<%
'*********************************************************
' VP-ASP 6.50 Validate that default passwords are not used
' Jan 5, 2003
'*********************************************************
Sub shopSecuritycheck
dim infolder, fs, strpagename,i
dim msgWritten, footerwrite
setsess "errorPresent","false"
%>
|
<% if getsess("security") = "" then %>
<% else %>
<% end if %>
<%
on error resume next
CheckPasswords
if GetSess("admintype") = "SUPER" then
CheckSecondPassword
CheckDatabase
checkxshopid
CheckAdminPage
CheckInSecurePages
CheckConfig
CheckSecurityKey
end if
If Err.Number <> 0 then
Response.Write "The VPASP Security Check could not be 100% completed. Please check the your file permissions. - "
Error.Clear
End If
%>
|
|
|
<%
setsess "security",""
End Sub
Sub CheckDatabase
infolder=server.mappath("shopsecuritycheck.asp")
infolder=Mid(infolder,1,len(infolder)-len("shopsecuritycheck.asp"))
dbexists(infolder)
End Sub
Sub dbExists(CheckFolder)
dim dbnames, mysubfolder,myfolder
dbnames = "shopping350.mdb,shopping400.mdb,shopping450.mdb,shopping500.mdb,shopping550.mdb,shopping600.mdb,shopping650.mdb"
dbnames = split(dbnames, ",")
Set fs=Server.CreateObject("Scripting.FileSystemObject")
for i = 0 to ubound(dbnames)
if (right(checkfolder, 1) <> "/") AND (right(checkfolder, 1) <> "\") then
checkfolder = checkfolder & "\"
end if
if fs.FileExists(CheckFolder & dbnames(i)) then
Response.Write "| DATABASE - Please rename database and store in a secure folder. (" & CheckFolder & dbnames(i) & ") |
| |
" & vbcrlf
setsess "errorPresent","true"
end if
next
Set MyFolder=fs.GetFolder(CheckFolder)
For Each MySubFolder in MyFolder.SubFolders
dbexists MySubFolder
Next
End Sub
Sub checkxshopid
select case xshopid
case "shop550","shop500","shop450","shop400","shop350","shop600","shop650"
Response.Write "XSHOPID - Please rename the xshopid setting in shop$config.asp and reload your configuration.
The xshopid is the name of the ""box"" that stores your site variables. If there are two sites on the same server with the same ""box"" name they will mix up the settings. |
| |
" & vbcrlf
setsess "errorPresent","true"
Exit Sub
end select
End Sub
Sub CheckInSecurePages
msgWritten = false
footerwrite = false
Set fs=Server.CreateObject("Scripting.FileSystemObject")
infolder=server.mappath("shopsecuritycheck.asp")
infolder=Mid(infolder,1,len(infolder)-len("shopsecuritycheck.asp"))
strpagename= "diag_dbtest.asp,diag_sessionlist.asp,diag_findfiles.asp,diag_smstest.asp,diag_mysqldbtest.asp,"
strpagename = strpagename & "convertsql.asp,convert550.asp,convert600.asp,convert650.asp,convert500.asp,convert450.asp,convert400.asp,convert350.asp,convert550access.txt,convert600access.txt,convert650access.txt,convert500access.txt,convert450access.txt,convert400access.txt,convert350access.txt,convert550config.txt,convert600config.txt,convert650config.txt,convert500config.txt,convert450config.txt,convert400config.txt,convert350config.txt,convert550imageupload.txt,convert500imageupload.txt,convert450imageupload.txt,convert400imageupload.txt,convert350imageupload.txt,convert550sqlserver.txt,convert600sqlserver.txt,convert650sqlserver.txt,convert500sqlserver.txt,convert450sqlserver.txt,convert400sqlserver.txt,convert350sqlserver.txt,convertcategories.asp,convertconfig.asp,convertproducts.asp,convertsql.asp,"
strpagename = strpagename & "convert650admin.asp,convert650inventory.asp,convert650mysql.txt,converttaxes.asp,create650demo.txt,create650mysql1.txt,diag_expirecookie.asp,"
strpagename = strpagename & "create550mysql.txt,create600mysql.txt,create650mysql.txt,create500mysql.txt,create450mysql.txt,create400mysql.txt,create350mysql.txt,create550admin.txt,create600admin.txt,create650admin.txt,create500admin.txt,create450admin.txt,create400admin.txt,create350admin.txt,create550demo.txt,create500demo.txt,create450demo.txt,create400demo.txt,create350demo.txt,create550sqlserver.txt,create600sqlserver.txt,create650sqlserver.txt,create500sqlserver.txt,create450sqlserver.txt,create400sqlserver.txt,create350sqlserver.txt,create550sqlserver.sql,create600sqlserver.sql,create650sqlserver.sql,create500sqlserver.sql,create450sqlserver.sql,create400sqlserver.sql,create350sqlserver.sql,"
strpagename = strpagename & "vsadmin.asp,shoptmptest.asp,sv.asp,shopdbtest.asp,shopa_sessionlist.asp,mysqlcreate.asp,convertmysql.asp"
strpagename = split(strpagename, ",")
For i = 0 to ubound(strpagename)
If fs.FileExists(infolder & strpagename(i)) then
if msgwritten=false then
msgwritten=true
footerwrite = true
Response.Write "| INSECURE PAGES - You must delete these files before going live. |
"
end if
setsess "errorPresent","true"
response.write "| " & strpagename(i) & " |
" & vbcrlf
End If
Next
if footerwrite = true then
Response.Write "| |
"
end if
set fs=nothing
End Sub
Sub CheckConfig
msgWritten = false
footerwrite = false
if lcase(getConfig("xadminmenucheck")) <> "yes" then
if msgwritten=false then
msgwritten=true
footerwrite = true
Response.Write "| INSECURE CONFIGURATION SETTINGS |
"
setsess "errorPresent","true"
end if
Response.Write "| xadminmenucheck is set to No. This should be set to Yes in the configuration before going live. |
" & vbcrlf
end if
if lcase(getConfig("xrestrictadmintables")) <> "yes" then
if msgwritten=false then
msgwritten=true
footerwrite = true
Response.Write "| INSECURE CONFIGURATION SETTINGS |
"
setsess "errorPresent","true"
end if
Response.Write "| xrestrictadmintables is set to No. This should be set to Yes in the configuration before going live. |
" & vbcrlf
end if
if lcase(getConfig("xshowadmin")) <> "no" then
if msgwritten=false then
msgwritten=true
footerwrite = true
Response.Write "| INSECURE CONFIGURATION SETTINGS |
"
setsess "errorPresent","true"
end if
Response.Write "| xshowadmin is set to Yes. This should be set to No in the configuration before going live. |
" & vbcrlf
end if
if lcase(getConfig("xencryptcreditcard")) <> "yes" then
if msgwritten=false then
msgwritten=true
footerwrite = true
Response.Write "| INSECURE CONFIGURATION SETTINGS |
"
setsess "errorPresent","true"
end if
Response.Write "| xencryptcreditcard is set to No. If taking Credit Cards, this should be set to Yes in the configuration before going live. |
" & vbcrlf
end if
if footerwrite = true then
Response.Write "| |
"
end if
End Sub
Sub CheckPasswords
ShopOpenDatabase myconn
sql = "select fldpassword from tbluser where fldusername IN ('vpasp','admin')"
Set rs = myconn.Execute(sql)
while not rs.eof
if (lcase(rs("fldpassword")) = "admin") or (lcase(rs("fldpassword")) = "vpasp") then
Response.Write "| PASSWORDS - You are using the default passwords, which makes your site open to hackers. Please change your userids and passwords as soon as possible. |
| |
" & vbcrlf
setsess "errorPresent","true"
CloseRecordSet rs
shopclosedatabase myconn
exit sub
end if
rs.movenext
wend
CloseRecordSet rs
shopclosedatabase myconn
End Sub
Sub CheckSecondPassword
'31/01/2006 xadminpage no longer exists. Second password check moved to shopadmin.asp
' dim substring, subon, adminFile
'
' subon=false
'
' set fs = CreateObject("Scripting.FileSystemObject")
' infolder=server.mappath("shopsecuritycheck.asp")
' infolder=Mid(infolder,1,len(infolder)-len("shopsecuritycheck.asp"))
' set adminFile = fs.OpenTextFile(infolder & getconfig("xadminpage"))
' Do while not adminFile.AtEndOfStream
' counter = counter + 1
' thisLine = adminFile.readline
' thisLine = Replace(thisLine,"<","<")
' thisLine = Replace(thisLine,">",">")
' if instr(1,thisLine,"const secondpassword=""""",1)<>0 then
' Response.Write "| SECOND PASSWORD - You are not using a second password. Please add this into line " & counter & " of " & getconfig("xadminpage") & " |
| |
" & vbcrlf
' setsess "errorPresent","true"
' end if
' Loop
End Sub
Sub CheckAdminPage
msgwritten = false
footerwrite = false
Set fs=Server.CreateObject("Scripting.FileSystemObject")
infolder=server.mappath("shopsecuritycheck.asp")
infolder=Mid(infolder,1,len(infolder)-len("shopsecuritycheck.asp"))
If fs.FileExists(infolder & "shopadmin.asp") then
if msgwritten=false then
msgwritten=true
footerwrite = true
Response.Write "| SHOP ADMIN |
"
end if
setsess "errorPresent","true"
response.write "| You should rename the file shopadmin.asp before going live and change the const xadminpage at the top of the file to the new filename. |
" & vbcrlf
'31/1/2006 - xadminpage now in admin page itself. Can't be checked.
' elseif (lcase(getConfig("xadminpage")) = "shopadmin.asp") then
' if msgwritten=false then
' msgwritten=true
' footerwrite = true
' Response.Write "| SHOP ADMIN |
"
' setsess "errorPresent","true"
' end if
' Response.Write "| xadminpage is still set to shopadmin.asp. This file should be renamed and shop$config.asp changed before going live. |
" & vbcrlf
end if
if footerwrite = true then
Response.Write "| |
"
end if
End Sub
Sub CheckSecurityKey
msgwritten = false
footerwrite = false
If xencryptkey = "agabAhjBcG" then
if msgwritten=false then
msgwritten=true
footerwrite = true
Response.Write "| ENCRYPTION KEY |
"
end if
setsess "errorPresent","true"
response.write "| The encryption key in shop$config.asp is still set to the default. Please change this key before going live to ensure greater security of data in your site. |
" & vbcrlf
end if
if footerwrite = true then
Response.Write "| |
"
end if
End sub
%> 
