Please Help....Hacker??

[abpse]

I am very new to zen cart and php. When I received the email from zen cart of the security patch, I instintly installed it. And silly me, did not back up after the patch. I had another issue and had to upload my last backup, which didn't have the patch, but I had totally forgotten to add it again. Now, when I try to login to my admin and also when customers try to log in this is what we get:



Warning: Unknown(): open_basedir restriction in effect. File(/home/auraback/public_html/index.php) is not within the allowed path(s): (/home/webhost/:/usr/lib/php:/usr/local/lib/php:/tmp) in Unknown on line 0

Warning: Unknown(/home/auraback/public_html/index.php): failed to open stream: Operation not permitted in Unknown on line 0

Warning: Unknown(): open_basedir restriction in effect. File(/home/auraback/public_html/index.php) is not within the allowed path(s): (/home/webhost/:/usr/lib/php:/usr/local/lib/php:/tmp) in Unknown on line 0

Warning: Unknown(/home/auraback/public_html/index.php): failed to open stream: Operation not permitted in Unknown on line 0

Warning: (null)(): Failed opening '/home/auraback/public_html/index.php' for inclusion (include_path='.:/usr/lib/php:/usr/local/lib/php') in Unknown on line 0



I have done searchs looking for the solution, but have not found anything.

Does anyone have any idea what I need to do??!!!

PLEEEEEEEEEAAAAAAAAAASE HELP ME!!!

Thanks,
Corinne

[DrByte]

This is not a hack-attempt. It's a configuration problem.

The message is telling you what's wrong:
File(/home/auraback/public_html/index.php) is not within the allowed path(s): (/home/webhost/:/usr/lib/php:/usr/local/lib/php:/tmp)

/home/auraback
isn't the same as
/home/webhost

What is your home folder really called?

Please post your /includes/configure.php without password.


Moving this post to the Installation area...

[abpse]

I just was confused because of the unknown on line 0. I have no idea what hackers do. Like I said I'm really new at this stuff. Anyway, here's my configure files:

includes/configure.php

<?php
/**
*
* @package Configuration Settings
* @copyright Copyright 2003-2006 Zen Cart Development Team
* @copyright Portions Copyright 2003 osCommerce
* @license http://www.zen-cart.com/license/2_0.txt GNU Public License V2.0
*/


// Define the webserver and path parameters
// HTTP_SERVER is your Main webserver: eg, http://www.yourdomain.com
// HTTPS_SERVER is your Secure webserver: eg, https://www.yourdomain.com
define('HTTP_SERVER', 'http://aurabackdrops.com');
define('HTTPS_SERVER', 'https://web-hosted.com/~auraback');

// Use secure webserver for checkout procedure?
define('ENABLE_SSL', 'true');

// NOTE: be sure to leave the trailing '/' at the end of these lines if you make changes!
// * DIR_WS_* = Webserver directories (virtual/URL)
// these paths are relative to top of your webspace ... (ie: under the public_html or httpdocs folder)
define('DIR_WS_CATALOG', '/');
define('DIR_WS_HTTPS_CATALOG', '/');

define('DIR_WS_IMAGES', 'images/');
define('DIR_WS_INCLUDES', 'includes/');
define('DIR_WS_FUNCTIONS', DIR_WS_INCLUDES . 'functions/');
define('DIR_WS_CLASSES', DIR_WS_INCLUDES . 'classes/');
define('DIR_WS_MODULES', DIR_WS_INCLUDES . 'modules/');
define('DIR_WS_LANGUAGES', DIR_WS_INCLUDES . 'languages/');
define('DIR_WS_DOWNLOAD_PUBLIC', DIR_WS_CATALOG . 'pub/');
define('DIR_WS_TEMPLATES', DIR_WS_INCLUDES . 'templates/');

define('DIR_WS_PHPBB', '/');

// * DIR_FS_* = Filesystem directories (local/physical)
//the following path is a COMPLETE path to your Zen Cart files. eg: /var/www/vhost/accountname/public_html/store/
define('DIR_FS_CATALOG', '/home/auraback/public_html/');

define('DIR_FS_DOWNLOAD', DIR_FS_CATALOG . 'download/');
define('DIR_FS_DOWNLOAD_PUBLIC', DIR_FS_CATALOG . 'pub/');
define('DIR_WS_UPLOADS', DIR_WS_IMAGES . 'uploads/');
define('DIR_FS_UPLOADS', DIR_FS_CATALOG . DIR_WS_UPLOADS);
define('DIR_FS_EMAIL_TEMPLATES', DIR_FS_CATALOG . 'email/');

// define our database connection
define('DB_TYPE', 'mysql');
define('DB_PREFIX', 'zen_');
define('DB_SERVER', 'localhost'); // eg, localhost - should not be empty
define('DB_SERVER_USERNAME', 'xxxxxx');
define('DB_SERVER_PASSWORD', 'xxxxxx');
define('DB_DATABASE', 'xxxxxx');
define('USE_PCONNECT', 'false'); // use persistent connections?
define('STORE_SESSIONS', 'db'); // leave empty '' for default handler or set to 'db'

// The next 2 "defines" are for SQL cache support.
// For SQL_CACHE_METHOD, you can select from: none, database, or file
// If you choose "file", then you need to set the DIR_FS_SQL_CACHE to a directory where your apache
// or webserver user has write privileges (chmod 666 or 777). We recommend using the "cache" folder inside the Zen Cart folder
// ie: /path/to/your/webspace/public_html/zen/cache -- leave no trailing slash
define('SQL_CACHE_METHOD', 'database');
define('DIR_FS_SQL_CACHE', '/home/auraback/public_html/cache');

?>


admin/includes/configure.php

<?php
//
/**
*
* @package Configuration Settings
* @copyright Copyright 2003-2006 Zen Cart Development Team
* @copyright Portions Copyright 2003 osCommerce
* @license http://www.zen-cart.com/license/2_0.txt GNU Public License V2.0
*/


// Define the webserver and path parameters
// Main webserver: eg, http://localhost - should not be empty for productive servers
// HTTP_SERVER is your Main webserver: eg, http://www.yourdomain.com
// HTTPS_SERVER is your Secure webserver: eg, https://www.yourdomain.com
// HTTP_CATALOG_SERVER is your Main webserver: eg, http://www.yourdomain.com
// HTTPS_CATALOG_SERVER is your Secure webserver: eg, https://www.yourdomain.com
/*
* URLs for your site will be built via:
* HTTP_SERVER plus DIR_WS_ADMIN or
* HTTPS_SERVER plus DIR_WS_HTTPS_ADMIN or
* HTTP_SERVER plus DIR_WS_CATALOG or
* HTTPS_SERVER plus DIR_WS_HTTPS_CATALOG
* ...depending on your system configuration settings
*/
define('HTTP_SERVER', 'http://aurabackdrops.com');
define('HTTPS_SERVER', 'https://web-hosted.com/~auraback');
define('HTTP_CATALOG_SERVER', 'http://aurabackdrops.com');
define('HTTPS_CATALOG_SERVER', 'https://web-hosted.com/~auraback');

// Use secure webserver for catalog module and/or admin areas?
define('ENABLE_SSL_CATALOG', 'true');
define('ENABLE_SSL_ADMIN', 'true');

// NOTE: be sure to leave the trailing '/' at the end of these lines if you make changes!
// * DIR_WS_* = Webserver directories (virtual/URL)
// these paths are relative to top of your webspace ... (ie: under the public_html or httpdocs folder)
define('DIR_WS_ADMIN', '/admin/');
define('DIR_WS_CATALOG', '/');
define('DIR_WS_HTTPS_ADMIN', '/admin/');
define('DIR_WS_HTTPS_CATALOG', '/');

define('DIR_WS_IMAGES', 'images/');
define('DIR_WS_ICONS', DIR_WS_IMAGES . 'icons/');
define('DIR_WS_CATALOG_IMAGES', HTTP_CATALOG_SERVER . DIR_WS_CATALOG . 'images/');
define('DIR_WS_CATALOG_TEMPLATE', HTTP_CATALOG_SERVER . DIR_WS_CATALOG . 'includes/templates/');
define('DIR_WS_INCLUDES', 'includes/');
define('DIR_WS_BOXES', DIR_WS_INCLUDES . 'boxes/');
define('DIR_WS_FUNCTIONS', DIR_WS_INCLUDES . 'functions/');
define('DIR_WS_CLASSES', DIR_WS_INCLUDES . 'classes/');
define('DIR_WS_MODULES', DIR_WS_INCLUDES . 'modules/');
define('DIR_WS_LANGUAGES', DIR_WS_INCLUDES . 'languages/');
define('DIR_WS_CATALOG_LANGUAGES', HTTP_CATALOG_SERVER . DIR_WS_CATALOG . 'includes/languages/');

// * DIR_FS_* = Filesystem directories (local/physical)
//the following path is a COMPLETE path to your Zen Cart files. eg: /var/www/vhost/accountname/public_html/store/
define('DIR_FS_ADMIN', '/home/auraback/public_html/admin/');
define('DIR_FS_CATALOG', '/home/auraback/public_html/');

define('DIR_FS_CATALOG_LANGUAGES', DIR_FS_CATALOG . 'includes/languages/');
define('DIR_FS_CATALOG_IMAGES', DIR_FS_CATALOG . 'images/');
define('DIR_FS_CATALOG_MODULES', DIR_FS_CATALOG . 'includes/modules/');
define('DIR_FS_CATALOG_TEMPLATES', DIR_FS_CATALOG . 'includes/templates/');
define('DIR_FS_BACKUP', DIR_FS_ADMIN . 'backups/');
define('DIR_FS_EMAIL_TEMPLATES', DIR_FS_CATALOG . 'email/');
define('DIR_FS_DOWNLOAD', DIR_FS_CATALOG . 'download/');

// define our database connection
define('DB_TYPE', 'mysql');
define('DB_PREFIX', 'zen_');
define('DB_SERVER', 'localhost'); // eg, localhost - should not be empty
define('DB_SERVER_USERNAME', 'xxxxxxx');
define('DB_SERVER_PASSWORD', 'xxxxxx');
define('DB_DATABASE', 'xxxxxx');
define('USE_PCONNECT', 'false'); // use persistent connections?
define('STORE_SESSIONS', 'db'); // leave empty '' for default handler or set to 'db'

// The next 2 "defines" are for SQL cache support.
// For SQL_CACHE_METHOD, you can select from: none, database, or file
// If you choose "file", then you need to set the DIR_FS_SQL_CACHE to a directory where your apache
// or webserver user has write privileges (chmod 666 or 777). We recommend using the "cache" folder inside the Zen Cart folder
// ie: /path/to/your/webspace/public_html/zen/cache -- leave no trailing slash
define('SQL_CACHE_METHOD', 'database');
define('DIR_FS_SQL_CACHE', '/home/auraback/public_html/cache');

?>



I don't understand why it would work fine for a few days and then all of a sudden I get this warning.


Corinne

[DrByte]

if you set this to 'false', do things work without errors for customer logins?

define('ENABLE_SSL', 'true');

If so, then the problem is in how your server's shared-SSL operates.

[DrByte]

I don't understand why it would work fine for a few days and then all of a sudden I get this warning.

If it happened "all of a sudden", then you should talk to your webhost. If they've changed something related to their shared-SSL certificate, then that's likely what's affecting you.