Master Password Encrypted mod support

Running Zen Cart 1.37 with Andrew's (a_berezin) Encrypted Master Password mod version dated Jan 29, 2006 from
zen-cart.spb.ru/freedownload.php?file=zc-contribution/master_password_encrypt.zip

The mod has previously behaving well on previous ZC 1.27 and 1.3x carts

However I just moved my network connection from one IP block to another. My old IP entry still shows up under "Master Password IP" in Configuration > My Store. (that is the only IP entered).

But when I attempt to log into another users account with master password from my new IP, I am allowed to log in. This should not be?

So possibly the IP filtering function of this mod does not work any longer with this mod? Or something I need to do to repair? I am fairly certain the IP filtering was working previously on my former Zen Cart 1.27 shop. Anyone else discover similar issue?Note the Master Password function still works fine, jut not the IP filter.

Is there a newer version of this Master Password mod available by Andrew (or somewhere else) supporting IP filtering on Zen Cart 1.37. I have not tried the other more recent Encrypted Master Password mod developed by Dennis Sayer, as I understand it does not filter Master Password access by IP.

Hi, Woodymon
Very strange. IP filtering function does not depend on the zen-cart version.
Tomorrow I shall test it once again.

a_berezin:

Very strange. IP filtering function does not depend on the zen-cart version.
Hi Andrew, I went to test a ZC 127 shop, which is still in production (in the upgrade queue) and which I am quite sure I previously installed your mod on. But just discovered it does not have the mod installed. So I will install mod and test.

Woody

Woodymon:

Hi Andrew, I went to test a ZC 127 shop, ... but just discovered it does not have the mod installed. So I will install mod and test.

Master Password (crypted) v1.0
master_password_encrypt.zip (Jan 29, 2006)

Just installed on a 1.27 shop. Master Password feature works and is encrypted in admin. But the IP filter does not work. I entered my OLD IP in admin but still able to use master password within the catalog to log into anyones account.

Possible issue with /includes/functions/password_funcs.php

// BOF master_password
      $ip_allow = true;
      if(MASTER_PASSWORD_IP != "") {
        $master_password_ip = explode(",", str_replace(array(";", " ", ",,"), ",", MASTER_PASSWORD_IP));
        $ip_allow = false;
        for($i=0,$n=sizeof($master_password_ip);$i<$n;$i++){
          if(strpos($_SERVER["REMOTE_ADDR"], $master_password_ip[$i]) == 0) {
            $ip_allow = true;
            break;
          }
        }
      }

I'm not pretending the IP filtering is providing a huge dose of extra security. But nevertheless the IP filtering would be a nice feature to have working. Especially when managing and/or troubleshooting the shop from different remote locations all the time.

Woody

Woody,
You use proxy?

a_berezin:

Woody,
You use proxy?
Negative. Nope. Nada.

Woody,
Run this script and PM me screenshot.

<?php
require('includes/application_top.php');
echo '<pre>';var_dump(MASTER_PASSWORD_IP, $_SERVER['REMOTE_ADDR'], $_SERVER['HTTP_X_FORWARDED_FOR'], $_SERVER['HTTP_CLIENT_IP']);echo '</pre>';
?>

v 1.1 14.02.2007 7:57

• Use zen_draw_password_field() function to enter master password in admin;
• Use zen_cfg_password_display() function to display master password in admin (for 1.3.7 compatibility);
• Fix bug testing MASTER_PASSWORD_IP in password_funcs.php;

Special thanks to Woody!

Thanks again for the fix Andrew.

The IP filtering provided by your updated Encrypted Master Password mod is a definite plus!!!!

Woody

BTW, the name of this mod is "Master Password Crypted". Apologies for the incorrect title of this support thread and for previously referring to mod name incorrectly. ;)

Woody

a_berezin:

v 1.1 14.02.2007 7:57

• Use zen_draw_password_field() function to enter master password in admin;
• Use zen_cfg_password_display() function to display master password in admin (for 1.3.7 compatibility);
• Fix bug testing MASTER_PASSWORD_IP in password_funcs.php;

Special thanks to Woody!
Andrew-

The patch you supplied worked on my 1.27 shop fine.

So I then downloaded your new 1.1 version and updated 1.37 shop from Master Password Encrypted (MPE) 1.0 to the new v.1.1.

However I discovered I am now unable to log into other user accounts with the master password. I have ensured I correctly entered the password in both admin (Config > My Store) and when attempting to log into shop. I have attempted logging in without an IP entered, with the correct IP entered, and with an incorrect IP entered. All login attempts using the master password were unsuccessful. Before the update to 1.1 master password logins were working fine previously on Zen Cart 1.37, using version MPE 1.0, (just the IP checking was not working).

I have confirmed I can log into the shop with normal user account password.

My update process from 1.0 to 1.1

1. Run update_1_1.sql;
2. Edit /includes/functions/password_funcs.php
3. Upload two new files:
   admin/includes/languages/english/extra_definitions/master_password.php
   admin/includes/functions/extra_functions/master_password.php

That was it.

It appears the previous 1.0 code changes already in /admin/configuration.php are the same as for v.1.1, so I did not edit this file.

Any troubleshooting ideas?

Woody

Sorry.
v 1.1.1 14.02.2007 20:12

• Bug fix in /includes/functions/password_funcs.php

Woody,
What version of PHP you use?

a_berezin:

Sorry.
v 1.1.1 14.02.2007 20:12

• Bug fix in /includes/functions/password_funcs.php

Woody,
What version of PHP you use?

The 1.37 shop with the reported issue runs on PHP Version: 5.1.6 (Zend: 2.1.0)

Now it work?

a_berezin:

Now it work?

Nope. Same issue.

I downloaded your new v.1.1.1 and patched /includes/functions/password_funcs.php (all code between lines // BOF master_password and // EOF master_password).

Woody

Thanks Andrew for providing the post v1.1.1 patch below! The master password and IP checking now works on ZC 1.37 shop (running PHP 5.1.6).

In the file /includes/functions/password_funcs.php
replace same commented code block with the following code block:

// BOF master_password
if(zen_not_null(MASTER_PASSWORD) && $encrypted != MASTER_PASSWORD) {
if(!zen_not_null(MASTER_PASSWORD_IP)) return zen_validate_password($plain, MASTER_PASSWORD);
$master_password_ip = explode("|", preg_replace(array("@(\s)+\s@"), "|", trim(str_replace(array(";", ","), ' ', MASTER_PASSWORD_IP))));
for($i=0,$n=sizeof($master_password_ip);$i<$n;$i++) {
if(preg_match('/^' . $master_password_ip[$i] . '/', $_SERVER['REMOTE_ADDR'])) {
return zen_validate_password($plain, MASTER_PASSWORD);
break;
}
}
}
// EOF master_password

I've downloaded 'Encrypted Master Password' from the download section and installed it in ZC1.3.7. Changed admin_id to 2 but it doesn't seem to work. Since this mod is rather basic there's nothing to indicate that I did something wrong.

Trying to solve this I stumbled upon this thread but it confused me to see the code patches I didn't seem to have. Now I realize that there must be two mods with almost similar names; 'Encrypted Master Password' by Dennis Sayer and 'Master Password Encrypted' by Andrew Berezin.

Couldn't find the 'Master Password Encrypted' mod in the download section but a link in one of the previous posts in this thread enabled me to download a copy. This mod however takes a little more work to incorporate into ZC.

Is there anyone who can confirm the existence of the two similar mods and explain why one is better than the other? The 'Master Password Encrypted' mod seems to have more options and a admin interface but is it a more secure solution?

davale:

Is there anyone who can confirm the existence of the two similar mods and explain why one is better than the other? The 'Master Password Encrypted' mod seems to have more options and a admin interface but is it a more secure solution?
Andrew's mod supports IP access control (via admin). To download latest version visit link in Andrew's signature.

Nice mod,

But just a small delima...
I have 3 administrators how do I change the following code?

Encrypted Master Password allows the stores administrator to login to any
account with there administrator password. The SLQ on line 60 can be
modified to change which administrator can use Encrypted Master Password.
This example changes the Encrypted Master Password to admin #2:
WHERE admin_id = '2' ";

I have admin #1,#3,#4 in for my administration panel. Is it possible to recode to have all three access the login rights for a customer.

Mark,

I just installed this mod in my 1.3.0.2 store and I get the error message when trying the admin password.

I went through the instructions a few times with the same results and then changed the 1 in the header_php.php to a the number of another admin user I desired and got the same results:

ERROR_SECURITY_ERROR and no other customers can log in.

Install went very simple. I did compare my files and the only difference in header_php.php was the code for the mod.