Forums / Installing on a Linux/Unix Server / Able to write to the config file

Able to write to the config file

Locked

Views: 2,124

Results 1 to 7 of 7
This thread is locked. New replies are disabled.
6 Sep 2006, 7:01 PM
#1
copelandc2002 avatar

copelandc2002

New Zenner

Join Date:
Aug 2006
Posts:
9
Plugin Contributions:
0

Able to write to the config file

Hello All:
Getting this message at the top of the page on my cart:
Warning: I am able to write to the configuration file: ...... This is a potential security risk - please set the right user permissions on this file (read-only, CHMOD 644 or 444 are typical).

I took out the link there in the message, but I've been through the other messages on this site and have changed the file permissions using both ftp and the file manager provided by host, still no luck. I've talked with the host and they said that they have "opened" it up for me to make those type of changes but no luck. Also I've tried renaming the file, changing the perms and then naming it back, still to no avail. Feel like I'm out of options here as I don't know what else to do. Any help?

Thanks!

6 Sep 2006, 7:05 PM
#2
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,515
Plugin Contributions:
176

Re: Able to write to the config file

When you use your FTP program to look at the file's permissions, what is it saying they're set to?

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

6 Sep 2006, 7:20 PM
#3
copelandc2002 avatar

copelandc2002

New Zenner

Join Date:
Aug 2006
Posts:
9
Plugin Contributions:
0

Re: Able to write to the config file

In the FTP app it is saying 444 and in the file manager on the host it is saying 444, I've also done this with the 644 option as well. I've attached some gifs of both. Thanks for looking.

6 Sep 2006, 7:26 PM
#4
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,515
Plugin Contributions:
176

Re: Able to write to the config file

if you use 400, does that stop your store from working at all?

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

6 Sep 2006, 7:40 PM
#5
copelandc2002 avatar

copelandc2002

New Zenner

Join Date:
Aug 2006
Posts:
9
Plugin Contributions:
0

Re: Able to write to the config file

Nope, didn't stop the store but the message is still there.

6 Sep 2006, 7:45 PM
#6
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,515
Plugin Contributions:
176

Re: Able to write to the config file

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

6 Sep 2006, 8:50 PM
#7
copelandc2002 avatar

copelandc2002

New Zenner

Join Date:
Aug 2006
Posts:
9
Plugin Contributions:
0

Re: Able to write to the config file

Alright DrB., I believe that is what the problem is. The server is running php 4.4.1. I've gone thru all the chmod's and such, it is a nix server. I checked out on the php site and looked thru the is_writable function, looks like there was a problem there so I took what they had there as a check and wrote a quick script to check the perms. I tested them out on my local and know that it works and was getting that it wasn't writeable, uploaded the script to the site and saw that it wasn't writable either even though the is_writable is saying that it is. I just really don't like the idea of changing the variable to turn off that checking because of a php error in the function. I think it is a good check and would really rather continue using it but I guess until ISP upgrades I'm stuck. Any suggestions on how to speed them up to the process. Thanks for all your help.

Recap:
Final solution for me is to overwrite the variable as PHP 4.4.1 is_writable is coming back erroneous as I know it's read only, don't like it, but looks like I'm stuck with it.

Attached script to check it all out:

<?php function is__writable($path) { //Function taken from php.net user contributed note on is_writable function if ($path{strlen($path)-1}=='/') //Start function again with tmp file... return is__writable($path.uniqid(mt_rand()).'.tmp'); elseif (ereg('.tmp', $path)) { //Check tmp file for read/write capabilities if (!($f = @fopen($path, 'w+'))) return false; fclose($f); unlink($path); return true; } else //We have a path error. return 0; // Or return error - invalid path... } $filename = 'includes/configure.php'; if (is_writable($filename)) { echo 'PHP is_writable function: The file is writable<br>'; } else { echo 'PHP is_writable function: The file is not writable<br>'; } if (is__writable($filename)) { echo 'Custom is__writable function: The file is writable<br>'; } else { echo 'Custom is__writable function: The file is not writable<br>'; } ?>