X-Cart:Security Options - Revision history

Dohtur: /* P3P options */

2018-03-01T14:21:59Z

‎P3P options

Dohtur: /* P3P options */

2018-03-01T14:21:42Z

‎P3P options

Dohtur at 11:44, 19 February 2014

2014-02-19T11:44:45Z

Dohtur: /* General security options */

2013-12-30T12:55:18Z

‎General security options

Dohtur at 13:18, 18 January 2013

2013-01-18T13:18:15Z

Dohtur at 11:58, 20 June 2012

2012-06-20T11:58:29Z

Dohtur: /* HTTPS options */

2012-06-20T11:50:20Z

‎HTTPS options

Dohtur at 15:55, 19 June 2012

2012-06-19T15:55:44Z

Dohtur at 14:55, 19 June 2012

2012-06-19T14:55:46Z

Seyfin at 12:37, 11 March 2011

2011-03-11T12:37:27Z

@@ Line 58: / Line 58: @@
 == P3P options ==
-**Important**: This section was removed as is not available in X-Cart versions 4.7.10 and later.
+'''Important''': This section was removed as is not available in X-Cart versions 4.7.10 and later.
 This section allows you to define your store's privacy policy. P3P enabled web browsers will use the information provided in this section  to decide how to interact with your store site. For example, Microsoft Internet Explorer 6 can compare your store's privacy policy with the user's stored preferences to decide whether or not to allow cookies from your store site.

← Older revision		Revision as of 14:21, 1 March 2018
Line 57:		Line 57:

	== P3P options ==		== P3P options ==
		+
		+	Important: This section was removed as is not available in X-Cart versions 4.7.10 and later.

	This section allows you to define your store's privacy policy. P3P enabled web browsers will use the information provided in this section to decide how to interact with your store site. For example, Microsoft Internet Explorer 6 can compare your store's privacy policy with the user's stored preferences to decide whether or not to allow cookies from your store site.		This section allows you to define your store's privacy policy. P3P enabled web browsers will use the information provided in this section to decide how to interact with your store site. For example, Microsoft Internet Explorer 6 can compare your store's privacy policy with the user's stored preferences to decide whether or not to allow cookies from your store site.

@@ Line 5: / Line 5: @@
 * <u>Order emails encryption method</u>: Method that you wish to be used for encrypting order emails.
 * <u>Comma separated list of file extensions disallowed for uploading</u>: A comma separated list of disallowed file extensions (For example, php, pl, cgi, asp, exe, com, bat, pif). Uploading onto the server of files with these extensions will not be possible.
-* <u>Check if payment gateway response is coming from the IP's specified here (enter a comma separated list)</u>: A comma separated list of IP addresses from which payment gateway responses can be accepted.
+* <u>Check if payment gateway response is coming from the IP's specified here (enter a comma separated list)</u>: Use this field to add a comma separated list of "trusted" IP addresses from which your store should accept callbacks for payment methods with gateway hosted payment page. The complete list of IP addresses from which you can expect callbacks can be obtained from the respective payment gateway. ''Why it is necessary'': Payment systems with gateway hosted payment page can make callbacks to your store to inform about the status of the transaction on the side of the payment gateway. Malicious users may try to fake the information coming from the payment gateway to manipulate information about the order status in the store.
 * <u>Enable merchant key based blowfish encryption method</u>: Enabling this option enables Merchant key-based Blowfish encryption for order details. As soon as you select the check box and click the '''Save''' button, you are redirected to a page where you are offered to create a Merchant key - a password which is used by X-Cart to encrypt and decrypt order details using Blowfish encryption method. After you create a Merchant key, all the order details in your store are re-encrypted using this new key.

@@ Line 11: / Line 11: @@
 {{Note1|'''Important:''' You will be supposed to enter your Merchant key as a password every time you try to access order details. Make sure you keep your Merchant key in a secure place. If you forget your Merchant key, all the order details stored in your database will be lost, as you will not be able to decrypt them. Please also be aware that the 'Blowfish encryption method is enabled' option cannot be disabled without a valid Merchant key.}}
 {{XC versions|from=4.1.0|to=4.5.5}}
-* <u>Check MD5 of compiled templates for better store protection at a shared hosting</u>: If selected, a special routine checks if MD5 checksums of the compiled templates of pages served to a user's web browser match the authentic checksums for these templates. If the sums for a certain compiled template do not match, the template is discarded and compiled anew. Compiled templates whose MD5 checksum does not match the authentic one are considered potentially harmful: the detected checksum mismatch indicates that the PHP code of such templates has been altered and may possibly contain malicious code. Enabling this option is recommended if your X-Cart is installed at a shared (public) hosting.
+* <u>Check MD5 of compiled templates for better store protection at a shared hosting</u>: If selected, a special routine checks if MD5 checksums of the compiled templates of pages served to a user's web browser match the authentic checksums for these templates. If the sums for a certain compiled template do not match, the template is discarded and compiled anew. It is recommended to keep this option disabled at all times to avoid negative effect on the store's performance.
 {{Note1|'''Note:''' Starting with X-Cart version 4.5.5, the option 'Check MD5 of compiled templates for better store protection at a shared hosting' is no longer present on the 'General settings/Security options' page. The functionality of checking the MD5 checksums of compiled templates is now controlled by the value of the constant COMPILED_TPL_CHECK_MD5 in X-Cart's main configuration file [[X-Cart:Config.php|config.php]].}}

@@ Line 9: / Line 9: @@
 * <u>Enable merchant key based blowfish encryption method</u>: Enabling this option enables Merchant key-based Blowfish encryption for order details. As soon as you select the check box and click the '''Save''' button, you are redirected to a page where you are offered to create a Merchant key - a password which is used by X-Cart to encrypt and decrypt order details using Blowfish encryption method. After you create a Merchant key, all the order details in your store are re-encrypted using this new key.
-{{Note1|Important: You will be supposed to enter your Merchant key as a password every time you try to access order details. Make sure you keep your Merchant key in a secure place. If you forget your Merchant key, all the order details stored in your database will be lost, as you will not be able to decrypt them. Please also be aware that the 'Blowfish encryption method is enabled' option cannot be disabled without a valid Merchant key.}}
+{{Note1|'''Important:''' You will be supposed to enter your Merchant key as a password every time you try to access order details. Make sure you keep your Merchant key in a secure place. If you forget your Merchant key, all the order details stored in your database will be lost, as you will not be able to decrypt them. Please also be aware that the 'Blowfish encryption method is enabled' option cannot be disabled without a valid Merchant key.}}
-* <u>Check MD5 of compiled templates for better store protection at a shared hosting</u>: If selected, a special routine checks if MD5 checksums of the compiled templates of pages served to a user's web browser match the authentic checksums for these templates. If the sums for a certain compiled template do not match, the template is discarded and compiled anew. Compiled templates whose MD5 checksum does not match the authentic one are considered potentially harmful: the detected checksum mismatch indicates that the PHP code of such templates has been altered and may possibly contain malicious code.
+{{Note1|'''Note:''' Starting with X-Cart version 4.5.5, the option 'Check MD5 of compiled templates for better store protection at a shared hosting' is no longer present on the 'General settings/Security options' page. The functionality of checking the MD5 checksums of compiled templates is now controlled by the value of the constant COMPILED_TPL_CHECK_MD5 in X-Cart's main configuration file [[X-Cart:Config.php|config.php]].}}
 {{XC_4.1}}
 * <u>Include login/password used for authentication into the email notifications about failed login attempts:</u> If your store is configured to send email notifications about failed login attempts (i.e. if the option 'Login error notification to site administrator' and/or the option 'All login error notifications to site administrator' in the '<u>General settings/Email Notifications</u>' section are enabled), you can use this setting to specify whether you wish the login/password combinations used in the unsuccesful login attempts to be included into the above said email notifications. Please use your best judgement while adjusting this setting: on the one hand, enabling the inclusion of bad login/password combinations into the email notifications about failed login attempts may help you to spot account cracking activity at your website; on the other hand, if an email notification message containing the actual login/password combination mistyped by the account owner is intercepted by a malicious person, the actual login/password combination may be compromised.
@@ Line 33: / Line 33: @@
 * <u>Use HTTPS for users' login and registration</u>: If selected, existing users log in to the store and new users get registered using HTTPS.
-{{Note1|Important: If you decide to use HTTPS for users' login and registration, make sure you have a valid SSL certificate installed and configured on your web-server and the variable $https_location in config.php is set up properly. For more details please refer to: [[X-Cart:Configuring_HTTPS | Configuring HTTPS]]}}
+{{Note1|'''Important:''' If you decide to use HTTPS for users' login and registration, make sure you have a valid SSL certificate installed and configured on your web-server and the variable $https_location in config.php is set up properly. For more details please refer to: [[X-Cart:Configuring_HTTPS | Configuring HTTPS]]}}
 * <u>Use secure login form on a separate page (HTTPS)</u>: If selected, your store's authorization pages will provide links to special secure login pages allowing users to log in to the store using HTTPS.
@@ Line 43: / Line 43: @@
 * <u>Home path</u>: Path to PGP home directory (a directory where PGP configuration file and keyrings are stored).
-{{Note1|Note: All the files in PGP home directory must be owned by the user under which PGP is running (usually Web server) and must have UNIX 0600 permissions. The directory itself must have 0700 permissions.}}
+{{Note1|'''Note:''' All the files in PGP home directory must be owned by the user under which PGP is running (usually Web server) and must have UNIX 0600 permissions. The directory itself must have 0700 permissions.}}
 * <u>PGP binary path</u>: Path to PGP executable.
@@ Line 64: / Line 64: @@
 * <u>P3P policy reference file url (leave empty if not used)</u>: URL of your store's P3P policy reference file.
-{{Note1|Note: More information about P3P is available at W3C P3P site ([http://www.w3.org/P3P/ http://www.w3.org/P3P/]).}}
+{{Note1|'''Note:''' More information about P3P is available at W3C P3P site ([http://www.w3.org/P3P/ http://www.w3.org/P3P/]).}}
 == Test data encryption ==

@@ Line 17: / Line 17: @@
 * <u>Include login/password used for authentication into the email notifications about failed login attempts:</u> If your store is configured to send email notifications about failed login attempts (i.e. if the option 'Login error notification to site administrator' and/or the option 'All login error notifications to site administrator' in the '<u>General settings/Email Notifications</u>' section are enabled), you can use this setting to specify whether you wish the login/password combinations used in the unsuccesful login attempts to be included into the above said email notifications. Please use your best judgement while adjusting this setting: on the one hand, enabling the inclusion of bad login/password combinations into the email notifications about failed login attempts may help you to spot account cracking activity at your website; on the other hand, if an email notification message containing the actual login/password combination mistyped by the account owner is intercepted by a malicious person, the actual login/password combination may be compromised.
 {{XC_4.3}}
-* <u>DB backup reminder after the previous DB backup (in days):</u> This option allows you to specify how often the store administrator should be reminded to back up the store's database. If you do not wish to use the DB backup reminder, leave this field empty or set its value to 0(zero).
+* <u>DB backup reminder after the previous DB backup (in days):</u> This option allows you to specify how often the store administrator should be reminded to back up the store's database. The DB backup reminder will be displayed as a warning message in the store's Admin area. If you do not wish to use the DB backup reminder, leave this field empty or set its value to 0(zero).
 == PCI DSS compliance options ==

@@ Line 14: / Line 14: @@
 {{Note1|Note: Enabling this option is recommended if your X-Cart is installed at a shared (public) hosting.}}
 == PCI DSS compliance options ==
@@ Line 64: / Line 68: @@
 [[Category:X-Cart user manual]]
 [[Category:X-Cart user manual]]

@@ Line 13: / Line 13: @@
 * <u>Check MD5 of compiled templates for better store protection at a shared hosting</u>: If selected, a special routine checks if MD5 checksums of the compiled templates of pages served to a user's web browser match the authentic checksums for these templates. If the sums for a certain compiled template do not match, the template is discarded and compiled anew. Compiled templates whose MD5 checksum does not match the authentic one are considered potentially harmful: the detected checksum mismatch indicates that the PHP code of such templates has been altered and may possibly contain malicious code.
-{{Note1|Note: Enabling this option is recommended if your X-Cart is installed at a shared (public) hosting.}} PCI DSS compliance options
+{{Note1|Note: Enabling this option is recommended if your X-Cart is installed at a shared (public) hosting.}}
 * <u>Number of failed login attempts after which a user account must be suspended</u>: The number of login attempts that a user is allowed to make using an incorrect password before X-Cart automatically suspends their account. For compliance with PCI Data Security Standard, set this value to 6.
@@ Line 60: / Line 62: @@
 This section allows you to test whether PGP/GnuPG encryption is working correctly. For details, see [[X-Cart:PGP/GnuPG]] page.
 [[Category:X-Cart user manual]]