X-Cart forums

[TNCMEDIA]

Hello,

How do I add additional admin account for design work, specifically template customizations, to my x-cart? I saw the Users management tab, and there are three user profiles, but how do I specifically limit the (new admins) activity to the template design. Just looking to protect my store without granting too much access.

Thank you so much!

TNCMEDIA

[carpeperdiem]

Originally Posted by TNCMEDIA

Hello,

How do I add additional admin account for design work, specifically template customizations, to my x-cart? I saw the Users management tab, and there are three user profiles, but how do I specifically limit the (new admins) activity to the template design. Just looking to protect my store without granting too much access.

Thank you so much!

TNCMEDIA

You can give your designer access to FTP only, and not the store admin, but that would restrict access to only editing files. Sometimes this enough. But don't think an untrustworthy person couldn't make a mess of things...

You should hire a trustworthy designer.

Agree in advance that there is zero access to anything not specifically required to accomplish the job.

You will make a plan and then disable access once the job is completed.

While your store is in dev mode, be aware of admin and customer registrations. Be aware of php files added or edited. But limiting access to your designer will not get you the results you want.

[cflsystems]

You can't restrict development work like this. Whoever is doing this will need FTP and store admin access. Most of the time the store admin access may not be needed or may be needed initially to change store settings/modules but still...
Unless there is a need of direct access to db cPanel access is not needed.
Give the minimum but enough for them to do their work.
And yes you need to trust them...

[TNCMEDIA]

Thanks carpeperdiem and Steve,

Totally agree, one can never be too careful nowadays, not looking forward to any unnecessary breach... The developer needing access is "TemplateMela" They're adding a new "Books" Template for me to replace the "Books & Magazines" built in x-cart template. I believe that TemplateMela is an X-Cart Affiliate and is promoted by Qualiteam.

So, I guess just taking the necessary precautions as outlined by carpeperdiem should suffice? Any second thoughts, or comments on TemplateMela?

Thanks guys!

TNCMEDIA

[totaltec]

Here is the deal. If you give someone savvy, any type of access at all, whether it is ftp, cpanel, or just the template editor, you have given them everything they need in order to do whatever they like.

That is why the level of trust needs to be extremely high, and you should only work with devs that you trust implicitly. One concern that most never realize, is the access to their client base and email lists that they are giving out. It amazes me sometimes to think of the amount of harm that a non-trustworthy dev could do.

That being said, we have a large number of people on this forum that can be trusted, Steve, BCSE, Phil, Jon, Bill, Padriac just to name a few. You can easily form a relationship with the dev of your choice, and have them install the template for you. You could ask for instructions from this company, and have them just send you the files. All of this should be being done on a dev copy of your live site anyway. I know that some people will work directly on your live site, and I can't blame them really, but it seems extremely foolish to me.

I can't tell you how many times I have had to fix some emergency caused by some other technician, who many times did not even make a full backup before they started working. Even when there is an existing dev site in operation, they still decided to go in and work directly on the live site, without a copy of the db or the files.

I have several clients that only allow me access to the dev site, and when I am finished and everything is perfected, they make the changes to the live site per my instructions. To me, that is the only way to truly manage the risk.