What about my customizations while looking at the beta?

Sometimes, it's easiest to just try something. :wink:

Ever tried loading: http://yoursite.com/includes/configure.php ?

hello website rob,
thank you for reply. i just tried that and got a nice reply, thank you. But hackers can't use any other programs besides web browser to view the file? I'm kinda new to this.

Discussions about hack prevention are best left to another thread.

If a hacker has enough access to read any of your files the way you're worried about, then they've already got way too much access, and you have many far more serious concerns than the file permissions on your configure.php file.

And, as Rob has said, that's an entirely different topic than the one you started this thread about.

knuckle-101:

Examples below may help depending how technically inclined you are

Read and write permission for owner, read-only for group members and all others:
chmod 644 filename Read, write and execute for owner, no access permission for others:
chmod 700 filename Read only for owner and others:
chmod 444 filename If the owner turns off his/her own write permission, the file is protected from accidental or exploiting destruction.

Ahem, I beg to differ.

What these numbers actually mean.
The 1st digit = Owner permissions
The 2nd digit = Group permissions
The 3nd digit = Others permissions

The permissions are bitmapped according to the following table:

0 = no access
1 = execute
2 = write
4 = read

So the permissions you specified:
644 = Owner Read/Write (2+4=6), Group Read only (4), Others Read only (4)
700 = Owner Read/Write & Execute (4+2+1 = 7). Group & others no access (0)
444 = Owner, Group & others, Read only.

Cheers
Rod

Rod, although it could be said you are more correct than knuckle, but still incorrect in a few settings you mentioned, I think between the two posts people will just end up getting confused. Best if people read their FTP Documentation and/or use their favourite Search Engine to find out more.

Bottom line is, an FTP program will automatically use correctly set Default permissions as determined by the Server and people do not even need to think or worry about them. It's only when one has to change permissions they need to know what to change.

Website Rob:

but still incorrect in a few settings you mentioned

Please elaborate. This is way too important for someone to get wrong, least of all me (I'm supposed to be able to train & assess students on this) When did this change? Why wasn't I told?

Or have I merely made a stupid mistake that I still can't see? :blush:

Cheers
Rod

RodG:

Or have I merely made a stupid mistake that I still can't see? :blush:

OIC :blush::blush::blush:Hang on... no idon't...

It may be different amongst different OS's but this is what I meant as applies to FTP programs.

The 3nd digit = Others permissions

• more commonly known as Public, not Others

0 = no access

• FTP programs do not have access to this bit, only accessible using Shell

Nit-picky I know but you know how it is with coding and syntax. :smartalec:

Website Rob:

It may be different amongst different OS's

With respect, you are wrong. (probably for the first time for a long, long time)

Website Rob:

but this is what I meant as applies to FTP programs.

FTP programs must obey the file permissions. Not the other way around. The permissions and ownerships are things we can rely on. If FTP can change these settings it is only because the permissions allow it for the user account that the FTP server is running at. This is an immutable fact.

Website Rob:

The 3nd digit = Others permissions

• more commonly known as Public, not Others

Always known as Other(s) never public. This is not an O/S thing, nor is it a common usage thing. Stating otherwise is only going to confuse my students when it comes to teaching the symbolic notation of the chmod command "u,g,o,a" User, Group, Owner, All. I don't want them wondering why
"chmod gp-rw myfile" produces an error, when they need to use "chmod go-rw myfile"

Website Rob:

0 = no access

• FTP programs do not have access to this bit, only accessible using Shell

Really??????????? Student Rob, please do some homework. You need to resit your exams.

Website Rob:

Nit-picky I know but you know how it is with coding and syntax. :smartalec:

Exactly.

The error I thought I spotted was a mistype of the number "2" in my bitmap table (I thought I saw a "3").

Cheers
Rod

ebaobao:

Hello,
What would be a good way to code and making changes so that when v1.5 is released that we don't waste all the work we have done? Thanks.... and returning to the original question. There is no way to write code that is guaranteed to be compatible with code or changes that haven't been made yet.

The point of the beta is to allow you to give feedback on its stability and accuracy and to give you an indication of what's coming so that you can prepare for it.

Experienced developers may start to adjust their code to reflect what's there and be ready to make further tweaks as needed in response to any further changes. Or they may just plan the changes they're going to make ready for the proper release.

There will be some more code changes, but the problems that have been raised so far by the community are pretty minor and the fixes very localised. So hopefully there won't be much more to come before full release can be made.

RodG:

With respect, you are wrong. (probably for the first time for a long, long time)
I appreciate the kind words but it looks again that, we will have to agree to disagree.

FTP programs can only do what a Server allows them to. As mentioned earlier, all FTP programs automatically use Server defined defaults and can only make any changes if allowed by the Server.

Fear me for I am root! :wink:

As also mentioned, people should read the documentation provided within their FTP program and learn to become familiar with permission settings. Each FTP program has it own quirks and not all work the same. Many people create needless problems for themselves, not properly understanding permissions. And the sooner people learn to use permissions of 755 for dir's. and 644 for files, which are default on Linux Servers, the better off they will be. Note that the 2 config files still should to be 444.

Are we there yet? :frusty:

RodG:

Ahem, I beg to differ.

What these numbers actually mean.
The 1st digit = Owner permissions
The 2nd digit = Group permissions
The 3nd digit = Others permissions

The permissions are bitmapped according to the following table:

0 = no access
1 = execute
2 = write
4 = read

So the permissions you specified:
644 = Owner Read/Write (2+4=6), Group Read only (4), Others Read only (4)
700 = Owner Read/Write & Execute (4+2+1 = 7). Group & others no access (0)
444 = Owner, Group & others, Read only.

Cheers
Rod

I believe I posted examples not actual configurations.. I did not go into detail to avoid confusing the original OP of what he was asking. Nevertheless the permissions 0600 or 600 are readable but takes away write permissions from the owner, which is what we use on some accounts upon request or websites we maintain commercially..

With a good server, PHP hardener and a good security configuration a good practice of custom configurations come into play. For us the way our OS is setup and configured we find the permissions 444 and 600 to be the best and strongest permissions for ZenCart to work without interruptions. So far no problems and the attacks have decreased and the results are what we was looking for..

But like Rob said "Have to agree to disagree" just depends what is best for you in the long run and is best for your OS.