Zen Cart Logo

Site maintenance: Sun 15 Nov, from 12:00 UTC, about 4–6 hours. Details

This cutover relies on some testing that is still incomplete so may be cancelled at short notice
Forums / Upgrading from 1.3.x to 1.3.9 / Security question

Security question

Locked

Started by music_man on 25 Jul 2009, 7:52 PM · Views: 1,734

Results 1 to 5 of 5
This thread is locked. New replies are disabled.
25 Jul 2009, 7:52 PM
#1
music_man avatar

music_man

Zen Follower

Join Date:
Apr 2009
Posts:
188
Plugin Contributions:
0

Security question

In the ZC site security recommendations I saw the following:

"/cache
..... The BEST security protection for this is to move it to a folder "above" the webroot (public_html or htdocs or www) area, so that it's not accessible via a browser. (Requires changes to DIR_FS_SQL_CACHE setting in configure.php files as well as Admin > Configuration > Sessions > Session Directory.)"

I ran this by my host and got the following response....

"You can move that folder to your home directory (the folder in which public_html lives). You wouldn't have an address(URL) for that directory once moved out of your web root, but you would have a filesystem path......... "

Two questions come to mind:

  1. By doing what the host says am I placing /cache folder on the same level or "above" the webroot? It sounds like I'm "above" but just wanted to check my understanding with someone else who is familiar with ZC.....

  2. How many configure.php files need changing?

Thanks for looking.....

MM

25 Jul 2009, 8:24 PM
#2
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,511
Plugin Contributions:
176

Re: Security question

  1. Yes.
  2. Two

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

25 Jul 2009, 8:51 PM
#3
music_man avatar

music_man

Zen Follower

Join Date:
Apr 2009
Posts:
188
Plugin Contributions:
0

Re: Security question

Yes to "above" or same level in question #1?

Thanks

MM

25 Jul 2009, 9:06 PM
#4
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,511
Plugin Contributions:
176

Re: Security question

Your server probably has the following folder structure:

/home/username/public_html

The "webroot" in that example is the "public_html" part.

So, if you move your cache folder to /home/username/cache then that puts the cache folder outside the webroot. Whether you want to be semantic and call it 'above' or 'beside' doesn't matter. In the "industry" being "outside" the webroot is also affectionately called "above" the webroot too.

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

26 Jul 2009, 4:31 AM
#5
music_man avatar

music_man

Zen Follower

Join Date:
Apr 2009
Posts:
188
Plugin Contributions:
0

Re: Security question

Ahh...I think I've got it now....

Thanks for the help...

MM