One security patch, five stores, one day

Situation

An emergency patch from Adobe, and a lesson a month later

In September Adobe published an emergency security patch for a critical Magento vulnerability. Every Magento store we look after needed it, and needed it quickly, without anything else changing.

We applied it to each store that week: tested on our own copy of the store first, then released. So far, so routine.

What we found

The patch was fine. The way patches are commonly applied was not.

A month later one store’s build failed with an error nobody had seen before. The patch itself was correct. The script that applied it ran every time the store’s code was installed, and one part of the patch could be applied twice without complaint. Each install added the same line again, until Magento refused to start.

The failure happened on our copy of the store, not the live one, which is the point of having a copy.

What we did

Apply each patch exactly once, everywhere

• A patch script that remembers Each patch is recorded as applied, per file, and left alone on the next install. A patch that only half-applies is rolled back rather than left in place.
• The same script on every store The fix went on every other store we look after before any of them hit the problem, not just the one that failed.
• October’s patch as the test When Adobe’s monthly patch came out, it went on five stores in a day using the new script, each one tested on our copy and then released.

Result

Patched, and still patched after the next deployment

Two things we took from it. “Patched” is not the end of the job: the patch has to survive the next deployment too. And a problem found on one store should be fixed on all of them.

Worth checking on your store

Two questions for whoever looks after it

• Which Adobe security patch is your store on, and when was it applied? The answer should be a date, not “recently”.
• Is the patch applied by a script that runs on every deployment? If so, what stops it applying twice?