[pattysgraphix]

Hey guys,

I have 2 php pages that will help you get oscommerce secured:

first you need to find the right path to your includes files in the store and admin:

so in a text editor copy and paste the following code:

<?php
echo realpath(dirname(__FILE__));
?>

now save as "path.php"

you need the "" or it will save as a text file and not execute

next upload it to your main store directory

and run it by going to your web browser and typing in:
http://yourdomain.com/path to php script/path.php

next you need to chmod the configure files in both includes and the admin includes:

so again open your text editor copy and paste this:

<?php
$filename = "configure.php";
chmod("/Path you got from running the other script/includes/$filename", 0444);
echo "Success !!! chmod for $filename was changed in the store";
chmod("/path you got from running the other script/admin/includes/$filename", 0444);
echo "Success !!! chmod for $filename was changed in the admin area";
?>

just change:
path you got from running the other script

to the actual path you got from the other script in both places and save as "chmod444.php"

and run it by going to your web browser and typing in:
http://yourdomain.com/path to php script/chmod444.php


now go to your admin area and you will notice it will tell you it is now secure.

Mark@pattysgraphix.com

[lobrc]

If you try to set the permissions of a file or directory to 444 you will notice that they automatically reset to the old values (default 644 for files and 755 for directories). This is caused by the way the server is configured and cannot be changed.

[joe56247]

Hi Pattysgraphix,
Thanks for posting these codes. I've done what you told but besides the 'success' messages there is also this one: "Warning: chmod() [function.chmod]: Permission denied in ../catalog/chmod444.php on line 5" though in line 5 the path is ../catalog/admin/includes/$filename", 0444)
Also, when running the site, the insecure message appears at the top of the page. Any hint on this issue? Thanks