3.5.2 upgrade showing "Your config.xml is writable"

Hi,

Ive just upgraded to 3.5.2 and followed the steps correctly to upgrade... everything seems to be in order... however the VBSEO admincp is showing a "Notice" saying the following:

Your config.xml is writable. Don't forget to update permissions after you finish updating the configuration for security purposes

Now i have set the permissions to "644" as instructed in the readme of the vbseo 3.5.2 package.. however the notice is still saying the config file is writable ?

Please advise me on what i should do.

Regards, Darren

Hello Darren ,

If you are still receiving this error even you set your config.xml permissions to 644 then you may have a serious problem on your server related chown permissions. Please note that if webserver have privilidges to modify file then chmod will not help. You should contact your host and ask them to make sure webserver have a different user , usergroup then your regular ftp users and webserver user , usergroup don't have privileges to update config.xml file

Hi mert,

The permissions changed fine.. ive not had permission issues before (hostgator servers, re-sellers account).. it's just that the notice continued to show after i changed the permissions.. i ended up clicking the close (X) button on the notice, it went away and has not shown since.. possible a cache problem ?

About to update another site on different hosting i will post again after and see if it happens again.

Thanks for your support

Regards, Darren

Having the same issue here after upgrading from 3.5.1 to 3.5.2. CHMOD Is verified 644 on config.xml

I thought it was just me. But no, others already have the same problem.

I've never had this problem before.

This is a new notification in 3.5.2 to help better alert vbseo customers that they may be at risk.

The easiest thing to do 99% of the time if your host offers it is to use the DSO version of apache instead of cgi. Not only is it faster, it is out of the box set up as its own user.

you sure its not Vbseo bug? bcoz he is not alone.. I m getting same (error) message.

As Brian explained we added a new notice just to warn customers to keep config.xml 644 when they are done with updating their configuration.

If your file is chmodded to 644 or 444 on some cgi setups and you're being told it's writable, you should contact your host because your webserver install itself is set up incorrectly and the apache user needs to be chowned to its own process.

Changing it to 444 fixed the problem on my server. Should I be concerned that 644 shows it as writable?

Getting this too and my host says 644 is set?

Hi guys,

Hostmonster is my hosting provider and I have the same problem...

Did anybody of you resolve it somehow?

Yes, like Brian said, changing it to 444 resolved the issue on my server. I'm not sure if it's related, but I hired ConfigServer to perform a security audit/upgrade (cPanel Server Service Package) which included some apache/kernel/php tweaks:

ConfigServer Server Services

Should I be concerned that 644 still displays the warning but 444 does not?

Originally Posted by vegasti

Should I be concerned that 644 still displays the warning but 444 does not?

I would also add: does 444 instead of 644 can be the cause of future problems? Eg. denied access when it's really needed?

Some php set ups require 444. you should try 644 first. If it still shows as being writable, try 444. If it still shows as being writable, find a new provider