Magento recently releases several patches to fix vulnerabilities in the system. It is recommended that you update your store to the latest version of Magento and install any security-related patches as soon as they are available.
Due to variation in hosting environments and server access, there is no universal way to install a Magento security patch. This article describes 3 methods to install a patch and also how to roll back a patche.
Methods to Install a Magento Security Patch
- Use SSH
- Run a script
- Load pre-patched files
- Roll back an installed patch
If your hosting provider does not provide SSH access to the server, try one of the other methods. Although this article focuses on security patches, the same methods can be used to install any Magento patch.
Step 1: Make a backup
Always make a backup of your Magento installation before installing a patch. For more information, see: Create a Magento Backup
Step 2: Download the patch
To download the recommended patches for your version of Magento Community Edition, visit the Magento download page.
Step 3: Disable the compiler
If your store is compiled, be sure to disable compilation before installing a patch. After installing a patch, test the store thoroughly. Then run the compiler again. Your store must be recompiled for the patch to take effect.
Method 1: Use SSH
Secure Shell (SSH) is the recommended way to install a patch. If you don't know how to configure SSH, contact your hosting provider.
- Upload the patches to the root folder of your [magento] installation.
- If the store is compiled, make sure the compiler is disabled.
- In the SSH console, run the following commands according to the patch extension:
.sh extension
Sh patch_file_name.sh
.patch extension
Patch --p0
- Use one of the following methods to verify that the patch has been installed:
Download or view the file: app/etc/applied.patches.list.
From the command line, run the patch file with the –list argument to get a report of all patch installations.
Method 2: Run a Script
The following example shows how to install the SUPEE_5344.sh patch. Be sure to replace the patch name in the example with the name of the file you are installing.
- Upload the patches to the root folder of your [magento] installation.
- If the store is compiled, make sure the compiler is disabled.
- From your desktop, do the following:
a. Use a text editor to create a file called patch.php that contains the following code.
"); passthru("/bin/bash PATCH_SUPEE-5344.sh"); print(" "); echo "Done"; ?>
b. Upload the patches to the root folder of your [magento] installation.
4. Run the script from your browser.
http://www. [yourdomain.com] /patch.php
Then look for the following message:
Checking if patch can be applied/reverted successfully... Patch was applied/reverted successfully. Donate
- After successfully installing the patch, delete the patch.php file from your server.
If you receive the following error, ask your hosting provider to install the missing tools or try one of the other methods.
"Mistake! Some required system tools, that are used in this sh script, are not installed; Tool (s) “patch” is (are) missed, please install it (them)
- Update the Magento Admin cache, don't forget to also update your OPcode or APC cache.
- If your store is compiled, run the compiler again.
Method 3: Load pre-patched files
- Download your Magento installation to your local machine.
- Apply the patch locally.
- Upload the updated files to your server.
Roll back a Magento security patch
From time to time it is necessary to uninstall a patch. The command to roll back a patch is essentially the same as the command used to install a patch, but with the addition of the -R flag.
- Before you begin, make sure you have the proper permissions for the Magento installation directory on the server. If the directory is owned by a web server user such as apache or root, change to the appropriate user to ensure you have the necessary permissions. For example:
su – apache
Then, when prompted, enter your password.
- Navigate to your magento installation folder.
- At the command line, type the following command to roll back the patch:
sh patch_file_name.sh -R
