Encrypted Master Password for Zen Cart v1.5.3 to v1.5.5

Version 2.2.1 by lat9. Copyright © 2013-2016, Vinos de Frutas Tropicales

Current Support Thread at Zen Cart Forums: www.zen-cart.com/showthread.php?179888-Encrypted-Master-Password-support

Usage Notes

  1. Starting with v2.2.0, this plugin drops support for Zen Cart versions prior to v1.5.3. If your store is using an older Zen Cart version, please use an earlier version of EMP.

What it does

Encrypted Master Password (EMP) allows one or more of your store's administrators to login to any customer account using their administrator password in conjunction with a customer's email address.

Configuration->My Store

Once you have have installed the plugin, two configuration values are available in your admin's Configuration->My Store to provide customization as described below.

Encrypted Master Password: Single Admin ID. If you want a single admin user to have EMP privileges, you'll set this value to the admin_id of that admin user. The default (1) selects the first admin user in your store. To find the admin_id value that you want to use, log into your store's admin and click Admin Access Management->Admin Users. The left-hand column will be titled ID, look for the number that identifies the admin account you've selected.

Encrypted Master Password: Admin Profile ID. If you want multiple admin users to have EMP privileges, they must be associated with one of the admin User Profiles that you select. Set this value to a packed, comma-separated list of profile ids (e.g. 1,2,3) and all admins in the specified profiles will have EMP authority. The default value (1) selects all Superuser admins for your store. To find the profile_id values that you want to use, log into your store's admin and click Admin Access Management->Admin Profiles. The left-hand column will be titled ID, look for the numbers that are associated with the admin user profiles want to configure.

The two configuration values can be used in combination, so that you can specify:

Customers->Customers

When an admin with EMP permissions views the Customers->Customers screen, there is an additional button available for the currently-selected customer: Place Order. Clicking that button will open a new window, taking the admin to your store's login page. From that page, the admin enters his/her Zen Cart admin password to log into the customer's account!

Note Versions 1.6.0 through 1.8.0 of this plugin provided an "automatic" login to the customer's account; version 2.0.0 changed this behavior, now requiring the admin-level password to log into the customer's account. This change was made to enable the use of the additional password validation methods introduced in Zen Cart v1.5.3 and in light of potential PCI concerns. With the previous behavior, if someone broke into your Zen Cart admin they would have "the keys to the kingdom" — access to all your customers' accounts.

In Your Store

When an EMP admin logs into a customer account, two session variables are set to identify this condition for future, additional plugins:

  1. $_SESSION['emp_admin_login'] is set to true.
  2. $_SESSION['emp_admin_id'] is set to the admin_id of the currently signed-in admin

In addition, an entry is written to the admin_activity_log to record the event. If an order is placed by the EMP admin on the customer's behalf, the updated_by field in the order's status history is set to identify the admin that placed the order (if that field has been added).

Starting with v2.1.0 of this plugin, a signed-in EMP admin can also change the customer's password on their behalf.

Installing and Upgrading

There are core-file overwrites in this plugin; you should always backup your cart’s database and files prior to making any changes. The files identified using this color are part of the "Common Orders-Status Update" interface and are subject to separate change!

  1. If you are upgrading from Encrypted Master Password v2.1.0:
    1. The ability to change a customer's password from the customer's account, introduced in EMP v2.1.0, has been replaced by a similar feature introduced in Zen Cart v1.5.5 admin's Customers->Customers handling. That functionality, included in EMP v2.2.0 and later, enables a Zen Cart admin to change a customer's password using that admin-level page.
    2. As such, this plugin's change to /includes/modules/pages/account_password/header_php.php is no longer required (or wanted). When you upgrade from EMP v2.1.0, you'll need to back-out the changes introduced to that file — most likely a simple replacement of your current Zen Cart's version of that core-file.
  2. Compare the plugin's /YOUR_ADMIN/customers.php with the one currently being used at your store. EMP currently provides the as-shipped Zen Cart 1.5.5 version of this file within its distribution. When integrating with changes to your pre-ZC1.5.5 store's files, the important line to merge is found at line #1266:

    $zco_notifier->notify('NOTIFY_ADMIN_CUSTOMERS_MENU_BUTTONS', $cInfo, $contents);

    Simply ensure that this line of code is present in your customized version of customers.php at the same point in the processing as in the distribution copy.
  3. Rename /YOUR_ADMIN to match the name of your Zen Cart admin directory.
  4. Upload the plugin's files to your store's file system:
    1. /includes/auto_loaders/config.emp_login_link.php
    2. /includes/classes/observers/class.emp_order_observer.php
    3. /YOUR_ADMIN/customers.php (This is the Zen Cart v1.5.5 version of the file)
    4. /YOUR_ADMIN/includes/auto_loaders/config.emp_customers_button.php
    5. /YOUR_ADMIN/includes/auto_loaders/config.zc154_compatibility.php
    6. /YOUR_ADMIN/includes/classes/observers/class.emp_admin_customers_observer.php
    7. /YOUR_ADMIN/includes/functions/extra_functions/init_emp_configuration.php
    8. /YOUR_ADMIN/includes/init_includes/init_zc154_compatibility.php
    9. /YOUR_ADMIN/includes/languages/dutch/customers.php (This is the Zen Cart v1.5.5 English version of the file)
    10. /YOUR_ADMIN/includes/languages/dutch/extra_definitions/emp_button_definitions.php
    11. /YOUR_ADMIN/includes/languages/dutch/images/buttons/button_placeorder.gif
    12. /YOUR_ADMIN/includes/languages/english/customers.php (This is the Zen Cart v1.5.5 version of the file)
    13. /YOUR_ADMIN/includes/languages/english/extra_definitions/emp_button_definitions.php
    14. /YOUR_ADMIN/includes/languages/english/images/buttons/button_placeorder.gif
  5. Sign into your admin-console or, if you are already signed in, click the Admin Home link at the top of the page. Navigate to Configuration->My Store and you'll see the two new configuration values for the EMP plugin.

Un-install

Replace the core files that were previously overwritten with the backup version that you created. You did make a backup, didn't you? Delete the other files copied during the installation. Finally, run the /docs/encrypted_master_password/uninstall/emp_uninstall.sql to remove the configuration keys from your database.

Version History: