added a token generator. md5(mt_rand()) is not good enough

opencart · Jun 29, 2015 · 564b4d0 · 564b4d0
1 parent 7280532
commit 564b4d0
Show file tree

Hide file tree

Showing 16 changed files with 54 additions and 102 deletions.
diff --git a/upload/admin/controller/catalog/download.php b/upload/admin/controller/catalog/download.php
@@ -492,7 +492,7 @@ public function upload() {
 		}
 
 		if (!$json) {
-			$file = $filename . '.' . md5(mt_rand());
+			$file = $filename . '.' . token(32);
 
 			move_uploaded_file($this->request->files['file']['tmp_name'], DIR_DOWNLOAD . $file);
 

diff --git a/upload/admin/controller/common/login.php b/upload/admin/controller/common/login.php
@@ -12,7 +12,7 @@ public function index() {
 		}
 
 		if (($this->request->server['REQUEST_METHOD'] == 'POST') && $this->validate()) {
-			$this->session->data['token'] = md5(mt_rand());
+			$this->session->data['token'] = token(32);
 
 			if (isset($this->request->post['redirect']) && (strpos($this->request->post['redirect'], HTTP_SERVER) === 0 || strpos($this->request->post['redirect'], HTTPS_SERVER) === 0 )) {
 				$this->response->redirect($this->request->post['redirect'] . '&token=' . $this->session->data['token']);

diff --git a/upload/admin/controller/extension/installer.php b/upload/admin/controller/extension/installer.php
@@ -76,7 +76,7 @@ public function upload() {
 
 		if (!$json) {
 			// If no temp directory exists create it
-			$path = 'temp-' . md5(mt_rand());
+			$path = 'temp-' . token(32);
 
 			if (!is_dir(DIR_UPLOAD . $path)) {
 				mkdir(DIR_UPLOAD . $path, 0777);

diff --git a/upload/admin/controller/payment/paymate.php b/upload/admin/controller/payment/paymate.php
@@ -91,7 +91,7 @@ public function index() {
 		} elseif ($this->config->get('paymate_password')) {
 			$data['paymate_password'] = $this->config->get('paymate_password');
 		} else {
-			$data['paymate_password'] = md5(mt_rand());
+			$data['paymate_password'] = token(32);
 		}
 
 		if (isset($this->request->post['paymate_test'])) {

diff --git a/upload/admin/controller/sale/order.php b/upload/admin/controller/sale/order.php
@@ -349,8 +349,8 @@ public function getForm() {
 		$data['text_loading'] = $this->language->get('text_loading');
 		$data['text_product'] = $this->language->get('text_product');
 		$data['text_voucher'] = $this->language->get('text_voucher');
-		$data['text_order'] = $this->language->get('text_order');
-
+		$data['text_order_detail'] = $this->language->get('text_order_detail');
+		
 		$data['entry_store'] = $this->language->get('entry_store');
 		$data['entry_customer'] = $this->language->get('entry_customer');
 		$data['entry_customer_group'] = $this->language->get('entry_customer_group');
@@ -832,6 +832,8 @@ public function info() {
 			//	$data['logo'] = DIR_ 
 			//}
 
+						$data['date_added'] = date($this->language->get('date_format_short'), strtotime($order_info['date_added']));
+
 			$data['order_id'] = $this->request->get['order_id'];
 
 			if ($order_info['invoice_no']) {
@@ -1111,8 +1113,6 @@ public function info() {
 			$data['forwarded_ip'] = $order_info['forwarded_ip'];
 			$data['user_agent'] = $order_info['user_agent'];
 			$data['accept_language'] = $order_info['accept_language'];
-			$data['date_added'] = date($this->language->get('date_format_short'), strtotime($order_info['date_added']));
-			$data['date_modified'] = date($this->language->get('date_format_short'), strtotime($order_info['date_modified']));
 
 
 
@@ -1258,7 +1258,7 @@ public function info() {
 					$content = $this->load->controller('fraud/' . $extension . '/order');
 
 					if ($content) {
-						$data['frauds'][] = array(
+						$data['tabs'][] = array(
 							'code'    => $extension,
 							'title'   => $this->language->get('heading_title'),
 							'content' => $content
@@ -1936,31 +1936,4 @@ public function shipping() {
 
 		$this->response->setOutput($this->load->view('sale/order_shipping.tpl', $data));
 	}
-
-	function api() {
-		$json = array();
-
-		if (!$this->user->hasPermission('modify', 'sale/order')) {
-			$json['error'] = $this->language->get('error_permission');
-		} else {
-			// Create token to login with
-			$string = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
-
-			$token = '';
-
-			for ($i = 0; $i < 64; $i++) {
-				$token .= $string[rand(0, strlen($string) - 1)];
-			}
-
-			$this->load->model('user/api');
-
-			$this->model_user_api->editToken($this->config->get('config_api_id'), $token);
-
-			//$data['token'] = $token;
-			$this->response->redirect();
-		}	
-
-		$this->response->addHeader('Content-Type: application/json');
-		$this->response->setOutput(json_encode($json));		
-	}
 }
diff --git a/upload/admin/controller/tool/upload.php b/upload/admin/controller/tool/upload.php
@@ -387,7 +387,7 @@ public function upload() {
 		}
 
 		if (!$json) {
-			$file = $filename . '.' . md5(mt_rand());
+			$file = $filename . '.' . token(32);
 
 			move_uploaded_file($this->request->files['file']['tmp_name'], DIR_UPLOAD . $file);
 

diff --git a/upload/admin/language/english/sale/order.php b/upload/admin/language/english/sale/order.php
@@ -6,6 +6,7 @@
 $_['text_list']                = 'Order List';
 $_['text_add']                 = 'Add Order';
 $_['text_edit']                = 'Edit Order';
+$_['text_order']               = 'Order (#%s)';
 $_['text_order_detail']        = 'Order Details';
 $_['text_order_id']            = 'Order ID:';
 $_['text_invoice_no']          = 'Invoice No.:';
@@ -37,14 +38,10 @@
 $_['text_shipping_address']    = 'Shipping Adress';
 $_['text_shipping_method']     = 'Shipping Method:';
 $_['text_payment_method']      = 'Payment Method:';
-
-
-
 $_['text_missing']             = 'Missing Orders';
 $_['text_default']             = 'Default';
 $_['text_product']             = 'Add Product(s)';
 $_['text_voucher']             = 'Add Voucher(s)';
-$_['text_order']               = 'Order Details';
 $_['text_shipping']            = 'Shipping';
 $_['text_contact']             = 'Contact';
 $_['text_sku']                 = 'SKU:';
@@ -53,7 +50,6 @@
 $_['text_jan']                 = 'JAN:';
 $_['text_isbn']                = 'ISBN:';
 $_['text_mpn']                 = 'MPN:';
-$_['text_generate']            = 'Generate';
 $_['text_reward_added']        = 'Success: Reward points added!';
 $_['text_reward_removed']      = 'Success: Reward points removed!';
 $_['text_commission_added']    = 'Success: Commission added!';

diff --git a/upload/admin/view/template/sale/order_form.tpl b/upload/admin/view/template/sale/order_form.tpl
@@ -39,7 +39,6 @@
                     <?php } ?>
                     <?php } ?>
                   </select>
-                  <input type="hidden" name="cookie" value="" />
                 </div>
               </div>
               <div class="form-group">
@@ -842,7 +841,7 @@
                 </table>
               </div>
               <fieldset>
-                <legend><?php echo $text_order; ?></legend>
+                <legend><?php echo $text_order_detail; ?></legend>
                 <div class="form-group required">
                   <label class="col-sm-2 control-label" for="input-shipping-method"><?php echo $entry_shipping_method; ?></label>
                   <div class="col-sm-10">
@@ -953,17 +952,15 @@ $('#order a[data-toggle=\'tab\']').on('click', function(e) {
 	return false;
 });
 
-// Cookie
+// Login to the API
 $.ajax({
 	url: $('select[name=\'store\'] option:selected').val() + 'index.php?route=api/login',
 	type: 'post',
 	data: 'token=<?php echo $token; ?>',
 	dataType: 'json',	
 	crossDomain: true,
 	success: function(json) {	
-		if (json['cookie']) {
-			$('input[name=\'cookie\']').val(json['cookie']);
-						
+		if (json['success']) {
 			$('select[name=\'currency\']').trigger('change');
 		}
 		
@@ -981,7 +978,7 @@ $('select[name=\'currency\']').on('change', function() {
 	$.ajax({
 		url: $('select[name=\'store\'] option:selected').val() + 'index.php?route=api/currency',
 		type: 'post',
-		data: 'cookie=' + $('input[name=\'cookie\']').val() + '&currency=' + $('select[name=\'currency\'] option:selected').val(),
+		data: 'token=<?php echo $token; ?>&currency=' + $('select[name=\'currency\'] option:selected').val(),
 		dataType: 'json',
 		crossDomain: false,
 		beforeSend: function() {
@@ -1012,7 +1009,7 @@ $('#button-refresh').on('click', function() {
 	$.ajax({
 		url: $('select[name=\'store\'] option:selected').val() + 'index.php?route=api/cart/products',
 		type: 'post',
-		data: 'cookie=' + $('input[name=\'cookie\']').val(),
+		data: 'token=<?php echo $token; ?>',
 		dataType: 'json',
 		crossDomain: true,
 		success: function(json) {

diff --git a/upload/admin/view/template/sale/order_info.tpl b/upload/admin/view/template/sale/order_info.tpl
@@ -14,7 +14,7 @@
   <div class="container-fluid">
     <div class="panel panel-default">
       <div class="panel-heading">
-        <h3 class="panel-title"><i class="fa fa-list"></i> <?php echo $text_order; ?></h3>
+        <h3 class="panel-title"><i class="fa fa-info-circle"></i> <?php echo $text_order; ?></h3>
       </div>
       <div class="panel-body">
         <div class="row">
@@ -27,7 +27,7 @@
             <br />
             <?php } ?>
             <br />
-            <i class="fa fa-calendar fa-fw"></i> <?php echo $date_added; ?><br />
+            <a href="<?php echo $store_url; ?>" target="_blank"><?php echo $store_name; ?></a> <i class="fa fa-calendar fa-fw"></i> <?php echo $date_added; ?><br />
             <?php if ($customer) { ?>
             <i class="fa fa-user fa-fw"></i> <a href="<?php echo $customer; ?>" target="_blank"><?php echo $firstname; ?> <?php echo $lastname; ?></a><br />
             <?php } else { ?>
@@ -172,7 +172,6 @@
                       <?php } ?>
                       <?php } ?>
                     </select>
-                    <input type="hidden" name="cookie" value="" />
                   </div>
                 </div>
                 <div class="form-group">
@@ -195,20 +194,26 @@
           </div>
           <div class="tab-pane" id="tab-additional">
             <table class="table table-bordered">
+              <?php foreach ($account_custom_fields as $custom_field) { ?>
               <tr>
-                <td><?php echo $text_store_name; ?></td>
-                <td><?php echo $store_name; ?></td>
+                <td><?php echo $custom_field['name']; ?>:</td>
+                <td><?php echo $custom_field['value']; ?></td>
               </tr>
-              <tr>
-                <td><?php echo $text_store_url; ?></td>
-                <td><a href="<?php echo $store_url; ?>" target="_blank"><?php echo $store_url; ?></a></td>
+              <?php } ?>
+              <?php foreach ($payment_custom_fields as $custom_field) { ?>
+              <tr data-sort="<?php echo $custom_field['sort_order'] + 1; ?>">
+                <td><?php echo $custom_field['name']; ?>:</td>
+                <td><?php echo $custom_field['value']; ?></td>
               </tr>
-              <?php foreach ($account_custom_fields as $custom_field) { ?>
-              <tr>
+              <?php } ?>
+              <?php if ($shipping_method) { ?>
+              <?php foreach ($shipping_custom_fields as $custom_field) { ?>
+              <tr data-sort="<?php echo $custom_field['sort_order'] + 1; ?>">
                 <td><?php echo $custom_field['name']; ?>:</td>
                 <td><?php echo $custom_field['value']; ?></td>
               </tr>
               <?php } ?>
+              <?php } ?>
               <?php if ($ip) { ?>
               <tr>
                 <td><?php echo $text_ip; ?></td>
@@ -233,31 +238,7 @@
                 <td><?php echo $accept_language; ?></td>
               </tr>
               <?php } ?>
-              <tr>
-                <td><?php echo $text_date_modified; ?></td>
-                <td><?php echo $date_modified; ?></td>
-              </tr>
-            </table>
-            <table class="table table-bordered">
-              <tbody>
-                <?php foreach ($payment_custom_fields as $custom_field) { ?>
-                <tr data-sort="<?php echo $custom_field['sort_order'] + 1; ?>">
-                  <td><?php echo $custom_field['name']; ?>:</td>
-                  <td><?php echo $custom_field['value']; ?></td>
-                </tr>
-                <?php } ?>
-              </tbody>
             </table>
-            <?php if ($shipping_method) { ?>
-            <table class="table table-bordered">
-              <?php foreach ($shipping_custom_fields as $custom_field) { ?>
-              <tr data-sort="<?php echo $custom_field['sort_order'] + 1; ?>">
-                <td><?php echo $custom_field['name']; ?>:</td>
-                <td><?php echo $custom_field['value']; ?></td>
-              </tr>
-              <?php } ?>
-            </table>
-            <?php } ?>
           </div>
           <?php foreach ($tabs as $fraud) { ?>
           <div class="tab-pane" id="tab-<?php echo $fraud['code']; ?>"> <?php echo $fraud['content']; ?></div>
@@ -415,7 +396,7 @@ $(document).delegate('#button-commission-remove', 'click', function() {
 	});
 });
 
-// Cookie
+// Login to the API
 $.ajax({
 	url: '<?php echo $store_url; ?>index.php?route=api/login',
 	type: 'post',
@@ -425,10 +406,6 @@ $.ajax({
 	success: function(json) {
 		$('.alert').remove();
 			
-		if (json['cookie']) {
-			$('input[name=\'cookie\']').val(json['cookie']);
-		}
-		
 		if (json['error']) {
 			$('#content > .container-fluid').prepend('<div class="alert alert-danger"><i class="fa fa-exclamation-circle"></i> ' + json['error'] + ' <button type="button" class="close" data-dismiss="alert">&times;</button></div>');
 		}		
@@ -461,7 +438,7 @@ $('#button-history').on('click', function() {
 		url: '<?php echo $store_url; ?>index.php?route=api/order/history&token=<?php echo $token; ?>&order_id=<?php echo $order_id; ?>',
 		type: 'post',
 		dataType: 'json',
-		data: 'cookie=' + $('input[name=\'cookie\']').val() + '&order_status_id=' + encodeURIComponent($('select[name=\'order_status_id\']').val()) + '&notify=' + ($('input[name=\'notify\']').prop('checked') ? 1 : 0) + '&append=' + ($('input[name=\'append\']').prop('checked') ? 1 : 0) + '&comment=' + encodeURIComponent($('textarea[name=\'comment\']').val()),
+		data: 'token=<?php echo $token; ?>&order_status_id=' + encodeURIComponent($('select[name=\'order_status_id\']').val()) + '&notify=' + ($('input[name=\'notify\']').prop('checked') ? 1 : 0) + '&append=' + ($('input[name=\'append\']').prop('checked') ? 1 : 0) + '&comment=' + encodeURIComponent($('textarea[name=\'comment\']').val()),
 		beforeSend: function() {
 			$('#button-history').button('loading');			
 		},

diff --git a/upload/admin/view/template/sale/order_list.tpl b/upload/admin/view/template/sale/order_list.tpl
@@ -246,7 +246,7 @@ $('input[name^=\'selected\']').on('change', function() {
 
 $('input[name^=\'selected\']:first').trigger('change');
 
-// Cookie
+// Login to the API
 $.ajax({
 	url: 'index.php?route=sale/order/api',
 	type: 'post',
@@ -256,10 +256,6 @@ $.ajax({
 	success: function(json) {	
 		$('.alert').remove();
 		
-		if (json['cookie']) {
-			$('input[name=\'cookie\']').val(json['cookie']);
-		}
-		
 		if (json['error']) {
 			$('#content > .container-fluid').prepend('<div class="alert alert-danger"><i class="fa fa-exclamation-circle"></i> ' + json['error'] + ' <button type="button" class="close" data-dismiss="alert">&times;</button></div>');
 		}		
@@ -278,7 +274,7 @@ $('button[id^=\'button-delete\']').on('click', function(e) {
 		$.ajax({
 			url: 'http://localhost/opencart/upload/index.php?route=api/cart/remove',
 			type: 'post',
-			data: 'cookie=' + $('input[name=\'cookie\']').val() + '&order_id=' + $(node).val(),
+			data: 'token=<?php echo $token; ?>&order_id=' + $(node).val(),
 			dataType: 'json',
 			crossDomain: true,						
 			beforeSend: function() {

diff --git a/upload/catalog/controller/affiliate/forgotten.php b/upload/catalog/controller/affiliate/forgotten.php
@@ -16,7 +16,7 @@ public function index() {
 		if (($this->request->server['REQUEST_METHOD'] == 'POST') && $this->validate()) {
 			$this->load->language('mail/forgotten');
 
-			$password = substr(md5(mt_rand()), 0, 10);
+			$password = token(10);
 
 			$this->model_affiliate_affiliate->editPassword($this->request->post['email'], $password);
 

diff --git a/upload/catalog/controller/api/order.php b/upload/catalog/controller/api/order.php
@@ -195,7 +195,7 @@ public function add() {
 					foreach ($this->session->data['vouchers'] as $voucher) {
 						$order_data['vouchers'][] = array(
 							'description'      => $voucher['description'],
-							'code'             => substr(md5(mt_rand()), 0, 10),
+							'code'             => substr(token(32), 0, 10),
 							'to_name'          => $voucher['to_name'],
 							'to_email'         => $voucher['to_email'],
 							'from_name'        => $voucher['from_name'],
@@ -535,7 +535,7 @@ public function edit() {
 						foreach ($this->session->data['vouchers'] as $voucher) {
 							$order_data['vouchers'][] = array(
 								'description'      => $voucher['description'],
-								'code'             => substr(md5(mt_rand()), 0, 10),
+								'code'             => token(10),
 								'to_name'          => $voucher['to_name'],
 								'to_email'         => $voucher['to_email'],
 								'from_name'        => $voucher['from_name'],

diff --git a/upload/catalog/controller/checkout/confirm.php b/upload/catalog/controller/checkout/confirm.php
@@ -233,7 +233,7 @@ public function index() {
 				foreach ($this->session->data['vouchers'] as $voucher) {
 					$order_data['vouchers'][] = array(
 						'description'      => $voucher['description'],
-						'code'             => substr(md5(mt_rand()), 0, 10),
+						'code'             => token(10),
 						'to_name'          => $voucher['to_name'],
 						'to_email'         => $voucher['to_email'],
 						'from_name'        => $voucher['from_name'],

diff --git a/upload/catalog/controller/payment/pp_express.php b/upload/catalog/controller/payment/pp_express.php
@@ -992,7 +992,7 @@ public function expressComplete() {
 				foreach ($this->session->data['vouchers'] as $voucher) {
 					$voucher_data[] = array(
 						'description'      => $voucher['description'],
-						'code'             => substr(md5(mt_rand()), 0, 10),
+						'code'             => token(10),
 						'to_name'          => $voucher['to_name'],
 						'to_email'         => $voucher['to_email'],
 						'from_name'        => $voucher['from_name'],