security warning configure.php

[joez5374]

new zen cart 1.3.8
installed using cPanel.
Not yet on a local machine.

Changed permissions on a bunch of files and folders as per the doc included in Zen cart.
This big warning showed-up at the top of the cart:

Warning: I am able to write to the configuration file: /home/xxxxxxx/public_html/store/includes/configure.php. This is a potential security risk - please set the right user permissions on this file (read-only, CHMOD 644 or 444 are typical). You may need to use your webhost control panel/file-manager to change the permissions effectively. Contact your webhost for assistance.

I have changed the permissions back to their original settings but the message still appears.

I must admit I very confused about how to set-up the store since the info is very different in the docs, in the book, and on this forum.

Should I just remove the store and reinstall?

Thanks for your help.

Joe

[tony_sar]

Follow the doc or book to set permission for your files and folders .. now , depending on server configuration , CHMOD 644 or 444 will work for files, if you tried CHMOD 644 configure.php file and warning still there , try CHMOD 444 .

[afo]

How are you setting the permissions? Are you sure the permissions are changed?

[joez5374]

I'm using cPanel File Manager to change the permissions.
I've tried 644 and 444 and still have hte same message.
The folks at host papa have tried changing the permissions manually and the message still appears!

Any other options you can think of?

Thanks

[joez5374]

I'm using cPanel File Manager to change the permissions. I don't really get why I had to change them in the first place. All very confusing for me

[mediabreeze]

Hi, I am experiencing the exact same problem. I have change the file permissions to all listed yet the message still remains the same. I have rechecked to make sure the permissions have changed and they appear to be what I have set them to both in the CP of my host and through my FTP.

Can anyone help?

[schoolboy]

All very confusing for me

Permissions relate to whether a file / folder is:

readable (by user, group, world)
writeable (by user, group, world)
executable (by user, group, world)

Depending on the file / folder, permissions need to be restricted, to prevent unauthorized people from writing to, or even executing such files / folders (and their contents).

Because the configure files contain such sensitive data, they must be READABLE ONLY.

On most servers, this CHMOD setting is 444 (or 0444) = READ ONLY for user AND group AND world.

Some servers are configured to allow 644 (0644) without generating the ZC security warning, but I always set to 444 regardless.

If, after setting to 444, you are still getting the warning, then a server configuration issue is usually the case, and your host should sort this out.

It is common for servers NOT to allow chmod to 444 via a FTP program, and this level can only be set at the CPanel.

If your host has tried the setting at 444, and cannot explain the re-appearance of the ZC warning, then start to have doubts about your host's knowledge of server configuration.

[DrByte]

HOWEVER, I would be interested as to why this happened after months of smooth activity. I can't help suspecting hacker activity however slight.

Exactly. So, you need to work with your hosting company to sort out exactly what happened and why.

[acflutes]

HI,

Am new to Zen Cart, but also getting the warning. Have tried all ways to set from 644 to 444, but not happening, and I don't want to put info up and advertise to the world there may be a way in to hack.

sadly I cannot get to the thread that tells you how to stop this coming up, ie suppress the message. Any help is appreciate as switched to Zencart after loosing 2 months work with Joomla, and the back ups failed.

cheers Adam

[Website Rob]

Start with a blank text file and inside put the following code:

<?php
chmod("includes/configure.php", 0444);
chmod("admin/includes/configure.php", 0444);
echo 'Completed'
?>

Note: if you renamed the 'admin' directory then change "admin" to whatever you renamed it to and you're good to go.

Save the file as chmod.php and upload it to the same directory where these files are:
index.php - ipn_main_handler.php - nddbc.html

Now load this URL into your Browser: http://yoursite.com/chmod.php
(adjust URL accordingly if Zen Cart is in a sub-directory)

Once you see the 'Completed' msg. then load your Zen Cart "index" page to verify Error msg. is gone.

Now delete the chmod.php page.