Is ZenCart default-secure?

[TheToe]

Hi, folks. I have been evaluating oscommerce, and before even getting to configuring my shop I had to give up because it is just too much of a mess. Before I go through the same process with ZC, perhaps someone could tell me if it has a better security model?

When I set up oscommerce, I was instructed to:

• Turn on register globals
• Make several folders world-writable
• "Secure" the completely open admin directory with an apache realm (which still sends the password in the clear)

All of these seem like big security problems to me. I was able to locate and install a patch that took away the register globals need, but it promised to break any other module I would attempt to install.

Is ZenCart any better, or am I going to have the same issues?

Thanks.

[Kim]

Hi, folks. I have been evaluating oscommerce, and before even getting to configuring my shop I had to give up because it is just too much of a mess. Before I go through the same process with ZC, perhaps someone could tell me if it has a better security model?

When I set up oscommerce, I was instructed to:

• Turn on register globals
• Make several folders world-writable
• "Secure" the completely open admin directory with an apache realm (which still sends the password in the clear)

All of these seem like big security problems to me. I was able to locate and install a patch that took away the register globals need, but it promised to break any other module I would attempt to install.

Is ZenCart any better, or am I going to have the same issues?

Thanks.

Zen Cart is designed to run with Register Globals OFF out of the box.

Some directories do need to be writable if you are using certain functionality, images in particular.

The Admin is password protected and can be run under SSL if needed. (not recommended for speed issues at this time)

We take security very seriously and have made tremendous leaps above the osC program.

[DrByte]

I'll just add a little to Kim's comment:

Some directories do need to be writable if you are using certain functionality, images in particular.

Just to add further clarification ... Once your site is "complete", all of these are optional, and can be managed separately by uploading changes via FTP instead of via the browser.