User Permissions / Configuration / Potential Security Risk?

[silverspring]

On my site, winniesonline.co.uk the following appeared. Why and how do I fix it ?


Warning: I am able to write to the configuration file: /home/winnieso/public_html/store/includes/configure.php. This is a potential security risk - please set the right user permissions on this file (read-only, CHMOD 644 or 444 are typical). You may need to use your webhost control panel/file-manager to change the permissions effectively. Contact your webhost for assistance.



I would appreciate help to sort the problem.

Thanks

[Website Rob]

Start with a blank text file and inside put the following code:

<?php
chmod("includes/configure.php", 0444);
chmod("admin/includes/configure.php", 0444);
echo 'Completed'
?>

Note: if you renamed the 'admin' directory then change "admin" to whatever you renamed it to and you're good to go.

Save the file as chmod.php and upload it to the same directory where these files are:
index.php - ipn_main_handler.php - nddbc.html

Now load this URL into your Browser: http://yoursite.com/chmod.php
(adjust URL accordingly if Zen Cart is in a sub-directory)

Once you see the 'Completed' msg. then load your Zen Cart "index" page to verify Error msg. is gone.

Now delete the chmod.php page/file.

[dbltoe]

OR...
You have cpanel. Why not use the file manager inside cpanel to change the permissions.
Click on file manager, Select Web Root, double-click "includes" in the right-hand panel, find the configure.php file, right-click it, and select Change Permissions. Make sure the only check marks are the three across the top for Read. The numbers at the bottom should read 444.
Click the Change Permissions button and you're done.

[silverspring]

Firstly Dbltoe, I sent you an email - did you get it ?


Should I log in via filezilla or is it ok to do it via the host ?

Doing it via the host when I log into my cpanel / file manager but dont see what you are referring to .....

[plymgary1]

Firstly Dbltoe, I sent you an email - did you get it ?


Should I log in via filezilla or is it ok to do it via the host ?

Doing it via the host when I log into my cpanel / file manager but dont see what you are referring to .....

Log into your cpanel then go into 'file manager'. Find your 'public_html' folder, expand it and click on 'includes'. Then find the file 'configure.php'. Right click this and select change permissions. Make sure the totals read 444 and that should get rid of that message.

Do the same for admin/includes/configure.php

[Steven300]

You can also use FileZilla. Basically the same steps as above.

[dbltoe]

Filezilla will not work if the host has that feature turned off. And, most who use cpanel do have the feature disabled.

[silverspring]

Log into your cpanel then go into 'file manager'. Find your 'public_html' folder, expand it and click on 'includes'. Then find the file 'configure.php'. Right click this and select change permissions. Make sure the totals read 444 and that should get rid of that message.

Do the same for admin/includes/configure.php

I found the public_html folder and assumed that I should follow the store/includes/configure.php - there I changed the permissions to 444 and ensured that the 3 boxes at the very top were ticked.

However, where exactly is the admin/includes/configure.php -
could you give me the full path ?

Thanks

[dbltoe]

both the admin/includes and the includes folders are under the public_html folder.

public_html/admin/includes/configure.php
public_html/includes/configure.php

[silverspring]

Phew ! - I think I've done it ! Thanks !

HOWEVER, what would have changed the permissions in the first place ?