Technical resource
How to install SUPEE-8788 without SSH
Note: This is a historical reference, not a current security baseline. Magento 1 is end-of-life.
SUPEE-8788 resolve multiple security issues, including critical vulnerabilities with certain payment methods and Zend Framework libraries, support for HTML5 image upload (no flash).
If you have SSH access, it would be more safe to apply the patch via SSH or upgrade to Magento 1.9.4.5 or OpenMage. If upgrade is not an option due to some reason you still can apply the patch via FTP/sFTP upload as shown in this article.
Before applying this patch, make sure to apply all previous patches.
If you wish to save time and have us to apply the slightest set of changes with minimal impact to your store, simply order our Magento Security Patching service.
Preparations
- Disable Magento Compiler and clear compiler cache
- Install all previous patches (namely, SUPEE-5344, SUPEE-5994, SUPEE-6285, SUPEE-6482, SUPEE-6788, SUPEE-7405)
Applying Magento patches via FTP/sFTP or FileManager / File Upload
To apply patches in this way we simply replace changed files. This way can not be used blindly if you or your developers have changed any core Magento files (which is a big no-no, by the way). Such changes should be re-applied to patched files, or you loose these changes.The following files are changed by SUPEE-8788 (v2 released on October 15, 2016):
app/code/core/Mage/Adminhtml/Block/Catalog/Product/Helper/Form/Gallery/Content.php app/code/core/Mage/Adminhtml/Block/Cms/Wysiwyg/Images/Content/Uploader.php app/code/core/Mage/Adminhtml/Block/Media/Uploader.php app/code/core/Mage/Adminhtml/Block/Urlrewrite/Category/Tree.php app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Serialized.php app/code/core/Mage/Adminhtml/controllers/DashboardController.php app/code/core/Mage/Adminhtml/controllers/IndexController.php app/code/core/Mage/Adminhtml/controllers/Media/UploaderController.php app/code/core/Mage/Catalog/Helper/Image.php app/code/core/Mage/Catalog/etc/config.xml app/code/core/Mage/Catalog/etc/system.xml app/code/core/Mage/Centinel/Model/Api.php app/code/core/Mage/Centinel/Model/Api/Client.php app/code/core/Mage/Core/Block/Abstract.php app/code/core/Mage/Core/Helper/Url.php app/code/core/Mage/Core/Model/Encryption.php app/code/core/Mage/Core/Model/Input/Filter/MaliciousCode.php app/code/core/Mage/Core/functions.php app/code/core/Mage/Customer/Block/Address/Book.php app/code/core/Mage/Customer/controllers/AddressController.php app/code/core/Mage/Dataflow/Model/Profile.php app/code/core/Mage/Downloadable/Block/Adminhtml/Catalog/Product/Edit/Tab/Downloadable/Links.php app/code/core/Mage/Downloadable/Block/Adminhtml/Catalog/Product/Edit/Tab/Downloadable/Samples.php app/code/core/Mage/Downloadable/Helper/File.php app/code/core/Mage/Oauth/Model/Server.php app/code/core/Mage/Paygate/Model/Authorizenet.php app/code/core/Mage/Payment/Block/Info/Checkmo.php app/code/core/Mage/Paypal/Model/Express/Checkout.php app/code/core/Mage/Paypal/Model/Resource/Payment/Transaction.php app/code/core/Mage/Sales/Model/Resource/Order/Payment.php app/code/core/Mage/Sales/Model/Resource/Order/Payment/Transaction.php app/code/core/Mage/Sales/Model/Resource/Quote/Payment.php app/code/core/Mage/Sales/Model/Resource/Recurring/Profile.php app/code/core/Mage/Uploader/Block/Abstract.php app/code/core/Mage/Uploader/Block/Multiple.php app/code/core/Mage/Uploader/Block/Single.php app/code/core/Mage/Uploader/Helper/Data.php app/code/core/Mage/Uploader/Helper/File.php app/code/core/Mage/Uploader/Model/Config/Abstract.php app/code/core/Mage/Uploader/Model/Config/Browsebutton.php app/code/core/Mage/Uploader/Model/Config/Misc.php app/code/core/Mage/Uploader/Model/Config/Uploader.php app/code/core/Mage/Uploader/etc/config.xml app/code/core/Mage/Uploader/etc/jstranslator.xml app/code/core/Mage/Usa/Model/Shipping/Carrier/Dhl.php app/code/core/Mage/Usa/Model/Shipping/Carrier/Dhl/International.php app/code/core/Mage/Usa/Model/Shipping/Carrier/Fedex.php app/code/core/Mage/Usa/Model/Shipping/Carrier/Ups.php app/code/core/Mage/Usa/etc/config.xml app/code/core/Mage/Usa/etc/system.xml app/code/core/Mage/Wishlist/Helper/Data.php app/code/core/Mage/Wishlist/controllers/IndexController.php app/code/core/Mage/XmlConnect/Block/Adminhtml/Mobile/Edit/Tab/Design.php app/code/core/Mage/XmlConnect/Block/Adminhtml/Mobile/Edit/Tab/Design/Images.php app/code/core/Mage/XmlConnect/controllers/Adminhtml/MobileController.php app/design/adminhtml/default/default/layout/cms.xml app/design/adminhtml/default/default/layout/main.xml app/design/adminhtml/default/default/layout/xmlconnect.xml app/design/adminhtml/default/default/template/catalog/product/helper/gallery.phtml app/design/adminhtml/default/default/template/cms/browser/content/uploader.phtml app/design/adminhtml/default/default/template/downloadable/product/edit/downloadable.phtml app/design/adminhtml/default/default/template/downloadable/product/edit/downloadable/links.phtml app/design/adminhtml/default/default/template/downloadable/product/edit/downloadable/samples.phtml app/design/adminhtml/default/default/template/media/uploader.phtml app/design/adminhtml/default/default/template/xmlconnect/edit/tab/design.phtml app/etc/modules/Mage_All.xml app/locale/en_US/Mage_Media.csv app/locale/en_US/Mage_Uploader.csv downloader/lib/Mage/HTTP/Client/Curl.php js/lib/uploader/flow.min.js js/lib/uploader/fusty-flow-factory.js js/lib/uploader/fusty-flow.js js/mage/adminhtml/product.js js/mage/adminhtml/uploader/instance.js lib/Unserialize/Parser.php lib/Unserialize/Reader/Arr.php lib/Unserialize/Reader/ArrValue.php lib/Unserialize/Reader/Null.php skin/adminhtml/default/default/boxes.css skin/adminhtml/default/default/media/flex.swf skin/adminhtml/default/default/media/uploader.swf skin/adminhtml/default/default/media/uploaderSingle.swf skin/adminhtml/default/default/xmlconnect/boxes.cssTo install the patch via FTP/File Upload
- select patch bundle archive corresponding to your Magento version from the table below and unpack it
- upload all files and folders to Magento root directory of your store, replacing all files
- delete the following files in skin/adminhtml/default/default/media/:
skin/adminhtml/default/default/media/flex.swf skin/adminhtml/default/default/media/uploader.swf skin/adminhtml/default/default/media/uploaderSingle.swf
Downloads for other versions added to table on demand when we patch certain version via file upload for the first time.
Note, all links are updated to v2 version, updated on October 15, 2016.
| Magento version | SUPEE-8788 v2 |
|---|---|
| Magento 1.9.2.4 | SUPEE-8788v2-1.9.2.4 |
| Magento 1.9.2.3 | SUPEE-8788v2-1.9.2.3 |
| Magento 1.9.2.2-1.9.2.1 | SUPEE-8788v2-1.9.2.1 |
| Magento 1.9.1.1 | SUPEE-8788v2-1.9.1.1 |
| Magento 1.9.0.1 | SUPEE-8788v2-1.9.0.1 |
| Magento 1.8.1.0 | SUPEE-8788v2-1.8.1.0 |
| Magento 1.7.0.2 | SUPEE-8788v2-1.7.0.2 |
Verification and flush of PHP opcode cache
Test that your store is working. If you use PHP opcode caches (APC/XCache/eAccelerator) make sure to flush it after patching (or restart webserver), otherwise code will continue to run from caches.Known issues
There are several known issues with SUPEE-8788 reported, please check this list for details.If you have any difficulties with applying the patches please let us know in comments, so we can find the solution together.
Comments
Archived discussion
Hi,
How can I verify whether I have successfully installed the Supee-8788 patch please?
I think I have done all the steps in this instruction, but I still cannot pass the security scan on MageReport (www.magereport.com). Is there any why I can check the installation?
Thanks.
Hi,
my magento version is 1.9.1.0.
Did you release the patch also for that version?
Thank you very much
I would preciate if you could release the patchfiles for 1.9.2.0.
Thank you so much!
Yes please post 1.9.2.0
Thanks
Hello my version is 1.9.0.1 will you release the patch files for my version too?
Thanks in advance!
Hello our version is 1.9.2.3. Could you please release patch for that version?
Thanks in advance!!
Viktor, this post here solved the problem for me: https://community.magento.c…
Basically, clear ALL caches: Magento, Your Browser, CDN & server. Use a fresh browser/private tab/incognito. This will help.
Below is the recommendations mentioned by Magento community before installing SUPEE-8788 v2 patch.
Revert SUPEE-8788 v1 (if installed) Revert SUPEE-1533 (if installed) Install SUPEE-3941 (if not installed yet) Install SUPEE-8788 v2
Do we need to follow all above steps if we use the zip files provided by you? Or we can directly install it without following these things?
Is there any version for 1.6.2.0?
Thank you!
Hello,
can you also provide the link for Magento 1.9.1.0 of SUPEE-8788v2?
Thank you very much for your support.
1.9.1.1 patch work pretty well with 1.9.1.0.
You just have to change the unserializeArray by unserialize i think (that’s the only error i encountered when i applied 1.9.1.1 on a 1.9.1.0 Magento)
Go to Cache Management, Refresh all caches, Flush all other caches. Logout admin.
Clear browser caches, especially browser data and cached images & files. Close browser.
Clear your CDN Cache!
Reload Apache or restart your server
Open your fresh browser, and login to admin. Test your image upload. If still not working, use private browsing or incognito or another machine
After applying the SUPEE-8788v2-1.8.1.0 patch the Product page is broken in admin
Admin > Catalog > Manage Products > Edit, Page is broken, I see only white background with this error: Fatal error: Call to undefined function lcfirst() in {server}/app/code/core/Mage/Uploader/Model/Config/Abstract.php on line 50
Hello.
Tested this patch on a Localhost magento Website and identified that, despite the edit products working properly, the page got some CSS glitches. Like Top menu letters are now white instead of black and there is a red outline in all buttons (Like Save, Duplicate, etc).
My Xamp is version 3.2.1 with Php 5.6.3. Magento 1.7.0.2
Anyone with the same issue?
Well. Confirmed.
If “Merge CSS Files” is set to “Yes”, Edit Product and Edit Category layouts get style errors. Cleaning caches doesn’t seens to solve the issue. Guess I will need to hunt the source of the trouble and make a custom CSS for admin =/
EDIT: Seens that 8 lines from boxes.css in skin\adminhtml\default\default got changed for no real reason. Save two lines that remove “float” behavior on Search and Upload image buttons the rest is purely unwanted changes on aesthetics.
Hello,
Our system used Magento 1.9.2.1. We updated OK now, But we have a problem:
On Admin > Manage products > Edit product: We are missing button upload image for product. It’s only show message “Maximum width and height dimension for upload image is 5000.”
I tried refresh, flush,.. on system. clear cache browser, restart apache,.. but have not any luck.
Thank you very much for your support.
Hello,
I upgraded my magento store from 1.9.2.2 to 1.9.3.0 but https://www.magereport.com/ display security patch 8788 not patched.. Please suggest how i can fix this.
Hello, I followed the above instructions and installed SUPEE-8788v2-1.7.0.2 on my Magento which is version 1.7.0.2.
Since then, none of my customers have been able to place an order. I’m able to get through the checkout to the final page, then when I click Place Order, the text “Submitting order information” appears for a second but nothing happens and it goes back to the Place Order button.
Any idea what the problem might be or how to fix it?
Hello I get following error after install patch 8788 in 1.9.2.2
Fatal error: Call to a member function getFieldLabel() on boolean in /chroot/home/ezkonne1/ezkonnect.com/html/app/code… on line 195
Please provide solution for it.
Hi,
We installed the patch SUPEE-8788 in magento 1.9.0.0
after applying the patch We have same issue , when we try to upload image in product , CMS page/block any where else using wysiwyg.
when we browse the image , browser got hang and it gives different errors in chrome and firefox, IE
In firefox : uncaught exception: out of memory in Chrome : Failed to clear temp storage: It was determined that certain files are unsafe for access within a Web application, or that too many calls are being made on file resources. SecurityError
also some time it gives error in flow.min.js.
fortunatly it working properly in safari.
we tried so many solution but stll its not working.
Can any one help on this please ?
thanks
hello Witch paches for magento 1.9.1.0 SUPEE-8788v2-1.9.1.1 SUPEE-8788v2-1.9.0.1
thanks
Hello, I followed the above instructions and installed SUPEE-8788 on my Magento which is version 1.9.2.4.
but not any changes on my magento, also not remove SUPEE-8788 error in Messages Inbox.
Any idea what the problem might be or how to fix it?
I have just installed SUPEE-8788v2 in magento 1.9.1.0 but got below error while editing product:
Fatal error: Call to a member function getUploaderConfig() on boolean in app/code/core/Mage/Adminhtml/Block/Catalog/Product/Helper/Form/Gallery/Content.php on line 56
After Installed the 8788 patch in magento ce-1.9.2.0 but product images upaload and browse buttons are not showing.Deleted file from skin/adminhtml/default/default/media/flex.swf skin/adminhtml/default/default/media/uploader.swf skin/adminhtml/default/default/media/uploaderSingle.swf but,no use browse and upload buttons are not showing…Please help on this issue
Thanks,
After installed patch for magento 1.9.1.0. below error come on after redirect on paypal.
Fatal error: Class ‘Mage_Core_Helper_UnserializeArray’ not found in /chroot/home/twoerosc/2eros.com/html/app/Mage.php on line 547
After installed 8788 patch for 1.9.0.1 custom option image is broken.
in cosole below error found.
Failed to load resource: the server responded with a status of 403 (Forbidden)
But we check folder permission is 777.
Can you please some body help