Error regarding security risk.

[philip56]

I have been trying to solve a problem relating to my site loosing its shared ssl state as I move through it. I was trying some changes to includes/configure.php based on replies to graphicsgirl's post of 19th August.

I then got the following error :- "Warning I am able to write to the configuration file var/www/html/oscommerce/includes/configure.php". After returning the file to it's original state, the error remains.

 

This is the current state of includes/configure.php

<?php

/*

osCommerce, Open Source E-Commerce Solutions

http://www.oscommerce.com

 

Copyright © 2003 osCommerce

 

Released under the GNU General Public License

*/

 

// Define the webserver and path parameters

// * DIR_FS_* = Filesystem directories (local/physical)

// * DIR_WS_* = Webserver directories (virtual/URL)

define('HTTP_SERVER', 'http://www.mysite.co.uk'); // eg, http://localhost - should not be empty for productive servers

define('HTTPS_SERVER', 'https://www.mysite.co.uk'); // eg, https://localhost - should not be empty for productive servers

define('ENABLE_SSL', true); // secure webserver for checkout procedure?

define('HTTP_COOKIE_DOMAIN', 'www.mysite.co.uk');

define('HTTPS_COOKIE_DOMAIN', 'www.mysite.co.uk'); ****This is the only line I changed****

define('HTTP_COOKIE_PATH', '/oscommerce');

define('HTTPS_COOKIE_PATH', '/oscommerce');

define('DIR_WS_HTTP_CATALOG', '/oscommerce/');

define('DIR_WS_HTTPS_CATALOG', '/oscommerce/');

define('DIR_WS_IMAGES', 'images/');

define('DIR_WS_ICONS', DIR_WS_IMAGES . 'icons/');

define('DIR_WS_INCLUDES', 'includes/');

define('DIR_WS_BOXES', DIR_WS_INCLUDES . 'boxes/');

define('DIR_WS_FUNCTIONS', DIR_WS_INCLUDES . 'functions/');

define('DIR_WS_CLASSES', DIR_WS_INCLUDES . 'classes/');

define('DIR_WS_MODULES', DIR_WS_INCLUDES . 'modules/');

define('DIR_WS_LANGUAGES', DIR_WS_INCLUDES . 'languages/');

 

define('DIR_WS_DOWNLOAD_PUBLIC', 'pub/');

define('DIR_FS_CATALOG', '/var/www/html/oscommerce/');

define('DIR_FS_DOWNLOAD', DIR_FS_CATALOG . 'download/');

define('DIR_FS_DOWNLOAD_PUBLIC', DIR_FS_CATALOG . 'pub/');

 

// define our database connection

define('DB_SERVER', 'localhost'); // eg, localhost - should not be empty for productive servers

define('DB_SERVER_USERNAME', 'my username');

define('DB_SERVER_PASSWORD', 'password');

define('DB_DATABASE', 'mysite_co_uk_-_oscommerce');

define('USE_PCONNECT', 'false'); // use persistent connections?

define('STORE_SESSIONS', 'mysql'); // leave empty '' for default handler or set to 'mysql'

?>

 

I hope somone can help as this is a pretty serious problem

 

Regards,

 

Philip

[♥Vger]

The error message relates to the fact that the configure.php file has the wrong permissions set on it - it should not be writeable. It has nothing directly to do with what is in the file.

 

You need to go to the File Manager in your web hosting control panel (not your osC panel) and use it to set the permissions on that file to 644 - and if that does not remove the message then 444 or even 400 (varies according to the server type your site is on).

 

Vger

[philip56]

The error message relates to the fact that the configure.php file has the wrong permissions set on it - it should not be writeable. It has nothing directly to do with what is in the file.

 

You need to go to the File Manager in your web hosting control panel (not your osC panel) and use it to set the permissions on that file to 644 - and if that does not remove the message then 444 or even 400 (varies according to the server type your site is on).

 

Vger

 

Thanks Vger (again!)

 

I've looked where you said and I can't see an option to change the permissions numerically, only read, write and execute. So I will get on to my Hosting company for their advice. When I get this sorted, I can hopefully get back to the original problem!

 

Regards

 

Philip

[AlanR]

Thanks Vger (again!)

 

I've looked where you said and I can't see an option to change the permissions numerically, only read, write and execute.

 

Same thing.

 

This can help you understand the system:

 

http://ninjasuit.com/scripts/script.php?script_id=63

[philip56]

Same thing.

 

This can help you understand the system:

 

http://ninjasuit.com/scripts/script.php?script_id=63

 

Thanks. That was very useful. I've set the permissions to 644 but it has'nt made any difference. (My hosting company have told me to do it via an FTP client by the way). In addition, I have just discovered that if I try to log in to the my site as a customer, I get the page not founf error for login.php. Is this connected?

 

Philip

[AlanR]

Thanks. That was very useful. I've set the permissions to 644 but it has'nt made any difference. (My hosting company have told me to do it via an FTP client by the way). In addition, I have just discovered that if I try to log in to the my site as a customer, I get the page not founf error for login.php. Is this connected?

 

Philip

 

1) Keep dropping the permissions till it works but don't go below 400.

 

2) Make sure that this line in configure.php

 

define('ENABLE_SSL', false); // secure webserver for checkout procedure?

 

is set to false. Your log in problem usually means that it's set to true but you don't have a valid ssl link.

[philip56]

1) Keep dropping the permissions till it works but don't go below 400.

 

2) Make sure that this line in configure.php

 

define('ENABLE_SSL', false); // secure webserver for checkout procedure?

 

is set to false. Your log in problem usually means that it's set to true but you don't have a valid ssl link.

 

 

Thanks Alan,

 

I just waiting to hear back form the hosting company, who are investing whats going on with the shared SSL.

Then I give your suggestions a try

 

Philip

[vaibhav]

hi I had same probs as you.

I changed my permission to 555 that is read and execute only. worked fine for me.

Also SSL certificate you would have to buy from your host. It will keep giving u errors unless u buy one or dont use it at all.

[philip56]

hi I had same probs as you.

I changed my permission to 555 that is read and execute only. worked fine for me.

Also SSL certificate you would have to buy from your host. It will keep giving u errors unless u buy one or dont use it at all.

 

Thanks for that. I have discovered that if I modify configure.php and upload it, the permissions are reset to 644, and the error is generated. I just have to remember to reset them!

 

Philip