3 - You say that the install process purposely sets the register_globals to OFF, and I'm glad that you do if it causes a security risk to have it on. Then WHY does your install process then report the "OFF" setting as "BAD"? I think this needs to be changed.
php do not give ability to change that directive "on-a-fly". We just can to reset all globals variable in that case.
by the way, this directive marked as deprecated in php 5.3 and removed in php 5.4.
When we show "BAD" we try to notify user about potential security risks with 3d-party php scripts, but not abantecart! Register_globals is not critical configuration setting.
4 - In the installation instructions, it says: "For Linux/Unix make sure the following folders and files are writable
chmod 0777 admin/system/backup/
chmod 0777 download/
chmod 0777 extensions/
chmod 0777 image/
chmod 0777 image/thumbnails/
chmod 0777 system/
chmod 0777 system/config.php
chmod 0777 system/cache/
chmod 0777 system/logs/"
Doing this is causes a serious security risk! Many, if not most or even all hosting companies not only tell you not to use 0777... they actually will BLOCK your website if you have any 0777 settings! HostGator tech support wrote this: "The problem with 777 file permissions is that it means the file is writable by anyone. Anyone else could modify the file, including the web server. It is recommended that the web server be able to read the files or execute the files, but there are times when you want the web server to have write access it just isn't that common. The outside risk is that someone could find a flaw in your site and use that flaw to rewrite your files."
I strongly suggest that you change the installation instructions.
[/quote]
no any risks! The input point of all requests of abantecart is file index.php. All other files just includes into it and running with permissions of index.php.
regarding hosting providers suggests..."writable by anyone" means anyone who login in shell as user. Usually, php scripts runs with web-server's permissions.
Abantecart have it's own upgrade controller that replaced old files and adds new, by another words, it needs to write permissions for automatic upgrade.
if you do not plan to upgrade abantecart automatically you can set all permissions for files to 644 and folders 755 and change file owner (i think it's paranoic mode:))
To damage some core-file you needs to run some bad php-script. But to do this without ftp or shell access?
How to upload it and get http-access for run?
Can i look on working exploit for abantecart?
Thank you.
p.s. Maybe my answer will seem a little harsh, but it is not. Just English is not my native language.
