Encrypted Master Password for Zen Cart v1.5.5 (and later)

Version 2.4.2 by lat9. Copyright © 2013-2019, Vinos de Frutas Tropicales

Current Support Thread at Zen Cart Forums: www.zen-cart.com/showthread.php?179888-Encrypted-Master-Password-support

Usage Notes

  1. Starting with v2.2.0, this plugin drops support for Zen Cart versions prior to v1.5.3. If your store is using an older Zen Cart version, please use an earlier version of EMP.
  2. Starting with v2.3.0, this plugin drops support for Zen Cart versions prior to v1.5.5. If your store is using an older Zen Cart version, please use an earlier version of EMP.

What it does

Encrypted Master Password (EMP) allows one or more of your store's administrators to login to any customer account using their administrator password in conjunction with a customer's email address.

Configuration->My Store

Once you have have installed the plugin, two configuration values are available in your admin's Configuration->My Store to provide customization as described below.

Encrypted Master Password: Single Admin ID. If you want a single admin user to have EMP privileges, you'll set this value to the admin_id of that admin user. The default (1) selects the first admin user in your store. To find the admin_id value that you want to use, log into your store's admin and click Admin Access Management->Admin Users. The left-hand column will be titled ID, look for the number that identifies the admin account you've selected.

Encrypted Master Password: Admin Profile ID. If you want multiple admin users to have EMP privileges, they must be associated with one of the admin User Profiles that you select. Set this value to a packed, comma-separated list of profile ids (e.g. 1,2,3) and all admins in the specified profiles will have EMP authority. The default value (1) selects all Superuser admins for your store. To find the profile_id values that you want to use, log into your store's admin and click Admin Access Management->Admin Profiles. The left-hand column will be titled ID, look for the numbers that are associated with the admin user profiles want to configure.

The two configuration values can be used in combination, so that you can specify:

Customers->Customers

When an admin with EMP permissions views the Customers->Customers screen, there is an additional button available for the currently-selected customer: Place Order. Clicking that button will open a new window, taking the admin to your store's login page. From that page, the admin enters his/her Zen Cart admin password to log into the customer's account!

Note Versions 1.6.0 through 1.8.0 of this plugin provided an "automatic" login to the customer's account; version 2.0.0 changed this behavior, now requiring the admin-level password to log into the customer's account. This change was made to enable the use of the additional password validation methods introduced in Zen Cart v1.5.3 and in light of potential PCI concerns. With the previous behavior, if someone broke into your Zen Cart admin they would have "the keys to the kingdom" — access to all your customers' accounts.

In Your Store

When an EMP admin logs into a customer account, three session variables are set to identify this condition for future, additional plugins:

  1. $_SESSION['emp_admin_login'] is set to true.
  2. $_SESSION['emp_admin_id'] is set to the admin_id of the currently signed-in admin
  3. $_SESSION['emp_customer_email_address'] is set to the email address of the customer for whom the admin is shopping; added in v2.4.0.

In addition, an entry is written to the admin_activity_log to record the event. If an order is placed by the EMP admin on the customer's behalf, the updated_by field in the order's status history is set to identify the admin that placed the order (if that field has been added).

Starting with v2.1.0 of this plugin, a signed-in EMP admin can also change the customer's password on their behalf.

Installing and Upgrading

Starting with v2.3.0 of EMP, there are no core-file overwrites in this plugin; you should always backup your cart's database and files prior to making any changes.

  1. Rename /YOUR_ADMIN to match the name of your Zen Cart admin directory.
  2. Upload the plugin's files to your store's file system:
    1. /includes/auto_loaders/config.emp_login_link.php
    2. /includes/classes/observers/class.emp_order_observer.php
    3. /includes/languages/dutch/extra_definitions/encrypted_master_password_messages.php (Added for v2.4.0)
    4. /includes/languages/english/extra_definitions/encrypted_master_password_messages.php (Added for v2.4.0)
    5. /YOUR_ADMIN/includes/auto_loaders/config.emp_customers_button.php
    6. /YOUR_ADMIN/includes/classes/observers/class.emp_admin_customers_observer.php
    7. /YOUR_ADMIN/includes/functions/extra_functions/init_emp_configuration.php
    8. /YOUR_ADMIN/includes/languages/dutch/extra_definitions/emp_button_definitions.php
    9. /YOUR_ADMIN/includes/languages/dutch/images/buttons/button_placeorder.gif
    10. /YOUR_ADMIN/includes/languages/english/extra_definitions/emp_button_definitions.php
    11. /YOUR_ADMIN/includes/languages/english/images/buttons/button_placeorder.gif
  3. Sign into your admin-console or, if you are already signed in, click the Admin Home link at the top of the page. Navigate to Configuration->My Store and you'll see the two new configuration values for the EMP plugin.

Un-install

Delete the plugin's added files (see above) copied during the installation. Finally, run the /docs/encrypted_master_password/uninstall/emp_uninstall.sql to remove the configuration keys from your database.

Version History: