Technical resource
How to install SUPEE-5994 without SSH
Note: This is a historical reference, not a current security baseline. Magento 1 is end-of-life.
UPDATE: July 7, 2015: New Magento Security Patch (SUPEE-6285), save time on installing both SUPEE-5994 and SUPEE-6285 at once as shown in SUPEE-6285 & SUPEE-5994 installation without SSH.According to announce sent on May 15, 2015 to all Magento installations new security patch SUPEE-5994 should be installed in addition to two recent shoplift patches (SUPEE-5344 and SUPEE-1533).
Important: New Magento Security Patch – Install it Now It is important for you to download and install a new security patch (SUPEE-5994) from the Magento Community Edition download page https://magento.com/tech-resources/download. Please apply this critical update immediately to help protect your site from exposure to multiple security vulnerabilities impacting all versions of the Magento Community Edition software. Please note that this patch should be installed in addition to the recent Shoplift patch (SUPEE-5344).The only problem with these patches is SSH requirement, which some hosts do not provide. If you have SSH access, you can install patches as shown in How to install SUPEE-5994. It is still possible to apply the patch even without SSH via FTP/sFTP or direct execution via PHP as shown below in this article. If you wish to save time and have us to install all these patches for you, simply click here to order installation. If you have any difficulties with applying the patches please let us know in comments, so we can find the solution together. Before patching make sure to Disable Magento Compiler if you use it at System > Configuration > Tools > Compilation and clear compiled cache.
Applying Magento patches via FTP/sFTP or FileManager / File Upload
To apply patches in this way we simply replace changed files. This way can not be used blindly if you or your developers have changed any core Magento files (which is a big no-no, by the way). Such changes should be re-applied to patched files, or you loose these changes. Patch SUPEE-5994 (Magento 1.6.x.x-1.9.1.1) applied to the following files:- app/code/core/Mage/Authorizenet/controllers/Directpost/PaymentController.php
- app/code/core/Mage/Core/Controller/Varien/Router/Admin.php
- app/code/core/Mage/Core/Controller/Varien/Router/Standard.php
- app/code/core/Mage/Customer/Model/Customer.php
- app/code/core/Mage/Dataflow/Model/Convert/Parser/Csv.php
- app/code/core/Mage/ImportExport/Model/Export/Adapter/Csv.php
- app/code/core/Mage/Install/Controller/Router/Install.php
- app/code/core/Mage/Install/etc/config.xml
- app/code/core/Mage/Sales/controllers/Recurring/ProfileController.php
- downloader/Maged/Model/Connect.php
- downloader/Maged/View.php
- downloader/template/connect/packages_prepare.phtml
- downloader/template/messages.phtml
- get.php
- lib/PEAR/PEAR/PEAR.php
- lib/PEAR/PEAR/PEAR5.php
- lib/Varien/Io/File.php
get.php file into your Magento root directory.
Patch for other versions
Older versions are patched in the same way, I am adding downloads for other versions into a single table on demand when I need to patch certain version:| Magento version | SUPEE-5994 |
|---|---|
| Magento 1.9.1.0-1.9.1.1 | SUPEE-5994-1.9.1 |
| Magento 1.9.0.1 | SUPEE-5994-1.9.0.1 |
| Magento 1.8.1.0 | SUPEE-5994-1.8.1 |
| Magento 1.7.0.2 | SUPEE-5994-1.7.0.2 |
| Magento 1.6.1.0-1.6.2.0 | SUPEE-5994-1.6 |
| Magento 1.5.1.0 | SUPEE-5994-1.5.1 |
| Magento 1.4.2.0 | SUPEE-5994-1.4.2 |
| Magento 1.4.1.0-1.4.1.1 | SUPEE-5994-1.4.1 |
Verification
Verify patch status at our patch tester page. If you use PHP opcode caches (APC/XCache/eAccelerator) make sure to flush it after patching, otherwise code will continue to run from caches. Additionally, if your store still using default/admin/ path, you may consider securing your Magento /admin/ by admin path change and restrict access to /downloader/.
Done.
If you have any difficulties with applying the patches please let us know in comments, so we can find the solution together.
Comments
Archived discussion
Thanx a lot You are awesome as usual !!
I use Magento 1.9. The only problem that I encountered was in the path: app/code/core/Mage/Install/Controller/Router/Install.php In my directory it looks like: app/code/core/Mage/Install/Controller/Action.php
I don’t know if this is only in my directory or you made a mistake. any idea?
Great Thanks a lot .. It solves the problem
Keeeeeeeeep up the good work
Fatal error: Class ‘Mage_Install_Controller_Router_Install’ not found in /home/x/public_html/includes/src/__default.php on line 17982
After uploading your files :S already cleaned cache, etc via sh
1.9.1.1
Nope, it was disabled, and also same when i tried again after reuploading all files fres, reinstalled twice now, happens after flushing magento storage,
Tried third time, now error appeared after i reenabled compiler, this happens when i upload install folder.
Had the same problem, check if you successfully uploaded app\code\core\Mage\Install\Controller\Router\Install.php If not, you are probably also missing
lib\PEAR\PEAR\PEAR5.php
Both files are new files.
I uploaded the files, shop looks ok.
Where can I check if patch is successfully installed an registered?
This is the problem to me. After this mistake, I did:
Problem is, anytime now I disable or run compilation process again, Magento dies
Any suggest to repair this problem? thanks a lot!
PHP Fatal error: Class ‘Mage_Core_Controller_Varien_Router_Admin’ not found in ./app/code/core/Mage/Core/Controller/Varien/Front.php on line 138
Like above a lot of complain class is not found.
Appreciate your help, it looks I am in a very bad situation, two problems.
even I delete the folder ‘includes’ and then create a new folder and empty config.php, them compile and enable it, it still says: Compiler Status: Disabled <—- never change to enable :( Compilation State: Compiled Collected Files Count: 8780 Compiled Scopes Count: 4
under ./app/code/local there is no folder named Mage, are your refer to “./app/code/core/Mage/Core” instead of “./app/code/local/Mage/Core”. Or, my system is heavily damaged by the template.
Thanks a lot your help, great work, helped a lot. A quick feedback for others:
my first problem of not able to change the disable state is because, I create a new empty includes/config.php which is not correct, must use an original one, which has basically 3 lines there. google ‘magento compilation state can’t enable’
my second issue, indeed is a permission issue.
Glad to chose Magento, and even better have you all. Thanks,
One more thing I found, that when run “# php shell/compiler.php – enable” it always says: Compiler Status: Disabled Compilation State: Compiled Collected Files Count: 8780 Compiled Scopes Count: 4
The Compiler Status always be Disabled, I run “php shell/compiler.php – enable” a few times, even tried option in order like: –disable –clear –compile –enable
For ppl having issue with mage error, use this, helped for me
http://magento.stackexchang…)
I have add this patch for magento 1.9.0.1. customer registration time generate error :
customer registration error “Please make sure your password match”. now i have change Mage/Customer/Model/Customer.php line no 844
$confirmation = $this->getPasswordConfirmation(); to $confirmation = $this->getConfirmation();
so this one right for code change ? thanks
You found a solution or this and the best solution? That and the right thing to do?
Abraços,
WHY?
Fatal error: Class ‘Mage_Install_Controller_Router_Install’ not found in/home/onesma6/public_html/includes/src/__default.php on line 17475 Please Help me urgent
Hi,
First like to say thank you for the good work. My webshop is 1.7.0.2. But after I applied the patch and when I clicked in the catalog > manage products is going to 404 page. Any help really appreciate.
Hi,
Can you upload files for SUPEE-5994 to magento 1.8.0.0? Or can I just use these 1.8.1.0 files?
Thanks.
Magento didn’t just release a single version. The programmatic patches can patch a range of magneto versions, so they were able to release fewer versions of the patch files, but they still had to release several versions.
Each version of Magento has differences in its code and the files being patched.
A patch file programmatically patches the various magento files based on diffs, it finds the code in the file to replace with the new code regardless of location of that code within the file. Even so Magento released several versions of the patch files for different version ranges based on the changes they needed to apply. A patch file has to be executed in the shell in order to be able to perform this programmatic patching.
The pre-patched files are version specific because those are the actual files for each version of magento with the patch pre-applied to them. They aren’t interchangeable because the files are different depending on the magento version. The benefit of these is they can just be ftp’ed into the proper locations without having to be executed from the shell.
It won’t take any more time to use one version over the other. We have a large magento user base and I’ve patched close to 300 sites now. While I prefer the programatic patch and have written my own variation, I’m also super grateful for these pre-patched versions for the few clients where ssh access isn’t possible for whatever reason.
Hi, I followed your instruction and successfully completed for the last 2 patches. But latest one is not working.I have Magento 1.9.0.1 . Is there any thing I missed. any suggestion .
Thanks.
This patch for version 1.8.1 works for Magento version 1.8.0?
Thank you