Need advice on hiring zen workers

Hi.

Before I ask the question, let me give you a little history. When I first started out, I hired a person to work on the cart for me. In the middle of doing the work for me, the worker found a lucrative government job and stopped doing work for me but expected payment. This worker changed all the passwords on everything until paid. I had to fight to get control of the situation and it was very stressful. Thanks to this negative experience, I decided to learn Zen Cart, especially since there are people here on Zen Cart forums who are not stingy with good advice.

I am now just too busy to do all the work necessary when it comes to uploading and setting up new products. I've interviewed a few people along the way but they seem unprofessional. Thanks to a very bad experience, I'm going to have to see the glass as half-empty when it comes to hiring people.

Here's what I want to do.

1. Hire someone who has a good reputation and resides in my state. This way, if the worker does wrong, he/she will be subject to litigation in my state. If not, contract will have to be signed that agrees that any legal problems are to be settled in my state. Person must be located in the USA either way. Unless the work can be done offline, see below.
2. Even with legal protections in place, I would like the worker to stay off the site and do the work offline... give to me and I upload it into the cart via patch or one of the tools. Problem is, the tool to batch populate the store...is no longer available for the latest version of Zen. When, if ever, will that be brought up to speed?

Anyone feel like sharing advice how I can be accommodated? I'm sure this question will help others along the way too.

Thanks in advance.

I can't address the first part of your post, except to say that several regular posters here have links to their companies in their signatures suggesting they do work on Zencart sites. Finding reliable people is a challenge for any business.

Second, as far as I know, there is a version of Easy Populate in the Plugins area which works with the latest Zencart version, and, though I haven't used them, I think the same could be said about the Apsona tool.

Although I'm not moving anytime soon... I can look into your wants/needs.

It's not difficult to run everything of yours on a 'live' testing server then forward the updates/patches to you if you like. I understand your hesitance releasing control of your site again, it just takes a bit more time ;)

My signature link has contact info site, email or PM if you would like to discuss.

Stevesh, when I upgraded I noticed it wasn't up-to-date but I'll check it out again. Thank You.

Twitch, When ready I'll contact you for a quote. Thanks (It could be a month or two as I have to comply with a contract before I can begin.)

My concern (or perhaps advice) for you in this situation, if you do go with the deliver to you option to be updated by you, is hopefully you have considered/have your own local site on which to test the provided files.

I will say that when I have been asked to help someone, one of my first suggestions is to create an admin profile that has (fill in blank) permissions, their normal admin folder to be changed to something else for the time being and to make similar changes in their .htaccess file so that they can change all of that info back and I won't be able to access the information further. It may seem odd that I who is willing to perform the work for compensation is suggesting to do these things, but if I were to ask someone else to help me, that's the kind of thing I would do, so why not suggest the same to them. I also advise of making an independent backup, etc... All of these things to ensure that if, heaven forbid, a mistake is made (not a malicious ransom event like you unfortunately experienced) then as all in this forum say, I have a backup to which to restore and compare against.

Oh yeah, as far as mass populating there are a few products out there that seem to be compatible with the latest ZC, I have my preferred one and it has it's strengths and weaknesses, but generally speaking doesn't matter, as long as the job can be done.

My deepest regrets for you having such a bad experience. Hopefully things will turn around for you. :)

If you are strongly opposed to giving a web developer access to your site, why not just set up a mirror site (AKA a development site). It's so daggone EASY to limit their exposure and access to just that ONE site, and it will protect your live site.

Sorry you had such a bad experience.. Don't understand folks who work like this.. Hope you find someone suitable..

DivaVocals:

If you are strongly opposed to giving a web developer access to your site, why not just set up a mirror site (AKA a development site). It's so daggone EASY to limit their exposure and access to just that ONE site, and it will protect your live site.

Sorry you had such a bad experience.. Don't understand folks who work like this.. Hope you find someone suitable..
And to think of it, don't many hosts offer ftp access such that the individual logging in is taken to
A designated location? (Ie that mirror site.)? There are ways in ZC also to limit the access when granting access to the admin panel.

Yes, you can set up an ftp user in cPanel (and probably others) which points to a particular subfolder and cannot access any other part of the server. You could even set one that had access to only your ZC /images/ folder so someone could upload product images and nothing else.

gjh42:

Yes, you can set up an ftp user in cPanel (and probably others) which points to a particular subfolder and cannot access any other part of the server. You could even set one that had access to only your ZC /images/ folder so someone could upload product images and nothing else.I haven't been able to set access to restrict to a specific set of folders using the cPanel tools, but with .htaccess I'll bet this very specific kind of access could be had.. Following this logic one could restrict someone to just the includes, admin, and MAYBE the images folder as this should cover most add-on installs..

DivaVocals:

I haven't been able to set access to restrict to a specific set of folders using the cPanel tools, but with .htaccess I'll bet this very specific kind of access could be had.. Following this logic one could restrict someone to just the includes, admin, and MAYBE the images folder as this should cover most add-on installs..

I would have to setup three different ftp "locations" to restrict to the level(s) described using the cPanel, but it could be done if that level of control was necessary. htaccess generally would not control a standard ftp program (such as filezilla or other related ftp programs), although perhaps you know a way to make it work. I know you do a lot of htaccess work.

mc12345678:

I would have to setup three different ftp "locations" to restrict to the level(s) described using the cPanel, but it could be done if that level of control was necessary. htaccess generally would not control a standard ftp program (such as filezilla or other related ftp programs), although perhaps you know a way to make it work. I know you do a lot of htaccess work.

I wasn't talking about using .htaccess to control ftp access.. As I said, I cannot give access to three specific folders to ONE FTP account using cPanel..

I don't do a lot of .htaccess work other than configuring the occasional URL re-write mod.. but I believe that htaccess could be used to restrict access to specific folders within a folder..

So altogether now..

Give FTP access to a subfolder which contais the dev/test site
Use .htaccess to restrict access to specific folders within the subfolder..

DivaVocals:

I wasn't talking about using .htaccess to control ftp access.. As I said, I cannot give access to three specific folders to ONE FTP account using cPanel..

I don't do a lot of .htaccess work other than configuring the occasional URL re-write mod.. but I believe that htaccess could be used to restrict access to specific folders within a folder..

So altogether now..

Give FTP access to a subfolder which contais the dev/test site
Use .htaccess to restrict access to specific folders within the subfolder..

And that was what I was thinking may not be possible (to restrict the access once the user has logged onto the dedicated dev/test site, primarily because or depending on the host and what setup(s) they allow). The OP (and anyone else following) would have to test that out to see if the host allows it. And of course, if not there are always other hosts.

mc12345678:

And that was what I was thinking may not be possible (to restrict the access once the user has logged onto the dedicated dev/test site, primarily because or depending on the host and what setup(s) they allow). The OP (and anyone else following) would have to test that out to see if the host allows it. And of course, if not there are always other hosts.

Yes.. it's possible to set INDIVIDUAL folder permissions using .htaccess.. Goodness.. i read this once so I Googled it and am posting the first article I found on the topic (there are MANY others)

** .htaccess ** can be used to protect folders on your account with a password-encryption. All files and subfolders within a folder protected by .htaccess will also be protected. Thus if you want to protect the whole website you should place .htaccess to public_html or httpdocs folder which is the public folder where your website files and folders are kept. But, if you want to protect only the specific folders, you will need to do that separately for each of the folders.
Note: If you have a Windows-based hosting plan, you cannot use .htaccess files. You can only use the .htaccess protection on the Apache-based Unix/Linux server.
1. Navigate to the folder that you want to protect

In the following example we would like to protect the admin folder of the ** Dynamic Flash Gallery ** in the public_html folder.
/users/user1/public_html/admin
Note: You need to keep the full path for the folder that you would like to protect. In our case the full path is /users/george/public_html/protected .
The remaining steps in this guide assume we are still in this folder.
2. Create a file named .htaccess

Use any text editor up to your choice to create a file called .htaccess (Note: the period at the beginning of the filename. Now, make sure that your text editor did not append a .txt suffix to the file name. (In Windows, you can do this by right-clicking the icon for the text file and selecting “Properties”.) If the file name does have a .txt suffix (i.e. ‘.htpasswd.txt’), remove the suffix by renaming the file.
3. Add the appropriate lines to the .htaccess file.

Using the same text editor (you chose in step 2), input the following.

AuthUserFile /users/george/public_html/admin/.htpasswd
AuthName “Title for Protected Site”
AuthType Basic
Require valid-user

Note:

2. beside AuthUserFile, you should put the full path, with /.htpasswd immediately following it. The above example shows /users/george/public_html/admin/.htpasswd

3. beside AuthName, input the words or phrase that you wish to appear as the title for the username/password input box.

DivaVocals:

Yes.. it's possible to set INDIVIDUAL folder permissions using .htaccess.. Goodness.. i read this once so I Googled it and am posting the first article I found on the topic (there are MANY others)

Found many similar articles, but they didn't identify that ftp was applicable, further looking into how to control access for ftp locations required files of various types, but so farhadnt found ones that said htaccess definitely could be used for ftp folder access. Did come across a site at carnegie mellon that addressed anymous site control, but there is no way that the OP wants to allow anonymous users on the developement site. And again that site identified the need to have permissions setup.

Okay, also, I haven't been able to test out the proposed solution yet, so if there is someone that has implemented it that way that can speak up to it's success, I'll stop blabbering. :) I haven't tried providing/limiting access to an ftp access outside of a designated folder.

mc12345678:

Found many similar articles, but they didn't identify that ftp was applicable, further looking into how to control access for ftp locations required files of various types, but so farhadnt found ones that said htaccess definitely could be used for ftp folder access. Did come across a site at carnegie mellon that addressed anymous site control, but there is no way that the OP wants to allow anonymous users on the developement site. And again that site identified the need to have permissions setup.

Okay, also, I haven't been able to test out the proposed solution yet, so if there is someone that has implemented it that way that can speak up to it's success, I'll stop blabbering. :) I haven't tried providing/limiting access to an ftp access outside of a designated folder.

Right.. I'm sure someone else can chime in and say HOW..

DivaVocals:

Right.. I'm sure someone else can chime in and say HOW..

You being facetious? :P

This thread seems to have meandered off-topic a bit...
Maybe I am fixed in my ways but I find it inconceivable to even THINK of anyone doing modifications to a working, profitable (hopefully) production site!!

I do not allow MYSELF that room for error. EVERYONE makes mistakes with the simplest modifications.

My method is that ALL mods however simple are done locally, no rush, no stress, then uploaded to a test site and tested again.

Only when all is finished (in the real sense of the word) are the changes copied to the production site in a matter of a few seconds. No interruptions, no half-done jobs, no rush, no stress and most importantly NO RISK.

Allowing a third party to bugger about with a production site seems criminally naive/negligent.

On the few occasions I have let a third party do work for me they use a development mirror with a temporary ftp user account.
When they are done, account deleted. They never have accesss to the live site.

That's my 10 cents.

torvista:

This thread seems to have meandered off-topic a bit...
Maybe I am fixed in my ways but I find it inconceivable to even THINK of anyone doing modifications to a working, profitable (hopefully) production site!!

I do not allow MYSELF that room for error. EVERYONE makes mistakes with the simplest modifications.

My method is that ALL mods however simple are done locally, no rush, no stress, then uploaded to a test site and tested again.

Only when all is finished (in the real sense of the word) are the changes copied to the production site in a matter of a few seconds. No interruptions, no half-done jobs, no rush, no stress and most importantly NO RISK.

Allowing a third party to bugger about with a production site seems criminally naive/negligent.

On the few occasions I have let a third party do work for me they use a development mirror with a temporary ftp user account.
When they are done, account deleted. They never have accesss to the live site.

That's my 10 cents.

And that's the route the OP appears to basically be trying to go. What we were most recently trying to formalize was the method to allow an individual access to the mirror site, and possibly locking that access down to the smallest fle structure area desired but still have a functional test site.

What happened in the past, well, it appears that some lessons have been learned and actions being taken to minimize the likelihood of reoccurrence.

mc12345678:

What we were most recently trying to formalize was the method to allow an individual access to the mirror site, and possibly locking that access down to the smallest fle structure area desired but still have a functional test site.

Exactly.. If you follow the full discussion, I do not think we went off topic at all.. Based on the OPs ORIGINAL post, the OP seems MORE THAN reluctant to allow full access to any aspect of their site. Presumably this could include reluctance to provide access to a dev/test site as well. Additionally the OP clearly expressed that they may on occasion still require the services of someone to make changes to their site for them as they do not feel they have the a. time or b. skill to do so themselves. So ideas were offered as an alternative for providing an outside web dev access..

Personally I don't think the additional restrictions are NECESSARY on a DEV site.. but I didn't go through what the OP went through.. So if he is interested in these additional restrictions, I don't see why they shouldn't be discussed..