Please can one of the forums Zen Cart developers tell me if I change the htaccess file in 'includes' would this compromise the cart and make it less secure?

The reason I ask is that I've been told by a payment system company to add |PHP|php to the end of the htaccess file like this.

deny everything

<FilesMatch ".*">
Order Allow,Deny
Deny from all
</FilesMatch>

but now allow just certain necessary files:

<FilesMatch ".*.(js|JS|css|CSS|jpg|JPG|gif|GIF|png|PNG|swf|SWF|xsl|XSL|PHP|php)$">
Order Allow,Deny
Allow from all
</FilesMatch>

IndexIgnore /

normally it would read

deny everything

<FilesMatch ".*">
Order Allow,Deny
Deny from all
</FilesMatch>

but now allow just certain necessary files:

<FilesMatch ".*.(js|JS|css|CSS|jpg|JPG|gif|GIF|png|PNG|swf|SWF|xsl|XSL)$">
Order Allow,Deny
Allow from all
</FilesMatch>

IndexIgnore /

Thanks

Nick

I would ask them why??

well I can answer that. Their processing system needs to access a callback.php file and serverresult.php file so orders are updated from pending to processing, which I have been told by them that it requires this change to the htaccess file. I found this a bit strange so I looked it up and I think you or Dr Byte commented that it should not be changed. The reason I found this strange is because to anyone that isn't a developer this would be a different language altogether and not the usual thing to do. Also there are no instructions inside the payment module saying this should happen.

I find myself questioning why? when its not listed as a change in the mod installation files, and there are no instructions to do this elsewhere?

A php file located on your hosting account should operate just fine without having that added

Nick1973:

Please can one of the forums Zen Cart developers tell me if I change the htaccess file in 'includes' would this compromise the cart and make it less secure?

The reason I ask is that I've been told by a payment system company to add |PHP|php to the end of the htaccess file like this.
EEEKS!!!!!!!
That would completely destroy the entire intention of the security measures in that .htaccess file.

The callback should NOT be put into the /includes/ folder. If they require that, then they've written it very poorly. Have them rewrite it so that it works from the root folder directly.