SUPEE-10570v2

SUPEE-10570v2 is the second version of SUPEE-10570 patch. The second version was released on March 28, 2018 to fix issue that could result in the inability of customers to complete checkout when trying to register during checkout.

SUPEE-10570v2 no longer causes this issue. Note, however, that this new patch no longer protects against two low risk session handling-related security issues that patch SUPEE-10570 protected against. The protection is restored in the next patch, SUPEE-10752.

If you have not yet applied SUPEE-10570, do not apply it, but instead patch your store with SUPEE-10570v2. If you have already applied SUPEE-10570, please first uninstall SUPEE-10570, then install SUPEE-10570v2. All stores should be patched with SUPEE-10570v2 as Magento used this patch (SUPEE-10570v2) as a base for all newer patch versions and releases.

To install SUPEE-10570v2 please refer to the following articles:

• install SUPEE-10570 via SSH
• install SUPEE-10570 without SSH

or use our patch installation service to install all missing security patches at once or upgrade to OpenMage LTS with all these and newer patches included.

Note: There are some Known issues for this patch.

The difference between SUPEE-10570 and SUPEE-10570v2 is one line in app/code/core/Mage/Core/Model/Session/Abstract/Varien.php:

diff --git app/code/core/Mage/Core/Model/Session/Abstract/Varien.php app/code/core/Mage/Core/Model/Session/Abstract/Varien.php
index 59b3ea8..35155f1 100644
--- app/code/core/Mage/Core/Model/Session/Abstract/Varien.php
+++ app/code/core/Mage/Core/Model/Session/Abstract/Varien.php
@@ -485,7 +485,7 @@ class Mage_Core_Model_Session_Abstract_Varien extends Varien_Object
             && isset($validatorData[self::VALIDATOR_PASSWORD_CREATE_TIMESTAMP])
             && isset($sessionData[self::VALIDATOR_SESSION_EXPIRE_TIMESTAMP])
             && $validatorData[self::VALIDATOR_PASSWORD_CREATE_TIMESTAMP]
-            > $sessionData[self::VALIDATOR_SESSION_EXPIRE_TIMESTAMP] - $this->getCookie()->getLifetime()
+            > $sessionData[self::VALIDATOR_SESSION_EXPIRE_TIMESTAMP]
         ) {
             return false;
         }

This line of code is added back with a few other changes in SUPEE-10752 to restore protection against two low risk session handling-related security issues and to not break checkout when trying to register.

Download SUPEE-10570v2