SuPHP and .htaccess?

[Schtoo]

Hi.

I am in a bit of a flap here.

I had a perfectly functional Zencart store running and making money for nearly 12 months.

This morning, nothing. I contacted the site's host, and worked out that anything with a database was not working, including Zencart and Wordpress.

Wordpress is working again, but Zencart is not and I got this message from the host.

"In verifying it again, we notice that you are using .htacces file in the most of the folders in the directory store. Since the PHP in the server is set in SuPHP mode , .htaccess file will not function. Kindly replace the setting in .htaccess with php.ini file."


A little help here?

Especially since I didn't change anything. Was I hacked? Will fooling with .htaccess introduce a security problem?

I am lost here, and I am not sure I am as effective at working things out since I need to get back into Zencart ASAP to process orders and such.

Help?

Thanks,

Stu.

[Schtoo]

Hi again,

Seems my site host did some updates, which was nice except that it broke my Zencart.

Still can't work out what to do though, and I am getting mad enough that I am not sure if I can fix it at all.

Stu.

[Merlinpa1969]

Your old host is only partially correct

you need to remove the php over ride information from the .htaccess folder and place it into a php.ini folder in the store root
and depending on the servers setup you may need to add this into the htaccess file

suPHP_ConfigPath /path/to new/php.ini

you need to make sure that all folders are set to 755 and all files are set to 644 ( exception is the ZC includes/configure.php needs set to 444 )

[Website Rob]

You really need to find out more from your Hoster. If they were not previously using suPHP and now they are, they should have had the courtesy to inform their Clients of such and also do the proper changes for them. That would include, for example, making sure all file & dir. permissions are corrected.

Changing your .htaccess file is something each Client can do but only if they know they have to make the changes and what changes to make. Your Hoster should be willing to help and guide in this.


For example.

If you have this in your .htaccess file:

php_flag session.use_trans_sid off
php_value register_globals off

That will now cause problems because with suPHP being used, you cannot use "php_" in your .htaccess files. It's not that you need to remove your .htaccess files, your Hoster is wrong in suggesting that, but that you probably need to change some text within your .htaccess files. Again, your Hoster should be willing to help with this.

[Schtoo]

Hi all,

They fixed it, but how well I am not 100% sure yet. I need to really dig around and see how good/bad things are, and I did find out very quickly about the 444 permissions for includes/configures.php .

Basically, they just changed it, without warning and at a time when the store was getting a lot of hits and taking orders nicely. To have it drop out for at 14 hours that I was aware of is bad enough, and I could have prepared (or not, but that then becomes my problem) for it, but no warning, and then to be told to just fix something I don't know how to fix and half panicking, well, I am looking for new hosting.

What's worse is that because I had no idea, my backup was not up to minute current and I lost an order. I did have the details and cleared it up quickly, but that was just more fuel for the fire to me.


So, thanks for the advise, and maybe the only good thing to come of it is that I end up picking a host who can do things properly instead of dropping bombs on me.

I just need to clean up what I got to get ready for the move now and make sure things are all nice and tight.

More junk I don't really have time to do, but I can't afford to have another day like yesterday.

Stu.