Category Specific Access Restriction (CSAR) - [Support Thread]

[Ajeh]

Works pretty well, nice job ...
However, hacker that I am, there is a way to trick it on going to a products_info page by changing the URL cPath ...

Interesting enough, removing the cPath and just using the products_id IS protected ...

Something to play with:
/index.php?main_page=product_info&cPath=69&products_id=186 <-- blocked

/index.php?main_page=product_info&cPath=2&products_id=186 <-- sneaks in

Granted you have to really want to get in there and are not a "good" customer ... so, this might not be worth the hassel to try to fix ... otherwise, somewhere you may need one more check that evil is not being committed ...

[frank18]

Works pretty well, nice job ...
However, hacker that I am, there is a way to trick it on going to a products_info page by changing the URL cPath ...

Interesting enough, removing the cPath and just using the products_id IS protected ...

Something to play with:
/index.php?main_page=product_info&cPath=69&products_id=186 <-- blocked

/index.php?main_page=product_info&cPath=2&products_id=186 <-- sneaks in

Granted you have to really want to get in there and are not a "good" customer ... so, this might not be worth the hassel to try to fix ... otherwise, somewhere you may need one more check that evil is not being committed ...

Thank you for your kind comments Ajeh!

It is the 'good hackers' that reveal flaws - so many thanks for that, I have a go at this in v2.1. No doubt more comments will surface from fellow zenners....

Cheers / Frank

[Ajeh]

Another one to peek at is when going through the Manufacturers box ... things like Hide Prices does hide prices but allows the add to cart to happen ...

[frank18]

Another one to peek at is when going through the Manufacturers box ... things like Hide Prices does hide prices but allows the add to cart to happen ...

Stupid me did not upload the /includes/modules/MY_TEMPLATE/product_listing.php file from my local server to the live demo site

It's fixed now, thanks again Ajeh!

[frank18]

......

Granted you have to really want to get in there and are not a "good" customer ... so, this might not be worth the hassel to try to fix ... otherwise, somewhere you may need one more check that evil is not being committed ...

Had another thought on this point:

A customer needs to know the products_id before they can apply this "trick". They first need to be (manually) privileged by the store owner to actually get the products_id

If they are already approved (=privileged) then there is no point for them to try this hack.

In the demo store the privileged login credentials are openly displayed for demo / testing purposes, in a real store that is not the case.

Still, for this mod to be picture perfect it needs to be watertight. So ..... v2.1 it will be

Need to find a test where the products_id is checked against the array CATEGORY_RESTRICTION_LOGIN_CATEGORY which is configured via admin ...

[Ajeh]

That appears to be working better on the Manufacturers selection ... and the Search now appears to be working better (forgot to mention that issue) ...

[frank18]

Works pretty well, nice job ...
However, hacker that I am, there is a way to trick it on going to a products_info page by changing the URL cPath ...

Interesting enough, removing the cPath and just using the products_id IS protected ...

Something to play with:
/index.php?main_page=product_info&cPath=69&products_id=186 <-- blocked

/index.php?main_page=product_info&cPath=2&products_id=186 <-- sneaks in

Granted you have to really want to get in there and are not a "good" customer ... so, this might not be worth the hassel to try to fix ... otherwise, somewhere you may need one more check that evil is not being committed ...

Plugged the security hole.

File /includes/templates/MY_TEMPLATE/templates/tpl_product_info_display.php amended to this:

[ file header here]

<?php 
/** 
* CATEGORY_RESTRICTION - find corresponding master category for the current product 
 */ 
$products_id_to_block = $_GET['products_id']; 
global $db; 
$sql = "select master_categories_id from " . TABLE_PRODUCTS . " where products_id = :productID:"; 
$sql = $db->bindVars($sql, ':productID:', $products_id_to_block, 'integer'); 
$result = $db->Execute($sql); 
 
if ($result->RecordCount() > 0) { 
  echo '(used for testing purposes): Master Category ID = ' . $result->fields['master_categories_id']; 
} else { 
  echo 'Sorry, no record found for product number ' . $products_id_to_block; 
} 
 
if (!$_SESSION['customer_id'] && !$_SESSION['customers_privileges'] > 0 && in_array($result->fields['master_categories_id'],explode(',', CATEGORY_RESTRICTION_LOGIN_CATEGORY)) ) { 
 //echo ' - this product should be blocked !!'; 
 echo TEXT_ILLEGAL_ACCESS ; 
} else { // bof CATEGORY_RESTRICTION - OPEN ACCESS 

.... orginal body of the file

.... then at the bottom added after 
<!--bof Form close-->
 
<?php 
    } // eof CATEGORY_RESTRICTION - OPEN ACCESS 
?> 
</div>

Thanks again for pointing this out Ajeh!

[frank18]

Just to keep you updated: I have submitted this plugin for inclusion to the downloads section a few days ago and I am awaiting approval by the moderators.

[frank18]

Version 2.0 is now available from the plugins section.

Link: http://www.zen-cart.com/downloads.php?do=file&id=1234

Cheers / Frank

[storm007]

My question is in relation to Category Specific Restriction of Product Price Display V1. I did have this working about a month when testing the function. However, when i tried to apply the mod again it doesn't work. Do you have any ideas?
Any help would be very appreciated, I'm taring my hair out!!!