Zen-Cart on Powweb

[notset4life]

I was running Zen-cart fine for a long time until Powweb was aquired by someone else. Since then, it has been a big hassle, and digital downloads no longer work.
I have to choose between a new host or a new ecommerce solution. But first, can you respond to Powweb's response - maybe there is a workaround somewhere?

Thank you.

It has been determined that the methods used by ZenCart to offer digital downloads are not compatible on our platform. ZenCart uses two methods to download a product:


1) Use fread() (http://www.php.net/fread) or readfile() (http://www.php.net/readfile) to read the file into memory and send it directly to the browser. This fails for either one of two reasons. It either hits our allowed memory limit or the script execution takes longer than the
allowed 60 seconds. But there are some instances where neither of the limitations are hit and the download fails regardless. There is no known solution for this.


2) Use a temporary redirect to a copy of the actual file. As far as system resources go, this is the preferred method of downloading the files. However, ZenCart places these temporary files in a directory that begins with a period (i.e. htdocs/download/.ehwpuseaf8s/file.zip). Our security measures do not allow requests to be made to a file or directory that begins with a period. A potential workaround that the you might look into is modifying the Zencart code to use temporary directory names that do not begin with a period.


If you have any further questions, please don't hesitate to contact us. We are available 24/7.

[Ajeh]

Sounds like it might be time to move on to a hosting site that understands the needs of e-commerce sites better ...

You may with to peek at the Zen Cart Certified Hosting sites ... they are better able to handle the needs of an e-commerce site for php, MySQL, larger downloads/uploads, etc. as they are familiar with what you need available on your site ...

[notset4life]

Sounds like it might be time to move on to a hosting site that understands the needs of e-commerce sites better ...

You may with to peek at the Zen Cart Certified Hosting sites ... they are better able to handle the needs of an e-commerce site for php, MySQL, larger downloads/uploads, etc. as they are familiar with what you need available on your site ...

Can you explain why Powweb consider the dot before the directory in Pub to be a security issue?

Why is the dot necessary...and is there a place that I can "remove" it to at least see if that's what causing the issue?

thanks
Vin

[Ajeh]

You'd have to ask them to explain the methods to their mad ... er ... umm ... reasoning behind the things that they do ...

Every hosting site believes that they "know" what is best ...

Unfortunately, some base that on what is best for them vs what is best for you ...

You will find our Certified Hostings Sites a lot more on the ball with your specific needs ...

Otherwise, they would catch heck here and slink off into the sunset ...

[notset4life]

Linda,
I appreciate your comments, and when my term runs out in a few months I will be switching.

But in the meantime, can you briefly explain why the dot is necessary in the pub sub-directory - the logic behind it. And if there is a quick workaround for the time being?

Thank you.

[Merlinpa1969]

the htaccess file is a directory that you can use to over ride certian functions
you can use it to turn globals exec() etc off and ON

SO, they dont want you being able to over ride what they decided on for global settings.

but in doing so they have limited your abilities to use things like the IP ban
mod re-write and so forth,
they have limited the ability for you to totally deny access to certain folders.


I hope this clears up a few things

[DrByte]

Files or folders starting with a dot are treated as "hidden" by the filesystem (linux/unix/etc).

It's possible that they feel their servers aren't secure enough if they allow browser traffic to access those hidden folders.

Zen Cart uses the hidden folder very intentionally ... so that anybody trying to hack the site has difficulty finding the hidden items.



If you must remove the dot, you'll have to manually edit a core file:
/includes/modules/pages/download/header_php.php
around line 71 you see:

function zen_random_name()
{
  $letters = 'abcdefghijklmnopqrstuvwxyz';
  $dirname = '.';

change that $dirname = '.'; by removing the dot

[notset4life]

Merlinpa1969: I know what htaccess is, but that wasn't the question

DrByte: Problem resolved. I removed the dot and everything now works. I assume the downloaded file is moved into that gibberish folder "during" the download, and is then removed...because I always see that temporary folder empty.

[DrByte]

I assume the downloaded file is moved into that gibberish folder "during" the download, and is then removed...because I always see that temporary folder empty.

A "pointer" to the real download file is placed in that folder. Called a symlink.
During the "next" download, the links are cleaned up so things are kept clean and secure as much as possible.

[poolprorich]

hi all,

Powweb's php5 or php4 is run as a gui witch also has php mem isues, if you edit your php.ini
down about half way you will find

; Resource Limits ;
;;;;;;;;;;;;;;;;;;;

max_execution_time = 300 ; Maximum execution time of each script, in seconds
max_input_time = 60 ; Maximum amount of time each script may spend parsing request data
memory_limit = 8M ; Maximum amount of memory a script may consume

change (memory_limit = 20M ; )

make sure the M is caps

it helped me