Security Token Generation

[glenelkins]

Hi

I didnt know which forum to post this in sorry!

I am a programmer and im writing a login form for zen cart as iv also written some code to mine file sessions from zen cart... the problem is to login i need to send a security token to zen cart...but without actually being inside the system the $_SESSION['securityToken'] isnt an option!

I need to know, how does zen cart generate this token? and how could i tie this into an external login form?

thanks

[glenelkins]

or even if someone could tell me which file actually does the login processing...i cannot find it anywhere!

[glenelkins]

ha! found it! just modified the login routine a little to avoid the security token!

[DrByte]

ha! found it! just modified the login routine a little to avoid the security token!

Avoiding the security token will let you login from a form on other pages outside your store ... but now your site is vulnerable to XSF attack.