Question about changing the admin password

Hello's again.

We had an intrusion at our web host. Some Turk1sh h4ck3r guy replaced the root index.htm (which was just a redirect) and dumped some php scripts into an uploads directory.

So I'm in the process of changing lots of passwords. (wish my web host had secure FTP but, sigh, no.)

I see in Admin > tools > Admin settings where I can change the admin password, that's cool.
**
But how does that affect the non-writeable configuration files for database connectivity?**

Is it adviseable to change the database user passwords too (using PhpMyAdmin), and if so, how do I get those passwords into the config files? They are stored in the database encrypted, right? Looks like the configuration.php files also have the encrypted version of the admin password.

I am wondering what is the correct procedure, so I don't detach ZC from its beloved database.

---Diana

Hi dbrewster

Database info is stored in
includes\configure.php and admin\includes\configure.php

admin\includes\configure.php: define('DB_SERVER_USERNAME', 'root');
admin\includes\configure.php: define('DB_SERVER_PASSWORD', 'root');

includes\configure.php: define('DB_SERVER_USERNAME', 'root');
includes\configure.php: define('DB_SERVER_PASSWORD', 'root');

Just make sure to change the above lines

Please let us know if you have any further questions

Superprg,

thanks for the reply. I am aware of the configure.php files.

I still have a few questions.

Do I need to make the same user/pwd changes to the database as well? Are they completely separate, or must they be the same?

Are these settings completely separate from the admin login user account? If I change my admin pwd in Admin > Tools > Admin settings I can still use a completely distinct database user account?

Are the database user passwords stored unencrypted?

Thanks in advance for speedy answers, so I can get my passwords changed pronto.

dbrewster:

Superprg,

thanks for the reply. I still have a few questions.

Do I need to make the same user/pwd changes to the database as well? Are they completely separate, or must they be the same?

Zen cart will read database user/password from above files to connect to database
If you are changing this info in the file, then database password must also be changed

dbrewster:

Are these settings completely separate from the admin login user account? If I change my admin pwd in Admin > Tools > Admin settings I can still use a completely distinct database user account?

Yes,
Admin user and password is completelly seperate from database user/password.
Changing admin password has no effect on database change. It just changes the admin password and nothing else

Are the database user passwords stored unencrypted?
Yes, all mysql passwords are stored in encrypted form in user table in mysql database