Note: This is a historical reference, not a current security baseline. Magento 1 is end-of-life.
March 28, 2018: SUPEE-10570v2 version released fixing inability of customers to complete checkout when trying to register during checkout after SUPEE-10570v1
February 27, 2018: Community Edition 1.9.3.8 and SUPEE-10570 Security Enhancements – 02/27/2018.
If you have SSH access, it would be more simple to apply the patch via SSH. If you have no SSH access to apply the patch you still can apply the patch via FTP/sFTP upload as shown in this article. If you wish to save time and have us to install these patches for you, simply click here to order installation.

Preparations

Applying Magento patches via FTP/sFTP or FileManager / File Upload

To apply patches in this way we simply replace changed files. This way can not be used blindly if you or your developers have changed any core Magento files (which is a big no-no, by the way). Such changes should be re-applied to patched files, or you loose these changes. The following files are changed by SUPEE-10570v2 (v1 for 1.9.3.7 released on March 28, 2018):
app/Mage.php
app/code/core/Mage/Admin/Helper/Block.php
app/code/core/Mage/Admin/Model/Block.php
app/code/core/Mage/Admin/Model/Resource/Block.php
app/code/core/Mage/Admin/Model/User.php
app/code/core/Mage/Adminhtml/Block/Catalog/Product/Grid.php
app/code/core/Mage/Adminhtml/Block/Newsletter/Template/Grid/Renderer/Sender.php
app/code/core/Mage/Adminhtml/Block/Sales/Order/Grid.php
app/code/core/Mage/Adminhtml/Block/Sales/Order/View/Info.php
app/code/core/Mage/Adminhtml/Block/System/Store/Edit/Form.php
app/code/core/Mage/Adminhtml/Block/Tag/Assigned/Grid.php
app/code/core/Mage/Adminhtml/Block/Widget/Grid/Column/Renderer/Store.php
app/code/core/Mage/Adminhtml/Block/Widget/Tabs.php
app/code/core/Mage/Adminhtml/Model/Config/Data.php
app/code/core/Mage/Adminhtml/Model/System/Store.php
app/code/core/Mage/Adminhtml/controllers/Catalog/ProductController.php
app/code/core/Mage/Adminhtml/controllers/System/BackupController.php
app/code/core/Mage/Core/Model/Variable.php
app/code/core/Mage/Customer/etc/config.xml
app/code/core/Mage/Customer/sql/customer_setup/upgrade-1.6.2.0.5.1.1-1.6.2.0.5.1.2.php
app/code/core/Mage/Downloadable/etc/config.xml
app/code/core/Mage/Downloadable/etc/system.xml
app/code/core/Mage/Downloadable/sql/downloadable_setup/upgrade-1.6.0.0.2.1.1-1.6.0.0.2.1.2.php
app/code/core/Mage/ImportExport/Model/Import.php
app/code/core/Mage/ImportExport/Model/Import/Entity/Product.php
app/code/core/Mage/Shipping/Model/Info.php
app/code/core/Mage/Widget/controllers/Adminhtml/Widget/InstanceController.php
app/code/core/Mage/XmlConnect/Block/Adminhtml/Connect/Dashboard/StoreSwitcher.php
app/design/adminhtml/default/default/template/catalog/product/attribute/options.phtml
app/design/adminhtml/default/default/template/catalog/product/attribute/set/main.phtml
app/design/adminhtml/default/default/template/customer/tab/view.phtml
app/design/adminhtml/default/default/template/customer/tab/view/sales.phtml
app/design/adminhtml/default/default/template/dashboard/store/switcher.phtml
app/design/adminhtml/default/default/template/downloadable/product/composite/fieldset/downloadable.phtml
app/design/adminhtml/default/default/template/downloadable/product/edit/downloadable/links.phtml
app/design/adminhtml/default/default/template/downloadable/sales/items/column/downloadable/creditmemo/name.phtml
app/design/adminhtml/default/default/template/downloadable/sales/items/column/downloadable/invoice/name.phtml
app/design/adminhtml/default/default/template/downloadable/sales/items/column/downloadable/name.phtml
app/design/adminhtml/default/default/template/eav/attribute/options.phtml
app/design/adminhtml/default/default/template/newsletter/preview/store.phtml
app/design/adminhtml/default/default/template/report/store/switcher.phtml
app/design/adminhtml/default/default/template/sales/order/view/info.phtml
app/design/adminhtml/default/default/template/store/switcher.phtml
app/design/adminhtml/default/default/template/store/switcher/enhanced.phtml
app/design/adminhtml/default/default/template/system/convert/profile/wizard.phtml
app/design/adminhtml/default/default/template/tax/rate/title.phtml
app/design/adminhtml/default/default/template/widget/form/renderer/fieldset.phtml
app/locale/en_US/Mage_Catalog.csv
app/locale/en_US/Mage_ImportExport.csv
lib/Zend/Mail/Transport/Sendmail.php
To install the patch via FTP/File Upload
  • select patch bundle archive corresponding to your Magento version from the table below and unpack it
  • upload all files and folders to Magento root directory of your store, replacing all files
Note: If you previously applied v1 patch via file upload, you can simply upload v2 patch on top of it.
Magento versionSUPEE-10570v2
Magento 1.9.3.8SUPEE-10570v2-1.9.3.8
Magento 1.9.3.7SUPEE-10570v2-1.9.3.7
Magento 1.9.3.6SUPEE-10570v2-1.9.3.6
Magento 1.9.3.4SUPEE-10570v2-1.9.3.4
Magento 1.9.3.3SUPEE-10570v2-1.9.3.3
Magento 1.9.3.2SUPEE-10570v2-1.9.3.2
Magento 1.9.3.1SUPEE-10570v2-1.9.3.1
Magento 1.9.3.0SUPEE-10570v2-1.9.3.0
Magento 1.9.2.4SUPEE-10570v2-1.9.2.4
Magento 1.9.1.1SUPEE-10570v2-1.9.1.1
Magento 1.9.1.0SUPEE-10570v2-1.9.1.0
Magento 1.8.1.0SUPEE-10570v2-1.8.1.0
Magento 1.7.0.2SUPEE-10570v2-1.7.0.2
Downloads for other versions added to table on demand when we patch certain version via file upload for the first time.

Verification and flush of PHP opcode cache

Test that your store is working. If you use PHP opcode caches (APC/XCache/eAccelerator) make sure to flush it after patching (or restart webserver), otherwise code will continue to run from caches.

Known issues

Patch fails to apply while patching lib/Zend/Mail/Transport/Sendmail.php
Your Magento installation is likely patched previously with SUPEE-9652 v1 instead of SUPEE-9652 v2. The recommended solution is to revert patch SUPEE-9652v1 and apply SUPEE-9652v2 prior to applying SUPEE-10570.
HTML tags are not allowed in SKU attribute
HTML tags are not allowed in SKU attribute If you try to create or edit a product in the Admin panel and the product’s SKU attribute value contains HTML tags, Magento throws this error when you try to save the product: HTML tags are not allowed in SKU attribute. If you have any difficulties with applying the patches please let us know in comments, so we can find the solution together.

Comments

Archived discussion

  1. Charles
    hi Guys. links die. plz check again. Thanks
    1. Selvaganapathy Venkatesan
      Download it using UK proxy, it works!!
  2. ASM77
    1.9.3.1 version is coming?
    1. magentary
      Yes, you can download it from https://magentary.com/wph/c…
      1. ASM77
        Many Thanks!
  3. Rck
    What about 1.9.2.1?
  4. faisal
    links not working
  5. Ivan
    Hello, is coming patch for version 1.9.1.0? Thank you very much
    1. magentary
      JFYI, we have recently added http://magentary.com/wph/co…
  6. jordan
    1.9.0.1?
  7. Mara
    The result of Security Patch Tester is “Unknown, can not determine patch status.” Do I something wrong or can not test the Tester every file of the patch?
  8. Omar
    1.9.2.3 + 1.9.1.0 ?
  9. Selvaganapathy Venkatesan
    Can you please share the files for version 1.9.0.1 and also for 1.9.1.0 as well?
  10. scott
    Are you able to post 1.9.0.1
  11. Darren Kek
    Will there be 1.9.3.0? please?
    1. Andrey
      Yes, please. I also need the files for this version. It returns errors when apply with console.
  12. jj
    1.9.3.1 cant download already?
  13. Ivan Fencl
    Have a nice day Please, PATCH 10570 for version 1.9.2.1 Will it be available? Thank you very much. Best regards. Ivan
  14. Gio
    Hi, Magento just release the v2 of this patch for 1.7.0.2. Can you make available?
    1. magentary
      Yes, you can download it from https://magentary.com/wph/c…
  15. Henric Meyer
    Please, Patch for 1.9.2.2
  16. ASM77
    Wich file to install for 1.9.2.2?
  17. Alejandro Araujo
    Files for v1.5.1.0????? Please
  18. Marc
    I will be afraid if there is a download for 1.9.1.0. Thank you very much.
    1. magentary
      Yes, it is available from http://magentary.com/wph/co…
  19. sukh
    ZIP files are not accessible as it shows some issue with your Cloudflare Cache, Can you please check and fix