Forums / General Questions / Security warning with fresh install of 1.3.8a

Security warning with fresh install of 1.3.8a

Locked

Views: 1,533

Results 1 to 10 of 10
This thread is locked. New replies are disabled.
7 May 2009, 4:15 PM
#1
panzico avatar

panzico

New Zenner

Join Date:
Aug 2008
Location:
Southern California - Riverside
Posts:
55
Plugin Contributions:
0

Security warning with fresh install of 1.3.8a

I had recently installed a fresh Zen Cart 1.3.8a on a new URL I'm setting up. I'm testing it out and for some reason it won't let me create a new customer. When I fill out the form (for a test customer) and hit "Submit", I get a message pop up "Security Warning : Although this page is encrypted, the information you have entered is to be sent over an unencrypted connection and could easily be read by a third party. Are you sure you want to continue sending this information?"

When I hit "continue" it goes to a new Welcome, Please Sign In screen. It obviously doesn't take in the new customer. Is this a problem with the SSL or Zen Cart configuration?

7 May 2009, 5:21 PM
#2
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,513
Plugin Contributions:
176

Re: Security warning with fresh install of 1.3.8a

That's a misconfiguration of your SSL settings

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

7 May 2009, 5:26 PM
#3
panzico avatar

panzico

New Zenner

Join Date:
Aug 2008
Location:
Southern California - Riverside
Posts:
55
Plugin Contributions:
0

Re: Security warning with fresh install of 1.3.8a

Any idea where I would go to fix this?

7 May 2009, 5:44 PM
#4
panzico avatar

panzico

New Zenner

Join Date:
Aug 2008
Location:
Southern California - Riverside
Posts:
55
Plugin Contributions:
0

Re: Security warning with fresh install of 1.3.8a

Also, when testing everytime I am trying to add a product it shows that the cart is empty.

7 May 2009, 5:48 PM
#5
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,513
Plugin Contributions:
176

Re: Security warning with fresh install of 1.3.8a

If login and add-to-cart don't work, that usually indicates that your PHP session support isn't working properly either.
This can be caused by having your /cache/ folder not set to read-write permissions.
It can also be caused by having an invalid path set in your Admin->Configuration->Sessions->Session Directory , or a non-read-write path specified. Similarly a valid path must be supplied in your configure.php files for DIR_FS_SQL_CACHE.

It can also be caused by supplying invalid SSL settings when setting up your store, causing either your sessions to not work due to URL mismatches, or your browser to get confused by attempting to use bad SSL details. If you turn off the ENABLE_SSL setting in your configure.php files and things suddenly work fine, then it's definitely something wrong with your SSL settings, either in your configure.php files and/or in your hosting account.

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

12 May 2009, 1:51 PM
#6
panzico avatar

panzico

New Zenner

Join Date:
Aug 2008
Location:
Southern California - Riverside
Posts:
55
Plugin Contributions:
0

Re: Security warning with fresh install of 1.3.8a

This installation has turned into a nightmare. My hosting company apparently has no clue on what they're doing.

Again, they are supposed to be giving me a clean fresh installation of the current Zen Cart version with SSL.

They have installed it 3 times now in an effort to not have Security warnings every time you try to do something (either as Admin or Customer).

The current situation is that I cannot make any changes in the admin configuration (like change store name), without the message. If I proceed it leaves the field blank. Please see the two attached screen shots. The domain in question is https://www.my-shopping-cart.com.

Last year I was able to install a Zen Cart with this hosting company and it works like a dream. That site is https://www.poodlesupply.com

The hosting company has tried contacting Zen Cart support team, but aren't getting a reply and have asked for me to contact you.

Your help is greatly appreciated.

12 May 2009, 4:12 PM
#7
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,513
Plugin Contributions:
176

Re: Security warning with fresh install of 1.3.8a

What are the contents of your /admin/includes/configure.php file (without the password)?

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

12 May 2009, 6:33 PM
#8
panzico avatar

panzico

New Zenner

Join Date:
Aug 2008
Location:
Southern California - Riverside
Posts:
55
Plugin Contributions:
0

Re: Security warning with fresh install of 1.3.8a

<?php /** * @package Configuration Settings circa 1.3.8 * @copyright Copyright 2003-2007 Zen Cart Development Team * @copyright Portions Copyright 2003 osCommerce * @license <http://www.zen-cart.com/license/2_0.txt> GNU Public License V2.0 */ /*************** NOTE: This file is similar, but DIFFERENT from the "store" version of configure.php. ***********/ /*************** The 2 files should be kept separate and not used to overwrite each other. ***********/ // Define the webserver and path parameters // Main webserver: eg-http://www.your_domain.com - // HTTP_SERVER is your Main webserver: eg-http://www.your_domain.com // HTTPS_SERVER is your Secure webserver: eg-https://www.your_domain.com // HTTP_CATALOG_SERVER is your Main webserver: eg-http://www.your_domain.com // HTTPS_CATALOG_SERVER is your Secure webserver: eg-https://www.your_domain.com /* * URLs for your site will be built via: * HTTP_SERVER plus DIR_WS_ADMIN or * HTTPS_SERVER plus DIR_WS_HTTPS_ADMIN or * HTTP_SERVER plus DIR_WS_CATALOG or * HTTPS_SERVER plus DIR_WS_HTTPS_CATALOG * ...depending on your system configuration settings * * If you desire your *entire* admin to be SSL-protected, make sure you use a "https:" URL for all 4 of the following: */ define('HTTP_SERVER', 'http://my-shopping-cart.com'); define('HTTPS_SERVER', 'https://www.my-shopping-cart.com'); define('HTTP_CATALOG_SERVER', 'http://my-shopping-cart.com'); define('HTTPS_CATALOG_SERVER', 'https://www.my-shopping-cart.com'); // Use secure webserver for catalog module and/or admin areas? define('ENABLE_SSL_CATALOG', 'true'); define('ENABLE_SSL_ADMIN', 'true'); // NOTE: be sure to leave the trailing '/' at the end of these lines if you make changes! // * DIR_WS_* = Webserver directories (virtual/URL) // these paths are relative to top of your webspace ... (ie: under the public_html or httpdocs folder) define('DIR_WS_ADMIN', '/admin/'); define('DIR_WS_CATALOG', '/'); define('DIR_WS_HTTPS_ADMIN', '/admin/'); define('DIR_WS_HTTPS_CATALOG', '/'); define('DIR_WS_IMAGES', 'images/'); define('DIR_WS_ICONS', DIR_WS_IMAGES . 'icons/'); define('DIR_WS_CATALOG_IMAGES', HTTP_CATALOG_SERVER . DIR_WS_CATALOG . 'images/'); define('DIR_WS_CATALOG_TEMPLATE', HTTP_CATALOG_SERVER . DIR_WS_CATALOG . 'includes/templates/'); define('DIR_WS_INCLUDES', 'includes/'); define('DIR_WS_BOXES', DIR_WS_INCLUDES . 'boxes/'); define('DIR_WS_FUNCTIONS', DIR_WS_INCLUDES . 'functions/'); define('DIR_WS_CLASSES', DIR_WS_INCLUDES . 'classes/'); define('DIR_WS_MODULES', DIR_WS_INCLUDES . 'modules/'); define('DIR_WS_LANGUAGES', DIR_WS_INCLUDES . 'languages/'); define('DIR_WS_CATALOG_LANGUAGES', HTTP_CATALOG_SERVER . DIR_WS_CATALOG . 'includes/languages/'); // * DIR_FS_* = Filesystem directories (local/physical) //the following path is a COMPLETE path to your Zen Cart files. eg: /var/www/vhost/accountname/public_html/store/ define('DIR_FS_ADMIN', '/home/myshopp/public_html/admin/'); define('DIR_FS_CATALOG', '/home/myshopp/public_html/'); define('DIR_FS_CATALOG_LANGUAGES', DIR_FS_CATALOG . 'includes/languages/'); define('DIR_FS_CATALOG_IMAGES', DIR_FS_CATALOG . 'images/'); define('DIR_FS_CATALOG_MODULES', DIR_FS_CATALOG . 'includes/modules/'); define('DIR_FS_CATALOG_TEMPLATES', DIR_FS_CATALOG . 'includes/templates/'); define('DIR_FS_BACKUP', DIR_FS_ADMIN . 'backups/'); define('DIR_FS_EMAIL_TEMPLATES', DIR_FS_CATALOG . 'email/'); define('DIR_FS_DOWNLOAD', DIR_FS_CATALOG . 'download/'); // define our database connection define('DB_TYPE', 'mysql'); define('DB_PREFIX', 'zen_'); define('DB_SERVER', 'localhost'); define('DB_SERVER_USERNAME', 'myshopp_zc1'); define('DB_SERVER_PASSWORD', 'XXXXXXXXXXX'); define('DB_DATABASE', 'myshopp_zc1'); define('USE_PCONNECT', 'false'); // use persistent connections? define('STORE_SESSIONS', 'db'); // use 'db' for best support, or '' for file-based storage // The next 2 "defines" are for SQL cache support. // For SQL_CACHE_METHOD, you can select from: none, database, or file // If you choose "file", then you need to set the DIR_FS_SQL_CACHE to a directory where your apache // or webserver user has write privileges (chmod 666 or 777). We recommend using the "cache" folder inside the Zen Cart folder // ie: /path/to/your/webspace/public_html/zen/cache -- leave no trailing slash define('SQL_CACHE_METHOD', 'database'); define('DIR_FS_SQL_CACHE', '/home/myshopp/public_html/cache'); // EOF
12 May 2009, 6:40 PM
#9
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,513
Plugin Contributions:
176

Re: Security warning with fresh install of 1.3.8a

Question ... if you're using HTTP_SERVER with a non-https URL, then why do your screenshots show an https URL on them? That will certainly cause the errors you're getting.

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

12 May 2009, 7:42 PM
#10
panzico avatar

panzico

New Zenner

Join Date:
Aug 2008
Location:
Southern California - Riverside
Posts:
55
Plugin Contributions:
0

Re: Security warning with fresh install of 1.3.8a

Thanks Dr. Byte for that. I'm not happy with my hosting provider who "set up my ZC", but I sent your question to them. Maybe they can figure it out. Meanwhile, I think I'm going to move on to another hosting provider.