MagentaryMagento & OpenMage Maintenance, Upgrades and Rescue

Technical resource

How to install SUPEE-8167 without SSH

Published
Last reviewed
Note: This is a historical reference, not a current security baseline. Magento 1 is end-of-life.
SUPEE-8167: New Patch for PayPal Instant Payment Notification (IPN) Changes. Upgrade to 1.9.3.3 or SUPEE-8167 by June 30, 2017 to Avoid Service Disruptions – 6/13/2017 As of June 30, 2017, PayPal Instant Payment Notifications will no longer allow you to use HTTP to post messages back to PayPal for verification. To comply with these changes, all merchants using PayPal must upgrade to Community Edition 1.9.3.3 or apply the SUPEE-8167 patch. Updates must be in place by June 30, 2017 to avoid any service disruptions.
If you have SSH access, it would be more simple to apply the patch via SSH. If you have no SSH access to apply the patch, you can simply upgrade your installation to Magento 1.9.3.3 version which includes all the latest security patches (SUPEE-5344, SUPEE-5994, SUPEE-6285, SUPEE-6482, SUPEE-6788, SUPEE-7405, SUPEE-8788, SUPEE-9652, SUPEE-9767). If Magento upgrade is not possible in the moment due to some reason you still can apply the patch via FTP/sFTP upload as shown in this article. If you wish to save time and have us to install these patches for you, simply click here to order installation.  

Preparations

 

Applying Magento patches via FTP/sFTP or FileManager / File Upload

To apply patches in this way we simply replace changed files. This way can not be used blindly if you or your developers have changed any core Magento files. Such changes should be re-applied to patched files, or you loose these changes.
Note: To the moment, the patch have no any dependencies and can be installed any time with any set of installed patches or without any patches.
The following file is changed by SUPEE-8167: 
app/code/core/Mage/Paypal/Model/Ipn.php
  To install the patch via FTP/File Upload
  • select patch bundle archive corresponding to your Magento version from the table below and unpack it
  • upload all files and folders to Magento root directory of your store, replacing all files
Magento versionSUPEE-8167
1.9.3.2SUPEE-8167-1.9.3.2
1.9.3.1SUPEE-8167-1.9.3.1
1.9.3.0SUPEE-8167-1.9.3.0
1.9.2.4SUPEE-8167-1.9.2.4
1.9.2.3SUPEE-8167-1.9.2.3
1.9.2.2SUPEE-8167-1.9.2.2
1.9.2.1SUPEE-8167-1.9.2.1
1.9.2.0SUPEE-8167-1.9.2.0
1.9.1.1SUPEE-8167-1.9.1.1
1.9.1.0SUPEE-8167-1.9.1.0
1.9.0.1SUPEE-8167-1.9.0.1
1.8.1.0SUPEE-8167-1.8.1.0
1.7.0.2SUPEE-8167-1.7.0.2
1.6.2.0SUPEE-8167-1.6.2.0
1.6.1.0SUPEE-8167-1.6.1.0
1.5.1.0SUPEE-8167-1.5.1.0
1.5.0.1SUPEE-8167-1.5.0.1
1.4.2.0SUPEE-8167-1.4.2.0
1.4.1.1SUPEE-8167-1.4.1.1
Downloads for other versions added to table on demand when we patch certain version via file upload for the first time.  

Check if your cURL PHP library have TLS1.2

PayPal switching to TLS1.2 only on June 30, so it is important to verify that your Magento still will be able to connect to PayPal. Navigate to PayPal payment settings page in Backend and check if you have warnings as described in
cURL php5 module update in Magento for PayPal changes by June 30th, 2017  

Verification and flush of Magento PHP opcode cache

Flush Magento cache: Navigate in Magento backend to System > Cache Management and click on Flush cache button. If you use PHP opcode caches (OPCache/APC/XCache/eAccelerator) make sure to flush it after patching (or restart webserver), otherwise code will continue to run from caches. Test that your store is working. If you have any difficulties with applying the patches please let us know in comments, so we can find the solution together.

Comments

Archived discussion

  1. Kingdom Amalur
    Any patches available for Magento ver. 1.9.0.1?
  2. Tejas Khamar
    Where is patches files for magento ver. 1.9.0.1?
  3. Ramkishan Suthar
    Popup is still showing when we logged in backend even after flushing cache many times and also checked it in incognito tab, What should I need to do.
    1. magentary
      Popup comes from Magento news feed, it shows any unread Magento news. As notification about the patch is the latest unread notification in your feed, it is shown until you mark it as read. You can do it at Notifications index page.
      1. Ramkishan Suthar
        Thank you @magentary:disqus I got it, Your post is very helpful.
  4. Simo
    Where is patches files for magento ver. 1.6.x?
  5. Scode
    Thank you for 1.7.0.2 upload, keep up the good work
  6. chungyan kwan
    Thank you so much for your work. It is very helpful~!
  7. Dominique T.
    Is there a patch for version 1.4.1.1?
  8. Murad Khan
    patch for 1.5.1.0 :)
  9. Brad

    Please… Magento ver. 1.9.0.1 Or will one of the other patches work?

    Thanks :)

  10. Ashwani
    1.9.0.1?
  11. zakir
    Please upload patch 8167 for 1.6.1.0
  12. Bordo
    Will the patch for 1.9.0.1 be available?Thanks!
  13. Peter Draper
    Is there a patch for 1.9.2.0 please?
  14. Aurel
    Hello, because there is no 1.9.0.1 version I run the patch as a php script because I have no ssh and it said “Done” (nothing else, maybe it was too fast). How can I check if everything worked? If I check the last edited time stamp on the ftp server in /htdocs/app/code/core/Mage/Paypal/Model/Ipn.php it still gives me a old date (january 2017)
  15. Murad Khan
    Please upload patch 8167 for 1.5.1.0
  16. Christian
    Hi there. Great work! Is there any chance to have this patch for 1.9.0.1? Or would one of these patches listed above work for 1.9.0.1 as well? Thank you!
  17. Christian
    7 out of 16 posts are requests for 1.9.0.1. Just saying :-)
  18. Oscar Laverde
    Please upload patch 8167 for 1.6.2.0
  19. Thank you
    Hello, thanks for sharing. How can it be verified that everything worked after upping it to ftp?
  20. Mind_is_Matter
    I downloaded this patch for 1.5.1.0 however, after unzipping the archive, the file (ipn.php) shows to have been modified in April of 2011, how is this a recent patch then? Thanks.
  21. Liam
    Updated for 1.9.3.1 and now IPN is no longer working at all. Order status left as Pending Payment instead of processing. Any ideas why this would happen? Was working fine in previous version.
    1. magentary
      After patch it works over HTTPS only, so you may need to check if your curl PHP module works over HTTPS, you can find sample code in https://magentary.com/kb/cu…
  22. Martin
    Could you please upload patch 8167 for 1.4.2.0? Thank you!
    1. Martin
      Is there anybody who has the patch for magento 1.4.2.0?
      1. magentary
        You can download it from https://magentary.com/wph/c…
        1. Martin
          Thank you so much!
  23. Matt
    Is there a patch for 1.4.0.1? Thanks for the help!
  24. Brad
    Thank you so much for providing this service! It is greatly appreciated.
  25. Michael
    hi can i use the 1.7.0.2 on version 1.7.0.1? if not can we get a patch for 1.7.0.1?
    1. magentary
      The only difference between 1.7.0.2 and 1.7.0.1 is one critical security fix, so yes, it is possible to use files from 1.7.0.2 for 1.7.0.1. Please note though, that 1.7.0.1 is vulnerable and there are public exploits available with full takeover, so it is recommended to update it up to 1.7.0.2 at least.
  26. Chirag Dodia
    After installing this patch on magento version 1.9.0.1 facing redirect problem in paypal express checkout. Order went through the system successfully but on frontside after placing order it is redirect to cart page and giving error “unable to initialize express checkout” any solutions?
  27. Ivan
    I’m using Magento 1.9.1 but i don’t use IPN feature. Do i need to patch my Magento web site with SUPEE-8167?