Category Specific Access Restriction (CSAR) - [Support Thread]

resqjoc:

This plug in is not installing properly. I have done all merging of the files, but when I login to my admin, I get a page error message. I have to disable the auto installer file to be able to login to my admin.

When I able to login to my admin, the customers do not show up. I have to change my "customers.php" file from admin folder back to the original file. This is on a test site.

I am running ZC Ver. 1.5.4 and CSAR 2.1.1

Any ideas?

Thanks
Stan

Stan, you are absolutely right - there is a bug in line 52 of the file

CSAR_files/YOUR_ADMIN_NAME/includes/installers/csar/2_1_1.php

Replace

 if (!$sniffer->field_exists(TABLE_CUSTOMERS, 'customers_privileges'))  $db->Execute("ALTER TABLE " . TABLE_CUSTOMERS  . " ADD customers_privileges[B]`[/B] TINYINT( 1 ) NOT NULL DEFAULT '0' AFTER customers_authorization;");

with

 if (!$sniffer->field_exists(TABLE_CUSTOMERS, 'customers_privileges'))  $db->Execute("ALTER TABLE " . TABLE_CUSTOMERS  . " ADD customers_privileges TINYINT( 1 ) NOT NULL DEFAULT '0' AFTER customers_authorization;");

For whatever reason the character ` snug into that file just after customers_privileges and before TINYINT( 1 )

Thanks for pointing that out

I have submitted an updated version (2.1.2) with bug fix as per post #141. It should be available in a few days.

frank18:

Stan, you are absolutely right - there is a bug in line 52 of the file

CSAR_files/YOUR_ADMIN_NAME/includes/installers/csar/2_1_1.php

Replace

if (!$sniffer->field_exists(TABLE_CUSTOMERS, 'customers_privileges')) $db->Execute("ALTER TABLE " . TABLE_CUSTOMERS . " ADD customers_privileges[B]`[/B] TINYINT( 1 ) NOT NULL DEFAULT '0' AFTER customers_authorization;");

>  
> with
> 
> ```
 if (!$sniffer->field_exists(TABLE_CUSTOMERS, 'customers_privileges'))  $db->Execute("ALTER TABLE " . TABLE_CUSTOMERS  . " ADD customers_privileges TINYINT( 1 ) NOT NULL DEFAULT '0' AFTER customers_authorization;");

For whatever reason the character ` snug into that file just after customers_privileges and before TINYINT( 1 )

Thanks for pointing that out
Frank18,

I made the change as you directed, it did allow me to login to my admin side of my site, but I can not get the "special Privilege Status" to save after I update the customer.

One other problem, The Login page does not display completely. This is te page to sign up as a "new" customer.

Thanks
Stan

resqjoc:

.....
I made the change as you directed, it did allow me to login to my admin side of my site, but I can not get the "special Privilege Status" to save after I update the customer.

One other problem, The Login page does not display completely. This is te page to sign up as a "new" customer.

I can only think of a merging error. I just installed this version on a local ZC 1.5.4 development site without a single glitch.

Hi Frank,

Can I restrict part of the product information to login customers, but show the price, add to cart box?

Actually I want to create a custom box/ tab or whatever that customers have to login to view.
The box/ tab would list the seller's contact information (phone no. & email), so we don't want people to get through it easily.

Is it possible with this mod?
I've found some useful info, but they are not that related to my case.

---

Here is my reference list
Plugin:
Twitch Restrict Categories by Customer or Group

Threads:
Making a category only visible after login
Log In to View one Page of Website
Require Login for one EZ Page?

Hope you can give my some hints!

Thanks,
Eva

Green Books:

Hi Frank,

Can I restrict part of the product information to login customers, but show the price, add to cart box?

Actually I want to create a custom box/ tab or whatever that customers have to login to view.
The box/ tab would list the seller's contact information (phone no. & email), so we don't want people to get through it easily.

Is it possible with this mod?
I've found some useful info, but they are not that related to my case.

---

Here is my reference list
Plugin:
Twitch Restrict Categories by Customer or Group

Threads:
Making a category only visible after login
Log In to View one Page of Website
Require Login for one EZ Page?

Hope you can give my some hints!

Thanks,
Eva

Ok, what part of the page do you want to 'restrict/hide'? CSAR wasn't designed for this, it would need a 'hack'

Green Books:

Hi Frank,

Can I restrict part of the product information to login customers, but show the price, add to cart box?

Actually I want to create a custom box/ tab or whatever that customers have to login to view.
The box/ tab would list the seller's contact information (phone no. & email), so we don't want people to get through it easily.

Is it possible with this mod?
I've found some useful info, but they are not that related to my case.

---

Here is my reference list
Plugin:
Twitch Restrict Categories by Customer or Group

Threads:
Making a category only visible after login
Log In to View one Page of Website
Require Login for one EZ Page?

Hope you can give my some hints!

Thanks,
Eva

Eva, this can be accomplished with Twitch Restrict using the filters within the package. You're welcome to contact me to work out the details :)

Frank
I'm trying to install CSAR over (or rather in addition to ) COWOA on a relatively new v1.5.4

There are some places where the two plugins want to modify the same code and where I can largely combine them e.g. in SQL queries, but in admin/includes/customers.php they seem to be fighting for a control which I'm not sure how to resolve.

Here's the current section of customers.php that has COWOA in it```
<?php if ($customers->fields['customers_authorization'] == 4 ? zen_image(DIR_WS_IMAGES . 'icon_red_off.gif', IMAGE_ICON_STATUS_OFF) : ($customers->fields['customers_authorization'] == 0 ? '<a href="' . zen_href_link(FILENAME_CUSTOMERS, 'action=status&current=' . $customers->fields ['customers_authorization'] . '&cID=' . $customers->fields['customers_id'] . (isset($_GET['page']) ? '&page=' . $_GET['page'] : '') . (isset($_GET['search']) ? '&search=' . $_GET['search'] : ''), 'NONSSL') . '">' . zen_image(DIR_WS_IMAGES . 'icon_green_on.gif', IMAGE_ICON_STATUS_ON) . '</a>' : '<a href="' . zen_href_link(FILENAME_CUSTOMERS, 'action=status&current=' . $customers->fields['customers_authorization'] . '&cID=' . $customers-> fields['customers_id'] . (isset($_GET['page']) ? '&page=' . $_GET['page'] : '') . (isset($_GET['search']) ? '&search=' . $_GET['search'] : ''), 'NONSSL') . '">' . zen_image(DIR_WS_IMAGES . 'icon_red_on.gif', IMAGE_ICON_STATUS_OFF) . '</a>')); ?> </td>

<?php if ($customers->fields['COWOA_account'] == 1) { ?>

            <td class="dataTableContent" align="center"><?php echo 'COWOA'; ?> </td>

<?php }else{ ?>

            <td class="dataTableContent" align="center"><?php echo 'STANDARD';} ?> </td>

This is what CSAR wants to replace it with:```
                <?php if ($customers->fields['customers_authorization'] == 4) { ?>                <?php echo zen_image(DIR_WS_IMAGES . 'icon_red_off.gif', IMAGE_ICON_STATUS_OFF); ?>
                <?php } else { ?>
                  <?php if ($customers->fields['customers_authorization'] == 0) {
                    echo zen_draw_form('setstatus', FILENAME_CUSTOMERS, 'action=status&cID=' . $customers->fields['customers_id'] . (isset($_GET['page']) ? '&page=' . $_GET['page'] : '') . (isset($_GET['search']) ? '&search=' . $_GET['search'] : ''));?>
                    <input type="image" src="<?php echo DIR_WS_IMAGES ?>icon_green_on.gif" title="<?php echo IMAGE_ICON_STATUS_ON; ?>" />
                    <input type="hidden" name="current" value="<?php echo $customers->fields['customers_authorization']; ?>" />
                    </form>
                  <?php } else {
                    echo zen_draw_form('setstatus', FILENAME_CUSTOMERS, 'action=status&cID=' . $customers->fields['customers_id'] . (isset($_GET['page']) ? '&page=' . $_GET['page'] : '') . (isset($_GET['search']) ? '&search=' . $_GET['search'] : ''));?>
                    <input type="image" src="<?php echo DIR_WS_IMAGES ?>icon_red_on.gif" title="<?php echo IMAGE_ICON_STATUS_OFF; ?>" />
                    <input type="hidden" name="current" value="<?php echo $customers->fields['customers_authorization']; ?>" />
                    </form>
                  <?php } ?>
                <?php } ?>
                </td>
                <td class="dataTableContent" align="center">
                <?php if ($customers->fields['customers_privileges'] == 0) { ?>
                <?php echo zen_image(DIR_WS_IMAGES . 'icon_red_off.gif', IMAGE_ICON_STATUS_OFF); ?>
                <?php } else { ?>
                  <?php if ($customers->fields['customers_privileges'] > 0) {
                    echo zen_draw_form('setstatus', FILENAME_CUSTOMERS, 'action=status&cID=' . $customers->fields['customers_id'] . (isset($_GET['page']) ? '&page=' . $_GET['page'] : '') . (isset($_GET['search']) ? '&search=' . $_GET['search'] : ''));?>
                    <input type="image" src="<?php echo DIR_WS_IMAGES ?>icon_green_on.gif" title="<?php echo IMAGE_ICON_STATUS_ON; ?>" />
                    <input type="hidden" name="current" value="<?php echo $customers->fields['customers_privileges']; ?>" />
                    </form>
                  <?php } else {
                    echo zen_draw_form('setstatus', FILENAME_CUSTOMERS, 'action=status&cID=' . $customers->fields['customers_id'] . (isset($_GET['page']) ? '&page=' . $_GET['page'] : '') . (isset($_GET['search']) ? '&search=' . $_GET['search'] : ''));?>
                    <input type="image" src="<?php echo DIR_WS_IMAGES ?>icon_red_on.gif" title="<?php echo IMAGE_ICON_STATUS_OFF; ?>" />
                    <input type="hidden" name="current" value="<?php echo $customers->fields['customers_privileges']; ?>" />
                    </form>
                  <?php } ?>
                <?php } ?>
                </td>

Can you advise what would be a safe resolution with both plugins functioning?

lucidlee:

Frank
I'm trying to install CSAR over (or rather in addition to ) COWOA on a relatively new v1.5.4

.......

There are some places where the two plugins want to modify the same code and where I can largely combine them e.g. in SQL queries, but in admin/includes/customers.php they seem to be fighting for a control which I'm not sure how to resolve.

Can you advise what would be a safe resolution with both plugins functioning?

I will need to download the COWOA files and take a look at this tonight.

Ok, downloaded COWOA Updated and Combined for ZC v1.5.x - Version: v2.4 (seems to be the latest)

Hmmm...

CSAR uses the latest customers.php file with this header

• @copyright Copyright 2003-2014 Zen Cart Development Team
• @copyright Portions Copyright 2003 osCommerce
• @license http://www.zen-cart.com/license/2_0.txt GNU Public License V2.0
• @version GIT: $Id: Author: DrByte Jun 30 2014 Modified in v1.5.4 $

with all the other standard ZC v1.5.4 code

On the other hand the latest version of COWOA still uses an old file. According to the header it is from ZC v1.5.1 ..... but read on!:

• @copyright Copyright 2003-2012 Zen Cart Development Team
• @copyright Portions Copyright 2003 osCommerce
• @license http://www.zen-cart.com/license/2_0.txt GNU Public License V2.0
• @version GIT: $Id: Author: Ian Wilson Tue Aug 7 15:17:58 2012 +0100 Modified in v1.5.1 $
• @version $Id: Integrated COWOA v2.4 - 2007 - 2013

After digging further I found that COWOA even uses most of the code which was prevalent in ZC v1.3.9!!!

To get to that conclusion I had to unzip several old ZC install files and do comparisons.

This part adds the additional column for CSAR (1.5.4) which makes it the second last column:

                <td class="dataTableContent" align="center">
                <?php if ($customers->fields['customers_privileges'] == 0) { ?>
                <?php echo zen_image(DIR_WS_IMAGES . 'icon_red_off.gif', IMAGE_ICON_STATUS_OFF); ?>
                <?php } else { ?>
                  <?php if ($customers->fields['customers_privileges'] > 0) {
                    echo zen_draw_form('setstatus', FILENAME_CUSTOMERS, 'action=status&cID=' . $customers->fields['customers_id'] . (isset($_GET['page']) ? '&page=' . $_GET['page'] : '') . (isset($_GET['search']) ? '&search=' . $_GET['search'] : ''));?>
                    <input type="image" src="<?php echo DIR_WS_IMAGES ?>icon_green_on.gif" title="<?php echo IMAGE_ICON_STATUS_ON; ?>" />
                    <input type="hidden" name="current" value="<?php echo $customers->fields['customers_privileges']; ?>" />
                    </form>
                  <?php } else {
                    echo zen_draw_form('setstatus', FILENAME_CUSTOMERS, 'action=status&cID=' . $customers->fields['customers_id'] . (isset($_GET['page']) ? '&page=' . $_GET['page'] : '') . (isset($_GET['search']) ? '&search=' . $_GET['search'] : ''));?>
                    <input type="image" src="<?php echo DIR_WS_IMAGES ?>icon_red_on.gif" title="<?php echo IMAGE_ICON_STATUS_OFF; ?>" />
                    <input type="hidden" name="current" value="<?php echo $customers->fields['customers_privileges']; ?>" />
                    </form>
                  <?php } ?>
                <?php } ?>
                </td>

As I see it the COWOA part replaces the standard 1.3.9 code which is

                <td class="dataTableContent" align="center"><?php echo ($customers->fields['customers_authorization'] == 4 ? zen_image(DIR_WS_IMAGES . 'icon_red_off.gif', IMAGE_ICON_STATUS_OFF) : ($customers->fields['customers_authorization'] == 0 ? '<a href="' . zen_href_link(FILENAME_CUSTOMERS, 'action=status&current=' . $customers->fields['customers_authorization'] . '&cID=' . $customers->fields['customers_id'] . ($_GET['page'] > 0 ? '&page=' . $_GET['page'] : ''), 'NONSSL') . '">' . zen_image(DIR_WS_IMAGES . 'icon_green_on.gif', IMAGE_ICON_STATUS_ON) . '</a>' : '<a href="' . zen_href_link(FILENAME_CUSTOMERS, 'action=status&current=' . $customers->fields['customers_authorization'] . '&cID=' . $customers->fields['customers_id'] . ($_GET['page'] > 0 ? '&page=' . $_GET['page'] : ''), 'NONSSL') . '">' . zen_image(DIR_WS_IMAGES . 'icon_red_on.gif', IMAGE_ICON_STATUS_OFF) . '</a>')); ?></td>

with

               <td class="dataTableContent" align="center">
        <?php if ($customers->fields['customers_authorization'] == 4 ? zen_image(DIR_WS_IMAGES .
        'icon_red_off.gif', IMAGE_ICON_STATUS_OFF) : ($customers->fields['customers_authorization'] == 0 ? 
        '<a href="' . zen_href_link(FILENAME_CUSTOMERS, 'action=status&current=' . $customers->fields
        ['customers_authorization'] . '&cID=' . $customers->fields['customers_id'] . (isset($_GET['page']) ? '&page=' . $_GET['page'] : '') . (isset($_GET['search']) ? '&search=' . $_GET['search'] : ''), 'NONSSL') . '">' . zen_image(DIR_WS_IMAGES . 'icon_green_on.gif', 
        IMAGE_ICON_STATUS_ON) . '</a>' : '<a href="' . zen_href_link(FILENAME_CUSTOMERS, 
        'action=status&current=' . $customers->fields['customers_authorization'] . '&cID=' . $customers->
        fields['customers_id'] . (isset($_GET['page']) ? '&page=' . $_GET['page'] : '') . (isset($_GET['search']) ? '&search=' . $_GET['search'] : ''), 'NONSSL') . '">' . 
        zen_image(DIR_WS_IMAGES . 'icon_red_on.gif', IMAGE_ICON_STATUS_OFF) . '</a>')); ?> </td>
<?php if ($customers->fields['COWOA_account'] == 1) { ?>               
                <td class="dataTableContent" align="center"><?php echo 'COWOA'; ?> </td>
<?php }else{ ?> 
                <td class="dataTableContent" align="center"><?php echo 'STANDARD';} ?> </td>

Considering COWOA still uses old code it would be up to developers to merge COWOA into a 1.5.4 customers.php file

I am sorry that I can't be of further help but I think that old code is secondary to the latest code used.

Frank

I'm using the v1.5.4 friendly version of Integrated COWOA 2.6 that DivaVocals is working on: https://github.com/DivaVocals/zen_COWOA, although there are hassled integrating that with SuperOrders/Edit Orders/ etc if one uses them

lucidlee:

I'm using the v1.5.4 friendly version of Integrated COWOA 2.6 that DivaVocals is working on: https://github.com/DivaVocals/zen_COWOA, although there are hassled integrating that with SuperOrders/Edit Orders/ etc if one uses them

OK, I got my copy from the Plugins - I will have a look at COWOA 2.6 a bit later.

Edit: **that is a beta version! **Suggest not to use it until the final version is released.

Yes its a beta but it works better in v1.5.4 than does the older v2.4. It does seem to be adhering to the most recent ZenCart coding practices which is one reason why I'm having so much difficulty merging CSAR in.

lucidlee:

Yes its a beta but it works better in v1.5.4 than does the older v2.4. It does seem to be adhering to the most recent ZenCart coding practices which is one reason why I'm having so much difficulty merging CSAR in.

Judging by your initial post re merging the 2 mods, the COWOA admin/customers.php file has not been upgraded as yet. I have not checked and guess DivaVocals would be the person to contact to clarify.

Until DivaVocals has completed all of COWOA 2.6 and released an official version I would not attempt merging the 2 mods.

Sorry for resurrecting this very old post. I've been testing this version 2.12 of this mod on my 1.5.4 server.
Was this bug patched in the release package of v2.12?
Looks like I am able to circumvent this restriction by using Ajeh's method of using any non-restricted category + restricted product id in a url.
Here's what I've discovered:
If Im not logged in as a user, and try to directly access a restricted product. It'll throw a simple one line note of "OOPS - ILLEGAL ACCESS !".
However, if I am logged in as a valid user, but this user is NOT a privileged user, I was able to view and add the product to the user's shopping basket.

I've attempted to apply the hot fix codes in post #9 by replacing the first part of tpl_document_product_info_display.php. Didn't seem to change any of the behavior. But I figured it shouldn't be, since the post is very old, and looks like its for a versions before 2.0.

Lastly, products by Manufacturer doesn't seem to work at all. Which file controls this anyways? Im guessing it is the default_filter.php file.

Any help would appreciate it. I have a some what cult like following for my products, and my customers are extremely crafty in which I have people engineered bots for walking my catalog for scalping, but many users have actually been guessing incremental product numbers for finding newly created but hidden products. Which I really want to put an end to.

Any help is greatly appreciated.

frank18:

Plugged the security hole.

File /includes/templates/MY_TEMPLATE/templates/tpl_product_info_display.php amended to this:

[ file header here]

<?php /** * CATEGORY_RESTRICTION - find corresponding master category for the current product */ $products_id_to_block = $_GET['products_id']; global $db; $sql = "select master_categories_id from " . TABLE_PRODUCTS . " where products_id = :productID:"; $sql = $db->bindVars($sql, ':productID:', $products_id_to_block, 'integer'); $result = $db->Execute($sql); if ($result->RecordCount() > 0) { echo '(used for testing purposes): Master Category ID = ' . $result->fields['master_categories_id']; } else { echo 'Sorry, no record found for product number ' . $products_id_to_block; } if (!$_SESSION['customer_id'] && !$_SESSION['customers_privileges'] > 0 && in_array($result->fields['master_categories_id'],explode(',', CATEGORY_RESTRICTION_LOGIN_CATEGORY)) ) { //echo ' - this product should be blocked !!'; echo TEXT_ILLEGAL_ACCESS ; } else { // bof CATEGORY_RESTRICTION - OPEN ACCESS .... orginal body of the file .... then at the bottom added after <!--bof Form close--> <?php } // eof CATEGORY_RESTRICTION - OPEN ACCESS ?> </div> ``` > > Thanks again for pointing this out Ajeh!

chibipaw:

.....
Here's what I've discovered:
If Im not logged in as a user, and try to directly access a restricted product. It'll throw a simple one line note of "OOPS - ILLEGAL ACCESS !".
However, if I am logged in as a valid user, but this user is NOT a privileged user, I was able to view and add the product to the user's shopping basket.

I've attempted to apply the hot fix codes in post #9 by replacing the first part of tpl_document_product_info_display.php. Didn't seem to change any of the behavior. But I figured it shouldn't be, since the post is very old, and looks like its for a versions before 2.0.

Lastly, products by Manufacturer doesn't seem to work at all. Which file controls this anyways? Im guessing it is the default_filter.php file. .....

Thank you for the heads up. I will have a look at this in the next couple of days. Just returned from a trip to Melbourne and have a pile of (paying) jobs to attend first.

Leave it with me

Cheers / Frank

Thanks Frank.

Another thing to consider. My tester had found another bypass using submitting form using Firebug. I have too notice that the view basket/cart function doesn't seem to sanity check for products that are prohibited. Here's the synopsis of his findings. Hope this helps.

Requirements:
Firefox with FireBug Plugin ( https://addons.mozilla.org/en-US/firefox/addon/firebug/ )

If the user loads a non-restricted item page, and then opens the page in firebug, they can edit the following tag in the "Add to Cart Box" section:
<input type="hidden" name="products_id" value="11321" />
to input any ID, restricted or otherwise. Then the user can click the Add to Cart button, and the item will be added successfully without any restriction checking done.

frank18:

Thank you for the heads up. I will have a look at this in the next couple of days. Just returned from a trip to Melbourne and have a pile of (paying) jobs to attend first.

Leave it with me

Cheers / Frank

chibipaw:

......
Looks like I am able to circumvent this restriction by using Ajeh's method of using any non-restricted category + restricted product id in a url.
Here's what I've discovered:
If Im not logged in as a user, and try to directly access a restricted product. It'll throw a simple one line note of "OOPS - ILLEGAL ACCESS !".
However, if I am logged in as a valid user, but this user is NOT a privileged user, I was able to view and add the product to the user's shopping basket.

I've attempted to apply the hot fix codes in post #9 by replacing the first part of tpl_document_product_info_display.php. Didn't seem to change any of the behavior. But I figured it shouldn't be, since the post is very old, and looks like its for a versions before 2.0.

Yep, I could reproduce that.

Open the file /includes/templates/MY_TEMPLATE/templates/tpl_product_info_display.php, find

if ([B]!$_SESSION['customer_id'] && [/B]!$_SESSION['customers_privileges'] > 0 && in_array($result->fields['master_categories_id'],explode(',', CATEGORY_RESTRICTION_LOGIN_CATEGORY)) ) { 
 // block access to this product 
  echo TEXT_ILLEGAL_ACCESS ;

removed the part in red, change to

if (!$_SESSION['customers_privileges'] > 0 && in_array($result->fields['master_categories_id'],explode(',', CATEGORY_RESTRICTION_LOGIN_CATEGORY)) ) { 
 // block access to this product 
  echo TEXT_ILLEGAL_ACCESS ;

It is marked for the next updated version.

chibipaw:

......
Lastly, products by Manufacturer doesn't seem to work at all. Which file controls this anyways? Im guessing it is the default_filter.php file.

Sorry, I can't reproduce this, you may want to check for merging errors. Products by manufacturer works fine in a few test sites and also on a live 1.5.5a store.

Thanks for the update. Excited to finally patch this hole before anyone figures it out.

On manufacturer checking issue, which are the best files to look into first to diagnose this?

Thanks.

chibipaw:

Thanks for the update. Excited to finally patch this hole before anyone figures it out.

On manufacturer checking issue, which are the best files to look into first to diagnose this?

Thanks.

Just in the process of parceling up CSAR 2.2.0 modified for ZC 1.5.5a and will submit in the next day or so.

PM me your email and I send you a copy of the pack in the next day or 2.