Getting WARNING Message

[Ghoastrider]

I am getting the following message at the top of my OScommerce catalog page "Warning: I am able to write to the configuration file: /home/longezpi/public_html/ruger1022receiver/OScommerce/includes/configure.php. This is a potential security risk - please set the right user permissions on this file."

 

Anyone know how to fix this? I have no idea how to address this message.

 

Phil

[FIMBLE]

I am getting the following message at the top of my OScommerce catalog page "Warning: I am able to write to the configuration file: /home/longezpi/public_html/ruger1022receiver/OScommerce/includes/configure.php. This is a potential security risk - please set the right user permissions on this file."

 

Anyone know how to fix this? I have no idea how to address this message.

 

Phil

 

You need to CHMOD the file permissions of your catalog / includes / configure.php and your admim / includes / configure.php files to 0444, or at the highest 0644 this will remove the error.

Nic

[Ghoastrider]

Nic,

I don't know what CHMOD means? I have looked at both files and have no idea where to add the numbers you suggested. I know I'm no guru at this can you be a little more basic. Thanks in advance.

[Terminum]

Does your host have something like cPanel?

 

CHMOD is just the file permissions which you should be able to change by logging in to your hosting account. In your file manager you should be able to edit the permission settings for files and folders. You may be able to just type in 644 or you'll have to check boxes to specify read and write permissions for various user types.

 

 

 

Use this permission calculator to figure out what various numbers mean:

 

http://www.javascriptkit.com/script/script2/chmodcal.shtml

 

 

For example, 644 is:

Owner: read, write

Group: read

Other: read

[Ghoastrider]

Thanks So much!!! It's done and the warning went away.

 

Someone sent me a private message called Airbrushmaster and told me to set it to 777. I am thankful there are others on this site that are honest and helpful. It is at a much lower number.

[Ben Nevis]

Ghoastrider, the file permissions on configure.php is a fairly basic security setting that osc warns you about. There are several other security measures you need to take that osc does not warn you about and you will likely not know about unless you have been reading the threads on security issues. If you have not done so, I would urge you urgently to do the things listed in this thread before you do anything else with your store.

[FIMBLE]

Thanks So much!!! It's done and the warning went away.

 

Someone sent me a private message called Airbrushmaster and told me to set it to 777. I am thankful there are others on this site that are honest and helpful. It is at a much lower number.

 

You should never ever set any folder / file to 777 its just asking to be hacked

[MrPhil]

Sometimes people will tell you to change permissions to 777 out of ignorance, not out of malice. It's rare that a directory need be 777 (but possible, read this: http://www.oscommerce.com/forums/index.php?showtopic=327395&view=findpost&p=1443272 ).

[airbrushmaster]

i sent a pm to them but i was busy at the time god knows why i said 777

[♥geoffreywalton]

How on earth did the message go away when it was set to 777 anyway?

[MrPhil]

They said they didn't set it to 777, but to a "much lower number" (I'm guessing 444).

[lianamber]

hello,

 

Having the same issue: I have changed the permissions, trying 644, 444 and 400, but none of them made the warning go away. Any tips?

 

thank you!!

[MrPhil]

444 (-r--r--r--) should work. Have you double checked that you successfully changed permissions to what you thought you did? Perhaps you thought you changed permissions, but didn't, or you changed one of the two configure.php files (not both). Note that 644 is read-write (-rw-r--r--).

[lianamber]

changed them to 444, and the error message went away! thanks much... hoping that doesn't mean I won't be able to change anything in the catalog... ?

 

appreciate your time greatly!!

[MrPhil]

It means that your configure.php files have to be "unlocked" (write-enabled to 644) by you before you can change those two files. No effect on the rest of the store. The whole idea is that all sorts of difficult-to-replace configuration information is in these two files, and you want to "lock" them (make them "read only") so that they can not be accidentally (program error) or maliciously (hacker-inserted code) be destroyed or corrupted.

[lianamber]

awesome, you rock! don't know what I'd do without good samaritans like you!!!

[svouratoys]

Hi i changed the file rights to include\configure.php and admin\include\configure.php but still i have the warning meggase

 

"Warning: I am able to write to the configuration file: /OScommerce/includes/configure.php. This is a potential security risk - please set the right user permissions on this file."

 

What also i have to do ??

 

Thank you

[MrPhil]

The first thing to do is to clear your browser cache, in case you're simply looking at an old, cached copy. If not, it sounds like you think you changed the permissions, but in fact they "didn't take" or you did it wrong. It's not uncommon for FTP utilities to not be able to change permissions, especially if it's a Windows server. Use your hosting service control panel to change permissions (to "read only" if Windows, or 444 for Linux).

[svouratoys]

The first thing to do is to clear your browser cache, in case you're simply looking at an old, cached copy. If not, it sounds like you think you changed the permissions, but in fact they "didn't take" or you did it wrong. It's not uncommon for FTP utilities to not be able to change permissions, especially if it's a Windows server. Use your hosting service control panel to change permissions (to "read only" if Windows, or 444 for Linux).

 

Thank you

i changed the permission from cpanel and worked

[OrcaSoul]

OK, I'm getting the same message. I found this thread, and have read what I need to do - but I seem to have a problem running the command "chmod who=644 c:/xampp/htdocs/catalog/includes/configure.php" in the DOS window (my OS is Vista, my server is xampp).

 

Is there another way to do this?

[satish]

technically speaking configure.php should not allow a write to any group.

 

So make sure that this is the case.

Satish

[MrPhil]

644 is for Linux servers. It's wrong anyway (you want 444). Does Windows now permit Linux-style permissions, or the 'chmod' command? If not, you'll have to look up how to make a file "read only". I know on older versions you would do something like attrib +r filename.

[ConsultMe]

It seems my host doesn't allow permissions below 644 (however I try to CHMOD to 444 (FTP/SSH) it always changes back to 644) so I'm not able to eliminate the message, is there a work around to remove the check or is this just hiding a security flaw and not recommended?

 

Thanks

Andrew

[germ]

It seems my host doesn't allow permissions below 644 (however I try to CHMOD to 444 (FTP/SSH) it always changes back to 644) so I'm not able to eliminate the message, is there a work around to remove the check or is this just hiding a security flaw and not recommended?

 

Thanks

Andrew

Most people have to use cPanel to get the permissions to change successfully.

 

If all else fails you can turn off the message.

 

Close to the bottom of /catalog/includes/application_top.php change this line:

 

  define('WARN_CONFIG_WRITEABLE', 'true');

To

 

  define('WARN_CONFIG_WRITEABLE', 'false');

BACKUP THE FILE FIRST.

 

You break it - You bought it...

:blush:

[ConsultMe]

Sorry, fixed my own problem moments later :-S

 

running the CHMOD via php script on the server worked where FTP/SSH failed for some reason.

 

Andrew