Warning: I am able to write to the configuration file

Hi,

I've set the permissions on the includes/configure.php file to be read only ( 444 ) and confirmed this with my web host however, I still get the warning messages. The host is running My SQl 4.x PHP 4.4.1 Apache 1.3.

If I change permissions to none then I get the page message " The requested URL /registry/zc_install/index.php was not found on this server." this would indicate that the permissions are changed on server.

Regards,
Robert.

and how about the admin/includes/configure.php?

azrahn:

and how about the admin/includes/configure.php?

That file is set to 644.

And which configure.php file are you getting the warning on?

If it's the admin, try that at 444 (or similar) too.

I'm getting the message from the zen\include\configure.php but I changed the admin configure.php to 444 and the problem persists.

I'm thinking that I should try a fresh install, but I hesitate since I would have to redo all of my customization.

There are 2 configure files. One at includes/configure.php and the other at admin/includes/configure.php. Are they both 644?

They are both at 444. Would a reinstall be of any use?

You are positive that they are set to 444 ...

As in after you set them you checked once more to make sure the setting took?

If that is the case ... and this only happens on rare rare occaisions with hosts that usually have something not configured quite right on the server ... you can comment out the error ...

We do not like this as being the method you use ...

Can you please check once more the settings on:
/includes/configure.php

/admin/includes/configure.php

and make sure that they are, in fact set to 444 ...

robertbob:

They are both at 444. Would a reinstall be of any use?

Re-installing won't make any difference.

Some hosts have more isolated security arrangements and thus allow more direct access to their customers' files. The warning is telling you that if someone were to get past Zen Cart's security systems, they could possibly read or change those very important configuration files. Thus it's important to find a way to prevent the warning message, rather than merely suppress it.

The message is saying that the webserver, using PHP, is able to write to the file, according to the access check that PHP does against the file.

Sometimes, although rare, it's necessary to set these files to 400 instead of the common 444 or 644. Any lower than 400 may cause you to lose access to the file.

Some hosts have security configured such that even when you "ask" the server to set the files to 444, they remain at 644 or even get changed again later by a server security or filesystem properties check. This is why folks have asked to check and double-check what the permissions are ;)

(I've combined some of this information into the FAQ on this topic, available here:
https://www.zen-cart.com/tutorials/index.php?article=90 )

Thanks for all of the suggestions, however, even when I set the permissions to 400 on both configure files I still get the warning message. I agree that disabling the warning is not the ideal solution but I am running out of options.

I set the file premissions with my webhost file manager software and then I log out and double check them with an FTP software and it does confirm the permission setting to be at 400.

Very well - you can override it by following this approach:
http://www.zen-cart.com/forum/showthread.php?t=54400

But ... I'd be watching carefully to be sure your server doesn't have compromised security and is leaving you open for trouble...

If you were only advertising or using static pages, that's one thing ... but you're running a store, with private and confidential customer information and financial data flowing through it. That's quite another scenario -- and not one to be taken lightly.

Hi.

Highly unlikely but possible is that the account that apache runs under has admin rights on the directory's.
Then the files would always be writable by the webserver.

Ronald.

azrahn:

Hi.

Highly unlikely but possible is that the account that apache runs under has admin rights on the directory's.
Then the files would always be writable by the webserver.

Ronald.

Exactly -- which is a good reason to consider another host or get the server administrator to make some changes.

DrByte:

Exactly -- which is a good reason to consider another host or get the server administrator to make some changes.

Lol, if users need to tell admin these things you better GOTO another host.:yes:

Thank you all very much for your suggestions. The urgency of the project has diminished for now but I'll come back to this issue. I think that my next steps will be to start all afresh and install the new release.

Hi all

I am having the same problem

both configure.php files are set to 644 my cpanel won't let me set the permissions any higher

what i don't understand is why i am still getting the error, when the permissions are set to the level they are, I have read both the linked pages mentioned earlier but I just can't seem to figure it out

Had the same problem some time ago. The website Control Panel was showing 444 for this file but when I went through SHH and checked, it was rw-rw- r . I had to set manually: chmod 444 configure.php. It worked out.

Adam T.