Security Patch Broke my site - BLANK PAGE

toltec7:

I had updated several sites, and only one went down in this manner

After reading this, I checked my non admin folders, and there they were DOHThank you for sharing this toltec7. I too spent a large chunk of yesterday applying the patch to client sites. Had no problems with any of them.

If you are having problems go back and double check what you did. Installed in the right place this patch simply works and you should see no difference in how your Admin operates (the extra security stuff happens under the surface). In particular, do not leave a backup of the html_output.php file (that is overwritten as part of the patch) on your site, and make sure that your FTP program hasn't done so either (check folder WHATEVER_YOU_CALL_YOUR_ADMIN/includes/functions) - that would cause a blank page in the current version of Zen Cart.

There are also two mods to watch out for. Admin Profiles has a patch (see its support thread) to make it compatible with this patch, and there may be some problems with Super Order's compatibility (see that mod's support thread for more information), but these will only affect those mod's features and not the rest of your admin area.

Do you think the files would be located most likely in the Admin folder? I've been so busy adding products to my site that I have strayed away from knowing the technical portion of it.

Here is a site that talks about a file that may be helping to cause this issue, although I am not sure which file this is. I will have to do a search throughout my shopping cart files:

[Moderator note: URL removed. Not everybody is patched yet, so posting a link to code that exploits the vulnerability that it plugs isn't helpful]

Sorry about posting the web link, just trying to help out fellow Zenners. Well, I think I found the file that is causing this problem. It is located in the below directory and is called core12758.php. Delete this file and you should be able to log into your admin section again. For me, personally I have also added the security patches and will be changing the name of my admin section. Hope this helps.

admin\includes\languages\english\extra_definitions\core12758.php

MODERATOR NOTE: The numbers and the name of the file may change from site to site.*

it seems since i installed the security patch, my "update" and "delete" buttons in admin will not work. instead, they take me back to the admin page. For example, i went to delete an order and after selecting the order and pressing "delete" again (to confirm) i was taken to the admin home page and the order was not deleted. Also when i try to change options in admin--> config ~ the same thing happens when i try to click "update" to confirm. the cancel button DOES work.. and shows a link when i hover over it... which the update and delete buttons do not.

Please help!

That's the same thing that happened to me. I deleted those files and everything started working again. I would try to delete those files and then follow the threads here that tell you how to rename your admin section.

those direction could use re-written.

I like how this important info isn't made clear till step 3.
Have someone not so code savvy write them.
Not a coding expert who assume we all know everything.

Oh BTW
"(You did make a backup, didn't you)"

If you do have any problems, then you should revert to the original version of html_ouput.php (You did make a backup, didn't you)

Its why engineers don't write books that sell to the general public.
They wrtie over folks heads.

SmittyMats:

Oh BTW
"(You did make a backup, didn't you)"

If you do have any problems, then you should revert to the original version of html_ouput.php (You did make a backup, didn't you)

Its why engineers don't write books that sell to the general public.
They wrtie over folks heads.
**RULE NUMBER ONE when working with websites:
****ALWAYS MAKE BACKUPS.
**Backups should include both the DATABASE AND all your PHP files and templates and images.
Make backups daily.
Make backups weekly.
Make backups monthly.
Make backups of backups.
Keep backups on your PC, and burned to CDs for archiving.
Anytime you go to change files on your website, MAKE BACKUPS BEFORE you change anything.
**
Oh, and in case I wasn't clear ... MAKE BACKUPS whenever you have important data someplace and you are about to change something.
**
That's not engineer or programmer speak. It's the number one rule to remember when working with computers and websites.

Hopefully you get the point.

And, if you've been bitten because you failed to make a backup, then hopefully the bite has taught you the lesson. It doesn't seem to matter how much any set of instructions says to make backups ... people ignore that part anyway. So ... the BEST teacher is personal disaster. It almost always drives the point home far enough that they don't make that mistake again.
Glad you've learned from it :blush:

Oh ... and another very important point: If you're complaining that you got burned because you didn't make a backup before you went to apply the patch, then ... the problem HAS NOTHING TO DO WITH THE DOCUMENTATION. The real problem is that YOU have not been doing regular backups yourself, and thus have not been taking any measures to protect your own website/store/business data properly. This statement isn't meant to point fingers or blame back at you, but merely to make it clear that complaining about documentation is a poor deflection. Instead of finger-pointing, simply put measures in place to keep yourself protected all the time. It's not hard to do; it just takes a few minutes here and there, and a bit of attention to detail on things that are important to you.