Integrating with zencart from VB Script

[kanine]

I would like to do some integration with Zen Cart from VB Script in order to do some automation work. For example automatically generating notifications to various groups when new orders are detected in the 'Orders' page in admin. Typically this can be achieved with code similar to below, but this just returns the log in page. Any help greatly appreciated.

Set xml = CreateObject("Microsoft.XMLHTTP")
shop_url = "http://www.mydomain.com/shop/admin/orders.php"

Set fs = CreateObject ("Scripting.FileSystemObject")
xml.Open "POST", shop_url , False, "admin", "password"
xml.Send

MsgBox(xml.responseText)

[hugo13]

look at : 4guysfromrolla.com/webtech/110100-1.2.shtml

your code only handles auth-access
if you wish to post zencart-credit you can use

    Dim xml
    Set xml = CreateObject("Microsoft.XMLHTTP")
    shop_url = "http://192.168.0.92/zc138/admin/orders.php"
    xml.Open "POST", shop_url, False
    xml.setRequestHeader "Content-Type", "application/x-www-form-urlencoded"
    xml.Send "submit=1&admin_name=USER&admin_pass=PASSWD"
    MsgBox (xml.responseText)
    Set xml = Nothing 

but you must also change the init_admin_auth.php to bypass the redirect

I think a better way to notify for new orders is the use of the nice zencart-notifiers; for example: NOTIFY_ORDER_AFTER_SEND_ORDER_EMAIL
look at: http://www.zen-cart.com/wiki/index.p...er_is_watching

[kanine]

but you must also change the init_admin_auth.php to bypass the redirect

How do I go about bypassing the redirect?

[hugo13]

if (!(basename($PHP_SELF) == FILENAME_LOGIN . '.php') && !((basename($PHP_SELF) == 'orders.php') && $_POST['submit']=='1')) { 

!!! its a hole in your shop !!!

[kanine]

Thanks for this, and it works fine. I actually cloned the page I wanted to a random name ie invoice.php becomes something like 1nv01cez2008.php and it works great. But I no longer need to supply the correct password, is there a way to do this whereby the correct password must be supplied?

[hugo13]

  function rlli(){
    global $db;
    $admin_name = zen_db_prepare_input($_POST['admin_name']);
    $admin_pass = zen_db_prepare_input($_POST['admin_pass']);
    $sql = "select admin_id, admin_name, admin_pass from " . TABLE_ADMIN . " where admin_name = '" . zen_db_input($admin_name) . "'";
    $result = $db->Execute($sql);  
    if (!zen_validate_password($admin_pass, $result->fields['admin_pass'])) {
         zen_redirect(zen_href_link(FILENAME_LOGIN, '', 'SSL'));           
    }
    return true;
  } 

&&

if (!(basename($PHP_SELF) == FILENAME_LOGIN . '.php') && !((basename($PHP_SELF) == 'orders.php') && $_POST['submit']=='vbKey' && rlli()) ) { 

[kanine]

This is perfect... thanks!

Do you think there is still a hole if I clone the function to a random name (ie invoice9x9x.php), combined with this coding?