My idea for accessing zen cart sessions outside of zen...

[glenelkins]

Hi

I know allot of people have been asking how to mainly access $_SESSION['customer_id'] from outside zen cart.

I also have posted a few times asking until it dawned on me, perhaps i could use SOAP to get the session data i need. I finally got the system working and would like to share my code with you guys and perhaps get some feedback??

Ok first off we need to download "NuSOAP" and extract the files into the following folder structure:

ZEN_CART_ROOT/nusoap/lib/FILES_HERE

Create the following file:

ZEN_CAR_ROOT/session_get.php

Within session_get.php the following code:

<?php
// Include application top
include_once ( "includes/application_top.php" );


function get_session( $var ){

	return ( settype ( $_SESSION['customer_id'], "string" ) );
}

// Load up nusoap library
require_once('nusoap/lib/nusoap.php');

// Create soap object
$Soap_Obj = new soap_server();

// COnfigure WSDL
$Soap_Obj->configureWSDL ( "session_get", "urn:session_get" );

// Register callback function
$Soap_Obj->register('get_session',
		array ( "var" => 'xsd:string'),
		array ( "return" => 'xsd:string'),
		'urn:session_get',
		'urn:session_get#get_session',
		'rpc',
		'encoded',
		'Returns Zen Cart Session Var'
	
		);

// Wait for response
$Soap_Obj->service($HTTP_RAW_POST_DATA);


?>

Now from the script you want to get the data to , for example the "customer_id" you use the following code:

<?php
// Load up nu_soap
require_once('ZEN_CART_ROOT/nusoap/lib/nusoap.php');


//now we must create a soapclient object
$soapclient = new nusoap_client('http://YOURDOMAIN.COM/ZEN_CART_ROOT/session_get.php?wsdl',true);

// Call get session variable function from server
$result = $soapclient->call ( "get_session", array ( "var" => "customer_id" ) );


if ( $client->fault ) {

	echo "<h2>Fault</h2><pre>";
	print_r ( $result );
	echo "</pre>";

} else {
	// trap error
	$err = $soapclient->getError();

	if ( $err ) {

		echo "<h2>Error</h2><pre>" . $err . "</pre>";
		print_r ( $result );
		echo "</pre>";

	} else {

		echo "<h2>Result</h2><pre>";
		echo $result;
		echo "</pre>";
		
	}

}	
?>

This piece of code is where we choose what variables to return:

// Call get session variable function from server
$result = $soapclient->call ( "get_session", array ( "var" => "customer_id" ) );

Hope this helps people!

[glenelkins]

This has a small bug im trying to fix right now

[glenelkins]

Iv just realised that with SOAP you cannot handle SESSIONS without actually changing a bunch of code on zen carts login and session handling code.

The best way iv found is write a small php script like this

<?php

// Include application top
include_once ( "includes/application_top.php" );

// Get the var we want
$var = $_GET['var'];

echo $_SESSION[$var];

?>

Place it in the zen cart root folder.

Then send over the variable you want using AJAX like this:

URL = ZEN_CART_ROOT/script_to_get_session.php?var=customer_id

This will then return the current logged in customer id to your javascript

[DrByte]

I hope you're planning to do a complete security audit of your custom code at some point, to close all the holes that creates ...

[glenelkins]

hi

can you point out security holes that you notice already and ill fix them up

[glenelkins]

in fact i think i may have an idea to use the SOAP client and server with a new database table and the zen cart $_COOKIE['zenid']

If I modify the login of zen cart i#to insert info into a custom db table such as session_id, session and timeout i can actually pass the zen sesison id to the soap server and check the database for a) that session id exists b) that session hasnt timed out. If the timeout is set the same as the zen cart one it should work ok

also edit the logout routine to delete the session info from the custom table.

any ideas on this?

[DrByte]

hi

can you point out security holes that you notice already and ill fix them up

My point was ... Calling something like /script_to_get_session.php?var=whatever to get the contents of ANY session var without validating who/what is making that request could easily disclose information that has no business being shared outside.