Secure Ajax Call

[CXM_Julien]

Hello,

 

in my admin module i am calling a PHP file with some ajax to change some prices in the database but anyone can run this script from outside so my question is, how can i secure the ajax call? i found some thing related to tokens and secure_key but i did not get it at all...

[garciasanchezdani]

Hi, in the file which receives the ajax call, you should check if the current user (connected user) has the administrator privileges... ( or the privileges to change the prices of the products )

 

Regards,

Edited November 23, 2015 by garciasanchezdani (see edit history)

[CXM_Julien]

Thank you but where can i get these informations? There is almost no documentations for Prestashop (maybe i don't know where to find it also)

[CXM_Julien]

Found a way of checking if the current user has the administrator privileges by doing this

	include_once('../../config/config.inc.php');
	include_once('../../config/settings.inc.php');
	include_once('../../classes/Cookie.php');

	$cookie = new Cookie('psAdmin');
	
	if ($cookie->profile != 1) {
		die();
	}

Is that really secure?