Technical resource
How to apply SUPEE-5344 and SUPEE-1533 without SSH
Note: This is a historical reference, not a current security baseline. Magento 1 is end-of-life.
Recently released announce regarding Magento vulnerability disclosed by CheckPoint urges Magento patches SUPEE-1533 and SUPEE-5344 installation. The patches are available for download at MagentoCommerce site: https://www.magentocommerce.com/products/downloads/magento/ To test if your store is vulnerable use our Scan your store button in sidebar. The only problem with these patches is SSH requirement, which some hosts do not provide. If you have SSH access, you can install patches as shown in How to apply SUPEE-5344 and SUPEE-1533 via SSH. It is still possible to apply these patches even without SSH via FTP/sFTP or direct execution via PHP as shown below in this article. If you wish to save time and have us to install these patches for you, simply click here to order installation. If you have any difficulties with applying the patches please let us know in comments, so we can find the solution together.
Note: Before patching make sure to Disable Magento Compiler if you use it at System > Configuration > Tools > Compilation and clear compiled cache.
Applying Magento patches via FTP/sFTP or FileManager
To apply patches via FTP we simply replace changed files. This way can not be used blindly if you or your developers have changed any core Magento files (which is a big no-no, by the way). Such changes should be re-applied to patched files, or you loose these changes. Patch SUPEE-1533 (Magento 1.7.x.x-1.9.1.0) applied to the following files:- app/code/core/Mage/Adminhtml/Block/Dashboard/Graph.php
- app/code/core/Mage/Adminhtml/controllers/DashboardController.php
- app/code/core/Mage/Admin/Model/Observer.php
- app/code/core/Mage/Core/Controller/Request/Http.php
- app/code/core/Mage/Oauth/controllers/Adminhtml/Oauth/AuthorizeController.php
- app/code/core/Mage/XmlConnect/Model/Observer.php
- lib/Varien/Db/Adapter/Pdo/Mysql.php
Patches for other versions (1.7.0.2 and earlier)
Older versions are patched in the same way, I have combined downloads for all versions into a single table. The last column contains combined version of both patches to upload both patches at once.| Magento version | SUPEE-5344 | SUPEE-1533 | COMBINED (both patches at once) |
|---|---|---|---|
| Magento 1.8.0.0-1.9.1.0 | SUPEE-5344.zip | SUPEE-1533.zip | SUPEE-1533-5344.zip |
| Magento 1.7.0.0-1.7.0.2 | SUPEE-5344-1.7.zip | SUPEE-1533.zip | SUPEE-1533-5344-1.7.zip |
| Magento 1.6.1.0-1.6.2.0 | SUPEE-5344-1.6.zip | SUPEE-1533-1.6.zip | SUPEE-1533-5344-1.6.1.zip |
| Magento 1.6.0.0 | not prepared (due to low volume) use official .sh patch file or upgrade to nearest 1.6.2.0 |
||
| Magento 1.5.1.0 | SUPEE-5344-1.5.1.zip | SUPEE-1533-1.5.1.zip | SUPEE-1533-5344-1.5.1.zip |
| Magento 1.4.0.0-1.5.0.1 | not prepared (due to high customization rate and overrides possibility) use official .sh patch file |
||
| Magento 1.3 | not prepared (due to high customization rate and overrides possibility) use patch from here |
||
Verification
Verify that your store have green SAFE status at http://magento.com/security-patch and our patch tester page. Additionally, if your store still using default/admin/ path, you may consider securing your Magento /admin/ by admin path change.
Done.
Update: Make sure also to apply the latest SUPEE-5994 and SUPEE-6285.
As there is an exploit in the wild, if your store was not yet patched to the date, the chances are that it is exploited already. Make sure to check list of admin users. You can do it System > Permissions > Users and System > Permissions > Roles in Backend. Make sure to delete any unknown users, especially with emails in example.com domain. Refer to Recovery after Shoplift vulnerability article for detailed list of actions.
Applying Magento patches via PHP
Upload one of PHP shells to your Magento root subfolder. Sample PHP shells are PHP Shell and phpFileManager. Just upload one of shells to your Magento site, open the shell in browser and run Magento patches in the shell provided just like via SSH.Applying patches manually (by merging patches with your changes in core files)
Use this way only if you or your developers have changed core Magento files that need to be patched. Apply the changes from the diffs below line by line editing all files. Lines prefixed with a “+” (plus sign) should be added, lines prefixed with “-” (minus sign) should be removed, “@@” characters indicate position (line number and column). Complete DIFF for SUPEE-1533 (Magento 1.7.0.0-1.9.1.0):
diff --git app/code/core/Mage/Adminhtml/Block/Dashboard/Graph.php app/code/core/Mage/Adminhtml/Block/Dashboard/Graph.php
index c698108..6e256bb 100644
--- app/code/core/Mage/Adminhtml/Block/Dashboard/Graph.php
+++ app/code/core/Mage/Adminhtml/Block/Dashboard/Graph.php
@@ -444,7 +444,7 @@ class Mage_Adminhtml_Block_Dashboard_Graph extends Mage_Adminhtml_Block_Dashboar
}
return self::API_URL . '?' . implode('&', $p);
} else {
- $gaData = urlencode(base64_encode(serialize($params)));
+ $gaData = urlencode(base64_encode(json_encode($params)));
$gaHash = Mage::helper('adminhtml/dashboard_data')->getChartDataHash($gaData);
$params = array('ga' => $gaData, 'h' => $gaHash);
return $this->getUrl('*/*/tunnel', array('_query' => $params));
diff --git app/code/core/Mage/Adminhtml/controllers/DashboardController.php app/code/core/Mage/Adminhtml/controllers/DashboardController.php
index eebb471..f9cb8d2 100644
--- app/code/core/Mage/Adminhtml/controllers/DashboardController.php
+++ app/code/core/Mage/Adminhtml/controllers/DashboardController.php
@@ -92,7 +92,8 @@ class Mage_Adminhtml_DashboardController extends Mage_Adminhtml_Controller_Actio
if ($gaData && $gaHash) {
$newHash = Mage::helper('adminhtml/dashboard_data')->getChartDataHash($gaData);
if ($newHash == $gaHash) {
- if ($params = unserialize(base64_decode(urldecode($gaData)))) {
+ $params = json_decode(base64_decode(urldecode($gaData)), true);
+ if ($params) {
$response = $httpClient->setUri(Mage_Adminhtml_Block_Dashboard_Graph::API_URL)
->setParameterGet($params)
->setConfig(array('timeout' => 5))
Complete DIFF for SUPEE-5344 (Magento 1.8.0.0-1.9.1.0):
diff --git app/code/core/Mage/Admin/Model/Observer.php app/code/core/Mage/Admin/Model/Observer.php
index bd00181..6a5281c 100644
--- app/code/core/Mage/Admin/Model/Observer.php
+++ app/code/core/Mage/Admin/Model/Observer.php
@@ -44,6 +44,10 @@ class Mage_Admin_Model_Observer
{
$session = Mage::getSingleton('admin/session');
/** @var $session Mage_Admin_Model_Session */
+
+ /**
+ * @var $request Mage_Core_Controller_Request_Http
+ */
$request = Mage::app()->getRequest();
$user = $session->getUser();
@@ -58,7 +62,7 @@ class Mage_Admin_Model_Observer
if (in_array($requestedActionName, $openActions)) {
$request->setDispatched(true);
} else {
- if($user) {
+ if ($user) {
$user->reload();
}
if (!$user || !$user->getId()) {
@@ -69,13 +73,14 @@ class Mage_Admin_Model_Observer
$session->login($username, $password, $request);
$request->setPost('login', null);
}
- if (!$request->getParam('forwarded')) {
+ if (!$request->getInternallyForwarded()) {
+ $request->setInternallyForwarded();
if ($request->getParam('isIframe')) {
$request->setParam('forwarded', true)
->setControllerName('index')
->setActionName('deniedIframe')
->setDispatched(false);
- } elseif($request->getParam('isAjax')) {
+ } elseif ($request->getParam('isAjax')) {
$request->setParam('forwarded', true)
->setControllerName('index')
->setActionName('deniedJson')
diff --git app/code/core/Mage/Core/Controller/Request/Http.php app/code/core/Mage/Core/Controller/Request/Http.php
index 6513db9..31eb6d6 100644
--- app/code/core/Mage/Core/Controller/Request/Http.php
+++ app/code/core/Mage/Core/Controller/Request/Http.php
@@ -76,6 +76,13 @@ class Mage_Core_Controller_Request_Http extends Zend_Controller_Request_Http
protected $_beforeForwardInfo = array();
/**
+ * Flag for recognizing if request internally forwarded
+ *
+ * @var bool
+ */
+ protected $_internallyForwarded = false;
+
+ /**
* Returns ORIGINAL_PATH_INFO.
* This value is calculated instead of reading PATH_INFO
* directly from $_SERVER due to cross-platform differences.
@@ -534,4 +541,26 @@ class Mage_Core_Controller_Request_Http extends Zend_Controller_Request_Http
}
return false;
}
+
+ /**
+ * Define that request was forwarded internally
+ *
+ * @param boolean $flag
+ * @return Mage_Core_Controller_Request_Http
+ */
+ public function setInternallyForwarded($flag = true)
+ {
+ $this->_internallyForwarded = (bool)$flag;
+ return $this;
+ }
+
+ /**
+ * Checks if request was forwarded internally
+ *
+ * @return bool
+ */
+ public function getInternallyForwarded()
+ {
+ return $this->_internallyForwarded;
+ }
}
diff --git app/code/core/Mage/Oauth/controllers/Adminhtml/Oauth/AuthorizeController.php app/code/core/Mage/Oauth/controllers/Adminhtml/Oauth/AuthorizeController.php
index c30d273..36542f9 100644
--- app/code/core/Mage/Oauth/controllers/Adminhtml/Oauth/AuthorizeController.php
+++ app/code/core/Mage/Oauth/controllers/Adminhtml/Oauth/AuthorizeController.php
@@ -55,7 +55,7 @@ class Mage_Oauth_Adminhtml_Oauth_AuthorizeController extends Mage_Adminhtml_Cont
*/
public function preDispatch()
{
- $this->getRequest()->setParam('forwarded', true);
+ Mage::app()->getRequest()->setInternallyForwarded();
// check login data before it set null in Mage_Admin_Model_Observer::actionPreDispatchAdmin
$loginError = $this->_checkLoginIsEmpty();
diff --git app/code/core/Mage/XmlConnect/Model/Observer.php app/code/core/Mage/XmlConnect/Model/Observer.php
index e6cb947..36142ac 100644
--- app/code/core/Mage/XmlConnect/Model/Observer.php
+++ app/code/core/Mage/XmlConnect/Model/Observer.php
@@ -143,7 +143,7 @@ class Mage_XmlConnect_Model_Observer
/** @var $request Mage_Core_Controller_Request_Http */
$request = Mage::app()->getRequest();
if (true === $this->_checkAdminController($request, $event->getControllerAction())) {
- $request->setParam('forwarded', true)->setDispatched(true);
+ $request->setInternallyForwarded()->setDispatched(true);
}
}
@@ -160,7 +160,7 @@ class Mage_XmlConnect_Model_Observer
if (false === $this->_checkAdminController($request, $event->getControllerAction())
&& !Mage::getSingleton('admin/session')->isLoggedIn()
) {
- $request->setParam('forwarded', true)->setRouteName('adminhtml')->setControllerName('connect_user')
+ $request->setInternallyForwarded()->setRouteName('adminhtml')->setControllerName('connect_user')
->setActionName('loginform')->setDispatched(false);
}
}
diff --git lib/Varien/Db/Adapter/Pdo/Mysql.php lib/Varien/Db/Adapter/Pdo/Mysql.php
index 2226331..d1c6942 100644
--- lib/Varien/Db/Adapter/Pdo/Mysql.php
+++ lib/Varien/Db/Adapter/Pdo/Mysql.php
@@ -2834,10 +2834,6 @@ class Varien_Db_Adapter_Pdo_Mysql extends Zend_Db_Adapter_Pdo_Mysql implements V
$query = '';
if (is_array($condition)) {
- if (isset($condition['field_expr'])) {
- $fieldName = str_replace('#?', $this->quoteIdentifier($fieldName), $condition['field_expr']);
- unset($condition['field_expr']);
- }
$key = key(array_intersect_key($condition, $conditionKeyMap));
if (isset($condition['from']) || isset($condition['to'])) {
If you have any difficulties with applying the patches please let us know in comments, so we can find the solution together.
Comments
Archived discussion
Yes i have installed it manually but am getting notification message :
Second Reminder: Download and install Magento critical security patches now.
is that manually patch not working correctlly ?
Thanks a lot! The lines are there alright
/**
shoplift test is checking SUPEE-5344, please use the following set of files for Magento 1.7.x.x: http://magentary.com/wph/co…
I have updated article to include set of files for 1.7.x.x
Man You are amazing !!
It works perfectly .. Shoplift Bug Tester shows my site as safe ;)
Can you reply me as well?? Do you have patch for 1.4 version as well ??
I have downloaded sh patches from Magento Site for 1.4 verion and opened sh files in notepad++ updated files accordingly.
Please reply. You are not replying to me..
Hi,
I really thank you for giving such a detailed way of resolving the issue.
I have tried to copy the files as mentioned to the folders using FTP / in
public_html/app/code/core/Mage/Adminhtml/Block/Dashboard/Graph.php public_html/app/code/core/Mage/Adminhtml/controllers/DashboardController.php
…. but after testing it still shows VULNERABLE. I even waited 1 hour but the result is same. Please Help !! Also I want to know that there are two folders similar to each other which is public_html and www. Do I need to copy the files in both !!!
Thanks
Thanks, really help!
But if i try to replace the file Mysql.php give me a permission problem, how can i fix it?
Thanks.
Thanks, really helpful!
I used the FTP option and when checking if my website is safe or not, it says it’s safe.
But when logging in the admin panel I still get the error message “Urgent: Immediately install Magento critical security patches”, why could it be?
Thanks
Oke great! Will just ignore these messages then! However one more question, in my system.log file I noticed the following line (repeatedly): 2015-04-24T13:33:24+00:00 ERR (3): Warning: array_key_exists() expects parameter 2 to be array, null given in /httpdocs/app/code/core/Mage/Captcha/Model/Observer.php on line 166
What does this mean?
Understand…
Does it mean I’ll get more messages like this on the future? Like a 4th reminder or so?
Thanks again, for real :)
brilliant, thanks for this, I did try via ssh but it was less than clear! 1533 failed - ERROR: Patch can’t be applied/reverted successfully. So I merged using sftp and all went fine :)
5344 patch “Patch was applied/reverted successfully.” And I can now see it has been successful when I checked the files, against the files, from your download :) But now, I have a permission problem as the files are owned by root. Will that leave any problem, I have tried to reset with the magento-permissions-cleanup.php script, but this also gave failures: Warning: chmod() [function.chmod]: Operation not permitted Thanks for any tips
It seems like you have uploaded files as root, so they are now owned by root. You can use chown command in SSH console as root to change owner for all files to the same owner as on index.php, i.e. as root in SSH console under Magento root directory:
chown -h -R –reference=./index.php ./app ./lib
its wasn’t the uploaded files, but those from the SSH root@xxx.xxx.xxx.xxx - 5344 patch “Patch was applied/reverted successfully.”, any way, your command worked like a charm :)
many thanks
Thanks for the reply. I Contacted my host and you are correct, my server is firewalled with ModSecurity which would normaly block those types of test requests. Therefore i was getting ‘cannot connect to server’ issues.
I wonder if this would have effected why i had a hard time installing the Patch. I used the PHP method (created a new PHP file and then went to that file in my web browser). It returned results that in my opinion where inconclusive. I will post it here in case anyone else had this same problem.
Checking if patch can be applied/reverted successfully… ERROR: Patch can’t be applied/reverted successfully.
patching file app/code/core/Mage/Admin/Model/Observer.php Reversed (or previously applied) patch detected! Assume -R? [n] Apply anyway? [n] Skipping patch. 3 out of 3 hunks ignored – saving rejects to file app/code/core/Mage/Admin/Model/Observer.php.rej patching file app/code/core/Mage/Core/Controller/Request/Http.php Reversed (or previously applied) patch detected! Assume -R? [n] Apply anyway? [n] Skipping patch.
This is the result i was getting for every file it was trying to patch. I manually checked the code in the relevant files and they had in fact been patched correctly.
BTW my Host told me that with ModSecurity it would not be possible for my store to be hacked even without the Patch installed. But either way, i would still want to make sure my store is up to date with proper security in place.
I tried applying the pach via SSH but it didn’t work correctly. Testing with theshoplift.byte.nl
Upload your files and everything OK.
Good job and thank you very much for your help.
Hi, I uploaded the files as indicated by you. However, after the upload the backend is not accessible anymore. Any idea what might have happend?
Regards
Mat
HI
Patches for other versions (1.7.0.2 and earlier) not showing patches for version 1.5.1.0
Hi,
i install this patch on 2 domains one has oky but other domain not fixed.. this domain still getting warring message on http://magento.com/security…
both are magento 1.9.1.0 versions..
Hello
I have install patches for Magento 1.7 with SUPEE-1533+5344-1.7 but after installation it shows me the error “Fatal error: Class ‘Mage_Core_Model_App’ not found in /home/tea67dpt/public_html/app/Mage.php on line 669”. My site is down and also I am not able to access the admin panel. The site is on production mode and now its down. Can you please help me to fix asap. Thanks
Hello Sir,
i am using Magento 1.7.x i had update the patches
Fatal error: Class ‘Mage_Install_Controller_Router_Install’ not found in /home/content/70/12213370/html/okolo/includes/src/__default.php on line 17475
can you please help me ?
Hi,
i have upload the magento1.7 patches,but how do i know safe the site.when i run my site securty page.warning message displayed .apply patch immediately .How top solve this