Admin Profiles (for v1.3.x only!) Support Thread

You probably forgot to add Kuroi's code to the third party extra boxes files. Take a look at the 'updating box files (a step-by-step guide).txt' document included in the download.

If you did mess that up...man...don't worry, the best do that...(me) Look up a couple of posts and you will see where I gave a great example of how to do this!

G,Luck

Thanks,

I'll take a look

I found the problem! it was missing the if statment

if (menu_header_visible('Tools')=='true')

It is working fine now.

Thanks All

This might be a fairly major issue.

My user can change their settings if they know the path to the admin page!
If the user enters the URL to edit a user they can change their own permissions and gain full control!
http://www.mysite_url_here.com/admindirectory/admin_control.php?adminID=2

The user is allowed to access this page, and allowed to change settings on this page. They can open up the site and do quite a bit of harm.

They cannot access the page without the variable in the url, but they have full access otherwise. If someone has installed Zen, or used Zen, they will have an understanding of the expected path and will probably monkey around. I did. They can even lock the main admin out by simply appending the URL with adminID=1! Try it.

Is there a setting that can be changed to fix this?

One other thing. Is there any way to restrict what they see on their 'Admin Home' page? I would prefer that they didn't see all stats.

Roblaw, wow... i just verified what you said and its very true.

Personally I'm not concerned since its all internal users and since everything is tracked, it shouldn't be an issue...

that said, if you have reason to believe (which you always should assume so) that someone has the intent of being malicious and is knowledgable, then they could at the same time clear any of the tracking data and not be noticed.

very interesting find...

roblaw:

This might be a fairly major issue. ...

Is there a setting that can be changed to fix this?If you replace your admin/includes/init_includes/overrides/init_admin_auth.php with this one --> Attachment #1848 then it should close that hole. A small health warning - this file is taken from Admin Profiles 2 which is still under development and so not fully tested, but in a quick test after retrofitting it to a 1.0.6 environment it seemed to work OK without side effects.

roblaw:

One other thing. Is there any way to restrict what they see on their 'Admin Home' page? I would prefer that they didn't see all stats.What appears on the Admin Home page is controlled by the admin/index.php file. There's not a switchable way, though you could use CSS to set display:none for the class .reportBox. This would turn the home page content off for all users. If you wanted more precision you would need to change the PHP by inserting "if" statement in there to restrict display to specific values of $_SESSION['admin_id'].

kuroi:

If you replace your admin/includes/init_includes/overrides/init_admin_auth.php with this one --> Attachment #1848 then it should close that hole. A small health warning - this file is taken from Admin Profiles 2 which is still under development and so not fully tested, but in a quick test after retrofitting it to a 1.0.6 environment it seemed to work OK without side effects.

Thanks for the fix. Appears to work well for me with Admin Profiles 1.06 on ZC 1.37.

Woody

Virtualahmad,

As in your case, this won't matter for most users. Anyone who has ever had an employee go bad, will probably want to get a fix in place. Especially if you have employees that like to tinker with things.

I am going to implement the solution by kuroi. Thanks for the quick response.

If others are looking to change the view that other users have on the admin/index.php page, I would recommend kuroi's suggestion a conditional statement checking for the admin_id prior to display. Hiding it with CSS is viewable in source.

Thanks again.

roblaw

Help please. I'm usually pretty good at this stuff

If you are using a database prefix for your Zen Cart tables, you must either: run the install_adminlevels.sql file using Zen Cart's Admin > Tools > Install SQL Patch facility, or edit the file to change the prefix for all create table and insert statements, before running it using your preferred tool.

Firs how do I know if I'm using a prefix_not sure what that means

I don't see an install-adminlevels.sql file to run?

Can someone please point me in the right direction.

THanks!

Firstly that should read install_admin_profiles.sql. After more than a year of operation and six releases, I'm amazed that nobody has pointed that out before.

If you don't know whether your Zen Cart was installed with a database prefix or not, I recommend installing Admin Profiles by using Admin > Tools > Install SQL Patches, as then you don't need to worry about this question.

Ok thanks that makes more sense I was just confused by that file name LOL. I will work on this tonight.

Thanks a bunch for the quick response

Honeysmom:

Ok thanks that makes more sense I was just confused by that file name LOL. I will work on this tonight.

Thanks a bunch for the quick response
Thank you for drawing my attention to this error, which has been corrected ready for any future releases.

Honeysmom:

Help please. I'm usually pretty good at this stuff

Firs how do I know if I'm using a prefix_not sure what that means

I don't see an install-adminlevels.sql file to run?

Can someone please point me in the right direction.

THanks!

There appears to be a couple of errors/typos in the install.txt file. Perhaps it is for an older version.

1. When they are referring to the prefix, you can tell if your tables have a prefix by viewing the DB in something like phpMyAdmin. Do your tables start with something like zc_? For example, is you first table zc_address_book? My button push installs (usually provided by your host) will ask if you would like to use a prefix, or they will offer you that option.

2. The 'install-adminlevels.sql' file seems to be named 'install_admin_profiles.sql' now.

Good luck.

Bob L.
http://www.venturen.net/

Kuroi,

I have super orders installed and I installed your patch to address the security issue that we discussed yesterday. When navigating to pages within 'super orders' (newer pages than your install) I a security clearance error.

"Sorry, your security clearance does not allow you to access this resource.
Please contact your site administrator if you believe this to be incorrect.
Sorry for any inconvenience."

I am assuming this can be addressed within the DB table 'admin_files'. Is this correct? If so, do you have some information regarding naming structure needed? Would it match up with the menu names for the page?

Any advice would be a real time saver. Thanks.

roblaw

I haven't actually used super orders personally, but am aware of it as one of three mods that needs some exceptional handling in Admin Profiles. In this case because, unusually, it has pages located within the mod that aren't referenced directly from the Admin menu system.

To deal with this you would need to set up extra box files in your admin/includes/boxes/extra_boxes folder. The super orders pages should then appear in Admin > Tools > Admin Settings (or at least I hope so, this is all a bit theoretical).

Anyway, to save you some time, here --> Attachment #1858 <-- are the box files that you need. Please let me know if this works.

Kuroi,

Worked great. Thanks for your help!

roblaw

Hi All!

Before i install this great contribution i just wanted to verify that the admin profiles 1.0.6 will work with ZC 1.3.7 - it looks like it will from other people. Also just wanted to verify that any additional mods that i add i have to modify the boxes with the access granted three line code?

Anyone else have anything to look out for when installing, etc?

As always I appreciate everyone's help!

Thanks - Zack

zackf:

i just wanted to verify that the admin profiles 1.0.6 will work with ZC 1.3.7It will.

zackf:

Also just wanted to verify that any additional mods that i add i have to modify the boxes with the access granted three line code?Not sure I understand, but I'll take a stab - you will need to modify the boxfile for any mod that has an admin page that you install in future - there are instructions for doing this in the release package.

zackf:

Anyone else have anything to look out for when installing, etc?It's all in the installation instructions (unless you're using Super Orders!)

Hi Kuroi - I really appreciate your quick response. can't wait to install it! :)

Thanks again - zack