SUPEE-10888 adalah patch keamanan baru untuk Magento 1 yang membahas 12 masalah keamanan.

https://magento.com/security/patches/supee-10888

SUPEE-10888, Magento Commerce 1.14.3.10 dan Open Source 1.9.3.10 berisi beberapa peningkatan keamanan yang membantu menutup skrip lintas situs (XSS), pemalsuan permintaan lintas situs (CSRF) dan kerentanan lainnya.

Patch tersebut dapat ditemukan di https://magento.com/tech-resources/download#download2243

Masalah umum apa yang harus Anda perhatikan saat menerapkan tambalan ini?

File di bawah ini telah diubah / dibuat setelah tambalan diterapkan

app/code/core/Mage/Admin/Model/User.php 
app/code/core/Mage/Admin/etc/config.xml 
app/code/core/Mage/Adminhtml/Block/Catalog/Product/Edit/Tab/Super/Config.php 
app/code/core/Mage/Adminhtml/Block/Widget/Grid/Massaction/Abstract.php 
app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator.php 
app/code/core/Mage/Adminhtml/controllers/Catalog/ProductController.php 
app/code/core/Mage/Adminhtml/controllers/Permissions/UserController.php 
app/code/core/Mage/Adminhtml/etc/config.xml 
app/code/core/Mage/Checkout/Model/Api/Resource/Customer.php 
app/code/core/Mage/Checkout/Model/Type/Onepage.php 
app/code/core/Mage/Cms/Model/Wysiwyg/Images/Storage.php 
app/code/core/Mage/Core/etc/config.xml 
app/code/core/Mage/Core/etc/system.xml 
app/code/core/Mage/Customer/Helper/Data.php 
app/code/core/Mage/Customer/Model/Customer.php 
app/code/core/Mage/Customer/Model/Resource/Customer.php 
app/code/core/Mage/Customer/controllers/AccountController.php 
app/code/core/Mage/Customer/etc/config.xml app/code/core/Mage/Customer/etc/config.xml
app/code/core/Mage/Customer/sql/customer_setup/upgrade-1.6.2.0.6.1.1-1.6.2.0.6.1.2.php 
app/code/core/Mage/Paypal/Model/Express/Checkout.php 
app/code/core/Mage/XmlConnect/controllers/ReviewController.php 
app/code/core/Zend/Filter/PregReplace.php app/code/core/Zend/Filter/PregReplace.php
app/design/adminhtml/default/default/template/bundle/product/edit/bundle/option.phtml 
app/design/adminhtml/default/default/template/bundle/sales/creditmemo/create/items/renderer.phtml 
app/design/adminhtml/default/default/template/bundle/sales/creditmemo/view/items/renderer.phtml 
app/design/adminhtml/default/default/template/bundle/sales/invoice/create/items/renderer.phtml 
app/design/adminhtml/default/default/template/bundle/sales/invoice/view/items/renderer.phtml 
app/design/adminhtml/default/default/template/bundle/sales/order/view/items/renderer.phtml 
app/design/adminhtml/default/default/template/bundle/sales/shipment/create/items/renderer.phtml 
app/design/adminhtml/default/default/template/bundle/sales/shipment/view/items/renderer.phtml 
app/design/adminhtml/default/default/template/catalog/product/helper/gallery.phtml 
app/design/frontend/base/default/template/bundle/email/order/items/creditmemo/default.phtml 
app/design/frontend/base/default/template/bundle/email/order/items/invoice/default.phtml 
app/design/frontend/base/default/template/bundle/email/order/items/order/default.phtml 
app/design/frontend/base/default/template/bundle/email/order/items/shipment/default.phtml 
app/design/frontend/base/default/template/bundle/sales/order/creditmemo/items/renderer.phtml 
app/design/frontend/base/default/template/bundle/sales/order/invoice/items/renderer.phtml 
app/design/frontend/base/default/template/bundle/sales/order/items/renderer.phtml 
app/design/frontend/base/default/template/bundle/sales/order/shipment/items/renderer.phtml 
app/design/frontend/base/default/template/downloadable/checkout/multishipping/item/downloadable.phtml 
app/design/frontend/base/default/template/downloadable/email/order/items/creditmemo/downloadable.phtml 
app/design/frontend/base/default/template/downloadable/email/order/items/invoice/downloadable.phtml 
app/design/frontend/base/default/template/downloadable/email/order/items/order/downloadable.phtml 
app/design/frontend/base/default/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml 
app/design/frontend/base/default/template/downloadable/sales/order/invoice/items/renderer/downloadable.phtml 
app/design/frontend/default/iphone/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml 
app/design/frontend/default/iphone/template/downloadable/sales/order/invoice/items/renderer/downloadable.phtml 
app/design/frontend/default/iphone/template/downloadable/sales/order/items/renderer/downloadable.phtml 
app/design/frontend/rwd/default/template/bundle/email/order/items/creditmemo/default.phtml 
app/design/frontend/rwd/default/template/bundle/email/order/items/invoice/default.phtml 
app/design/frontend/rwd/default/template/bundle/email/order/items/order/default.phtml 
app/design/frontend/rwd/default/template/bundle/email/order/items/shipment/default.phtml 
app/design/frontend/rwd/default/template/bundle/sales/order/items/renderer.phtml 
app/design/frontend/rwd/default/template/downloadable/email/order/items/creditmemo/downloadable.phtml 
app/design/frontend/rwd/default/template/downloadable/email/order/items/invoice/downloadable.phtml 
app/design/frontend/rwd/default/template/downloadable/email/order/items/order/downloadable.phtml 
app/locale/en_US/Mage_Adminhtml.csv app/locale/en_US/Mage_Adminhtml.csv
app/locale/en_US/Mage_Customer.csv app/locale/en_US/Mage_Customer.csv
app/locale/en_US/template/email/account_password_reset_confirmation.html 
app/locale/en_US/template/email/admin_new_user_notification.html 
downloader/Maged/Controller.php downloader/Maged/Controller.php
skin/adminhtml/default/enterprise/images/placeholder/thumbnail.jpg 

Di patch v1 asli dengan 2018-09-18nama file:

File skin/adminhtml/default/enterprise/images/placeholder/thumbnail.jpg: git binary diffs are not supported.

Magento diam-diam memperbaiki masalah ini dengan merilis file tambalan baru. Masih v1dengan 2018-09-19nama file.

Masalah dengan tambalan PATCH_SUPEE-10888_CE_v1.9.0.1_v1-2018-09-18-02-54-39.shdi vanilla Magento 1.8.1.0, dengan semua tambalan sebelumnya diinstal:

can't find file to patch at input line 1019
Perhaps you used the wrong -p or --strip option?
The text leading up to this was:
--------------------------
|diff --git app/design/frontend/rwd/default/template/bundle/sales/order/items/renderer.phtml app/design/frontend/rwd/default/template/bundle/sales/order/items/renderer.phtml
|index b1ec5eb0460..ca3e8b32474 100644
|--- app/design/frontend/rwd/default/template/bundle/sales/order/items/renderer.phtml
|+++ app/design/frontend/rwd/default/template/bundle/sales/order/items/renderer.phtml
--------------------------

Memang file app/design/frontend/rwd/default/template/bundle/sales/order/items/renderer.phtmltersebut tidak ada di 1.8.1.0 jadi saya menghapus perubahan ini dari file patch.

Saya tidak berhasil melakukan ini dengan 2018-09-19versi patch yang diperbarui . Hanya berhasil dengan file PATCH_SUPEE-10888_CE_v1.8.1.0_v1-2018-09-18-02-54-39setelah juga menghapus thumbnail.jpgperubahan seperti dijelaskan dalam komentar saya di /magento//a/242823/13642

Jika Anda menggunakan tema khusus dan tema Anda menimpa salah satu file di bawah ini maka Anda perlu menambahkan perubahan secara manual di tema Anda

app/design/frontend/base/default/template/bundle/email/order/items/creditmemo/default.phtml 
app/design/frontend/base/default/template/bundle/email/order/items/invoice/default.phtml 
app/design/frontend/base/default/template/bundle/email/order/items/order/default.phtml 
app/design/frontend/base/default/template/bundle/email/order/items/shipment/default.phtml 
app/design/frontend/base/default/template/bundle/sales/order/creditmemo/items/renderer.phtml 
app/design/frontend/base/default/template/bundle/sales/order/invoice/items/renderer.phtml 
app/design/frontend/base/default/template/bundle/sales/order/items/renderer.phtml 
app/design/frontend/base/default/template/bundle/sales/order/shipment/items/renderer.phtml 
app/design/frontend/base/default/template/downloadable/checkout/multishipping/item/downloadable.phtml 
app/design/frontend/base/default/template/downloadable/email/order/items/creditmemo/downloadable.phtml 
app/design/frontend/base/default/template/downloadable/email/order/items/invoice/downloadable.phtml 
app/design/frontend/base/default/template/downloadable/email/order/items/order/downloadable.phtml 
app/design/frontend/base/default/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml 
app/design/frontend/base/default/template/downloadable/sales/order/invoice/items/renderer/downloadable.phtml 
app/design/frontend/default/iphone/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml 
app/design/frontend/default/iphone/template/downloadable/sales/order/invoice/items/renderer/downloadable.phtml 
app/design/frontend/default/iphone/template/downloadable/sales/order/items/renderer/downloadable.phtml 
app/design/frontend/rwd/default/template/bundle/email/order/items/creditmemo/default.phtml 
app/design/frontend/rwd/default/template/bundle/email/order/items/invoice/default.phtml 
app/design/frontend/rwd/default/template/bundle/email/order/items/order/default.phtml 
app/design/frontend/rwd/default/template/bundle/email/order/items/shipment/default.phtml 
app/design/frontend/rwd/default/template/bundle/sales/order/items/renderer.phtml 
app/design/frontend/rwd/default/template/downloadable/email/order/items/creditmemo/downloadable.phtml 
app/design/frontend/rwd/default/template/downloadable/email/order/items/invoice/downloadable.phtml 
app/design/frontend/rwd/default/template/downloadable/email/order/items/order/downloadable.phtml 

misalnya jika sudah ditambahkan

 app/design/frontend/base/default/template/bundle/email/order/items/creditmemo/default.phtml

di tema Anda, maka Anda harus melakukan perubahan secara manual di

app/design/frontend/[YourPackge]/[YourTheme]/template/bundle/email/order/items/creditmemo/default.phtml

Misalnya Temukan baris ini

$attributes['option_label']

dan ganti dengan yang di bawah ini

$this->escapeHtml($attributes['option_label']);

Sebagaimana diuraikan dalam /magento//a/243531/142 , Anda perlu memeriksa semua file templat frontend kustom Anda dan memasukkan perubahan dari tambalan di sana secara manual.

Selain itu, Anda perlu memeriksa account_password_reset_confirmation.htmltemplat email Anda . Bergantung pada toko Anda, baik di bawah app/locale/[LANG]/template/email/atau di backend di bawah Sistem> Email Transaksional untuk semua bahasa. Di semua templat masing-masing, Anda perlu mengubah _query_id=$customer.idke _query_id=$customer.rp_customer_id. Perubahan telah diterapkan dengan cara yang kompatibel-mundur, tetapi jika Anda ingin menyertakan semua peningkatan keamanan, Anda tidak boleh melewatkan perubahan ini.

Pagi hari ini saya sudah menerapkan patch. File-file utama ada di backend Magento.

app/code/core/Mage/Admin/Model/User.php
app/code/core/Mage/Admin/etc/config.xml
app/code/core/Mage/Adminhtml/Block/Catalog/Product/Edit/Tab/Super/Config.php
app/code/core/Mage/Adminhtml/Block/Widget/Grid/Massaction/Abstract.php
app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator.php
app/code/core/Mage/Adminhtml/controllers/Catalog/ProductController.php
app/code/core/Mage/Adminhtml/controllers/Permissions/UserController.php
app/code/core/Mage/Adminhtml/etc/config.xml
app/code/core/Mage/Checkout/Model/Api/Resource/Customer.php
app/code/core/Mage/Checkout/Model/Type/Onepage.php
app/code/core/Mage/Cms/Model/Wysiwyg/Images/Storage.php
app/code/core/Mage/Core/etc/config.xml
app/code/core/Mage/Core/etc/system.xml
app/code/core/Mage/Customer/Helper/Data.php
app/code/core/Mage/Customer/Model/Customer.php
app/code/core/Mage/Customer/Model/Resource/Customer.php
app/code/core/Mage/Customer/controllers/AccountController.php
app/code/core/Mage/Customer/etc/config.xml
app/code/core/Mage/Customer/sql/customer_setup/upgrade-1.6.2.0.5.1.2-1.6.2.0.5.1.3.php
app/code/core/Mage/Paypal/Model/Express/Checkout.php
app/code/core/Mage/XmlConnect/controllers/ReviewController.php
app/code/core/Zend/Filter/PregReplace.php
app/locale/en_US/Mage_Adminhtml.csv
app/locale/en_US/Mage_Customer.csv
app/locale/en_US/template/email/account_password_reset_confirmation.html
app/locale/en_US/template/email/admin_new_user_notification.html
downloader/Maged/Controller.php
skin/adminhtml/default/enterprise/images/placeholder/thumbnail.jpg

Escapehtml menambahkan file

app/design/adminhtml/default/default/template/bundle/product/edit/bundle/option.phtml
app/design/adminhtml/default/default/template/bundle/sales/creditmemo/create/items/renderer.phtml
app/design/adminhtml/default/default/template/bundle/sales/creditmemo/view/items/renderer.phtml
app/design/adminhtml/default/default/template/bundle/sales/invoice/create/items/renderer.phtml
app/design/adminhtml/default/default/template/bundle/sales/invoice/view/items/renderer.phtml
app/design/adminhtml/default/default/template/bundle/sales/order/view/items/renderer.phtml
app/design/adminhtml/default/default/template/bundle/sales/shipment/create/items/renderer.phtml
app/design/adminhtml/default/default/template/bundle/sales/shipment/view/items/renderer.phtml
app/design/adminhtml/default/default/template/catalog/product/helper/gallery.phtml
app/design/frontend/base/default/template/bundle/email/order/items/creditmemo/default.phtml
app/design/frontend/base/default/template/bundle/email/order/items/invoice/default.phtml
app/design/frontend/base/default/template/bundle/email/order/items/order/default.phtml
app/design/frontend/base/default/template/bundle/email/order/items/shipment/default.phtml
app/design/frontend/base/default/template/bundle/sales/order/creditmemo/items/renderer.phtml
app/design/frontend/base/default/template/bundle/sales/order/invoice/items/renderer.phtml
app/design/frontend/base/default/template/bundle/sales/order/items/renderer.phtml
app/design/frontend/base/default/template/bundle/sales/order/shipment/items/renderer.phtml
app/design/frontend/base/default/template/downloadable/checkout/multishipping/item/downloadable.phtml
app/design/frontend/base/default/template/downloadable/email/order/items/creditmemo/downloadable.phtml
app/design/frontend/base/default/template/downloadable/email/order/items/invoice/downloadable.phtml
app/design/frontend/base/default/template/downloadable/email/order/items/order/downloadable.phtml
app/design/frontend/base/default/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml
app/design/frontend/base/default/template/downloadable/sales/order/invoice/items/renderer/downloadable.phtml
app/design/frontend/rwd/default/template/bundle/email/order/items/creditmemo/default.phtml
app/design/frontend/rwd/default/template/bundle/email/order/items/invoice/default.phtml
app/design/frontend/rwd/default/template/bundle/email/order/items/order/default.phtml
app/design/frontend/rwd/default/template/bundle/email/order/items/shipment/default.phtml
app/design/frontend/rwd/default/template/bundle/sales/order/items/renderer.phtml
app/design/frontend/rwd/default/template/downloadable/email/order/items/creditmemo/downloadable.phtml
app/design/frontend/rwd/default/template/downloadable/email/order/items/invoice/downloadable.phtml
app/design/frontend/rwd/default/template/downloadable/email/order/items/order/downloadable.phtml

Dalam Magento commerce menambahkan file selain file di atas:

app/code/core/Enterprise/GiftRegistry/Helper/Data.php
app/code/core/Enterprise/GiftRegistry/Model/Attribute/Processor.php
app/design/frontend/enterprise/default/template/cms/hierarchy/pagination.phtml
app/design/frontend/enterprise/iphone/template/bundle/sales/order/items/renderer.phtml
app/design/frontend/enterprise/iphone/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml
app/design/frontend/enterprise/iphone/template/downloadable/sales/order/invoice/items/renderer/downloadable.phtml
app/design/frontend/enterprise/iphone/template/downloadable/sales/order/items/renderer/downloadable.phtml
app/design/frontend/rwd/enterprise/template/cms/hierarchy/pagination.phtml
app/design/frontend/rwd/enterprise/template/rma/return/view.phtml

Saya tidak menghadapi masalah apa pun sampai sekarang.

Dalam Magento EE 1.13.1.0

Patch mencari file yang salah (file komunitas, saya percaya).

Harus menghapus baris ini dari file tambalan dan menerapkan. Itu berhasil diterapkan.

Telah memberi tahu tim inti Magento, belum menerima umpan balik.

diff --git app/design/frontend/rwd/default/template/bundle/sales/order/items/renderer.phtml app/design/frontend/rwd/default/template/bundle/sales/order/items/renderer.phtml
index b3e997f59f3..f34c2bba6a2 100644
--- app/design/frontend/rwd/default/template/bundle/sales/order/items/renderer.phtml
+++ app/design/frontend/rwd/default/template/bundle/sales/order/items/renderer.phtml
@@ -43,7 +43,7 @@
     <?php $attributes = $this->getSelectionAttributes($_item) ?>
     <?php if ($_prevOptionId != $attributes['option_id']): ?>
     <tr class="bundle label<?php if($_item->getLastRow()): ?> last<?php endif; ?>">
-        <td><div class="option-label"><?php echo $attributes['option_label'] ?></div></td>
+        <td><div class="option-label"><?php echo $this->escapeHtml($attributes['option_label']); ?></div></td>
         <td data-rwd-label="SKU" class="lin-hide">&nbsp;</td>
         <td data-rwd-label="Price" class="lin-hide">&nbsp;</td>
         <td data-rwd-label="Qty" class="lin-hide">&nbsp;</td>

Formulir pengaturan ulang kata sandi tidak lagi berfungsi setelah menginstal patch pada CE 1.7.0.2 dengan semua patch sebelumnya diinstal.

(PATCH_SUPEE-10888_CE_v1.7.0.2_v1-2018-09-18-03-00-22.sh)

EDIT:

Masalah tidak lagi terjadi setelah mengembalikan tambalan mulai 18 September (v1) dan menerapkan tambalan yang diperbarui mulai 19 September (v1) + penyegaran cache dan membersihkan cache magento.

(PATCH_SUPEE-10888_CE_v1.7.0.2_v1-2018-09-19-03-01-22.sh)

Terima kasih, Robb untuk petunjuknya.

SUPEE-10752 perlu diterapkan. Saya juga menerapkan, patch kompatibilitas PHP 7.2 dan menghapus patch kompatibilitas Inchoo_PHP7 sebelum menginstal SUPEE-10888. Bekerja tanpa masalah.

Magento CE 1.6.2.0

Kesalahan berikut setelah tambalan diterapkan ketika mencoba mengatur ulang kata sandi akun pelanggan di frontend.

Kesalahan fatal: Panggil ke fungsi anggota getBackend () pada non-objek di app / code / core / Mage / Eav / Model / Entity / Abstract.php on line 1536.

Ternyata, tambalan tidak menjalankan skrip peningkatan SQL (app / code / core / Mage / Pelanggan / sql / customer_setup / upgrade-1.6.1.0.1.2-1.6.1.0.1.3.php) yang menciptakan atribut baru bernama rp_customer_id.

Periksa apakah Anda sudah menghapus Magento Cache, tetapi yang lebih penting jika Anda mengaktifkan cache pernis, bersihkan. Setelah saya menonaktifkan semua cache, dan membersihkan cache vernis, skrip SQL menciptakan atribut baru dalam database.

Menemukan kesalahan ketik kecil di tambalan untuk 1.14.2.0 hingga 1.14.2.4

Dalam file app/design/frontend/enterprise/iphone/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml, itu keliru membuat perubahan berikut:

<dt><?php echo $this->escspeHtml($this->getLinksTitle()); ?></dt>

dari pada

<dt><?php echo $this->escapeHtml($this->getLinksTitle()); ?></dt>

Inilah perbedaan untuk referensi:

diff --git app/design/frontend/enterprise/iphone/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml app/design/frontend/enterprise/iphone/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml index 6ed3cd9bfd4..f8b1573605a 100644 --- app/design/frontend/enterprise/iphone/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml +++ app/design/frontend/enterprise/iphone/template/downloadable/sales/order/creditmemo/items/renderer/downloadable.phtml @@ -55,7 +55,7 @@ <!-- downloadable --> <?php if ($links = $this->getLinks()): ?> <dl class="item-options"> - <dt><?php echo $this->getLinksTitle() ?></dt> + <dt><?php echo $this->escspeHtml($this->getLinksTitle()); ?></dt> <?php foreach ($links->getPurchasedItems() as $link): ?> <dd><?php echo $this->escapeHtml($link->getLinkTitle()); ?></dd> <?php endforeach; ?>

Ada kesalahan ketik /app/code/core/Mage/Core/etc/system.xmldi <crate_admin_user_notification translate="label comment">dalamnya seharusnya <create_admin_user_notification translate="label comment">tetapi tidak melanggar karena penggunaannya juga dieja salahif(Mage::getStoreConfigFlag('admin/security/crate_admin_user_notification')

Saat ini gagal di Magento CE 1.9.1.0.

patching file app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator.php
Hunk #2 FAILED at 57.

Pemeriksaan visual dari file sumber mengkonfirmasi bahwa kode yang relevan tidak ada.

patching file app/code/core/Mage/Customer/controllers/AccountController.php
Hunk #3 FAILED at 845.

...

can't find file to patch at input line 600
Perhaps you used the wrong -p or --strip option?
The text leading up to this was:
--------------------------
|diff --git app/code/core/Zend/Filter/PregReplace.php app/code/core/Zend/Filter/PregReplace.php

Seperti yang ditunjukkan, tidak ada file seperti itu.

patching file app/design/adminhtml/default/default/template/bundle/product/edit/bundle/option.phtml
Hunk #1 FAILED at 209.

Hanya FYI untuk pengguna EE, karena tambalan ini membutuhkan SUPEE-10752 Anda mungkin mengalami beberapa sesi yang dibatalkan secara acak atau checkout Anda mengalihkan ke beranda alih-alih halaman sukses.

Kami pergi ke proses yang biasa menerapkan tambalan berikut dalam urutan ini:

1. SUPEE-10570v2 (PATCH_SUPEE-10570_EE_v1.14.2.4_v2-2018-03-22-10-57-00.sh)
2. SUPEE-10752 (PATCH_SUPEE-10752_EE_v1.14.2.4_v1-2018-06-25-09-53-38.sh)
3. SUPEE-10888 (PATCH_SUPEE-10888_EE_v1.14.2.4_v1-2018-09-19-03-07-06.sh)

Namun, tambalan SUPEE-10752 untuk EE berisi perubahan berikut: app / code / core / Mage / Core / Model / Session / Abstract / Varien.php

+    const VALIDATOR_PASSWORD_CREATE_TIMESTAMP   = 'password_create_timestamp';


+    /**
+     * Use password creation timestamp in validator key
+     *
+     * @return bool
+     */
+    public function useValidateSessionPasswordTimestamp()
+    {
+        return true;
+    }


+        if ($this->useValidateSessionPasswordTimestamp()
+            && isset($validatorData[self::VALIDATOR_PASSWORD_CREATE_TIMESTAMP])
+            && isset($sessionData[self::VALIDATOR_SESSION_EXPIRE_TIMESTAMP])
+            && $validatorData[self::VALIDATOR_PASSWORD_CREATE_TIMESTAMP]
+            > $sessionData[self::VALIDATOR_SESSION_EXPIRE_TIMESTAMP] - $this->getCookie()->getLifetime()
+        ) {
+            return false;
+        }

Saya harus mengajukan permohonan pada bagian terakhir invalid_session_fix-2018-03-14-05-10-19.patch di bawah ini yang ditemukan di https://magento.com/tech-resources/download di bawah SUPEE-10570 > invalid_session_fix.patch (0 MB)

diff --git a/app/code/core/Mage/Core/Model/Session/Abstract/Varien.php b/app/code/core/Mage/Core/Model/Session/Abstract/Varien.php
index 59b3ea8..35155f1 100644
--- a/app/code/core/Mage/Core/Model/Session/Abstract/Varien.php
+++ b/app/code/core/Mage/Core/Model/Session/Abstract/Varien.php
@@ -485,7 +485,7 @@ class Mage_Core_Model_Session_Abstract_Varien extends Varien_Object
             && isset($validatorData[self::VALIDATOR_PASSWORD_CREATE_TIMESTAMP])
             && isset($sessionData[self::VALIDATOR_SESSION_EXPIRE_TIMESTAMP])
             && $validatorData[self::VALIDATOR_PASSWORD_CREATE_TIMESTAMP]
-            > $sessionData[self::VALIDATOR_SESSION_EXPIRE_TIMESTAMP] - $this->getCookie()->getLifetime()
+            > $sessionData[self::VALIDATOR_SESSION_EXPIRE_TIMESTAMP]
         ) {
             return false;
         }

Saya telah melihat masalah dengan beberapa pelanggan di mana mereka memanggil kami bahwa mereka tidak dapat masuk dan melihat akun mereka.

Email dan kata sandi itu benar - tidak ada pesan kesalahan masuk, halaman hanya memuat ulang ke halaman beranda atau halaman masuk, mereka sepertinya tidak bisa masuk ke akun mereka! Ini terjadi setelah menerapkan patch 10888, dan kami memang menerapkan 10752.

Setelah menggali saya menemukan di tabel customer_entity, dan itu menyadarkan saya bahwa pelanggan yang terkena dampak memiliki timestamp created_dateSETELAH itu updated_date. Saya pikir tidak seharusnya seperti itu kan?

Jadi untuk menguji, saya mengubah Created_date menjadi SEBELUM updated_date, bahkan satu menit. Untuk beberapa pengguna ini saja membantu mereka untuk kembali ke akun mereka. Sementara untuk pengguna lain saya juga harus memperbarui kata sandi mereka melalui SQL, menggunakan kueri:

update customer_entity_varchar set value = md5('123456') 
   where where entity_id = 105 /*enter customer's entity_id found in customer_entity */
   and attribute_id in 
      (select attribute_id from eav_attribute where attribute_code = 'password_hash' 
        and entity_type_id = 1);

Saya belum harus sepenuhnya menyelidiki perubahan yang SUPEE 10888 lakukan pada file inti pelanggan, tetapi pasti ada masalah dengan tambalan.

Terlebih lagi, sepertinya saya tidak dapat memperbarui kata sandi pelanggan melalui panel admin seperti biasanya, ketika menyimpan, halaman menghasilkan kesalahan.

Menggunakan 1.9.2.4

Saya menggunakan Magento 1.9.3.7. Os adalah ubuntu. Versi PHP adalah 7.0.

Ketika mencoba menerapkan jalur SUPPER-10888 mendapatkan kesalahan di bawah ini.

Checking if a patch can be applied/reverted successfully...

GALAT: Patch tidak dapat diterapkan / dikembalikan dengan sukses.

memeriksa file app / code / core / Mage / Admin / Model / User.php Hunk # 2 berhasil di 676 (offset -20 baris). memeriksa aplikasi file / kode / inti / Mage / Admin / etc / config.xml memeriksa aplikasi file / kode / core / Mage / Adminhtml / Blok / Katalog / Produk / Edit / Tab / Super / Config.php memeriksa aplikasi file / kode / core / Mage / Adminhtml / Blok / Widget / Grid / Massaction / Abstract.php memeriksa file app / kode / core / Mage / Adminhtml / Model / LayoutUpdate / Validator.php Hunk # 2 GAGAL di 57. Hunk # 3 berhasil di 80 ( mengimbangi -12 baris). Hunk # 4 berhasil di 115 dengan fuzz 2 (offset -12 baris). Hunk # 5 berhasil di 139 dengan fuzz 1 (offset -21 baris). Hunk # 6 berhasil di 161 (offset -21 baris). 1 dari 6 bakhil GAGAL memeriksa aplikasi file / kode / inti / Mage / Adminhtml / controllers / Katalog / ProductController.php Hunk # 1 berhasil di 1020 (offset -11 baris). memeriksa aplikasi file / kode / core / Mage / Adminhtml / controllers / Izin / UserController.php memeriksa aplikasi file / kode / core / Mage / Adminhtml / etc / config.xml memeriksa aplikasi file / kode / core / Mage / Checkout / Model / Api / Resource / Customer.php Hunk # 1 berhasil di 151 dengan fuzz 1 (offset -1 baris). memeriksa file app / kode / core / Mage / Checkout / Model / Jenis / Onepage.php Hunk # 1 berhasil di 731 dengan fuzz 1 (offset -3 baris). memeriksa aplikasi file / kode / core / Mage / Cms / Model / Wysiwyg / Gambar / Storage.php memeriksa aplikasi file / kode / core / Mage / Core / dll / config.xml memeriksa aplikasi file / kode / core / Mage / Core / dll / system.xml memeriksa aplikasi file / kode / inti / Penyihir / Pelanggan / Pembantu / Data.php memeriksa aplikasi file / kode / inti / Penyihir / Pelanggan / Model / Pelanggan.php memeriksa aplikasi file / kode / inti / Penyihir / Pelanggan /Model/Resource/Customer.php Hunk # 1 berhasil di 332 (offset -1 baris). memeriksa aplikasi file / kode / inti / Penyihir / Pelanggan / pengendali / AccountController.php Hunk # 1 berhasil di 755 (offset -1 baris). Hunk # 2 berhasil pada 810 (offset -1 baris). Hunk # 3 GAGAL di 871. Hunk # 4 berhasil di 883 (offset -2 baris). 1 dari 4 bakhil FAILED memeriksa file aplikasi / kode / inti / Mage / Pelanggan / etc / config.xml Hunk # 1 GAGAL di 28. 1 dari 1 hunk FAILED memeriksa file app / kode / inti / Mage / Pelanggan / sql / customer_setup / upgrade-1.6.2.0.5.1.2-1.6.2.0.5.1.3.php memeriksa aplikasi file / kode / core / Mage / Paypal / Model / Express / Checkout.php memeriksa aplikasi file / kode / core / Mage / XmlConnect / controllers / ReviewController.php tidak dapat menemukan file untuk ditambal pada input line 600 Mungkin Anda menggunakan opsi -p atau --strip yang salah? Hunk # 4 berhasil di 883 (offset -2 baris). 1 dari 4 bakhil FAILED memeriksa file aplikasi / kode / inti / Mage / Pelanggan / etc / config.xml Hunk # 1 GAGAL di 28. 1 dari 1 hunk FAILED memeriksa file app / kode / inti / Mage / Pelanggan / sql / customer_setup / upgrade-1.6.2.0.5.1.2-1.6.2.0.5.1.3.php memeriksa aplikasi file / kode / core / Mage / Paypal / Model / Express / Checkout.php memeriksa aplikasi file / kode / core / Mage / XmlConnect / controllers / ReviewController.php tidak dapat menemukan file untuk ditambal pada input line 600 Mungkin Anda menggunakan opsi -p atau --strip yang salah? Hunk # 4 berhasil di 883 (offset -2 baris). 1 dari 4 bakhil FAILED memeriksa file aplikasi / kode / inti / Mage / Pelanggan / etc / config.xml Hunk # 1 GAGAL di 28. 1 dari 1 hunk FAILED memeriksa file app / kode / inti / Mage / Pelanggan / sql / customer_setup / upgrade-1.6.2.0.5.1.2-1.6.2.0.5.1.3.php memeriksa aplikasi file / kode / core / Mage / Paypal / Model / Express / Checkout.php memeriksa aplikasi file / kode / core / Mage / XmlConnect / controllers / ReviewController.php tidak dapat menemukan file untuk ditambal pada input line 600 Mungkin Anda menggunakan opsi -p atau --strip yang salah?

Teks yang mengarah ke ini adalah:

| diff --git app / kode / core / Zend / Filter / PregReplace.php app / kode / core / Zend / Filter / PregReplace.php | index 586c0fe20a0..d6fa2dac0ec 100644 | --- app / code / core / Zend / Filter / PregReplace.php

| +++ aplikasi / kode / inti / Zend / Filter / PregReplace.php

File untuk ditambal: Lewati tambalan ini? [y] Melompati tambalan. 2 dari 2 bakhilan mengabaikan pengecekan aplikasi file / desain / adminhtml / default / default / tempel / bundel / produk / edit / bundel / option.phtml Hunk # 1 GAGAL di 209. 1 dari 1 bakhil memeriksa file app Gai / desain / adminhtml / default / default / template / bundle / sales / creditmemo / create / items / renderer.phtml memeriksa file app / desain / adminhtml / default / default / template / bundle / penjualan / creditmemo / view / items / renderer.phtml memeriksa file app / design / adminhtml / default / default / template / bundle / sales / invoice / create / items / renderer.phtml memeriksa file app / desain / adminhtml / default / default / template / bundle / penjualan / faktur / tampilan / item / renderer .phtml memeriksa aplikasi file / desain / adminhtml / default / default / template / bundle / penjualan / pesanan / tampilan / item / renderer.

Ada yang tahu apa yang hilang?