Master Password Encrypted mod support

[Woodymon]

v 1.1 14.02.2007 7:57
- Use zen_draw_password_field() function to enter master password in admin;
- Use zen_cfg_password_display() function to display master password in admin (for 1.3.7 compatibility);
- Fix bug testing MASTER_PASSWORD_IP in password_funcs.php;

Special thanks to Woody!

Andrew-

The patch you supplied worked on my 1.27 shop fine.

So I then downloaded your new 1.1 version and updated 1.37 shop from Master Password Encrypted (MPE) 1.0 to the new v.1.1.

However I discovered I am now unable to log into other user accounts with the master password. I have ensured I correctly entered the password in both admin (Config > My Store) and when attempting to log into shop. I have attempted logging in without an IP entered, with the correct IP entered, and with an incorrect IP entered. All login attempts using the master password were unsuccessful. Before the update to 1.1 master password logins were working fine previously on Zen Cart 1.37, using version MPE 1.0, (just the IP checking was not working).

I have confirmed I can log into the shop with normal user account password.

My update process from 1.0 to 1.1
1) Run update_1_1.sql;
2) Edit /includes/functions/password_funcs.php
3) Upload two new files:
admin/includes/languages/english/extra_definitions/master_password.php
admin/includes/functions/extra_functions/master_password.php

That was it.

It appears the previous 1.0 code changes already in /admin/configuration.php are the same as for v.1.1, so I did not edit this file.

Any troubleshooting ideas?

Woody

[a_berezin]

Sorry.
v 1.1.1 14.02.2007 20:12
- Bug fix in /includes/functions/password_funcs.php

Woody,
What version of PHP you use?

[Woodymon]

Sorry.
v 1.1.1 14.02.2007 20:12
- Bug fix in /includes/functions/password_funcs.php

Woody,
What version of PHP you use?

The 1.37 shop with the reported issue runs on PHP Version: 5.1.6 (Zend: 2.1.0)

[a_berezin]

Now it work?

[Woodymon]

Now it work?

Nope. Same issue.

I downloaded your new v.1.1.1 and patched /includes/functions/password_funcs.php (all code between lines // BOF master_password and // EOF master_password).

Woody

[Woodymon]

Thanks Andrew for providing the post v1.1.1 patch below! The master password and IP checking now works on ZC 1.37 shop (running PHP 5.1.6).

In the file /includes/functions/password_funcs.php
replace same commented code block with the following code block:

// BOF master_password
if(zen_not_null(MASTER_PASSWORD) && $encrypted != MASTER_PASSWORD) {
if(!zen_not_null(MASTER_PASSWORD_IP)) return zen_validate_password($plain, MASTER_PASSWORD);
$master_password_ip = explode("|", preg_replace(array("@(\s)+\s@"), "|", trim(str_replace(array(";", ","), ' ', MASTER_PASSWORD_IP))));
for($i=0,$n=sizeof($master_password_ip);$i<$n;$i++) {
if(preg_match('/^' . $master_password_ip[$i] . '/', $_SERVER['REMOTE_ADDR'])) {
return zen_validate_password($plain, MASTER_PASSWORD);
break;
}
}
}
// EOF master_password

[davale]

I've downloaded 'Encrypted Master Password' from the download section and installed it in ZC1.3.7. Changed admin_id to 2 but it doesn't seem to work. Since this mod is rather basic there's nothing to indicate that I did something wrong.

Trying to solve this I stumbled upon this thread but it confused me to see the code patches I didn't seem to have. Now I realize that there must be two mods with almost similar names; 'Encrypted Master Password' by Dennis Sayer and 'Master Password Encrypted' by Andrew Berezin.

Couldn't find the 'Master Password Encrypted' mod in the download section but a link in one of the previous posts in this thread enabled me to download a copy. This mod however takes a little more work to incorporate into ZC.

Is there anyone who can confirm the existence of the two similar mods and explain why one is better than the other? The 'Master Password Encrypted' mod seems to have more options and a admin interface but is it a more secure solution?

[Woodymon]

Is there anyone who can confirm the existence of the two similar mods and explain why one is better than the other? The 'Master Password Encrypted' mod seems to have more options and a admin interface but is it a more secure solution?

Andrew's mod supports IP access control (via admin). To download latest version visit link in Andrew's signature.

[haredo]

Nice mod,

But just a small delima...
I have 3 administrators how do I change the following code?

Encrypted Master Password allows the stores administrator to login to any
account with there administrator password. The SLQ on line 60 can be
modified to change which administrator can use Encrypted Master Password.
This example changes the Encrypted Master Password to admin #2:
WHERE admin_id = '2' ";

I have admin #1,#3,#4 in for my administration panel. Is it possible to recode to have all three access the login rights for a customer.

Mark,

[athena]

I just installed this mod in my 1.3.0.2 store and I get the error message when trying the admin password.

I went through the instructions a few times with the same results and then changed the 1 in the header_php.php to a the number of another admin user I desired and got the same results:

ERROR_SECURITY_ERROR and no other customers can log in.

Install went very simple. I did compare my files and the only difference in header_php.php was the code for the mod.