Zen Cart Logo
trapezoid-twopenny
Open navigation menu
Home Community Forum Plugins
Documentation
For Developers For Storeowners
Services Donate Get Started
Forums / All Other Contributions/Addons / evertek

evertek

Results 1 to 10 of 10
20 Dec 2011, 06:35
#1
skraps avatar

skraps

New Zenner

Join Date:
Dec 2011
Posts:
8
Plugin Contributions:
0

evertek

I wrote a script to retrieve and convert the evertek csv to easy populate format. Now apparently I have to mod the core to allow curl to login. Anyone done this? This is the only thing holding it everything up. Thanks!
20 Dec 2011, 08:30
#2
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,506
Plugin Contributions:
173

Re: evertek

You said your script converts a CSV to EasyPopulate format. If it's only converting data formats, why does it need to login to anything?
20 Dec 2011, 13:09
#3
skraps avatar

skraps

New Zenner

Join Date:
Dec 2011
Posts:
8
Plugin Contributions:
0

Re: evertek

So it can auto update the database with new / updated values with out having to manually doing it your self. Auto shop updating :) I have already made a google page for it. So hopefully more people can make a use of it. I don't even run my own e-store this is for someone else.
20 Dec 2011, 14:01
#4
skraps avatar

skraps

New Zenner

Join Date:
Dec 2011
Posts:
8
Plugin Contributions:
0

Re: evertek

I'm trying to avoid actually messing with the database. zen cart and easy populate are already really good at manipulating the data in the db, so I'd rather just let them do those tasks. The only problem I was having was getting easy populate to accept the csv file. That problem is past but now, when I try to login to curl I get the regular login page with the same token.


Iv managed to scrape the token. And post the admin_name admin_pass securityToken also submit=Login but its not working that way.
20 Dec 2011, 19:01
#5
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,506
Plugin Contributions:
173

Re: evertek

Have you considered the implications of PCI DSS with your application? If you're creating something which gains access to the store's backend administration tools, then you need to ensure your code is totally secure. Anyone using your application puts themselves at risk if they allow outsiders (ie your application) to login.

www.pcisecuritystandards.org

Just something to keep in mind and ensure you alert people about when you give people your code.
20 Dec 2011, 19:26
#6
blindside avatar

blindside

Totally Zenned

Join Date:
Sep 2004
Posts:
1,237
Plugin Contributions:
0

Re: evertek

I think you may be overthinking your problem. Why not move your code into the Zen Cart admin. I don't see why your conversion couldn't occur on a page inside the Admin...
21 Dec 2011, 01:55
#7
skraps avatar

skraps

New Zenner

Join Date:
Dec 2011
Posts:
8
Plugin Contributions:
0

Re: evertek

The whole config file is encrypted with AES 256 bit encryption , the worst security issue would be dns poisoning w/ a man in the middle attack. I got it to work while keeping the security token feature working. The script doesn't access the admin page directly.

You can read about it here. http://jackiecraigsparks.wordpress.com/2011/12/20/auto-updating-product-lists-in-zen-cart/ Im going to post the code in the next day on google code. I'm working on putting ajax into it.

You can even trigger the script from your home/office pc, phone or tablet device to keep your login creds stored in the config private from preying eyes.

Now the whole security of the config is flawed when run from the same server on a cron job. Thanks for the link on PCI security standards. I will read that for sure.
21 Dec 2011, 01:57
#8
skraps avatar

skraps

New Zenner

Join Date:
Dec 2011
Posts:
8
Plugin Contributions:
0

Re: evertek

BlindSide: does the admin allow me to run like a cron job?
21 Dec 2011, 01:59
#9
skraps avatar

skraps

New Zenner

Join Date:
Dec 2011
Posts:
8
Plugin Contributions:
0

Re: evertek

The dns poisoning /w man in the middle would only allow a sql injection if the easy populate script didn't sanitize the csv.
24 Dec 2011, 16:17
#10
blindside avatar

blindside

Totally Zenned

Join Date:
Sep 2004
Posts:
1,237
Plugin Contributions:
0

Re: evertek

skraps:

BlindSide: does the admin allow me to run like a cron job?

The Zen Cart Admin is designed to serve webpages, and has no native recognition for cron jobs. However PHP code located in the Admin (or anywhere else for that matter) can be executed in a cronjob.

The concern DrByte and I have is that you're hacking around the login, which violates PCI.

Does the cronjob itself need to login, or are you logging in for a user so they can configure stuff?