ProductCart E-Commerce Solutions Homepage
Forum Home Forum Home > ProductCart > Using ProductCart
  New Posts New Posts RSS Feed - Read/Write Folder Permissions
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

Read/Write Folder Permissions
 Post Reply Post Reply
Author
Message
  Topic Search Topic Search  Topic Options Topic Options
robguay View Drop Down
Newbie
Newbie
Avatar

Joined: 29-November-2010
Location: Organize-it
Status: Offline
Points: 0 		Post Options Post Options   Thanks (0) Thanks(0)   Quote robguay Quote  Post ReplyReply Direct Link To This Post Topic: Read/Write Folder Permissions
    Posted: 08-March-2012 at 11:35am
Quote from--> wiki.earlyimpact.com
 
"Set the following folder permissions for the “Internet User” (IUSR) or the “Everyone”:
  • READ/WRITE on the productcart folder and all of its files and folders.
  • READ/WRITE/DELETE on the productcart/includes folder and all of its files and folders
  • READ/WRITE/DELETE on the productcart/pcadmin folder and all of its files and folders"

    • This seems extreme does anyone have a better security structure on your web site?
     
    Beer
Robert J Guay Jr
Back to Top
Hamish View Drop Down
Admin Group
Admin Group


Joined: 12-October-2006
Location: United Kingdom
Status: Offline
Points: 56 		Post Options Post Options   Thanks (0) Thanks(0)   Quote Hamish Quote  Post ReplyReply Direct Link To This Post Posted: 08-March-2012 at 6:46pm
Hi,
   ProductCart is PCI compliant with the folder permissions set exactly like that so I don't believe you have any reason for concern. We have never heard of any store compromised because of the folder permissions and you can be certain we would have changed the advised settings if we had.

From our home page...
"Robust, flexible, reliable, and secure.
Among other things, ProductCart is one of the few shopping carts to have been officially PA-DSS validated."

Editing ProductCart Code?

See WIKI Guidelines for Editing ProductCart's ASP Source Code
Back to Top
robguay View Drop Down
Newbie
Newbie
Avatar

Joined: 29-November-2010
Location: Organize-it
Status: Offline
Points: 0 		Post Options Post Options   Thanks (0) Thanks(0)   Quote robguay Quote  Post ReplyReply Direct Link To This Post Posted: 09-March-2012 at 10:11am
Which folders are absolutley required to have write permissions?
Robert J Guay Jr
Back to Top
Guests View Drop Down
Guest
Guest
Post Options Post Options   Thanks (0) Thanks(0)   Quote Guests Quote  Post ReplyReply Direct Link To This Post Posted: 10-March-2012 at 1:07am
I'm agreed with Hamish, but if you want to nit pick it, you'd have to go down to the file level. 

If you really want to manage a "non-issue" at this level, you're probably going to be on your own to pick through them as it's rather a waste of our time to consider this, IMHO.
Back to Top
Dayv3 View Drop Down
Newbie
Newbie


Joined: 07-June-2009
Location: United States
Status: Offline
Points: 11 		Post Options Post Options   Thanks (0) Thanks(0)   Quote Dayv3 Quote  Post ReplyReply Direct Link To This Post Posted: 10-March-2012 at 12:24pm


"Set the following folder permissions for the “Internet User” (IUSR) or the “Everyone”:
  • READ/WRITE on the productcart folder and all of its files and folders.


Just in case anyone has trouble or confusion with this directory, remember that in the productcart directory may have been renamed to something like store.  I spent some time, with frustration, on this issue.  I had Early Impact install my software and never knew that they renamed the directory to store.  I could not find the productcart directory to set the permissions. I thought it was the pc directory under store, which is incorrect... so went on the frustrations as to why I could not get the permissions set correctly.

Eventually, I opened a ticket and after a few back and forths with tech support (with frustration on both sides) we finally got it figured out.  I hope this helps anyone who may have tripped on the same issue.

Dave





Edited by Dayv3 - 10-March-2012 at 12:55pm
Back to Top
Guests View Drop Down
Guest
Guest
Post Options Post Options   Thanks (0) Thanks(0)   Quote Guests Quote  Post ReplyReply Direct Link To This Post Posted: 13-March-2012 at 12:05am
Originally posted by Dayv3 Dayv3 wrote:


"Set the following folder permissions for the “Internet User” (IUSR) or the “Everyone”:
  • READ/WRITE on the productcart folder and all of its files and folders.

This wouldn't/shouldn't work as the /includes/ and /"pcadmin"/ directories need "modify"/"delete" permissions. "Read/Write" permissions on the entire application is not sufficient, and maybe not the best idea.

What's more, my earlier post assumed @robguay thought the permissions were too loose and wanted to ratchet them down. I think this is what Hamish thought as well. However, I didn't flush out that take on it well enough "at the file level" as the issue there would mean rather significantly altering PC to find the files it needs to write and modify in directories one would have to custom create and then go modify the application for (and maintain with upgrades, etc.). Just doesn't seem remotely worth it when there is no real security issue here. 
Back to Top
Greg Dinger View Drop Down
Certified ProductCart Developers
Certified ProductCart Developers
Avatar

Joined: 23-September-2006
Location: United States
Status: Offline
Points: 238 		Post Options Post Options   Thanks (0) Thanks(0)   Quote Greg Dinger Quote  Post ReplyReply Direct Link To This Post Posted: 13-March-2012 at 12:11am
Agreed.  When one configures this or that, various settings files get written.  Generate a store map or category navigation and more files are written.  Ship orders and shipping label-related files are produced.  It goes on and on.  
 
It would be extremely laborious to try to work through the entire list of files that the system might eventually want to tough, and to try to granularly set the permissions on every possible file that needs to be touched.
Back to Top
Guests View Drop Down
Guest
Guest
Post Options Post Options   Thanks (0) Thanks(0)   Quote Guests Quote  Post ReplyReply Direct Link To This Post Posted: 13-March-2012 at 12:32am
Originally posted by robguay robguay wrote:

Which folders are absolutley required to have write permissions?

Ok, @robguay, the "big wigs" here have weighed in (Hamish, Greg/GBDG, Sean/WMS): do you still have a concern here? We think you shouldn't.

Personally, I think you should not waste any development juice getting hung up here and just go build yourself an awesome store.

ON a side note, though, perhaps your real concern here should be on how to clean up on a lot of those files that get written temporarily. Greg's been an "advanced guard" on that issue, and WMS has worked on this issue as well. Not a big deal, but more of a concern than the required permissions issues.
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down

Forum Software by Web Wiz Forums® version 12.04
Copyright ©2001-2021 Web Wiz Ltd.

This page was generated in 0.062 seconds.