Patch Keamanan SUPEE-10752 - Kemungkinan masalah?

Patch keamanan baru keluar untuk Magento 1, mengatasi 25 masalah APPSEC

https://magento.com/security/patches/supee-10752

Masalah umum apa yang harus Anda perhatikan saat menerapkan tambalan ini?

SUPEE-10752, Magento Commerce 1.14.3.9 dan Open Source 1.9.3.9 berisi beberapa peningkatan keamanan yang membantu menutup eksekusi kode jarak jauh pengguna Admin (RCE) terotentikasi, pemalsuan permintaan lintas situs (CSRF) dan kerentanan lainnya.

Informasi tentang semua perubahan dalam rilis 1.14.3.9 dan 1.9.3.9 tersedia di catatan rilis Magento Commerce dan Magento Open Source.

Tambalan dan peningkatan tersedia untuk versi Magento berikut:

Magento Commerce 1.9.0.0-1.14.3.9: SUPEE-10752 atau tingkatkan ke Magento Commerce 1.14.3.9.

Magento Open Source 1.5.0.0-1.9.3.9: SUPEE-10752 atau tingkatkan ke Magento Open Source 1.9.3.9.

Seperti yang Disebutkan oleh Documents Resmi Oleh Magento :

Konflik selama pemasangan tambalan SUPEE-10752 paling sering disebabkan oleh pemasangan tambalan versi 1 sebelumnya ( SUPEE-10570v1 ).

Pastikan untuk menghapus SUPEE-10570v1 dan menginstal SUPEE-10570v2 sebelum pemasangan SUPEE-10752 baru.

File-file di bawah ini diubah / dibuat setelah menerapkan tambalan

app/code/core/Mage/Admin/Model/User.php
app/code/core/Mage/Adminhtml/Block/Catalog/Product/Composite/Fieldset/Options.php
app/code/core/Mage/Adminhtml/Block/Catalog/Product/Edit/Tab/Options/Option.php
app/code/core/Mage/Adminhtml/Block/Widget/Grid/Column/Filter/Datetime.php
app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator.php
app/code/core/Mage/Adminhtml/controllers/Catalog/CategoryController.php
app/code/core/Mage/Adminhtml/controllers/Catalog/ProductController.php
app/code/core/Mage/Adminhtml/controllers/Cms/Wysiwyg/ImagesController.php
app/code/core/Mage/Adminhtml/controllers/Cms/WysiwygController.php
app/code/core/Mage/Adminhtml/controllers/CustomerController.php
app/code/core/Mage/Adminhtml/controllers/System/StoreController.php
app/code/core/Mage/Catalog/Model/Product.php
app/code/core/Mage/Catalog/Model/Resource/Category/Tree.php
app/code/core/Mage/Checkout/Model/Api/Resource/Customer.php
app/code/core/Mage/Checkout/Model/Type/Onepage.php
app/code/core/Mage/Checkout/controllers/CartController.php
app/code/core/Mage/Core/Helper/Http.php
app/code/core/Mage/Core/Model/Session/Abstract/Varien.php
app/code/core/Mage/Customer/Helper/Data.php
app/code/core/Mage/Customer/Model/Resource/Customer.php
app/code/core/Mage/Customer/controllers/AccountController.php
app/code/core/Mage/Log/Model/Visitor.php
app/code/core/Mage/Usa/Helper/Data.php
app/code/core/Mage/Usa/Model/Shipping/Carrier/Abstract/Backend/Abstract.php
app/code/core/Mage/Usa/Model/Shipping/Carrier/Ups/Backend/Freemethod.php
app/code/core/Mage/Usa/Model/Shipping/Carrier/Ups/Backend/OriginShipment.php
app/code/core/Mage/Usa/Model/Shipping/Carrier/Ups/Backend/Type.php
app/code/core/Mage/Usa/etc/system.xml
app/code/core/Zend/Filter/PregReplace.php
app/code/core/Zend/Validate/EmailAddress.php
app/design/adminhtml/default/default/template/bundle/product/edit/bundle/option.phtml

app/design/adminhtml/default/default/template/system/shipping/ups.phtml
app/design/frontend/base/default/template/downloadable/catalog/product/links.phtml
app/design/frontend/base/default/template/downloadable/checkout/cart/item/default.phtml
app/design/frontend/base/default/template/downloadable/checkout/onepage/review/item.phtml
app/design/frontend/base/default/template/downloadable/sales/order/items/renderer/downloadable.phtml
app/design/frontend/rwd/default/template/downloadable/checkout/cart/item/default.phtml
app/design/frontend/rwd/default/template/downloadable/checkout/onepage/review/item.phtml
app/design/frontend/rwd/default/template/downloadable/sales/order/items/renderer/downloadable.phtml
app/locale/en_US/Mage_Catalog.csv
app/locale/en_US/Mage_Usa.csv
cron.php
js/tiny_mce/plugins/media/.htaccess
lib/Varien/Image/Adapter/Gd2.php

Untuk Edisi EE file di bawah ini ditambahkan selain CE

app/code/core/Enterprise/CatalogEvent/Block/Adminhtml/Event/Grid.php
app/code/core/Enterprise/GiftRegistry/Block/Adminhtml/Giftregistry/Edit/Attribute/Attribute.php
app/code/core/Enterprise/GiftRegistry/Model/Attribute/Processor.php
app/code/core/Enterprise/Invitation/Block/Adminhtml/Invitation/Grid.php
app/code/core/Enterprise/Logging/Block/Adminhtml/Details/Renderer/Diff.php
app/code/core/Enterprise/Reward/Block/Adminhtml/Customer/Edit/Tab/Reward/History/Grid/Column/Renderer/Reason.php
app/code/core/Enterprise/TargetRule/Model/Rule.php
app/code/core/Enterprise/TargetRule/controllers/Adminhtml/TargetruleController.php
app/design/adminhtml/default/default/template/enterprise/cms/page/revision/info.phtml

app/design/frontend/enterprise/default/template/cms/hierarchy/pagination.phtml
app/design/frontend/enterprise/iphone/template/downloadable/checkout/cart/item/default.phtml
app/design/frontend/enterprise/iphone/template/downloadable/checkout/onepage/review/item.phtml
app/design/frontend/rwd/enterprise/template/cms/hierarchy/pagination.phtml

app / code / core / Mage / Admin / Model / User.php

+            $sessionUser = $this->getSession()->getUser();
+            if ($sessionUser && $sessionUser->getId() == $this->getId()) {
+                $this->getSession()->setUserPasswordChanged(true);
+            }


+    /**
+     * @return Mage_Admin_Model_Session
+     */
+    protected function getSession()
+    {
+        return  Mage::getSingleton('admin/session');
+    }
+

app / code / core / Mage / Adminhtml / Blok / Widget / Kisi / Kolom / Filter / Datetime.php

                     $this->getLocale()->getDateTimeFormat(Mage_Core_Model_Locale::FORMAT_TYPE_SHORT)
                 );
             }
-            return $value;
+            return $this->escapeHtml($value);
         }

-        return parent::getEscapedValue($index);
+        return $this->escapeHtml(parent::getEscapedValue($index));
     }
-
 }

app / code / core / Mage / Adminhtml / controllers / Catalog / CategoryController.php

+            if (isset($data['general']['path'])) {
+                unset($data['general']['path']);
+            }

app / code / core / Mage / Adminhtml / controllers / Catalog / ProductController.php

+                $product->validate();

app / code / core / Mage / Adminhtml / controllers / Cms / Wysiwyg / ImagesController.php

+            $this->getResponse()->setHeader('Content-type', $image->getMimeTypeWithOutFileType());

app / code / core / Mage / Adminhtml / controllers / Cms / WysiwygController.php

+        $this->getResponse()->setHeader('Content-type', $image->getMimeTypeWithOutFileType());

app / code / core / Mage / Adminhtml / controllers / CustomerController.php

+                    $customer->setPasswordCreatedAt(time());

app / code / core / Mage / Adminhtml / controllers / System / StoreController.php

+   /**
+     * Controller predispatch method
+     *
+     * @return Mage_Adminhtml_Controller_Action
+     */
+    public function preDispatch()
+    {
+        $this->_setForcedFormKeyActions(array('deleteWebsitePost', 'deleteGroupPost', 'deleteStorePost'));
+        return parent::preDispatch();
+    }

app / code / core / Mage / Katalog / Model / Product.php

+                        if (!empty($option['file_extension'])) {
+                            $fileExtension = $option['file_extension'];
+                            if (0 !== strcmp($fileExtension, Mage::helper('core')->removeTags($fileExtension))) {
+                                Mage::throwException(Mage::helper('catalog')->__('Invalid custom option(s).'));
+                            }
+                        }

app / code / core / Mage / Katalog / Model / Sumber Daya / Kategori / Tree.php

+            if (!preg_match("#^[0-9\/]+$#", $item['path'])) {
+                $item['path'] = '';
+            }

app / code / core / Mage / Checkout / Model / Api / Sumber Daya / Customer.php

+        $customer->setPasswordCreatedAt(time());

Siapa pun yang menimpa file onepage.php, harap perbarui file tersebut.

app / code / core / Mage / Checkout / Model / Jenis / Onepage.php

  +        $passwordCreatedTime = $this->_checkoutSession->getData('_session_validator_data')['session_expire_timestamp']
    +            - Mage::getSingleton('core/cookie')->getLifetime();
    +        $customer->setPasswordCreatedAt($passwordCreatedTime);

Untuk validasi kunci ditambahkan. Harap periksa formulir keranjang Anda, miliki kunci formulir

app / code / core / Mage / Checkout / controllers / CartController.php

+        if (!$this->_validateFormKey()) {
+            $this->_redirect('*/*/');
+            return;
+        }
+

app / code / core / Mage / Core / Helper / Http.php

-                if ($this->_getRequest()->getServer($var, false)) {
+                if ($var != 'REMOTE_ADDR' && $this->_getRequest()->getServer($var, false)) {

+        if (strpos($this->_remoteAddr, ',') !== false) {
+            $ipList = explode(',', $this->_remoteAddr);
+            $this->_remoteAddr = trim(reset($ipList));
+        }
+

aplikasi / kode / inti / Penyihir / Inti / Model / Sesi / Abstrak / Varien.php

+    const VALIDATOR_PASSWORD_CREATE_TIMESTAMP   = 'password_create_timestamp';

+    /**
+     * Use password creation timestamp in validator key
+     *
+     * @return bool
+     */
+    public function useValidateSessionPasswordTimestamp()
+    {
+        return true;
+    }
+

+        if ($this->useValidateSessionPasswordTimestamp()
+            && isset($validatorData[self::VALIDATOR_PASSWORD_CREATE_TIMESTAMP])
+            && isset($sessionData[self::VALIDATOR_SESSION_EXPIRE_TIMESTAMP])
+            && $validatorData[self::VALIDATOR_PASSWORD_CREATE_TIMESTAMP]
+            > $sessionData[self::VALIDATOR_SESSION_EXPIRE_TIMESTAMP] - $this->getCookie()->getLifetime()
+        ) {
+            return false;
+        }

+        if (isset($this->_data['visitor_data']['customer_id'])) {
+            $parts[self::VALIDATOR_PASSWORD_CREATE_TIMESTAMP] =
+                Mage::helper('customer')->getPasswordTimestamp($this->_data['visitor_data']['customer_id']);
+        }
+

app / code / core / Mage / Pelanggan / Helper / Data.php

+    /**
+     * Get customer password creation timestamp or customer account creation timestamp
+     *
+     * @param $customerId
+     * @return int
+     */
+    public function getPasswordTimestamp($customerId)
+    {
+        /** @var $customer Mage_Customer_Model_Customer */
+        $customer = Mage::getModel('customer/customer')
+            ->setWebsiteId(Mage::app()->getStore()->getWebsiteId())
+            ->load((int)$customerId);
+        $passwordCreatedAt = $customer->getPasswordCreatedAt();
+
+        return is_null($passwordCreatedAt) ? $customer->getCreatedAtTimestamp() : $passwordCreatedAt;
+    }
+

app / code / core / Mage / Pelanggan / Model / Sumber Daya / Customer.php

-        $customer->setPassword($newPassword);
+        $customer->setPassword($newPassword)->setPasswordCreatedAt(time());
+        $this->saveAttribute($customer, 'password_created_at');
app/code/core/Mage/Customer/controllers/AccountController.php

+                $customer->setPasswordCreatedAt(time());



-        if (!$this->getCustomerId() && $customer = $observer->getEvent()->getCustomer()) {
+        if ($customer = $observer->getEvent()->getCustomer()) {

> app/code/core/Mage/Log/Model/Visitor.php

    -        if (!$this->getCustomerId() && $customer = $observer->getEvent()->getCustomer()) {
    +        if ($customer = $observer->getEvent()->getCustomer()) {

app / code / core / Mage / Usa / Helper / Data.php

+
+    /**
+     * Validate ups type value
+     *
+     * @param $valueForCheck string ups type value for check
+     *
+     * @return bool
+     */
+    public function validateUpsType($valueForCheck) {
+        $result = false;
+        $sourceModel = Mage::getSingleton('usa/shipping_carrier_ups_source_type');
+        foreach ($sourceModel->toOptionArray() as $allowedValue) {
+            if (isset($allowedValue['value']) && $allowedValue['value'] == $valueForCheck) {
+                $result = true;
+                break;
+            }
+        }
+        return $result;
+    }
 }

cron.php

cron.php: exception handle dalam file cron.php

-Mage::app('admin')->setUseSessionInUrl(false);
+try {
+    Mage::app('admin')->setUseSessionInUrl(false);
+} catch (Exception $e) {
+    Mage::printException($e);
+    exit;
+}

lib / Varien / Gambar / Adaptor / Gd2.php

GD2: mengembalikan tipe mime nyata.

+        header("Content-type: ".$this->getMimeTypeWithOutFileType());

+
+    /**
+     * Gives real mime-type with not considering file type field
+     *
+     * @return string
+     */
+    public function getMimeTypeWithOutFileType()
+    {
+        return $this->_fileMimeType;
+    }
 }

js / tiny_mce / plugins / media / .htaccess

Jika Anda menggunakan nginx bukan Apache, pastikan Anda memperbarui konfigurasi Anda untuk menduplikasi perubahan ini.

+<IfModule mod_rewrite.c>
+    <Files moxieplayer.swf>
+        RewriteEngine on
+        RewriteCond %{QUERY_STRING} !^$
+        RewriteRule ^(.*)$ %{REQUEST_URI}? [R=301,L]
+    </Files>
+</IfModule>

app / desain / adminhtml / default / default / templat / sistem / pengiriman / ups.phtml

+if (!in_array($storedOriginShipment, array_keys($orShipArr))) {
+    $storedOriginShipment = '';
+}

+if ($storedFreeShipment != '' && !in_array($storedFreeShipment, array_keys($defShipArr))) {
+    $storedFreeShipment = '';
+}

+if (!Mage::helper('usa')->validateUpsType($storedUpsType)) {
+    $storedUpsType = '';
+}

Metode pengiriman file yang baru ditambahkan / diperbarui adalah:

app/code/core/Mage/Usa/Helper/Data.php
app/code/core/Mage/Usa/Model/Shipping/Carrier/Abstract/Backend/Abstract.php
app/code/core/Mage/Usa/Model/Shipping/Carrier/Ups/Backend/Freemethod.php
app/code/core/Mage/Usa/Model/Shipping/Carrier/Ups/Backend/OriginShipment.php
app/code/core/Mage/Usa/Model/Shipping/Carrier/Ups/Backend/Type.php

File Escapehtml:

File frontend produk yang dapat diunduh: Siapa pun yang menggunakan produk yang dapat didownload silakan perbarui file dalam file tema Anda.

app / design / frontend / base / default / template / dapat diunduh / katalog / produk / links.phtml

Periksa kode

<dt><label<?php if ($_isRequired) echo ' class="required"' ?>><?php if ($_isRequired) echo '<em>*</em>' ?><?php echo
    > $this->getLinksTitle() ?></label></dt>

Ubah dengan

<dt><label<?php if ($_isRequired) echo ' class="required"' ?>><?php if ($_isRequired) echo '<em>*</em>' ?><?php echo
    > $this->escapeHtml($this->getLinksTitle()); ?></label></dt>

app / design / frontend / base / default / template / dapat diunduh / checkout / keranjang / item / default.phtml

Periksa kode

<dt><?php echo $this->getLinksTitle() ?></dt>

Ubah dengan

 <dt><?php echo $this->escapeHtml($this->getLinksTitle()); ?></dt>

aplikasi / desain / antarmuka / basis / default / template / dapat diunduh / penjualan / pesanan / item / renderer / downloadable.phtml

Periksa kode

<dt><?php echo $this->getLinksTitle() ?></dt>

Ubah dengan

<dt><?php echo $this->escapeHtml($this->getLinksTitle()); ?></dt>

aplikasi / desain / antarmuka / default / iphone / templat / dapat diunduh / checkout / keranjang / item / default.phtml

Periksa kode

<dt><?php echo $this->getLinksTitle() ?></dt>

Ubah dengan

<dt><?php echo $this->escapeHtml($this->getLinksTitle()); ?></dt>

app / design / frontend / default / iphone / template / dapat diunduh / checkout / onepage / review / item.phtml Periksa kode

`<dt><?php echo $this->getLinksTitle() ?></dt>`

Ubah dengan

`<dt><?php echo $this->escapeHtml($this->getLinksTitle()); ?></dt>`

app / design / frontend / rwd / default / template / dapat diunduh / checkout / keranjang / item / default.phtml Periksa kode

`<dt><?php echo $this->getLinksTitle() ?></dt>`

Ubah dengan

`<dt><?php echo $this->escapeHtml($this->getLinksTitle()); ?></dt>`

app / design / frontend / rwd / default / template / dapat diunduh / checkout / onepage / review / item.phtml

Periksa kode

<dt><?php echo $this->getLinksTitle() ?></dt>

Ubah dengan

<dt><?php echo $this->escapeHtml($this->getLinksTitle()); ?></dt>

app / design / frontend / rwd / default / template / dapat diunduh / penjualan / pesanan / item / renderer / downloadable.phtml

Periksa kode

<dt><?php echo $this->getLinksTitle() ?></dt>

Ubah dengan

<dt><?php echo $this->escapeHtml($this->getLinksTitle()); ?></dt>

File Escapehtml lainnya:

app / code / core / Mage / Adminhtml / Blok / Katalog / Produk / Komposit / Fieldset / Options.php

+        if (!empty($option['file_extension'])) {
+            $option['file_extension'] = $this->escapeHtml($option['file_extension']);
+        }

app / code / core / Mage / Adminhtml / Blok / Katalog / Produk / Edit / Tab / Opsi / Option.php

-                    $value['file_extension'] = $option->getFileExtension();
+                    $value['file_extension'] = $this->escapeHtml($option->getFileExtension());

app / desain / frontend / perusahaan / default / template / cms / hierarki / pagination.phtml

-    <li><a title="<?php echo $this->escapeHtml($node->getLabel())?>" href="<?php echo $node->getUrl()?>"><?php echo $this->getNodeLabel($node)?></a></li>

+    <li><a title="<?php echo $this->escapeHtml($node->getLabel())?>" href="<?php echo $node->getUrl()?>"><?php echo $this->escapeHtml($this->getNodeLabel($node)); ?></a></li>

Modifikasi ke filtermetode kelebihan beban di Zend_Filter_PregReplaceadalah naif, dan mengasumsikan bahwa $this->_matchPatternselalu string. Properti ini selanjutnya disediakan sebagai argumen pertama preg_replace. Pada kenyataannya, sebuah array juga merupakan argumen yang benar-benar valid. Fakta ini sebenarnya digunakan oleh beberapa Zend_Filterkelas inti (seperti Zend_Filter_Word_SeparatorToCamelCase). Jadi setiap ekstensi / cabang kode yang menggunakan filter ini atau salah satu turunannya, dengan argumen array _matchPattern, akan mulai melempar Warning: substr() expects parameter 1 to be a string, array given.

Contoh kasar dari apa yang mungkin harus dilakukan akan menjadi sesuatu di sepanjang baris:

/**
 * Perform regexp replacement as filter
 *
 * @param  string $value
 * @return string
 */
public function filter($value)
{
    if ($this->_matchPattern == null) {
        #require_once 'Zend/Filter/Exception.php';
        throw new Zend_Filter_Exception(get_class($this) . ' does not have a valid MatchPattern set.');
    }

    $patterns = is_array($this->_matchPattern) ? $this->_matchPattern : array($this->_matchPattern);
    foreach ($patterns as $pattern) {
        if ($this->_containsEvalModifier($pattern)) {
            throw new Zend_Filter_Exception(get_class($this) . ' uses deprecated modifier "/e".');
        }
    }

    return preg_replace($this->_matchPattern, $this->_replacement, $value);
}

/**
 * Check if the modifiers contains the eval flag.
 *
 * @param  string $value
 * @return bool
 */
protected function _containsEvalModifier($pattern)
{
    $firstDelimiter = substr($pattern, 0, 1);
    $partsOfRegex = explode($firstDelimiter, $pattern);
    $modifiers = array_pop($partsOfRegex);

    return ($modifiers != str_replace('e', '', $modifiers));
}

Meskipun saya belum melakukan pengujian menyeluruh tentang ini.

EDIT: Perlu dicatat, bahwa sementara solusi yang diusulkan di atas harus mencegah kesalahan, implementasi secara teknis masih agak naif dan cenderung positif palsu. Diasumsikan bahwa pembatas regex yang memisahkan pola dari pengubah sama dengan yang ada di awal string. Secara teknis ini tidak harus menjadi kasus sejak PHP mendukung berbagai pembatas gaya braket. Oleh karena itu input yang valid {hello}isakan menentukan pengubah hello}is(bukan pengubah sebenarnya is) dan dengan demikian akan mengeluarkan pengecualian, meskipun polanya tidak benar-benar memasukkan epengubah.

1.7.0.2 Masalah Versi: Setelah menginstal tambalan dan pergi ke satu halaman checkout (generic Magento checkout), dapatkan kesalahan ini

Parse error: syntax error, tak terduga

app / code / core / Mage / Checkout / Model / Jenis / Onepage.php on line 691

Mengembalikan tambalan, kesalahan hilang.

Melihat lebih dalam ke pertanyaan ini, saya telah menemukan tambalan telah menambahkan baris berikut ke file onepage.php.

$passwordCreatedTime = $this->_checkoutSession->getData('_session_validator_data')['session_expire_timestamp']
            - Mage::getSingleton('core/cookie')->getLifetime();
        $customer->setPasswordCreatedAt($passwordCreatedTime);

SOLUSI: Terima kasih kepada @FabianSchmengler

UPDATE TO PHP versi 5.4 dan lebih tinggi!

masalah yang diketahui: -

Jika kode khusus atau ekstensi Anda menggunakan Zend/Filter/PregReplace.php dengan pengubah e, ​​sekarang akan menghasilkan kesalahan karena kemungkinan masalah RCE.

Patch ini mengikuti keamanan di bawah ini.

1) Perubahan kata sandi validasi sesi admin tambahan

+++ app/code/core/Mage/Admin/Model/User.php

+            $sessionUser = $this->getSession()->getUser();
+            if ($sessionUser && $sessionUser->getId() == $this->getId()) {
+                $this->getSession()->setUserPasswordChanged(true);
+            }

lalu

+    /**
+     * @return Mage_Admin_Model_Session
+     */
+    protected function getSession()
+    {
+        return  Mage::getSingleton('admin/session');
+    }
+

class Mage_Admin_Model_User

+        $oldPassword = $this->getPassword();
     $this->setId(null);
     $this->load($id);
+        $isUserPasswordChanged = $this->getSession()->getUserPasswordChanged();
+        if ($this->getPassword() !== $oldPassword && !$isUserPasswordChanged) {
+            $this->setId(null);
+        } elseif ($isUserPasswordChanged) {
+            $this->getSession()->setUserPasswordChanged(false);
+        }

2) Validasi Ekstensi File

app/code/core/Mage/Adminhtml/Block/Catalog/Product/Composite/Fieldset/Options.php

+        if (!empty($option['file_extension'])) {
+            $option['file_extension'] = $this->escapeHtml($option['file_extension']);
+        }

app/code/core/Mage/Adminhtml/Block/Catalog/Product/Edit/Tab/Options/Option.php app/code/core/Mage/Adminhtml/Block/Catalog/Product/Edit/Tab/Options/Option.php

-                    $value['file_extension'] = $option->getFileExtension();
+                    $value['file_extension'] = $this->escapeHtml($option->getFileExtension());

app/code/core/Mage/Catalog/Model/Product.php

+                        if (!empty($option['file_extension'])) {
+                            $fileExtension = $option['file_extension'];
+                            if (0 !== strcmp($fileExtension, Mage::helper('core')->removeTags($fileExtension))) {
+                                Mage::throwException(Mage::helper('catalog')->__('Invalid custom option(s).'));
+                            }
+                        }

3) Escape Html ditambahkan untuk XSS

+++ app/code/core/Mage/Adminhtml/Block/Widget/Grid/Column/Filter/Datetime.php

-            return $value;
+            return $this->escapeHtml($value);
     }

-        return parent::getEscapedValue($index);
+        return $this->escapeHtml(parent::getEscapedValue($index));

app/design/frontend/base/default/template/downloadable/catalog/product/links.phtml

-        <dt><label<?php if ($_isRequired) echo ' class="required"' ?>><?php if ($_isRequired) echo '<em>*</em>' ?><?php echo $this->getLinksTitle() ?></label></dt>
+        <dt><label<?php if ($_isRequired) echo ' class="required"' ?>><?php if ($_isRequired) echo '<em>*</em>' ?><?php echo $this->escapeHtml($this->getLinksTitle()); ?></label></dt>

app/design/frontend/base/default/template/downloadable/checkout/cart/item/default.phtml

-            <dt><?php echo $this->getLinksTitle() ?></dt>
+            <dt><?php echo $this->escapeHtml($this->getLinksTitle()); ?></dt>

app/design/frontend/base/default/template/downloadable/checkout/onepage/review/item.phtml

-            <dt><?php echo $this->getLinksTitle() ?></dt>
+            <dt><?php echo $this->escapeHtml($this->getLinksTitle()); ?></dt>

app/design/frontend/base/default/template/downloadable/sales/order/items/renderer/downloadable.phtml

-            <dt><?php echo $this->getLinksTitle() ?></dt>
+            <dt><?php echo $this->escapeHtml($this->getLinksTitle()); ?></dt>

app/design/frontend/default/iphone/template/downloadable/checkout/onepage/review/item.phtml

-                <dt><?php echo $this->getLinksTitle() ?></dt>
+                <dt><?php echo $this->escapeHtml($this->getLinksTitle()); ?></dt>

app/design/frontend/rwd/default/template/downloadable/checkout/cart/item/default.phtml

-            <dt><?php echo $this->getLinksTitle() ?></dt>
+            <dt><?php echo $this->escapeHtml($this->getLinksTitle()); ?></dt>

app/design/frontend/rwd/default/template/downloadable/checkout/onepage/review/item.phtml

-            <dt><?php echo $this->getLinksTitle() ?></dt>
+            <dt><?php echo $this->escapeHtml($this->getLinksTitle()); ?></dt>

app/design/frontend/rwd/default/template/downloadable/sales/order/items/renderer/downloadable.phtml

-            <dt><?php echo $this->getLinksTitle() ?></dt>
+            <dt><?php echo $this->escapeHtml($this->getLinksTitle()); ?></dt>

4) Ekspresi XPath untuk memeriksa pembaruan tata letak

app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator.php

+    /**
+     * XPath expression for checking layout update
+     *
+     * @var array
+     */
+    protected $_disallowedXPathExpressions = array(
+        '*//template',
+        '*//@template',
+        '//*[@method=\'setTemplate\']',
+        '//*[@method=\'setDataUsingMethod\']//*[text() = \'template\']/../*'
+    );
+

Mage_Adminhtml_Model_LayoutUpdate_Validator

-        if ($templatePaths = $value->xpath('*//template | *//@template | //*[@method=\'setTemplate\']/*')) {
+        if ($templatePaths = $value->xpath($this->_getXpathValidationExpression())) {

Mage_Adminhtml_Model_LayoutUpdate_Validator

+    /**
+     * Returns xPath for validate incorrect path to template
+     *
+     * @return string xPath for validate incorrect path to template
+     */
+    protected function _getXpathValidationExpression() {
+        return implode(" | ", $this->_disallowedXPathExpressions);
+    }
+



+    /**
+     * Returns xPath for validate incorrect path to template
+     *
+     * @return string xPath for validate incorrect path to template
+     */
+    protected function _getXpathValidationExpression() {
+        return implode(" | ", $this->_disallowedXPathExpressions);
+    }
+

app/code/core/Mage/Catalog/Model/Resource/Category/Tree.php

+            if (!preg_match("#^[0-9\/]+$#", $item['path'])) {
+                $item['path'] = '';
+            }

5) Injeksi SQL terotentikasi saat menyimpan kategori

app/code/core/Mage/Adminhtml/controllers/Catalog/CategoryController

+            if (isset($data['general']['path'])) {
+                unset($data['general']['path']);
+            }

6) Produk memvalidasi app/code/core/Mage/Adminhtml/controllers/Catalog/ProductController.php

+                $product->validate();

7) mimetype app/code/core/Mage/Adminhtml/controllers/Cms/Wysiwyg/ImagesController.php

+            $this->getResponse()->setHeader('Content-type', $image->getMimeTypeWithOutFileType());

app/code/core/Mage/Adminhtml/controllers/Cms/WysiwygController.php

+        $this->getResponse()->setHeader('Content-type', $image->getMimeTypeWithOutFileType());

lib/Varien/Image/Adapter/Gd2.php

-        header("Content-type: ".$this->getMimeType());
+        header("Content-type: ".$this->getMimeTypeWithOutFileType());


+
+    /**
+     * Gives real mime-type with not considering file type field
+     *
+     * @return string
+     */
+    public function getMimeTypeWithOutFileType()
+    {
+        return $this->_fileMimeType;
+    }

8) Customer Passsword dibuatat app/code/core/Mage/Adminhtml/controllers/CustomerController.php

+                    $customer->setPasswordCreatedAt(time());

app/code/core/Mage/Checkout/Model/Api/Resource/Customer.php

+        $customer->setPasswordCreatedAt(time());

app/code/core/Mage/Checkout/Model/Type/Onepage.php

+        $passwordCreatedTime = $this->_checkoutSession->getData('_session_validator_data')['session_expire_timestamp']
+            - Mage::getSingleton('core/cookie')->getLifetime();
+        $customer->setPasswordCreatedAt($passwordCreatedTime);

app/code/core/Mage/Core/Model/Session/Abstract/Varien.php

+    const VALIDATOR_PASSWORD_CREATE_TIMESTAMP   = 'password_create_timestamp';


+    /**
+     * Use password creation timestamp in validator key
+     *
+     * @return bool
+     */
+    public function useValidateSessionPasswordTimestamp()
+    {
+        return true;
+    }


+        if ($this->useValidateSessionPasswordTimestamp()
+            && isset($validatorData[self::VALIDATOR_PASSWORD_CREATE_TIMESTAMP])
+            && isset($sessionData[self::VALIDATOR_SESSION_EXPIRE_TIMESTAMP])
+            && $validatorData[self::VALIDATOR_PASSWORD_CREATE_TIMESTAMP]
+            > $sessionData[self::VALIDATOR_SESSION_EXPIRE_TIMESTAMP] - $this->getCookie()->getLifetime()
+        ) {
+            return false;
+        }

app/code/core/Mage/Customer/Helper/Data.php

+    /**
+     * Get customer password creation timestamp or customer account creation timestamp
+     *
+     * @param $customerId
+     * @return int
+     */
+    public function getPasswordTimestamp($customerId)
+    {
+        /** @var $customer Mage_Customer_Model_Customer */
+        $customer = Mage::getModel('customer/customer')
+            ->setWebsiteId(Mage::app()->getStore()->getWebsiteId())
+            ->load((int)$customerId);
+        $passwordCreatedAt = $customer->getPasswordCreatedAt();
+
+        return is_null($passwordCreatedAt) ? $customer->getCreatedAtTimestamp() : $passwordCreatedAt;
+    }
+

app/code/core/Mage/Customer/Model/Resource/Customer.php

-        $customer->setPassword($newPassword);
+        $customer->setPassword($newPassword)->setPasswordCreatedAt(time());
     $this->saveAttribute($customer, 'password_hash');
+        $this->saveAttribute($customer, 'password_created_at');

app/code/core/Mage/Customer/controllers/AccountController.php

+                $customer->setPasswordCreatedAt(time());

Mage_Customer_AccountController

+            $customer->setPasswordCreatedAt(time());
         $customer->save();

``

+                $customer->setPasswordCreatedAt(time());

app/code/core/Mage/Log/Model/Visitor.php

-        if (!$this->getCustomerId() && $customer = $observer->getEvent()->getCustomer()) {
+        if ($customer = $observer->getEvent()->getCustomer()) {

9) Perubahan UPS

app/code/core/Mage/Usa/Helper/Data.php

+
+    /**
+     * Validate ups type value
+     *
+     * @param $valueForCheck string ups type value for check
+     *
+     * @return bool
+     */
+    public function validateUpsType($valueForCheck) {
+        $result = false;
+        $sourceModel = Mage::getSingleton('usa/shipping_carrier_ups_source_type');
+        foreach ($sourceModel->toOptionArray() as $allowedValue) {
+            if (isset($allowedValue['value']) && $allowedValue['value'] == $valueForCheck) {
+                $result = true;
+                break;
+            }
+        }
+        return $result;
+    }

TAMBAH file untuk UPS

`app/code/core/Mage/Usa/Model/Shipping/Carrier/Abstract/Backend/Abstract.php` 
`app/code/core/Mage/Usa/Model/Shipping/Carrier/Ups/Backend/Freemethod.php`
`app/code/core/Mage/Usa/Model/Shipping/Carrier/Ups/Backend/OriginShipment.php`
`app/code/core/Mage/Usa/Model/Shipping/Carrier/Ups/Backend/Type.php`

Pengaturan Ditambahkan untuk functoinlaity baru ini

app/code/core/Mage/Usa/etc/system.xml

+                            <backend_model>usa/shipping_carrier_ups_backend_freemethod</backend_model>

843 baris

+                            <backend_model>usa/shipping_carrier_ups_backend_originShipment</backend_model>

886

+                            <backend_model>usa/shipping_carrier_ups_backend_type</backend_model>

app/design/adminhtml/default/default/template/system/shipping/ups.phtml

+if (!in_array($storedOriginShipment, array_keys($orShipArr))) {
+    $storedOriginShipment = '';
+}
+if ($storedFreeShipment != '' && !in_array($storedFreeShipment, array_keys($defShipArr))) {
+    $storedFreeShipment = '';
+}
+if (!Mage::helper('usa')->validateUpsType($storedUpsType)) {
+    $storedUpsType = '';
+}
 ?>

10) Kelas Zend ditambahkan

`app/code/core/Zend/Filter/PregReplace.php`
`app/code/core/Zend/Validate/EmailAddress.php`

1> 1) Validasi Produk Bundle

app/design/adminhtml/default/default/template/bundle/product/edit/bundle/option.phtml

+    <?php $_selection->setSku($this->escapeHtml($_selection->getSku())); ?>

12) Sesi admin di coba tangkap di cron.php

-Mage::app('admin')->setUseSessionInUrl(false);
+try {
+    Mage::app('admin')->setUseSessionInUrl(false);
+} catch (Exception $e) {
+    Mage::printException($e);
+    exit;
+}

Sepertinya bagian dari tambalan adalah htmlEscaping semua "getLinksTitle ()". Tetapi mereka lupa file-file berikut (ini didasarkan pada 1.8.1).

app/design/frontend/base/default/template/downloadable/checkout/multishipping/item/downloadable.phtml

app/design/frontend/base/default/template/downloadable/email/order/items/creditmemo/downloadable.phtml

app/design/frontend/base/default/template/downloadable/email/order/items/invoice/downloadable.phtml

app/design/frontend/base/default/template/downloadable/email/order/items/order/downloadable.phtml

app/design/frontend/base/default/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml

app/design/frontend/base/default/template/downloadable/sales/order/invoice/items/renderer/downloadable.phtml

app/design/frontend/default/iphone/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml

app/design/frontend/default/iphone/template/downloadable/sales/order/invoice/items/renderer/downloadable.phtml

Tambalan tidak berfungsi pada vanilla Magento CE 1.8.0.0

Pembaruan: Menambahkan solusi di bawah ini.

Masalah:

file app/design/frontend/base/default/template/downloadable/sales/order/items/renderer/downloadable.phtml
Hunk #1 FAILED at 54.

Tambalan sebelumnya yang diterapkan:

• APPSEC-212
• SUPEE-2619
• SUPEE-2725
• SUPEE-3941
• SUPEE-5344
• SUPEE-5994
• SUPEE-6237
• SUPEE-6285
• SUPEE-6482
• SUPEE-6788
• SUPEE-7405
• SUPEE-7405v.1.1
• SUPEE-7616
• SUPEE-8167
• SUPEE-8788v2
• SUPEE-8967
• SUPEE-9652
• SUPEE-9767v2
• SUPEE-10336
• SUPEE-10266
• SUPEE-10415
• SUPEE-10570v2

Larutan

Diperbaiki dengan mengedit file tambalan. Ganti tambalan downloadable.phtmldengan yang dari tambalan untukv1.7.0.2 dalam file tambalan asli ini adalah garis 1854-1862.

Ini terutama karena lekukan dalam file. Karena perubahan downloadable.phtmldalam V1.7.0.2telah lebih menjorok.

Solusi 2

Saya memiliki masalah yang sama, tapi saya bisa memperbaikinya dengan menyimpan kembali file asli dalam editor yang memaksa baris berakhir menjadi gaya Unix LF, bukan gaya Windows CRLF atau Mac CR

Mengacu pada Matt Antley, mungkin mereka tidak menyertakan SUPEE-10570v2 karena ini

Magento baru-baru ini diberitahu tentang masalah dengan patch SUPEE-10570> dan Magento versi 1.9.3.8/1.14.3.8 yang dapat mengakibatkan ketidakmampuan pelanggan untuk menyelesaikan checkout ketika mencoba mendaftar saat checkout. Magento sekarang menyediakan tambalan yang diperbarui (SUPEE-10570v2) yang> tidak lagi menyebabkan masalah ini. Namun, perlu diketahui bahwa tambalan baru ini tidak lagi melindungi terhadap dua masalah keamanan terkait penanganan sesi berisiko rendah yang diproteksi oleh SUPEE-10570. https://magento.com/security/patches/supee-10570

Sejauh yang saya tahu bug checkout tidak terlalu umum sehingga mereka memutuskan untuk tetap dengan SUPEE-10570 yang melindungi terhadap dua masalah keamanan risiko rendah ?!

Tambalan tidak berfungsi pada vanilla Magento CE 1.6.0.0

Pembaruan: Menambahkan solusi di bawah ini.

Masalah:

file app/code/core/Mage/Admin/Model/User.php
Hunk #1 FAILED at 127.
...
file app/code/core/Mage/Customer/controllers/AccountController.php
Hunk #2 FAILED at 812.

Tambalan sebelumnya yang diterapkan:

• APPSEC-212
• SUPEE-2631
• SUPEE-2725
• SUPEE-5344
• SUPEE-5994
• SUPEE-6237
• SUPEE-6285
• SUPEE-6482
• SUPEE-6788
• SUPEE-7405
• SUPEE-7405v.1.1
• SUPEE-8167
• SUPEE-8788v2
• SUPEE-8967
• SUPEE-9652
• SUPEE-9767v2
• SUPEE-10266
• SUPEE-10415
• SUPEE-10570v2
• SUPEE-10752

Terpecahkan

Saya telah memperbaiki masalah ini dengan mengubah file tambalan. Saya mengganti bakhil yang memberikan masalah dengan yang sesuai dari patch untuk v1.5.1.0. Dalam file tambalan asli ini adalah baris 167-177 dan 663-670.

Di EE v1.14.2.4 setelah menerapkan SUPEE-10752, saya harus menerapkan tambalan berikut juga untuk memperbaiki masalah ketika checkout diarahkan ke beranda alih-alih halaman sukses:

File: invalid_session_fix-2018-03-14-05-10-19.patch

diff --git a/app/code/core/Mage/Core/Model/Session/Abstract/Varien.php b/app/code/core/Mage/Core/Model/Session/Abstract/Varien.php
index 59b3ea8..35155f1 100644
--- a/app/code/core/Mage/Core/Model/Session/Abstract/Varien.php
+++ b/app/code/core/Mage/Core/Model/Session/Abstract/Varien.php
@@ -485,7 +485,7 @@ class Mage_Core_Model_Session_Abstract_Varien extends Varien_Object
             && isset($validatorData[self::VALIDATOR_PASSWORD_CREATE_TIMESTAMP])
             && isset($sessionData[self::VALIDATOR_SESSION_EXPIRE_TIMESTAMP])
             && $validatorData[self::VALIDATOR_PASSWORD_CREATE_TIMESTAMP]
-            > $sessionData[self::VALIDATOR_SESSION_EXPIRE_TIMESTAMP] - $this->getCookie()->getLifetime()
+            > $sessionData[self::VALIDATOR_SESSION_EXPIRE_TIMESTAMP]
         ) {
             return false;
         }

Perbaikan di atas ditemukan di https://magento.com/tech-resources/download di bawah SUPEE-10570 > invalid_session_fix.patch (0 MB)

Saya mengalami masalah setelah tambalan ini. Saya tidak dapat mengatur "Metode Gratis" untuk "Tipe UPS" "United Parcel Service XML". Magento melempar kesalahan ketika metode apa pun dipilih di drop-down "Metode Gratis". Kesalahan: " Bidang" Metode Gratis Ups "memiliki nilai yang salah. "

Adakah yang pernah mengalami masalah yang sama dan mendapatkan solusinya?

Terima kasih sebelumnya!

Pada 1.6, tambalan ups.phtml rusak. Ini merujuk $ tersimpanOriginShipment, $ disimpanFreeShipment yang memiliki kesalahan ketik dalam 1,6 ($ stroredOriginShipment dan $ stroredFreeShipment). Lebih jauh lagi, referensi $ disimpanUpsType yang tidak ada sama sekali dalam 1,6.

Kami mengalami masalah pada 1.9.1.0 dan 1.9.2.4 (belum diuji pada orang lain). Itu tidak muncul di semua proyek kami, tetapi sudah berulang pada beberapa dari mereka. Kami pikir itu mungkin memengaruhi proyek yang SUPEE-10570v1 diinstal di beberapa titik.

Setelah menerapkan tambalan, jika pengguna masuk, mereka akan melihat halaman akun mereka dengan sangat baik. Namun, jika mereka mencoba untuk kembali ke halaman lain di situs ini, halaman tersebut akan berhenti merespons dan mereka akan melihat layar kosong atau 502 Bad Gateway. Hal ini disebabkan oleh PHP yang masuk ke loop tak terbatas dan baik segfaulting atau dihentikan oleh pengaturan .ini.

Saya sudah berhasil menggali bahwa masalah adalah rekursi tak terbatas pada baris yang beban yang $customerdi \app\code\core\Mage\Customer\Helper\Data.php, getPasswordTimestamp().

$customer = Mage::getModel('customer/customer')
        ->setWebsiteId(Mage::app()->getStore()->getWebsiteId())
        ->load((int)$customerId);

Ketika melihat jejak tumpukan rekursi tak terbatas, itu terus berulang kembali ke ini. Entah bagaimana, tampaknya ->load()akhirnya memanggil getPasswordTimestamp()metode.

Solusi yang diberikan di /magento//a/235984/67252 berfungsi dengan baik, tapi saya ingin tahu apa yang terjadi.

Setelah menerapkan tambalan SUPEE 10752, Registrasi dan checkout membawa halaman sukses ke beranda. Ada saran?

Kami melihat halaman kosong di / checkout / * setelah menerapkan SUPEE-10752 dan kompilasi

versi: 1.9.1.0

Kondisi yang memicu: menerapkan SUPEE-10752 + mengaktifkan compiler + login sebagai pelanggan, lalu kunjungi / checkout / *

Hanya untuk memperjelas: Dengan kompiler yang dinonaktifkan semua hal berjalan dengan baik, dengan kompiler yang diaktifkan kita hanya bisa melihat halaman keranjang kosong ketika login tanpa entri log (bahkan setelah mengaktifkan semua log yang mungkin dan mode pengembang).