Customers accessing admin area

[Raven2000]

Hi I don't know if anyone else has this problem but I just discovered that whenI'm logged into my site as a customer I can access all admin facilities without entering the admin password.. I simply type admin after the https://mydomain.com/osCommerce/admin and it opens up the admin section even though I haven't given the admin password or login

 

has anyone uncovered this problem on their site and overcome it??

 

Help please this is a major security issue

 

Mel :(

[bluepony]

You can password protect it using .htaccess. (htaccss tutorials are on the web).

 

If your web hosting control panel allows you to set up password protected directories - set up a group, add a user to that group, and then password protect the admin directory.

 

There are also some Admin password contributions as well.

 

See more tips at http://wiki.oscommerce.com/docsInstallNew

[TerryK]

With my server, if I log in to the admin section of my site via .htaccess, it will remember my login for as long as my browser session remains open. (If I close IE down completely, then open it up again, I have to relogin via .htaccess to gain access to the admin section again.)

 

Could it be that this is what's happening to you? Try closing your browser completely, then going to the store as a 'customer' and THEN try to access Admin and see if it still happens.

 

HTH,

 

Terry

[Pompeylad]

Terry,

 

Would this mean that anybody can access it when the store owner has entered it? Or just that computer?

 

Pompeylad.

[TerryK]

AFAIK, it applies to ONLY my computer.

 

Another example: if I open up both MSIE and Netscape and try to access my /admin section from both, I have to enter my username and password for EACH browser. Once I have logged in, my sessions will remain in effect for however long I keep each browser window open. (Closing the browser and re-opening it will force the prompt to login the next time I try to access admin.)

 

HTH,

 

Terry