/Group/Edit.php failed. I assume you applied patch SUPEE-11043 which SUPEE-11086 assumes you haven't done.

Which hunk are you failing on?

This was a bug in SUPEE-10975 which caused you to not be able to delete Customer Groups. Looks like you fixed it manually, which causes this new patch to fail which is also fixing this.

REST hasn't been completely implemented in Magento 1. So you need to either build it yourself, or use SOAP instead.

They made Mage_Captcha depended on Mage_Sendfriend instead of the other way around. So you need to also deactivate Mage_Captcha to disable Mage_Sendfriend. Which might not be what you want because it disables all Magento default recaptcha's

So the fix should be replacing parent::getDeleteUrl(); in app/code/core/Mage/Adminhtml/Block/Customer/Group/Edit.php with return parent::getDeleteUrl();

It shouldn't be necessary to add this function. It will just always default to not raw, because any functionality calling this function should not have $raw set in 1.8.1.

Also remember that re-enabling the Mage_Backup module opens you up to: "remote code execution (RCE), cross-site scripting (XSS), and cross-site request forgery (CSRF) issues."

The change in this patch is that Mage_Backup is deactivated by default and the checks for running the code are stricter (eg. if block output for the module is deactivated the backups wont run). You can still manually re-enable the module by changing false to true in the Mage_Backup section of app/etc/modules/Mage_All.xml. Be careful that re-enabling the backup functionality potentially allows: "remote code execution (RCE), cross-site scripting (XSS), and cross-site request forgery (CSRF) issues."