Security again! Just can't find the answer

[Chrissie]

OK. Sorry to raise an old problem but I've searched all the forums and can't find the answer to this .. and I'm almost ready to go live!

 

Here's what happens (bear with me cos I will try to explain fully!) This is using SSL by the way.

 

When I log onto "Admin", I have to put in user name and password (as I would expect) ... but when I click on a link, I have to put it in again. (I can live with that!). Once in Admin, images are broken cos they are not found on the secure server. (I can live with that ... if I have to!). If I change the images directory in Admin/configure to the catalog images directory, I get that old "this page contains secure and nonsecure items" thing which is a real pain when you are adding product images.

 

More of a concern is ... if I log into my site as a customer, it's fine, but as soon as I add something to the cart and go to checkout ... I have to log in again. I don't think that would please customers!

 

Clearly there is something wrong with the one (or both) configure.php files. Can someone please have a look and tell me where to make the necessary changes (in simple terms please!)? I will, as always, be very grateful for any help.

 

Here is the code for the two files (obviously, with the sensitive stuff removed by asterisks)

 

 

Admin/includes/configure.php

 

<?php
/*
 osCommerce, Open Source E-Commerce Solutions
 [url="http://www.oscommerce.com"]http://www.oscommerce.com[/url]

 Copyright © 2003 osCommerce

 Released under the GNU General Public License
*/

// Define the webserver and path parameters
// * DIR_FS_* = Filesystem directories (local/physical)
// * DIR_WS_* = Webserver directories (virtual/URL)
 define('HTTP_SERVER', 'https://********.co.uk/~******'); // eg, [url="http://localhost"]http://localhost[/url] - should not be empty for productive servers
 define('HTTP_CATALOG_SERVER', 'http://www.******.co.uk');
 define('HTTPS_CATALOG_SERVER', 'https://******.co.uk/~******');
 define('ENABLE_SSL_CATALOG', 'true'); // secure webserver for catalog module
 define('DIR_FS_DOCUMENT_ROOT', '/home/******/public_html/catalog/'); // where the pages are located on the server
 define('DIR_WS_ADMIN', '/catalog/admin/'); // absolute path required
 define('DIR_FS_ADMIN', '/home/******/public_html/catalog/admin/'); // absolute pate required
 define('DIR_WS_CATALOG', '/catalog/'); // absolute path required
 define('DIR_FS_CATALOG', '/home/******/public_html/catalog/'); // absolute path required
 define('DIR_WS_IMAGES', 'images/');
 define('DIR_WS_ICONS', DIR_WS_IMAGES . 'icons/');
 define('DIR_WS_CATALOG_IMAGES', DIR_WS_CATALOG . 'images/');
 define('DIR_WS_INCLUDES', 'includes/');
 define('DIR_WS_BOXES', DIR_WS_INCLUDES . 'boxes/');
 define('DIR_WS_FUNCTIONS', DIR_WS_INCLUDES . 'functions/');
 define('DIR_WS_CLASSES', DIR_WS_INCLUDES . 'classes/');
 define('DIR_WS_MODULES', DIR_WS_INCLUDES . 'modules/');
 define('DIR_WS_LANGUAGES', DIR_WS_INCLUDES . 'languages/');
 define('DIR_WS_CATALOG_LANGUAGES', DIR_WS_CATALOG . 'includes/languages/');
 define('DIR_FS_CATALOG_LANGUAGES', DIR_FS_CATALOG . 'includes/languages/');
 define('DIR_FS_CATALOG_IMAGES', DIR_FS_CATALOG . 'images/');
 define('DIR_FS_CATALOG_MODULES', DIR_FS_CATALOG . 'includes/modules/');
 define('DIR_FS_BACKUP', DIR_FS_ADMIN . 'backups/');

// define our database connection
 define('DB_SERVER', 'localhost'); // eg, localhost - should not be empty for productive servers
 define('DB_SERVER_USERNAME', '******_******');
 define('DB_SERVER_PASSWORD', '******');
 define('DB_DATABASE', '******_******');
 define('USE_PCONNECT', 'false'); // use persisstent connections?
 define('STORE_SESSIONS', 'mysql'); // leave empty '' for default handler or set to 'mysql'
?>

 

 

catalog/includes/configure.php

 

<?php
/*
 osCommerce, Open Source E-Commerce Solutions
 [url="http://www.oscommerce.com"]http://www.oscommerce.com[/url]

 Copyright © 2003 osCommerce

 Released under the GNU General Public License
*/

// Define the webserver and path parameters
// * DIR_FS_* = Filesystem directories (local/physical)
// * DIR_WS_* = Webserver directories (virtual/URL)
 define('HTTP_SERVER', 'http://www.******.co.uk'); // eg, [url="http://localhost"]http://localhost[/url] - should not be empty for productive servers
 define('HTTPS_SERVER', 'https://******.co.uk/~******'); // eg, [url="https://localhost"]https://localhost[/url] - should not be empty for productive servers
 define('ENABLE_SSL', true); // secure webserver for checkout procedure?
 define('HTTP_COOKIE_DOMAIN', '******.co.uk');
 define('HTTPS_COOKIE_DOMAIN', '******.co.uk');
 define('HTTP_COOKIE_PATH', '/catalog/');
 define('HTTPS_COOKIE_PATH', '/catalog/');
 define('DIR_WS_HTTP_CATALOG', '/catalog/');
 define('DIR_WS_HTTPS_CATALOG', '/catalog/');
 define('DIR_WS_IMAGES', 'images/');
 define('DIR_WS_ICONS', 'http://www.******.co.uk/catalog/includes/languages/english/images/');
 define('DIR_WS_INCLUDES', 'includes/');
 define('DIR_WS_BOXES', DIR_WS_INCLUDES . 'boxes/');
 define('DIR_WS_FUNCTIONS', DIR_WS_INCLUDES . 'functions/');
 define('DIR_WS_CLASSES', DIR_WS_INCLUDES . 'classes/');
 define('DIR_WS_MODULES', DIR_WS_INCLUDES . 'modules/');
 define('DIR_WS_LANGUAGES', DIR_WS_INCLUDES . 'languages/');

 define('DIR_WS_DOWNLOAD_PUBLIC', 'pub/');
 define('DIR_FS_CATALOG', '/home/******/public_html/catalog/');
 define('DIR_FS_DOWNLOAD', DIR_FS_CATALOG . 'download/');
 define('DIR_FS_DOWNLOAD_PUBLIC', DIR_FS_CATALOG . 'pub/');

// define our database connection
 define('DB_SERVER', 'localhost'); // eg, localhost - should not be empty for productive servers
 define('DB_SERVER_USERNAME', '******_******');
 define('DB_SERVER_PASSWORD', '******');
 define('DB_DATABASE', '******_******');
 define('USE_PCONNECT', 'false'); // use persistent connections?
 define('STORE_SESSIONS', 'mysql'); // leave empty '' for default handler or set to 'mysql'
?>

 

Thanks for looking and any help would be really appreciated. It seems from the forum searches that I am not the only one having this type of problem ... I need a clever person to help!

 

Chrissie xx

[Chrissie]

Looks like I've asked a sticky question! Sorry, everyone! I've had several people saying they have a similar problem. If nobody knows the answer, could anybody please point me in the right to direction to start looking again? I'm really stumped by this one and it's stopping me going live so I apologise for pestering for help.

 

Any guidance at all would be very much appreciated.

 

Chrissie.

 

xx

[Jack_mcs]

I'm not really sure what the question is. Perhaps just askingit straight out would help. In any event. youshould have your username in these urls

  define('HTTP_SERVER', 'https://********.co.uk/~******'); // eg, http://localhost - should not be empty for productive servers  define('HTTPS_CATALOG_SERVER', 'https://******.co.uk/~******');

 

Jack

[Chrissie]

I'm not really sure what the question is. Perhaps just askingit straight out would help. In any event. youshould have your username in these urls

  define('HTTP_SERVER', 'https://********.co.uk/~******'); // eg, http://localhost - should not be empty for productive servers  define('HTTPS_CATALOG_SERVER', 'https://******.co.uk/~******');

 

Jack

 

Thanks for helping me out again Jack. Sorry if I did't make it clear ... I tried to give a comprehensive view of my problems. Can you please tell me what username you are referring to and where it should go exactly.

 

Thanks again.

 

Chrissie.

 

xx

[Jack_mcs]

This part

~******

is the username. It may be required for the secure server url if you are using a shared ssl, but not for the main one (the first one).

 

Jack

[Chrissie]

This part

~******

is the username. It may be required for the secure server url if you are using a shared ssl, but not for the main one (the first one).

 

Jack

 

Thanks Jack. In that the case the user name is correct and in the locations tou mention. I still have the problems mentioned in my first post though, namely images not appearing in admin and customer having to log-in twice. Any help would be appreciated or examples from somebody of their two config files that work ok.

 

Many thanks

Chrissie xx

[Guest]

Thanks Jack. In that the case the user name is correct and in the locations tou mention. I still have the problems mentioned in my first post though, namely images not appearing in admin and customer having to log-in twice. Any help would be appreciated or examples from somebody of their two config files that work ok.

 

Many thanks

Chrissie xx

Chrissie,

Are you using a shared SSL certificate for your https pages? Do you have your http admin pages PW protected? When you first log in to Admin, is it though an https page? When you go to any other Admin page after logging in, do you go to an http page? If so, that's probably why you have to enter the UN and PW twice. If you change the path for the http pages in Admin so it is https that should eliminate the double login. To solve the image issue, I'd take another look at the path to the image folder. Are you on a shared server?

[Chrissie]

Chrissie,

Are you using a shared SSL certificate for your https pages? Do you have your http admin pages PW protected? When you first log in to Admin, is it though an https page? When you go to any other Admin page after logging in, do you go to an http page? If so, that's probably why you have to enter the UN and PW twice. If you change the path for the http pages in Admin so it is https that should eliminate the double login. To solve the image issue, I'd take another look at the path to the image folder. Are you on a shared server?

 

Thanks for taking a look baddog. Sorry if I am being a bit stupid here!

 

Yes, I am on a shared server and using a shared SSL certificate (although I will buy a certificate as soon as I am ready to go live). The admin folder is password protected. I think I understand some of what you say. If I log onto admin using the secured URL then I do only have to log-in as Admin once - I really should have thought of that, so thanks. However, if I change (in admin/includes/configure) the line

 

define('HTTP_CATALOG_SERVER', 'http://www.mysite.co.uk');

 

to

 

define('HTTP_CATALOG_SERVER', 'https://secure_url~username'); (in other words to match the HTTPS_CATALOG_SERVER on the next line down)

 

as I think you are suggesting, I still have to login as a customer as I would expect but if I go to the home page (or any other not on SSL) and then go to checkout, I have to log in (as the customer) again. I think this will put people off.

 

As for the images which dont show in admin, the path is pointing to the images (or icon) directory on the secure URL and not finding them. If I change the images reference to the non-secure url, I then get the messgae about secure and non-secure items on every page change (although the images do show up).

 

Sorry to be a real pain but could you please have a look at my code at the top of this post and show me what changes you suggest I should make and where because I am getting a bit confused.

 

I would be so grateful and thank you so much for taking the trouble to help so far.

 

Chrissie

xx

[Guest]

Thanks for taking a look baddog. Sorry if I am being a bit stupid here!

 

Yes, I am on a shared server and using a shared SSL certificate (although I will buy a certificate as soon as I am ready to go live). The admin folder is password protected. I think I understand some of what you say. If I log onto admin using the secured URL then I do only have to log-in as Admin once - I really should have thought of that, so thanks. However, if I change (in admin/includes/configure) the line

 

define('HTTP_CATALOG_SERVER', 'http://www.mysite.co.uk');

 

to

 

define('HTTP_CATALOG_SERVER', 'https://secure_url~username'); (in other words to match the HTTPS_CATALOG_SERVER on the next line down)

 

as I think you are suggesting, I still have to login as a customer as I would expect but if I go to the home page (or any other not on SSL) and then go to checkout, I have to log in (as the customer) again. I think this will put people off.

 

As for the images which dont show in admin, the path is pointing to the images (or icon) directory on the secure URL and not finding them. If I change the images reference to the non-secure url, I then get the messgae about secure and non-secure items on every page change (although the images do show up).

 

Sorry to be a real pain but could you please have a look at my code at the top of this post and show me what changes you suggest I should make and where because I am getting a bit confused.

 

I would be so grateful and thank you so much for taking the trouble to help so far.

 

Chrissie

xx

Chrissie,

If you plan on getting your own certificate when you go live, I would get it now and configure the shop accordingly (and test it that way) rather than waiting and trying to switch over when or just before you go live. Might avoid some headaches that way.

[Chrissie]

If you plan on getting your own certificate when you go live, I would get it now and configure the shop accordingly (and test it that way) rather than waiting and trying to switch over when or just before you go live. Might avoid some headaches that way.

 

Thanks for the advice, baddog. I would like to have got things working before spending the money on a certificate and going live but I appreciate that what you are saying makes a lot of sense. My host will install the certificate and make changes to the configure files so, hopefully, that will solve my problems.

 

Thanks again for assistance and advice.

 

Chrissie

xx