geoffreywalton

I offer the following services and more:

- Cleaning Hacked Sites
- Securing Oscommerce sites
- Product Loading and maintenance
- Oscommerce Customization
- Support - Online, Skype and Contracts
- Oscommerce version upgrades
- Custom coding
- SEO Opmization
- Speed Optimization
- Add-ons/modules installation
- Add-ons/modules customization and modifications
- Migration to oscommerce from other cart software
- Migration to other cart software from oscommerce

To find out more go to http://www.theukwaltons.co.uk and feel free to contact me for a quote on anything you want done, otherwise please post your questions in the forum.

Thanks.

G

The data that was here and has been referred to in my posts since 2007 is slowly being transferred to my web site at http://www.theukwaltons.co.uk, so if you can't find it below, please follow the link.

IMPORTANT SECURITY PATCH FOR EXISTING AND NEW SITES (18/07/90).

If your admin directory is still called admin you really must follow the steps outlined HERE, don't and you will get hacked.

Once you have done that look at the "Security Contributions You Ought to Apply" links lower down in this profile.

They all come with step by step guides that if you are familiar with editing files and ftp you should be able to follow.

What To Do If Your Site Has Been Hacked?

Moved to Basic Installation steps on my web site.

Security Contributions You Ought to Apply

Follow the instruction on How to secure your osCommerce 2.2 site. All the stuff you should to prevent posting 'My Sites Been Hacked

Virus Threat Scanner is designed to run on your web server and scan your public web files for malicious code. It is small, portable and efficient, uses minimal server resources, and provides a full report on what has been discovered.

One of them, Site Monitor can be set up to check your site at regular intervals and email you of suspicious changes, it can also be run as part of the process to disinfect a site.

Try this one as well to sort out a few well known glitches in the registration process.


Hi

You may have noticed I answer quite a lot of questions on the forum, or I did when I wrote this, so first a please, post your questions in the forum or see the comments in my Personal Statement.

Most of the answers I give can be found by searching the forum, so whenever you get stuck, use Google and use a search term like

site:forums.oscommerce.com xxxxxxxxxxxxxxx

in the Google search box. Or read this link A guide to searching the forums/contributions

Here are some links to answers and other info I have found useful to install RC2A sites, credit must go to the authors, all I have done is consolidate them into one place. If you find others let me know and I'll add them in.

Starting Out

Just so you understand how OSC is put together have a read of the roadmap for newbies by lindsayanng, which gives a good overview of OSC.

File relationships diagram [img]http://forums.oscommerce.com//public/style_emoticons/default/whistling.gif[/img] here

If you need to understand a bit more about Linux commands?

And before you start out here are some tips on how people make crap sites using OSC. Then from there are links on how to make an awesome site.

Basic Installation steps

Moved to Basic Installation steps on my web site.

Getting A Basic Understanding

Once you have it installed the first 2 threads in the installation forum covers how to do loads of basic things as does this one [img]http://forums.oscommerce.com//public/style_emoticons/default/whistling.gif[/img]

Also the documentation that comes with the download of your version of OSC will be a good first stop or if it is not on your server, download a new copy of your version and read that

Video Tutorials and a free template editor, not to mention a tutorial about setting up your PC as a (XAMPP) server so you can test your changes before uploading them to your live site.

The knowledgebase on this site can be read on-line or a copy downloaded, unfortunately the screen shots are for the V3 and but most of it still applies to rc2a.

The configuration files are also a dark pit and A guide to the configure.php files sheds some light on them and their contents.

If you want to change colours and box styles the Knowledgebase on stylesheets would have been a good place to start but it has gone. So here it is from my archive:

Some good general FAQscovering alls sorts of things from error messages and SEO by Mr Phil makes good reading.

If you are having problems with email try this link.
=====================================================================================================================

2.3.1 Design http://forums.oscomm...s-the-easy-way/

2.2 and before Catalog Stylesheet Definitions

Moved to 2.2 and before Catalog Stylesheet Definitions on my web site.

More Tips

When you start to get more technical and want to create links, you should read What is the osCsid & why you must not loose it.

And for those wanting to install SSL a little SSL Implementation Guide goes a long way to explaining everything you need to know.

This one explains it a bit more.

And this one is a good all rounder especially if you can't get it to work.

But the code documentation here is very useful, wiki.oscdox.com, once you have drilled down the search tool on the right is invaluable. The rest of the site is not finished but good in parts.

If you like diagrams these UML or ER diagram of OsCommerce database might be of interest.

How to add products to your store.

You can either do this one product at a time through the shop admin or install a contribution to take data from a csv file and upload en-mass. The best contribution to do this is Easy Populate.

Now if you want someone to take a file given to you by your supplier and automate the reformatting it so it can be imported using EP I know just the person to do this ...... (me, if you are a bit slow)

This contribution will get a csv file from your supplier and update existing products and this one an xml file.

If Your Host has Upgraded your Server to use MySQL5.

If your host has recently upgraded to mysql5 then you need to sort out "Left Joins.

The exact changes you need to make to a stock RC2A shop are in the instructions on How to update to RC2A.

If you want to know how to do it everywhere, this explains how to code LEFT JOINS

If Your Host has Upgraded your Server to use MySQL5.3.

And once you have done that 5.2 to 5.3 upgrade.

What to do if your Site Displays Info for Other Users / Sites

This is not always a hack of your site it might be because you are using a shared directory on a shared server. If you use the tmp dir for your cache on a shared server you will get this problem. There are 2 ways to solve it.

1) Create a folder in your root directory(public html) called 5osc9_cache.

Set the permission on this folder to 755.

In your shop admin under cache set the cache directory to

/home/my_site/public_html/5osc9_cache/

Change my_site to your the correct values for your site/server.

2) Personally I prefer to set cache to 'false' in the shop admin.
Then on the last line of both of your configure.php files set STORE SESSIONS to 'mysql'

Images

IStockPhoto
http://us.fotolia.com/.
BigStockPhoto
magictoolbox
colour scheme generator

Buttons/icons

dryicons.com/
qds-team
www.oscbuttons.com/
www.advancewebsoft.com

Templates

How to upgrade a template, good start if you ignore the flame war.

Explanation of Permissions and How They are Used in a Hack - Thanks to Taipo

There is some confusion surrounding the issue of file and folder permissions, and a lot of this is because there has been a change in methods in the last few years and many are not aware of.

There are in general two philosophies with virtual hosts now that have come into play probably because of the escalation in traversal type server intrusions.

Before, the common method which Ill refer to as method 1, the first of the two primary methods, was to use folder and file permissions as a means of controlling the writability of content where the server script, in this case php, needed a file to have a write permission of 666 to be able to write to that file.

The case was the same with folders, which like files of 644, were by default non-writable. In order for php to write to files in that folder, or to create files or delete files or even chmod files, the folders have to have permissions of 777. 777 though meant that the writable folder was prone to an attack from another infected website on the web server, using a directory traversal, an attacker could write into any folder within other websites that were writable.

And because it is possible in method 1 for malicious scripts to execute outside of the virtual host folder, it is possible for affected scripts to be used to read higher up into the server, like to nab the root user and passwords, scan all directories and files, read them, which usually could give an attacker enough information to be able to enter every site on that server (consider for a minute that a configure.php file chmod to 644 is still readable, even chmod to 444 is still 'readable' in this method 1 type configuration. In configure.php are the user and passwords for your mysql server, and in many situations, that user and password is not that different from the cpanel login, and the FTP user and password.

So while this restricted the overwriting attacks (often referred to as defacements) to just writable folders and to writable files on your website, it did allow attacks to span across multiple websites, often referred to as a mass defacement. It allowed attackers to run arbitrary code on non-root services like APACHE and spam assassin and others.

The second method, method 2 which has come into play with several php mods, usually in share hosting configurations, is to assign the owner privileges to the user and the script, thus pretty much making the whole file and folder permissions almost redundant if your web code security is crap. On the plus side, if another site on the shared server is exploited, the attack is not able to spread their attack across virtual hosts, in other words, the attack is restricted to just the site that has the weak security coding.

On the downside of method 2, if your site is the one that has been attacked, every file and folder in that configuration is pretty much vulnerable to be overwritten regardless of the file permissions (if malicious backdoor files have been installed, or code appended into files from the previous admin bypass exploit).

Sure you can chmod a file to 444 via a file manager or FTP client (if allowed), but in this particular configuration which is becoming more and more popular amongst shared hosts, because PHP has user permissions therefore is the owner, it is able to chmod file permissions back to writable.

So all an attacker needs to do is call chmod() a file from 444 to 644 before calling fopen($filename, 'a') to append their code to any file they wish, and if they want to be nice, chmod the appended file back to 444.

Of course it is a waste of time doing this to some files, so they go for the main include files usually, like the language file, application_top and the javascripts.

I think the key indicator in all of this is that if PHP is saying that all files and folders by default (644 for files and 755 for folders) are writable, and in some situations, the webhost has given you your own php.ini to play with, then your site is on one of these configurations.

So therefore that means that the attack has come via a file still resident in your file repository or appended code in your site files somewhere that you must have missed.

The question is not so much about shared hosting, although these type of phase two attacks are more common with shared host configurations, but whether or not a file with a permission of 644 is writable by your server.

So to test this create a file called something like filetester.php and add this code into it:

<?php
if ( is_writable( "index.php" ) ) {
echo "- index.php is writable by the server
";
} else {
echo "- index.php is not writable by the server
";
}
$writeperms = substr( decoct( fileperms( "index.php" ) ),3 );
echo "- the file permissions for index.php are " . $writeperms;
?>

Upload it into your main catalog directory and browse to it.


So that little script above just gives you an indicator that if your index.php file is set to 644 and is writable by PHP, then there is a good chance all the files are the same. And by implication that your site is on a method 2 type configuration, that could mean there is still a rogue file or code somewhere on your site that has been missed somehow, rather than the usual assumption that the attack has been a traversal across from another affected website.

Try this, create a file called whatever you want, test123.php for example. Add this to it:

<?php
$testfile = "testchmod.php";
error_reporting(0);
$i=0;
if ( !chmod( $testfile, 0666 ) ) {
$i++;
} else {
$msg .= "able to chmod
";
}
if ( !$fp = @fopen( $testfile, "w" ) ) {
$i++;
} else {
$msg .= "able to open file
";
}
$contents = file_get_contents( $testfile, true );
if ( fwrite( $fp, $testfile ) === FALSE ) {
$i++;
} else {
$msg .= "able to write to file
";
}
if ( !fclose( $fp ) ) {
$i++;
} else {
$msg .= "able to close file
";
}
 
if( $i > 0 ) {
echo $testfile . " is Write-Protected";
} else {
echo $msg;
}
?>

and upload it to your shop folder.

Then create a second file called testchmod.php and upload that to your shop, and chmod it to whatever, 444, 600, 644 etc.

Then run test123.php and see what it says.

If PHP can write to it, it will chmod the file to 666 and print out what it is able to do.

!!! Only try this on test files, never on your actual site files.

Long-winded I know, but just hope it gives a better insight into why there are differences in server setups where that same code above on one site would say that index.php is read only, and on another, its writable, yet the file permissions are the same.


How To Run SQL.

Moved to How To Run SQL on my web site.

UK Your Site

For a comprehensive way of changing EVERYTHING to UK(UK-Based: Default osCommerce Installation).

Date formatting: UK-Based osCommerce 2.2 & Date of Birth PullDown

Another couple of threads might be of interest

UK Royal Mail & Overseas Shipping Methods (UK & Overseas Postage Methods).
Single Country on Registration (Only if you plan to post to UK only! Removing Country Selection on Register.)

Payment

Read this link before processing Credit Card data on your site.

Do not allow your customers to enter cc details on any OSC screen unless you are PCI compliant, team up with a card processor such as paypal, protx, or autorize.net and accept cc details on their system.

Use a contribution such as PayPal, Protx etc.

PaypalBasic Guide and PP Guide and PP Standard or another PP Guide or Paypal IPN

Paypal IPN -how to generate your encryption certs

How to secure your site.

Search Engine Optimisation

Google SEO Starter-guide

Comparison of SEO contibutions.

- Header Tags SEO V 3.1.2
- ULTIMATE SEO Urls 5
- Ultimate SEO URLs - 2.1d
- Sitemap SEO
- All Products SEO
- Googlebase
- Updated Spiders file
- Robots file
- SID killer
- SEO Assistant

How to Speed Up Your site.

Apart from upgrade to a faster server [img]http://forums.oscommerce.com//public/style_emoticons/default/whistling.gif[/img])

A Store Speed Optimization in Progress, Step by step from a vanilla install!
An example of how to debug a nasty query problem
Find slow queries
Optimise Categories
Optimize tep_get_tax_rate() method

These could be of help.

http://addons.oscommerce.com/info/4203
http://addons.oscommerce.com/info/4083
http://addons.oscommerce.com/info/4052
http://addons.oscommerce.com/info/4075
Sometimes the images you have on your site are massive and you could do with making the smaller, try this to Reduce Image Size.

2.3.1

CSS and other Links

The look and feel of 2.3.2 is controlled in a different way from 2.2.

The layout uses the 960 Grid method and the style sheet is stored at ext960gsrtl_960_24.css.

The theme is controlled by a theme stylesheet, for the Redmond theme it is in extuiredmondjquery-ui-1.8.6.css. Additionally jquery.fancybox-1.3.4.css controls the fancybox image box on the product pages.

You can create your own theme, start by reading getting started with jquery., then move on to the ThemeRollerpage.

Once you are comfortable with that have a look at and install the Theme Switcher addon

Useful 2.3.1. Links

http://forums.oscomm...ost__p__1549798
http://forums.oscomm...ost__p__1546060

Enjoy

Geoffrey

www.theukwaltons.co.uk