Magento Patches Finder

by frosit 7 years ago

macOS ◆ xterm-256color ◆ zsh 95 views

The following is a small phar solution i made based on the patch verification solution within my Magento Security Framework. The console utility basically finds the right patches for your Magento installation based on the stores’ version and edition. I’ve aggregated an index of all patches for this as part of my security solution. This indexed data is being matched against the store using semantic versioning, and filtered using the applied.patches file. It provides some additionally features to aid in patch work like auto-downloading, extracting the diff’s, matching checksums etc.

Magento Patch Finder

All patches and information used are publicly available in the magento-patches repository which is now according to my data, complete. My framework has features for collecting and aggregating this kind of patch data which i then contribute. The features that aggregate the data are not in there. My framework periodically updates the patch index json file.

Install

wget -q -O magepatch.phar http://magepatch.gdprproof.com/magepatch.phar && chmod +x magepatch.phar

Build (dev)

git clone https://github.com/GDPRProof/magento-patch-finder.git && \
cd magento-patch-finder && make install && make build

About

When working with large stores, having to verify dozens of patches in complex and highly customised installations can be quite the task. In order to ensure a store’s security, I had to make sure everything that was necessary to patch, was patched. When i found out the sources i relied on we’re not complete, i started maintaining my own collection. Now the collection is complete, I’ve extracted some features out of my framework into this Symfony CLI tool for the community to use.

My security framework has ben under development for over a year now and is coming close to a first release. This framework aids us in providing semi-automated security & monitoring services as well as judicial and compliancy related consultancy. Feel free to drop me a pm if you’re interested to have a chat about that.

Author

Fabio Ros - GDPRProof.com (@frosit_it)

More by frosit

hnwsl 01:11

by frosit 3 years ago

POC bash version of mwscan 02:23

by frosit 7 years ago

Magento Cacheleak check 00:56

by frosit 7 years ago

See all

You can download this recording in asciicast v1 format, as a .json file.

Download

Replay in terminal

You can replay the downloaded recording in your terminal using the asciinema play command:

asciinema play 122408.json

If you don't have asciinema CLI installed then see installation instructions.

Use with stand-alone player on your website

Download asciinema player from the releases page (you only need .js and .css file), then use it like this:

<!DOCTYPE html>
<html>
<head>
  <link rel="stylesheet" type="text/css" href="asciinema-player.css" />
</head>
<body>
  <div id="player"></div>
  <script src="asciinema-player.min.js"></script>
  <script>
    AsciinemaPlayer.create(
      '/assets/122408.json',
      document.getElementById('player'),
      { cols: 219, rows: 37 }
    );
  </script>
</body>
</html>

See asciinema player quick-start guide for full usage instructions.

While this site doesn't provide GIF conversion at the moment, you can still do it yourself with the help of asciinema GIF generator utility - agg.

Once you have it installed, generate a GIF with the following command:

agg https://asciinema.org/a/122408 demo.gif

Or, if you already downloaded the recording file:

agg demo.cast demo.gif

Check agg --help for all available options. You can change font family and size, select color theme, adjust speed and more.

See agg manual for full usage instructions.