Manual Configuration and security warning?

[GregV]

Is it possible to configure OSCommerce 2.2 MS2 manually? I found the 2 configuration files for catalog and admin and I've made adjustments to both. I had to attempt manually since I was getting an import error for the database sql script oscommerce.sql. I loaded that manually through the mysql admin tool.

 

Now... I don't appear to be having any problems with the site now other than SSL. The pages do hop to https but the browser does not display the lock or go ssl. I have the same problem in admin console - so I'm guessing I have a slight configuration problem.

 

// Define the webserver and path parameters
// * DIR_FS_* = Filesystem directories (local/physical)
// * DIR_WS_* = Webserver directories (virtual/URL)
 define('HTTP_SERVER', 'http://www.manifoldstore.com/'); // eg, http://localhost - should not be empty for productive servers
 define('HTTPS_SERVER', 'https://www.manifoldstore.com/'); // eg, https://localhost - should not be empty for productive servers
 define('ENABLE_SSL', true); // secure webserver for checkout procedure?
 define('HTTP_COOKIE_DOMAIN', 'manifoldstore.com');
 define('HTTPS_COOKIE_DOMAIN', 'manifoldstore.com');
 define('HTTP_COOKIE_PATH', '/');
 define('HTTPS_COOKIE_PATH', '/');
 define('DIR_WS_HTTP_CATALOG', 'catalog/');
 define('DIR_WS_HTTPS_CATALOG', 'catalog/');
 define('DIR_WS_IMAGES', 'images/');
 define('DIR_WS_ICONS', DIR_WS_IMAGES . 'icons/');
 define('DIR_WS_INCLUDES', 'includes/');
 define('DIR_WS_BOXES', DIR_WS_INCLUDES . 'boxes/');
 define('DIR_WS_FUNCTIONS', DIR_WS_INCLUDES . 'functions/');
 define('DIR_WS_CLASSES', DIR_WS_INCLUDES . 'classes/');
 define('DIR_WS_MODULES', DIR_WS_INCLUDES . 'modules/');
 define('DIR_WS_LANGUAGES', DIR_WS_INCLUDES . 'languages/');

 define('DIR_WS_DOWNLOAD_PUBLIC', 'pub/');
 define('DIR_FS_CATALOG', dirname($HTTP_SERVER_VARS['SCRIPT_FILENAME']));
 define('DIR_FS_DOWNLOAD', DIR_FS_CATALOG . 'download/');
 define('DIR_FS_DOWNLOAD_PUBLIC', DIR_FS_CATALOG . 'pub/');

 

 

 

Also, I'm using godaddy.com as a host and having a hell of a time with file permissions as well as directory permissions. Both appear to be on or off. No inbetweens. I'm getting the pink notice banner includes/configure.php. This is a potential security risk - please set the right user permissions on this file. Now, I've gone in and changed the directory to read, web only but it still appears. godaddy.com uses a hosting manager to control these settings and is not very robust. I'm wondering if anyone has used godaddy.com successfully and how they might have oscommerce setup.

 

With that as well, i'm having to disable the admin directory and re-enable it to make it secure - is there a plugin around the admin control panel that would resolve this so I don't have to worry about directory user security permissions?

 

Thanks!

[GregV]

One thing to note. The server is windows based and doesn't take chmod commands.

[Butch_US]

One thing to note. The server is windows based and doesn't take chmod commands.

 

 

Hi,

 

This is the catalog / includes / configure.php

and works on an Windows server

 

 

<?php

// Please, note that all changes in this file will be lost

// after reconfiguring application by Plesk

define('HTTP_SERVER', 'http://your_domain.com');

define('HTTPS_SERVER', 'http://your_domain.com');

define('ENABLE_SSL', 'false');

define('HTTP_COOKIE_DOMAIN', 'http://your_domain.com');

define('HTTPS_COOKIE_DOMAIN', 'http://your_domain.com');

define('HTTP_COOKIE_PATH', '/shop/');

define('DIR_WS_HTTP_CATALOG', '/shop/');

define('DIR_WS_HTTPS_CATALOG', '/shop/');

define('DIR_WS_IMAGES', 'images/');

define('DIR_WS_ICONS', DIR_WS_IMAGES . 'icons/');

define('DIR_WS_INCLUDES', 'includes/');

define('DIR_WS_BOXES', DIR_WS_INCLUDES . 'boxes/');

define('DIR_WS_FUNCTIONS', DIR_WS_INCLUDES . 'functions/');

define('DIR_WS_CLASSES', DIR_WS_INCLUDES . 'classes/');

define('DIR_WS_MODULES', DIR_WS_INCLUDES . 'modules/');

define('DIR_WS_LANGUAGES', DIR_WS_INCLUDES . 'languages/');

 

define('DIR_WS_DOWNLOAD_PUBLIC', 'pub/');

define('DIR_FS_CATALOG', 'D:/clients/http://your_domain.com/httpdocs/shop/');

define('DIR_FS_DOWNLOAD', DIR_FS_CATALOG . 'download/');

define('DIR_FS_DOWNLOAD_PUBLIC', DIR_FS_CATALOG . 'pub/');

 

// define our database connection

 

define('DB_SERVER', 'localhost:3306');

define('DB_SERVER_USERNAME', 'your username');

define('DB_SERVER_PASSWORD', 'your password');

define('DB_DATABASE', 'your database_name');

define('USE_PCONNECT', 'false');

define('STORE_SESSIONS', 'mysql');

?>

 

maybe it's a help

 

RTC

Butch

[♥Vger]

Please ignore the references to the cookie_domain in the last post because they are wrong. The cookie domain must be a domain and not a url - which is what they become when you add http or https to them.

 

define('HTTP_SERVER', 'http://www.manifoldstore.com');

define('HTTPS_SERVER', 'https://www.manifoldstore.com');define('ENABLE_SSL', true); // secure webserver for checkout procedure?

define('HTTP_COOKIE_DOMAIN', 'www.manifoldstore.com');

define('HTTPS_COOKIE_DOMAIN', 'www.manifoldstore.com');

define('HTTP_COOKIE_PATH', '/catalog');

define('HTTPS_COOKIE_PATH', '/catalog');

define('DIR_WS_HTTP_CATALOG', '/catalog/');

define('DIR_WS_HTTPS_CATALOG', '/catalog/');

 

Those settings should work provided you have a full ssl certificate. If they don't then it's probably something to do with your hosting. If you are hosted with 1and1 for instance then you need to search these forums for posts about 1and1.

 

Vger

[GregV]

Thanks all :) I'll give this configuration a try.

 

I got a pretty useless response from godaddy.com on file security and I'm still looking for a good answer on that front. I'm probably going to have to move the site somewhere else since they're not a very good hosting company at all.

 

Any good hosting companies that are recommendable?