Auteur Topic: security patch voor zen cart  (gelezen 36077 keer)


  • Forumbeheerder
  • Senior
  • *****
  • Berichten: 274
  • Karma: 0
    • E-mail
security patch voor zen cart
« Gepost op: 4 juli 2009, 14:33:30 »
Wil je voorkomen dat je zen cart webwinkel wordt gehacked, volg dan onderstaande instructie en update de shop met de download patch. (onderaan het artikel)

Heb je hulp nodig bij het beveiligen van je webshop, neem dan contact op met


The following is a list of several steps you can take to secure your Zen Cart™ site:
1. Delete the /zc_install folder

Once installation is complete, delete the /zc_install folder from the server.
Don't simply rename the folder, as this leaves you vulnerable if someone were to discover this renamed folder.
2. Rename your "/admin" folder

Renaming the "admin" folder makes it much harder for would-be hackers to get into your admin area.

(Before making the following changes, make sure to have a current backup of your files and your database.)

A- Open your admin/includes/configure.php, using a simple text editor like notepad.
Change all instances of /admin/ to your chosen new admin folder-name.

Change this section:

define('DIR_WS_ADMIN', '/admin/');
define('DIR_WS_CATALOG', '/');
define('DIR_WS_HTTPS_ADMIN', '/admin/');
define('DIR_WS_HTTPS_CATALOG', '/');

And this section:

define('DIR_FS_ADMIN', '/home/');
define('DIR_FS_CATALOG', '/home/');

B- Find your Zen Cart /admin/ directory, using your FTP software or your webhost File Manager.
Rename the directory to match the settings you just made in your admin/includes/configure.php.

C - To login to your admin system you will now have to visit a new URL that matches the new name used in steps A and B above.

D - You should also protect your admin area by using a .htaccess file similar to the one shown below, and placing it into /admin/includes. (This should already exist in Zen Cart versions 1.2.7 and greater.)
3. Set configure.php files read-only

It's important that you CHMOD (set permissions) on the two configure.php files as read-only.
Typically this means setting it to "644", or in some cases "444".

The configure.php files are located in:

Quite often setting permissions on a file to read only via FTP will not work. Even if the permission looks like it was set to read only, it really may not have been. You must verify the correct setting by entering the store and seeing if there is a warning message on the top of the screen. "Warning: I am able to write to the configuration file:..." In this case you will need to use the "File Manager" supplied with your webhosting account.

If you're using a Windows server, simply set the file as Read-Only for Everyone and especially the IUSR_xxxxx (Internet Guest Account) user if running IIS, or the System account or apache user if running Apache.
4. Delete any unused Admin accounts

Admin->Tools->Admin Settings
In your admin area, open the Tools menu, and choose Admin Settings
- Check for any unused admin accounts, and delete them. Especially the "Demo" account, if it exists.
5. Admin Password Security

It is wise to use complicated passwords so that a would-be hacker cannot easily guess them.

You can change your admin password in Admin->Tools->Admin Settings, and click on the "Reset Password" button, or click on the icon that looks like a recycle symbol.

We recommend that you use passwords that are at least 8 characters long.
Making them alpha-numeric (including letters, numbers, upper-and-lower-case, etc) helps too.
If you are going to use normal words it is a good idea to join together two normal words that don't normally go together.
6. Protect your "define pages" content in "html_includes"

After you have finished editing your define pages (Admin->Tools->Define Pages Editor), you should protect them:

A. Download a copy of them to your PC using your FTP software. They are located in the /includes/languages/english/html_includes area.

B. Make them CHMOD 644 or 444 (or “read-only” for Windows hosts). See notes above on CHMOD.
/includes/languages/english/html_includes – and all files/folders underneath
(note: on "some" hosts, you must use at least 645 or 555 in order for the contents to still display)

If you make them read-only, then a would-be hacker cannot edit them if they gain access to your system, unless they can get permissions to change the read-only status, which is more complicated.

NOTE: Of course, once you set them read-only, then you'll have to go and set them read-write before making additional changes using the define-pages editor.
7. Use .htaccess files to protect against unwanted snooping

In several folders, there are .htaccess files to prevent users from being able to browse through the files on your site unless they know exact filenames. Some also prevent access to "any" .PHP scripts, since it's expected that all PHP files in those folders will be accessed by other PHP files, and not by a browser directly. This is good for security.
If you delete these files, you run the risk of leaving yourself open to people snooping around.

There are also some semi-"blank" index.html files in several folders. These files are there to protect you in case your FTP software won't upload .htaccess files, or your server won't accept them. These only prevent directory browsing, and do not stop execution of .PHP files. It's a good "alternative", although using .htaccess files in ALL of these folders is the better choice, for servers that accept them.

Suggested content for .htaccess files in folders where there is an index.html file but NOT yet an .htaccess file would be something like the following (depends on your server configuration):

#.htaccess to prevent unauthorized directory browsing or access to .php files
   IndexIgnore */*
   <Files *.php>
    Order Deny,Allow
    Deny from all

#add the following to protect against people finding your spiders.txt version
   <Files *.txt>
    Order Deny,Allow
    Deny from all

If your webhost configuration doesn't allow you to create/use your own .htaccess files, sometimes they provide an interface in your hosting admin control panel where you can set the desired .htaccess settings.

It is recommended that you work with your host to configure these settings if this is the method they require. You need to choose -- and use -- the appropriate method for your server. As mentioned above, it's best to work with your web hosting company to select and implement the best method for your specific server. We can't tell you what to use for your specific server, but we offer these guidelines as a starting point.
Disable "Allow Guest To Tell A Friend" feature
You may wish to go to Admin->Configuration->Email Options->Allow Guest To Tell A Friend and set the option to 'false'. This will prevent non-logged-in customers from using your server to send unwanted email messages.
Protect your "images" and other folders
During initial installation, you are advised to set your images folder to read/write, so that you can use the Admin interface to upload product/category images without having to use FTP for each one. Similar recommendations are made to other files for various reasons.

However, leaving the images (or any other) folder in read/write mode means that hackers might be able to put malicious files in this (or other) folder(s) and thus create access points from which to attempt nasty exploits.

Thus, once your site is built and your images have been created/loaded, you should drop the security down from read/write to read. ie: change from CHMOD 777 down to 644 for files, and to 755 for folders.

File/Folder permissions settings

On Linux/Unix hosts, generally, permission-setting recommendations for basic security are:

    * folders/directories: 755
    * files: 644

On Windows hosts, setting files read-only is usually sufficient. Should double-check that the Internet Guest Account has limited (read-only) access.
Folder Purposes

The folders for which installation suggests read-write access for setup are these. If your site supports .htaccess protection, then you should use it for these folders.

    * /cache
      This is used to cache session and database information. The BEST security protection for this is to move it to a folder "above" the webroot (public_html or htdocs or www) area, so that it's not accessible via a browser. (Requires changes to DIR_FS_SQL_CACHE setting in configure.php files as well as Admin > Configuration > Sessions > Session Directory.)
    * /images
      See other suggestions earlier.
    * /includes/languages/english/html_includes
      See other suggestions earlier.
    * /media
      This is only suggested read-write for the sake of being able to upload music-product media files via the admin. Could be done by FTP as an alternative.
    * /pub
      This is used on Linux/Unix hosts to have downloadable products made available to customers via a secure delivery method which doesn't disclose the 'real' location of files/data on your server (so that people can't share a URL and have their friends steal downloads from your site)
    * /admin/backups
      This is used by automated backup routines to store database backups. Optional.
    * /admin/images/graphs
      This is used by the Admin > Tools > Banner Manager for updating/displaying bar graphs related to banner usage. If not writable, feature is ignored.

Remove the print URL from your browser's headers

To stop the browser from printing a URL on the invoice or any other document on the web, follow these steps:

For Internet Explorer:
o Click on File then Page Setup
o At page setup, remove this two character combination: "&u" from the header or footer text box.

For Firefox:
o Click on File then Page Setup
o On page setup window click on the tab "Margins & Header/Footer". In the "Header & Footer" section set all of the drop downs to --blank--. (Or at least remove all references to "Title" and "URL".)
Things to Check Up on Regularly

   1. Be sure you've done all the steps listed in this document
   2. Keep good backups of your website files and database
   3. Check your server's errorlog regularly for odd or suspicious activity
          * look for any links that went to a page that isn't in your site
          * look for links that have http after the index.php
   4. Check your website files regularly to be sure nothing's been added or altered
   5. Ask your webhost what they have done to be sure the server you're on is safe and secure so that outsiders cannot do any harm, and so that other websites on your server cannot be used to get to your site and cause any harm (in case they have security holes in them)
   6. If your business warrants, or you still want additional assurance (esp if running forum software on your site, or other scripts outside of Zen Cart), hire a security consultant to check your site regularly and give you peace of mind in exchange for a few dollars

In our Security Recommendations for all Zen Cart™ users, we stress the need to rename your "/admin" folder. We also have prominent warnings in the administration section of the Zen Cart™ store, to remind users when they have not changed the folder name.

Recently we have been informed of some vulnerabilities in the store code which could potentially allow an attacker to gain access to the Administration section. To take advantage of theses vulnerabilities, the attacker needs to know the location of the Zen Cart™ Administration section.

While renaming the "/admin" provides protection against this vulnerability, we decided that this "Security through obscurity" was not sufficient, and therefore released this patch to address the vulnerability at the software level.

It should be noted that we are not the only Ecommerce system that relied on "Security through Obscurity" to protect the Aministration Section, as evidenced by this link
Installing this security patch on your Zen Cart™ 1.3.x store

The following is a list of the steps you need to take to install this security patch on your Zen Cart™ site:
1. Files in the Security Patch

   1. <YOUR ADMIN DIRECTORY>/includes/functions/extra_functions/security_patch_v138_20090619.php - NEW FILE
   2. <YOUR ADMIN DIRECTORY>/includes/extra_configures/security_patch_v138_20090619.php - NEW FILE
   3. <YOUR ADMIN DIRECTORY>/includes/autoloaders/config.security_patch_v138_20090619.php - NEW FILE
   4. <YOUR ADMIN DIRECTORY>/includes/init_includes/init_security_patch_v138_20090619.php - NEW FILE
   5. <YOUR ADMIN DIRECTORY>/includes/functions/html_output.php - ALTERED FILE

The files in the list above that are marked NEW FILE, can be simply uploaded to the corresponding directories in your stores admin directory. Hopefully after all the subtle hinting you will have renamed your "/admin" directory !

The html_output.php file will already exist in your Zen Cart™ installation, and how you deal with that file will depend on whether you have altered that file or not. If you are sure it has not been altered you can simply overwrite the original file with the version that came with this patch. Otherwise you will need to change your version by hand. Fortunately the change is minor and is described below.

Note you do not have to upload any other files, e.g the .html files that came with this security patch.

A word of WARNING. The html_ouptut.php file also exists in <STORE>/includes/functions/ directory. You must not change this version, only the one that exists in your admin directory.
2. Amending html_output.php by hand

To amend the <YOUR ADMIN DIRECTORY>/includes/functions/html_output.php by hand is fairly straightforward.
However before attempting to edit this file, please make sure you have a secure backup of the original version.

Open the file in an editor and find the function "zen_draw_form"

The last line of this function is

return $form;

Just before that line add another line as below

$form .= '<input type="hidden" name="securityToken" value="' . $_SESSION['securityToken'] . '" />';

You can then save the file.
3. Test changes

With all the changes in place, you should now test that you can still access your Administration panel, and that nothing in the Administration panel appears to have been adversely affected by the changes.

If you do have any problems, then you should revert to the original version of html_ouput.php (You did make a backup, didn't you) and remove the other 4 files that are part of this security patch.

Please use the Zen Cart™ Forums for advice and/or to notify us of any problems with the patch.
Previous Zen Cart Versions

This patch was specifically written and tested using the most up to date Zen Cart release (v1.3.8), however it will also work with all other 1.3.x releases. We cannot however confirm that it will fully work with previous versions.

Any one using v1.2.x is advised to upgrade their store as soon as possible.

However, the following file contained in this patch:.

<YOUR ADMIN DIRECTORY>/includes/function/extra_functions/security_patch_v138_20090619.php

is compatible with 1.2.x releases, and people using those versions are advised to at least upload this file.

You should also ensure that you have any other patches for your system installed. Details of previous patches can be found in the Release Annoucements section of the Zen Cart Forums.

« Laatst bewerkt op: 17 april 2017, 19:09:38 door Domein-Direct »