Patch & CVE Reference
MPERF-10565
MPERF-10565 is patch to correct known issue with Magento 1.9.4.1 release and SUPEE-11086, when logging to non-existing file fails silently.
The patch is included in SUPEE-11155 and Magento 1.9.4.2 version, so use SUPEE-11155 instead or upgrade to 1.9.4.2.
--- app/Mage.php
+++ app/Mage.php
@@ -798,9 +798,9 @@ public static function log($message, $level = null, $file = '', $forceLog = fals
',',
(string) self::getConfig()->getNode('dev/log/allowedFileExtensions', Mage_Core_Model_Store::DEFAULT_CODE)
);
- $logValidator = new Zend_Validate_File_Extension($_allowedFileExtensions);
$logDir = self::getBaseDir('var') . DS . 'log';
- if (!$logValidator->isValid($logDir . DS . $file)) {
+ $validatedFileExtension = pathinfo($file, PATHINFO_EXTENSION);
+ if (!$validatedFileExtension || !in_array($validatedFileExtension, $_allowedFileExtensions)) {
return;
}