Magento 1.9.1.1 SUPEE-6285 Hunk #1 FAILED at 33.

[lensjuh]

Hi,

We have an magento 1.9.1.1 store that gets a the following error:

1 out of 1 hunk FAILED -- saving rejects to file downloader/template/connect/packages_prepare.phtml.rej

I thought that we made modifications on this file, so i downloaded the original magento 1.9.1.1 and made a rewrite on the complete downloader folder. After this i still get the same error message. Does somebody know what the problem can be? Here is the complete error message:

Checking if patch can be applied/reverted successfully...
ERROR: Patch can't be applied/reverted successfully.

patching file app/Mage.php
patching file app/code/community/Phoenix/Moneybookers/controllers/MoneybookersController.php
patching file app/code/core/Mage/Adminhtml/Controller/Action.php
patching file app/code/core/Mage/Adminhtml/controllers/AjaxController.php
patching file app/code/core/Mage/Adminhtml/controllers/Catalog/Category/WidgetController.php
patching file app/code/core/Mage/Adminhtml/controllers/Catalog/Product/DatafeedsController.php
patching file app/code/core/Mage/Adminhtml/controllers/Catalog/Product/ReviewController.php
patching file app/code/core/Mage/Adminhtml/controllers/Catalog/Product/WidgetController.php
patching file app/code/core/Mage/Adminhtml/controllers/Cms/Block/WidgetController.php
patching file app/code/core/Mage/Adminhtml/controllers/Cms/Page/WidgetController.php
patching file app/code/core/Mage/Adminhtml/controllers/Cms/PageController.php
patching file app/code/core/Mage/Adminhtml/controllers/Cms/WysiwygController.php
patching file app/code/core/Mage/Adminhtml/controllers/Customer/System/Config/ValidatevatController.php
patching file app/code/core/Mage/Adminhtml/controllers/JsonController.php
patching file app/code/core/Mage/Adminhtml/controllers/NotificationController.php
patching file app/code/core/Mage/Adminhtml/controllers/Report/CustomerController.php
patching file app/code/core/Mage/Adminhtml/controllers/Report/ProductController.php
patching file app/code/core/Mage/Adminhtml/controllers/Report/ReviewController.php
patching file app/code/core/Mage/Adminhtml/controllers/Report/SalesController.php
patching file app/code/core/Mage/Adminhtml/controllers/Report/ShopcartController.php
patching file app/code/core/Mage/Adminhtml/controllers/Report/TagController.php
patching file app/code/core/Mage/Adminhtml/controllers/ReportController.php
patching file app/code/core/Mage/Adminhtml/controllers/Rss/CatalogController.php
patching file app/code/core/Mage/Adminhtml/controllers/Rss/OrderController.php
patching file app/code/core/Mage/Adminhtml/controllers/Sales/Billing/AgreementController.php
patching file app/code/core/Mage/Adminhtml/controllers/Sales/Order/View/GiftmessageController.php
patching file app/code/core/Mage/Adminhtml/controllers/Sales/Recurring/ProfileController.php
patching file app/code/core/Mage/Adminhtml/controllers/Sales/TransactionsController.php
patching file app/code/core/Mage/Adminhtml/controllers/System/Config/System/StorageController.php
patching file app/code/core/Mage/Adminhtml/controllers/TagController.php
patching file app/code/core/Mage/Adminhtml/controllers/Tax/RateController.php
patching file app/code/core/Mage/Adminhtml/controllers/TaxController.php
patching file app/code/core/Mage/Api2/controllers/Adminhtml/Api2/AttributeController.php
patching file app/code/core/Mage/Bundle/controllers/Adminhtml/Bundle/SelectionController.php
patching file app/code/core/Mage/Captcha/controllers/Adminhtml/RefreshController.php
patching file app/code/core/Mage/Centinel/controllers/Adminhtml/Centinel/IndexController.php
patching file app/code/core/Mage/Checkout/controllers/MultishippingController.php
patching file app/code/core/Mage/Connect/controllers/Adminhtml/Extension/LocalController.php
patching file app/code/core/Mage/ImportExport/Model/Abstract.php
patching file app/code/core/Mage/Oauth/controllers/Adminhtml/Oauth/AuthorizeController.php
patching file app/code/core/Mage/Paygate/controllers/Adminhtml/Paygate/Authorizenet/PaymentController.php
patching file app/code/core/Mage/Paypal/controllers/Adminhtml/Paypal/ReportsController.php
patching file app/code/core/Mage/Rss/controllers/CatalogController.php
patching file app/code/core/Mage/Rss/controllers/OrderController.php
patching file app/code/core/Mage/Widget/Block/Adminhtml/Widget/Chooser.php
patching file app/code/core/Mage/Widget/controllers/Adminhtml/WidgetController.php
patching file app/design/frontend/base/default/template/checkout/cart.phtml
patching file app/design/frontend/base/default/template/checkout/cart/noItems.phtml
patching file app/design/frontend/base/default/template/checkout/onepage/failure.phtml
patching file app/design/frontend/base/default/template/rss/order/details.phtml
patching file app/design/frontend/base/default/template/wishlist/email/rss.phtml
patching file app/design/frontend/default/modern/template/checkout/cart.phtml
patching file downloader/Maged/.htaccess
patching file downloader/Maged/Controller.php
patching file downloader/Maged/Model/Session.php
patching file downloader/lib/.htaccess
patching file downloader/template/connect/packages.phtml
patching file downloader/template/connect/packages_prepare.phtml
Hunk #1 FAILED at 33.
1 out of 1 hunk FAILED -- saving rejects to file downloader/template/connect/packages_prepare.phtml.rej
patching file downloader/template/login.phtml
patching file downloader/template/settings.phtml
patching file errors/processor.php

[atoso · Accepted solution]

I had the same problem probably due to a older packages_prepare.phtml file reading:

    <input type="hidden" name="install_package_id" value="<?php echo $this->get('package_id'); ?>">

instead of

    <input type="hidden" name="install_package_id" value="<?php echo $this->escapeHtml($this->get('package_id')); ?>">

I was able to solve this by modifying the patch file starting at line 1207

diff --git downloader/template/connect/packages_prepare.phtml downloader/template/connect/packages_prepare.phtml
index f74c3df..86aa51b 100644
--- downloader/template/connect/packages_prepare.phtml
+++ downloader/template/connect/packages_prepare.phtml
@@ -33,6 +33,7 @@
 Extension dependencies
 <form action="<?php
     echo $this->url('connectInstallPackagePost')?>" method="post" target="connect_iframe" onsubmit="onSubmit(this)">
-    <input type="hidden" name="install_package_id" value="<?php echo $this->get('package_id'); ?>">
+    <input name="form_key" type="hidden" value="<?php echo $this->getFormKey() ?>" />
+    <input type="hidden" name="install_package_id" value="<?php echo $this->escapeHtml($this->get('package_id')); ?>">
     <table cellspacing="0" cellpadding="0" width="100%">
         <col width="150" />

That was a quick solution for me as I wanted to patch quickly. Maybe there is a better way to do this.

[sherrie]

Hi @lensjuh, do you have the previous patches installed? If not, you will need to install them before SUPEE-6285. This is likely what is causing the problem. Alternatively, you can upgrade to 1.9.2 which includes SUPEE-5344, SUPEE-5994 and SUPEE-6285.

There's a bit more detail here: http://community.magento.com/t5/News-Announcements/Critical-new-Magento-security-patch/m-p/10137#M15

[A Developer]

Hi,

I had a similar issue if not the same, magento 1.9.1.1 with the other previous patches installed as well.

$ sh PATCH_SUPEE-6285.sh
PATCH_SUPEE-6285.sh: 14: PATCH_SUPEE-6285.sh: 127: not found
PATCH_SUPEE-6285.sh: 14: PATCH_SUPEE-6285.sh: 127: not found
PATCH_SUPEE-6285.sh: 25: PATCH_SUPEE-6285.sh: 0: not found
Checking if patch can be applied/reverted successfully...
-e ERROR: Patch can't be applied/reverted successfully.

checking file app/Mage.php
checking file app/code/community/Phoenix/Moneybookers/controllers/MoneybookersController.php
checking file app/code/core/Mage/Adminhtml/Controller/Action.php
checking file app/code/core/Mage/Adminhtml/controllers/AjaxController.php
checking file app/code/core/Mage/Adminhtml/controllers/Catalog/Category/WidgetController.php
checking file app/code/core/Mage/Adminhtml/controllers/Catalog/Product/DatafeedsController.php
checking file app/code/core/Mage/Adminhtml/controllers/Catalog/Product/ReviewController.php
checking file app/code/core/Mage/Adminhtml/controllers/Catalog/Product/WidgetController.php
checking file app/code/core/Mage/Adminhtml/controllers/Cms/Block/WidgetController.php
checking file app/code/core/Mage/Adminhtml/controllers/Cms/Page/WidgetController.php
checking file app/code/core/Mage/Adminhtml/controllers/Cms/PageController.php
checking file app/code/core/Mage/Adminhtml/controllers/Cms/WysiwygController.php
checking file app/code/core/Mage/Adminhtml/controllers/Customer/System/Config/ValidatevatController.php
checking file app/code/core/Mage/Adminhtml/controllers/JsonController.php
checking file app/code/core/Mage/Adminhtml/controllers/NotificationController.php
checking file app/code/core/Mage/Adminhtml/controllers/Report/CustomerController.php
checking file app/code/core/Mage/Adminhtml/controllers/Report/ProductController.php
checking file app/code/core/Mage/Adminhtml/controllers/Report/ReviewController.php
checking file app/code/core/Mage/Adminhtml/controllers/Report/SalesController.php
checking file app/code/core/Mage/Adminhtml/controllers/Report/ShopcartController.php
checking file app/code/core/Mage/Adminhtml/controllers/Report/TagController.php
checking file app/code/core/Mage/Adminhtml/controllers/ReportController.php
checking file app/code/core/Mage/Adminhtml/controllers/Rss/CatalogController.php
checking file app/code/core/Mage/Adminhtml/controllers/Rss/OrderController.php
checking file app/code/core/Mage/Adminhtml/controllers/Sales/Billing/AgreementController.php
checking file app/code/core/Mage/Adminhtml/controllers/Sales/Order/View/GiftmessageController.php
checking file app/code/core/Mage/Adminhtml/controllers/Sales/Recurring/ProfileController.php
checking file app/code/core/Mage/Adminhtml/controllers/Sales/TransactionsController.php
checking file app/code/core/Mage/Adminhtml/controllers/System/Config/System/StorageController.php
checking file app/code/core/Mage/Adminhtml/controllers/TagController.php
checking file app/code/core/Mage/Adminhtml/controllers/Tax/RateController.php
checking file app/code/core/Mage/Adminhtml/controllers/TaxController.php
checking file app/code/core/Mage/Api2/controllers/Adminhtml/Api2/AttributeController.php
checking file app/code/core/Mage/Bundle/controllers/Adminhtml/Bundle/SelectionController.php
checking file app/code/core/Mage/Captcha/controllers/Adminhtml/RefreshController.php
checking file app/code/core/Mage/Centinel/controllers/Adminhtml/Centinel/IndexController.php
checking file app/code/core/Mage/Checkout/controllers/MultishippingController.php
checking file app/code/core/Mage/Connect/controllers/Adminhtml/Extension/LocalController.php
checking file app/code/core/Mage/ImportExport/Model/Abstract.php
checking file app/code/core/Mage/Oauth/controllers/Adminhtml/Oauth/AuthorizeController.php
checking file app/code/core/Mage/Paygate/controllers/Adminhtml/Paygate/Authorizenet/PaymentController.php
checking file app/code/core/Mage/Paypal/controllers/Adminhtml/Paypal/ReportsController.php
checking file app/code/core/Mage/Rss/controllers/CatalogController.php
checking file app/code/core/Mage/Rss/controllers/OrderController.php
checking file app/code/core/Mage/Widget/Block/Adminhtml/Widget/Chooser.php
checking file app/code/core/Mage/Widget/controllers/Adminhtml/WidgetController.php
checking file app/design/frontend/base/default/template/checkout/cart.phtml
checking file app/design/frontend/base/default/template/checkout/cart/noItems.phtml
checking file app/design/frontend/base/default/template/checkout/onepage/failure.phtml
checking file app/design/frontend/base/default/template/rss/order/details.phtml
checking file app/design/frontend/base/default/template/wishlist/email/rss.phtml
checking file app/design/frontend/default/modern/template/checkout/cart.phtml
checking file downloader/Maged/.htaccess
checking file downloader/Maged/Controller.php
checking file downloader/Maged/Model/Session.php
checking file downloader/lib/.htaccess
checking file downloader/template/connect/packages.phtml
checking file downloader/template/connect/packages_prepare.phtml
Hunk #1 FAILED at 33.
1 out of 1 hunk FAILED
checking file downloader/template/login.phtml
checking file downloader/template/settings.phtml
checking file errors/processor.php

[A Developer]

---

@atoso wrote:

I had the same problem probably due to a older packages_prepare.phtml file reading:

<input type="hidden" name="install_package_id" value="<?php echo $this->get('package_id'); ?>">

instead of

    <input type="hidden" name="install_package_id" value="<?php echo $this->escapeHtml($this->get('package_id')); ?>">

---

I just checked my packages_prepare.phtml file, related to that section you described it looks the same for me as it did for you, This was a fresh 1.9.1 install a few months ago so i'm guessing the code it's looking for its actually older and they juts forgot to add a case for the newer ones.

   <input type="hidden" name="install_package_id" value="<?php echo $this->get('package_id'); ?>">
   

I also tried applying the patch to a magento 1.9.0.1 with the same result, must be an issue with the 1.9.x.x versions.

[atoso]

The scary thing is, that the required change is in the

PATCH_SUPEE-5994_CE_1.6.0.0_v1-2015-05-15-04-34-46.sh

@@ -33,7 +33,7 @@
 Extension dependencies
 <form action="<?php
     echo $this->url('connectInstallPackagePost')?>" method="post" target="connect_iframe" onsubmit="onSubmit(this)">
-    <input type="hidden" name="install_package_id" value="<?php echo $this->get('package_id'); ?>">
+    <input type="hidden" name="install_package_id" value="<?php echo $this->escapeHtml($this->get('package_id')); ?>">

I was dead sure that I applied this patch successfully. And after checking my applied.patches.list I found out that it recorded applying :

SUPEE-6004 | EE_1.9.0.0 | v1 | 73197f338d60626b1c38c59467c109b57483e436 | Wed May 13 13:34:16 2015 +0300 | v1.9.0.0..HEAD

I dont even find that in the Downloads section today but doing a diff it patched quite a few files the same way the 5994 did. But just quite isn't enough.

Anyway ... I will the core to 1.9.2 as soon as I see that people are happy with the release.

[WHHA]

At a glance it appears you are changing the code to add in the HTML escape tag. Thank you for sharing this. It assisted our own deploy. Would you be able to offer a bit of explanation what the aim of the changes are specifically?

Thanks!

[atoso]

Its not really a change I made:

The 5994 patch included the change I had to make manually so the general/correct procedure is to make sure you have

5994 installed before 6285.

However I am still pretty sure that I had 5994 installed before installing 6285 (on 4 different installs that is by the way) and to me it seems like there was a wrong patch file out there for some time that behaved differently and lead to the error some of us are experiencing. But I cannot prove it.

As written above, for the long run I will play it safe and do a clean update to 1.9.2

Technically the html escape in that line is used to target potential cross site scripting vulnarabilities.

[jkossoff]

I am receiving the exact same error as the OP, but my packages_prepare.phtml file has the indentation before the line atoso specified.  I have definitely installed the 5994 patch, so I'm quite confused.  Has anyone found another cause for this issue?

[A Developer]

I replaced 

   <input type="hidden" name="install_package_id" value="<?php echo $this->get('package_id'); ?>">

For 

    <input type="hidden" name="install_package_id" value="<?php echo $this->escapeHtml($this->get('package_id')); ?>">

on my packages_prepare.phtml

Then I was able to run the patch successfully.