Jump to content


Corporate Sponsors


Latest News: (loading..)

* * * * * 1 votes

PHP Intrusion Detection System for osCommerce


243 replies to this topic

#21 celextel

  • Community Member
  • 136 posts
  • Real Name:Lakshmanan S.
  • Location:Chennai

Posted 06 May 2010, 12:59

View PostMicke, on 06 May 2010, 12:43, said:

I have done the installation procedure from the beginning - not changing any files.
The database is not created and I can not see any messages after setting:
$show_result = 'true';
and "attacking" with the URL parameters in the installation instructions.
Would it do any good to create the database table manually in phpMyAdmin?

Perhaps PHPIDS directory is not in the right place.

You should rename "phpids-0.6.3.1" directory as "phpids" [not Caps]. [You should do simple zipping and not to a folder.]

Make sure that this renamed directory has the following directories directly in it:
docs
lib
nbproject
tests

Keep
$show_result = 'false';
and do the test-1 and test-2.

Go to the MySQL DB and see whether the new table has been created. No need to create it manually.

If still this does not work, you should add the following code to the index file at the top
error_reporting(E_ALL);
ini_set('display_errors', '1');
after
<?php
and see as to what is wrong.

Avoid doing this [error_reporting] in a Live Shop.

Edited by celextel, 06 May 2010, 13:00.


#22 Micke

  • Community Member
  • 191 posts
  • Real Name:Micke

Posted 06 May 2010, 13:30

Got it working! :)
The problem was I had another contribution installed called FWR Security Pro. I disabled it and the installation worked like a charm!
I have turned FWR Security Pro on again and now I'll see what happens. I hope these two contributions can interact in a good way.
If you think I'm wrong - please tell me.

#23 celextel

  • Community Member
  • 136 posts
  • Real Name:Lakshmanan S.
  • Location:Chennai

Posted 07 May 2010, 03:01

View PostMicke, on 06 May 2010, 13:30, said:

Got it working! :)
The problem was I had another contribution installed called FWR Security Pro. I disabled it and the installation worked like a charm!
I have turned FWR Security Pro on again and now I'll see what happens. I hope these two contributions can interact in a good way.
If you think I'm wrong - please tell me.

Glad to know about this. Perhaps you could use only one of this. We do not have any problem with our module as we do not have FWR Security Pro in our websites. We have to see whether these two could exist together.

#24 celextel

  • Community Member
  • 136 posts
  • Real Name:Lakshmanan S.
  • Location:Chennai

Posted 09 May 2010, 06:52

NEW!!

PHPIDS for osCommerce 1.3

1. Version Checker and IP look up link added to admin PHPIDS Log Report file.
2. File Log has been disabled by default now. It is not required as DB Log is enabled.
3. Added few more exception variables which osCommerce is using during the checkout and other process.
4. Some functions [tep] have been modified.
5. Added more explanatory notes to the module file.
6. You could use this now with Security Pro of FWR with a small modification.


#25 sishimaru

  • Community Member
  • 2 posts
  • Real Name:sishimaru

Posted 11 May 2010, 07:22

hi celextel, i really aprecited your contributions, thank you very much.

I've been trying to install this addons to my live webstore. http://www.harcomas I'm using oscommerce 2.2.
When i loggin to my admin page i got an error
1146 - Table 'xxxxx_xxx.phpids_intrusions' doesn't exist

select id, ip, name, impact, value, page, created from phpids_intrusions order by id 

what should i do?

I felt i was run according to the instructions but i got error, should i restart my brain??

needed your advice celextel.. thanks

#26 celextel

  • Community Member
  • 136 posts
  • Real Name:Lakshmanan S.
  • Location:Chennai

Posted 11 May 2010, 07:42

View Postsishimaru, on 11 May 2010, 07:22, said:

hi celextel, i really aprecited your contributions, thank you very much.

I've been trying to install this addons to my live webstore. http://www.harcomas I'm using oscommerce 2.2.
When i loggin to my admin page i got an error
1146 - Table 'xxxxx_xxx.phpids_intrusions' doesn't exist

select id, ip, name, impact, value, page, created from phpids_intrusions order by id 

what should i do?

I felt i was run according to the instructions but i got error, should i restart my brain??

needed your advice celextel.. thanks

Step-D: [Testing - Mandatory for Database Creation]

The module at the front end would automatically create the required database during its first test call. Access the website Catalog Main Page [or any other page in which application_top.php is called] and do the testing as mentioned herein, after completing the installation, before going to the admin for accessing the PHPIDS Log Report.

Please go through both the test processes first and then go to Admin.

#27 sishimaru

  • Community Member
  • 2 posts
  • Real Name:sishimaru

Posted 14 May 2010, 06:06

View Postcelextel, on 11 May 2010, 07:42, said:

Step-D: [Testing - Mandatory for Database Creation]

The module at the front end would automatically create the required database during its first test call. Access the website Catalog Main Page [or any other page in which application_top.php is called] and do the testing as mentioned herein, after completing the installation, before going to the admin for accessing the PHPIDS Log Report.

Please go through both the test processes first and then go to Admin.

oh boy... i'm too stupid to ignore that step. Right now everything is working for me, bravo celextel, you are my hero.
May i kiss you??? lol
i mean million thank you for your great jobs celextel

#28 celextel

  • Community Member
  • 136 posts
  • Real Name:Lakshmanan S.
  • Location:Chennai

Posted 14 May 2010, 07:54

NEW!!

PHPIDS for osCommerce 1.4

>>> with IP Containment Management System and Version Checker

1. DB creation code shifted to admin file.

2. IP Containment and Management System files [modified] included in this package. Added two more columns to the Banned IP table. One to add reason for banning and another to create the Time Stamp for reference purpose. These columns would be automatically created when you click Banned IP under Tools after going through the upgrade process.

3. Version Checker files included in this package.


#29 dpolyk

  • Community Member
  • 21 posts
  • Real Name:Demetris Polykarpou

Posted 14 May 2010, 10:00

Hi , thanks for the great add-on , till now had version 1.3 , today i upgraded into 1.4 but something is going wrong with the IP trap

When i run the tests i get this message

1146 - Table 'database_name.TABLE_BANNED_IP' doesn't exist

select * from TABLE_BANNED_IP where ip_address = '999.199.173.230'

[TEP STOP]

#30 dpolyk

  • Community Member
  • 21 posts
  • Real Name:Demetris Polykarpou

Posted 14 May 2010, 10:16

What i have found out is that the line : define('TABLE_BANNED_IP', 'banned_ip'); must be added not only in admin/includes/database_tables.php
but in catalog/includes/database_tables.php

#31 celextel

  • Community Member
  • 136 posts
  • Real Name:Lakshmanan S.
  • Location:Chennai

Posted 14 May 2010, 17:33

View Postdpolyk, on 14 May 2010, 10:16, said:

What i have found out is that the line : define('TABLE_BANNED_IP', 'banned_ip'); must be added not only in admin/includes/database_tables.php
but in catalog/includes/database_tables.php
You are correct. Thanks for bringing this to our notice. We have updated the Read Me file with this instruction. Thanks.

#32 dink

  • Community Member
  • 48 posts
  • Real Name:dink
  • Gender:Not Telling

Posted 14 May 2010, 22:23

Hi all,
Please excuse me if I am in the wrong place, just point me in the right direction.
This is the problem:
I installed oscommerce on my server and everything worked fine with the default installation.
Then I added an addon called Sales Force and that is where the problems begin.
I did post a question on that thread but it didn't help much.

Quote

The error is saying the database change hasn't been made. Assuming you have a working oscommerce shop, you need to login to your hosts control panel and use the program named phpmyadmin to run the sql comands. Your host should be able to guide you through that, though some won't, or there are threads in these forums and on the web.

I extracted the files and uploaded each to the proper directory. The database was created automatically when I installed OSC, so from the PHPAdmin I inserted the salesrep.sql. I can see the Sales Force in admin and I have added some data. From the PHPadmin I can see the tables with the correct data in the fields.
When I go to the store and click checkout it suppose to put a dropdown for the sales reps name.
Instead I get this
1146 - Table 'C250884_oscommerce2.TABLE_SALES_REPS' doesn't exist

select * from TABLE_sales_reps order by sales_rep_lastname ASC

[TEP STOP]
I am guessing it is saying it can't find the table, but I know it is in the database.
I am really, really new at SQL so if anyone can help me with this I would really appreciate it.
What is my next step?
My hosting provider was unable to help me (maybe because I didn't ask the right questions lol)

Thanks in advance,
dink

#33 celextel

  • Community Member
  • 136 posts
  • Real Name:Lakshmanan S.
  • Location:Chennai

Posted 15 May 2010, 13:41

View Postdink, on 14 May 2010, 22:23, said:

When I go to the store and click checkout it suppose to put a dropdown for the sales reps name.
Instead I get this
1146 - Table 'C250884_oscommerce2.TABLE_SALES_REPS' doesn't exist

select * from TABLE_sales_reps order by sales_rep_lastname ASC

[TEP STOP]
I am guessing it is saying it can't find the table, but I know it is in the database.
I am really, really new at SQL so if anyone can help me with this I would really appreciate it.
What is my next step?
My hosting provider was unable to help me (maybe because I didn't ask the right questions lol)

Thanks in advance,
dink

You seem to have not done the following:
18) In catalog/includes/database_tables.php before the last ?>

ADD:

  /*** Begin SalesForce ***/
  define('TABLE_SALES_GROUPS', 'sales_groups');
  define('TABLE_SALES_REPS', 'sales_reps');
  /*** End SalesForce ***/

If you still get the error even after adding this, let us know.

#34 pablito21050

  • Community Member
  • 24 posts
  • Real Name:paolo

Posted 15 May 2010, 16:10

Hello, I'm installing a new store these days and I want to install your add on.
Please tell me the compability with the others major security add ons like:

-Security Pro
-SiteMonitor
-IP trap
-htaccess protection
-Anti XSS

Maybe someone will be superfluous once istalled your add-on, may you suggest me a right formula to protect the new site?

Thanks.


View Postcelextel, on 14 May 2010, 07:54, said:

NEW!!

PHPIDS for osCommerce 1.4

>>> with IP Containment Management System and Version Checker

1. DB creation code shifted to admin file.

2. IP Containment and Management System files [modified] included in this package. Added two more columns to the Banned IP table. One to add reason for banning and another to create the Time Stamp for reference purpose. These columns would be automatically created when you click Banned IP under Tools after going through the upgrade process.

3. Version Checker files included in this package.



#35 celextel

  • Community Member
  • 136 posts
  • Real Name:Lakshmanan S.
  • Location:Chennai

Posted 15 May 2010, 17:03

View Postpablito21050, on 15 May 2010, 16:10, said:

Hello, I'm installing a new store these days and I want to install your add on.
Please tell me the compability with the others major security add ons like:

-Security Pro
-SiteMonitor
-IP trap
-htaccess protection
-Anti XSS

Maybe someone will be superfluous once istalled your add-on, may you suggest me a right formula to protect the new site?

Thanks.

PHPIDS for osCommerce 1.4 is compatible with the following add-ons:
>> Security Pro
- Please refer to our Read Me file [included in the package] in regard to this.
>> Site Monitor

We use both of these add-ons along with PHPIDS.

>> IP trap
You do not require this as we have integrated IP Containment and Management System [similar and more advanced one] with PHPIDS.

>> htaccess protection
You could use most of those codes along with PHPIDS. There should not be any problem.

>> Anti XSS [XSS Shield]
PHPIDS would not work fully if you use this as some of the query strings get sanitized.
You would not require this if you use Security Pro as both of them have almost same functions.

Right formula to protect osCommerce based sites could be:
>> PHPIDS for osCommerce 1.4
>> Security Pro
>> Site Monitor and
>> htaccess protection codes [which are essential]

#36 dink

  • Community Member
  • 48 posts
  • Real Name:dink
  • Gender:Not Telling

Posted 15 May 2010, 18:35

View Postcelextel, on 15 May 2010, 13:41, said:

You seem to have not done the following:
18) In catalog/includes/database_tables.php before the last ?>

ADD:

  /*** Begin SalesForce ***/
  define('TABLE_SALES_GROUPS', 'sales_groups');
  define('TABLE_SALES_REPS', 'sales_reps');
  /*** End SalesForce ***/

If you still get the error even after adding this, let us know.

Thanks for your response celextel,

I did as you suggested and entered the code, fixed an email problem by unchecking validate email, and now the store/catalog/checkout_shipping.php is showing a blank page. Where do I go from here?
dink

#37 pablito21050

  • Community Member
  • 24 posts
  • Real Name:paolo

Posted 15 May 2010, 22:14

Thank you very much, I appreciate your explanation and suggestion. I'll reply here when all will be installed to let you know.
Regards,


View Postcelextel, on 15 May 2010, 17:03, said:

PHPIDS for osCommerce 1.4 is compatible with the following add-ons:
>> Security Pro
- Please refer to our Read Me file [included in the package] in regard to this.
>> Site Monitor

We use both of these add-ons along with PHPIDS.

>> IP trap
You do not require this as we have integrated IP Containment and Management System [similar and more advanced one] with PHPIDS.

>> htaccess protection
You could use most of those codes along with PHPIDS. There should not be any problem.

>> Anti XSS [XSS Shield]
PHPIDS would not work fully if you use this as some of the query strings get sanitized.
You would not require this if you use Security Pro as both of them have almost same functions.

Right formula to protect osCommerce based sites could be:
>> PHPIDS for osCommerce 1.4
>> Security Pro
>> Site Monitor and
>> htaccess protection codes [which are essential]


#38 celextel

  • Community Member
  • 136 posts
  • Real Name:Lakshmanan S.
  • Location:Chennai

Posted 16 May 2010, 04:35

View Postdink, on 15 May 2010, 18:35, said:

Thanks for your response celextel,

I did as you suggested and entered the code, fixed an email problem by unchecking validate email, and now the store/catalog/checkout_shipping.php is showing a blank page. Where do I go from here?
dink

You should add the following code to the checkout_shipping.php file at the top
error_reporting(E_ALL);
ini_set('display_errors', '1');
after
<?php
and see as to what is wrong in that page.

#39 dink

  • Community Member
  • 48 posts
  • Real Name:dink
  • Gender:Not Telling

Posted 16 May 2010, 05:12

View Postcelextel, on 16 May 2010, 04:35, said:

You should add the following code to the checkout_shipping.php file at the top
error_reporting(E_ALL);
ini_set('display_errors', '1');
after
<?php
and see as to what is wrong in that page.
Fatal error: Call to undefined method currencies::calculate_price() in D:\hshome\c250884\dink-a-do.net\store\catalog\includes\classes\order.php on line 320

This is line 320
 $shown_price = $currencies->calculate_price($this->products[$index]['final_price'], $this->products[$index]['tax'], $this->products[$index]['qty']);

Edited by dink, 16 May 2010, 05:16.


#40 celextel

  • Community Member
  • 136 posts
  • Real Name:Lakshmanan S.
  • Location:Chennai

Posted 16 May 2010, 06:20

View Postdink, on 16 May 2010, 05:12, said:

Fatal error: Call to undefined method currencies::calculate_price() in D:.....\store\catalog\includes\classes\order.php on line 320

This is line 320
 $shown_price = $currencies->calculate_price($this->products[$index]['final_price'], $this->products[$index]['tax'], $this->products[$index]['qty']);

Avoid giving the full path info to the files.

Either you do not have the following file:
catalog\includes\classes\currencies.php

or the following function is missing in the catalog\includes\classes\currencies.php file:
    function calculate_price($products_price, $products_tax, $quantity = 1) {
      global $currency;

      return tep_round(tep_add_tax($products_price, $products_tax), $this->currencies[$currency]['decimal_places']) * $quantity;
    }

You should setup osCommerce directly in the root directory of your website or in the catalog directory. You have setup under store\catalog\. This is not usually done.