Check external session before store loads

Can I check the value of a kohana 2 session variable before zen cart loads? Can I do this in a php prepend file, or should I do this in zen cart?

Is there anyway to do something like this after calling session start?

session_write_close();
session_name($_COOKIE['zenid']);

Accessing the kohana session is no problem. I know how to do that. The issues I'm running into is the cart is empty when I try using a prepend script, and the session persists when I go back to the url if I try doing something in the template header.

I'm going to try with application_top and see what happens.

What EXACTLY are you attempting to do here?

I want to only allow access to zencart if the user is logged into a kohana script.

Thanks Dr. Byte. Nice to see you are still around.

Why not do the inquiry from within Zen Cart? Does your kohana script allow you to inquire whether the visitor is logged in, by making a call from another script, ie: ZC?

Something like require('/user/checkStatus') in ZC which returns a variable and avoid sessions altogether?

Would I create an observer for this or put it into application_top? Thanks

It may depend on what you want to happen if you find the "check" returning a response that says the person isn't logged in.
What do you want ZC to do in that case?

DrByte:

It may depend on what you want to happen if you find the "check" returning a response that says the person isn't logged in.
What do you want ZC to do in that case?

I would just like to do a header('Location: /');

In that case simply put your custom detection code in /includes/extra_configures/check_kohana.php as there's no need for the complexity of observers.

DrByte:

In that case simply put your custom detection code in /includes/extra_configures/check_kohana.php as there's no need for the complexity of observers.

Thanks. There are two issues:

Wouldn't accessing kohana from zencart using require, curl, fopen or file_get_contents start a different session, as the user logs in with the browser and the script uses the server?

Also is there an issue if authorize.net calls a form_action_url from a cronjob and the kohana session does not exists?

There are lots more questions beyond those, that still need consideration. This whole issue is way larger than those few small things, and there's far too little detail about what you're ultimately trying to do here for me to give any answers suitable for use on a live site.

DrByte:

There are lots more questions beyond those, that still need consideration. This whole issue is way larger than those few small things, and there's far too little detail about what you're ultimately trying to do here for me to give any answers suitable for use on a live site.

I want to limit zencart access to only users currently logged into kohana. I am using zencart 1.3.9 and php 5.2.10.

Could you please tell me what are the larger issues you see?

DrByte:

There are lots more questions beyond those, that still need consideration. This whole issue is way larger than those few small things, and there's far too little detail about what you're ultimately trying to do here for me to give any answers suitable for use on a live site.

Could you please suggest resources on what else would need access to zen cart which could be blocked?

What exactly are you trying to accomplish here? Why are you talking about cron jobs and authorize.net and curl and fopen and file_get_contents from outside Zen Cart?
When you start talking about triggering payment systems from code running outside the store's code base, you raise zillions of security flags, and so on.

Without having a solid understanding of what you're wanting to end up with, more specifically the bigger picture of the business issues you're trying to solve here and the detailed list of end-results you're targeting, I've very reluctant to send you off with technical information that could result in you creating security problems on your site.

And, is this your site? Or merely some site you've been contracted to do some custom work for?

DrByte:

What exactly are you trying to accomplish here? Why are you talking about cron jobs and authorize.net and curl and fopen and file_get_contents from outside Zen Cart?
When you start talking about triggering payment systems from code running outside the store's code base, you raise zillions of security flags, and so on.

Without having a solid understanding of what you're wanting to end up with, more specifically the bigger picture of the business issues you're trying to solve here and the detailed list of end-results you're targeting, I've very reluctant to send you off with technical information that could result in you creating security problems on your site.

And, is this your site? Or merely some site you've been contracted to do some custom work for?

It is for a contract. The client required an extensive list of zen cart modules to use with an existing script.

The curl, fopen and file_get_contents was in reference to checking a kohana script on the same server but external to zencart, and allowing access to zen cart only if the user is logged into kohana. I am looking at setting an AES token in a cookie and a mysql record for each kohana request and checking it before each zen cart request to avoid interfering with the zen cart session.

For cron, I am using this cim module for recurring payments.

http://www.zen-cart.com/forum/showthread.php?t=112719

I am allowing access to it only by command line by checking php_sapi_name() and a php token variable defined in the kohana script set only if the conditions for a recurring payment exists.

urgentprog:

... and a mysql record for each kohana request and checking it before each zen cart request to avoid interfering with the zen cart session.
I suspect that's probably the most appropriate approach. Use the database as the determiner, and write code on both ends to set/check the database for validation both ways.