Skip to content

Commit 746ccfa

Browse files
yoshdogyoshdog
committed
Resolve security vulnerability with Synchronize Customers feature
All customers are requested to download and instal this release the extension.
1 parent 564e238 commit 746ccfa

File tree

4 files changed

+32
-148
lines changed

4 files changed

+32
-148
lines changed

‎src/app/code/community/Zendesk/Zendesk/Helper/Sync.php

Lines changed: 13 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,14 @@
22

33
class Zendesk_Zendesk_Helper_Sync extends Mage_Core_Helper_Abstract {
44

5-
public function getCustomerData($customer){
5+
public function syncCustomer($customer){
66
if(!Mage::getStoreConfig('zendesk/general/customer_sync'))
77
return;
88

99
$user = null;
10-
$email = $customer->getEmail();
11-
$origEmail = $customer->getOrigData();
12-
$origEmail = $origEmail['email'];
10+
$currentEmail = $customer->getEmail();
11+
$previousCustomerData = $customer->getOrigData();
12+
$previousEmail = $previousCustomerData['email'];
1313
//Get Customer Group
1414
$groupId = $customer->getGroupId();
1515
$group = Mage::getModel('customer/group')->load($groupId);
@@ -48,7 +48,7 @@ public function getCustomerData($customer){
4848

4949
$info['user'] = array(
5050
"name" => $customer->getFirstname() . " " . $customer->getLastname(),
51-
"email" => $email,
51+
"email" => $currentEmail,
5252
"user_fields" => array(
5353
"group" => $group->getCode(),
5454
"name" => $customer->getFirstname() . " " . $customer->getLastname(),
@@ -59,36 +59,20 @@ public function getCustomerData($customer){
5959
)
6060
);
6161

62-
if($origEmail && $origEmail !== $email) {
63-
$user = Mage::getModel('zendesk/api_users')->find($origEmail);
64-
65-
if(isset($user['id'])) {
66-
$data['identity'] = array(
67-
'type' => 'email',
68-
'value' => $email,
69-
'verified' => true
70-
);
71-
$identity = Mage::getModel('zendesk/api_users')->addIdentity($user['id'],$data);
72-
if(isset($identity['id'])) {
73-
Mage::getModel('zendesk/api_users')->setPrimaryIdentity($user['id'], $identity['id']);
74-
}
62+
$user = Mage::getModel('zendesk/api_users')->find($currentEmail);
63+
if($previousEmail !== $currentEmail) {
64+
if(!isset($user['id'])) {
65+
$user = $this->createAccount($info);
7566
}
7667
}
77-
if(!$user) {
78-
$user = Mage::getModel('zendesk/api_users')->find($email);
79-
}
8068

81-
if(isset($user['id'])) {
82-
$this->syncData($info);
83-
} else {
84-
$info['user']['verified'] = true;
85-
$user = Mage::getModel('zendesk/api_users')->create($info);
86-
}
8769
return $user;
8870
}
8971

90-
private function syncData($info)
72+
private function createAccount($data)
9173
{
92-
Mage::getModel('zendesk/api_users')->create($info);
74+
$data['user']['verified'] = false;
75+
$user = Mage::getModel('zendesk/api_users')->create($data);
76+
return $user;
9377
}
9478
}

‎src/app/code/community/Zendesk/Zendesk/Model/Api/Users.php

Lines changed: 13 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -55,70 +55,64 @@ public function all()
5555
{
5656
$page = 1;
5757
$users = array();
58-
58+
5959
while($page && $response = $this->_call('users.json?page=' . $page)) {
6060
$users = array_merge($users, $response['users']);
6161
$page = is_null($response['next_page']) ? 0 : $page + 1;
6262
}
63-
63+
6464
return $users;
6565
}
66-
66+
6767
public function end($id)
6868
{
6969
if(!Zend_Validate::is($id, 'NotEmpty')) {
7070
throw new InvalidArgumentException('No ID value provided');
7171
}
72-
72+
7373
$response = $this->_call('end_users/'. $id .'.json');
74-
74+
7575
return (isset($response['user']) ? $response['user'] : null);
7676
}
77-
77+
7878
public function getIdentities($id)
7979
{
8080
$response = $this->_call('users/' . $id . '/identities.json');
8181
return (isset($response['identities']) ? $response['identities'] : null);
8282
}
83-
84-
public function setPrimaryIdentity($user_id, $identity_id)
85-
{
86-
$response = $this->_call('users/' . $user_id . '/identities/'.$identity_id.'/make_primary.json', null, 'PUT', null, true);
87-
return (isset($response['identities']) ? $response['identities'] : null);
88-
}
89-
83+
9084
public function addIdentity($user_id, $data)
9185
{
9286
$response = $this->_call('users/' . $user_id . '/identities.json', null, 'POST', $data, true);
9387
return (isset($response['identity']) ? $response['identity'] : null);
9488
}
95-
89+
9690
public function update($user_id, $user)
9791
{
9892
$response = $this->_call('users/' . $user_id . '.json', null, 'PUT', $user, true);
9993
return (isset($response['user']) ? $response['user'] : null);
10094
}
101-
95+
10296
public function create($user)
10397
{
10498
$response = $this->_call('users.json', null, 'POST', $user, true);
10599
return (isset($response['user']) ? $response['user'] : null);
106100
}
107-
101+
108102
public function createUserField($field)
109103
{
110104
$response = $this->_call('user_fields.json', null, 'POST', $field, true);
111105

112106
if(!isset($response['user_field'])) {
113107
throw new Exception('No User Field specified.');
114108
}
115-
109+
116110
return $response['user_field'];
117111
}
118112

119113
/**
120114
* Fetch all user fields
121-
*
115+
*
122116
* @return array $userFields
123117
*/
124118
public function getUserFields()
@@ -129,7 +123,7 @@ public function getUserFields()
129123
$userFields = array_merge($userFields, $response['user_fields']);
130124
$page = is_null($response['next_page']) ? 0 : $page + 1;
131125
}
132-
126+
133127
return $userFields;
134128
}
135129
}

‎src/app/code/community/Zendesk/Zendesk/Model/Customer.php

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ public function syncronize(){
1414
Mage::log('Synchronization started', null, 'zendesk.log');
1515
try {
1616
Mage::log('Synchronizing customer with id '.$customer->getId(), null, 'zendesk.log');
17-
$customerData = Mage::helper('zendesk/sync')->getCustomerData($customer);
17+
$customerData = Mage::helper('zendesk/sync')->syncCustomer($customer);
1818
$zendeskId = $customerData['id'];
1919
$customer->setZendeskId($zendeskId);
2020
$customer->save();
@@ -25,8 +25,6 @@ public function syncronize(){
2525
return;
2626
}
2727
Mage::log('Synchronization completed successfully', null, 'zendesk.log');
28-
29-
3028
}
3129
}
3230
}

‎src/app/code/community/Zendesk/Zendesk/Model/Observer.php

Lines changed: 5 additions & 97 deletions
Original file line numberDiff line numberDiff line change
@@ -104,110 +104,18 @@ public function addTicketButton(Varien_Event_Observer $event)
104104
));
105105
}
106106
}
107-
107+
108108
public function changeIdentity(Varien_Event_Observer $event)
109109
{
110-
if(!Mage::getStoreConfig('zendesk/general/customer_sync'))
111-
return;
112-
113-
$user = null;
114110
$customer = $event->getCustomer();
115-
$email = $customer->getEmail();
116-
$orig_email = $customer->getOrigData();
117-
$orig_email = $orig_email['email'];
118-
119-
//Get Customer Group
120-
$group_id = $customer->getGroupId();
121-
$group = Mage::getModel('customer/group')->load($group_id);
122-
123-
//Get Customer Last Login Date
124-
$log_customer = Mage::getModel('log/customer')->loadByCustomer($customer);
125-
if ($log_customer->getLoginAt())
126-
$logged_in = date("Y-m-d\TH:i:s\Z",strtotime($log_customer->getLoginAt()));
127-
else
128-
$logged_in = "";
129-
130-
//Get Customer Sales Statistics
131-
$order_totals = Mage::getResourceModel('sales/order_collection');
132-
$lifetime_sale = 0;
133-
$average_sale = 0;
134-
135-
if (is_object($order_totals)) {
136-
$order_totals
137-
->addFieldToFilter('customer_id', $customer->getId())
138-
->addFieldToFilter('status', Mage_Sales_Model_Order::STATE_COMPLETE);
139-
140-
$order_totals->getSelect()
141-
->reset(Zend_Db_Select::COLUMNS)
142-
->columns(new Zend_Db_Expr("SUM(grand_total) as total"))
143-
->columns(new Zend_Db_Expr("AVG(grand_total) as avg_total"))
144-
->group('customer_id');
145-
146-
if (count($order_totals) > 0) {
147-
$sum = (float) $order_totals->getFirstItem()->getTotal();
148-
$avg = (float) $order_totals->getFirstItem()->getAvgTotal();
149-
150-
$lifetime_sale = Mage::helper('core')->currency($sum, true, false);
151-
$average_sale = Mage::helper('core')->currency($avg, true, false);
152-
}
153-
}
154-
155-
$info['user'] = array(
156-
"name" => $customer->getFirstname() . " " . $customer->getLastname(),
157-
"email" => $email,
158-
"user_fields" => array(
159-
"group" => $group->getCode(),
160-
"name" => $customer->getFirstname() . " " . $customer->getLastname(),
161-
"id" => $customer->getId(),
162-
"logged_in" => $logged_in,
163-
"average_sale" => $average_sale,
164-
"lifetime_sale" => $lifetime_sale
165-
)
166-
);
167-
168-
if($orig_email && $orig_email !== $email) {
169-
$user = Mage::getModel('zendesk/api_users')->find($orig_email);
170-
171-
if(isset($user['id'])) {
172-
$data['identity'] = array(
173-
'type' => 'email',
174-
'value' => $email,
175-
'verified' => true
176-
);
177-
$identity = Mage::getModel('zendesk/api_users')->addIdentity($user['id'],$data);
178-
if(isset($identity['id'])) {
179-
Mage::getModel('zendesk/api_users')->setPrimaryIdentity($user['id'], $identity['id']);
180-
}
181-
}
182-
}
183-
184-
if(!$user) {
185-
$user = Mage::getModel('zendesk/api_users')->find($email);
186-
}
187-
188-
if(isset($user['id'])) {
189-
$this->syncData($user['id'], $info);
190-
} else {
191-
$info['user']['verified'] = true;
192-
$this->createAccount($info);
193-
}
194-
}
195-
196-
public function syncData($user_id, $data)
197-
{
198-
Mage::getModel('zendesk/api_users')->update($user_id, $data);
111+
Mage::helper('zendesk/sync')->syncCustomer($customer);
199112
}
200-
201-
public function createAccount($data)
202-
{
203-
Mage::getModel('zendesk/api_users')->create($data);
204-
}
205-
113+
206114
public function checkSsoRedirect($user)
207115
{
208116
if (
209-
Mage::helper('zendesk')->isSSOAdminUsersEnabled() &&
210-
Mage::app()->getRequest()->getControllerName() === 'zendesk' &&
117+
Mage::helper('zendesk')->isSSOAdminUsersEnabled() &&
118+
Mage::app()->getRequest()->getControllerName() === 'zendesk' &&
211119
Mage::app()->getRequest()->getActionName() === 'authenticate'
212120
) {
213121
Mage::app()->getResponse()

0 commit comments

Comments
 (0)