X-Cart:Store Security - Revision history

Mouse at 10:01, 22 July 2020

2020-07-22T10:01:28Z

Aim: ADMIN_ALLOWED_IP/$admin_allowed_ip

2018-02-01T07:55:09Z

ADMIN_ALLOWED_IP/$admin_allowed_ip

Dohtur: /* SECURITY_BLOCK_UNKNOWN_ADMIN_IP */

2016-02-25T10:28:38Z

‎SECURITY_BLOCK_UNKNOWN_ADMIN_IP

Dohtur: /* How to secure your X-Cart */

2016-01-11T15:06:38Z

‎How to secure your X-Cart

Dohtur: /* How to secure your X-Cart */

2016-01-11T12:39:22Z

‎How to secure your X-Cart

Dohtur: /* How to secure your X-Cart */

2016-01-11T11:08:35Z

‎How to secure your X-Cart

Dohtur: /* How to secure your X-Cart */

2016-01-11T11:03:49Z

‎How to secure your X-Cart

Dohtur: /* How to secure your X-Cart */

2016-01-11T10:51:33Z

‎How to secure your X-Cart

Dohtur: /* How to secure your X-Cart */

2016-01-11T10:49:24Z

‎How to secure your X-Cart

Dohtur: /* How to secure your X-Cart */

2016-01-11T09:51:08Z

‎How to secure your X-Cart

@@ Line 271: / Line 271: @@
 The main purpose of these identifiers is to ensure authenticity of the form when the form is submitted by the user: if the submitted form contains a valid form identifier, the form is recognized as that generated by X-Cart in the current user's session, and therefore it detected as valid and safe for use. If there is no valid form identifier, the form is treated as suspicious and the submit process is canceled.
-Information about the CSRF attacks: http://en.wikipedia.org/wiki/Cross-site_request_forgery
+Information about the CSRF attacks: https://en.wikipedia.org/wiki/Cross-site_request_forgery
 There are sooooo many web applications that just don't have such a protection :-(

@@ Line 299: / Line 299: @@
 PHPIDS (PHP Intrusion Detection System) is an open source PHP Web Application Intrusion Detection System. PHPIDS detects Cross-site scripting (XSS), SQL injection, header injection, Directory traversal, Remote File Execution, Local File Inclusion, Denial of Service (DoS). It is simple to use and well structured. It provides impact of every attack by analyzing any chosen input variables as POST, GET, SESSION, COOKIE. Find out more at http://phpids.org/
-By default there's no IP-based limitations on accessing X-Cart admin area. To make your admin area more secure you can define IP-based restrictions by editing the '''$admin_allowed_ip''' parameter in the <u>config.php</u> file located in the X-Cart root directory as shown below.
+===[[X-Cart:Config.php#Restricting_access_to_the_store.27s_back_end_by_IP|ADMIN_ALLOWED_IP/$admin_allowed_ip]]===
 '''Example:'''
 <pre>
-$admin_allowed_ip = "192.168.0.1, 127.0.0.1";
+const ADMIN_ALLOWED_IP = "192.168.0.1, 192.168.16.45";
 </pre>
-This will make the access limited to users from IP addresses 192.168.0.1 and 127.0.0.1.
+This will make the access limited to users from IP addresses 192.168.0.1 and 192.168.16.45.
 == Maintaining X-Cart security ==

@@ Line 228: / Line 228: @@
 ==Seven security features that you might not know yet==
-===SECURITY_BLOCK_UNKNOWN_ADMIN_IP===
+===BLOCK_UNKNOWN_ADMIN_IP (in X-Cart versions before 4.5.5 named SECURITY_BLOCK_UNKNOWN_ADMIN_IP)===
 The mode of enhanced protection. It allows you to control from which IP addresses users can access your x-cart.
-By default, it is disabled. To turn it on, edit config.php file. Set this value
+By default, it is disabled (set to FALSE). To turn it on, edit config.php file. Set this value:
-<pre>SECURITY_BLOCK_UNKNOWN_ADMIN_IP</pre>
+<pre>BLOCK_UNKNOWN_ADMIN_IP</pre>
-to 'true', i.e.
+to 'TRUE':
-<pre>define("SECURITY_BLOCK_UNKNOWN_ADMIN_IP", true);</pre>
+<pre>const BLOCK_UNKNOWN_ADMIN_IP = TRUE;</pre>
-Immediately you enable this mode, you should login to x-cart admin so that your own IP address is registered in the system. After that, no user will be able to login to the admin back end until you register his/her IP address: all login attempts will be denied and the users will get an error message.
+Immediately after you enable this mode, you must login to X-Cart Admin back end so that your own IP address is registered in the system. After that, no user will be able to log in to the Admin back end until you register their IP address: all login attempts will be denied and the users will get an error message.
-If login/password, submitted by a user, are correct (i.e. correspond to the login/password of an existing user, and this user belongs to a type with permissions to access this x-cart zone), a request to register the user's IP address will be sent to x-cart administrator email.
+If the login/password submitted by a user are correct (i.e. correspond to the login/password of an existing user, and this user belongs to a type with permissions to access this X-Cart zone), a request to register the user's IP address will be sent to X-Cart administrator email.
-This notification will have information about the time of the login attempt, the username and the IP address. Thus you can consider whether or not to grant access to this user: by simply clicking on a link in the email.
+This notification will provide information about the time of the login attempt, the username and the IP address. This way you will be able to decide whether you should grant access to this user, and, if you choose to do so, will be able to grant access simply by clicking on a link in the email.
 As a result, the IP address will be registered in your store's list of allowed IP addresses.
-More information: [[X-Cart:User Access Control]]
+More information:
 === System Fingerprints===

@@ Line 161: / Line 161: @@
 Otherwise the speed-up tool for Javascript and CSS will not work!}}
 {{Note1|Note: Change <tt>http://www.yourdomain.com/x-cart-path/</tt> to the url to your error_message.php file.}}
+<div id="NginxHtaccess"></div>
 . '''Security for nginx/IIS (htaccess not-compatible) web servers''':<br />
 For nginx/IIS web servers which do not use htaccess files, it is strongly recommended to move the rules from the following folders:

@@ Line 73: / Line 73: @@
 * [[X-Cart:Setting_up_file_permissions | Setting up file permissions in X-Cart]]
-. Unless you are using the subscriptions module, '''do not store credit card information''' in your database. To disable, or to ensure that this setting is disabled, open your config.php file and ensure the $store_cc variable is set to false:
+. '''Do not store credit card information''' in your database. To disable, or to ensure that this setting is disabled, open your config.php file and ensure the $store_cc variable is set to false:
 <pre>$store_cc = false;</pre>

@@ Line 73: / Line 73: @@
 * [[X-Cart:Setting_up_file_permissions | Setting up file permissions in X-Cart]]
-. Turn off the option of sending credit card information in e-mails in the General Settings -> E-Mail Options section of your x-cart admin section.
+. Unless you are using the subscriptions module, '''do not store credit card information''' in your database. To disable, or to ensure that this setting is disabled, open your config.php file and ensure the $store_cc variable is set to false:
 <pre>$store_cc = false;</pre>
 . It is always a good idea to '''log into your x-cart admin section using https''' so that the data you transact during the x-cart session is encrypted. The following code will force your x-cart admins/providers to login using httрs:// by redirecting them when httр:// is used.
 Add this code to the .htaccess of your admin section (adjust your url):
@@ Line 103: / Line 101: @@
 RewriteRule ^(.*)$ https://www.your-domain.com/xcart-dir/provider/$1 [R=301,L]</pre>
 . The following .htaccess code, which can be placed in an .htaccess file in your store’s root directory (same directory as / and cart.php), will '''prevent access to sensitive areas of the x-cart file structure'''. If you are on a server that does not support .htaccess files, you will want to find alternate ways to block access to these files.
 <pre>Options +SymlinksIfOwnerMatch -Indexes
@@ Line 164: / Line 162: @@
 {{Note1|Note: Change <tt>http://www.yourdomain.com/x-cart-path/</tt> to the url to your error_message.php file.}}
 . '''Security for nginx/IIS (htaccess not-compatible) web servers''':<br />
 For nginx/IIS web servers which do not use htaccess files, it is strongly recommended to move the rules from the following folders:
 :* xcart/.htaccess
@@ Line 172: / Line 170: @@
 :* xcart/var/log/.htaccess
 to the configuration files of these servers, for example, nginx.conf on nginx web servers.<br />
-Optionally, you can also move there the htaccess rules from the paragraphs 7 and 8 of [[X-Cart:Store_Security#How_to_secure_your_X-Cart]].
+Optionally, you can also move there the htaccess rules from the paragraphs 6 and 7 of [[X-Cart:Store_Security#How_to_secure_your_X-Cart]].
 ==How do I set up secure login, registration and checkout in my X-Cart store?==

@@ Line 38: / Line 38: @@
 After securing the hosting environment, it is necessary to address security with x-cart itself. Taking the following steps will make great strides in securing your x-cart:
-. Ensure you have a secure https connection for your store using a valid SSL certificate.
+. Ensure you have a '''secure https connection''' for your store using a valid SSL certificate.
 For more details please refer to [[X-Cart:Store_Security#How_do_I_set_up_secure_login.2C_registration_and_checkout_in_my_X-Cart_store.3F | How do I set up secure login, registration and checkout in my X-Cart store?]].
-. Do not use the "master" x-cart admin account. To change this, login using your "master" x-cart admin account, create a new administrator with a username that is less generic. Log in as that new user and delete the "master" user account.
+. '''Do not use the "master" x-cart admin account'''. To change this, login using your "master" x-cart admin account, create a new administrator with a username that is less generic. Log in as that new user and delete the "master" user account.
-. Immediately password protect your admin and provider directories. You can usually password protect these directories using a control panel such as cPanel, or you can use .htaccess and .htpasswd files (Please find an example [[X-Cart:Store_Security#How_di_I_set_up_password_protection_for_my_X-Cart_admin_and_provider_areas.3F | here]], or run a quick google search if you are unsure how).
+. Immediately '''password protect your admin and provider directories'''. You can usually password protect these directories using a control panel such as cPanel, or you can use .htaccess and .htpasswd files (Please find an example [[X-Cart:Store_Security#How_di_I_set_up_password_protection_for_my_X-Cart_admin_and_provider_areas.3F | here]], or run a quick google search if you are unsure how).
-. Be aware of your site’s file permissions, as having loose file permissions in conjunction with an exploit can allow someone to write and execute files on your website. This is a very common exploit against x-cart so take this seriously. In general your file chmod permissions should appear as follows:
+. Be aware of your site’s '''file permissions''', as having loose file permissions in conjunction with an exploit can allow someone to write and execute files on your website. This is a very common exploit against x-cart so take this seriously. In general your file chmod permissions should appear as follows:
 <pre>File Type Permission
@@ Line 75: / Line 75: @@
 . Turn off the option of sending credit card information in e-mails in the General Settings -> E-Mail Options section of your x-cart admin section.
-. Unless you are using the subscriptions module, do not store credit card information in your database. To disable, or to ensure that this setting is disabled, open your config.php file and ensure the $store_cc variable is set to false:
+. Unless you are using the subscriptions module, '''do not store credit card information''' in your database. To disable, or to ensure that this setting is disabled, open your config.php file and ensure the $store_cc variable is set to false:
 <pre>$store_cc = false;</pre>
-. It is always a good idea to log into your x-cart admin section using https so that the data you transact during the x-cart session is encrypted. The following code will force your x-cart admins/providers to login using httрs:// by redirecting them when httр:// is used.
+. It is always a good idea to '''log into your x-cart admin section using https''' so that the data you transact during the x-cart session is encrypted. The following code will force your x-cart admins/providers to login using httрs:// by redirecting them when httр:// is used.
 Add this code to the .htaccess of your admin section (adjust your url):
@@ Line 103: / Line 103: @@
 RewriteRule ^(.*)$ https://www.your-domain.com/xcart-dir/provider/$1 [R=301,L]</pre>
-. The following .htaccess code, which can be placed in an .htaccess file in your store’s root directory (same directory as / and cart.php), will prevent access to sensitive areas of the x-cart file structure. If you are on a server that does not support .htaccess files, you will want to find alternate ways to block access to these files.
+. The following .htaccess code, which can be placed in an .htaccess file in your store’s root directory (same directory as / and cart.php), will '''prevent access to sensitive areas of the x-cart file structure'''. If you are on a server that does not support .htaccess files, you will want to find alternate ways to block access to these files.
 <pre>Options +SymlinksIfOwnerMatch -Indexes
@@ Line 164: / Line 164: @@
 {{Note1|Note: Change <tt>http://www.yourdomain.com/x-cart-path/</tt> to the url to your error_message.php file.}}
-. Security for nginx/IIS (htaccess not-compatible) web servers:
+. '''Security for nginx/IIS (htaccess not-compatible) web servers''':<br />
 For nginx/IIS web servers which do not use htaccess files, it is strongly recommended to move the rules from the following folders:
 :* xcart/.htaccess

@@ Line 46: / Line 46: @@
 . Immediately password protect your admin and provider directories. You can usually password protect these directories using a control panel such as cPanel, or you can use .htaccess and .htpasswd files (Please find an example [[X-Cart:Store_Security#How_di_I_set_up_password_protection_for_my_X-Cart_admin_and_provider_areas.3F | here]], or run a quick google search if you are unsure how).
-. Be aware of your site’s file permissions, as having loose file permissions in conjunction with an exploit, can allow someone to write and execute files on your website – this is a very common exploit against x-cart so take this seriously. In general your file chmod permissions should appear as follows:
+. Be aware of your site’s file permissions, as having loose file permissions in conjunction with an exploit can allow someone to write and execute files on your website. This is a very common exploit against x-cart so take this seriously. In general your file chmod permissions should appear as follows:
 <pre>File Type Permission
@@ Line 155: / Line 155: @@
 </pre>
-{{Note1|{{XC 4.4}}Note: If you use X-Cart 4.4 replace this line:
+{{Note1|{{XC 4.4}}Note: If you are using X-Cart 4.4, replace this line:
 <pre>RedirectMatch permanent ^.*/var/.*$ http://www.yourdomain.com/x-cart-path/error_message.php</pre>
-with these lines:
+with the following lines:
 <pre><FilesMatch !"\.(css|js)$">
 RedirectMatch permanent ^.*/var/.*$ http://www.yourdomain.com/x-cart-path/error_message.php
 </FilesMatch></pre>
-Otherwise speed-up tool for Javascript and CSS will not work!}}
+Otherwise the speed-up tool for Javascript and CSS will not work!}}
 {{Note1|Note: Change <tt>http://www.yourdomain.com/x-cart-path/</tt> to the url to your error_message.php file.}}