Security Token vs my mod

I have a small problem with the concept of securityToken, and I hope you can bring me some light!

I understand that this securityToken is sent together with the login and password to prevent fraudulent identification, but I don't get where theat token is generated.

In my case, I try to adapt the login_as_customer module, which allow an admin to click on a button to directly login in the catalog part of the shop using the customer's email and the master password.

Information is sent that way :

<form target="_blank" name="login" action="' . $login_as_customer . '" method="get">
<input type="hidden" name="email_addr" id="login-email-address" value="' . $email_address . '">
<input type="hidden" name="password" id="login-password" value="' . $pass . '">
<input type="image" src="' . $place_order_button . '">
</form>

I would expect the following to work with 1.3.8a :

<form target="_blank" name="login" action="' . $login_as_customer . '" method="get">
<input type="hidden" name="email_addr" id="login-email-address" value="' . $email_address . '">
<input type="hidden" name="password" id="login-password" value="' . $pass . '">
' . zen_draw_hidden_field('securityToken', $_SESSION['securityToken']) . '
<input type="image" src="' . $place_order_button . '">
</form>

(the code might look a little strange, it is in fact only an abstract of a long string sent, but it is working - no parse error)

But this seems not to work. Do I have a problem with the way I generate the token??

Thanks,

sanji

Sanji

Don't worry about how the security token is generated. Rather your problem looks to me to be that your form is using the get method for passing information, but Zen Cart is expecting to receive the security token in the $_POST array.

Indeed, I'm not sure that you can pass hidden variables with the get method as they are visibly tagged onto the URL.

Thanks Kuroi, I tried both post and get methods, but the result is exactly the same...

sanji

This is the way the information is sent for login, with post :

<form name='form1' action='/index.php?main_page=login&action=process' method='post'>
<input type='hidden' name='email_address' id='login-email-address' value='[email protected]' />
<input type='hidden' name='password' id='login-password' value='12345678' />
<input type='hidden' name='securityToken' id='securityToken' value='xxxxxxxx49eb4cdfd90ba277c409aa22' />
<input type='submit' value='Place Order' />
<input type='button' value='Cancel Order' onclick='window.close()'>
</form>

Does that look OK? I still get that Security Error...

sanji