Password Protect directories with OSCommerce - UK Web Hosting | Dedicated Server Windows and Linux VPS Forum

**Chris** · #1 (**permalink**) 03-09-2007, 20:36

I have been experimenting with OSCommerce and have launched a couple of shops in the form of on-line galleries. The default installation automatically password protects the ADMIN directory - but I noticed that I actually have to login twice !

That didn't bother me too much - but I recently tried to password protect the whole shop by using cpanel to password protect the shop's root directory. Same effect here - i.e. the logon dialogue comes up twice before you get access !

Password protecting a standard directory seems fine. Any ideas please? I am also posting on the OSCommerce forum.

regards
Chris.

**DPS Computing** · #2 (**permalink**) 06-09-2007, 18:57

Can you give some more details? It seems like a strange problem.

Are the two password dialogs the same? Or is one a IE password dialog (like you get with password protecting a normal folder where it just asks you once) and one an OSCommerce text box password character input field on a page?

**WelshTom** · #3 (**permalink**) 06-09-2007, 20:08

Possibly two .htaccess files which are conflicting with each other. Check to ensure only one .htaccess file is present, and not two - as it will cause problems otherwise.

**Chris** · #4 (**permalink**) 07-09-2007, 17:48

Quote:

Originally Posted by DPS Computing

Can you give some more details? It seems like a strange problem.

Are the two password dialogs the same? Or is one a IE password dialog (like you get with password protecting a normal folder where it just asks you once) and one an OSCommerce text box password character input field on a page?

They look like standard password dialogues to me and they are identical. The second pops up immediately the first is closed - as if you got the password wrong.

Quote:

Originally Posted by Thomas

Possibly two .htaccess files which are conflicting with each other. Check to ensure only one .htaccess file is present, and not two - as it will cause problems otherwise.

I'm not sure how you could have two versions of the same file present in the same directory? Anyhow when I check the directory and files it all looks as expected.

I have created an oscommerce test shop so you can see the effect.
You can logon with "guest" / "password"

http://www.armphotography.co.uk/test_shop

Chris.

**WelshTom** · #5 (**permalink**) 07-09-2007, 18:04

Check to see if the user hasn't been added twice in the htpasswd file.

**Chris** · #6 (**permalink**) 07-09-2007, 18:20

Thomas - No - there's definitely only one entry for the 'guest' user in the "passwd" file.

**DPS Computing** · #7 (**permalink**) 07-09-2007, 18:27

I see what you mean - I had to type the username / password more than twice. In fact I had to enter it about 40 times as I had to enter it for every single image which would suggest to me a directory that should be public, where the images are stored, has actually been secured in error.

**Chris** · #8 (**permalink**) 07-09-2007, 18:29

.. also worth mentioning that this isn't just a one off for me. I have now replicated with four separate test installations.

As I have a reseller account I have tested on three separate domains - with the same result.

Test steps:
(1) Use Fantastico to install a new shop "test_shop" off the public_html directory.
(2) Edit the .htaccess file in the test_shop directory to add the user_globals flag (otherwise oscommerce doesn't work at all)
(3) Test the shop works with no access control on the test_shop directory.
(4) Use cpanel to password protect the test_shop directory with the single 'guest' user.
(5) Re-test access with user logon.

I have posted on oscommerce forum but not had a great response - so presumably not a common issue. A moderator there suspected some duplication in .htaccess or implied perhaps fantastico had added it's own security - but that didn't make sense to me.

Chris.

**DPS Computing** · #9 (**permalink**) 07-09-2007, 18:31

I have personally had problems with duplicated .htaccess files in the past so do just double check this after all is set up just to make sure.

**Chris** · #10 (**permalink**) 07-09-2007, 18:41

... still a bit confused on that. How can you have duplicate files? - or would they have different names? In any case there is only one .* file of any sort in the test_shop directory.

What about .htaccess in higher level directories ?

**Chris** · #11 (**permalink**) 07-09-2007, 18:43

Quote:

Originally Posted by Chris

In any case there is only one .* file of any sort in the test_shop directory

... at least according to cpanel file manager. Could this get confused?

**DPS Computing** · #12 (**permalink**) 08-09-2007, 08:41

They looked funny. It was like .htaccess, .htaccess1 etc so just check there is only one .htaccess* file in the directory.

Don't use cPanel file manager for this, it sometimes hides files that have nothing left of the . - use something like an FTP client, Dreamweaver, Frontpage or Expression Web and make sure any don't display hidden files option is not selected in these clients.

**Chris** · #13 (**permalink**) 08-09-2007, 19:10

No, I've given up on this for now. A work around was to insert another directory with a standard html page containing the link to the 'shop' and put the security on that.
Not great, but sufficient for this application which simply requires privacy rather than security.

**DPS Computing** · #14 (**permalink**) 08-09-2007, 19:16

Glad you found a solution to fit your needs then - if you have any more problems don't hesitate to ask for help

.

**swexpert** · #15 (**permalink**) 08-09-2007, 20:04

Hi Chris,
It seems a redirection issue. Oscommerce redirects to a secure page (folder) by default. You're protected the main folder as well.

What is happening is:
main-site/.htaccess (set by osc) -->redirect-->/yourshop_root/ (which has an htaccess with password)

IN the above scenario, you added
main-site/.htaccess (now with password) -->redirect-->/yourshop_root (which already had password protection)

OSC uses redirection a lot , loads another index file once you get authenticated. But because the parent is password protected, the system asks for password again.

Post your .htaccess file minus username/passwords so that someone may take a look.

Regds
IJ

**Chris** · #16 (**permalink**) 10-09-2007, 20:02

IJ, Thanks for commenting.
Well OSC doesn't auto secure the root. The fantastico installation secures the admin sub-folder only. So a default installation doesn't event have a .htaccess in the root. The only password protection entry here is that installed by cpanel.

In your above scenario I'm not sure what is meant by 'main-site' - isn't that the same as shop-root?

regards
Chris.

**swexpert** · #17 (**permalink**) 10-09-2007, 21:02

Hello,
By main-site I meant the document root of your domain. shop root would be yourdomain.tld/shop or yourdomain.tld/order

Ideally there should be an .htaccess file in all subfolders of OSC root with various settings such as register_globals and others.

I'll check yuor issue up try to recreate your environment in one of my website hostings and then get back to you soon (about 1 day).

Regds
IJ