Security Patch Broke my site - BLANK PAGE

I followed the directions to a T and now when I try and access my site, all I get are blank pages. Argh.. I should have just left it alone...

I'd love to back it out, but as I didn't backup my html_output.php file I'm hosed.

What's wrong with your patch??!!! :censored:

FYI, the site is hosted at GoDaddy.com if that makes any difference.

All files were copied over, into the proper directories in the admin folder and not the root.

I overwrote the html_output.php with the one included with the patch since I've not changed mine. The directions said this was ok. Obviously it's not, something is screwed up now.

I have sent GoDaddy.com an email asking for help from their end as well, hopefully it's a simple fix, but as I can't see any server messages, I'm in the dark here. I will NEVER upgrade a patch again. This is frustrating as he** :censored: :censored: :no:

There were several files inside the zip.
And, those files were contained inside folders embedded in the zip.
When you unzipped, did you get the folders too? or just the files?
If you didn't get the folders, then you probably didn't upload the right files to the right places. That's been the most common mistake we've observed with people installing the patch.

The second most common mistake has been that people were uploading the html_output.php file to the /includes/functions folder instead of to the /ADMIN/includes/functions folder. Those files are very different inside, even though the filenames are the same !!

I'm having exatc problem!!
I've uploaded files in the right folder and now i have a blank page when i go to my shop...
When i saw that i delet the maj and it's still the same problem i have a blank page...
I'm french and my english is not fluent... I have my shop in english & french maybe the problem is there i don't know what to do..
Any help will be much appreciated..
Tyvm in advance
Marie

Same problem here.

1. I changed my admin folder to something else following the instructions here
2. Then I followed the instruction for the patch install here

I unzipped the patch file, which includes the admin/includes/ and four folders, then using my file manager I uploaded each files into their respected spots.

My admin page now says I am up to date, so I know that worked..but when I got to my main index.php page it's blank.
It can be seen here: http://peauproductions.com/store/

I did a database export also beforehand.
I have also changed back the admin folder and the lines in the configure.php file in the admin/includes/configure.php file, and renamed the admin folder, and the admin page still loads but not my main page.
I then tried to do a import of my database, and I get the stupid SQL Error 1062, with the error of: "#1062 - Duplicate entry '1' for key 'PRIMARY' " I have looked at fixes on the forum here, mainly this thread for the Error 1062, but the solutions there didnt help me as I dont know which line it needs, since it errors out if any of the lines dont work.

Please let me know ASAP as my store is down and I get orders everyday on it so it's very important to have it up and working, thanks!

OY!

a) the patch ONLY deals with files in your ADMIN area.
b) if your non-admin area is suddenly not working, then you likely put one or more of the files into the non-admin includes folder. Double-check that, including the html_output.php file (there's one in admin and one not in admin, and the patch ONLY affected the one IN the admin area; the other one should have been left alone).
c) there were NO database changes for this patch. So you should not be touching anything in the database, and certainly not importing your database data directly without first wiping all the data already in it ... and I STRONGLY suggest you don't do that until you're sure you really know what you're doing in that area ... cuz it doesn't sound like you do.

Ok, so I had figured out what you had said about the non admin area being changed how the admin area should had been and of course that seems like what had happened.

So I removed all the patch files and made sure they were in their correct folders in the admin area. Also I made sure the html_output.php file in the non-admin area didn't have the added lines in the zen_draw_form but the one in the admin folder did.

But it still doesnt work, and I've double, triple checked to make sure all are in their correct places....???

Hmm, I'm wondering if it's because I copied the output_html.php file code from one to the other, so that the non-admin one is simply the same as the new updated output_html.php but without the added lines on the zen_draw_form.php. So maybe they were different originally? That's why I was trying to import the database so that I could go back to the original file. Do you have the original non admin one if it is different than the one in the admin section?

You can get the original non-admin file by downloading a fresh copy of the Zencart zip file. That's probably the best way to make sure you get the file you need.

Arg, I should have thought of that, since it was so obvious. Ok, all is working good. Note to self, make sure to add files to correct spot and make sure that if you back something up, it actually does back up before you overwrite it.

Thanks guys

Hi Zenners, thanks for the alert! I'm just a bit confused about one of the steps in the security patch, specifically step 3.

It says:

3. Test changes

With all the changes in place, you should now test that you can still access your Administration panel, and that nothing in the Administration panel appears to have been adversely affected by the changes.

If you do have any problems, then you should revert to the original version of html_ouput.php (You did make a backup, didn't you) and remove the other 4 files that are part of this security patch.

Please use the Zen Cart™ Forums for advice and/or to notify us of any problems with the patch.

I followed the instructions, all went well, I logged into my admin area 100% after copying the patch files. My store seems to be working 100% as well. Now step 3 says that if everything is fine after installing the patch, I should delete the patch files from my admin folder, as well as replace the html_output.php with the original one that was there before I installed the patch. Am I understand this correctly that I should just delete the patch files and replace the html_output with the original one? I thought that keeping the html_output.php would be essential since it is a patched version... PLEASE PLEASE advise on this! Thanks!

yaseent:

Hi Zenners, thanks for the alert! I'm just a bit confused about one of the steps in the security patch, specifically step 3.

It says:

3. Test changes

With all the changes in place, you should now test that you can still access your Administration panel, and that nothing in the Administration panel appears to have been adversely affected by the changes.

If you do have any problems, then you should revert to the original version of html_ouput.php (You did make a backup, didn't you) and remove the other 4 files that are part of this security patch.

Please use the Zen Cart™ Forums for advice and/or to notify us of any problems with the patch.

I followed the instructions, all went well, I logged into my admin area 100% after copying the patch files. My store seems to be working 100% as well. Now step 3 says that if everything is fine after installing the patch, I should delete the patch files from my admin folder, as well as replace the html_output.php with the original one that was there before I installed the patch. Am I understand this correctly that I should just delete the patch files and replace the html_output with the original one? I thought that keeping the html_output.php would be essential since it is a patched version... PLEASE PLEASE advise on this! Thanks!

if everything is working for you , you should leave the patch file alone . don't remove them ..

yaseent:

3. Test changes

...

If you do have any problems, then you should revert to the original version of html_ouput.php...vs> yaseent:

Now step 3 says that if everything is fine after installing the patch, I should delete the patch files from my admin folder, as well as replace the html_output.php with the original one that was there before I installed the patch. Am I understand this correctly ... ?

Um ... you read it wrong. It said IF YOU DO have problems, then you would undo the changes. :blink:

My site got hacked. For convenience sake I left the /admin naming convention. The site is www.desertskyink.com/admin and here is the output below. If I apply the patches (which I did), should I then be able to access my admin section? Because I am still not able to. Any help would be appreciated:

#!/usr/bin/php =___________ Zen Cart 1.3.8 Remote Code Execution Exploit ____________= ======================================================================== | BlackH | ======================================================================== | | | $system> php | | Notes: ex: http://victim.com/site (no slash) | | | ========================================================================

Go back and read the security patch announcement and addendum posts. Clean up your site, removing the files added by the hackers. After you do that you should be able to get your admin to load again.

tedk:

I will NEVER upgrade a patch again. This is frustrating as he** :censored: :censored: :no:

As frustrating as you have found it to be (keeping in mind that most of us that have installed the patch haven't had any issues) this is a very poor attitude for you to have. No one likes having to patch their systems, but there is always a VERY GOOD reason for the patches. They help protect your system against hackers.

Given the choice of having my store hacked, or possibly breaking it myself while attempting a patch, I would much rather break it myself. A hacked system is far worse than a self inflicted problem.

Also, make no mistake about it, when a security flaw is found the hackers will take advantage of it on any vulnerable site they find, and it doesn't take much effort at all to locate vulnerable sites.

If you are not willing to patch then you probably shouldn't be running an online store in the first place, and in the worst possible scenario you may find yourself in legal strife by knowingly and willingly potentially exposing your customers data to unauthorised persons.

Cheers
Rod

I guess I should have phrased this better. By applying the security patches, will this fix my admin section, or do I have to go through and remove files that may have been added? I haven't seen 'which' files to delete, etc. This is what I need to know.

handkem:

I guess I should have phrased this better. By applying the security patches, will this fix my admin section, or do I have to go through and remove files that may have been added? I haven't seen 'which' files to delete, etc. This is what I need to know.The security patch will not remove files added by a hacker. I'm afraid that you will need to remove them yourself. Zen Cart knows nothing of these files so to identify them you will need use a file comparison tool to compare the files on your site to a clean Zen Cart release.

Just want to thank the posters here for the tips

I had updated several sites, and only one went down in this manner

After reading this, I checked my non admin folders, and there they were DOH

Saved me a lot of time, thanks zenners

:clap:.