Category Specific Access Restriction (CSAR) - [Support Thread]

In the next couple of days I will be submitting my latest plugin Category Specific Access Restriction (CSAR)

This plugin has the official version number 2.0, reason being that I have previously released a mod with a similar name for ZC version 1.3.9h. That particular mod was unsatisfactory as it did not address sideboxes and centre columns. It also could not restrict products by manufacturers.

Although related to this plugin the original mod and this new plugin are NOT compatible in any way, hence this new support thread and a new version number.


This plugin allows you to

1. hide prices of selected categories if the customer is not logged in. The prices of these categories are hidden and the 'Buy Now' button is replaced with 'Login for price'
2. specify selected categories which can only be accessed by privileged customers, for example paid-up members. The customer must be logged in AND the customer must be individually authorized by the store owner to access the selected category / categories. Just being logged in does not automatically grant access to these 'privileged' categories. The authorization of individual customers is done via the Admin > Customers file.
3. specify manufacturers whose products are hidden and are only accessible by customers with special 'privileges'. This can be useful if the manufacturer imposes such a restriction upon online stores or if the range of their products is of sensitive nature.

These categories and manufacturers can be configured via admin and the configuration is stored in the database.

The chosen configuration is reflected in the centreboxes 'New Products For (month)' , 'Specials' and 'Featured Products' and their corresponding sideboxes.

The 'Bestsellers' sidebox is disabled unless a 'privileged' customer is logged in. At this stage the 'Bestsellers' sidebox can not be configured in any other way (I am working on this.....).

In addition 'All Products' also reflects the chosen configuration.

The whole store continues to work as normal, customers can browse, see prices, add products to the cart and check out - with the exception of the specified categories and/or manufacturers.

This mod has been tested to work with Zen Cart v1.5.1 but *may* work with prior versions - use at your own peril, better though: upgrade your store to ZC v1.5.1

A generic simple demo site is available here

I will let you know when the new plugin has been approved by the team and is ready for download. A direct download link will be posted here.

Frank

A quick update about this plugin:

During 'final' testing I found some bugs which obviously needed to be fixed before submitting the plugin.

Unfortunately it has taken me a bit longer than anticipated to get things right. At long last the mod is working to my satisfaction, all that is left to do is a 'cleanup' of comments in the code and finalizing the documentation.

So, please accept my apologies for the delay, submission is mighty close!

Updated demo site here

Cheers / Frank

Works pretty well, nice job ... :smile:
However, hacker that I am, there is a way to trick it on going to a products_info page by changing the URL cPath ... :eek:

Interesting enough, removing the cPath and just using the products_id IS protected ...

Something to play with:
/index.php?main_page=product_info&cPath=69&products_id=186 <-- blocked

/index.php?main_page=product_info&cPath=2&products_id=186 <-- sneaks in

Granted you have to really want to get in there and are not a "good" customer ... so, this might not be worth the hassel to try to fix ... otherwise, somewhere you may need one more check that evil is not being committed ...

Ajeh:

Works pretty well, nice job ... :smile:
However, hacker that I am, there is a way to trick it on going to a products_info page by changing the URL cPath ... :eek:

Interesting enough, removing the cPath and just using the products_id IS protected ...

Something to play with:
/index.php?main_page=product_info&cPath=69&products_id=186 <-- blocked

/index.php?main_page=product_info&cPath=2&products_id=186 <-- sneaks in

Granted you have to really want to get in there and are not a "good" customer ... so, this might not be worth the hassel to try to fix ... otherwise, somewhere you may need one more check that evil is not being committed ...

Thank you for your kind comments Ajeh!

It is the 'good hackers' that reveal flaws - so many thanks for that, I have a go at this in v2.1. No doubt more comments will surface from fellow zenners....

Cheers / Frank

Another one to peek at is when going through the Manufacturers box ... things like Hide Prices does hide prices but allows the add to cart to happen ...

Ajeh:

Another one to peek at is when going through the Manufacturers box ... things like Hide Prices does hide prices but allows the add to cart to happen ...

Stupid me did not upload the /includes/modules/MY_TEMPLATE/product_listing.php file from my local server to the live demo site :ohmy:

It's fixed now, thanks again Ajeh!

Ajeh:

......

Granted you have to really want to get in there and are not a "good" customer ... so, this might not be worth the hassel to try to fix ... otherwise, somewhere you may need one more check that evil is not being committed ...

Had another thought on this point:

A customer needs to know the products_id before they can apply this "trick". They first need to be (manually) privileged by the store owner to actually get the products_id

If they are already approved (=privileged) then there is no point for them to try this hack.

In the demo store the privileged login credentials are openly displayed for demo / testing purposes, in a real store that is not the case.

Still, for this mod to be picture perfect it needs to be watertight. So ..... v2.1 it will be

Need to find a test where the products_id is checked against the array CATEGORY_RESTRICTION_LOGIN_CATEGORY which is configured via admin :huh: ...

That appears to be working better on the Manufacturers selection ... and the Search now appears to be working better (forgot to mention that issue) ...

Ajeh:

Works pretty well, nice job ... :smile:
However, hacker that I am, there is a way to trick it on going to a products_info page by changing the URL cPath ... :eek:

Interesting enough, removing the cPath and just using the products_id IS protected ...

Something to play with:
/index.php?main_page=product_info&cPath=69&products_id=186 <-- blocked

/index.php?main_page=product_info&cPath=2&products_id=186 <-- sneaks in

Granted you have to really want to get in there and are not a "good" customer ... so, this might not be worth the hassel to try to fix ... otherwise, somewhere you may need one more check that evil is not being committed ...

Plugged the security hole.

File /includes/templates/MY_TEMPLATE/templates/tpl_product_info_display.php amended to this:

[ file header here]

<?php 
/** 
* CATEGORY_RESTRICTION - find corresponding master category for the current product 
 */ 
$products_id_to_block = $_GET['products_id']; 
global $db; 
$sql = "select master_categories_id from " . TABLE_PRODUCTS . " where products_id = :productID:"; 
$sql = $db->bindVars($sql, ':productID:', $products_id_to_block, 'integer'); 
$result = $db->Execute($sql); 
 
if ($result->RecordCount() > 0) { 
  echo '(used for testing purposes): Master Category ID = ' . $result->fields['master_categories_id']; 
} else { 
  echo 'Sorry, no record found for product number ' . $products_id_to_block; 
} 
 
if (!$_SESSION['customer_id'] && !$_SESSION['customers_privileges'] > 0 && in_array($result->fields['master_categories_id'],explode(',', CATEGORY_RESTRICTION_LOGIN_CATEGORY)) ) { 
 //echo ' - this product should be blocked !!'; 
 echo TEXT_ILLEGAL_ACCESS ; 
} else { // bof CATEGORY_RESTRICTION - OPEN ACCESS 

.... orginal body of the file

.... then at the bottom added after 
<!--bof Form close-->
 
<?php 
    } // eof CATEGORY_RESTRICTION - OPEN ACCESS 
?> 
</div>

Thanks again for pointing this out Ajeh!

Just to keep you updated: I have submitted this plugin for inclusion to the downloads section a few days ago and I am awaiting approval by the moderators.

Version 2.0 is now available from the plugins section.

Link: http://www.zen-cart.com/downloads.php?do=file&id=1234

Cheers / Frank

My question is in relation to Category Specific Restriction of Product Price Display V1. I did have this working about a month when testing the function. However, when i tried to apply the mod again it doesn't work. Do you have any ideas?
Any help would be very appreciated, I'm taring my hair out!!! :(

storm007:

My question is in relation to Category Specific Restriction of Product Price Display V1. I did have this working about a month when testing the function. However, when i tried to apply the mod again it doesn't work. Do you have any ideas?
Any help would be very appreciated, I'm taring my hair out!!! :(

V1 had various issues. It is for that reason that I have released v2.0 (CSAR) for Zen Cart 1.5.x

V1, as it stands, is no longer supported.

If you are running Zen Cart 1.3.9h or lower, you will need to upgrade your installation to ZC 1.5.1 and install CSAR 2.0

frank18:

V1 had various issues. It is for that reason that I have released v2.0 (CSAR) for Zen Cart 1.5.x

V1, as it stands, is no longer supported.

If you are running Zen Cart 1.3.9h or lower, you will need to upgrade your installation to ZC 1.5.1 and install CSAR 2.0

Thanks Frank,

I have also tried using CSAR v2.0, but again the mod didn't work, all the files that i uploaded altered the look of the store but didn't actually do the required function. I have also tried these mods on other zencarts I have access to, but still no luck. Is it a possibility other files need to be edited in some way?

How can the original CSAR work a month ago but not now?

Kind regards
Simon

storm007:

Thanks Frank,

I have also tried using CSAR v2.0, but again the mod didn't work, all the files that i uploaded altered the look of the store but didn't actually do the required function. I have also tried these mods on other zencarts I have access to, but still no luck. Is it a possibility other files need to be edited in some way?

How can the original CSAR work a month ago but not now?

Kind regards
Simon

Simon,

Are you using ZC 1.3.9h or the latest 1.5.1?

CSAR was only released less than one month ago - so something does not stack up??

Cheers / Frank

Sorry Frank I was using the Category Specific Restriction of Product Price Display (OLD v1 mod) about a month ago. It worked on that occasion but trying it again this week, it now doesn't which is bizarre. I then decided to use your new CSAR v2.0 this week, but can't get that to work either! I am just wondering if any other files need to be changed that aren't outlined in the mod?

Simon

storm007:

Sorry Frank I was using the Category Specific Restriction of Product Price Display (OLD v1 mod) about a month ago. It worked on that occasion but trying it again this week, it now doesn't which is bizarre.

If it has worked before then we can only assume that you have made other changes to your file system since then.

I then decided to use your new CSAR v2.0 this week, but can't get that to work either! I am just wondering if any other files need to be changed that aren't outlined in the mod?

Without knowing your ZC version (1.5.1 ???? I hope) there is no way that I can be of further assistance. Also please post a link to your site and let us know which template you are using.

Frank

Hi Frank,

Thanks for your time on this problem.

The site address is www.neilson-hydraulics.co.uk/store.

I am using template, Pure Blue Free on v1.5.0 of zencart.

I have set up a temporary category link called test with 2 test products inside. As you will see, the prices of these items are disabled in the product listing page, but when you click on them you are directed to a blank page instead of being directed to the login page. Like i said, i did have this working about a month ago.

Thanks once again for your assistance with this.

Kind regards
Simon

storm007:

Hi Frank,

Thanks for your time on this problem.

The site address is www.neilson-hydraulics.co.uk/store.

I am using template, Pure Blue Free on v1.5.0 of zencart.

I have set up a temporary category link called test with 2 test products inside. As you will see, the prices of these items are disabled in the product listing page, but when you click on them you are directed to a blank page instead of being directed to the login page. Like i said, i did have this working about a month ago.

Thanks once again for your assistance with this.

Kind regards
Simon

Simon,

please open your includes/templates/YOUR_TEMPLATE/templates/tpl_product_info_display.php file , scroll to the bottom of the file and post the last 10 or 12 lines of that file.

Frank

frank18:

Simon,

please open your includes/templates/YOUR_TEMPLATE/templates/tpl_product_info_display.php file , scroll to the bottom of the file and post the last 10 or 12 lines of that file.

Frank

Hi Frank,

<!--bof Product URL -->
<?php
if (zen_not_null($products_url)) {
if ($flag_show_product_info_url == 1) {
?>
<p id="productInfoLink" class="productGeneral centeredContent"><?php echo sprintf(TEXT_MORE_INFORMATION, zen_href_link(FILENAME_REDIRECT, 'action=url&goto=' . urlencode($products_url), 'NONSSL', true, false)); ?></p>
<?php
} // $flag_show_product_info_url
}
?>
<!--eof Product URL -->

</div>

<!--bof also purchased products module-->
<?php require($template->get_template_dir('tpl_modules_also_purchased_products.php', DIR_WS_TEMPLATE, $current_page_base,'templates'). '/' . 'tpl_modules_also_purchased_products.php');?>
<!--eof also purchased products module-->

<!--bof Form close-->
</form>
<!--bof Form close-->

</div>

</div>
</div>

</div>