Forums / General Questions / PCI question about seeing my images

PCI question about seeing my images

Views: 524

Results 1 to 4 of 4
20 Sep 2012, 5:21 PM
#1
sir_paolo avatar

sir_paolo

New Zenner

Join Date:
Oct 2009
Location:
Assachusetts
Posts:
11
Plugin Contributions:
0

PCI question about seeing my images

Our PCI scan company is saying that any viewer can view indexes of our images, etc and this is something that shouldn't be happening. Our scan company says that it is Bluehost (our host) that needs to change it on their servers...as they claim to be PCI compliant. Bluehost says they cannot change it, we must change it. Below is what Bluehost told us to fix on our end. Does this conflict with the inner workings of Zen Cart? Will it mess up Zen Cart's function?

The Options -Indexes will prevent the contents of a directory from being displayed if they do not have an index file. It would have the same impact to the shopping cart if it were enabled globally on the server or enabled via the .htaccess file. You would need to contact the company that developed your shopping cart to find out for sure if it would have a negative impact or not.

Here are the steps to edit the public_html/.htaccess file.

Login to your cPanel Account
Click the File Manager icon, located in the Files section.
From the File Manger popup choose "Choose Hidden Files (dotfiles)."
Note: If you do not see this popup you will need to click the "reset all interface settings" link at the bottom of the cPanel page.
From the File Manager popup choose the folder you would like to open, most often the "Web Root (public_html/www)"
Click the Go button.

The files will be displayed in the right hand side of the screen. Select the .htaccess file Click on the Edit icon from the menu bar.
Type in Options -Indexes in the first line of the file and then press enter on your keyboard.
Save file

20 Sep 2012, 5:52 PM
#2
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,515
Plugin Contributions:
176

Re: PCI question about seeing my images

If you would upgrade to a more modern version of Zen Cart, you would find that the supplied .htaccess files, in various different folders, already take care of this issue.

At the VERY least, you could take the /images/.htaccess and /images/index.html files from the latest version of Zen Cart and put them onto your site.

BUT YOU SHOULD NOT STOP THERE!!!!! YOU NEED TO UPGRADE ASAP.

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

20 Sep 2012, 5:53 PM
#3
kobra avatar

kobra

Black Belt

Join Date:
Aug 2005
Location:
Arizona
Posts:
31,500
Plugin Contributions:
4

Re: PCI question about seeing my images

v138a PCI question
If you are truly using ZenCart version 1.3.8a - You need to upgrade

There are known vulnerabilities in 1.3.8a

Zen-Venom Get Bitten

20 Sep 2012, 6:06 PM
#4
sir_paolo avatar

sir_paolo

New Zenner

Join Date:
Oct 2009
Location:
Assachusetts
Posts:
11
Plugin Contributions:
0

Re: PCI question about seeing my images

The people that built our site didn't prepare it for upgrades. They made changes that do not accommodate upgrades. That's why we have yet to upgrade. But we will now that you mention it. Thank You.