My idea for accessing zen cart sessions outside of zen...

[glenelkins]

Hi

I know allot of people have been asking how to mainly access $_SESSION['customer_id'] from outside zen cart.

I also have posted a few times asking until it dawned on me, perhaps i could use SOAP to get the session data i need. I finally got the system working and would like to share my code with you guys and perhaps get some feedback??

Ok first off we need to download "NuSOAP" and extract the files into the following folder structure:

ZEN_CART_ROOT/nusoap/lib/FILES_HERE

Create the following file:

ZEN_CAR_ROOT/session_get.php

Within session_get.php the following code:

<?php
// Include application top
include_once ( "includes/application_top.php" );


function get_session( $var ){

	return ( settype ( $_SESSION['customer_id'], "string" ) );
}

// Load up nusoap library
require_once('nusoap/lib/nusoap.php');

// Create soap object
$Soap_Obj = new soap_server();

// COnfigure WSDL
$Soap_Obj->configureWSDL ( "session_get", "urn:session_get" );

// Register callback function
$Soap_Obj->register('get_session',
		array ( "var" => 'xsd:string'),
		array ( "return" => 'xsd:string'),
		'urn:session_get',
		'urn:session_get#get_session',
		'rpc',
		'encoded',
		'Returns Zen Cart Session Var'
	
		);

// Wait for response
$Soap_Obj->service($HTTP_RAW_POST_DATA);


?>

Now from the script you want to get the data to , for example the "customer_id" you use the following code:

<?php
// Load up nu_soap
require_once('ZEN_CART_ROOT/nusoap/lib/nusoap.php');


//now we must create a soapclient object
$soapclient = new nusoap_client('http://YOURDOMAIN.COM/ZEN_CART_ROOT/session_get.php?wsdl',true);

// Call get session variable function from server
$result = $soapclient->call ( "get_session", array ( "var" => "customer_id" ) );


if ( $client->fault ) {

	echo "<h2>Fault</h2><pre>";
	print_r ( $result );
	echo "</pre>";

} else {
	// trap error
	$err = $soapclient->getError();

	if ( $err ) {

		echo "<h2>Error</h2><pre>" . $err . "</pre>";
		print_r ( $result );
		echo "</pre>";

	} else {

		echo "<h2>Result</h2><pre>";
		echo $result;
		echo "</pre>";
		
	}

}	
?>

This piece of code is where we choose what variables to return:

// Call get session variable function from server
$result = $soapclient->call ( "get_session", array ( "var" => "customer_id" ) );

Hope this helps people!

[glenelkins]

This has a small bug im trying to fix right now

[glenelkins]

Iv just realised that with SOAP you cannot handle SESSIONS without actually changing a bunch of code on zen carts login and session handling code.

The best way iv found is write a small php script like this

<?php

// Include application top
include_once ( "includes/application_top.php" );

// Get the var we want
$var = $_GET['var'];

echo $_SESSION[$var];

?>

Place it in the zen cart root folder.

Then send over the variable you want using AJAX like this:

URL = ZEN_CART_ROOT/script_to_get_session.php?var=customer_id

This will then return the current logged in customer id to your javascript

[DrByte]

I hope you're planning to do a complete security audit of your custom code at some point, to close all the holes that creates ...

[glenelkins]

hi

can you point out security holes that you notice already and ill fix them up

[glenelkins]

in fact i think i may have an idea to use the SOAP client and server with a new database table and the zen cart $_COOKIE['zenid']

If I modify the login of zen cart i#to insert info into a custom db table such as session_id, session and timeout i can actually pass the zen sesison id to the soap server and check the database for a) that session id exists b) that session hasnt timed out. If the timeout is set the same as the zen cart one it should work ok

also edit the logout routine to delete the session info from the custom table.

any ideas on this?

[A Hot Mess]

glenelkins...

Please don't take this as being antagonistic (I know people over here LOVE to threadcrap just so they can get a dig at someone thinking outside the box), but what will you be using this information for? I'm sure it's far beyond my own needs, but I'm always interested to see what others are doing.

[DrByte]

hi

can you point out security holes that you notice already and ill fix them up

My point was ... Calling something like /script_to_get_session.php?var=whatever to get the contents of ANY session var without validating who/what is making that request could easily disclose information that has no business being shared outside.

[glenelkins]

A Hot Mess... I cannot really tell you what this is used for its a confidential piece of work im doing ....at work lol. I work for a media company as a web developer and basically have been looking for a way to link Textpattern to Zen Carts login

I know allot of people have been trying to share session information outside zen cart. And iv been working to find a solution, the two main ways forward i see is AJAX or SOAP... the SOAP will be the best method if i can pass the session ID over!

DrByte...the vailidation is done on the textpattern side in this case!

[glenelkins]

The main thing is i cannot understand what zen cart does to stop session working outside of itself. Iv looked over the code and appart from a load of checks it does the sessions work just like any normal program..... and nobody seems to know why it does this.

Iv even tried loading up the same session name and ID in external applications, it still wont work. Pain in the ######!


Heres a question, how does Zen Cart actually control which pages are restricted access? There may be an option to completely re-do their silly login ( i say silly, its silly from a dev point of view, its not very versitile considering its open source )