COWOA (for ZC v1.5.x)

I just had a customer inform me of an issue regarding order status lookups.

This customer (COWOA) received the 'shipped' email and the link to enter the order number and their email address.

When this customer had made the purchase, they entered the email address like so: [email protected]

When they tried to view the order status page, they entered their email as: [email protected] and it fails telling them the address isn't in our system.

I see the form field 'query_email_address', is there a way to make that query case insensitive?

I have re-uploaded all files to server using WS_FTP. Uninstalled and reinstalled sql patch. Still COWOA does not show up in admin config menu. I still get a warning message that there was an error with the patch, but the database fields are changed by patches.

At the start of the install instructions it says:

Date: January 12, 2011
Version 2.0c2

Did I download the most current install files?

Are there non-COWOA settings within config that have to be turned on or off to make COWOA work? (Because this is a site only for conference registration, I have many settings turned off.)

No other mods were installed other than paypal pro and express payment mods, which are in sandbox mode.

What else can I look at to get this to work?

bbarasa:

At the start of the install instructions it says:

Date: January 12, 2011
Version 2.0c2

**Did I download the most current install files?**Not likely since this is the support thread for "COWOA Updated and Combined for ZC v1.5.x" and (based on your posts) the one you downloaded and installed is "COWOA for Zen Cart 1.3.9". You've got the Zen Cart v1.3.9 version installed on a v1.5 store (hence no admin menus)..

bbarasa:

I have re-uploaded all files to server using WS_FTP. Uninstalled and reinstalled sql patch. Still COWOA does not show up in admin config menu. I still get a warning message that there was an error with the patch, but the database fields are changed by patches.

At the start of the install instructions it says:

Date: January 12, 2011
Version 2.0c2

Did I download the most current install files?

Are there non-COWOA settings within config that have to be turned on or off to make COWOA work? (Because this is a site only for conference registration, I have many settings turned off.)

No other mods were installed other than paypal pro and express payment mods, which are in sandbox mode.

What else can I look at to get this to work?

Cowoa Version 2.0c2 is for Zen Cart v1.3.9.
You downloaded the wrong version for your Zen Cart. You said you were running Zen Cart v1.5.0 so you need to download the Cowoa version v2.3
Uninstall what you have done before you install Cowoa v2.3

DivaVocals:

Not likely since this is the support thread for "COWOA Updated and Combined for ZC v1.5.x" and (based on your posts) the one you downloaded and installed is "COWOA for Zen Cart 1.3.9". You've got the Zen Cart v1.3.9 version installed on a v1.5 store (hence no admin menus)..

Didn't see your post before I posted back thanks.

Limitless:

I just had a customer inform me of an issue regarding order status lookups.

This customer (COWOA) received the 'shipped' email and the link to enter the order number and their email address.

When this customer had made the purchase, they entered the email address like so: [email protected]

When they tried to view the order status page, they entered their email as: [email protected] and it fails telling them the address isn't in our system.

I see the form field 'query_email_address', is there a way to make that query case insensitive?

It may be a day or 2 before I can address this. I'll keep you posted when I figure out why this happens.

countrycharm:

It may be a day or 2 before I can address this. I'll keep you posted when I figure out why this happens.

Not a problem, once I figured out the 'why and how' I informed the customer how to access the order status.

Thanks for looking into it.

DivaVocals:

Not likely since this is the support thread for "COWOA Updated and Combined for ZC v1.5.x" and (based on your posts) the one you downloaded and installed is "COWOA for Zen Cart 1.3.9". You've got the Zen Cart v1.3.9 version installed on a v1.5 store (hence no admin menus)..

THANK YOU for stating the obvious! (That is not meant as a snide remark ... it is a real thank you.) I knew it must be something "obvious" but it was not obvious to me.

When I went looking for COWOA, I googled on "zen cart cowoa". The first item in the search was a link to the mod. I see now that it does say for zc 1.3.9 and it does not say "and higher". But since there is no mention of a later version of cowoa, I guess I assumed that was the latest version.

I just downloaded and installed the correct version for zc 1.5 and all is well. Mostly my mental health.

countrycharm:

It may be a day or 2 before I can address this. I'll keep you posted when I figure out why this happens.

Limitless:

Not a problem, once I figured out the 'why and how' I informed the customer how to access the order status.

Thanks for looking into it.Ummm I'm not sure this is broken or a bug at all.. I believe the case sensitivity of logins (customers and admins) is a part of Zen Cart v1.5's new security model.. I would suggest confirming this with Dr Byte before "fixing" it.. If I am correct, then clearly it's not a good idea to change this and simply you should educate your customers instead.. Even if I am not correct this would be my suggestion anyway as it's better security anyway.. an on-screen message would do the trick..

Based on this thread it seems it is supposed to be insensitive:

http://www.zen-cart.com/showthread.php?201575-E-mails-Address-Case-Insensitive

Not sure how case in-sensitivity on an email address would decrease security?

Same thing on user names. Not typical in network security(Windows, Netware, Active Directory).

Passwords yes, but not on an email address.

Limitless:

Based on this thread it seems it is supposed to be insensitive:

http://www.zen-cart.com/showthread.php?201575-E-mails-Address-Case-Insensitive

**Not sure how case in-sensitivity on an email address would decrease security? **

Same thing on user names. Not typical in network security(Windows, Netware, Active Directory).

Passwords yes, but not on an email address.For the very same reasons why passwords are case sensitive.. Makes the login/username harder to guess..

Email addresses should not be treated as case-sensitive.

DivaVocals:

For the very same reasons why passwords are case sensitive.. Makes the login/username harder to guess..

That is silly. Email addresses are not case sensitive in the 'real' world. Unless someone wants to petition for a change to RFC 5322 and RFC 6531.

User names in Windows (local and directory/domain based) are not sensitive because it would allow duplicate users (potentially), same with case sensitive email addresses.

[email protected] would be a 'different' user than [email protected], yet on the internet both would be delivered to the same place, so I could then reset [email protected]'s password using the user [email protected] credentials.

Can I turn off/skip shipping page?

Now that I have COWOA working, I'm having trouble customizing the checkout process. I am using this for a conference registration. Nothing will ever get shipped, so I don't think users should have to fill out a shipping page. It won't make any sense to them. The "products" are set up as virtual products and to skip shipping page but COWOA is taking user to shipping info page first. I can't find any way to turn this off.

bbarasa:

Can I turn off/skip shipping page?

Now that I have COWOA working, I'm having trouble customizing the checkout process. I am using this for a conference registration. Nothing will ever get shipped, so I don't think users should have to fill out a shipping page. It won't make any sense to them. The "products" are set up as virtual products and to skip shipping page but COWOA is taking user to shipping info page first. I can't find any way to turn this off.

Yes go to your admin/catalog then click on the Categories/Products an tick the box that says ( Yes, Skip Shipping Address )

DivaVocals:

Ummm I'm not sure this is broken or a bug at all.. I believe the case sensitivity of logins (customers and admins) is a part of Zen Cart v1.5's new security model.. I would suggest confirming this with Dr Byte before "fixing" it.. If I am correct, then clearly it's not a good idea to change this and simply you should educate your customers instead.. Even if I am not correct this would be my suggestion anyway as it's better security anyway.. an on-screen message would do the trick..

I agree with you 100% Diva on it been more secure this way, but as Drbyte said Email addresses should not be treated as case-sensitive. In any case I will be looking into how to fix this if there is enough people who needs the Email change to case- insensitive. Any suggestions are welcome.

Limitless:

That is silly. Email addresses are not case sensitive in the 'real' world. Unless someone wants to petition for a change to RFC 5322 and RFC 6531.

User names in Windows (local and directory/domain based) are not sensitive because it would allow duplicate users (potentially), same with case sensitive email addresses.

[email protected] would be a 'different' user than [email protected], yet on the internet both would be delivered to the same place, so I could then reset [email protected]'s password using the user [email protected] credentials.Ummm you and I are speaking apples and oranges here.. I'm not speaking of email addresses being used on an email server to send email.. If that's what I meant then your response above would make sense..

In a software system, USER NAMES/LOGINS can indeed be case sensitive if the system is programmed as such.. So if you use an e-mail address as a USER NAME/LOGIN in a system where the user name/login IS case sensitive.. then YES [email protected] is not going to be the same as [email protected]..

And I have worked in SEVERAL organizations where logins for systems ARE indeed case sensitive (including corporate systems which use an e-mail address as the user login).

Now you may think this is silly, doesn't make sense, or whatever.. This doesn't make what am saying any less true.. Logins for systems CAN can be case sensitive (yes EVEN IF the login/user name is an e-mail address).. However, going back and forth on this point is moot since this is NOT how Zen Cart's customer login's work..

DrByte:

Email addresses should not be treated as case-sensitive. The doctor has spoken..

Hmmmmm. I stand corrected. While as stated earlier I agree that email addresses should be treated as case INsensitive ...

... upon inspecting the code, it seems like the core code for customer login actually does treat it as "case sensitive" ... whether for COWOA or not.
It would actually be more accurate to say: Zen Cart presently tests for an exact match, without translating it to bypass case-sensitivity.

That said, you can expect that to change in a future version ;)

To make COWOA case-insensitive for the "no-account" customers, you could simply edit the header_php.php for the orders_status page and wrap strtolower() around both variables in the comparison done in: ```
if (isset($_POST['query_email_address']) && $customer_info->fields['customers_email_address'] != $_POST['query_email_address']) {

DrByte:

To make COWOA case-insensitive for the "no-account" customers, you could simply edit the header_php.php for the orders_status page and wrap strtolower() around both variables in the comparison done in: ```
if (isset($_POST['query_email_address']) && $customer_info->fields['customers_email_address'] != $_POST['query_email_address']) {

Thank you!

DivaVocals:

Ummm you and I are speaking apples and oranges here.. I'm not speaking of email addresses being used on an email server to send email.. If that's what I meant then your response above would make sense..

In a software system, USER NAMES/LOGINS can indeed be case sensitive if the system is programmed as such.. So if you use an e-mail address as a USER NAME/LOGIN in a system where the user name/login IS case sensitive.. then YES [email protected] is not going to be the same as [email protected]..

And I have worked in SEVERAL organizations where logins for systems ARE indeed case sensitive (including corporate systems which use an e-mail address as the user login).

Now you may think this is silly, doesn't make sense, or whatever.. This doesn't make what am saying any less true.. Logins for systems CAN can be case sensitive (yes EVEN IF the login/user name is an e-mail address).. However, going back and forth on this point is moot since this is NOT how Zen Cart's customer login's work..

The doctor has spoken..

Not to continue this, but what you refer to as an 'email address login' is really a UPN, whether that is really the 'email address' of the user, is irregardless. And 'checking' case sensitivity and HAVING 5 users with [email protected], [email protected], [email protected] and [email protected] is ridiculous and those are NOT email addresses as they would all have mail delivered to the same place. Your security by obscurity just fell apart.

Within applications on a corporate network, sure, programmers can require case sensitivity on user names, but if you display that logins MUST BE IN CAPS on the login page, that sort of defeats the argument.

And this IS the place to talk about this, while ZenCart does not use email addresses for logins, my inquiry was related to order status checking with COWOA accounts and that does require using an email address along with order number to verify identity.

*nix systems and their derivatives have case sensitive user names. Windows, Netware and other LDAP based systems do not.