Applying Magento security patches – SUPEE-6285

This bundle includes protection against the following security-related issues:

1. Customer Information Leak via RSS and Privilege Escalation

2. Request Forgery in Magento Connect Leads to Code Execution

3. Cross-site Scripting in Wishlist

4. Cross-site Scripting in Cart

5. Store Path Disclosure

6. Permissions on Log Files too Broad

7. Cross-site Scripting in Admin

8. Cross-site Scripting in Orders RSS

Theme patches

Some theme files have been patched with added escaping to prevent possible XSS attacks:
checkout/cart.phtml
checkout/cart/noItems.phtml
checkout/onepage/failure.phtml
rss/order/details.phtml
wishlist/email/rss.phtml

If your theme(s) contain any of these templates, or if you made modifications directly in base/default (good luck, you are screwed), then you need to patch them manually:

1. in the checkout templates, replace all occurences of

with

2. in wishlist/email/rss.phtml, replace

with

3. In rss/order/details.phtml, replace

with

Permissions

.htaccess files have been added to downloader/Maged and downloader/lib to disallow direct access to source files.

But I recommend to exclude downloader from deployments to a live system system anyway, in this case you don’t need to take action.

Admin Privileges (ACL)

If you use restricted admin accounts, some menus of third party extensions might not work anymore for them. The reason is that the default return value of Mage_Adminhtml_Controller_Action::_isAllowed() has been changed from true to Mage::getSingleton(‘admin/session’)->isAllowed(‘admin’). Extensions that do not override this method in their admin controllers because they don’t use the ACL, now need the “ALL” privilege.
The only solution is to patch the extensions and add this method to all their admin controllers:

Or if they actually have an ACL resource defined in etc/adminhtml.xml:

Leave a Comment

Your email address will not be published. Required fields are marked *

*