X-Cart:Security related tips - Revision history

Admin: /* See also */

2011-11-22T08:42:05Z

‎See also

Vladimir Gurinenko: /* Log off when you walk away */

2011-09-01T17:33:02Z

‎Log off when you walk away

Vladimir Gurinenko: Added "Log off when you walk away"

2011-09-01T13:08:15Z

Added "Log off when you walk away"

Admin at 12:52, 22 June 2011

2011-06-22T12:52:50Z

Seyfin: /* Protect X-Cart files and directories */

2011-03-23T08:25:24Z

‎Protect X-Cart files and directories

Admin: /* Protect the installation script install.php */

2010-01-11T08:26:46Z

‎Protect the installation script install.php

Admin: /* Protect the installation script install.php */

2010-01-11T08:26:24Z

‎Protect the installation script install.php

Admin at 08:25, 11 January 2010

2010-01-11T08:25:19Z

Admin: Created page with 'After the installation is completed, you must ensure the security of your X-Cart installation and source code. It is strongly recommended you take the following steps. == Protec…'

2010-01-11T08:25:05Z

Created page with 'After the installation is completed, you must ensure the security of your X-Cart installation and source code. It is strongly recommended you take the following steps. == Protec…'

New page

After the installation is completed, you must ensure the security of your X-Cart installation and source code. It is strongly recommended you take the following steps.

== Protect the installation script install.php ==

You must ensure that the installation script install.php you used to install X-Cart is well protected from unauthorized access. This is essential because anyone with access to this script can re-install your store or change your store's skin set/layout.

X-Cart provides a mechanism protecting the script install.php after the installation: at the last step of the installation procedure,install.php is renamed to something like install-file-YY-MM-DD-xxxxx.php (The new filename is displayed to you at the last step of the installation procedure and sent to you in the email notification). In the filename install-file-YY-MM-DD-xxxxx.php, the portion YY-MM-DD stands for the year, month and date when the file was renamed, and the portion xxxxx is a randomly generated code. After the renaming, the installation script cannot be run. To be able to use the installation script again, you need to change its name back to install.php using FTP, SSH or any other type of direct access to the file system (Control Panel and the like).

The renaming mechanism may fail if, for example, file renaming is forbidden on your system. If X-Cart fails to rename install.php, the 'Installation complete' message at the last step of X-Cart installation will say so. In this case, you will need to either rename the file install.php manually or remove it from the web-accessible directory keeping a copy of the file in a safe place. Later, if you need to re-install your X-Cart store, you will be able to re-upload the script install.php to /xcart directory and run the installation the same way you did it the first time.

== Protect the X-Cart distribution package ==

To prevent unauthorized access to X-Cart source code, be sure to remove the X-Cart distribution package archive you used to install your store from the web-accessible directory.

== Protect X-Cart files and directories ==

You must ensure that the files and directories of your X-Cart installation are protected by secure permissions.

During X-Cart installation, the installation script automatically sets the required secure permissions on the files and directories that need to be protected. If it is not able to change the permissions, the 'Installation complete' message at the last step of X-Cart installation will say so and provide a list of files/directories for which the permissions need to be re-adjusted. Be sure to re-adjust the permissions as advised.

For all X-Cart files and directories secure permissions must be set. Change the permissions as advised below.

<pre>
> chmod 644 config.php
> chmod 755 var
</pre>

@@ Line 34: / Line 34: @@
 ==See also==
 * [[X-Cart:Security Options]]
-* [[X-Cart:Store_Security | X-Cart: Store Security]]
+* [[X-Cart:Store Security]]
 [[Category:X-Cart user manual]]
 [[Category:X-Cart user manual]]

@@ Line 30: / Line 30: @@
 == Log off when you walk away ==
-If you are using your computer and need to walk away from it for whatsoever reason, even for just a few moments, log off from the admin area or lock your workstation.
+If you are using your computer and need to walk away from it for whatsoever reason, even for just a few moments, log off from the admin area of your store or lock your workstation.
 ==See also==

@@ Line 25: / Line 25: @@
 > chmod 755 var
 </pre>
 ==See also==

@@ Line 26: / Line 26: @@
 </pre>
-See also: [[X-Cart:Store_Security | X-Cart: Store Security]]
+==See also==
 [[Category:X-Cart user manual]]
 [[Category:X-Cart user manual]]

@@ Line 25: / Line 25: @@
 > chmod 755 var
 </pre>
 [[Category:X-Cart user manual]]

@@ Line 5: / Line 5: @@
 You must ensure that the installation script <u>install.php</u> you used to install X-Cart is well protected from unauthorized access. This is essential because anyone with access to this script can re-install your store or change your store's skin set/layout.
-X-Cart provides a mechanism protecting the script <u>install.php</u> after the installation: at the last step of the installation procedure,<u>install.php</u> is renamed to something like <u>install-file-YY-MM-DD-xxxxx.php</u>(The new filename is displayed to you at the last step of the installation procedure and sent to you in the email notification). In the filename <u>install-file-YY-MM-DD-xxxxx.php</u>, the portion YY-MM-DD stands for the year, month and date when the file was renamed, and the portion xxxxx is a randomly generated code. After the renaming, the installation script cannot be run. To be able to use the installation script again, you need to change its name back to <u>install.php </u>using FTP, SSH or any other type of direct access to the file system (Control Panel and the like).
+X-Cart provides a mechanism protecting the script <u>install.php</u> after the installation: at the last step of the installation procedure,<u>install.php</u> is renamed to something like <u>install-file-YY-MM-DD-xxxxx.php</u>(The new filename is displayed to you at the last step of the installation procedure and sent to you in the email notification). In the filename <u>install-file-YY-MM-DD-xxxxx.php</u>, the portion YY-MM-DD stands for the year, month and date when the file was renamed, and the portion xxxxx is a randomly generated code. After the renaming, the installation script cannot be run. To be able to use the installation script again, you need to change its name back to <u>install.php</u> using FTP, SSH or any other type of direct access to the file system (Control Panel and the like).
 The renaming mechanism may fail if, for example, file renaming is forbidden on your system. If X-Cart fails to rename <u>install.php</u>, the 'Installation complete' message at the last step of X-Cart installation will say so. In this case, you will need to either rename the file install.php manually or remove it from the web-accessible directory keeping a copy of the file in a safe place. Later, if you need to re-install your X-Cart store, you will be able to re-upload the script <u>install.php</u> to <u>/xcart</u> directory and run the installation the same way you did it the first time.

← Older revision		Revision as of 08:25, 11 January 2010
Line 25:		Line 25:
	> chmod 755 var		> chmod 755 var
	</pre>		</pre>
		+
		+	[[Category:X-Cart user manual]]