Fast and Easy Checkout

[rwoody]

I've just been contacted by a customer where I had installed FEC v 1.51 to include the checkout w/o account. He received a call from one of his retail customer's that they found that they could login to their account with only their email address. No password was needed!!

Of course I immediately thought it was a cookie, but it's not. Anyone that has previously registered to the site can merely enter their email address and hit login and they are in!!! (Password field left blank).

Now I've disabled the entire FEC and it is still happening, so something somewhere in the checkout modifications has really messed this up and I have no clue where to look.

I need to fix this ASAP as you can imagine and I don't know where to start. Can someone give me a clue what to look for?

Really stressed here on this one.

I'm still trying to figure this out. Has anyone ever seen this issue before and if not, can someone give me a clue other than the tpl_login_default.php file that would be the issue? I've replaced that file with a fresh one from the install. There were no edits to that file. We do have super orders installed and I used the appropriate replacement files from the package there. I am just at a loss on this to figure out what is causing the issue.

Any suggestions would be greatly appreciated and desperately needed.

[greenhat]

I'm still trying to figure this out. Has anyone ever seen this issue before and if not, can someone give me a clue other than the tpl_login_default.php file that would be the issue? I've replaced that file with a fresh one from the install. There were no edits to that file. We do have super orders installed and I used the appropriate replacement files from the package there. I am just at a loss on this to figure out what is causing the issue.

Any suggestions would be greatly appreciated and desperately needed.

you mentioned that you disabled the FEC module.. I would try to completely uninstall it at this point.

[rwoody]

you mentioned that you disabled the FEC module.. I would try to completely uninstall it at this point.

Exactly. What I've done is made a duplicate of my site, so as not to disturb the production site. I've used Beyond Compare and been going through files looking for anything out of the ordinary and found nothing. I've grabbed the latest release and I'm going to try to do an upgrade.

Can you tell me if there from 1.5.1 to 1.6.2 which is what I'm about to install, if there are any db changes? I was going to do a compare on the sql install files, as I didn't see an upgrade file. There maybe no changes there, but wanted to make sure before I proceed.

This is just the absolute strangest thing I've ever seen. If you put in a bad password it will error out as it should...leave it blank and zoom you're in the customer's account, as long as you know the email address they used to create their account with.

Go figure...leave it to me when I have a thousand other tasks at hand to have something so strange to deal with...LOL Guess it's the luck of the draw.

[greenhat]

Exactly. What I've done is made a duplicate of my site, so as not to disturb the production site. I've used Beyond Compare and been going through files looking for anything out of the ordinary and found nothing. I've grabbed the latest release and I'm going to try to do an upgrade.

hmm.. but, did you try to completely uninstall the plugin? i mean.. just go through and delete each file one by one as well as undo all the SQL insertions and changes.

Can you tell me if there from 1.5.1 to 1.6.2 which is what I'm about to install, if there are any db changes? I was going to do a compare on the sql install files, as I didn't see an upgrade file. There maybe no changes there, but wanted to make sure before I proceed.

no idea.. try to compare the sql install files as you suggested.

This is just the absolute strangest thing I've ever seen. If you put in a bad password it will error out as it should...leave it blank and zoom you're in the customer's account, as long as you know the email address they used to create their account with.

Go figure...leave it to me when I have a thousand other tasks at hand to have something so strange to deal with...LOL Guess it's the luck of the draw.

i have a sneaky suspicious that this may have something to do with the "Master Password" feature.. Admin -> Config -> FEC Config -> Master Password..
This feature is a bit unclear because it can either be true or false.. but there is no field where to set this password. check if you have it turned on ("true").. maybe it's on and set as blank somewhere. just an idea..

good luck

[greenhat]

just looked into it.. it looks like if the Master Password is set to true, you can login to any account with your admin password.. so , if your admin password is blank (which is highly unlikely, but double check) , you will get the behavior you're describing.

[rwoody]

just looked into it.. it looks like if the Master Password is set to true, you can login to any account with your admin password.. so , if your admin password is blank (which is highly unlikely, but double check) , you will get the behavior you're describing.

I could kiss you!!!!!!!!! My customer was in there poking around and did just that!!! He cleared out the password and voilla! I have spent hours looking for this...LOL I never even thought of that.

Thank you sooooooooo much!!!

[greenhat]

I could kiss you!!!!!!!!! My customer was in there poking around and did just that!!! He cleared out the password and voilla! I have spent hours looking for this...LOL I never even thought of that.

Thank you sooooooooo much!!!

:) glad i could help.