Magento 1.9.0.1 + Patch SUPEE-6788 – Fixing Custom Theme Breaks

ce-1.9.0.1layoutmagento-1.9patchessupee-6788

I have tried to apply the new patch SUPEE-6788 on my website which was successful without any errors.

After that I recompiled Magento using Configuration > tools > compilation. After doing that my custom theme layout broke. It is missing some blocks etc.

Any suggestions on this please?

Best Answer

This patch enforces a block whitelist. You can add your blocks in the admin section under System -> Permissions -> Blocks, or via setup scripts adding to the permission_block table.

Related Solutions

How to Apply New Patch SUPEE-6788 in Magento

In general, you can apply the patch as all previous ones. Have a look at the official documentation and check this SE post. But yes, there are some additional points you should check when applying this patch. Byte/Hypernode has a nice post about it.

Check if your theme has a custom template/customer/form/register.phtml or custom template/persistent/customer/form/register.phtml. If this is the case, make sure that it includes a form_key.
Check if your theme has a custom layout/customer.xml. If this is the case, make sure to apply the necessary changes from the patch (customer_account_resetpassword has been changed to customer_account_changeforgotten).
Do you use non-standard variables in CMS pages, static blocks or email templates? Then make sure that you whitelist them. See this SE question to learn how to whitelist variables/blocks.
Do you run the cron.php via HTTP? Make sure that you better use cron.sh. If this is not possible, at least make sure that you call cron.php via CLI PHP. If for some reason you can not configure a real cronjob and need to run it via HTTP, see this SE question
Make sure that all your extensions use the "new" admin routing. You can use this n98-magerun plugin to check. You can also use this CLI script. You can also have a look at this related SE question.
1. When all your extensions use the proper admin routing, make sure to disable "Enable Admin routing compatibility mode" under System - Configuration - Admin - Security.
If you use M2ePro, update it to the latest version since old versions do not work with the new patch.

When updating, make sure that you delete the file dev/tests/functional/.htaccess. It is not present any more in Magento 1.9.2.2. Keeping it means you are still vulnerable.

In any case, check your page with MageReport after updating to see if everything went well.

There is also a technical blog post by Piotr, which describes the critical changes.

Magento – PHP Fatal error: Call to a member function setData() on a non-object in Permissions/BlockController.php on line 113 – After Applying SUPEE-6788

app/design/adminhtml/default/default/layout/admin.xml

This error is generated when layout cache hasn't been updated or admin.xml is missing the following code.

<!-- admin permissions block edit page -->
<adminhtml_permissions_block_edit>
    <reference name="content">
        <block type="adminhtml/permissions_block_edit" name="adminhtml.permissions.block.edit"/>
    </reference>
</adminhtml_permissions_block_edit>
<!-- admin permissions variable edit page -->

Best Answer

Related Solutions

How to Apply New Patch SUPEE-6788 in Magento

Magento – PHP Fatal error: Call to a member function setData() on a non-object in Permissions/BlockController.php on line 113 – After Applying SUPEE-6788

Related Topic