Technical resource
How to install SUPEE-6788 without SSH
Note: This is a historical reference, not a current security baseline. Magento 1 is end-of-life.
October 27, 2015: New Magento Security Patch (SUPEE-6788) – Install Immediately Today, we are releasing a new patch (SUPEE-6788) and Community Edition 1.9.2.2 to address 10+ security issues, including remote code execution and information leak vulnerabilities. This patch is unrelated to the Guruincsite malware issue. Be sure to test the patch in a development environment first, as it can affect extensions and customizations. Download the patch from the Community Edition Download page and learn more at http://magento.com/security/patches/supee-6788If you have SSH access, it would be more simple to apply the patch via SSH. If you have no SSH access to apply the patch, you can simply upgrade your installation to Magento 1.9.2.2 version which includes all the latest security patches (SUPEE-5344, SUPEE-5994, SUPEE-6285, SUPEE-6482, SUPEE-6788). If Magento upgrade is not possible in the moment due to some reason you still can apply the patch via FTP/sFTP upload as shown in this article. Before applying this patch, make sure to apply all previous patches. If you wish to save time and have us to install these patches for you, simply click here to order installation.
Preparations
Warning: This patch may break some third-party modules that makes extensive use of custom variables and custom admin routes. Refer to community maintained list of all known incompatible extensions.
- Disable Magento Compiler and clear compiler cache
- Update all third-party extensions, disable and uninstall any unused extensions.
- Install all previous patches (namely, SUPEE-1533, SUPEE-5344, SUPEE-5994, SUPEE-6285, SUPEE-6482)
Applying Magento patches via FTP/sFTP or FileManager / File Upload
To apply patches in this way we simply replace changed files. This way can not be used blindly if you or your developers have changed any core Magento files (which is a big no-no, by the way). Such changes should be re-applied to patched files, or you loose these changes. The following files are changed by SUPEE-6788:.htaccess .htaccess.sample app/code/core/Mage/Admin/Model/Block.php app/code/core/Mage/Admin/Model/Resource/Block.php app/code/core/Mage/Admin/Model/Resource/Block/Collection.php app/code/core/Mage/Admin/Model/Resource/Variable.php app/code/core/Mage/Admin/Model/Resource/Variable/Collection.php app/code/core/Mage/Admin/Model/Variable.php app/code/core/Mage/Admin/etc/config.xml app/code/core/Mage/Admin/sql/admin_setup/upgrade-1.6.1.1-1.6.1.2.php app/code/core/Mage/Adminhtml/Block/Permissions/Block.php app/code/core/Mage/Adminhtml/Block/Permissions/Block/Edit.php app/code/core/Mage/Adminhtml/Block/Permissions/Block/Edit/Form.php app/code/core/Mage/Adminhtml/Block/Permissions/Block/Grid.php app/code/core/Mage/Adminhtml/Block/Permissions/Variable.php app/code/core/Mage/Adminhtml/Block/Permissions/Variable/Edit.php app/code/core/Mage/Adminhtml/Block/Permissions/Variable/Edit/Form.php app/code/core/Mage/Adminhtml/Block/Permissions/Variable/Grid.php app/code/core/Mage/Adminhtml/controllers/Permissions/BlockController.php app/code/core/Mage/Adminhtml/controllers/Permissions/VariableController.php app/code/core/Mage/Adminhtml/etc/adminhtml.xml app/code/core/Mage/Catalog/Model/Product/Option/Type/File.php app/code/core/Mage/Core/Controller/Front/Action.php app/code/core/Mage/Core/Controller/Varien/Router/Admin.php app/code/core/Mage/Core/Helper/UnserializeArray.php app/code/core/Mage/Core/Model/Email/Template/Filter.php app/code/core/Mage/Core/Model/Resource/Setup.php app/code/core/Mage/Core/etc/config.xml app/code/core/Mage/Core/etc/system.xml app/code/core/Mage/Customer/Block/Account/Changeforgotten.php app/code/core/Mage/Customer/Block/Account/Resetpassword.php app/code/core/Mage/Customer/controllers/AccountController.php app/code/core/Mage/Downloadable/Model/Product/Type.php app/code/core/Mage/Eav/Model/Resource/Attribute/Collection.php app/code/core/Mage/Sales/Model/Resource/Order/Item/Collection.php app/code/core/Mage/Sales/controllers/DownloadController.php app/code/core/Mage/SalesRule/Model/Resource/Coupon/Collection.php app/design/adminhtml/default/default/layout/admin.xml app/design/frontend/base/default/layout/customer.xml app/design/frontend/base/default/template/customer/form/register.phtml app/design/frontend/base/default/template/customer/form/resetforgottenpassword.phtml app/design/frontend/base/default/template/persistent/customer/form/register.phtml app/design/frontend/default/iphone/layout/customer.xml app/design/frontend/default/modern/layout/customer.xml app/design/frontend/rwd/default/layout/customer.xml app/design/frontend/rwd/default/template/customer/form/resetforgottenpassword.phtml app/design/frontend/rwd/default/template/persistent/customer/form/register.phtml cron.php dev/tests/functional/.htaccess errors/processor.php lib/Unserialize/Parser.php lib/Unserialize/Reader/Arr.php lib/Unserialize/Reader/ArrKey.php lib/Unserialize/Reader/ArrValue.php lib/Unserialize/Reader/Bool.php lib/Unserialize/Reader/Dbl.php lib/Unserialize/Reader/Int.php lib/Unserialize/Reader/Str.php lib/Varien/Data/Collection/Db.php lib/Zend/Xml/Security.phpTo install the patch via FTP/File Upload
- select patch bundle archive corresponding to your Magento version from the table below and unpack it
- upload all files and folders to Magento root directory of your store, replacing all files
- delete dev/tests/functional/.htaccess from your store (if exists)
| Magento version | SUPEE-6788 |
|---|---|
| Magento 1.9.2.1 | SUPEE-6788-1.9.2.1 |
| Magento 1.9.2.0 | SUPEE-6788-1.9.2.0 |
| Magento 1.9.1.1 | SUPEE-6788-1.9.1.1 |
| Magento 1.9.1.0 | SUPEE-6788-1.9.1.0 |
| Magento 1.9.0.1 | SUPEE-6788-1.9.0.1 |
| Magento 1.8.1.0 | SUPEE-6788-1.8.1.0 |
| Magento 1.8.0.0 | SUPEE-6788-1.8.0.0 |
| Magento 1.7.0.2 | SUPEE-6788-1.7.0.2 |
| Magento 1.6.2.0 | SUPEE-6788-1.6.2.0 |
| Magento 1.6.1.0 | SUPEE-6788-1.6.1.0 |
| Magento 1.5.1.0 | SUPEE-6788-1.5.1.0 |
Verification and flush of PHP opcode cache
Verify patch status at our patch tester page. Test that your store is working. If you use PHP opcode caches (APC/XCache/eAccelerator) make sure to flush it after patching (or restart webserver), otherwise code will continue to run from caches.Post-installation
Warning: Secure Admin routing for extensions is not applied by default after patch installation. To take all advantages of the patch Admin routing compatibility mode should be Disabled at System > Configuration > Admin > Security > Admin routing compatibility mode for extensions.You can disable it as shown below:
Warning: This feature may break some (about ~80% at the moment) third-party extensions from working as expected. Make sure to update all third-party extensions, disable and uninstall any unused extensions and request an extension upgrades from developers if it does not work with this feature enabled..Additionally, if your store still use default /admin/ path, you may consider securing your Magento /admin/ by admin path change and restrict access to
/downloader/.
Known issues
- CMS pages and transactional emails broken after SUPEE-6788 patch to Magento
- Reset Password page is blank after SUPEE-6788
- Magento registration form does not work after SUPEE-6788
- Ess/M2ePro extension is broken after SUPEE-6788
Comments
Archived discussion
Admin routing compatibility mode for extensions is set to “Enable” for me automatically after I apply the patch and the little text under it said “Enabling this setting increases risk of automated attacks against admin functionality.”
So are we suppose to keep this “Enable” or “Disable”
Hello
I need to installed Magento Security Patch (SUPEE-6788) for Magento ver. 1.9.0.1
can you please advise me which are used from above one ?
Regards, Tarun
I tried to apply the patch via script and get an error: [root@s17801997 httpdocs]# sh PATCH_SUPEE-6788_CE_1.8.1.0… /? Checking if patch can be applied/reverted successfully… ERROR: Patch can’t be applied/reverted successfully.
patching file .htaccess can’t find file to patch at input line 38 Perhaps you used the wrong -p or –strip option? The text leading up to this was:
|diff –git .htaccess.sample .htaccess.sample |index b8821af..383313a 100644 |— .htaccess.sample |+++ .htaccess.sample
Found a solution here:
http://magento.stackexchang…
After upload, I am still getting the error in the check page: SUPEE-6788: Vulnerable, immediate attention required.
How do I flush or restart to get this working:
Test that your store is working. If you use PHP opcode caches (APC/XCache/eAccelerator) make sure to flush it after patching (or restart webserver), otherwise code will continue to run from caches.
Hi There
I am just reviewing the files, which I will be replacing as apart of the SUPEE-6788 patch.
However I have noticed that the some of the file paths are different in the SUPEE-6788 update, compared to my cPanel.
Some of the folders / files do not exist on my cPanel. I just want to be sure how to manage this issue.
I have a pretty limited knowledge of Magento and this will be my first security patch update.
The main issues are the following file paths:
In SUPEE-6788 as: app/code/core/Mage/Adminhtml/Block/Permissions/Block/ However the folder “Block” does not exist inside the Permissions Folder on my cPanel
In SUPEE-6788 as: app/code/core/Mage/Adminhtml/Block/Permissions/Variable/ However the folder “Variable” does not exist inside the Permissions Folder on my cPanel
In SUPEE-6788 as: lib/Unserialize/ However the folder “Unserialize” does not exist on my cPanel
In SUPEE-6788 as: lib/Zend/Xml/Security.php However the folder “Xml” does not exist inside Zend on my cPanel
Should I be creating new folders within my cPanel to match the SUPPE-6788 file paths? Or what should I be doing?
Other issues include: In your list of files affected as: app/design/frontend/rwd/ However the folder “rwd” does not exist on my cPanel or inside the SUPEE-6788 Download In your list of files affected as: app/code/core/Mage/Core/Controller/Front/Action.php However the Folder “Front” does not exist in the SUPEE-6788 download
In your list of files affected as: cron.php However no updated file for cron.php exists in the SUPEE-6788 Download
In your list of files affected as: dev/tests/functional/.htaccess However the folder “dev” does not exist on my cPanel or inside the SUPEE-6788 download
Also these files do not currently exist on my cPanel, should I just save them there although I will not be replacing any files?
app/code/core/Mage/Adminhtml/controllers/Permissions/BlockController.php
app/code/core/Mage/Adminhtml/controllers/Permissions/VariableController.php
app/code/core/Mage/Core/Helper/UnserializeArray.php
app/code/core/Mage/Customer/Block/Account/Changeforgotten.php
Sorry if this is overwhelming, I just want to be super careful.
Thanks.
After instal the SUPEE-6788-1.7.0.2 for my magento 1.7.02 this error appeared
a:5:{i:0;s:237:“Error in file: “/var/www/vhosts/biodiesel.nl/httpdocs/paras…” - SQLSTATE[42S01]: Base table or view already exists: 1050 Table ‘permission_variable’ already exists”;i:1;s:1173:" #0 /var/www/vhosts/biodiesel.nl/httpdocs/paras… Mage::exception(‘Mage_Core’, ‘Error in file: …’) #1 /var/www/vhosts/biodiesel.nl/httpdocs/paras… Mage_Core_Model_Resource_Setup->_modifyResourceDb(‘upgrade’, ‘1.6.1.1’, ‘1.6.1.2’) #2 /var/www/vhosts/biodiesel.nl/httpdocs/paras… Mage_Core_Model_Resource_Setup->_upgradeResourceDb(‘1.6.1.1’, ‘1.6.1.2’) #3 /var/www/vhosts/biodiesel.nl/httpdocs/paras… Mage_Core_Model_Resource_Setup->applyUpdates() #4 /var/www/vhosts/biodiesel.nl/httpdocs/paras… Mage_Core_Model_Resource_Setup::applyAllUpdates() #5 /var/www/vhosts/biodiesel.nl/httpdocs/paras… Mage_Core_Model_App->_initModules() #6 /var/www/vhosts/biodiesel.nl/httpdocs/paras… Mage_Core_Model_App->run(Array) #7 /var/www/vhosts/biodiesel.nl/httpdocs/paras… Mage::run(’nl’, ‘store’) #8 {main}";s:3:“url”;s:32:"/parasoldoek/index.php/kokosnoot";s:11:“script_name”;s:22:"/parasoldoek/index.php";s:4:“skin”;s:7:“default”;}
SQLSTATE[42S22]: Column not found: 1054 Unknown column ‘CONCAT(lastname, ’ ‘, firstname)’ in ‘where clause’
Trace: #0 /home/cosmetic/public_html/lib/Varien/Db/Statement/Pdo/Mysql.php(110): Zend_Db_Statement_Pdo->_execute(Array) #1 /home/cosmetic/public_html/lib/Zend/Db/Statement.php(300): Varien_Db_Statement_Pdo_Mysql->_execute(Array) #2 /home/cosmetic/public_html/lib/Zend/Db/Adapter/Abstract.php(479): Zend_Db_Statement->execute(Array) #3 /home/cosmetic/public_html/lib/Zend/Db/Adapter/Pdo/Abstract.php(238): Zend_Db_Adapter_Abstract->query(‘SELECT COUNT()…’, Array) #4 /home/cosmetic/public_html/lib/Varien/Db/Adapter/Pdo/Mysql.php(428): Zend_Db_Adapter_Pdo_Abstract->query(‘SELECT COUNT()…’, Array) #5 /home/cosmetic/public_html/lib/Zend/Db/Adapter/Abstract.php(825): Varien_Db_Adapter_Pdo_Mysql->query(Object(Varien_Db_Select), Array) #6 /home/cosmetic/public_html/lib/Varien/Data/Collection/Db.php(225): Zend_Db_Adapter_Abstract->fetchOne(Object(Varien_Db_Select), Array) #7 /home/cosmetic/public_html/lib/Varien/Data/Collection.php(225): Varien_Data_Collection_Db->getSize() #8 /home/cosmetic/public_html/lib/Varien/Data/Collection.php(211): Varien_Data_Collection->getLastPageNumber() #9 /home/cosmetic/public_html/lib/Varien/Data/Collection/Db.php(522): Varien_Data_Collection->getCurPage() #10 /home/cosmetic/public_html/lib/Varien/Data/Collection/Db.php(569): Varien_Data_Collection_Db->_renderLimit() #11 /home/cosmetic/public_html/app/code/core/Mage/Adminhtml/Block/Widget/Grid.php(533): Varien_Data_Collection_Db->load() #12 /home/cosmetic/public_html/app/code/local/Inno/Adminhtml/Block/Sales/Order/Grid.php(24): Mage_Adminhtml_Block_Widget_Grid->_prepareCollection() #13 /home/cosmetic/public_html/app/code/core/Mage/Adminhtml/Block/Widget/Grid.php(626): Inno_Adminhtml_Block_Sales_Order_Grid->_prepareCollection() #14 /home/cosmetic/public_html/app/code/core/Mage/Adminhtml/Block/Widget/Grid.php(632): Mage_Adminhtml_Block_Widget_Grid->_prepareGrid() #15 /home/cosmetic/public_html/app/code/core/Mage/Core/Block/Abstract.php(862): Mage_Adminhtml_Block_Widget_Grid->_beforeToHtml() #16 /home/cosmetic/public_html/app/code/core/Mage/Core/Block/Abstract.php(582): Mage_Core_Block_Abstract->toHtml() #17 /home/cosmetic/public_html/app/code/core/Mage/Core/Block/Abstract.php(526): Mage_Core_Block_Abstract->_getChildHtml(‘grid’, true) #18 /home/cosmetic/public_html/app/code/core/Mage/Adminhtml/Block/Widget/Grid/Container.php(77): Mage_Core_Block_Abstract->getChildHtml(‘grid’) #19 /home/cosmetic/public_html/app/design/adminhtml/default/default/template/widget/grid/container.phtml(36): Mage_Adminhtml_Block_Widget_Grid_Container->getGridHtml() #20 /home/cosmetic/public_html/app/code/core/Mage/Core/Block/Template.php(241): include(’/home/cosmetic/…’) #21 /home/cosmetic/public_html/app/code/core/Mage/Core/Block/Template.php(272): Mage_Core_Block_Template->fetchView(‘adminhtml/defau…’) #22 /home/cosmetic/public_html/app/code/core/Mage/Core/Block/Template.php(286): Mage_Core_Block_Template->renderView() #23 /home/cosmetic/public_html/app/code/core/Mage/Adminhtml/Block/Template.php(81): Mage_Core_Block_Template->_toHtml() #24 /home/cosmetic/public_html/app/code/core/Mage/Adminhtml/Block/Widget/Container.php(308): Mage_Adminhtml_Block_Template->_toHtml() #25 /home/cosmetic/public_html/app/code/core/Mage/Core/Block/Abstract.php(863): Mage_Adminhtml_Block_Widget_Container->_toHtml() #26 /home/cosmetic/public_html/app/code/core/Mage/Core/Block/Text/List.php(43): Mage_Core_Block_Abstract->toHtml() #27 /home/cosmetic/public_html/app/code/core/Mage/Core/Block/Abstract.php(863): Mage_Core_Block_Text_List->_toHtml() #28 /home/cosmetic/public_html/app/code/core/Mage/Core/Block/Abstract.php(582): Mage_Core_Block_Abstract->toHtml() #29 /home/cosmetic/public_html/app/code/core/Mage/Core/Block/Abstract.php(526): Mage_Core_Block_Abstract->_getChildHtml(‘content’, true) #30 /home/cosmetic/public_html/app/design/adminhtml/default/default/template/page.phtml(74): Mage_Core_Block_Abstract->getChildHtml(‘content’) #31 /home/cosmetic/public_html/app/code/core/Mage/Core/Block/Template.php(241): include(’/home/cosmetic/…’) #32 /home/cosmetic/public_html/app/code/core/Mage/Core/Block/Template.php(272): Mage_Core_Block_Template->fetchView(‘adminhtml/defau…’) #33 /home/cosmetic/public_html/app/code/core/Mage/Core/Block/Template.php(286): Mage_Core_Block_Template->renderView() #34 /home/cosmetic/public_html/app/code/core/Mage/Adminhtml/Block/Template.php(81): Mage_Core_Block_Template->_toHtml() #35 /home/cosmetic/public_html/app/code/core/Mage/Core/Block/Abstract.php(863): Mage_Adminhtml_Block_Template->_toHtml() #36 /home/cosmetic/public_html/app/code/core/Mage/Core/Model/Layout.php(555): Mage_Core_Block_Abstract->toHtml() #37 /home/cosmetic/public_html/app/code/core/Mage/Core/Controller/Varien/Action.php(390): Mage_Core_Model_Layout->getOutput() #38 /home/cosmetic/public_html/app/code/core/Mage/Adminhtml/controllers/Sales/OrderController.php(95): Mage_Core_Controller_Varien_Action->renderLayout() #39 /home/cosmetic/public_html/app/code/core/Mage/Core/Controller/Varien/Action.php(419): Mage_Adminhtml_Sales_OrderController->indexAction() #40 /home/cosmetic/public_html/app/code/core/Mage/Core/Controller/Varien/Router/Standard.php(254): Mage_Core_Controller_Varien_Action->dispatch(‘index’) #41 /home/cosmetic/public_html/app/code/core/Mage/Core/Controller/Varien/Front.php(176): Mage_Core_Controller_Varien_Router_Standard->match(Object(Mage_Core_Controller_Request_Http)) #42 /home/cosmetic/public_html/app/code/core/Mage/Core/Model/App.php(354): Mage_Core_Controller_Varien_Front->dispatch() #43 /home/cosmetic/public_html/app/Mage.php(683): Mage_Core_Model_App->run(Array) #44 /home/cosmetic/public_html/index.php(87): Mage::run(’’, ‘store’) #45 {main}
Error log record number: 1420504705103
I got this error trying to filter orders by name in Magento 1.7.0.2 do you have any soultion?
Dear sirs, we downloaded the patch SUPEE-6788 bundle archive corresponding to our Magento version 1.8.1.0 and identified some folders are missing according to your (+ expand source) table, namely: Front/Action.php on row 024, rwd/default on rows 046, 047, 048, and lib/Zend/Xml/Security.php at the last row.
Is there missing something? Or the information on the expand source table is for other Magento versions?
Thank you for your attention, looking forward to hearing from you!
Dear Magentary, we thank you for the response and clarification.
Thank you for your attention !
I updated the patch file for Magento 1.6.2.0, and found the issues as I checked the file app/code/core/Mage/Customer/Model/Session.php the function have authenticate() has the $action->setRedirectWithCookieCheck(Mage_Customer_Helper_Data::ROUTE_ACCOUNT_LOGIN, Mage::helper(‘customer’)->getLoginUrlParams());
Here “setRedirectWithCookieCheck” functions does not exists in Magento 1.6.2.0, as well does not exists Mage_Customer_Helper_Data::ROUTE_ACCOUNT_LOGIN & Mage::helper(‘customer’)->getLoginUrlParams() in Magento 1.6.2.0, so getting the issues on login redirection etc, Please confirm that the patch files provided by you SUPEE-6788-1.6.2.0.zip are correct version patch files?
Hello. i installed the patch carefully without SSH and tested it on: https://www.magereport.com/… which tells me that i patched it okay. But when I test it with the patch tester from magentary it says that it is still vulnerable to SUPEE-6788 could you please advice me in which criterea the test is failing for the domain magento.robbeberking.info thanks.
The magento version we are using is: 1.7.0.2