2

I have imported 30,000 customers from a previous system into a new Magento installation using a custom script. I want to make it so that when a user tries to log in on the new website Magento will check to see if they have logged in before and then if not, take them to a new static page with directions on how to retrieve their password. I have looked through the Customer AccountController.php file in the Magento Core which I believe is where this needs to be implemented. Here is the source for login authentication: 

public function loginPostAction()
{
    if (!$this->_validateFormKey()) {
        $this->_redirect('*/*/');
        return;
    }

    if ($this->_getSession()->isLoggedIn()) {
        $this->_redirect('*/*/');
        return;
    }
    $session = $this->_getSession();

    if ($this->getRequest()->isPost()) {
        $login = $this->getRequest()->getPost('login');
        if (!empty($login['username']) && !empty($login['password'])) {
            try {
                $session->login($login['username'], $login['password']);
                if ($session->getCustomer()->getIsJustConfirmed()) {
                    $this->_welcomeCustomer($session->getCustomer(), true);
                }
            } catch (Mage_Core_Exception $e) {
                switch ($e->getCode()) {
                    case Mage_Customer_Model_Customer::EXCEPTION_EMAIL_NOT_CONFIRMED:
                        $value = $this->_getHelper('customer')->getEmailConfirmationUrl($login['username']);
                        $message = $this->_getHelper('customer')->__('This account is not confirmed. <a href="%s">Click here</a> to resend confirmation email.', $value);
                        break;
                    case Mage_Customer_Model_Customer::EXCEPTION_INVALID_EMAIL_OR_PASSWORD:
                        //added code to allow reset if customer is imported from netsuite. 


                        $message = $e->getMessage();
                        break;
                    default:
                        $message = $e->getMessage();
                }
                $session->addError($message);
                $session->setUsername($login['username']);
            } catch (Exception $e) {
                // Mage::logException($e); // PA DSS violation: this exception log can disclose customer password
            }
        } else {
            $session->addError($this->__('Login and password are required.'));
        }
    }

    $this->_loginPostRedirect();
}

/**
 * Define target URL and redirect customer after logging in
 */
protected function _loginPostRedirect()
{
    $session = $this->_getSession();

    if (!$session->getBeforeAuthUrl() || $session->getBeforeAuthUrl() == Mage::getBaseUrl()) {
        // Set default URL to redirect customer to
        $session->setBeforeAuthUrl($this->_getHelper('customer')->getAccountUrl());
        // Redirect customer to the last page visited after logging in
        if ($session->isLoggedIn()) {
            if (!Mage::getStoreConfigFlag(
                Mage_Customer_Helper_Data::XML_PATH_CUSTOMER_STARTUP_REDIRECT_TO_DASHBOARD
            )) {
                $referer = $this->getRequest()->getParam(Mage_Customer_Helper_Data::REFERER_QUERY_PARAM_NAME);
                if ($referer) {
                    // Rebuild referer URL to handle the case when SID was changed
                    $referer = $this->_getModel('core/url')
                        ->getRebuiltUrl( $this->_getHelper('core')->urlDecodeAndEscape($referer));
                    if ($this->_isUrlInternal($referer)) {
                        $session->setBeforeAuthUrl($referer);
                    }
                }
            } else if ($session->getAfterAuthUrl()) {
                $session->setBeforeAuthUrl($session->getAfterAuthUrl(true));
            }
        } else {
            $session->setBeforeAuthUrl( $this->_getHelper('customer')->getLoginUrl());
        }
    } else if ($session->getBeforeAuthUrl() ==  $this->_getHelper('customer')->getLogoutUrl()) {
        $session->setBeforeAuthUrl( $this->_getHelper('customer')->getDashboardUrl());
    } else {
        if (!$session->getAfterAuthUrl()) {
            $session->setAfterAuthUrl($session->getBeforeAuthUrl());
        }
        if ($session->isLoggedIn()) {
            $session->setBeforeAuthUrl($session->getAfterAuthUrl(true));
        }
    }
    $this->_redirectUrl($session->getBeforeAuthUrl(true));
}

Now I am wondering how to actually check if they have logged in before when the login fails in Exception "EXCEPTION_INVALID_EMAIL_OR_PASSWORD" if it fails there then I want to check for previous login, if there is one we do nothing but behave normally. If the customer has never logged in then we should redirect them to a static page. Any ideas on how to go about this?

Improve this question
2
  • You could add a 'flag'-attribute/database column to the customer, which you set to 1 if a login succeeds?
    – Maikel Koek
    Mar 19, 2015 at 16:33
  • I don't mind adding an additional attribute to the customers, but I need to know how to actually check that attribute here.
    – Tanner Ewing
    Mar 19, 2015 at 16:43

2 Answers 2

Reset to default
1

You can put customers in a new customergroup Not logged In. This way you can easily check if the customer is logged in before.

After password change, update customer group and presto. Side affect is that it will be clearly visible in Magento backend.

Improve this answer
0

I maybe have a workaround for you.

Not a way to detect if the xustomer already logged in your new website, but should work for what you want.

--

The idea is to set the same password hash to all the imported customers NEED_PASSWORD_RESET. You maybe need to reimport or to update the database for that.

Then, you rewrite the customer model authenticate method like that

const EXCEPTION_NEED_PASSWORD_RESET = 5;
public function authenticate($login, $password)
{
    $this->loadByEmail($login);
    if ($this->getConfirmation() && $this->isConfirmationRequired()) {
        throw Mage::exception('Mage_Core', Mage::helper('customer')->__('This account is not confirmed.'),
            self::EXCEPTION_EMAIL_NOT_CONFIRMED
        );
    }
    if ($this->getPasswordHash() == "NEED_PASSWORD_RESET") {
        throw Mage::exception('Mage_Core', Mage::helper('customer')->__('Need password reset.'),
                self::EXCEPTION_NEED_PASSWORD_RESET
        );
    }
    if (!$this->validatePassword($password)) {
        throw Mage::exception('Mage_Core', Mage::helper('customer')->__('Invalid login or password.'),
            self::EXCEPTION_INVALID_EMAIL_OR_PASSWORD
        );
    }
    Mage::dispatchEvent('customer_customer_authenticated', array(
       'model'    => $this,
       'password' => $password,
    ));

    return true;
}

If the password hash load from the DB is exactly NEED_PASSWORD_RESET, the method will throw a new exception EXCEPTION_NEED_PASSWORD_RESET

Now, in a rewrite of the AccountController, you can check and treat this error code

public function loginPostAction()
{
    if (!$this->_validateFormKey()) {
        $this->_redirect('*/*/');
        return;
    }

    if ($this->_getSession()->isLoggedIn()) {
        $this->_redirect('*/*/');
        return;
    }
    $session = $this->_getSession();

    if ($this->getRequest()->isPost()) {
        $login = $this->getRequest()->getPost('login');
        if (!empty($login['username']) && !empty($login['password'])) {
            try {
                $session->login($login['username'], $login['password']);
                if ($session->getCustomer()->getIsJustConfirmed()) {
                    $this->_welcomeCustomer($session->getCustomer(), true);
                }
            } catch (Mage_Core_Exception $e) {
                switch ($e->getCode()) {
                    case Mage_Customer_Model_Customer::EXCEPTION_EMAIL_NOT_CONFIRMED:
                        $value = $this->_getHelper('customer')->getEmailConfirmationUrl($login['username']);
                        $message = $this->_getHelper('customer')->__('This account is not confirmed. <a href="%s">Click here</a> to resend confirmation email.', $value);
                        break;
                    case Mage_Customer_Model_Customer::EXCEPTION_INVALID_EMAIL_OR_PASSWORD:
                        $message = $e->getMessage();
                        break;
                    default:
                    case Mage_Customer_Model_Customer::EXCEPTION_NEED_PASSWORD_RESET:
                            // your code here
                            Mage::log('your code here');
                            $message = ''; // to avoid errors of undefined variable
                            break;
                        default:
                        $message = $e->getMessage();
                }
                $session->addError($message);
                $session->setUsername($login['username']);
            } catch (Exception $e) {
                // Mage::logException($e); // PA DSS violation: this exception log can disclose customer password
            }
        } else {
            $session->addError($this->__('Login and password are required.'));
        }
    }

    $this->_loginPostRedirect();
}

This works until the customer saves a new password

Improve this answer
2
  • Is it secure to assign the same password to all users? I have already assigned them all really long random passwords so no two customers have the same. Is it safe to assign them all the same?
    – Tanner Ewing
    Mar 19, 2015 at 20:56
  • You have different passwords, but as I understand it, these passwords won't be used, because if the customer logged in for the first time, he have to change his password.
    – Pilou
    Mar 20, 2015 at 9:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.