X-Cart:User Access Control - Revision history

Dohtur at 07:31, 26 March 2013

2013-03-26T07:31:53Z

Dohtur at 07:28, 26 March 2013

2013-03-26T07:28:10Z

Dohtur at 09:24, 25 March 2013

2013-03-25T09:24:24Z

Dohtur at 16:45, 21 March 2013

2013-03-21T16:45:50Z

Dohtur at 16:03, 21 March 2013

2013-03-21T16:03:44Z

Dohtur at 13:54, 21 March 2013

2013-03-21T13:54:46Z

Dohtur at 20:01, 21 February 2013

2013-02-21T20:01:39Z

Dohtur at 16:18, 21 January 2013

2013-01-21T16:18:53Z

Dohtur at 13:41, 8 October 2012

2012-10-08T13:41:29Z

Dohtur at 20:41, 24 July 2012

2012-07-24T20:41:56Z

← Older revision		Revision as of 07:31, 26 March 2013
Line 56:		Line 56:

	Please note that it is not possible to remove your own IP address from the list. (The check box displayed next to your own IP address is grayed out).		Please note that it is not possible to remove your own IP address from the list. (The check box displayed next to your own IP address is grayed out).
		+
		+	==See also==
		+	* [[X-Cart:Protected_Mode\|Protected Mode]]
		+	* [[X-Cart:Config.php\|Config.php]]

	[[Category:X-Cart user manual]]		[[Category:X-Cart user manual]]

← Older revision		Revision as of 07:28, 26 March 2013
Line 1:		Line 1:
	User access control functionality is available in X-Cart versions 4.1.9 and later. This functionality allows the store administrator to restrict access of users to the store's back end by IP address. In X-Cart GOLD and GOLD PLUS, the "back end" is the store's Admin area. Speaking about X-Cart PLATINUM and PRO, by "back end" we mean the Admin area and the Provider area.		User access control functionality is available in X-Cart versions 4.1.9 and later. This functionality allows the store administrator to restrict access of users to the store's back end by IP address. In X-Cart GOLD and GOLD PLUS, the "back end" is the store's Admin area. Speaking about X-Cart PLATINUM and PRO, by "back end" we mean the Admin area and the Provider area.
		+
		+	{{Note1\|'''Note''': User access control functionality fully blocks access to the store's back end by IP address. If you would like to restrict access not to the entire back end, but just to some of the pages in the back end, see the section [[X-Cart:Protected_Mode\|Protected Mode]].}}

	By default, user access control functionality is disabled. It can be enabled by setting the value of the constant BLOCK_UNKNOWN_ADMIN_IP (in X-Cart versions prior to 4.5.5 - the constant SECURITY_BLOCK_UNKNOWN_ADMIN_IP) in X-Cart's main configuration file [[X-Cart:Config.php\|config.php]] to TRUE.		By default, user access control functionality is disabled. It can be enabled by setting the value of the constant BLOCK_UNKNOWN_ADMIN_IP (in X-Cart versions prior to 4.5.5 - the constant SECURITY_BLOCK_UNKNOWN_ADMIN_IP) in X-Cart's main configuration file [[X-Cart:Config.php\|config.php]] to TRUE.

@@ Line 8: / Line 8: @@
 At the same time an IP address registration request is sent:
-* in X-Cart 4.5.5 and later - to the email address of the user trying to log in (provided that they are a registered user with an account type allowed access to the store's back end);
+* in X-Cart 4.5.5 and later - to the email address of the user trying to log in (provided that they are a registered user with an account type allowed access to the store's back end, with a valid email address and password);
 * in earlier X-Cart versions - to the email address specified under 'Site administrator email address' in 'General settings/Company options'.

@@ Line 1: / Line 1: @@
-User access control functionality is available in X-Cart versions 4.1.9 and later. This functionality allows the store administrator to restrict access of users to the store's back end by IP address.
+User access control functionality is available in X-Cart versions 4.1.9 and later. This functionality allows the store administrator to restrict access of users to the store's back end by IP address. In X-Cart GOLD and GOLD PLUS, the "back end" is the store's Admin area. Speaking about X-Cart PLATINUM and PRO, by "back end" we mean the Admin area and the Provider area.
 By default, user access control functionality is disabled. It can be enabled by setting the value of the constant BLOCK_UNKNOWN_ADMIN_IP (in X-Cart versions prior to 4.5.5 - the constant SECURITY_BLOCK_UNKNOWN_ADMIN_IP) in X-Cart's main configuration file [[X-Cart:Config.php|config.php]] to TRUE.
@@ Line 15: / Line 13: @@
 The email message with the IP address registration request contains information about the login attempt that was blocked and specially crafted links that can be used to either allow or deny access to the back end from the respective IP address. As soon as the link to allow access is clicked, the IP address is added to the list of allowed IP addresses, and the user can freely log in to the back end.
-In addition to being sent via email, IP address registration requests also appear on the 'User access control' page in the Admin area where they can be approved to deleted by any user with access to the page. For details, see [[#Managing IP address registration requests|Managing IP address registration requests]].
+In addition to being sent via email, IP address registration requests also appear on the 'User access control' page in the Admin area where they can be approved or deleted by any user with access to the page. For details, see [[#Managing IP address registration requests|Managing IP address registration requests]].
 It is also possible to add allowed IP addresses manually via the 'User access control' page in the Admin area. For details, see [[#Managing the list of allowed IP addresses|Managing the list of allowed IP addresses]].
@@ Line 48: / Line 46: @@
 Instead of adding individual IP addresses one by one, it is possible to define patterns. Patterns can use numbers (0-255) and the asterisk character. An asterisk matches any number in the range 0-255 and can be used to replace an IP octet. For example, to allow access from any host on the 195.24.53 network, set the pattern as 195.24.53.*.
-{{Note1|Note: When creating a pattern, be aware that you can use asterisks in non-final IP address octets only if you are going to replace all the octets that follow it by asterisks, too. Patterns formatted differently will be deemed incorrect. For example, patterns like 195.*.*.* or 195.24.*.* are correct; patterns like 195.*.53.* are incorrect.}}
+When creating a pattern, be aware that you can use asterisks in non-final IP address octets only if you are going to replace all the octets that follow it by asterisks, too. Patterns formatted differently will be deemed incorrect. For example, patterns like 195.*.*.* or 195.24.*.* are correct; patterns like 195.*.53.* are incorrect.
 If the list of allowed IP addresses contains an IP address that needs no longer be allowed access to the store's back end, you can remove this IP address from the list of allowed IP addresses. To remove an IP address from the list of allowed IP addresses:

@@ Line 5: / Line 5: @@
 By default, user access control functionality is disabled. It can be enabled by setting the value of the constant BLOCK_UNKNOWN_ADMIN_IP (in X-Cart versions prior to 4.5.5 - the constant SECURITY_BLOCK_UNKNOWN_ADMIN_IP) in X-Cart's main configuration file [[X-Cart:Config.php|config.php]] to TRUE.
-With user access control functionality enabled, no user can log in to the store's back end unless their IP address is on the list of allowed IP addresses. The only exception to the general rule is the very first user who logs in to the store's back end after user access control functionality has been enabled: it is presumed that the IP address used to log in to the store's back end for the very first time is a trusted IP, so it is added to the list of allowed IP addresses automatically. Any subsequent log-in attempts from IP addresses other than that IP address are blocked; the following message is displayed:
+With user access control functionality enabled, no user can log in to the store's back end unless their IP address is on the list of allowed IP addresses. The only exception to the general rule is the very first user who logs in to the store's back end after user access control functionality has been enabled: it is presumed that the IP address used to log in to the store's back end for the very first time is a trusted IP address, so it is added to the list of allowed IP addresses automatically. Any subsequent log-in attempts from IP addresses other than that IP address are blocked. Instead of being logged in, the user is stopped and shown a warning message like the following:
 :[[Image:warn.gif|663px]]
-Registration of IP addresses from which access to the back end must be allowed is performed by the store administrator. After enabling user access control functionality, the store administrator registers his or her own IP address with the system and manages the IP address registration requests of other users who need access to the back end area, if any. The IP addresses from which access to the store's back end is allowed are entered into the list of allowed IP addresses. This list is stored in the database and can be managed by the store administrator on the 'User access control' page of the Admin area.
+At the same time an IP address registration request is sent:
-== Managing IP address registration requests ==
+The email message with the IP address registration request contains information about the login attempt that was blocked and specially crafted links that can be used to either allow or deny access to the back end from the respective IP address. As soon as the link to allow access is clicked, the IP address is added to the list of allowed IP addresses, and the user can freely log in to the back end.
-If you are the store administrator, the first thing you should do after enabling the mode of enhanced protection for the store's back end is register your own IP address with the system so you can log in to the Admin area. To do so, go to the Admin area (make sure this happens from the IP address you wish to register) and log in using your admin user credentials. You will not be logged in; however, you will see a warning message (as seen in the screenshot above) saying that you are not allowed to access the requested resource because your IP address is not registered, and that a request to register your IP address has been sent to the store administrator. This means that an IP address registration request has been sent on your behalf to the email address specified under 'Site administrator email address' in 'General settings/Company options'. Go to the said email account, locate the IP address registration request message and open it. You will see that this message provides information about your own attempt to log in to the Admin area (the time of the log-in attempt, your login name and the IP address that was used) as well as links allowing you to allow or deny access to the store's back end for the respective IP address. Use the link provided in the email message to allow access to the store's back end from your own IP address. As a result, your IP address will be  entered into the store's list of allowed IP addresses. As soon as it happens, you will be able to log in to the Admin area from the registered IP address as usual. If you intend to use more than one IP address to access the store's back end, you can register all of these addresses by adding them to the list of allowed IP addresses using the 'User access control' page in the store's Admin area (See [[#Managing the list of allowed IP addresses |Managing the list of allowed IP addresses]]).
+In addition to being sent via email, IP address registration requests also appear on the 'User access control' page in the Admin area where they can be approved to deleted by any user with access to the page. For details, see [[#Managing IP address registration requests|Managing IP address registration requests]].
-If you are not the only user of the store's back end, you may also receive IP address registration requests from other users. The procedure for registering the IP addresses of other users of the store's back end is exactly the same: when a user attempts to log in to the store's back end using a valid login/password combination, you will receive an IP address registration request by email and will be able to accept or decline it using specially crafted links provided in the email message.
+It is also possible to add allowed IP addresses manually via the 'User access control' page in the Admin area. For details, see [[#Managing the list of allowed IP addresses|Managing the list of allowed IP addresses]].
-You can also manage IP address registration requests using the 'User access control' page of the store's Admin area (In X-Cart versions 4.4.0 and later, this page can be found at the location Tools menu -> Maintenance -> "See also" tab (right-side menu) -> User access control; in X-Cart versions before 4.4.x, this page can be found at the location Administration menu -> Summary -> "In this section" menu -> User access control). On the 'User access control' page, IP address registration requests sent to the site administrator appear in the 'IP address registration requests' section (This section is displayed only if there are active requests).
+== Managing IP address registration requests ==
 :[[Image:ip_registration_requests.gif|523px]]
 To delete an IP address registration request:
@@ Line 34: / Line 37: @@
 == Managing the list of allowed IP addresses ==
-The store's list of allowed IP addresses is stored in the database and can be viewed and managed using the 'Allowed IP addresses' section of the 'User access control' page in the store's Admin area (In X-Cart versions 4.4.0 and later, this page can be found at the location Tools menu -> Maintenance -> "See also" tab (right-side menu) -> User access control; in X-Cart versions before 4.4.x, this page can be found at the location Administration menu -> Summary -> "In this section" menu -> User access control). Before you add any IP addresses to the list, it contains an only IP address - your own:
+The store's list of allowed IP addresses is stored in the database and can be viewed and managed using the 'Allowed IP addresses' section of the 'User access control' page in the store's Admin area (In X-Cart versions 4.4.0 and later, this page can be found at the location Tools menu -> Maintenance -> "See also" tab (right-side menu) -> User access control; in X-Cart versions before 4.4.x, this page can be found at the location Administration menu -> Summary -> "In this section" menu -> User access control).
 :[[Image:allowed_ip_addrs.gif|517px]]
@@ Line 43: / Line 46: @@
 # Click the '''Add''' button. The IP address will be added to the list. You should see an Information box with a confirmation message.
-Instead of adding individual IP addresses one by one, it is possible to define patterns that would match multiple IP addresses. Patterns can use numbers (0-255) and the asterisk character. An asterisk matches any number in the range 0-255 and can be used to replace an IP octet. For example, to allow access from any host on the 195.24.53 network, set the pattern as 195.24.53.*.
+Instead of adding individual IP addresses one by one, it is possible to define patterns. Patterns can use numbers (0-255) and the asterisk character. An asterisk matches any number in the range 0-255 and can be used to replace an IP octet. For example, to allow access from any host on the 195.24.53 network, set the pattern as 195.24.53.*.
 {{Note1|Note: When creating a pattern, be aware that you can use asterisks in non-final IP address octets only if you are going to replace all the octets that follow it by asterisks, too. Patterns formatted differently will be deemed incorrect. For example, patterns like 195.*.*.* or 195.24.*.* are correct; patterns like 195.*.53.* are incorrect.}}

← Older revision		Revision as of 20:01, 21 February 2013
Line 1:		Line 1:
−	X-Cart ~~allows~~ the store administrator to enable a mode of enhanced protection for the store's back end in which the store administrator will be able to control, from which IP addresses the store's back end can be accessed. In X-Cart GOLD and GOLD PLUS, the back end is the store's Admin area; in X-Cart PLATINUM and PRO - the Admin area and the Provider area.	+	X-Cart versions 4.1.9 and later allow the store administrator to enable a mode of enhanced protection for the store's back end in which the store administrator will be able to control, from which IP addresses the store's back end can be accessed. In X-Cart GOLD and GOLD PLUS, the back end is the store's Admin area; in X-Cart PLATINUM and PRO - the Admin area and the Provider area.

	By default, the mode of enhanced protection is disabled. It can be enabled by setting the value of the constant BLOCK_UNKNOWN_ADMIN_IP (in X-Cart versions prior to 4.5.5 known as SECURITY_BLOCK_UNKNOWN_ADMIN_IP) in X-Cart's main configuration file [[X-Cart:Config.php\|config.php]] to TRUE.		By default, the mode of enhanced protection is disabled. It can be enabled by setting the value of the constant BLOCK_UNKNOWN_ADMIN_IP (in X-Cart versions prior to 4.5.5 known as SECURITY_BLOCK_UNKNOWN_ADMIN_IP) in X-Cart's main configuration file [[X-Cart:Config.php\|config.php]] to TRUE.

@@ Line 1: / Line 1: @@
 X-Cart allows the store administrator to enable a mode of enhanced protection for the store's back end in which the store administrator will be able to control, from which IP addresses the store's back end can be accessed. In X-Cart GOLD and GOLD PLUS, the back end is the store's Admin area; in X-Cart PLATINUM and PRO - the Admin area and the Provider area.
-By default, the mode of enhanced protection is disabled. It can be enabled by setting the value of the constant SECURITY_BLOCK_UNKNOWN_ADMIN_IP in X-Cart's main configuration file [[X-Cart:Config.php|config.php]] to "true".
+By default, the mode of enhanced protection is disabled. It can be enabled by setting the value of the constant BLOCK_UNKNOWN_ADMIN_IP (in X-Cart versions prior to 4.5.5 known as SECURITY_BLOCK_UNKNOWN_ADMIN_IP) in X-Cart's main configuration file [[X-Cart:Config.php|config.php]] to TRUE.
 After the mode of enhanced protection has been enabled, no user will be able to log in to the store's back end until his or her IP address is registered with the system. Log-in attempts of existing back end users will be denied with the following message:

← Older revision		Revision as of 13:41, 8 October 2012
Line 1:		Line 1:
−	X-Cart allows the store administrator to enable a mode of enhanced protection for the store's back end in which the store administrator will be able to control, from which IP addresses the store's back end can be accessed. In X-Cart GOLD, the back end is the store's Admin area; in X-Cart PRO - the Admin area and the Provider area.	+	X-Cart allows the store administrator to enable a mode of enhanced protection for the store's back end in which the store administrator will be able to control, from which IP addresses the store's back end can be accessed. In X-Cart GOLD and GOLD PLUS, the back end is the store's Admin area; in X-Cart PLATINUM and PRO - the Admin area and the Provider area.

	By default, the mode of enhanced protection is disabled. It can be enabled by setting the value of the constant SECURITY_BLOCK_UNKNOWN_ADMIN_IP in X-Cart's main configuration file [[X-Cart:Config.php\|config.php]] to "true".		By default, the mode of enhanced protection is disabled. It can be enabled by setting the value of the constant SECURITY_BLOCK_UNKNOWN_ADMIN_IP in X-Cart's main configuration file [[X-Cart:Config.php\|config.php]] to "true".