User Permissions / Configuration / Potential Security Risk?

[plymgary1]

Firstly Dbltoe, I sent you an email - did you get it ?


Should I log in via filezilla or is it ok to do it via the host ?

Doing it via the host when I log into my cpanel / file manager but dont see what you are referring to .....

Log into your cpanel then go into 'file manager'. Find your 'public_html' folder, expand it and click on 'includes'. Then find the file 'configure.php'. Right click this and select change permissions. Make sure the totals read 444 and that should get rid of that message.

Do the same for admin/includes/configure.php

[Steven300]

You can also use FileZilla. Basically the same steps as above.

[dbltoe]

Filezilla will not work if the host has that feature turned off. And, most who use cpanel do have the feature disabled.

[silverspring]

Log into your cpanel then go into 'file manager'. Find your 'public_html' folder, expand it and click on 'includes'. Then find the file 'configure.php'. Right click this and select change permissions. Make sure the totals read 444 and that should get rid of that message.

Do the same for admin/includes/configure.php

I found the public_html folder and assumed that I should follow the store/includes/configure.php - there I changed the permissions to 444 and ensured that the 3 boxes at the very top were ticked.

However, where exactly is the admin/includes/configure.php -
could you give me the full path ?

Thanks

[dbltoe]

both the admin/includes and the includes folders are under the public_html folder.

public_html/admin/includes/configure.php
public_html/includes/configure.php

[silverspring]

Phew ! - I think I've done it ! Thanks !

HOWEVER, what would have changed the permissions in the first place ?

[dbltoe]

The permissions would have been set like they were at installation. They have to be changed in order to write/change them.
If this is not a new install, perhaps someone helping you has changed the permissions to work on the files.
If none of the above is the case, you will need to check to see if you've been hacked.

[silverspring]

Having sorted one situation out another has presented itself - the images from the mainpage went missing - fortunately, I managed to re-instate them !

The hosting is through RENTACART - guys, DONT USE THEM - seriously their support is non existent, as well as their telephone service !!!!!!!

Browsing on their site I found the following :

Security Announcement -- Admin Security Patch
A vulnerability has been discovered in the admin section of the carts we use. To take advantage of this vulnerability any attacker must know the URL of your admin section.

A link to the patch is posted below. Please download the patch file and unzip it. The file contains a readme.html with full details on how to install the security patch.

IMPORTANT NOTE:

There are Directories/Folders embedded in the zip. So, when you expand/unzip, you MUST tell your unzip program to expand the folders too! Otherwise you are likely to end up putting the wrong files in the wrong places.

Follow the instructions carefully and remember, the documentation tells you exactly where to put the files. This is an ADMIN patch so all the files go under your admin directory in their respective folders.

Click Here For Patch Download

REMEMBER WHEN APPLYING ANY PATCHES ALWAYS DO A FULL BACKUP. That includes your MySQL database, data and your PHP/HTML/CSS/TEMPLATE/IMAGES files by downloading them to your computer.
We can do all this for you if required.

For 19.88 we will apply the patch, check your site, change your admin directory & update the details in your configure.php file to reflect the changes made. To purchase please click here.

Yeah, I'd have immediate attention if I gave them £19.88 !!!!

My gripe aside, I have downloaded the patch to my HD so now how do I install in without causing MORE PROBLEMS to the site.

I'd appreciate help !

Kind regards

[dbltoe]

Please read the line in your post that starts

A link to the patch is posted below. Please download the patch...

I wouldn't charge a penny over $33.78 to fix this