How to install SUPEE-6285 without SSH

Note: This article describes a high-risk historical Magento 1 workaround. Do not upload an old prepared fileset to a current production store. Prefer a controlled upgrade to current OpenMage and validate the full security patch history.

SUPEE-6285 was released for Magento Community Edition in July 2015. The original article offered prepared patched files for stores without shell access. This conversion preserves the workflow and its constraints, but deliberately does not republish those version-specific archives as current downloads.

Why the no-shell method is different

The original patch was a shell script that changed a defined set of core files. Without shell access, an administrator had to apply it to a clean copy of the exact Magento release elsewhere, then upload the resulting files through SFTP or a hosting file manager.

That approach replaces complete files. It can overwrite local core edits and can combine incompatible code if the source release, prior patches or edition do not match. SUPEE-6285 also historically depended on earlier security work, including SUPEE-5994; the original prepared sets were not independent patches.

Preconditions

Identify the exact Magento edition and version.
Inventory prior patches and all core modifications.
Create recoverable database and file backups.
Prepare the patched files from a trusted patch source in an isolated copy of that exact release.
Compare every replacement against the production file before upload.
Rehearse deployment and rollback outside production.

Do not rely on the old downloadable ZIP names alone to establish compatibility.

Disable compilation

Disable Magento compilation before replacing application files and clear the compiled tree. The original admin location is illustrated below.

Disabling Magento Compiler in the Magento 1 admin — Magento 1 compilation controls. Select the image to open the original size.

Where shell access exists in a preparation environment, the historical command sequence is:

$ php -f shell/compiler.php -- state
Compiler Status:          Enabled
Compilation State:        Compiled
$ php -f shell/compiler.php -- disable
Compiler include path disabled
$ php -f shell/compiler.php -- clear
Compilation successfully cleared

When the production host has no shell, the compiler state and compiled files must be handled through the admin and file-management facilities available on that host.

Prepare and compare the fileset

Apply the correct patch chain to a clean reference tree, then compare it with the deployed application. A local comparison makes unexpected customizations visible before any upload:

$ diff -ruN clean-magento/ patched-magento/
$ diff -ruN production-copy/ patched-magento/

Resolve differences deliberately. Never replace a customized core file without porting and reviewing the customization, and never upload files prepared for a different Magento version.

Upload and verify

Use a maintenance window and upload only the reviewed changed paths, preserving their directory structure and permissions. Then clear Magento caches and the PHP opcode cache using the controls available from the hosting platform.

Verify at minimum:

storefront and admin authentication;
customer account and password flows;
cart, checkout and the configured payment methods;
API and integration endpoints;
cron and queues used by the store;
application, PHP and web-server logs.

If any check fails, restore the known-good files and database state before attempting ad-hoc repairs in production.

Comments

Archived discussion

Frederik 2015-07-07

Thank you, you’re ready-made patches are always a great help with servers which have no SSH access or missing patch tools!
Peter Vowels 2015-07-07

I would like to thank you as well. What you do is a godsend …
Cristian 2015-07-08

Can you please post the patch for version 1.6 please?
1. Mage 1.6.2 User 2015-07-08
  
  Yes please - I second that!
  
  Apart from that - thank you again for supplying the patch(ed) files!
  
  Regards from Switzerland
  1. magentary 2015-07-08
    
    Thank you for the feedback, I’ve just added 1.6.2 to the table: http://magentary.com/wph/co…
    1. Cristian 2015-07-08
      
      Thank you can I install 1.6.2 on 1.6.1?
    2. Mage 1.6.2 User 2015-07-08
      
      Merci!! :-)
    3. Cristian 2015-07-09
      
      Thank you can I install 1.6.2 on 1.6.1?
    4. Cristian 2015-07-11
      
      Can I install 1.6.2 on 1.6.1?
Verner 2015-07-08

Thank you! Can you please also provide the patch for 1.8.0.0 release?
Mark 2015-07-08

Hi, Can someone help with the following

/var/www$ sh ./PATCH_SUPEE-6285_CE_1.8.1.0…

./PATCH_SUPEE-6285_CE_1.8.1.0…: 14: ./PATCH_SUPEE-6285_CE_1.8.1.0…: 127: not found

./PATCH_SUPEE-6285_CE_1.8.1.0…: 14: ./PATCH_SUPEE-6285_CE_1.8.1.0…: 127: not found

./PATCH_SUPEE-6285_CE_1.8.1.0…: 25: ./PATCH_SUPEE-6285_CE_1.8.1.0…: 0: not found

Checking if patch can be applied/reverted successfully…

-e ERROR: Patch can’t be applied/reverted successfully.

I also had two files fail

patching file app/design/frontend/base/default/template/checkout/cart.phtml

Hunk #1 FAILED at 98.

1 out of 1 hunk FAILED – saving rejects to file app/design/frontend/base/default/template/checkout/cart.phtml.rej

atching file downloader/Maged/Controller.php

Hunk #4 succeeded at 451 (offset -5 lines).

Hunk #5 FAILED at 1120.

1 out of 5 hunks FAILED – saving rejects to file downloader/Maged/Controller.php.rej

I have manually installed the 2 files and now get

patching file app/design/frontend/base/default/template/checkout/cart.phtml

Reversed (or previously applied) patch detected! Assume -R? [n]

Apply anyway? [n]

Skipping patch.

1 out of 1 hunk ignored – saving rejects to file app/design/frontend/base/default/template/checkout/cart.phtml.rej

Skipping patch.

1 out of 1 hunk ignored – saving rejects to file app/design/frontend/base/default/template/checkout/cart.phtml.rej

patching file downloader/Maged/Controller.php

Reversed (or previously applied) patch detected! Assume -R? [n]

Apply anyway? [n]

Skipping patch.

5 out of 5 hunks ignored – saving rejects to file downloader/Maged/Controller.php.rej
1. Mark 2015-07-08
  
  processed manually thanks to the manual file above thanks
Ton de Visser 2015-07-08

Thanks again, the patch works great again. Just tried to update from 1.9.1.0 to 1.9.2.0 but that wasn’t a great idea, luckely my back-up worked and with your patch everything running smooth again.
muzafar 2015-07-08

Thank you! Can you please provide this patch for 1.8.0.0 release?
Sam 2015-07-08

Hi guys, great work!

Can you guys post the patch for version 1.9.0.1? (Or would 1.9.1.0 - 1.9.1.1 fall under this?)

Thanks
1. Thomas 2015-07-08
  
  Yes please 1.9.0.1 seconded, Thank you!
2. magentary 2015-07-08
  
  1.9.0.1 require separate fileset, it has been added to the table.
Ahmed Tushar 2015-07-08

Thanks for great work again! Which zip file i will use for version 1.9.0.1? you didn’t mention 1.9.0.1 in Magento version.
Steve 2015-07-08

Any chance for 1.5.0.1 please? I would massively appreciate it!!! Many thanks
1. magentary 2015-07-08
  
  The patch was not backported yet to 1.4-1.5 version, hope we see it a bit later.
2. magentary 2015-07-18
  
  jfyi: 1.5.0.1 was just added to the table - http://magentary.com/wph/co…
vinod khajja 2015-07-10

Please provide patches for Magento community edition ver. 1.5.1.0 . Many Thanks
Gary 2015-07-10

I installed the patch 6285 two days ago and got the email from magento today to revert the patch and install v2. problem is i don’t have shh access to i used the zip file. Do i really need to revert the previous version of can i simply download the file and upload the following directory

app/design/frontend/rwd/default/template/checkout/cart.phtml Thanks a mill!!
1. magentary 2015-07-10
  
  It should be sufficient to upload app/design/frontend/rwd/default/template/checkout/cart.phtml on top of it, there only changes in v2 are in this file. Btw, the download table is updated to v2 versions.
  1. Gary 2015-07-10
    
    Wow thanks for getting back to me so quickly. So I might as well just re-upload the entire v2 file? forgive my ignorance but what is ’the download table'?
    1. magentary 2015-07-10
      
      Yes, you can re-upload the whole v2 fileset if needed, all links in the article are up to date. The download table I was referring to is just a table in the article above with links to zipped filesets: http://magentary.com/kb/ins…
      1. Gary 2015-07-10
        
        Sorry blond moment… great did it there and all worked smoothly. Thanks so much!!
vinod khajja 2015-07-13

Any chance for 1.5.0.1 please? ! Many thanks
jewel 2015-07-13

Hi there, i added the files and now can’t get into my admin page. I get this message instead

Front controller reached 100 router match iterations

and get 4 lines of errors underneath. Please help if you can. I applied the previous patches with no problem.
Rajnish Malakar 2015-07-15

Could you please provides us Patch for 1.8.0.0 And 1.6.1.0
algodat 2015-07-17

Is there a chance to test, if the patch was sucessful ?
aln85 2015-07-17

I need to patch version 1.7.0.0 will the 1.7.0.2 patch cover this?
1. adam688 2016-02-02
  
  Did you try it out? Any result? It seems it is not working for us.
resende99 2015-07-20

Amazing job! Can we use SUPEE-6285-1.6.2 for Magento 1.6.1?
Prabu Prasath 2015-07-23

Hi please provide patch file for Magento version 1.14.0.1
1. magentary 2015-07-23
  
  For EE versions please contact your Magento representatives
Dan Vince 2015-08-11

hi any chance of getting this for 1.6.1.0?
1. resende99 2015-09-23
  
  The 1.6.2.0 pack seems to be working just fine for 1.6.1.0 as well.
Peter 2015-08-18

Great Work! Is it possible for get a patch for 1.8.0.0?
Daniel C 2015-10-02

Hello,

Thank you for all the PATCHES in the first place!

Magento ver. 1.8.1.0

I installed all the PATCHES about 3 weeks ago, and now in the admin backend the CMS > STATIC BLOCKS and PAGES looks something like this only when I access a page or a static block to modify: http://screencast.com/t/Vur… Any idea of what cause this? Maybe the modifications below?

app/code/core/Mage/Adminhtml/controllers/Cms/Block/WidgetController.php

app/code/core/Mage/Adminhtml/controllers/Cms/Page/WidgetController.php

app/code/core/Mage/Adminhtml/controllers/Cms/PageController.php

app/code/core/Mage/Adminhtml/controllers/Cms/WysiwygController.php

Thanks in advance!
1. magentary 2015-10-02
  
  I would suggest to check PHP error log files for fatal PHP errors, as it looks like pages are just not finished on generation by PHP engine due to some reason (fatal errors, memory shortage, syntax error in PHP code). The PHP error log should give exact reason. As for the patches relation, it depends on implementation. The patches itself can not cause it, only if some files were not copied, or there are core class overrides in code of extensions or local code pool, or compiler cache was not cleared.
  1. Daniel C 2015-10-02
    Thank you for fast reply!
    
    Compiler is DISABLE chace Cleared many times.
    
    Only error I got is this
    
    [02-Oct-2015 06:17:02 UTC] PHP Fatal error: Class ‘Varien_Data_Collection_Filesystem’ not found in /public_html/app/code/core/Mage/Widget/Model/Widget/Config.php on line 85
    
    and on line 85 its says something like:
    - Return list of existing widget image placeholders
    - @return array */ public function getAvailablePlaceholderFilenames() { $result = array(); $targetDir = $this->getPlaceholderImagesBaseDir(); if (is_dir($targetDir) && is_readable($targetDir)) { $collection = new Varien_Data_Collection_Filesystem(); <——– LINE 85 $collection->addTargetDir($targetDir) ->setCollectDirs(false) ->setCollectFiles(true) ->setCollectRecursively(false); foreach ($collection as $file) { $result[] = $file->getBasename(); } }
    return $result; }
    1. Daniel C 2015-10-02
      
      Another error in the system.log is:
      
      2015-10-02T06:17:02+00:00 ERR (3): Warning: include(Varien/Data/Collection/Filesystem.php): failed to open stream: No such file or directory in public_html/lib/Varien/Autoload.php on line 93 2015-10-02T06:17:02+00:00 ERR (3): Warning: include(): Failed opening ‘Varien/Data/Collection/Filesystem.php’ for inclusion (include_path=‘public_html/app/code/local:public_html/app/code/community:public_html/app/code/core:/public_html/lib:.:/usr/lib/php:/usr/local/lib/php’) in /public_html/lib/Varien/Autoload.php on line 93
      1. magentary 2015-10-02
        
        according to the log it can not find /lib/Varien/Data/Collection/Filesystem.php file
        
        Daniel C 2015-10-02
        
        Thank you man for open my eyes :). I am not a coder and don’t know much about coding.
        
        I checked that path and yes, that filesystem.php was not there, but it was filesystem.php.suspected . I don’t know how that file end up there. I uploaded a clean Filesystem.php and now everything is fine, I can see all the data on on CMS> Pages and Static Blocks content. Now, I don’t know if I have to delete that filesystem.php.suspected , what do you recommend?
        
        Thanks again for the infos you provide us!
Anurag Khandelwal 2015-12-22
Those who are asking for this patch for magento v1.8.0.0, Take the patch for magento v1.8.1.0 and do not include these files:
1. downloader/Maged/Controller.php
2. downloader/Maged/Model/Session.php
3. downloader/template/connect/packages.phtml
4. downloader/template/connect/packages_prepare.phtml
5. downloader/template/login.phtml
6. downloader/template/settings.phtml
1. Ashwani 2016-10-19
  
  But these files does not present in magento v1.8.1.0 patch. Please suggest.
  1. Anurag Khandelwal 2016-10-19
    
    You have mistaken man, those files mentioned are present in bare magento 1.8.1.0. Please check again
adam688 2016-02-01

Thanks for your great work. Can I install patch 1.7.0.2 on 1.7.0.0 ? Also Can I install patch 1.7.0.2 on 1.7.0.1 ?

Also we can not upgrade our Magento higher version, due to the high risk. Pls help us out here, thanks for your support.
Rob Rasmussen 2016-02-22

Any chance of 1.6.0.0? Pretty please? :-)