How to install SUPEE-9767 without SSH

Comments

Archived discussion

1. Anurag Khandelwal 2017-06-01
   which one should I follow for magento version 1.9.2.2? I guess it should be the one made for 1.9.2.4!
   1. Eddie May 2017-06-06
      From doing a filemerge & visual check between the patches for 1.9.2.1 & 1.9.2.4, it looks like the only differences between the two are in locale csv files where there are references to admin security hardening introduced after 1.9.2.2. Otherwise all the other files are identical apart from date differences in the copyright declaration.
      1. Anurag Khandelwal 2017-06-08
         Great thanks Eddie
2. Magee 2017-06-01

   Hello - can you please upload the fix for magento 1.6.2 ? and a question - do I need all other patches BEFORE using this one? Or is this an “independent” patch ?

   thank you very much for your service!

   1. magentary 2017-06-03
      File for 1.6.2.0 was just added to the table. And yes, there are lot of files changed, so there are common files with SUPEE-5344, SUPEE-5994, SUPEE-6285, SUPEE-6788, SUPEE-7405 and SUPEE-8788 - all these patches should be applied before SUPEE-9767.
3. Daniel 2017-06-01
   Hello - i’ve Magento 1.9.0.1 -> can i use one of your Patches yet?
   1. magentary 2017-06-03
      File for 1.9.0.1 was just added to the table
      1. Gaurav 2018-10-22
         hi, i don’t see the version 1.9.0.1 in the table. can i use SUPEE-9767v2-1.9.1.0 instead? nice work by the way, you are doing a great job! thank you
4. Scode 2017-06-02

   Thank you as always for the non-SSH patch installation help. This one seemed to go ok, however there is now this notice in the backend: “Formkey validation on checkout disabled. This may expose security risks. We strongly recommend to Enable Form Key Validation On Checkout in Admin / Security Section, for protect your own checkout process.”

   I get the feeling if I enable that in settings it might break our checkout process (did some googling), but if I don’t there may be a bigger security risk than what we just patched? Is it usual to set this after installing SUPEE-9767? Thanks again.

   1. magentary 2017-06-02

      It is safe to enable this option with default theme (rwd or base theme) or with any new theme that have form keys in checkout forms. If custom theme have no form_key inputs in checkout forms, it will be impossible to submit form / proceed with checkout as Magento will ignore any input from checkout without form keys. Patching custom theme is straightforward task, it is required to add form keys input (one line) in the following theme files (for 1.9.x): template/checkout/cart/shipping.phtml template/checkout/multishipping/billing.phtml template/checkout/multishipping/shipping.phtml template/checkout/multishipping/addresses.phtml template/checkout/onepage/billing.phtml template/checkout/onepage/payment.phtml template/checkout/onepage/shipping.phtml template/checkout/onepage/shipping_method.phtml template/persistent/checkout/onepage/billing.phtml

      If some files do not exist in the theme, it will use default ones, that are already patched by default.

      The option is created to protect from CSRF: Checkout functionality is vulnerable to cross-site request forgery attacks. These types of attacks are typically executed by phishing emails or pages that allow attackers to modify or harvest payment details.

      The line to add into template files is usually like the following:

      getBlockHtml('formkey') ?>
      1. Scode 2017-06-02

         How about the theme files locations for 1.7.0.2? Thanks again Magentary.

         Also - if I enable Form Key Validation to test if checkout process works, and it then doesn’t work, will disabling that setting then allow it to work again til I input the fix? Thanks.

         1. magentary 2017-06-03

            Yes, sure, it is possible to disable Form Key Validation for checkout again and it will work just like it was always disabled.

            For 1.7.0.2 the list of files is without addresses.phtml template: template/checkout/cart/shipping.phtml template/checkout/multishipping/billing.phtml template/checkout/multishipping/shipping.phtml template/checkout/onepage/billing.phtml template/checkout/onepage/payment.phtml template/checkout/onepage/shipping.phtml template/checkout/onepage/shipping_method.phtml template/persistent/checkout/onepage/billing.phtml

            You can see the list of template files patched in app/etc/applied.patches.list file when patch is applied.

      2. Vicky 2017-06-05
         Thank you for the above information. So if I understand correctly, if it doesn’t have that last line of code in one of the files listed above, then we need to add it ourselves?
5. YV 2017-06-04
   My custom theme use the path: “app/design/frontend/default/mytheme” and not “app/design/frontend/base/default”. The Form Key not work for this, only if I copy my custom theme to the folder “base”. How can I fix it in my “default” folder (path)? Magento version 1.7.0.2
6. Omar 2017-06-05
   Please upload for 1.9.2.0 also.
7. Omar 2017-06-05
   Please upload for 1.9.1.1 also
8. Sobana Devi 2017-06-05

   i have updated SUPEE-9767 patch in CE 1.9.3.2 through FTP. Everything works fine, except the confirmation mail for new account and new order. I m getting mail for “forget password” but not for new confirmation mail. But new account and orders are successfully updated in backend. Could you help me how could i trace and fix?

   Thank you

   1. Vicky 2017-06-05
      I can confirm that when I updated my theme files with getBlockHtml(‘formkey’) ?> I know don’t get email confirmations. I’m also on CE 1.9.3.2 and my theme has recently been updated but didn’t have the formkey in the forms.
   2. Sobana Devi 2017-06-07

      Confirmation mails are working now. just changed the app/code/core/Mage/Core/Model/Email/Template.php template.php (line number:424) from : if ($this->hasQueue() && $this->getQueue() instanceof Mage_Core_Model_Email_Queue) {

      to: if (!($this->hasQueue()) && $this->getQueue() instanceof Mage_Core_Model_Email_Queue) {

9. Stokes 2017-06-05
   Is there a reason why a patch for version 1.9.2.2 hasn’t been uploaded yet? I’ve noticed on other sites that they seem to skip right over it as well. Any info about this would be greatly appreciated. Thanks!
10. Nafiz 2017-06-06
    please upload 1.9.2.2
    1. Anurag Khandelwal 2017-06-08
       You can also follow the comments Eddie said on my same question for 1.9.2.2
11. sandy 2017-06-06
    Can you guys plz add for magento version 1.9.1.1 plzzzz
12. Stokes 2017-06-06

    So riddle me this…. I have uploaded all the new files in MY theme files and of course as well as the default just for the heck of it. When I log in to the backed of my store like I should I see up on the top the message “Important: Formkey validation on checkout disabled. This may expose security risks. We strongly recommend to Enable Form Key Validation On Checkout in Admin / Security Section, for protect your own checkout process.” Now when I go to the area to “Enable” this I don’t even see it there? What in the heck am I missing? I have ran my store through MageReport and it shows the Patch 9767 is installed so I would imagine I did all of it right. Any insight on this would be greatly appreciated. Thanks!

    P.S. I am running Magento 1.9.2.2 if that matters at all.

    1. Stokes 2017-06-07
       Replying to my own question. I got it to work finally. Problems with uploading files that I didn’t see upload. Once I went back through and checked everyone of them I cleared the cache and then it showed.
13. Anna Sarotsky 2017-06-06
    please upload for 1.9.2.3
    1. Omar 2017-07-05
       Did u install or still looking. if you found some where plz update here
       1. Anna Sarotsky 2017-07-06
          I’m still wating :(
14. Nancy 2017-06-09
    Are the files for 1.8.1 the same as the ones for 1.8.0.0? If not, can 1.8.0.0 be added? Please?
15. Anurag Khandelwal 2017-06-09

    @magentary:disqus I think for the version 1.9.2.2, you guys missed to add changes to this file “app/code/core/Mage/Customer/Model/Session.php”

    diff –git app/code/core/Mage/Customer/Model/Session.php app/code/core/Mage/Customer/Model/Session.php index 623fa39..b5e5eda 100644 — app/code/core/Mage/Customer/Model/Session.php +++ app/code/core/Mage/Customer/Model/Session.php @@ -222,6 +222,7 @@ class Mage_Customer_Model_Session extends Mage_Core_Model_Session_Abstract { $this->setCustomer($customer); $this->renewSession();

    • Mage::getSingleton(‘core/session’)->renewFormKey(); Mage::dispatchEvent(‘customer_login’, array(‘customer’=>$customer)); return $this; } @@ -307,6 +308,7 @@ class Mage_Customer_Model_Session extends Mage_Core_Model_Session_Abstract $this->setId(null); $this->setCustomerGroupId(Mage_Customer_Model_Group::NOT_LOGGED_IN_ID); $this->getCookie()->delete($this->getSessionName());
    • Mage::getSingleton(‘core/session’)->renewFormKey(); return $this; }

    Let me know if I am wrong!

    1. magentary 2017-06-09
       Patch bundle file for 1.9.2.2 contains the changes quoted. Make sure that you have uploaded all files.
       1. Anurag Khandelwal 2017-06-09

          okay I see, you should change this line in your blog “The following files are changed by SUPEE-9767 (v1 relased on May 31, 2017):” and should include also “app/code/core/Mage/Customer/Model/Session.php”

          While verifying, I made a mistake.

16. Murad Khan 2017-06-12
    Please upload for 1.5.1.0
17. Fayyaz Khattak 2017-06-13
    This helped me a lot. Thank you! :)
18. Best Bear 2017-06-13
    Hi Magentary. Just heard about a “SUPEE-8167” patch today which I don’t think I’ve seen covered here - “…new PayPal IPN server location… required to keep PayPal processing transactions past June 30, 2017.” Will you be advising on how to install without SSH? Thanks as always!
    1. magentary 2017-06-13
       Yes, sure, it is uploaded to https://magentary.com/kb/in…
19. Kirti Nariya 2017-06-14
    I have need to update SUPEE-9767 patch in Enterprise edition Magento ver. 1.14.2.4 and where to download SUPPEE-9767 for Enterprise edition
    1. magentary 2017-06-14
       You can download patches for EE from your account: log in to magento.com, in the left pane, click Downloads, in the right pane, click Magento Enterprise Edition, there should be all patches for your EE version.
       1. Kirti Nariya 2017-06-14
          Thanks Magentary!
20. PixieTom 2017-06-14
    this patch has introduced a bug with uploading transparent png’s in the cms. Transparent backgrounds are now not honoured - they are converted to black. Anyone else found this?
    1. Devlopment 2017-06-14

       app/code/core/Mage/Core/Model/File/Validator/Image.php

       public function validate($filePath) { list($imageWidth, $imageHeight, $fileType) = getimagesize($filePath); if ($fileType) { if ($this->isImageType($fileType)) { //replace tmp image with re-sampled copy to exclude images with malicious data $image = imagecreatefromstring(file_get_contents($filePath)); if ($image !== false) { $img = imagecreatetruecolor($imageWidth, $imageHeight); imagecopyresampled($img, $image, 0, 0, 0, 0, $imageWidth, $imageHeight, $imageWidth, $imageHeight); switch ($fileType) { case IMAGETYPE_GIF: imagegif($img, $filePath); break; case IMAGETYPE_JPEG: imagejpeg($img, $filePath, 100); break; case IMAGETYPE_PNG: imagepng($img, $filePath); break; default: return; } imagedestroy($img); imagedestroy($image); return null; } else { throw Mage::exception(‘Mage_Core’, Mage::helper(‘core’)->(‘Invalid image.’)); } } } throw Mage::exception(‘Mage_Core’, Mage::helper(‘core’)->(‘Invalid MIME type.’)); }

       Change to

       public function validate($filePath) { $fileInfo = getimagesize($filePath); if (is_array($fileInfo) and isset($fileInfo[2])) { if ($this->isImageType($fileInfo[2])) { return null; } } throw Mage::exception(‘Mage_Core’, Mage::helper(‘core’)->__(‘Invalid MIME type.’)); }

       1. PixieTom 2017-06-14
          Thanks, though that is just reverting it to how it was pre-patched. I’ve reported to Magento to release an update.
21. Dan Vince 2017-06-14
    Request for 1.9.2.3 please :)
    1. Omar 2017-07-05
       Did u have please update here also
22. zakir 2017-06-15
    Please upload for 1.6.1.0
23. Alia 2017-06-15
    please upload for 1.9.2.3 magento
24. Tere 2017-06-21
    Please… for Magento 1.5.1.0? :(
    1. magentary 2017-06-22
       1.5.1.0 was just added to the table: https://magentary.com/wph/c…
25. Rohit 2017-06-26
    can you please tell us how we will patch the third party checkout extension. The file are for magento core module.
26. Purushotam Sharma 2017-07-04

    After upload the SUPEE-9767 in 1.8.1.0, I am getting below error:- Fatal error: Call to a member function getRedirectUrl() on a non-object in /app/code/core/Mage/Admin/Model/Session.php on line 130 when you refresh again on this stage, you can able to see the dashboard.

    if any one have idea please share.

27. Allen 2017-07-14
    Can you please upload the patched version 2 for Mangeto 1.9.0.1 and 1.6.2.0 Thanks
28. Sunil Poonia 2017-07-15
    please upload for 1.9.0.1 magento
    1. Gaurav 2018-10-22
       did you get for 1.9.0.1 ?
29. b7itzz 2017-07-17

    After installing the patch, we started getting the error below when the customer logs out of their account.

    Invalid method Mage_Core_Model_Session::renewFormKey(Array ( ) )

    Trace: #0 /app/code/core/Mage/Customer/Model/Session.php(311): Varien_Object->__call(‘renewFormKey’, Array) #1 app/code/core/Mage/Customer/Model/Session.php(311): Mage_Core_Model_Session->renewFormKey() #2 app/code/core/Mage/Customer/Model/Session.php(255): Mage_Customer_Model_Session->_logout() #3 /app/code/core/Mage/Customer/controllers/AccountController.php(236): Mage_Customer_Model_Session->logout() #4 /app/code/core/Mage/Core/Controller/Varien/Action.php(418): Mage_Customer_AccountController->logoutAction() #5 /app/code/core/Mage/Core/Controller/Varien/Router/Standard.php(254): Mage_Core_Controller_Varien_Action->dispatch(’logout’) #6 /app/code/core/Mage/Core/Controller/Varien/Front.php(172): Mage_Core_Controller_Varien_Router_Standard->match(Object(Mage_Core_Controller_Request_Http)) #7 /app/code/core/Mage/Core/Model/App.php(365): Mage_Core_Controller_Varien_Front->dispatch() #8 /app/Mage.php(1367): Mage_Core_Model_App->run(Array) #9 /index.php(84): Mage::run(’’, ‘store’) #10 {main}

    1. magentary 2017-07-18

       There are two possible causes of this error:

       1. patch was applied incompletely or OPcode cache was not flushed
       2. there are local overrides either in code/local/Mage or in one of extensions that rewrites Mage_Core_Model_Session

       To solve it, corresponding override should be patched as well with adding renewFormKey method and OPcode cache should be flushed.

30. Toyin Etiko 2017-07-17
    Could you please upload or let us know when you would upload the patch for 1.9.0.1? Thank you
31. Airsea 2017-07-19
    Dear Magentary, first of all, we want to thank you for the excellent contribution given to the community, by providing the patch bundle archive, to install the patches via FTP/File Upload. Please we would like you to provide zip of supee patch - 9767 v2 for Magento version 1.8.1.0. Thanks !
    1. magentary 2017-07-26
       Thank you for your warm words, 9767v2 for 1.8.1.0 was recently added to the table: http://magentary.com/wph/co…
32. Geesala Siva 2017-07-20
    after installing the 9767 v2 patch ,shipping method is not working ,and i was unable to proceed to check out .
    1. magentary 2017-07-20
       You may need to patch theme template files as described in “Enable Form Key Validation On Checkout (optional)” section above.
33. John Elenko 2017-07-26
    9767 v2 for Magento ver. 1.8.1.0. https://drive.google.com/fi… Tested
    1. magentary 2017-07-26
       Please note, that ZIP file above does not revert changes in app/code/core/Mage/Tax/Model/Resource/Calculation.php app/code/core/Mage/Tax/Model/Calculation.php patched in v1 and skipped in v2.
34. magentary 2017-07-26
    SUPEE-9767v2 for 1.8.1.0 was recently added to download table
35. Krishna 2017-09-18
    I had Image Upload problem for product after installing patch SUPEE-9767v2-1.9.2.2. can anyone help me out …please
36. Laura 2017-09-18
    Hi, we’re still on 1.9.0.1 - are any of these versions suitable for us to use? Thanks!
    1. Gaurav 2018-10-22
       hi, did you get for 1.9.0.1 ?
37. EspertoMagento.it 2017-09-20
    9767 v2 for Magento ver. 1.9.0.1? I can use 1.9.1.0? Thanks
    1. Tom 2017-12-19
       This solution works for you ? Thx !
       1. EspertoMagento.it 2018-01-18
          I haven’t try it yet.
    2. Gaurav 2018-10-22
       did you try? have you used 1.9.1.0 instead of 1.9.0.1 ? did it work?
38. Jae Peat 2017-09-27
    Hi, I am using 1.9.3.2 and I followed the steps and added all of the files via cpanel FTP. After a scan using magreport.com its showing that the patch is not installed. I have successful added the security patch 10266 before this so I am not sure if this could be the reason. I doubled checked that I had uploaded every file one by one and all have been added. Thanks, Jae
39. Alejandro Araujo 2018-04-16
    Files for v1.5.1.0??? PLEASE