Upgrade help - stuck on problem configure.php is not writeable ?

So I'm at the very beginning of setting up my zen-cart. I did the install through Hostgators quickinstall system.

But for some reason it installed 1.5.0 instead of 1.5.1 so I want to upgrade now before I get started customizing & building my site.

I copied all new files into my from the 1.5.1 download & ran the zc_install & started going through the walk-thru but am stuck on the "Prerequisites" part

There seems to be the problem found of "store configure.php is not writeable, more info"

When I click on "more info" link it tells me to change the permissions of the files includes/configure/php to 777 (I'm using Filezilla as an FTP) & I did that but it's still not clearing up that issue allowing me to upgrade.

Am I missing something?

Thanks.

Most hosts will not allow a permissions change from 444 to anything higher via FTP, (especially if it's being attempted with a vulnerable program like filezilla).

444 to 644, or 666, or 777 is only possible via the C-PANEL.

Hmm ok, I will try through Cpanel, probably tomorrow, I am beat & going to bed.

Just for the record, I was able to change the permissions to 777 via filezilla, why would it show the change but not work?

So filezilla is bad & vulnerable? What other FTP do you suggest that is highly secure?

JohnnyScience:

Hmm ok, I will try through Cpanel, probably tomorrow, I am beat & going to bed.

Just for the record, I was able to change the permissions to 777 via filezilla, why would it show the change but not work?

So filezilla is bad & vulnerable? What other FTP do you suggest that is highly secure?

Filezilla may report (falsely) that permissions have changed, but if the host disallows changing 444 (or stronger) via FTP then it will not have changed.

My personal view (about programs to handle the management of an eCommerce site) is not shared by everyone. A lot of people try to set up a web business on less than a shoe-string, so go for ultra-cheap or free on everything. This is not always a good idea, because if you are serious about your business (ie: it's more than just an after-hours hobby), then you chief concern is security and reliability. For a budget of around £75, you can get some very good programs for site management.

Filezilla is a "competent" ftp program, and is fine if you are not involved in eCommerce sites. But it does not encrypt passwords, and I find its interface very clunky. I use WSFTP Professional from IpSwitch, which is FAR better, more intuitive, and is secure. Cost is under £40 .

I don't mind spending money on my business to make it better, but with so much free open-source software out there, it's hard to justify paying for it sometimes. And free open-source doens't mean bad... I mean come on were on Zen carts forum, supposedly one of the top e-commerce platforms and yet, it's free!

Filezilla is all I've ever really used, so I just suppose I'm used to it's clunkyness.

I do want security & reliability to be high though - but are you referring to when my clients are logged in to place an order or strictly me just editing/upgrading files through FTP?

I figured Zen cart has it's own security built in since its an ecommerce website to keep my clients using/surfing/buying off of the website safe? Are you saying I need something on top of Zen cart in order for this to be the case?

What programs are you suggesting for site management? I figured an FTP to make HTML & CSS changes & then use zen carts dashboard to make changes inside itself

JohnnyScience:

I don't mind spending money on my business to make it better, but with so much free open-source software out there, it's hard to justify paying for it sometimes. And free open-source doens't mean bad... I mean come on were on Zen carts forum, supposedly one of the top e-commerce platforms and yet, it's free!

Filezilla is all I've ever really used, so I just suppose I'm used to it's clunkyness.

I do want security & reliability to be high though - but are you referring to when my clients are logged in to place an order or strictly me just editing/upgrading files through FTP?

I figured Zen cart has it's own security built in since its an ecommerce website to keep my clients using/surfing/buying off of the website safe? Are you saying I need something on top of Zen cart in order for this to be the case?

What programs are you suggesting for site management? I figured an FTP to make HTML & CSS changes & then use zen carts dashboard to make changes inside itself

There are many excellent opensource programs out there, but the choice of what you use must also be based on RISK. Even with zencart, you are taking a RISK using it. (very small one, but a risk nevertheless). There is no "come-back" on opensource... you use it at your own risk.

Fortunately, zencart (1.5.1) is a very secure and well-built system, with a committed team behind it, who tweak it constantly to keep a step ahead of crooks.

Filezilla is "ok" as a FTP program, but the issue I have with it is that it does not encrypt server login data. You just need some key-logging trojan to find its way onto your home machine, and your passwords to your server(s) will be captured.

So for SOME programs, it is worth considering spending a few bucks on getting proper security. I have seen (and fixed) a significant number of hacked sites, and in two recent instances, the hacks were traced to a key-logger and filezilla was a very strong suspect for kicking open the barn door.

schoolboy:

There are many excellent opensource programs out there, but the choice of what you use must also be based on RISK. Even with zencart, you are taking a RISK using it. (very small one, but a risk nevertheless). There is no "come-back" on opensource... you use it at your own risk.

Fortunately, zencart (1.5.1) is a very secure and well-built system, with a committed team behind it, who tweak it constantly to keep a step ahead of crooks.

Filezilla is "ok" as a FTP program, but the issue I have with it is that it does not encrypt server login data. You just need some key-logging trojan to find its way onto your home machine, and your passwords to your server(s) will be captured.

So for SOME programs, it is worth considering spending a few bucks on getting proper security. I have seen (and fixed) a significant number of hacked sites, and in two recent instances, the hacks were traced to a key-logger and filezilla was a very strong suspect for kicking open the barn door.

So there is no free, secure FTP that encrypts your login info? If I'm on my home computer setup on my own network with WPA2-PSK how un-secure am I and where can the attack come from that would log my admin info when using a FTP such as Filezilla or a similar program?

WinSCP works very well, and is free.

When working with a server other than your own PC, it's up to you and your hosting company to set up "secure FTP" though. If you transmit passwords unencrypted then you're just inviting someone to steal them.

So is this "Secure FTP" generally only possible via cPanel? (or one of these paid programs?)

WinSCP doesn't completely eliminate this security hole? But it's much better than Filezilla at least?

With FTP I don't mess around. It is heavily targeted by hackers and crooks. When you are working with eCommerce you have a duty of care to people who shop on your site, because slack attitudes can end up presenting them with big hassles if credit card and personal info is stolen.

For a few bucks I use a good, professional system - WSFTP Pro - removing one layer of potential problems that can be massively costly otherwise.

JohnnyScience:

So is this "Secure FTP" generally only possible via cPanel? (or one of these paid programs?)

WinSCP doesn't completely eliminate this security hole? But it's much better than Filezilla at least?

FileZilla is an FTP application. Its weakness is that it stores passwords in plain text, so is vulnerable to trojan attacks on your computer.
WinSCP isn't a magic pill. Nor is WSFTP. But they don't store passwords in plain text, so don't have the vulnerability that FileZilla has.
That said, if YOU tell ANY program to use plain old "FTP" protocol when talking to a webserver/ftpserver, YOU will be passing YOUR passwords AND all your data in plain text, unencrypted.
To overcome that, you need to arrange for using a secure FTP method, such as SFTP or SCP/SSH or FTP-with-implicit-SSL etc, with your hosting company so that you can transmit your data in a manner that encrypts/protects all the data you exchange between your PC and the server.

Just like using SSL on pages that collect passwords or personal or financial/creditcard information.

You can read up all about all these concepts using your favorite search engine and probably wikipedia etc. If your hosting company doesn't know what you're talking about, find one that does before you spend any money with them.

As for making the configure.php files writable, 777 or 755 should do the job. If it doesn't, contact the hosting company for assistance.

DrByte:

... you need to arrange for using a secure FTP method, such as SFTP or SCP/SSH or FTP-with-implicit-SSL etc, with your hosting company so that you can transmit your data in a manner that encrypts/protects all the data you exchange between your PC and the server.

All good hosts now make this mandatory. Our host no longer allows insecure FTP and all connections are now via SSL.

As Dr Byte says, if your host is not insisting on this, then they are behind the curve - and that suggests they are behind the curve elsewhere too.