Guidelines for security

Rowli001

Please accept my apologies in advance for the naivety in this post.
I installed Zenphoto using simplescripts, so probably bypassed some of the configuration options others might be aware of. My challenge is how to secure my gallery. At present, it is open to view to all without registration. I can't seem to find where I can lock down the access.

I have also been the victim of hackers injecting code into the PHP file. According to my hosting provider, the secret is to move the config file (zp-config) somewhere else. I would appreciate guidance on where in the scripts I need to modify to point to a different location.

Thanks

acrylian

I installed Zenphoto using simplescripts
We do not support installations using that at all.

At present, it is open to view to all without registration. I can't seem to find where I can lock down the access.
Why would you want to have a website/gallery that is not public viewable at all? You can password protect the gallery or albums. I suggest to look at little at the administration backend before asking such questions. (Note that the actual images in the albums folder can't be protected by that, you have to do that via .htaccess yourself if you want). You can of course also block the complete site using the right .htaccess.

Also I suggest to look at the troubleeshooting to set the right file/folder permissions and about protecting albums.

You can't remove the zp-config.php file because that is necessary. But you can remove the `zp-core/setup.php` file after installation. But you might need to reupload if you need to run it again.

sbillard

Also, if you did really use simplescripts most likely you are runnign a fairly old version of zenphoto. In that case, all bets are off for your site security. Your provider is clearly not too brite with respect to Zenphoto at least. As Acrylian says, removing the zp-config.php file will render your site inert.

Rowli001

Thanks for the comments. Just to clarify, the vendor gave generic advice, which is to 'Move' (not 'remove') config files to a location outside of the public area. I was trying to understand whether it is practical to do this, and how I would modify files to reference a config file in another location. I think the answer is 'No'.

acrylian

Moving a file out of a folder is removing it from that folder... How should a script know where you moved it?