I want to share session between admin and cart for specialized use

Hi,
I'm putting together a B2B cart where operators log in to the Admin section first, and then access the cart with a link. I need to check in all of the cart headers that the user has already logged on to the admin section. This is done by putting a check in the cart headers for the presence of the 'admin_id'.

Unfortunately, when the link from admin to cart is selected and the index.php for the cart is invoked the session no longer contains the admin_id. If an admin URL is typed in to the same browser, however, and control returns to the cart, then the admin_id still exists.

Something appears to be happening when crossing between admin and cart. Has anyone else had experience of this?

Regards,

• Jim

We do not have users logging in to our admin side....
These are distinctly seperate

The admin section uses zenAdminId as the session name, but the storefront uses zenid. That's why you're seeing different info. It's all intended for security and to keep shoppers from ever having any admin access, or from knowing anything about where the admin folder even exists.

DrByte and kobra,
Many thanks for your replies. I probably didn't express myself clearly. The point is that only the admin will administer the user accounts. The admin will log in through the admin section, then go to the cart with a link. It's B2B, so the admin will log in a user (no password required). The user screens themselves need to be protected from user access, that's why I need to ensure that the admin_id is set whenever anyone tries to access a user page.

I've been having a poke around (looking at sessions.php for cart and admin) but, as yet, no luck.

I'll post up the solution when I find it.

Regards,

• Jim

whippetblue:

I probably didn't express myself clearly.

... It's B2B, so the admin will log in a userYou're right -- it's still not clear. Just being "B2B" doesn't commonly denote that the businesses (your customers) who buy from you would have no access to their own order history, or ability to place orders.

And, if by "admin will log in a user" you are somehow suggesting that the admin must first authorize the user and then give them a link to login, then you're making things way too complicated, as there is already a built-in functionality to have to "authorize" a customer before they can shop, or even browse, your store.

I have several B2B clients and we achieve all we need (principally requiring user login before anything in the site is displayed) purely through standard zencart settings.

See AN EXAMPLE

There is absolutely no need to have customers (B2B or B2C) gaining access to the admin console.

In fact it is strongly discouraged.

Hi,
Thanks again for the replies. I have solved the probem, but first I'll state what the problem was before I give the solution.

Problem

I needed to prevent all customers accessing customer accounts in the shop. This is because admins will log in through the admin section, phone up customers and then log in to the shop for the customer. So, the customer should never be able to log in.

Admins are defined as those logging on through the admin section and whose usernames/passwords are held in the zen_admin table. 'Customer' accounts are defined as those held in the zen_customers table (assuming that 'zen_' is your table prefix).

The solution was to intercept calls to the shop pages at the earliest opportunity and redirect to the admin log in page if the user had not already logged in as an admin. Two different session ids are used: 'zenAdminID' for admin; and 'zenid' for the shop. If the user has already logged in via the admin section, then the session variable 'admin_id' will be present in the 'zenAdminID' session.

Solution

1. To ensure that all pages in the cart require an admin login before they can be accessed the following must be done:

Copy the following file:

includes\init_includes\init_sessions.php

to
includes\init_includes\overrides\init_sessions.php

Add the following to the new file:

/**

• require the session handling functions
  */
  require(DIR_WS_FUNCTIONS . 'sessions.php');

/**

• START OF CUSTOMISATION
• Check if the user has already logged on throught the admin secion.
• If not, do not allow access, and redirect to the admin log in page.
• Otherwise restore the shop session ('zenid').
  */
  zen_session_name('zenAdminID');
  zen_session_start();

if( null == $_SESSION['admin_id'] ) {
print "lilnk = " . zen_href_link("/" . FILENAME_ADMIN);
header( 'Location: /admin/index.php' ) ;
}

/*

• END OF CUSTOMISATION
  */

/**

• set the session name and save path
  */
  zen_session_name('zenid');

Hope this a help to folk in the future.

• Jim