Fixing extensions after SUPEE-6788

If you applied the SUPEE-6788 security patch to a Magento 1 store and half of your extensions suddenly stopped working, you are not alone. The patch closes some real security holes, but in doing so it changes a few behaviours that a lot of third party modules were relying on. These are the issues I ran into and how I fixed them.

1. Admin controllers must live under the adminhtml router

This is by far the most common one (APPSEC-1063). Before the patch, extensions could declare admin controllers under their own frontend router. After it, admin controllers must be reached through the adminhtml router.

The fix is to move the controller and update its routing. In config.xml, the admin route moves from <admin><routers> to <adminhtml><args><modules>:

<!-- app/code/community/Vendor/Module/etc/config.xml -->
<adminhtml>
    <args>
        <modules>
            <Vendor_Module before="Mage_Adminhtml">Vendor_Module_Adminhtml</Vendor_Module>
        </modules>
    </args>
</adminhtml>

Then move the controller file from controllers/Adminhtml/ and adjust its class name/namespace accordingly. Magento even ships a tool, shell/rewrites.php, that lists the controllers that need moving.

2. Block name whitelist

The patch introduced a whitelist for blocks that can be instantiated from layout updates and CMS content (APPSEC-1057). If your extension (or a CMS block) references a block that is not whitelisted, it silently stops rendering.

You whitelist it by adding a row to the permission_block table, or through the admin under System > Permissions > Blocks, setting your block to Allowed.

3. Variable and directive whitelist

Custom variables and {{block}} directives used in CMS pages, static blocks and email templates are also restricted now. If a template stops resolving a directive, add the variable to System > Permissions > Variables, or insert the allowed path into the admin_directive / core_variable whitelist.

Once you know these three, most “my extension broke after the patch” tickets resolve in minutes. The patch is worth applying, do not let a couple of compatibility fixes talk you out of it.

Hope this helps.

If you have any question or ran into a different issue, feel free to share in the comments below.