Jump to content

  2. → Viewing Profile: burt

Corporate Sponsors


Latest News: (loading..)

burt

Member Since 09 Sep 2002
Offline Last Active Yesterday, 12:32
****-

Topics I've Started

Updated Security Thread

16 May 2011, 11:45

The other security thread is good, but times have moved on. Here are my base suggestions (in no particualr order) for securing a unhacked site;

1. Security Pro from FWR Media
2. OSC SEC from Taipo
3. Filesafe from FWR Media
4. Add htaccess to all public folders
5. Rename /admin/ and htpasswd it
6. Remove references to (newly renamed) admin area in outgoing emails
7. Add extra login parameter (JanZ)
8. Fix $PHP_SELF spoofability

Bad Conduct from Debs (undecided on this, I am still "road-testing" it).

I am not in favour of IP trapping, as most hackers don't use their own IP addresses.

If anyone has any extra thoughts on this, please post.

For securing a hacked site - exactly the same, but make sure that the hack is cleaned out first. This can be done by manually inspecting the files and removing any files/code that is not supposed to be there. Or by re-installing from a known unhacked backup. Or of course, starting from scratch with a brand new install of oscommerce.

Revamp Checkout

04 March 2011, 16:28

In my new site, I want to have nothing other than create_account (which will be only name, email, password) and checkout_confirmation.

What I then want is to have the customer go to their order_history to pay. Here I envisage payment via a button for each payment method offered;

[ click here to pay by paypal ]
[ click here to pay by RBS Worldpay ]

and so on. Once paid, all buttons disappear.

Anyone developer already done anything like this? Any input appreciated.

  1. osCommerce Support Forum
  2. → Viewing Profile: burt
  3. Forum Rules