Magento Commerce

Apply patches with composers post-install-cmd

I just want to introduce another approach that will apply Magento patches, in case your Magento instance isn’t hosted on Adobe’s Cloud infrastructure or can’t be applied as explained in How to apply a composer patch provided by Adobe for some reason.

1. Update your composer.json file

Add a new section “scripts” at the end of your composer.json file and validate your file with composer validate.

"scripts": {
    "post-install-cmd": [
        "patch -p1 < ./patches/MDVA-43395_EE_2.4.3-p1_COMPOSER_v1.patch"
    ]
}

"scripts": {

"post-install-cmd": [

"patch -p1 < ./patches/MDVA-43395_EE_2.4.3-p1_COMPOSER_v1.patch"

]

}

If you see ./composer.json is valid you are good to move on. Btw. your composer.lock file doesn’t need to be updated.

2. Create a folder ./patches/

Create a folder ./patches/ or something similar and copy your *.patch file in there.

3. Test it

Run composer install and wait. Your script and patch should be executed after Generating autoload files just like in the below output.

Generating autoload files
98 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
> patch -p1 < ./patches/MDVA-43395_EE_2.4.3-p1_COMPOSER_v1.patch
patching file vendor/magento/module-email/Model/Template/Filter.php
patching file vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php

Generating autoload files

98 packages you are using are looking for funding.

Use the `composer fund` command to find out more!

> patch -p1 < ./patches/MDVA-43395_EE_2.4.3-p1_COMPOSER_v1.patch

patching file vendor/magento/module-email/Model/Template/Filter.php

patching file vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php

4. Deploy it

Commit your changes ( composer.json and ./patches/ ) folder and run your deployment procedure.

That’s it!

Adobe APSB22-12 – Don’t panic!

Adobe has released a critical security patch early this week on https://support.magento.com/hc/en-us/articles/4426353041293-Security-updates-available-for-Adobe-Commerce-APSB22-12– and https://helpx.adobe.com/security/products/magento/apsb22-12.html.

Of course, Adobe Commerce merchants and agencies are nervous and want to apply the security patch as soon as possible. However, I believe as long as your admin passwords are strong enough and you have control about your admin accounts, you shouldn’t be worried too much.

Here is why.

Let’s have a look at the content of the security patch.

diff --git a/vendor/magento/module-email/Model/Template/Filter.php b/vendor/magento/module-email/Model/Template/Filter.php
index 1a7c3683820a..586cb485ee1f 100644
--- a/vendor/magento/module-email/Model/Template/Filter.php
+++ b/vendor/magento/module-email/Model/Template/Filter.php
@@ -618,6 +618,12 @@ public function transDirective($construction)
         }
 
         $text = __($text, $params)->render();
+
+        $pattern = '/{{.*?}}/';
+        do {
+            $text = preg_replace($pattern, '', (string)$text);
+        } while (preg_match($pattern, $text));
+
         return $this->applyModifiers($text, $modifiers);
     }
 
diff --git a/vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php b/vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php
index f2fe398c3848..78034d70ba51 100644
--- a/vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php
+++ b/vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php
@@ -55,6 +55,11 @@ public function process(array $construction, Template $filter, array $templateVa
             $result = $this->filterApplier->applyFromRawParam($construction['filters'], $result);
         }
 
+        $pattern = '/{{.*?}}/';
+        do {
+            $result = preg_replace($pattern, '', (string)$result);
+        } while (preg_match($pattern, $result));
+
         return $result;
     }

diff --git a/vendor/magento/module-email/Model/Template/Filter.php b/vendor/magento/module-email/Model/Template/Filter.php

index 1a7c3683820a..586cb485ee1f 100644

--- a/vendor/magento/module-email/Model/Template/Filter.php

+++ b/vendor/magento/module-email/Model/Template/Filter.php

@@ -618,6 +618,12 @@ public function transDirective($construction)

}

$text = __($text, $params)->render();

+ $pattern = '/{{.*?}}/';

+ do {

+ $text = preg_replace($pattern, '', (string)$text);

+ } while (preg_match($pattern, $text));

return $this->applyModifiers($text, $modifiers);

}

diff --git a/vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php b/vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php

index f2fe398c3848..78034d70ba51 100644

--- a/vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php

+++ b/vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php

@@ -55,6 +55,11 @@ public function process(array $construction, Template $filter, array $templateVa

$result = $this->filterApplier->applyFromRawParam($construction['filters'], $result);

}

+ $pattern = '/{{.*?}}/';

+ do {

+ $result = preg_replace($pattern, '', (string)$result);

+ } while (preg_match($pattern, $result));

return $result;

}

The patch will update two files only that are responsible to process template variables such as email variables {{var logo_url}} or {{config path=”general/store_information/name”}} or variables within CMS pages or Static Blocks. The change is trivial and will wipe out unwanted content by using the pattern $pattern = ‘/{{.*?}}/’.

It basically means, in order to be able to exploit this issue, you must:

1. Know the admin url of a store
2. Have access to the Magento backend ( ideally admin privileges )
3. Know how to exploit the issue

So, as long as you maintain admin accounts regularly and know who is actively working in your backend, you should be fine.

However, if you have modules installed that add custom variables by injecting Magento\Email\Model\Template\Filter in combination with 3rd party services, you should probably go and install the patch with your next release.

Update: 2022/02/16

Code could possibly injected by using the customers billing or shipping address ( e.g {{trans “%name,” name=$order.getBillingAddress().getName()}} ) depending on how strong form validation is in the front-end ( My Account > Addresses or Checkout ).

Missing required argument $name of Xtento\ProductExport\Logger\Logger.

If you are using Xtento in combination with an automated product importer, you may have seen the following error before.

Missing required argument $name of Xtento\ProductExport\Logger\Logger.

1	Missing required argument $name of Xtento\ProductExport\Logger\Logger.

The error message appears right after saving a product. The reason is that, at least one of your products in Products > Catalog has no Name. To fix this, you can update the name manually via MySQL queries or simply delete the products and import again correctly.

Captcha Test For Your Contact Form

The following PHP script allows you to test your contact form captcha integration in Magento. If you receive any email after executing this script, you have to review your captcha integration.

<?php

$url = '{base_url}/contacts/index/post/';

$fields = array(
    'name' => urlencode('Bad spam test'),
    'email' => urlencode('somebody@gmail.com'),
    'state' => urlencode('Any State'),
    'postcode' => urlencode(''),
    'telephone' => urlencode(''),
    'comment' => urlencode('Bad spam test'),
    'recaptcha-verification-1' => urlencode('checked'),
);

$query = http_build_query($fields);

$ch = curl_init();
curl_setopt($ch,CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch,CURLOPT_URL, $url);
curl_setopt($ch,CURLOPT_POST, count($fields));
curl_setopt($ch,CURLOPT_POSTFIELDS, $query);

$result = curl_exec($ch);

curl_close($ch);

?>

<?php

$url = '{base_url}/contacts/index/post/';

$fields = array(

'name' => urlencode('Bad spam test'),

'email' => urlencode('somebody@gmail.com'),

'state' => urlencode('Any State'),

'postcode' => urlencode(''),

'telephone' => urlencode(''),

'comment' => urlencode('Bad spam test'),

'recaptcha-verification-1' => urlencode('checked'),

);

$query = http_build_query($fields);

$ch = curl_init();

curl_setopt($ch,CURLOPT_FOLLOWLOCATION, 1);

curl_setopt($ch,CURLOPT_URL, $url);

curl_setopt($ch,CURLOPT_POST, count($fields));

curl_setopt($ch,CURLOPT_POSTFIELDS, $query);

$result = curl_exec($ch);

curl_close($ch);

You may need to add, remove or rename fields in the $field array. Don’t forget to replace {base_url} with your actual URL.

Broken Admin Panel after SUPEE-8788

After the installation of patch SUPEE-8788 in Magento 1.9.0.1 I have experienced a broken product edit form in Catalog > Manage Products > { select any product } > Edit Product. Every time when I tried to edit a product it was logging the following error message.

2016/11/04 19:52:04 [error] 16030#16030: *14543 FastCGI sent in stderr: "PHP message: PHP Fatal error:  Undefined class constant 'XML_NODE_PRODUCT_MAX_DIMENSION' in /var/www/{project.com}/src/app/design/adminhtml/default/default/template/catalog/product/helper/gallery.phtml on line 111" while reading response header from upstream, client: 115.70.205.114, server: {project.com}, request: "GET /index.php/admin/catalog_product/edit/id/549/key/2648665fef72a346f08657ca178f5a51/ HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "{project.com}", referrer: "http://{project.com}/index.php/admin/catalog_product/index/key/4cd6b694401f474c72d0dbd9d639e651/"

2016/11/04 19:52:04 [error] 16030#16030: *14543 FastCGI sent in stderr: "PHP message: PHP Fatal error: Undefined class constant 'XML_NODE_PRODUCT_MAX_DIMENSION' in /var/www/{project.com}/src/app/design/adminhtml/default/default/template/catalog/product/helper/gallery.phtml on line 111" while reading response header from upstream, client: 115.70.205.114, server: {project.com}, request: "GET /index.php/admin/catalog_product/edit/id/549/key/2648665fef72a346f08657ca178f5a51/ HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "{project.com}", referrer: "http://{project.com}/index.php/admin/catalog_product/index/key/4cd6b694401f474c72d0dbd9d639e651/"

I have found a community extension in my project which was causing the problem by rewriting the complete class Mage_Catalog_Helper_Image. With diff I was able to identify all changes which I needed to copy from core to the community extension.

diff app/code/community/{Module_Name}/Catalog/Helper/Image.php app/code/core/Mage/Catalog/Helper/Image.php

1	diff app/code/community/{Module_Name}/Catalog/Helper/Image.php app/code/core/Mage/Catalog/Helper/Image.php

I just added the missing constant

const XML_NODE_PRODUCT_MAX_DIMENSION = 'catalog/product_image/max_dimension';

1	const XML_NODE_PRODUCT_MAX_DIMENSION = 'catalog/product_image/max_dimension';

and updated the method validateUploadFile().

public function validateUploadFile($filePath) {

1	public function validateUploadFile($filePath) {

Find Missing Or Not Readable Product Image Files

With the following script you can detect missing or not readable image files, based on your product collection. Good before project launch or after product imports.

<?php
/**
 * Find missing or not readable product image files in Magento1.
 * Run this file via command line ( php fmpif.php ) or open it in your web browser.
 *
 * @copyright   Copyright (c) 2016 Tobias Forkel (http://www.tobiasforkel.de)
 * @license     http://opensource.org/licenses/osl-3.0.php Open Software License (OSL 3.0)
 */

require_once 'app/Mage.php';
Mage::app();

// Collection of all products
$products = Mage::getModel('catalog/product')->getCollection();

// Get absolute path to media folder
$media = Mage::getBaseDir('media');

// Count missing files
$i = 0;

foreach ($products as $_product)
{
    $product = Mage::getModel('catalog/product')->load($_product->getId());

    foreach ($product->getMediaGalleryImages() as $image)
    {
        $file = $media . '/catalog/product' . $image['file'];

        if (!is_readable($file))
        {
            $i++;
            echo sprintf('The image file (%s) from product SKU number (%s) doesn\'t exists or is not readable.', $file, $_product->getSku());
        }
    }
}

if ($i == 0)
{
    echo 'All good!';
}

?>

<?php

/**

* Find missing or not readable product image files in Magento1.

* Run this file via command line ( php fmpif.php ) or open it in your web browser.

* @license http://opensource.org/licenses/osl-3.0.php Open Software License (OSL 3.0)

require_once 'app/Mage.php';

Mage::app();

// Collection of all products

$products = Mage::getModel('catalog/product')->getCollection();

// Get absolute path to media folder

$media = Mage::getBaseDir('media');

// Count missing files

$i = 0;

foreach ($products as $_product)

{

$product = Mage::getModel('catalog/product')->load($_product->getId());

foreach ($product->getMediaGalleryImages() as $image)

{

$file = $media . '/catalog/product' . $image['file'];

if (!is_readable($file))

{

$i++;

echo sprintf('The image file (%s) from product SKU number (%s) doesn\'t exists or is not readable.', $file, $_product->getSku());

}

if ($i == 0)

{

echo 'All good!';

}

Find the Gist here.

Automatically Update The Year In The Footer

In most of the projects that I am working on, it is still common practice to have the current year of the copyright text stored in System > Configuration > General > Design > Footer.

&copy; 2015 Magento Demo Store. All Rights Reserved.

1	© 2015 Magento Demo Store. All Rights Reserved.

That means, every year somebody has to change the year manually. This is very time consuming, especially if you have to manage ten, twenty or more clients. Here is a quick example of how you can make it dynamic.

1. Set a custom string such as {YEAR}

Edit your footer in System > Configuration > General > Design > Footer and place the {YEAR} somewhere.

&copy; {YEAR} Magento Demo Store. All Rights Reserved.

1	© {YEAR} Magento Demo Store. All Rights Reserved.

2. Replace the {YEAR}

Edit your footer.phtml in your package and replace getCopyright as shown below. For the year I am using Mage::getModel(‘core/date’) to have the correct timezone included.

<div class="footer-container">
    <div class="footer">
        <?php echo $this->getChildHtml() ?>
        <p class="bugs"><?php echo $this->__('Help Us to Keep Magento Healthy') ?> - <a href="http://www.magentocommerce.com/bug-tracking" onclick="this.target='_blank'"><strong><?php echo $this->__('Report All Bugs') ?></strong></a> <?php echo $this->__('(ver. %s)', Mage::getVersion()) ?></p>
        <address><?php echo str_replace('{YEAR}', Mage::getModel('core/date')->date('Y'), $this->getCopyright()); ?></address>
    </div>
</div>

<?php echo $this->getChildHtml() ?>

<p class="bugs"><?php echo $this->__('Help Us to Keep Magento Healthy') ?> - <a href="http://www.magentocommerce.com/bug-tracking" onclick="this.target='_blank'"><strong><?php echo $this->__('Report All Bugs') ?></strong></a> <?php echo $this->__('(ver. %s)', Mage::getVersion()) ?></p>

<address><?php echo str_replace('{YEAR}', Mage::getModel('core/date')->date('Y'), $this->getCopyright()); ?></address>

</div>

File: ./app/design/frontend/{package}/default/template/page/html/footer.phtml

Algolia 1.6.1 or higher automatically update the product index

Algolia 1.6.1 or higher comes with a new feature that automatically updates your product index, every time you save a category. The disadvantage is that it will also update the product index, even if you just change an attribute which has nothing to do with URL rewrites or something else that can break search results. This can increase your indexing operations rapidly, therefore your monthly bills from Algolia as well.

To prevent unnecessary indexing, you should disable the new feature in System > Configuration > Algolia Search 1.x > Advanced > Update product on category products update and manage indexing manually with System > Index Management or simply with cron jobs.

Programmatically Create a Gift Card for Magestore Gift Card Module

This is a quick example of how you can programmatically create a code for Magestore’s Gift Card module.

1. Create the Gift Card

$data = array(
    // Valid price format without currency code
    'balance' => $input['giftcard_balance'],

    // The currency code such as $ or €
    'currency' => Mage::app()->getStore()->getCurrentCurrencyCode(),

    // Please find all available statuses in the Magestore > Gift Card module
    'status' => 2,

    // Remove the line to set no expire date
    'expired_at' => strtotime('+1 month'),

    'customer_id' => $customer->getId(),
    'customer_name' => $customer->getFirstname(),
    'customer_email' => $customer->getEmail(),
    'recipient_name' => 'Recipient Name',
    'recipient_email' => 'recipient@email.tld',

    'extra_content' => $this->__('Created by module X')
);

$giftvoucher = Mage::getModel('giftvoucher/giftvoucher')
->setData($data)
->setIncludeHistory(true)
->save();

$data = array(

// Valid price format without currency code

'balance' => $input['giftcard_balance'],

// The currency code such as $ or €

'currency' => Mage::app()->getStore()->getCurrentCurrencyCode(),

// Please find all available statuses in the Magestore > Gift Card module

'status' => 2,

// Remove the line to set no expire date

'expired_at' => strtotime('+1 month'),

'customer_id' => $customer->getId(),

'customer_name' => $customer->getFirstname(),

'customer_email' => $customer->getEmail(),

'recipient_name' => 'Recipient Name',

'recipient_email' => 'recipient@email.tld',

'extra_content' => $this->__('Created by module X')

);

$giftvoucher = Mage::getModel('giftvoucher/giftvoucher')

->setData($data)

->setIncludeHistory(true)

->save();

2. Link the Gift Card to a Customer

In order to be able to see the Gift Card in My Account > Gift Card you need to create a reference between Gift Card and a customer id. This is something you can do right after the Gift Voucher was successfully created.

$customervoucher = Mage::getModel('giftvoucher/customervoucher')
->setCustomerId($customer->getId())
->setVoucherId($giftvoucher->getId())
->setAddedDate(now())
->save();

$customervoucher = Mage::getModel('giftvoucher/customervoucher')

->setCustomerId($customer->getId())

->setVoucherId($giftvoucher->getId())

->setAddedDate(now())

->save();

Nginx and Cached CSS / JS files

Yesterday I had a pretty hard time with cached CSS / JS files on my developer environment. I supposed to review layout changes, but I always got the old CSS files. I have spent about 2 hours to find the reason. At the end the solution was to turn off the syscall sendfile in my virtual host configuration.

server {

    listen 80;

    .....

    location ~\.(css|js)$ {
        sendfile off;
    }
}

server {

listen 80;

.....

location ~\.(css|js)$ {

sendfile off;

}

If you use Nginx as a reverse proxy to serve pages from an application server, you can leave sendfile turned off.