Skip to content

Commit 7ef5026

Browse files
drobinsondrobinson
committed
SUPEE-5994 This patch addresses multiple security vulnerabilities in Magento Community Edition software, including issues that can put customer information at risk.
1 parent fe40916 commit 7ef5026

File tree

19 files changed

+558
-196
lines changed

19 files changed

+558
-196
lines changed

‎app/code/core/Mage/Authorizenet/controllers/Directpost/PaymentController.php‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,8 @@ protected function _getIframeBlock()
6868
public function responseAction()
6969
{
7070
$data = $this->getRequest()->getPost();
71+
unset($data['redirect_parent']);
72+
unset($data['redirect']);
7173
/* @var $paymentMethod Mage_Authorizenet_Model_DirectPost */
7274
$paymentMethod = Mage::getModel('authorizenet/directpost');
7375

@@ -113,6 +115,8 @@ public function responseAction()
113115
public function redirectAction()
114116
{
115117
$redirectParams = $this->getRequest()->getParams();
118+
unset($redirectParams['redirect_parent']);
119+
unset($redirectParams['redirect']);
116120
$params = array();
117121
if (!empty($redirectParams['success'])
118122
&& isset($redirectParams['x_invoice_num'])

‎app/code/core/Mage/Core/Controller/Varien/Router/Admin.php‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,4 +129,15 @@ public function collectRoutes($configArea, $useRouterName)
129129
}
130130
parent::collectRoutes($configArea, $useRouterName);
131131
}
132+
133+
/**
134+
* Check if current controller instance is allowed in current router.
135+
*
136+
* @param Mage_Core_Controller_Varien_Action $controllerInstance
137+
* @return boolean
138+
*/
139+
protected function _validateControllerInstance($controllerInstance)
140+
{
141+
return true;
142+
}
132143
}

‎app/code/core/Mage/Core/Controller/Varien/Router/Standard.php‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -201,6 +201,10 @@ public function match(Zend_Controller_Request_Http $request)
201201
// instantiate controller class
202202
$controllerInstance = Mage::getControllerInstance($controllerClassName, $request, $front->getResponse());
203203

204+
if (!$this->_validateControllerInstance($controllerInstance)) {
205+
continue;
206+
}
207+
204208
if (!$controllerInstance->hasAction($action)) {
205209
continue;
206210
}
@@ -271,6 +275,17 @@ protected function _noRouteShouldBeApplied()
271275
return false;
272276
}
273277

278+
/**
279+
* Check if current controller instance is allowed in current router.
280+
*
281+
* @param Mage_Core_Controller_Varien_Action $controllerInstance
282+
* @return boolean
283+
*/
284+
protected function _validateControllerInstance($controllerInstance)
285+
{
286+
return $controllerInstance instanceof Mage_Core_Controller_Front_Action;
287+
}
288+
274289
/**
275290
* Generating and validating class file name,
276291
* class and if evrything ok do include if needed and return of class name
@@ -297,7 +312,6 @@ protected function _validateControllerClassName($realModule, $controller)
297312
return $controllerClassName;
298313
}
299314

300-
301315
/**
302316
* @deprecated
303317
* @see _includeControllerClass()

‎app/code/core/Mage/Customer/Model/Customer.php‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -273,8 +273,11 @@ public function addAddress(Mage_Customer_Model_Address $address)
273273
*/
274274
public function getAddressById($addressId)
275275
{
276-
return Mage::getModel('customer/address')
277-
->load($addressId);
276+
$address = Mage::getModel('customer/address')->load($addressId);
277+
if ($this->getId() == $address->getParentId()) {
278+
return $address;
279+
}
280+
return Mage::getModel('customer/address');
278281
}
279282

280283
/**

‎app/code/core/Mage/Dataflow/Model/Convert/Parser/Csv.php‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -266,6 +266,10 @@ public function getCsvString($fields = array()) {
266266
$str = '';
267267

268268
foreach ($fields as $value) {
269+
if (substr($value, 0, 1) === '=') {
270+
$value = ' ' . $value;
271+
}
272+
269273
if (strpos($value, $delimiter) !== false ||
270274
empty($enclosure) ||
271275
strpos($value, $enclosure) !== false ||

‎app/code/core/Mage/ImportExport/Model/Export/Adapter/Csv.php‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,9 +109,21 @@ public function writeRow(array $rowData)
109109
if (null === $this->_headerCols) {
110110
$this->setHeaderCols(array_keys($rowData));
111111
}
112+
113+
/**
114+
* Security enchancement for CSV data processing by Excel-like applications.
115+
* @see https://bugzilla.mozilla.org/show_bug.cgi?id=1054702
116+
*/
117+
$data = array_merge($this->_headerCols, array_intersect_key($rowData, $this->_headerCols));
118+
foreach ($data as $key => $value) {
119+
if (substr($value, 0, 1) === '=') {
120+
$data[$key] = ' ' . $value;
121+
}
122+
}
123+
112124
fputcsv(
113125
$this->_fileHandler,
114-
array_merge($this->_headerCols, array_intersect_key($rowData, $this->_headerCols)),
126+
$data,
115127
$this->_delimiter,
116128
$this->_enclosure
117129
);

‎app/code/core/Mage/Install/Controller/Router/Install.php‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
<?php
2+
/**
3+
* Magento Enterprise Edition
4+
*
5+
* NOTICE OF LICENSE
6+
*
7+
* This source file is subject to the Magento Enterprise Edition End User License Agreement
8+
* that is bundled with this package in the file LICENSE_EE.txt.
9+
* It is also available through the world-wide-web at this URL:
10+
* http://www.magento.com/license/enterprise-edition
11+
* If you did not receive a copy of the license and are unable to
12+
* obtain it through the world-wide-web, please send an email
13+
* to [email protected] so we can send you a copy immediately.
14+
*
15+
* DISCLAIMER
16+
*
17+
* Do not edit or add to this file if you wish to upgrade Magento to newer
18+
* versions in the future. If you wish to customize Magento for your
19+
* needs please refer to http://www.magento.com for more information.
20+
*
21+
* @category Mage
22+
* @package Mage_Install
23+
* @copyright Copyright (c) 2006-2014 X.commerce, Inc. (http://www.magento.com)
24+
* @license http://www.magento.com/license/enterprise-edition
25+
*/
26+
27+
class Mage_Install_Controller_Router_Install extends Mage_Core_Controller_Varien_Router_Standard
28+
{
29+
/**
30+
* Check if current controller instance is allowed in current router.
31+
*
32+
* @param Mage_Core_Controller_Varien_Action $controllerInstance
33+
* @return boolean
34+
*/
35+
protected function _validateControllerInstance($controllerInstance)
36+
{
37+
return $controllerInstance instanceof Mage_Install_Controller_Action;
38+
}
39+
}

‎app/code/core/Mage/Install/etc/config.xml‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,13 +48,35 @@
4848
</install>
4949
</blocks>
5050
</global>
51+
<default>
52+
<web>
53+
<routers>
54+
<install>
55+
<area>frontend</area>
56+
<class>Mage_Install_Controller_Router_Install</class>
57+
</install>
58+
</routers>
59+
</web>
60+
</default>
61+
<stores>
62+
<default>
63+
<web>
64+
<routers>
65+
<install>
66+
<area>frontend</area>
67+
<class>Mage_Install_Controller_Router_Install</class>
68+
</install>
69+
</routers>
70+
</web>
71+
</default>
72+
</stores>
5173
<frontend>
5274
<secure_url>
5375
<install>/install/wizard/checkSecureHost</install>
5476
</secure_url>
5577
<routers>
5678
<install>
57-
<use>standard</use>
79+
<use>install</use>
5880
<args>
5981
<module>Mage_Install</module>
6082
<frontName>install</frontName>

‎app/code/core/Mage/Sales/controllers/Recurring/ProfileController.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -190,8 +190,9 @@ protected function _viewAction()
190190
*/
191191
protected function _initProfile()
192192
{
193+
/** @var Mage_Sales_Model_Recurring_Profile $profile */
193194
$profile = Mage::getModel('sales/recurring_profile')->load($this->getRequest()->getParam('profile'));
194-
if (!$profile->getId()) {
195+
if (!$profile->getId() || $this->_session->getCustomerId() != $profile->getCustomerId()) {
195196
Mage::throwException($this->__('Specified profile does not exist.'));
196197
}
197198
Mage::register('current_recurring_profile', $profile);

‎app/etc/applied.patches.list‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,24 @@
22
patching file app/code/core/Mage/ConfigurableSwatches/Block/Catalog/Media/Js/Abstract.php
33

44

5+
2015-05-15 01:46:02 UTC | SUPEE-5998 | EE_1.14.1.0 | v1 | 9324d922a64fac99ceb3725062eb498d634401dc | Thu May 14 13:46:45 2015 +0300 | v1.14.1.0..HEAD
6+
patching file app/code/core/Mage/Authorizenet/controllers/Directpost/PaymentController.php
7+
patching file app/code/core/Mage/Core/Controller/Varien/Router/Admin.php
8+
patching file app/code/core/Mage/Core/Controller/Varien/Router/Standard.php
9+
patching file app/code/core/Mage/Customer/Model/Customer.php
10+
patching file app/code/core/Mage/Dataflow/Model/Convert/Parser/Csv.php
11+
patching file app/code/core/Mage/ImportExport/Model/Export/Adapter/Csv.php
12+
patching file app/code/core/Mage/Install/Controller/Router/Install.php
13+
patching file app/code/core/Mage/Install/etc/config.xml
14+
patching file app/code/core/Mage/Sales/controllers/Recurring/ProfileController.php
15+
patching file downloader/Maged/Model/Connect.php
16+
patching file downloader/Maged/View.php
17+
patching file downloader/template/connect/packages_prepare.phtml
18+
patching file downloader/template/messages.phtml
19+
patching file get.php
20+
Hunk #1 succeeded at 36 (offset -1 lines).
21+
patching file lib/PEAR/PEAR/PEAR.php
22+
patching file lib/PEAR/PEAR/PEAR5.php
23+
patching file lib/Varien/Io/File.php
24+
25+

0 commit comments

Comments
 (0)