Security Issues After Installation

[guyzys]

I've decided to start fresh on a hosted online server.

 

After installing I encounter these 2 security issues:

 

1. I'm still receiving this message: "Warning: I am able to write to the configuration file: ***/catalog/includes/configure.php. This is a potential security risk - please set the right user permissions on this file."

 

I tried changing the permissions to both 644 and 444, yet I still get this message.

 

2. I have set the ../catalog/admin/ folder as protected(.htaccess) and set a user name and password. Where should I be prompted for the credentials, since it seems like I can easily go into the admin panel without entering anything.

[web-project]

1. I'm still receiving this message: "Warning: I am able to write to the configuration file: ***/catalog/includes/configure.php. This is a potential security risk - please set the right user permissions on this file."

 

I tried changing the permissions to both 644 and 444, yet I still get this message.

 

some php configurations on webhosts for some reason ignore the permission (chmod) mask, in this case you need edit the following file /shop/public_html/includes/header.php

 

find:

// check if the configure.php file is writeable
 if (WARN_CONFIG_WRITEABLE == 'true') {
if ( (file_exists(dirname($HTTP_SERVER_VARS['SCRIPT_FILENAME']) . '/includes/configure.php')) && (is_writeable(dirname($HTTP_SERVER_VARS['SCRIPT_FILENAME']) . '/includes/configure.php')) ) {
  $messageStack->add('header', WARNING_CONFIG_FILE_WRITEABLE, 'warning');
}
 }

 

change to:

  /* // check if the configure.php file is writeable
 if (WARN_CONFIG_WRITEABLE == 'true') {
if ( (file_exists(dirname($HTTP_SERVER_VARS['SCRIPT_FILENAME']) . '/includes/configure.php')) && (is_writeable(dirname($HTTP_SERVER_VARS['SCRIPT_FILENAME']) . '/includes/configure.php')) ) {
  $messageStack->add('header', WARNING_CONFIG_FILE_WRITEABLE, 'warning');
}
 }*/

 

2. I have set the ../catalog/admin/ folder as protected(.htaccess) and set a user name and password. Where should I be prompted for the credentials, since it seems like I can easily go into the admin panel without entering anything.

 

if you correctly set-up it, every time you go to www.domain-name.com/shop/admin it will prompt to enter username & password