Forums / Addon Admin Tools / Encrypted Master Password support

Encrypted Master Password support

Views: 53,602

Results 101 to 120 of 210
6 Feb 2016, 4:27 PM
#101
carlwhat avatar

carlwhat

zennedOut

Join Date:
Nov 2005
Location:
los angeles
Posts:
2,972
Plugin Contributions:
8

Encrypted Master Password support

lat9,
i want to further state how great i think this add-on is. i'm rolling it out to a couple of customers soon and i'm sure i will get more feedback. i wanted to document a couple of small changes that i made to make this add-on a little easier for someone to use.

as the basis for the admin to login is the email address in YOUR_ADMIN/customers, i added the following line right after one of your comments:

 //-eof-a-EMP login link *** 1 of 1 ***
        $contents[] = array('text' => '<br />Customers Email Address: ' . $cInfo->customers_email_address);

its just easier to have the customers email address right there.

in the same vein, i changed one line to automatically fill in the email address when selecting to place an order (almost makes the previous code irrelevant). the code is in includes/templates/YOUR_TEMPLATE/templates/tpl_login_default:

//original
   <?php echo zen_draw_input_field('email_address', '', 'size="30" id="login-email-address"'); ?>
// new line
   <?php echo zen_draw_input_field('email_address', (($_POST['email_address'] !== null) ? $_POST['email_address']: ''), 'size="30" id="login-email-address"'); ?>

finally as i think the admin would like to see who they might be logged in as, i modified my templates header to include this information. where someone might want to put this bit in their template is up to them, but again i think it's just something that makes life easier for the admin entering the order (or whatever they might be doing on the customer account):

<?php if (($_SESSION['customer_id']) && ($_SESSION['emp_admin_login'] == true)) { ?>
	<li><a href="<?php echo zen_href_link(index, '', 'NONSSL'); ?>">Logged in as <? echo $_SESSION['customer_first_name'] . ' ' . $_SESSION['customer_last_name'] ?></a></li>
<?php } else { ?>
	<li><a href="<?php echo zen_href_link(index, '', 'NONSSL'); ?>"><?php echo 'Home'; ?></a></li>
<?php } ?>

if these ideas were already documented somewhere, and i missed them, i apologize for being redundant!

best.

author of square Webpay, now with Apple Pay and Google Pay.
mXworks
donations: venmo or paypal accepted.
premium consistent excellent support. available for hire.

6 Feb 2016, 6:28 PM
#102
lat9 avatar

lat9

Administrator

Join Date:
Sep 2009
Location:
Stuart, FL
Posts:
14,116
Plugin Contributions:
56

Re: Encrypted Master Password support

@carlwhat, thanks for the suggestions; I'll take the complement on behalf of *all *the authors!

I've opened a change-request on the EMP GitHub repository (https://github.com/lat9/encrypted_master_password/issues/12) to track your suggestions.

Note that the second one should be redundant; the built-in Zen Cart handling performed by zen_draw_input_field automatically populates the field value if either a $_POST or $_GET variable with the field's name is present.

21 Feb 2016, 9:03 PM
#103
hubert avatar

hubert

Zen Follower

Join Date:
Mar 2005
Posts:
229
Plugin Contributions:
0

Re: Encrypted Master Password support

Hello,

This module is great but I would like to modify its behavior so that it bypasses the login page, i.e. clicking on Place Order directly gets you on the home page (in a new tab) as the customer with no admin password to type.

Lat9 told me that this was its first behavior and that it has been changed for security reasons. I understand but as I'm planning on doing this on a local machine, the risks are far less to be hacked.

Lat9 suggested me to compare the files with the former version, which I did with the 1.6 but it doesn't work so I'm quite sure it's not the right version to look at. As there's a tenth of versions, if someone is kind enough to direct me to the right one the would very kind.

Last, that is on ZC154 with EMP 2.1

Thanks for your help

Hubert

22 Feb 2016, 12:51 PM
#104
lat9 avatar

lat9

Administrator

Join Date:
Sep 2009
Location:
Stuart, FL
Posts:
14,116
Plugin Contributions:
56

Re: Encrypted Master Password support

@hubert, the change requires some code-merging since EMP v1.6.0 uses an older Zen Cart version as its code-base.

First, remove all remnants of EMP v2.1.0 from your store. The changes vary significantly from v1.6.0 to v2.1.0 of this plugin.

Now, using the EMP v1.6.0 zip-file:

  1. Merge the single block of code that adds the "Place Order" button into /YOUR_ADMIN/customers.php.
  2. Merge the single block of code within /includes/modules/pages/login/header_php.php. This isn't going to be pretty, since the login code changed significantly from Zen Cart v1.5.1 (which is the code-base used by the plugin) to v1.5.4 (which your store is using). You'll need to review the code structure in the two versions of the module to determine where to place the EMP-specific code.
  3. Once the merges are complete, the remaining code (all EMP-specific) can simply be copied to your store's file system.
23 Feb 2016, 5:36 PM
#105
hubert avatar

hubert

Zen Follower

Join Date:
Mar 2005
Posts:
229
Plugin Contributions:
0

Re: Encrypted Master Password support

lat9:

@hubert, the change requires some code-merging since EMP v1.6.0 uses an older Zen Cart version as its code-base.

First, remove all remnants of EMP v2.1.0 from your store. The changes vary significantly from v1.6.0 to v2.1.0 of this plugin.

Now, using the EMP v1.6.0 zip-file:

  1. Merge the single block of code that adds the "Place Order" button into /YOUR_ADMIN/customers.php.
  1. Merge the single block of code within /includes/modules/pages/login/header_php.php. This isn't going to be pretty, since the login code changed significantly from Zen Cart v1.5.1 (which is the code-base used by the plugin) to v1.5.4 (which your store is using). You'll need to review the code structure in the two versions of the module to determine where to place the EMP-specific code.
  1. Once the merges are complete, the remaining code (all EMP-specific) can simply be copied to your store's file system.

1 is done
2- In /includes/modules/pages/login/header_php.php there is not only one modification but several, some by you lat9 and some by stagebrace. Even if I downloaded the 1.6 version the comment says > //-bof-Encrypted Master Password by stagebrace *** 1/1

  //- Start modifications by lat9:

//-bof-a-v1.7.0
and that is the only the fist one. So I added all of them as it seems to me its the code I'm looking for to get the automatic login.

3- I understood that I had to add the remaining files and modifications from 2.1. What I did.

Now when I click the Place Order button it gets me to a login page saying Whoops your session has expired.

Sorry. I'm stuck. I need a bit more help.

23 Feb 2016, 8:53 PM
#106
lat9 avatar

lat9

Administrator

Join Date:
Sep 2009
Location:
Stuart, FL
Posts:
14,116
Plugin Contributions:
56

Re: Encrypted Master Password support

@hubert, for step#3 you should be using the files from the 1.6.0 version, not v2.1.0.

23 Feb 2016, 9:01 PM
#107
hubert avatar

hubert

Zen Follower

Join Date:
Mar 2005
Posts:
229
Plugin Contributions:
0

Re: Encrypted Master Password support

lat9:

@hubert, for step#3 you should be using the files from the 1.6.0 version, not v2.1.0.

OK, OK, I just understood, so it was just "install 1.6 instead of 2.1". LOL

Thanks a lot for your patience.

It works, it's great. I just noticed something.
Choose customer X, click Place Order, you get a new tab acting as X.
Don't close your tab, just go back to the customer list tab.
Choose customer Y, click Place Order, you get a new tab acting as X.

If you do not logout X I can't act as Y.
Just curiosity, would it be possible to have a customer by tab, acting as X in a tab and at the same time as Y in another tab ?

23 Feb 2016, 10:04 PM
#108
hubert avatar

hubert

Zen Follower

Join Date:
Mar 2005
Posts:
229
Plugin Contributions:
0

Re: Encrypted Master Password support

Next step...

As I'm planning to give a restricted access to the one who is going to take orders on the phone using EMP... I just noticed that I have no way to give access to the Place Order button in an Admin Profile.

I've setup a "Cashier" admin account, given access to the customers page, but when I log as the Cashier the Place Order button disappears...

How can I add the option in the admin profiles settings ?

24 Feb 2016, 1:01 AM
#109
hubert avatar

hubert

Zen Follower

Join Date:
Mar 2005
Posts:
229
Plugin Contributions:
0

Re: Encrypted Master Password support

Following...

I've dug a bit : admin profiles gives access to admin pages, since EMP has not its own page (its settings are in Configuration->My Store), seems impossible to give access to EMP.
More, even if you/we move the EMP settings to a separate page, that would makes us give access to this settings page which is not what I'm looking for.

There must be a trick, but the problem seems to me to give access to customer side page from a admin profile system which is built only to give access to admin side pages.

The thing I don't understand is how the profile system can sort out a button in a page...

24 Feb 2016, 1:25 AM
#110
hubert avatar

hubert

Zen Follower

Join Date:
Mar 2005
Posts:
229
Plugin Contributions:
0

Re: Encrypted Master Password support

Here is the trick which is not really one, I was looking too far :
in /admin/customers.php

around line 1212

if (!$emp_result->EOF && ($_SESSION['admin_id'] == EMP_LOGIN_ADMIN_ID || $emp_result->fields['admin_profile'] == EMP_LOGIN_ADMIN_PROFILE_ID) ) {  /*v1.7.0c*/

should be

if (!$emp_result->EOF && ( $_SESSION['admin_id'] == EMP_LOGIN_ADMIN_ID || in_array ($emp_result->fields['admin_profile'], explode (',', EMP_LOGIN_ADMIN_PROFILE_ID)) )) {

And now my cashier has the button and everything is fine.

24 Feb 2016, 12:00 PM
#111
lat9 avatar

lat9

Administrator

Join Date:
Sep 2009
Location:
Stuart, FL
Posts:
14,116
Plugin Contributions:
56

Re: Encrypted Master Password support

hubert:

OK, OK, I just understood, so it was just "install 1.6 instead of 2.1". LOL

Thanks a lot for your patience.

It works, it's great. I just noticed something.
Choose customer X, click Place Order, you get a new tab acting as X.
Don't close your tab, just go back to the customer list tab.
Choose customer Y, click Place Order, you get a new tab acting as X.

If you do not logout X I can't act as Y.
Just curiosity, would it be possible to have a customer by tab, acting as X in a tab and at the same time as Y in another tab ?
That's not going to be possible, since the session-cookie is stored once-per-site in the browser. If you have multiple browsers, you could have Customer X in Firefox, Customer Y in Chrome, ...
hubert:

Next step...

As I'm planning to give a restricted access to the one who is going to take orders on the phone using EMP... I just noticed that I have no way to give access to the Place Order button in an Admin Profile.

I've setup a "Cashier" admin account, given access to the customers page, but when I log as the Cashier the Place Order button disappears...

How can I add the option in the admin profiles settings ?
You've discovered that the multiple admin-profiles settings were introduced post EMP v1.6. The change that you posted brings your Customers->Customers handling up to the current EMP version.

14 Apr 2016, 6:29 PM
#112
lat9 avatar

lat9

Administrator

Join Date:
Sep 2009
Location:
Stuart, FL
Posts:
14,116
Plugin Contributions:
56

Re: Encrypted Master Password support

I've uploaded v2.2.0 of *EMP *to the Zen Cart Plugins for review. This version adds support for Zen Cart v1.5.5 and drops support for Zen Cart versions prior to v1.5.3, with the following changes:

  • Update to use Zen Cart 1.5.5 release (03-29-2016) for the core-file changes
  • Add Dutch language constants
  • Use new Customers->Customers notifier
  • Remove support for Zen Cart versions prior to 1.5.3
  • Restructure the plugin's distribution zip-file
  • Remove OSH-updated-by code; it can be installed separately if the functionality is desired.

Note: If you're still using a version of Zen Cart prior to v1.5.3 for your store, please use an earlier version of EMP.

21 Apr 2016, 6:01 PM
#113
lat9 avatar

lat9

Administrator

Join Date:
Sep 2009
Location:
Stuart, FL
Posts:
14,116
Plugin Contributions:
56

Re: Encrypted Master Password support

v2.2.0 is now available for download.

4 May 2016, 7:37 PM
#114
exile_machine avatar

exile_machine

New Zenner

Join Date:
Apr 2011
Posts:
4
Plugin Contributions:
0

Re: Encrypted Master Password support

Not sure what I did but my attempts to log in as a customer using my store admin password are no longer working:

https://www.exilemachine.net/shop/index.php?main_page=login&action=process
**WARNING: An Error occurred, please refresh the page and try again.
**
If I put in a nonsense password it gives me the correct red banner password error:
Error: Sorry, there is no match for that email address and/or password.

I'm on ZC 1.5.4 and I can not determine the version of the EMP that I'm using. Is there a file that shows which version EMP is in use?

-Mark

4 May 2016, 7:43 PM
#115
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,513
Plugin Contributions:
176

Re: Encrypted Master Password support

Exile Machine:

WARNING: An Error occurred, please refresh the page and try again.
See: http://www.zen-cart.com/content.php?311-warning-an-error-occurred-please-refresh-the-page-and-try-again

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

4 May 2016, 8:16 PM
#116
lat9 avatar

lat9

Administrator

Join Date:
Sep 2009
Location:
Stuart, FL
Posts:
14,116
Plugin Contributions:
56

Re: Encrypted Master Password support

If you'll post the first 25 lines in the file /includes/classes/observers/class.emp_order_observer.php, I might be able to identify the EMP version you're using.

4 May 2016, 8:19 PM
#117
carlwhat avatar

carlwhat

zennedOut

Join Date:
Nov 2005
Location:
los angeles
Posts:
2,972
Plugin Contributions:
8

Re: Encrypted Master Password support

as the link that DrByte posted states, you need to look at the debug log files. if you can track those log files and post them, perhaps someone could give you more help. alternatively, the log files might indicate how you could solve the problem on your own.

good luck!

author of square Webpay, now with Apple Pay and Google Pay.
mXworks
donations: venmo or paypal accepted.
premium consistent excellent support. available for hire.

4 May 2016, 8:23 PM
#118
exile_machine avatar

exile_machine

New Zenner

Join Date:
Apr 2011
Posts:
4
Plugin Contributions:
0

Re: Encrypted Master Password support

lat9:

If you'll post the first 25 lines in the file /includes/classes/observers/class.emp_order_observer.php, I might be able to identify the EMP version you're using.
Here you go:

<?php // ----- // Part of the Encrypted Master Password plugin, provided by [email protected] // // Copyright (C) 2013-2014 Vinos de Frutas Tropicales // // @license <http://www.zen-cart.com/license/2_0.txt> GNU Public License V2.0 // // ----- // When entered via the "Place Order" button from the admin, the customer's email address is posted but somehow (on PHP 5.4) // doesn't get recorded in the $GLOBALS array (which is where the default input field values are gathered. // if (isset ($_POST['email_address'])) { $GLOBALS['email_address'] = $_POST['email_address']; } class emp_order_observer extends base { function emp_order_observer() { $this->attach ($this, array ('NOTIFY_ORDER_DURING_CREATE_ADDED_ORDER_COMMENT', 'NOTIFY_PROCESS_3RD_PARTY_LOGINS')); } // -----

Referencing DrByte's suggestion above, I did find a logfile with this error in it:
PHP Fatal error: 1364:Field 'logmessage' doesn't have a default value :: INSERT INTO
admin_activity_log (access_date, admin_id, page_accessed,
page_parameters, ip_address, gzpost, flagged, attention) VALUES (now(),
'1', 'login.php', '', 'xx.xxx.xxx.xxx',
'[binary data]', '0', '') ==> (as called by)
/shop/includes/functions/functions_general.php
on line 965 <== in
/shop/includes/classes/db/mysql/query_factory.
php on line 155

4 May 2016, 8:53 PM
#119
lat9 avatar

lat9

Administrator

Join Date:
Sep 2009
Location:
Stuart, FL
Posts:
14,116
Plugin Contributions:
56

Re: Encrypted Master Password support

:censored: That's a bug; I'll post back in the morning when I've got a solution.

5 May 2016, 1:11 PM
#120
lat9 avatar

lat9

Administrator

Join Date:
Sep 2009
Location:
Stuart, FL
Posts:
14,116
Plugin Contributions:
56

Re: Encrypted Master Password support

lat9:

:censored: That's a bug; I'll post back in the morning when I've got a solution.
I've uploaded v2.2.1 of EMP to correct this issue; it'll be available for download once reviewed.

There was one file changed (/includes/classes/observers/class.emp_order_observer.php); you can download the updated file from its GitHub repo here for use with your v2.2.0 EMP install.