Rename Admin folder security patch v1.3.8

After installed the security patch, I can login but cannot update anything inside the admin configuration panel. It just jumps out to the main admin panel without any error message. I double checked that I followed exactly the instruction. Anyone got an idea why? I'm in a hurry to fix this. Thanks a lot.

This most likely means that you haven't managed to properly over-write the admin/includes/functions/html_output.php file with the new version.

No, I've updated the file and changed its mode to 675 as original already. But still got this problem.

One more error was found. I even can't switch the currency for the "product detail" page. It will routed to the "page not found" page. It is really critical and I need to fix it urgently, otherwise, I have to rollback the security patch. Could anyone help?

How many files did you change/add?
Which folders did you put them in?

Sounds like you put the files in the wrong places.

I've put in the new files and amended two files.

1. includes/function/html_output.php
2. renamed admin folder/includes/configure.php

I double checked several times and pretty sure I follow exactly the instruction. But then I have these two problems:

1. You can't switch the currency in product detail page. It will jump to "page not found" page.
2. I can't update any configuration in admin panel. It jump out to the main admin panel without any error message.

Don't you guys having the same problem?

As a suppliment, the url link for page not found is somewhat like this

/page_not_found/securityToken/16fb69b84332cf65674.....

You touched the wrong html_output.php file.
The documentation tells you to edit/update the /admin/includes/functions/html_output.php file.
Also, the zip includes a folder structure that puts that updated file in the appropriate place under the admin folder structure, not in the non-admin area.

You'll need to put back the original non-admin html_output.php file, and then edit/patch the admin one.

OH.....I'm so silly. Yes, you are right, I edited the wrong html_output.php. I've fixed this file but it can only solve the configuration problem. The currency problem still persist. You can visit my testing site to see what's happening.

http://www.popartonline.com/zencart2/andy-warhol-remake-animations-pop-art-c-130_131/bat-grapnel-gun-for-batman-p-2931

I double checked all the new files are put in the admin folder already. No mistake for this part.

Looks like something wrong with your so-called SEO addon.

But I don't have this problem before installing the security patch. Are you suggesting there is some conflict between this security patch and the SEO add-on? Anyway to handle this? Remove the SEO addon? Any workaround solution is also fine.

I suspect your problem is that you have an SEO addon that came with an altered version of /includes/functions/html_output.php and when you mistakenly edited that file you ended up damaging it, and when you tried to reverse it you didn't put back what was there before editing, and likely put back an old copy from before adding the SEO addon.

No, I renamed the original file in the same folder, so I simply rename it back. I double checked the content, it was the one before editing. Any other hints?

If you turn off your SEO addon, does the currency box work properly?
Did your site's main .htaccess file get altered recently? Maybe something's broken in there.
If turning off the SEO addon "fixes" the problem, then you'll have to work with that addon's support/discussion about how to re-enable it.

Keep in mind that the June 2009 security patch ONLY touches admin-related files, and thus has NO effect on any of the files in your storefront. So, if your storefront is "suddenly" broken, then it's not the fault of the patch ... so I'd start looking at user-error, or maybe files getting hacked and not properly cleaned up, or other contributing factors.

How to turn off SEO? I'm using Simple SEO URL. Seems that there is no such option to turn off.

I double checked the current content with the one from simple SEO URL, it was the same. So I confirm my rollback is successful.

I also notice that you are one of member contributing to the amendment of this html_output.php. Really feel honored to have you helping me on this issue. Thanks a lot.

I confirm that the problem only appear after the security patch installation, you can see this website, it is the one before installating the security patch.

http://www.smarthost4u.org/sclients/fineartmegastore/

DrByte is not just a member, he is a core developer :)

SSU can be turned off via admin->configuration->ssu setting.

SSU does edit your html_output.php, and this edit does not conflict with any zencart security patch. There should be absolutely no problem if you applied the patch correctly.

I suggest you recheck the html_output.php goes inside the SSU package and compare with the current one.

After turning SSU off, the currency switching has no problem. I compared the below file with the one in simple SEO URL, the only difference is the security patch.

admin/includes/function/html_output.php

Are you suggesting simple SEO URL has conflict with this security patch? Any hints? How about use another SEO URL addon?

alimtlai:

After turning SSU off, the currency switching has no problem. I compared the below file with the one in simple SEO URL, the only difference is the security patch.

admin/includes/function/html_output.php

Are you suggesting simple SEO URL has conflict with this security patch? Any hints? How about use another SEO URL addon?
No, it cannot have any conflict because

1. logically, this patch does not affect ssu in anyway (and vice versa)
2. we are using this patch along with ssu for our own site and clients sites.

I suspect in the process of applying the patch you messed up something else :)

alimtlai:

After turning SSU off, the currency switching has no problem. I compared the below file with the one in simple SEO URL, the only difference is the security patch.

admin/includes/function/html_output.php

Are you suggesting simple SEO URL has conflict with this security patch? Any hints? How about use another SEO URL addon?
It still seems like maybe your non-admin version of html_output.php is not the right one.