Troubleshooting

Adobe APSB22-12 – Don’t panic!

Adobe has released a critical security patch early this week on https://support.magento.com/hc/en-us/articles/4426353041293-Security-updates-available-for-Adobe-Commerce-APSB22-12– and https://helpx.adobe.com/security/products/magento/apsb22-12.html.

Of course, Adobe Commerce merchants and agencies are nervous and want to apply the security patch as soon as possible. However, I believe as long as your admin passwords are strong enough and you have control about your admin accounts, you shouldn’t be worried too much.

Here is why.

Let’s have a look at the content of the security patch.

diff --git a/vendor/magento/module-email/Model/Template/Filter.php b/vendor/magento/module-email/Model/Template/Filter.php
index 1a7c3683820a..586cb485ee1f 100644
--- a/vendor/magento/module-email/Model/Template/Filter.php
+++ b/vendor/magento/module-email/Model/Template/Filter.php
@@ -618,6 +618,12 @@ public function transDirective($construction)
         }
 
         $text = __($text, $params)->render();
+
+        $pattern = '/{{.*?}}/';
+        do {
+            $text = preg_replace($pattern, '', (string)$text);
+        } while (preg_match($pattern, $text));
+
         return $this->applyModifiers($text, $modifiers);
     }
 
diff --git a/vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php b/vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php
index f2fe398c3848..78034d70ba51 100644
--- a/vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php
+++ b/vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php
@@ -55,6 +55,11 @@ public function process(array $construction, Template $filter, array $templateVa
             $result = $this->filterApplier->applyFromRawParam($construction['filters'], $result);
         }
 
+        $pattern = '/{{.*?}}/';
+        do {
+            $result = preg_replace($pattern, '', (string)$result);
+        } while (preg_match($pattern, $result));
+
         return $result;
     }

diff --git a/vendor/magento/module-email/Model/Template/Filter.php b/vendor/magento/module-email/Model/Template/Filter.php

index 1a7c3683820a..586cb485ee1f 100644

--- a/vendor/magento/module-email/Model/Template/Filter.php

+++ b/vendor/magento/module-email/Model/Template/Filter.php

@@ -618,6 +618,12 @@ public function transDirective($construction)

}

$text = __($text, $params)->render();

+ $pattern = '/{{.*?}}/';

+ do {

+ $text = preg_replace($pattern, '', (string)$text);

+ } while (preg_match($pattern, $text));

return $this->applyModifiers($text, $modifiers);

}

diff --git a/vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php b/vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php

index f2fe398c3848..78034d70ba51 100644

--- a/vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php

+++ b/vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php

@@ -55,6 +55,11 @@ public function process(array $construction, Template $filter, array $templateVa

$result = $this->filterApplier->applyFromRawParam($construction['filters'], $result);

}

+ $pattern = '/{{.*?}}/';

+ do {

+ $result = preg_replace($pattern, '', (string)$result);

+ } while (preg_match($pattern, $result));

return $result;

}

The patch will update two files only that are responsible to process template variables such as email variables {{var logo_url}} or {{config path=”general/store_information/name”}} or variables within CMS pages or Static Blocks. The change is trivial and will wipe out unwanted content by using the pattern $pattern = ‘/{{.*?}}/’.

It basically means, in order to be able to exploit this issue, you must:

1. Know the admin url of a store
2. Have access to the Magento backend ( ideally admin privileges )
3. Know how to exploit the issue

So, as long as you maintain admin accounts regularly and know who is actively working in your backend, you should be fine.

However, if you have modules installed that add custom variables by injecting Magento\Email\Model\Template\Filter in combination with 3rd party services, you should probably go and install the patch with your next release.

Update: 2022/02/16

Code could possibly injected by using the customers billing or shipping address ( e.g {{trans “%name,” name=$order.getBillingAddress().getName()}} ) depending on how strong form validation is in the front-end ( My Account > Addresses or Checkout ).

Captcha Test For Your Contact Form

The following PHP script allows you to test your contact form captcha integration in Magento. If you receive any email after executing this script, you have to review your captcha integration.

<?php

$url = '{base_url}/contacts/index/post/';

$fields = array(
    'name' => urlencode('Bad spam test'),
    'email' => urlencode('somebody@gmail.com'),
    'state' => urlencode('Any State'),
    'postcode' => urlencode(''),
    'telephone' => urlencode(''),
    'comment' => urlencode('Bad spam test'),
    'recaptcha-verification-1' => urlencode('checked'),
);

$query = http_build_query($fields);

$ch = curl_init();
curl_setopt($ch,CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch,CURLOPT_URL, $url);
curl_setopt($ch,CURLOPT_POST, count($fields));
curl_setopt($ch,CURLOPT_POSTFIELDS, $query);

$result = curl_exec($ch);

curl_close($ch);

?>

<?php

$url = '{base_url}/contacts/index/post/';

$fields = array(

'name' => urlencode('Bad spam test'),

'email' => urlencode('somebody@gmail.com'),

'state' => urlencode('Any State'),

'postcode' => urlencode(''),

'telephone' => urlencode(''),

'comment' => urlencode('Bad spam test'),

'recaptcha-verification-1' => urlencode('checked'),

);

$query = http_build_query($fields);

$ch = curl_init();

curl_setopt($ch,CURLOPT_FOLLOWLOCATION, 1);

curl_setopt($ch,CURLOPT_URL, $url);

curl_setopt($ch,CURLOPT_POST, count($fields));

curl_setopt($ch,CURLOPT_POSTFIELDS, $query);

$result = curl_exec($ch);

curl_close($ch);

You may need to add, remove or rename fields in the $field array. Don’t forget to replace {base_url} with your actual URL.

Broken Admin Panel after SUPEE-8788

After the installation of patch SUPEE-8788 in Magento 1.9.0.1 I have experienced a broken product edit form in Catalog > Manage Products > { select any product } > Edit Product. Every time when I tried to edit a product it was logging the following error message.

2016/11/04 19:52:04 [error] 16030#16030: *14543 FastCGI sent in stderr: "PHP message: PHP Fatal error:  Undefined class constant 'XML_NODE_PRODUCT_MAX_DIMENSION' in /var/www/{project.com}/src/app/design/adminhtml/default/default/template/catalog/product/helper/gallery.phtml on line 111" while reading response header from upstream, client: 115.70.205.114, server: {project.com}, request: "GET /index.php/admin/catalog_product/edit/id/549/key/2648665fef72a346f08657ca178f5a51/ HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "{project.com}", referrer: "http://{project.com}/index.php/admin/catalog_product/index/key/4cd6b694401f474c72d0dbd9d639e651/"

2016/11/04 19:52:04 [error] 16030#16030: *14543 FastCGI sent in stderr: "PHP message: PHP Fatal error: Undefined class constant 'XML_NODE_PRODUCT_MAX_DIMENSION' in /var/www/{project.com}/src/app/design/adminhtml/default/default/template/catalog/product/helper/gallery.phtml on line 111" while reading response header from upstream, client: 115.70.205.114, server: {project.com}, request: "GET /index.php/admin/catalog_product/edit/id/549/key/2648665fef72a346f08657ca178f5a51/ HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "{project.com}", referrer: "http://{project.com}/index.php/admin/catalog_product/index/key/4cd6b694401f474c72d0dbd9d639e651/"

I have found a community extension in my project which was causing the problem by rewriting the complete class Mage_Catalog_Helper_Image. With diff I was able to identify all changes which I needed to copy from core to the community extension.

diff app/code/community/{Module_Name}/Catalog/Helper/Image.php app/code/core/Mage/Catalog/Helper/Image.php

1	diff app/code/community/{Module_Name}/Catalog/Helper/Image.php app/code/core/Mage/Catalog/Helper/Image.php

I just added the missing constant

const XML_NODE_PRODUCT_MAX_DIMENSION = 'catalog/product_image/max_dimension';

1	const XML_NODE_PRODUCT_MAX_DIMENSION = 'catalog/product_image/max_dimension';

and updated the method validateUploadFile().

public function validateUploadFile($filePath) {

1	public function validateUploadFile($filePath) {

Find Missing Or Not Readable Product Image Files

With the following script you can detect missing or not readable image files, based on your product collection. Good before project launch or after product imports.

<?php
/**
 * Find missing or not readable product image files in Magento1.
 * Run this file via command line ( php fmpif.php ) or open it in your web browser.
 *
 * @copyright   Copyright (c) 2016 Tobias Forkel (http://www.tobiasforkel.de)
 * @license     http://opensource.org/licenses/osl-3.0.php Open Software License (OSL 3.0)
 */

require_once 'app/Mage.php';
Mage::app();

// Collection of all products
$products = Mage::getModel('catalog/product')->getCollection();

// Get absolute path to media folder
$media = Mage::getBaseDir('media');

// Count missing files
$i = 0;

foreach ($products as $_product)
{
    $product = Mage::getModel('catalog/product')->load($_product->getId());

    foreach ($product->getMediaGalleryImages() as $image)
    {
        $file = $media . '/catalog/product' . $image['file'];

        if (!is_readable($file))
        {
            $i++;
            echo sprintf('The image file (%s) from product SKU number (%s) doesn\'t exists or is not readable.', $file, $_product->getSku());
        }
    }
}

if ($i == 0)
{
    echo 'All good!';
}

?>

<?php

/**

* Find missing or not readable product image files in Magento1.

* Run this file via command line ( php fmpif.php ) or open it in your web browser.

* @license http://opensource.org/licenses/osl-3.0.php Open Software License (OSL 3.0)

require_once 'app/Mage.php';

Mage::app();

// Collection of all products

$products = Mage::getModel('catalog/product')->getCollection();

// Get absolute path to media folder

$media = Mage::getBaseDir('media');

// Count missing files

$i = 0;

foreach ($products as $_product)

{

$product = Mage::getModel('catalog/product')->load($_product->getId());

foreach ($product->getMediaGalleryImages() as $image)

{

$file = $media . '/catalog/product' . $image['file'];

if (!is_readable($file))

{

$i++;

echo sprintf('The image file (%s) from product SKU number (%s) doesn\'t exists or is not readable.', $file, $_product->getSku());

}

if ($i == 0)

{

echo 'All good!';

}

Find the Gist here.

Automatically Update The Year In The Footer

In most of the projects that I am working on, it is still common practice to have the current year of the copyright text stored in System > Configuration > General > Design > Footer.

&copy; 2015 Magento Demo Store. All Rights Reserved.

1	© 2015 Magento Demo Store. All Rights Reserved.

That means, every year somebody has to change the year manually. This is very time consuming, especially if you have to manage ten, twenty or more clients. Here is a quick example of how you can make it dynamic.

1. Set a custom string such as {YEAR}

Edit your footer in System > Configuration > General > Design > Footer and place the {YEAR} somewhere.

&copy; {YEAR} Magento Demo Store. All Rights Reserved.

1	© {YEAR} Magento Demo Store. All Rights Reserved.

2. Replace the {YEAR}

Edit your footer.phtml in your package and replace getCopyright as shown below. For the year I am using Mage::getModel(‘core/date’) to have the correct timezone included.

<div class="footer-container">
    <div class="footer">
        <?php echo $this->getChildHtml() ?>
        <p class="bugs"><?php echo $this->__('Help Us to Keep Magento Healthy') ?> - <a href="http://www.magentocommerce.com/bug-tracking" onclick="this.target='_blank'"><strong><?php echo $this->__('Report All Bugs') ?></strong></a> <?php echo $this->__('(ver. %s)', Mage::getVersion()) ?></p>
        <address><?php echo str_replace('{YEAR}', Mage::getModel('core/date')->date('Y'), $this->getCopyright()); ?></address>
    </div>
</div>

<?php echo $this->getChildHtml() ?>

<p class="bugs"><?php echo $this->__('Help Us to Keep Magento Healthy') ?> - <a href="http://www.magentocommerce.com/bug-tracking" onclick="this.target='_blank'"><strong><?php echo $this->__('Report All Bugs') ?></strong></a> <?php echo $this->__('(ver. %s)', Mage::getVersion()) ?></p>

<address><?php echo str_replace('{YEAR}', Mage::getModel('core/date')->date('Y'), $this->getCopyright()); ?></address>

</div>

File: ./app/design/frontend/{package}/default/template/page/html/footer.phtml

Algolia 1.6.1 or higher automatically update the product index

Algolia 1.6.1 or higher comes with a new feature that automatically updates your product index, every time you save a category. The disadvantage is that it will also update the product index, even if you just change an attribute which has nothing to do with URL rewrites or something else that can break search results. This can increase your indexing operations rapidly, therefore your monthly bills from Algolia as well.

To prevent unnecessary indexing, you should disable the new feature in System > Configuration > Algolia Search 1.x > Advanced > Update product on category products update and manage indexing manually with System > Index Management or simply with cron jobs.

Notice: Array to string conversion in grid.phtml on line 161

I am working on a new module and just received the following notice message when I was trying to open the admin html grid.

Notice: Array to string conversion  in /var/www/html/{VirtualHost}/app/design/adminhtml/default/default/template/widget/grid.phtml on line 161

1	Notice: Array to string conversion in /var/www/html/{VirtualHost}/app/design/adminhtml/default/default/template/widget/grid.phtml on line 161

The reason of this message is that I just copied the Grid.php from another entity that contains different database columns. So I just removed columns which are not defined in install-0.0.1.php ( especially columns with a custom renderer ) to fix the problem.

Cannot create table column without comments

Today I forgot to set a comment for my new column which broke the complete module setup procedure. Here is one example how you can add a new column to the sales flat table ” sales_flat_order_item “.

<?php

$installer = $this;
$installer->startSetup();
$installer->getConnection()->addColumn($installer->getTable('sales/order_item'), 'custom_price_field', array('type' => Varien_Db_Ddl_Table::TYPE_DECIMAL, 'length' => '12,4', 'comment' => 'My new custom price field'));
$installer->endSetup();

?>

<?php

$installer = $this;

$installer->startSetup();

$installer->getConnection()->addColumn($installer->getTable('sales/order_item'), 'custom_price_field', array('type' => Varien_Db_Ddl_Table::TYPE_DECIMAL, 'length' => '12,4', 'comment' => 'My new custom price field'));

$installer->endSetup();