p4d Free Shipping Support

Hi

I am running

https://www.whiterose-equestrian.co.uk
Zen Cart 1.3.8a
Patch: 1::
Database Patch Level: 1.3.8
PHP Version 5.2.9

I have a number of contributions which do not affect the core code.

I have not experienced problems - but have been thinking and I am now concerned to the extent that I think I should ask for guidance

We use a third party shipping agent on occasion and find them very good. http://www.p4d.co.uk/

They offer a facility to download shipping info from ebay, oscommerce and zen. This comprises of the attached program that sits in the root directory

Looking at what it does, I am concerned that it could assist others to breach security. It doesn't sit behind an htaccess file. The password is freely available in that it sits in the file for all to see although this seems of limited value as it is supposed to correspond with the same password in the program that initiates the download in the p4d site.

I guess what is the core concern is that the code simply seems to ask for the server details from the config file and then use that information to download whatever. Using this principle any code could be implemented to access information.

Am I thinking correctly or are the checks in the system and I am way off beam

Any guidance on this would be gratefully recieved

Thank you

To run Zen Cart there's a need to store certain "access" information in .php files on the server. Namely the database user/password credentials, which then unlocks all the store's data.

Your addon does similarly by storing the validation key which attempts to prove that whoever/whatever is attempting to read order-data from your site is allowed to do so. Instead of requiring them/it to login with a username/password, it's just merely passing a "token" or "key" as part of the URL making the read-request. Your server will check that the key is valid, and then respond with all the order details being requested.

Your concerns are valid, but as long as the script itself does nothing rogue, it's fine, and is almost the only option available. (There are a few other much more complicated ways.)

So, with those valid concerns, it behooves you to make sure EVERYTHING on your site is ABSOLUTELY secure. And running v1.3.8a is risky. Granted, you appear to at least have the one major patch installed. There were a few patches issued for v1.3.8a, but v1.3.9 has all the patches already built-in, as well as a number of additional tightened security benefits.

A quick review of the psm script you attached suggests that it's doing nothing to be alarmed about.

DrByte
Good Evening

Thank you for taking a look at this - it is much appreciated - I ended up going round in circles...

I will reinstate the file - for non UK orders the facility is very useful indeed.

I have taken on board your comments re v1.3.8a. There is a copy of v1.3.9 on the test system to incorporate files and it will be implemented asap

Can I take the opportunity to sincerely thank you and your colleagues for making all this possible - I parted company with my employers last year and this is now our "living" - not quite in the plan but.... you can teach and old dog new tricks! Thank you.

We're glad it's working for you!