Draft:Config.php - Revision history

Dohtur: /* X-Cart security keys */

2013-02-14T11:43:24Z

‎X-Cart security keys

Dohtur: /* X-Cart security keys */

2013-02-14T11:41:01Z

‎X-Cart security keys

Dohtur: /* X-Cart security keys */

2013-02-14T11:36:43Z

‎X-Cart security keys

Dohtur: /* Security keys */

2013-02-14T11:31:36Z

‎Security keys

Dohtur at 10:44, 14 February 2013

2013-02-14T10:44:34Z

Dohtur at 10:42, 14 February 2013

2013-02-14T10:42:21Z

Dohtur: /* Checking the authenticity of Social login admin profiles in xcart_xauth_user_ids */

2013-02-11T09:15:57Z

‎Checking the authenticity of Social login admin profiles in xcart_xauth_user_ids

Dohtur: /* Checking the authenticity of admin profiles in xcart_customers */

2013-02-11T09:15:06Z

‎Checking the authenticity of admin profiles in xcart_customers

Dohtur: /* Checking the authenticity of admin profiles in xcart_customers */

2013-02-08T15:58:30Z

‎Checking the authenticity of admin profiles in xcart_customers

Dohtur: /* Checking the authenticity of Social login admin profiles in xcart_xauth_user_ids */

2013-02-08T15:57:54Z

‎Checking the authenticity of Social login admin profiles in xcart_xauth_user_ids

@@ Line 242: / Line 242: @@
 ===X-Cart security keys===
 The variables $xc_security_key* are used to store X-Cart security keys that ensure the security of admin operations. These keys are involved in the generation of digital signatures used to ensure the authenticity of certain types of data stored in the database:
-* '''$xc_security_key_session''': This key is used for the generation of signatures for admin and (X-Cart PLATINUM) provider user profiles, password_reset_key, Social Login admin and (X-Cart PLATINUM) provider profiles and sessions.
+* '''$xc_security_key_session''': This key is used for the generation of signatures for admin and (X-Cart PLATINUM) provider user profiles, password reset keys, Social Login admin and (X-Cart PLATINUM) provider profiles and sessions.
 * '''$xc_security_key_config''': This key is used for the generation of signatures for critical xcart_config values.
 * '''$xc_security_key_general''': This key is used for X-Cart's X-Monitoring module.
 Without the key no one will be able to recreate the signature of a database record, so no one will be able to fake a database record by substituting their own data.
 Similarly to your store's $blowfish_key value, the values of $xc_security_key* variables must be unique per store and must be stored securely. To enhance the security of your store, it is recommended to periodically update the security keys by re-generating them. To re-generate your security keys, you only need to [[X-Cart:Advanced_Tools#Re-generate_the_Blowfish_Encryption_Key|re-generate your Blowfish key]]: the $xc_security_key* keys will be re-generated automatically along with the $blowfish_key value.

@@ Line 245: / Line 245: @@
 * '''$xc_security_key_config''': This key is used for the generation of signatures for critical xcart_config values.
 * '''$xc_security_key_general''': This key is used for X-Cart's X-Monitoring module.
 Similarly to your store's $blowfish_key value, the values of $xc_security_key* variables must be unique per store and must be stored securely. To enhance the security of your store, it is recommended to periodically update the security keys by re-generating them. To re-generate your security keys, you only need to [[X-Cart:Advanced_Tools#Re-generate_the_Blowfish_Encryption_Key|re-generate your Blowfish key]]: the $xc_security_key* keys will be re-generated automatically along with the $blowfish_key value.

@@ Line 241: / Line 241: @@
 ===X-Cart security keys===
-The variables $xc_security_key* are used to store X-Cart security keys that ensure the security of admin operations. These keys are involved in the generation of the digital signature used to ensure the authenticity of certain types of data stored in the database:
+The variables $xc_security_key* are used to store X-Cart security keys that ensure the security of admin operations. These keys are involved in the generation of digital signatures used to ensure the authenticity of certain types of data stored in the database:
 * '''$xc_security_key_session''': This key is used for the generation of signatures for admin and (X-Cart PLATINUM) provider user profiles, password_reset_key, Social Login admin and (X-Cart PLATINUM) provider profiles and sessions.
 * '''$xc_security_key_config''': This key is used for the generation of signatures for critical xcart_config values.
 * '''$xc_security_key_general''': This key is used for X-Cart's X-Monitoring module.
 Similarly to your store's $blowfish_key value, the values of $xc_security_key* variables must be unique per store and must be stored securely. To enhance the security of your store, it is recommended to periodically update the security keys by re-generating them. To re-generate your security keys, you only need to [[X-Cart:Advanced_Tools#Re-generate_the_Blowfish_Encryption_Key|re-generate your Blowfish key]]: the $xc_security_key* keys will be re-generated automatically along with the $blowfish_key value.

@@ Line 240: / Line 240: @@
 By default the value of this variable is set to '''2'''.
-===Security keys===
+===X-Cart security keys===
-'''$xc_security_key_session''' - admin and (X-Cart PLATINUM) provider user profiles, password_reset, Social Login admin and (X-Cart PLATINUM) provider profiles, sessions;<br />
+The variables $xc_security_key* are used to store X-Cart security keys that ensure the security of admin operations. These keys are involved in the generation of the digital signature used to ensure the authenticity of certain types of data stored in the database:
-'''$xc_security_key_config''' - xcart_config values;<br />
+* '''$xc_security_key_session''': This key is used for the generation of signatures for admin and (X-Cart PLATINUM) provider user profiles, password_reset_key, Social Login admin and (X-Cart PLATINUM) provider profiles and sessions.
-'''$xc_security_key_general''' - X-Monitoring.
+* '''$xc_security_key_config''': This key is used for the generation of signatures for critical xcart_config values.

@@ Line 187: / Line 187: @@
 The constant '''CHECK_CONFIG_INTEGRITY''' defines whether critical config values stored in the xcart_config table should be checked for authenticity in order to prevent their malicious faking and stealing. The possible values for this constant are '''TRUE''' and '''FALSE'''. It is highly recommended to keep this option enabled (set to '''TRUE''') at all times.
 The config values protected by '''CHECK_CONFIG_INTEGRITY''' are as follows:
   'site_administrator' => 'Site administrator email address', // without category
   'ip_register_codes' => 'List of IP addresses awaiting registration', // without category
@@ Line 197: / Line 198: @@
   'admin_sqlerror_notify' => 'Notify the site administrator about SQL errors in the store by email', // Email_Note
   'allow_ips' => 'Check if payment gateway response is coming from the IP\'s specified here (enter a comma separated list)', // Security
+</pre>
 ===Synchronizing user sessions of the primary store domain and additional domain aliases===
 <pre>
@@ Line 240: / Line 241: @@
 ===Security keys===
-'''$xc_security_key_session''' - admin and (X-Cart PLATINUM) provider user profiles, password_reset, Social Login admin and (X-Cart PLATINUM) provider profiles, sessions;
+'''$xc_security_key_session''' - admin and (X-Cart PLATINUM) provider user profiles, password_reset, Social Login admin and (X-Cart PLATINUM) provider profiles, sessions;<br />
-'''$xc_security_key_config''' - xcart_config values;
+'''$xc_security_key_config''' - xcart_config values;<br />
 '''$xc_security_key_general''' - X-Monitoring.

@@ Line 173: / Line 173: @@
 </pre>
-The constant '''CHECK_XAUTH_USER_IDS_INTEGRITY''' defines whether [[X-Cart:X-Social_Login_(ex_Janrain_Engage)_module | Social login]] admin and (X-Cart PLATINUM) provider profiles in the xcart_xauth_user_ids table should be checked for authenticity to prevent their malicious faking and stealing. The check ensures the integrity of the association between the Social login id of admin and provider users and their X-Cart user profiles. The check is intended to prevent a malicious user who manages to get their hands on a correct Social login id of an admin or provider user from using this id with their own X-Cart user profile. The possible values for this constant are '''TRUE''' and '''FALSE'''. It is highly recommended to keep this option enabled (set to '''TRUE''') at all times.
+The constant '''CHECK_XAUTH_USER_IDS_INTEGRITY''' defines whether [[X-Cart:X-Social_Login_(ex_Janrain_Engage)_module | Social login]] admin and (X-Cart PLATINUM) provider profiles in the xcart_xauth_user_ids table should be checked for authenticity to prevent their malicious faking and stealing. The check ensures the integrity of the association between the Social login id of admin and provider users and their X-Cart user profiles. The possible values for this constant are '''TRUE''' and '''FALSE'''. It is highly recommended to keep this option enabled (set to '''TRUE''') at all times.
 ===Checking the authenticity of the password_reset_key field in xcart_reset_passwords===

@@ Line 166: / Line 166: @@
 </pre>
-The constant '''CHECK_CUSTOMERS_INTEGRITY''' defines whether admin and (X-Cart PLATINUM) provider profiles in xcart_customers should be checked for authenticity to prevent their malicious faking and stealing. The possible values for this constant are '''TRUE''' and '''FALSE'''. It is highly recommended to keep this option enabled (set to '''TRUE''') at all times.
+The constant '''CHECK_CUSTOMERS_INTEGRITY''' defines whether admin and (X-Cart PLATINUM) provider profiles in the xcart_customers table should be checked for authenticity to prevent their malicious faking and stealing. The possible values for this constant are '''TRUE''' and '''FALSE'''. It is highly recommended to keep this option enabled (set to '''TRUE''') at all times.
 ===Checking the authenticity of Social login admin profiles in xcart_xauth_user_ids===