OpenMage/magento-lts v20.19.0

v20.19.0 🌈

on GitHub

Security

This release fixes 34 security issues: 16 are published with CVE identifiers and 18 as GitHub Security Advisories only. Upgrade as soon as possible. All 34 are fixed in v20.19.0. v20.18.2 is a security-only patch release on top of v20.18.0 and fixes all of them except the three marked 20.19.0 only. Those three need behaviour or schema changes too large for a patch release. The 21.x pre-release line will be fixed in v21.0.0-beta3.

Why there is no v20.18.1. An automatically generated release draft named "v20.18.1" sat on the Releases page for months. It was never tagged or released, and its contents were feature work, which now ships as v20.19.0. We skipped the 20.18.1 number deliberately, so nobody confuses the security patch with that old draft. v20.18.2 is the first patch release after v20.18.0.

Scores are CVSS 3.1. Where a vulnerable feature ships disabled, the advisory says so and gives the score for stores that have it enabled.

Advisories with a CVE

* In 20.18.2, downloadable links on private networks are still allowed by default, to avoid breaking existing stores. See Behaviour changes.

Advisories without a CVE

These are published so you can track them. Each one either needs an administrator account and crosses no authority boundary, or has low impact.

Hardening

These are not vulnerabilities in a default install, but are fixed as defence in depth. Thank you to everyone who reported them.

• Mage_Archive_Tar now confines extracted entries to the target directory, skips symlinks that escape it, and drops setuid/setgid/sticky bits. No core code calls it. Thanks @lichoin.
• The three phar:// guards are case-insensitive and catch nested stream wrappers. The phar wrapper is already unregistered at bootstrap. Thanks subhashdasyam (HackerOne) and Bassem Tarek (@1xNANO).
• Dataflow profiles refuse action and container types that are not Dataflow containers before constructing them, and stop with an error when an action names a method the container lacks. Thanks @hariprasanth9317-tech.
• Gift message To/From fields escape the customer's default name (self-XSS). Thanks @0x5t4l1n (w4nn4d13 on HackerOne).
• Varien_Simplexml_Config_Cache_File unserializes its .stat file with allowed_classes => false and treats a tampered file as a stale cache.
• A regression test keeps the HTMLPurifier pass of the MaliciousCode filter in place against unclosed-tag and slash-separated event-handler shapes. Thanks @Judx.

Behaviour changes and upgrade notes

Review these before you upgrade. Most need no action unless you run a custom theme, an extension that overrides the named templates or classes, or a restricted admin role.

Server configuration

• nginx: deny /media/custom_options/. Add location /media/custom_options/ { deny all; } next to your existing rules for /media/customer/, /media/downloadable/ and /media/import/. The upgrade does not touch your server config. Apache users get a new media/custom_options/.htaccess, so make sure AllowOverride lets it take effect.
• Rate limiter behind a proxy or CDN. After a failed Orders and Returns lookup, the client IP is now refused for system/rate_limit/timeframe seconds (default 30). If you run behind a load balancer, reverse proxy or CDN, list the real-client-IP header under global/remote_addr_headers in app/etc/local.xml. Otherwise all visitors share one IP, and one failed lookup blocks everyone. Set system/rate_limit/active to 0 to switch the limiter off.

Configuration to review

• Downloadable products: private networks. Link and sample URLs that resolve to loopback, link-local, cloud-metadata or reserved addresses stop working in both releases. In 20.19.0, private-network hosts (10/8, 172.16/12, 192.168/16, 100.64/10, fc00::/7) are also refused by default. In 20.18.2 they are still allowed by default. Go to System → Configuration → Catalog → Catalog → Downloadable Product Options, set Allow Link URLs on Private Networks to No, and list hosts you trust under Trusted Link URL Prefixes. A new hourly cron job, downloadable_link_url_audit, and admin inbox messages list affected links.
• Upload extensions. php8, phar and phps are refused wherever the protected-extension list applies. The protected list now has a fixed minimum (PHP variants, phtml, pht, phar, phps, pl, py, cgi, sh, asp, aspx, jsp, htaccess, shtml) that applies even if you saved your own general/file/protected_extensions; you can add extensions but not remove these. A File custom option with no "Allowed File Extensions" list refuses htm, html, svg, svgz, xhtml, xht, xml, xsl and xslt uploads; list a type on the option to accept it, and keep media/custom_options/ off the web if you do.
• Dataflow URL fetch. An invalid or non-http(s) uri in a cURL adapter now fails the profile. Hosts that resolve to loopback, link-local (cloud metadata) or other special-purpose addresses are refused, and redirects are not followed, so point profiles at the final URL. Private-network hosts stay allowed unless you set Allow Private Network Addresses to No. Hosts listed under System → Configuration → System → Dataflow URL Fetch → Allowed URL Prefixes skip the address check. If PHP runs with an http_proxy environment variable, the proxy resolves host names; restrict the proxy's destinations.
• Email templates. store.getConfig() in any letter case returns empty for encrypted settings and their parent nodes. If restricted admins have held System → Transactional Emails, consider rotating payment and carrier credentials.

Admin roles (granular ACL)

• Editing an order address now requires Sales → Orders → Actions → Edit.
• Editing an existing order requires Edit, not Create. Create-only roles lose this; Edit-only roles regain it, which fixes the regression in #2342.
• Each of these now needs its own permission: mass Cancel/Hold/Unhold, Void, report exports and detail pages, All Tags, REST role and REST attribute management, table-rate export, USPS tools, and tax rate import/export.
• Print All leaves out credit memos for roles without credit-memo access.
• Some narrowly scoped roles gain access they were wrongly denied: Bestsellers export, tax import, and the REST role Add button. Review roles that are not full-access after upgrading.

Themes and links (CSRF)

• Customer-account actions need a form key. These actions return 404 without one: billing agreement cancel, reorder (customer and guest), recurring profile cancel/suspend/activate/update, and customer OAuth token revoke/delete. Themes that use the stock block URL getters keep working. Custom code that builds these URLs itself must add form_key or POST with the formkey block. In 20.19.0 the base and rwd templates use POST forms; 20.18.2 changes no templates.
• OAuth authorization buttons. The confirm actions require POST plus the form key, and a GET returns 404. If you override oauth/authorize/button.phtml or button-simple.phtml, submit with method="post" and include the formkey block.
• OAuth callbacks. A consumer with a registered callback URL must use the same scheme, host and port, under the registered path.
• PayPal return URLs (20.19.0 only). Cancel and decline returns now carry a one-time /nonce/<hex>/ segment. Buyers who are at PayPal during the upgrade return without one, and their order stays pending_payment until you cancel it. Extensions overriding getStandardCheckoutFormFields(), _buildTokenRequest() or _buildFormUrlRequest() must keep the parent's nonce.
• {{layout}} directive (20.19.0 only). Only handles declared under global/template/email_layout_handles are rendered. A module that uses its own handles in emails, CMS, widgets or newsletters must declare them, or that content renders empty and a log line is written.

Feeds

• RSS feed URLs are re-issued. Every order-status feed URL issued before the upgrade stops working, and customers get new signed links on their order page. This only matters if order-status RSS is enabled, which it isn't by default. All RSS responses are now text/xml with nosniff, names in feed entries are HTML-escaped, and hidden invoice, shipment and credit-memo comments no longer appear in the customer order-status feed.

Other

• Layout updates are checked more strictly. Updates that contain xmlns, call setTemplate/setDataUsingMethod with a different letter case or a Class:: prefix, name a disallowed block through class or a module/name alias, or put .. in a template argument are rejected. CMS pages and widget instances are validated only on save, so after upgrading, search cms_page.layout_update_xml, cms_page.custom_layout_update_xml and core_layout_update.xml for xmlns (and for unusual method= values or ..) and remove anything you did not put there. Product and category updates are dropped at render time.
• Session messages are purified. Flash messages on the storefront and in the admin keep only simple markup (a b br em i strong span p ul ol li and similar); other tags appear as text, and class, style and target attributes are removed. Check extensions that put buttons, forms, images or scripts in messages. The base core/messages.phtml template now prints the same purified output.
• API access after deactivation. Deactivating a SOAP/XML-RPC API user or changing its API key now ends its open sessions immediately. REST requests with an OAuth token of a deleted or inactive admin user get HTTP 401, and deactivating an admin user revokes its OAuth tokens; after reactivating the account, re-enable them under System → Web Services → REST - OAuth Authorized Tokens.
• Customer confirmation keys. Accounts that registered before the upgrade and are still unconfirmed keep their old key. Consider removing stale unconfirmed accounts.
• Checkout. The Zero Subtotal Checkout method refuses an order whose grand total is not zero.
• Coupon usage limits (20.19.0 only). Uses per Coupon and both Uses per Customer limits are enforced atomically when the order is placed; an order that would exceed a limit fails with a message. Schema change: salesrule_customer gets (rule_id, customer_id) as its primary key and duplicate rows are merged (15–40 s on 2 million rows; run the upgrade in maintenance mode). salesrule_rule_save_before/_after no longer fire when an order uses or cancels a rule; listen to the new salesrule_usage_update_after event instead.
• Free-shipping coupons. A rule or coupon that only grants free shipping now counts towards its Uses per Coupon and Uses per Customer limits. Before, those limits never applied to it, because the order carried no discount amount (#4757, fixed by #5554). Uses from before the upgrade were not recorded.
• Product image APIs (REST/SOAP). Image file names are reduced to [A-Za-z0-9_.-], so spaces and slashes become underscores. (20.19.0 only) Varien_Io_File::write() throws when given an absolute target outside the directory opened with open()/cd().
• Custom-option file downloads return 404 when the stored path lies outside media/custom_options/, or when the file no longer matches its key. An admin following a wishlist file link from the customer edit page also gets 404.
• SOAP WSDL. The WSDL and soap:address use the configured store host unless the request's Host matches a configured store base URL.
• Admin error output. A failed Dataflow profile run shows a generic error and logs the exception to var/log/exception.log.
• Template overrides. If your theme overrides any of these templates, apply the same escaping: tax/rate/title.phtml, sales/order/totals/tax.phtml (admin), oauth/authorize/form/login*.phtml, system/convert/profile/process.phtml, the MSRP price templates, and cataloginventory/qtyincrements.phtml.

Thanks

We thank every researcher who reported these issues through GitHub and HackerOne. Each advisory names its reporters.

Changes

• Release v20.19.0 (#5808)
• fix: "Set Return-Path" setting is ignored since the switch to match (#5799)
• bump symfony/http-foundation to v6.4.48 (#5794)
• fix: default dev/log/max_level drops all levels except emergency (#5790)
• Add events and eventPrefix to the adminhtml form widget (#5756)
• fix(security): use CSPRNG for uniqHash and Newsletter randomSequence (#5774)
• Configurable: remove deprecations in view (#5758)
• add TypeInfo to base Generator functions (#5715)
• replace Mage_Adminhtml_Block_Tax_Rate_Title_Fieldset (#5714)
• Fix labeler YAMLException (#5737)
• getGroupedClassName: fix null on array access (#5747)
• Sales: remove use of deprecated submit() (#5740)
• Add missing frontend base fallback for payment/info/pdf/default.phtml (#5751)
• Fix type safety (#5766)
• Mage_Api: remove classes that doesn't exist anymore (#5761)
• fix(security): deny ACL resources that have no explicit rule for a role (#5757)
• Improve patch handling (#5750)
• Fix deprecated warnings related to using null as an array offset (#5713)
• update widget_grid event prefixes in adminhtml (#5749)
• Sales: remove use of deprecated getTotalModels (#5739)
• LayoutUpdate: remove app()->isInstalled (#5738)
• StoreSwitcher: replace use of deprecated functions (#5741)
• WidgetFormContainer: replace deprecated getSaveUrl with getFormActionUrl (#5742)
• Add focus effects to the admin-html OpenMage design (#5657)
• USE $_SERVER['SCRIPT_FILENAME'] instead of getenv() (#5720)
• fix yesno select preselection, if 'no' is selected (#5735)
• RemoveDefaultValueFromAssignedPropertyRector (#5726)
• RemoveDuplicatedReturnSelfDocblockRector (#5725)
• fix: Disable global attribute field when editing on a store view scope (#5699)
• Unify Colors in adminhtml openmage design (#5615)
• unset image data, to prevent useless override resulting in an array c… (#5628)
• Phpunit10 (#5675)
• Prevent PHP 8.5 null-array-offset deprecations in admin options grid renderer (#5708)
• Report: add timestamp to ReportData (#5710)
• Fix validation for System/Design entries (#5711)
• add schmite as a contributor for bug (#5712)
• Fix MariaDB 12.3 compatibility in cart (#5709)
• Use canonical category id_path equality in URL rewrite category joins (#5663)
• replace hardcoded America/Los_Angeles with StoreConfig (#5685)
• Fix custom admin URL: also apply to skin/js base URLs and cookie domain (#5689)
• Set correct getter for the review id in the rating collection filter (#5690)
• Prevent override of existing buttons in getButtonsHtml (#5688)
• Paypal: add parent::getConfigData fallback (#5637)
• Fix CMS page load store fallback query strategy (#5660)
• Fix CMS block load store fallback semantics (#5658)
• Varien_Object: fix contravariant with implements ArrayAccess (#5678)
• Api2: fixes adminhtml if Api1 is disabled (#5676)
• Fix PHP 8.0+ named parameter error in _generateAction helper calls (#5670)
• Remove unused adminhtml permission files (#5655)
• fix clockHelper instead null pointer during backend order creation (#5634)
• [Core] fix typo validateFileExension (#5629)
• Fix missing method declaration for the model validation. (#5627)
• Composer update symfony/http-foundation v6.4.41 (#5620)
• rector: UseIdenticalOverEqualWithSameTypeRector (#5549)

🚨 Security

• Harden login credential handling against non-string POST input (#5723)
• Security: update guzzlehttp to 7.12.1 (#5653)

🐛 Bug Fixes

• fix: pass $allowedTags to escapeHtml() with array input (#5604)
• Mage_Widget: fix placeholder images not respecting possible SkinDir (#5472)
• Fix wrong DocBlock and getter in adminhtml grid classes (#5578)

🦾 Enhancements

• Harden login credential handling against non-string POST input (#5723)

🔨 Maintenance

• Updated PhpStorm meta-files (#5669)
• [Rss] Fix SettCustomer (#5613)
• Api2: cleanup getNode (#5607)
• Varien_Data_Collection_Db: fix type for _map property (#5606)
• Varien Gd2: fix isset check (#5605)
• phpStan: fix instanceof.alwaysTrue (#5603)
• phpStan: fix class.nameCase (#5602)
• jQuery: downgrade back to v3.7 (#5600)
• Updated workflow (#5599)
• rector: add return type to _isAllowed acl check (#5351) (#5579)

↗️ Dependencies

• build(deps): bump symfony/polyfill-php85 from 1.41.0 to 1.43.0 (#5793)
• build(deps): bump mklkj/tinymce-i18n from 26.8.2 to 26.9.28 (#5791)
• build(deps-dev): bump rector/rector from 2.6.3 to 2.6.6 (#5762)
• build(deps): bump ezyang/htmlpurifier from 4.19.0 to 4.19.1 (#5784)
• build(deps): bump symfony/polyfill-php83 from 1.41.0 to 1.43.0 (#5785)
• build(deps-dev): bump symplify/easy-coding-standard from 13.3.2 to 13.3.3 (#5786)
• build(deps-dev): bump phpstan/phpstan from 2.2.13 to 2.2.15 (#5778)
• build(deps): bump monolog/monolog from 3.12.0 to 3.12.1 (#5781)
• build(deps): bump tinymce/tinymce from 8.9.1 to 8.9.2 (#5780)
• build(deps-dev): bump friendsofphp/php-cs-fixer from 3.95.25 to 3.95.27 (#5777)
• build(deps-dev): bump symplify/easy-coding-standard from 13.2.19 to 13.3.2 (#5779)
• build(deps): bump tinymce/tinymce from 8.8.2 to 8.9.1 (#5772)
• build(deps): bump monolog/monolog from 3.11.0 to 3.12.0 (#5771)
• build(deps-dev): bump friendsofphp/php-cs-fixer from 3.95.24 to 3.95.25 (#5773)
• build(deps-dev): bump friendsofphp/php-cs-fixer from 3.95.23 to 3.95.24 (#5763)
• build(deps): bump monolog/monolog from 3.10.0 to 3.11.0 (#5764)
• build(deps-dev): bump phpstan/phpstan from 2.2.10 to 2.2.13 (#5765)
• build(deps-dev): bump friendsofphp/php-cs-fixer from 3.95.20 to 3.95.23 (#5754)
• build(deps): bump vlucas/phpdotenv from 5.6.4 to 5.7.0 (#5753)
• build(deps-dev): bump phpstan/phpstan-deprecation-rules from 2.0.4 to 2.0.5 (#5752)
• build(deps-dev): bump symplify/easy-coding-standard from 13.2.3 to 13.2.19 (#5755)
• build(deps): bump mklkj/tinymce-i18n from 26.7.14 to 26.8.2 (#5745)
• build(deps-dev): bump friendsofphp/php-cs-fixer from 3.95.13 to 3.95.20 (#5744)
• build(deps-dev): bump rector/rector from 2.6.2 to 2.6.3 (#5743)
• build(deps-dev): bump rector/rector from 2.5.8 to 2.6.2 (#5732)
• build(deps): bump rojopolis/spellcheck-github-actions from 0.64.0 to 0.66.0 (#5733)
• build(deps): bump symfony/polyfill-php85 from 1.38.1 to 1.41.0 (#5731)
• build(deps): bump symfony/polyfill-php83 from 1.38.2 to 1.41.0 (#5730)
• build(deps): bump phpseclib/phpseclib from 3.0.55 to 3.0.56 (#5724)
• build(deps-dev): bump phpstan/phpstan from 2.2.5 to 2.2.7 (#5716)
• build(deps-dev): bump rector/rector from 2.4.4 to 2.5.2 (#5650)
• build(deps-dev): bump squizlabs/php_codesniffer from 3.13.5 to 3.13.6 (#5721)
• build(deps): bump guzzlehttp/guzzle from 7.15.1 to 7.15.2 (#5719)
• build(deps): bump rojopolis/spellcheck-github-actions from 0.63.0 to 0.64.0 (#5718)
• build(deps): bump tinymce/tinymce from 8.7.0 to 8.8.2 (#5717)
• build(deps): bump actions/setup-python from 6 to 7 (#5703)
• build(deps): bump empiricompany/openmage_ignition from 1.5.2 to 1.5.3 (#5704)
• build(deps): bump vlucas/phpdotenv from 5.6.3 to 5.6.4 (#5705)
• build(deps-dev): bump composer/composer from 2.2.28 to 2.2.29 (#5697)
• build(deps): bump guzzlehttp/guzzle from 7.12.1 to 7.15.1 (#5698)
• build(deps-dev): bump phpstan/phpstan-strict-rules from 2.0.11 to 2.0.12 (#5695)
• build(deps): bump mklkj/tinymce-i18n from 26.6.8 to 26.7.14 (#5693)
• build(deps): bump tinymce/tinymce from 8.6.0 to 8.7.0 (#5682)
• build(deps-dev): bump friendsofphp/php-cs-fixer from 3.95.10 to 3.95.13 (#5683)
• build(deps-dev): bump phpstan/phpstan-phpunit from 2.0.16 to 2.0.18 (#5672)
• build(deps): bump mklkj/tinymce-i18n from 26.5.18 to 26.6.8 (#5664)
• build(deps): bump rojopolis/spellcheck-github-actions from 0.62.0 to 0.63.0 (#5671)
• build(deps): bump actions/cache from 5 to 6 (#5665)
• build(deps): bump tinymce/tinymce from 8.5.1 to 8.6.0 (#5666)
• build(deps): bump symfony/translation-contracts from 3.7.0 to 3.7.1 (#5667)
• build(deps-dev): bump phpstan/phpstan from 2.2.1 to 2.2.2 (#5640)
• build(deps-dev): bump symplify/easy-coding-standard from 13.2.2 to 13.2.3 (#5652)
• build(deps-dev): bump friendsofphp/php-cs-fixer from 3.95.4 to 3.95.10 (#5651)
• build(deps): bump actions/checkout from 6 to 7 (#5648)
• build(deps): bump rojopolis/spellcheck-github-actions from 0.61.0 to 0.62.0 (#5649)
• Security: update guzzlehttp to 7.12.1 (#5653)
• build(deps-dev): bump symplify/easy-coding-standard from 13.1.5 to 13.2.2 (#5642)
• build(deps): bump rojopolis/spellcheck-github-actions from 0.60.0 to 0.61.0 (#5641)
• build(deps): bump symfony/polyfill-php83 from 1.38.1 to 1.38.2 (#5643)
• build(deps): bump phpseclib/phpseclib from 3.0.52 to 3.0.55 (#5644)
• build(deps): bump guzzlehttp/psr7 from 2.9.0 to 2.11.0 (#5636)
• build(deps-dev): bump friendsofphp/php-cs-fixer from 3.95.2 to 3.95.4 (#5631)
• build(deps-dev): bump symplify/vendor-patches from 12.0.1 to 12.1.1 (#5630)
• build(deps-dev): bump symplify/easy-coding-standard from 13.1.3 to 13.1.5 (#5632)
• build(deps): bump symfony/polyfill-php85 from 1.37.0 to 1.38.1 (#5633)
• build(deps): bump symfony/polyfill-php82 from 1.37.0 to 1.38.1 (#5618)
• build(deps): bump symfony/polyfill-php83 from 1.37.0 to 1.38.1 (#5616)
• build(deps): bump symfony/polyfill-php84 from 1.37.0 to 1.38.1 (#5617)
• build(deps-dev): bump phpstan/phpstan from 2.1.55 to 2.2.1 (#5619)
• build(deps-dev): bump rector/rector from 2.4.2 to 2.4.4 (#5590)
• build(deps): bump tinymce/tinymce from 8.5.0 to 8.5.1 (#5597)
• build(deps): bump mklkj/tinymce-i18n from 26.4.7 to 26.5.18 (#5596)
• build(deps-dev): bump phpstan/phpstan from 2.1.54 to 2.1.55 (#5595)
• dependency: symfony/mime v6.4.40 (#5598)
• build(deps): bump components/jquery from 3.7.1 to 4.0.0 (#5591)
• build(deps-dev): bump perftools/php-profiler from 1.4.0 to 1.4.2 (#5589)
• build(deps-dev): bump friendsofphp/php-cs-fixer from 3.95.1 to 3.95.2 (#5592)
• build(deps-dev): bump composer/composer from 2.2.27 to 2.2.28 (#5593)
• build(deps-dev): bump dealerdirect/phpcodesniffer-composer-installer from 1.2.0 to 1.2.1 (#5581)
• build(deps): bump openmage/composer-plugin from 3.1.0 to 3.2.0 (#5583)
• build(deps-dev): bump perftools/php-profiler from 1.2.0 to 1.4.0 (#5584)
• build(deps): bump symfony/translation-contracts from 3.6.1 to 3.7.0 (#5582)
• build(deps-dev): bump symplify/easy-coding-standard from 13.1.2 to 13.1.3 (#5580)

@alexh-swdev, @B3Hana, @Caprico85, @colinmollenhour, @Hanmac, @kasper-agg, @loekvangool, @mattdavenport, @philipsorensen, @schmite, @sreichel, @theroch, @wild82pl, @xqiu, @allcontributors[bot], @copilot-swe-agent[bot], @dependabot[bot], @github-actions[bot], @addison74, @claude, @Copilot, Frank Rochlitzer, @Judx, Matt Davenport, @michalszdeligo and Rob Agnese