Is there a way to auto-login to admin?

[mikejd]

I have added a ZenCart v1.3.8 to a site I am managing which uses a custom built CMS. I would like to add a direct link to the ZenCart admin interface from the admin interface of the CMS. There is already a similar link to a PhpList installation.

The Phplist link uses an href of the form ~/admin/?login="xxx"&password="xxx". I have tried a similar link for ZenCart but it just opens the login form and I have to enter the username and password. I would prefer it to login directly without having to input the details.

Can anyone suggest the correct syntax?

Mike

[spid3r1987]

i dont know if its possible to login without entering details, this would comprimise security surely?

[peytonrm]

That's not possible because the zencart admin login uses a random token that is different on every login that must be present and match for you to be able to login. You could hack the login process to bypass the token check under cetain conditions, but that smells really bad from a security perspective.

What I would probably do is modify login.php to check for login and password being passed as GET parameters and fill them into the form if they are. That way the user would only have to click "submit" to login. Something like this should only be done inside your CMS, where the user has already had to login to one system and even then only if you really trust the security of your CMS.

[kiddo]

You can do this with Curl in two steps.

retrieve the login screen and parse out the security token and then construct another Curl call to do the login.

drawback is that your curl script will have to store an admin password in plain text.

[mikejd]

Thanks all for the advice. Sounds like it will be easier and better security to just login again to ZenCart. Not sure about the security of the CMS as it is a one off system written more than 5 years ago, not a proprietary or open source system, and not actively maintained since.

Mike