Magento released the latest security patch SUPEE-9767 patching various security issues. It is a straight forward installation but required to cover a couple of areas. This is quick step by step guide to cover the process and links I found really helpful and made the job easy.
- Download the SUPEE 9767 patch file match for the current Magento installation
>> https://magento.com/tech-resources/download - Upload the patch file to the root
- In command line run the following command (It should match the patch file name)
>> sh PATCH_SUPEE-9767_CE_1.7.0.2_v1.sh - If the download folder is removed (Which we did as a security measure) remove the
download folder related code from the patch file - If you come across any other missing files check in this repo. It might be due to
a previous patch could not generate a new file. Add the new file and apply STEP 2
>> https://github.com/magecomp/Magento-Pre-Patched-Files - Apply the template level changes to the custom template files.
- Add the script to the magento shell folder and run it
>> https://github.com/experius/Magento-1-Experius-Patch-Helper#magento - Add getBlockHtml(‘formkey’) ?> to all the template files.
- Apply the JS file changes to the over writes
>> https://magento.stackexchange.com/questions/177035/supee-9767-patch-ce-1-9-3-3-one-page-checkout-customer-registration-issue?noredirect=1&lq=1 - After applying the patch successfully check the following settings before testing
- Enable Form Key Validation On Checkout
>> Admin > System > Configuration > Advanced > Admin > Security - Test Login in and out in Admin User level
- Placed a test order enabling create account
- Upload image from the admin area.
