X-Cart:Security Profiles - Revision history

Dohtur at 07:37, 26 March 2013

2013-03-26T07:37:30Z

Dohtur: /* See also */

2013-03-26T07:32:35Z

‎See also

Dohtur at 12:30, 6 March 2013

2013-03-06T12:30:39Z

Dohtur at 21:13, 20 February 2013

2013-02-20T21:13:08Z

Dohtur at 21:05, 20 February 2013

2013-02-20T21:05:27Z

Dohtur at 19:02, 20 February 2013

2013-02-20T19:02:03Z

Dohtur at 18:32, 20 February 2013

2013-02-20T18:32:23Z

Dohtur at 13:53, 6 February 2013

2013-02-06T13:53:19Z

Dohtur at 07:53, 30 January 2013

2013-01-30T07:53:15Z

Dohtur at 07:52, 30 January 2013

2013-01-30T07:52:37Z

@@ Line 4: / Line 4: @@
 '''Live store''' security profile is a pre-set combination of security options that ensure a higher level of security for your store's data in production mode. This includes:
-# Enabled [[X-Cart:Config.php#Setting_the_protection_method_for_SQL.2Fsecurity_and_file_changes_from_the_Admin_area | 'ip'-based protection method]] for security-sensitive operations performed via your store's back end:
+# Enabled [[X-Cart:Protected_Mode#IPBasedProtectionMethod | 'ip'-based protection method]] for security-sensitive operations performed via your store's back end:
 #* SQL/security and upgrade/patch operations,
 #* file operations (upload of distribution files for ESD products) and template editing.

@@ Line 27: / Line 27: @@
 ==See also==
 * [[X-Cart:Config.php | X-Cart:Config.php]]
 [[Category:X-Cart user manual]]

@@ Line 15: / Line 15: @@
 :* const PROTECT_XID_BY_IP = 'secure_mask';<br />
-'''Evaluation/Playground''' is a security profile that allows you to work without the security limitations imposed by the '''Live store''' security profile. With this profile enabled, no protection is used for security-sensitive operations performed via X-Cart's Admin area, and session protection mechanism is disabled. This is caused by the following settings in config.php:
+'''Evaluation/Playground''' is a security profile that allows you to work without the security limitations imposed by the '''Live store''' security profile. With this profile enabled, no protection is used for security-sensitive operations performed via your store's back end, and session protection mechanism is disabled. This is caused by the following settings in config.php:
 :* const PROTECT_DB_AND_PATCHES = FALSE;<br />

@@ Line 4: / Line 4: @@
 '''Live store''' security profile is a pre-set combination of security options that ensure a higher level of security for your store's data in production mode. This includes:
-# Enabled [[X-Cart:Protected mode | 'ip'-based protection mode]] for security-sensitive operations performed via your store's back end:
+# Enabled [[X-Cart:Config.php#Setting_the_protection_method_for_SQL.2Fsecurity_and_file_changes_from_the_Admin_area | 'ip'-based protection method]] for security-sensitive operations performed via your store's back end:
 #* SQL/security and upgrade/patch operations,
 #* file operations (upload of distribution files for ESD products) and template editing.
@@ Line 28: / Line 28: @@
 ==See also==
 * [[X-Cart:Config.php | X-Cart:Config.php]]
 [[Category:X-Cart user manual]]

@@ Line 4: / Line 4: @@
 '''Live store''' security profile is a pre-set combination of security options that ensure a higher level of security for your store's data in production mode. This includes:
-# Enabled [[X-Cart:Protected mode | 'ip'-based protection mode]] for security-sensitive operations performed via X-Cart's Admin area:
+# Enabled [[X-Cart:Protected mode | 'ip'-based protection mode]] for security-sensitive operations performed via your store's back end:
 #* SQL/security and upgrade/patch operations,
 #* file operations (upload of distribution files for ESD products) and template editing.

@@ Line 25: / Line 25: @@
 : OR
 :* Manually readjust the values of the constants PROTECT_DB_AND_PATCHES, PROTECT_ESD_AND_TEMPLATES and PROTECT_XID_BY_IP in your store's file <u>config.php</u> .
 [[Category:X-Cart user manual]]

@@ Line 13: / Line 13: @@
 :* const PROTECT_DB_AND_PATCHES = 'ip';<br />
 :* const PROTECT_ESD_AND_TEMPLATES = 'ip';<br />
-:* const PROTECT_XID_BY_IP = 'mask';<br />
+:* const PROTECT_XID_BY_IP = 'secure_mask';<br />
 '''Evaluation/Playground''' is a security profile that allows you to work without the security limitations imposed by the '''Live store''' security profile. With this profile enabled, no protection is used for security-sensitive operations performed via X-Cart's Admin area, and session protection mechanism is disabled. This is caused by the following settings in config.php:

@@ Line 23: / Line 23: @@
 If you need to change the previously selected security profile, do one of the following:
 :* Re-run X-Cart's installer with the option '''Update config only''' enabled and select a different security profile.
-OR
+: OR
 :* Manually readjust the values of the constants PROTECT_DB_AND_PATCHES, PROTECT_ESD_AND_TEMPLATES and PROTECT_XID_BY_IP in your store's file <u>config.php</u> .
 [[Category:X-Cart user manual]]

@@ Line 1: / Line 1: @@
 In X-Cart versions 4.5.5 and later, during X-Cart installation you can choose a security profile for your store. The two available options are '''Evaluation/Playground''' and '''Live store'''.
 The store administrator selects the security profile at the step '''[[X-Cart:Installing_X-Cart_Using_the_Installation_Wizard#Preparing to install X-Cart database | Preparing to install X-Cart database]]''' of X-Cart's web installation:
-[[File:Security_profile.png|border]]
+: [[File:Security_profile.png|border]]
-The '''Live store''' security profile is a combination of security options that ensure a higher level of security for your store's data in production mode. This includes:
+'''Live store''' security profile is a pre-set combination of security options that ensure a higher level of security for your store's data in production mode. This includes:
 # Enabled 'ip'-based protection mode for security-sensitive operations performed via X-Cart's Admin area:
 #* SQL/security and upgrade/patch operations,
 #* file operations (upload of distribution files for ESD products) and template editing.
 # Enabled session protection mechanism ensuring that the session id of admin user is locked to the IP subnetwork including the IP address from which the admin session originated; this significantly reduces the possibility of a valid session being hijacked by an unauthorized person.
-const PROTECT_DB_AND_PATCHES = 'ip';
+'''Live store''' security profile corresponds to the following settings in config.php:
-test
+:* const PROTECT_DB_AND_PATCHES = 'ip';<br />
-const PROTECT_DB_AND_PATCHES = FALSE;
+'''Evaluation/Playground''' is a security profile that allows you to work without the security limitations imposed by the '''Live store''' security profile. With this profile enabled, no protection is used for security-sensitive operations performed via X-Cart's Admin area, and session protection mechanism is disabled. This is caused by the following settings in config.php:
-If you need to change the previously chosen security profile, re-run X-Cart's Installation Wizard with the option '''Update config only''' enabled, or simply edit your store's file <u>config.php</u> to readjust the values of the constants '''PROTECT_DB_AND_PATCHES''', '''PROTECT_ESD_AND_TEMPLATES''' and '''PROTECT_XID_BY_IP''' manually.
+If you need to change the previously selected security profile, do one of the following:
 [[Category:X-Cart user manual]]