sexta-feira, dezembro 11, 2015

The answer is that your theme does not supply a variable called form_key.

Just as stated above I have to add:

<input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->getFormKey(); ?>" />

<input type="hidden" name="form_key" value="<?php echo Mage::getSingleton('core/session')->getFormKey(); ?>" />

you add it right after <ul class="form-list">

to each one of my login.phtml files for the theme.

You may also have problems with update quantity of cart items

Take a look at http://iamvikram.com/magento-form-keys-in-version-1-8/ for more information

Here is the importance of form_keys:

Since the beginning of time, Magento's backend contained a form key that protected against XSS attacks [1]. With Magento 1.8 the form key has entered the frontend for pretty much the same reason: to protect against form submission from another website, using your browser. a malicious attacker can add stuff to your cart while you're in a different browser tab or even complete an order for you. This relies on predictable URLs, because the site will not have access to the actual HTML content in the browser tab where you have your Magento order waiting. Everything sent to the Magento store will however submit your cookies and thus use your session.

By adding a unique key to each form or to each link that generates an action on the server, the URL or form content becomes no longer predictable. The form key is stored in the session data and validated upon submission to the server. If they don't match, you get a form key error and the action is not completed.

Script to reset all customer passwords in Magento

Script to reset all customer passwords in Magento

Script to reset all customer passwords in Magento

The following script was created to reset all customer passwords in a Magento store. It creates the new password from the first 3 characters of the customer’s current e-mail address, and a random 3 digit number. The total password length is 6 characters, but it can easily be modified. It also stores all the passwords to a tab-delimited file, this way you can refer to it later. All of this is just subjective, so you will want to tailor it to suit your exact needs.

For obvious security reasons, you will want to remove this script after you use it, or at the very least put it in a protected directory of some kind.

<?php
/************************ * / '_ __/_ _/_
* ()()/(-( /( ()(/(-
* _/
* since 2007
*
* Created by Foundco
* All rights reserved unless otherwise specified under contract.
* http://www.foundco.com/
* @author Christopher Hogan <mailing address removed>
* @copyright 2012 and beyond.
******************************/

error_reporting(E_ALL | E_STRICT);
$mageFilename = 'app/Mage.php';
if (!file_exists($mageFilename)) {
echo $mageFilename." was not found";
exit;
}
require_once $mageFilename;
Varien_Profiler::enable();
Mage::setIsDeveloperMode(true);
ini_set('display_errors', 1);
umask(0);
Mage::app();

$passwordLength = 10;

/****
If you are just resetting one customer by customer_id:
****/

//$customer_id = 10;
//$customers = Mage::getModel('customer/customer')->getCollection()->addAttributeToFilter('entity_id', array('eq' => $customer_id));

/****
If you are resetting all customers:
****/

$customer_id = 10;
$customers = Mage::getModel('customer/customer')->getCollection();

/****
Now loop through the customers and create the passwords
****/

foreach ($customers as $customer){
// $customer->generatePassword($passwordLength)
// $customer->sendNewAccountEmail();
$password = strtoupper(substr( $customer->getEmail(), 0, 3)).rand(111,999);
$customer->setPassword($password)->save();
$line_data = $customer->getEmail(). "\t". $customer->getPassword();
$line[] = $line_data;
echo $line_data."\n";
}
$content = implode("\n", $line);

// store all the passwords to a file:
file_put_contents('./accounts.csv', $content);
echo "COMPLETE!";
?>

segunda-feira, dezembro 07, 2015