0

Please note: I understand this would be open to a potential security risk. However, due to the nature of my site, I want to exhaust as many solutions as possible to help stop fraud from taking place. With the way Magento saves and hashes passwords, it's impossible to compare passwords. One way to catch abusers/fraudsters is to compare the password they use at registration, as many use the same thing to speed the process up.

Intention: I want to grab the raw password upon successful registration, hash it (without salt) and save it in a table on a remote server that has no connection to my site's server. It would simply save the customer ID and the new hashed password.

I think I could do this 1 of 2 ways:

  1. Extend the core model with an extra function that will do this
  2. Create a new module that would use the customer_register_success ? event and grab it separately.

I'm unsure of whether or not it's possible to grab the password before it's hashed with solution 2.

Either way, after doing a little searching through core customer models, I've really only found a couple of possibilities.

In /core/Mage/Customer/Model/Customer.php

$this->setData('password', $password);

I'm unable to tell if this is passing the pre-hashed password or not, though it does precede setPasswordHash().

Now, I've attempted to test these just to see what I get as a result, but I'm failing to grab anything. I've attempted to extend core/Mage/Customer/Model/Customer.php by doing the following:

config.xml

<config>
<modules>
    <Custommodule_Password>
        <version>1.0.0</version>
    </Custommodule_Password>
</modules>

<global>
    <models>
        <custommodule_password>
            <class>Custommodule_Password_Model</class>
        </custommodule_password>

        <core>
          <rewrite>
            <export>Custommodule_Password_Model_Export</export>
          </rewrite>
        </core>

    </models>       
</global>

Custommodule_Password.xml

<?xml version="1.0"?>
<config>
  <modules>
      <Custommodule_Password>
          <active>true</active>
          <codePool>local</codePool>
          <depends><Mage_Customer/></depends>
      </Custommodule_Password>
  </modules>
</config>

/Custommodule/Password/Model/Export.php

class Customermodule_Password_Model_Export extends Mage_Customer_Model_Customer
{


public function getPassword($password) {
   $email = $this->getData('email');
   $pw = $this->getData('password');
   $customer = Mage::getModel("customer/customer")->loadByEmail($email);
   $customerId = $customer->getId();


}

}

I'll be honest, I'm not even entirely sure if this is the correct way to grab the customer entity or if I'm extending the correct model class.

Any help, suggestions, tips are greatly appreciated.

EDIT This is the config.xml I'm using with an observer:

<config>
<modules>
    <Custommodule_Password>
        <version>1.0.0</version>
    </Custommodule_Password>
</modules>

<global>
    <models>
        <password>
            <class>Custommodule_Password_Model</class>
        </password>         

    </models>

    <events>
        <customer_register_success>
            <observers>
                <custommodule_password>
                    <type>singleton</type>
                    <class>Custommodule_Password_Model_Observer</class>
                    <method>exportPassword</method>
                <custommodule_password>
            </observers>
        </customer_register_success>
    </events>

</global>

However, it doesn't seem like this is hooking onto the event because I'm not getting anything after registering (I'm trying to write to the log and simply echo things to see if it works, but nothing.)

2

Option 1

Its been a while since I've worked on Magento 1 so excuse any mistakes. But to me it looks like your Model rewrite is invalid as current you are overwriting Mage_Core_Model_Export with your custom class which is extending the customer model. I would expect your rewrite to look something like the following (minus the comments i've added).

<global>
    <models>
        ...
        <customer>
          <rewrite>
            <customer>Custommodule_Password_Model_Export</export>
          </rewrite>
        </core>
    </models>       
</global>

Option 2

As far as I remember the event queue in Magento 1 is synchronous. So any request, registry, session variables when the dispatchEvent is called should be available to you. This is beneficial to us since Magento unsets the password variables before dispatching the event.

So if you create an observer on the customer_register_success event and then you should be able to access the password request parameter then.

Implementation

app/etc/Vendor_Module.xml

<?xml version="1.0"?>
<config>
    <modules>
        <Vendor_Module>
            <active>true</active>
            <codePool>local</codePool>
            <depends>
                <Mage_Customer/>
            </depends>
        </Vendor_Module>
    </modules>
</config>

app/code/local/Vendor/Module/etc/config.xml

<?xml version="1.0"?>
<config>
    <modules>
        <Vendor_Module>
            <version>1.0.0</version>
        </Vendor_Module>
    </modules>
    <global>
        <models>
            <vendor_module>
                <class>Vendor_Module_Model</class>
            </vendor_module>
        </models>
        <events>
            <customer_register_success>
                <observers>
                    <vendor_module_register_success_export_data>
                        <type>singleton</type>
                        <class>vendor_module/observer_exportData</class>
                        <method>execute</method>
                    </vendor_module_register_success_export_data>
                </observers>
            </customer_register_success>
        </events>
    </global>
</config>

app/code/local/Vendor/Module/Model/Observer/ExportData.php

<?php

class Vendor_Module_Model_Observer_ExportData
{

    public function execute($observer)
    {
        $request = Mage::app()->getRequest();
        $password = $request->getParam('password');
        $passwordHash = password_hash($password, PASSWORD_BCRYPT);

        $customer = $observer->getEvent()->getCustomer();
        $customerId = $customer->getId();

        file_put_contents('passwordHash.log', "Customer {$customerId} register with the following password hash: {$passwordHash}.".PHP_EOL, FILE_APPEND);
    }

}

Sidenote

Im aware you already know its bad practise to store plain text passwords, especially transferring them between servers.

One alternative i can think of, is during registration validate the provided password against other customers hash while and keep a count of matches. So if it resolves to say 10 other customer hash reject registration etc.

https://github.com/OpenMage/magento-mirror/blob/magento-1.9/app/code/core/Mage/Core/Model/Encryption.php#L127

| improve this answer | |
  • I've tried hooking onto the event (I added code I was using) because I'm more familiar with this route, but it doesn't seem to be triggered upon registration. – taskle Feb 16 at 15:54
  • @taskle I've updated my answer with a example that should work – Sam Feb 16 at 18:30
  • Thanks, I actually don't plan on storing or moving the password in plain text, but I just want a more simplified hash that I can use to compare other passwords with. It seems your answer is being triggered on the event now, but I can't get anything to save to the remote server. So there must be an error in my connection code. – taskle Feb 16 at 18:52
  • Ha, silly me. For some reason I set the column for storing the new hash as INT instead of VARCHAR ... – taskle Feb 16 at 18:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.