I found an interesting extension for onepagecheckout. It seems to be free but when I installed the extension I realized that the code is sending and encoding data to developer servers. In theory its validating a license value - I don't know why because its free, additionally the site is not telling anything about that hidden value passed to their servers but.. OK. - its free.

Based on the fact that this particular area manages information about credit cards I would like to know which values are they passing. In my research I found that the code send to their servers are in a line called id=opc_s_data with a call to:

public function getSUrl($mode = '') {
    $code = Mage::getStoreConfig('onepagecheckout/sdatacode');
    eval(base64_decode($code));
    if(!isset($url))
        $url = '';
    return $url;
}

and the value sent is something like:

<input type='hidden' id='opc_s_data'
    value='http://company.com/magento/opclicense/opcaction.php?sdata=bWFEuN......=='/

Does anyone know what can I do to decode the information sent to my application from their servers? If I erase this hidden ID the onepagecheckout doesn't work.

Disclaimer: I wrote to the developer but I never received a response.

up vote 15 down vote accepted

First of all I want to say that this is an ugly way of doing things. Most probably the ugliest. If you didn't want to add the company name in here I will. It's interiorwebdesign.com. Most probably the things sent to their server are the magento version, the extension version and the url of your website. You can check for sure by doing base64_decode on the value of the sdata parameter sent to them. I don't know what the answer should be if your licence is correct, but in case there is an error this is the response:

checkout.o_p_c_l_s = '2';
deljsphp();

Look in the code for a function called deljsphp. I think that disables your checkout.

[EDIT]
Because I get mad when I see these types of extensions I decided to waste some time for investigating.
Here is what I found. The result of the request should be a link to a js file or some js code on their server. After decoding the js file from the extension I found this function:

start: function () {
    this.s_code = $('opc_s_data').value;
    $('opc_s_data').remove();
    if (this.s_code == '') {
        this.opcdis();
        return false
    }
    addjsphp(this.s_code);
    this.getActionResults(0)
},

so if the code 'license' is valid some js is added to the DOM through addjsphp that looks like this:

function addjsphp(u) {
    var me = document.createElement('div');
    me.setAttribute('id', 'opcstataj');
    var p = 'html';
    var th1 = document.getElementsByTagName(p)[0];
    th1.appendChild(me);
    var th = document.getElementById('opcstataj');
    var s = document.createElement('script');
    s.setAttribute('language', 'javascript');
    s.setAttribute('type', 'text/javascript');
    s.setAttribute('src', u);
    th.appendChild(s)
}

I don't know (yet) how the js from their server should look like, but here is what you can try. Not sure if it works. Edit the js file skin\frontend\base\default\js\onepagecheckout.pack.js and at the end of the file add this:

function deljsphp(){
    return 1;
}

This should override the original deljsphp function, that by the way looks like this:

function deljsphp() {
    var th = $('opcstataj');
    if (th && th != null && th != undefined) th.remove()
}

Basically it removes the <script> tag added from their server.

Other info The code that is being eval'd in the the line you mentioned in the question is this:

eval(gzinflate(base64_decode('jZAxb8MgEIXn+FfQCBl7qL1UHRLRDFGkLlWjOM0SVRHBV4NqwIKLqqrKfy84S9MuXeDgcd97BzWiI5xQVDrcPnSAT6IDi24HPmhni3KeUePaqyfP6+VPWV2Jy5Nv0Hl48X1UJ5OMhqhPow3/onE95xGXSteec2WFgXhQ51xIjEAuFcj3aaS2AkVsPIoA93cHsNK1UNAwGiZicQNmwM+CHprVZrfa7Nnjdrtu2GtJ8pz8ueWcM2dZuWAKcQhsNu4s0k6+TwOoULFZXWuL4LXzH3BsIejOVtKZ2lw+pXaD7LUEGyCVl8jVoIZFSHE5q8bY80y/FWlAIJwThhCQlb+NeidFr1zA/0K/AQ==')));

Going further...this is the code that actually gets evaluated:

$mag = $this->getMagentoVersion(); 
$mod = $this->getOPCVersion(); 
$h = $this->getCurStoreUrl(); 
$s = "mag={$mag}&mod={$mod}&hname={$h}&action=check"; 
$data = base64_encode($s); 
$hs = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS']==='on')?'https':'http'; 
$url = $hs.'://interiorwebdesign.com/magento/opclicense/opcaction.php?sdata='.$data; 
if($mode == 'test') 
    $url = $hs.'://localhost/opclicense/opcaction.php?sdata='.$data;

This confirms my initial suspicions on what is sent to their servers.

  • thank you so much @Marius . great analysis, i will check in my code. i avoid to put their name because its their choice, the part that i found ugly is that they are not telling people about this information transacted and for people like me not very skilled in coding, its confusing. once again thank you so much.! – s_h Sep 25 '13 at 19:24
  • additionally, that free extension is not granting a license to validate. no place in the code request to put a license.. brgds – s_h Sep 25 '13 at 19:28
  • Are you sure the base64-String cannot be updated remotely? Because last time I checked the code I saw something like this. – giraff Jun 7 '14 at 7:23
  • @giraff. Actually I'm not sure, but I wrote what I found – Marius Jun 7 '14 at 9:26
  • Hi to all, in recent versions of this module, do we have the same "malicious" code? – Simbus82 May 13 '15 at 9:15

Marius, Thanks for the investigation. I too, highly dislike and discourage magento module creators to ads these type of "phone home calls" to their extensions. They should be exposed and eradicated.

To disable the phone home call, and keep your onepagecheckout extension working (yes, they can disable it) do the following.

Copy the file /skin/frontend/base/default/js/onepagecheckout.pack.js to your theme folder/js/onepagecheckout.pack.js and beautify the code using a site like: http://jsbeautifier.org/

Now around line:244 in the start method You'll see

addjsphp(this.s_code);
this.getActionResults(0)

change it to

//addjsphp(this.s_code);
//this.getActionResults(0)

This will stop the script from always phoning home to their slow website, and will stop it from action on the code results

This should work, but test it before you roll it out. It is your checkout after all

  • Thanks for the beautifuler. I needed to change a lot of JS in this script to personalize the page, and was really stuck by the pack thing. – hellimac Dec 30 '15 at 3:47

I would like to say that this regular code was just about to collect information on what version was used by our clients. No other information was collected.

We also have removed that since version 3, which was released like about 1.5 years ago. So, if you use version 2 still, it's time for you to upgrade to version 4.x

  • thanks for your comment. it was weird to find that code in the payment area. I asked this question almost two years ago. – s_h Jun 4 '15 at 5:57

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.