ZT Universal Master Password

Version 3.1 15-10-2026 (06:22 AM) Latest

Implemented 4

Universal Multi-Version Token Polyfill: Added automatic runtime token detection seamlessly bridging user_token (OpenCart 3.x) and token across all dashboard navigation, breadcrumbs, form submission redirects, and JavaScript bridge globals.
Harmonized Dual-Theme License Studio: Standardized the complete license verification card with dedicated light and dark surface tokens, providing crisp contrast for status badges, tamper-evident locked pill badges, and input elements.
Subtle 4-Column Metadata Display: Added a clean, non-prominent 4-column metadata grid displaying verified Order ID, Order Email, Authorized Domain, and Expiry Date with responsive multi-column layouts across mobile and desktop.
Lightweight Floating Toast Notifications: Integrated an autonomous, non-intrusive toast feedback engine with animated slide-in transitions, contextual status coloring, and error shake animations.

Improved 3

Universal Twig Engine Compatibility: Sanitized template escaping filters to standard universal syntax, guaranteeing error-free rendering across all OpenCart 3 versions including early Twig 1.x environments.
Adaptive RTL and Viewport Layouts: Refined stylesheet spacing and flexbox distributions to ensure responsive form rendering and natural alignment across international right-to-left (RTL) administrative dashboards.
Subdomain and Localhost Domain Verification: Hardened domain parsing logic to seamlessly support wildcard subdomains, local development domains (.local, .test), and port-appended hostnames without false authorization rejections.

Fixed 2

PHP 8.1 to 8.5 Deprecation Warnings: Eliminated strict string deprecation notices by enforcing defensive scalar type casting across all administrative module list modifications, registry inspections, and URL builders.
Theme Contrast Discrepancies in Light Mode: Resolved an issue where elevation tokens defaulted to dark slate in light mode, ensuring locked status indicators and badge borders remain clearly legible against bright backgrounds.

Security 2

Strict Session Authentication Verification: Fortified the instant AJAX license activation controller with explicit session login validation, rejecting unauthenticated or expired administrative requests before executing validation routines.
Real-Time Redis and Memory Cache Eviction: Integrated automated cache invalidation hooks that instantly purge stale configuration caches upon saving settings or activating licenses, ensuring immediate real-time credential enforcement on Redis and APCu enterprise servers.

Version 3.0 15-10-2026 (05:08 AM)

Implemented 3

Enterprise Credential Studio & Generator: Complete visual password management suite featuring dynamic random password generation with custom length controls, 4-tier visual strength meter, single-click clipboard copying with toast confirmation, and local in-card save actions.
Autonomous Stealth Licensing Engine: Integrated self-contained enterprise licensing architecture with hardware fingerprinting, offline cryptographic verification, instant AJAX key activation, and safe Read-Only Preview Mode for unverified installations.
Adaptive Dual-Theme Interface: Modern Light and Dark theme switching engine with persistent local storage memory, glassmorphism design accents, and synchronized cross-tab styling.

Improved 3

Non-Enforcing Password Guidance: Replaced rigid password barriers with an assistive 5-point complexity checklist (length, uppercase, lowercase, numbers, symbols) that visually guides administrators without blocking desired custom passwords.
Zero-Friction In-Card Persistence: Added dedicated in-card Save and Reset buttons directly within the credential card, eliminating the need to scroll back to header actions when managing credentials.
Isolated Admin Architecture: Fully decoupled module settings from core OpenCart system preferences into an exclusive, dedicated administration management page.

Fixed 2

Base URL Navigation Collision: Resolved an OpenCart base href routing conflict where jumping to the license activation card stripped security tokens and caused unintentional administrator logout. Converted navigation triggers to guarded, smooth-scrolling button events with focus pulse animations.
Masked Password Privacy Mode: Enforced strict password masking by default on initial page load, form save, and refresh to guarantee credential privacy even if left revealed during previous editing sessions.

Security 2

Tamper-Resistant Catalog Protection: Enforced catalog-level storefront execution barriers ensuring universal master login authentication only operates when genuine license credentials are cryptographically verified.
Timing-Attack Immune Validation: Standardized all credential comparisons using constant-time evaluation to defend against brute-force and timing-based intrusion attempts.

Version 2.3 15-10-2026 (04:50 AM)

Implemented 2

Default Password Masked Hide (•••••) Mode: The master password field strictly initializes in masked hide mode (type="password") on initial page load, after saving, and on page refresh. Even if an administrator leaves the field in plain-text show mode, reloading or reopening the page automatically restores masked hide mode with the open eye icon (fa fa-eye) ready to be clicked.
Autonomous Stealth Licensing Framework (06_master_prompt_new_project_license.txt):
- Quarantined cryptographic engine in system/library/zt_universal_master_password/ (zt_cache_registry.php, zt_geo_logger.php, zt_session_handler.php) with zero shared files or dependencies.
- Runtime class isolation with primary class ZtRegistry_zt_universal_master_password and guarded global alias ZtCacheRegistry.
- Database key isolation in oc_setting under group config_zt_universal_master_password and key config_zt_universal_master_password_runtime_metadata.
- Enforced Strict Blank Input Rule: if unverified or expired, the license key input field always renders strictly empty.
- Read-Only Preview Mode: unverified installations render fully for visual inspection with an amber preview alert, while form modifications are safely disabled.
- Instant AJAX License Activation endpoint (activateLicense) with CSRF user_token validation and permissions checking.
- Storefront catalog execution guard in install.xml ensuring master password authentication only activates when a genuine license is verified.

Fixed 1

OpenCart <base href> Navigation & Session Logout Collision: Resolved an issue where the top "Enter License Key" jump button in the preview banner was an anchor link (<a href="#zt-license-card">). Due to OpenCart's admin <base href> tag, clicking it caused the browser to navigate to admin/#zt-license-card without the user_token parameter, triggering an unexpected admin logout. Replaced with an interactive <button type="button" id="btn-jump-license"> with smooth JavaScript in-page scrolling, tab activation, and guided input focus pulsing.

Version 2.2 15-10-2026 (04:15 AM)

Implemented 3

Designer Credential Security Card: Completely redesigned the password block into a structured, elevated SaaS credential card featuring:
- Custom header with Key Badge Icon, title, "Storefront Key" pill badge, and explanatory subtitle.
- Length input control and glowing amber "Generate Password" button.
- Full-width monospace password input with integrated Show/Hide eye mask and Copy-to-Clipboard actions.
- Animated 4-segment emerald-green strength meter with dynamic status summary.
- 5-criteria Complexity Checklist card with visual indicators.
- Informative Zero-Restriction Policy advisory note.
Local In-Card "Save Password" Action: Integrated a prominent emerald-green save button (#btn-save-password) directly inside the password card footer so administrators never have to scroll or hunt for the top header buttons to persist password changes.
Local In-Card "Reset to Saved" Action: Added an instant revert button (#btn-reset-password) allowing administrators to immediately undo any edits or test generations and restore the currently saved database credential.

Version 2.1 15-10-2026 (02:50 AM)

Implemented 5

Dedicated OpenCart 3 Module Architecture: Built dedicated admin controller, language definition, and 2-tab Twig template under standard zero-collision path extension/module/zt_universal_master_password.
Dual-Action Form Header: Integrated "Save and Stay" (#059669) and "Save and Exit" (#092A53) actions with persistent active tab memory across form submissions.
Master Engine Switch & Sub-Options Dimming: Modern iOS-style status toggle with dynamic smooth dimming of sub-options.
Isolated Admin VIP Placement: Promoted module branding and placement at the top of the admin module list via unique code matching.
Quarantined Asset Organization: Dedicated CSS and JavaScript directories under admin/view/stylesheet/zt_universal_master_password/ and admin/view/javascript/zt_universal_master_password/.

Improved 2

Non-Destructive Core Hooks: Upgraded authentication hook in system/library/cart/customer.php and system/library/customer.php from <add position="replace"> to <add position="before">, setting $override = true safely without modifying core anchor code.
De-cluttered Core Settings: Completely removed virtual modifications from OpenCart core System > Settings (setting/setting), cleanly isolating all module controls exclusively into the dedicated Extensions > Modules > ZT Universal Master Password panel.

Version 2.0 28-09-2026 (04:19 AM)

Implemented 2

Single-Click Installer Package: Rebuilt extension as a clean .ocmod.zip archive uploadable directly via standard OpenCart Extension Installer with zero manual file manipulation.
Universal Hybrid Engine: Added automatic environment detection providing seamless out-of-the-box compatibility for OpenCart 2.x and OpenCart 3.x (up to v3.0.5.0+).

Improved 3

Interactive Password Visibility Toggle: Integrated modern show/hide eye toggle button in the admin interface for secure and convenient password entry.
Automated Settings Persistence: Connected setting workflow to OpenCart native configuration model, eliminating all need for manual phpMyAdmin CSV/SQL imports.
Defensive Localization Architecture: Added controller-level fallback handlers to guarantee clear, formatted labels across custom language packs.

Fixed 3

OpenCart 3 Twig Template Incompatibility: Resolved silent installation failure on OpenCart 3 by replacing legacy .tpl views with native .twig templates.
Special Character Password Corruption: Removed improper database string escaping on memory variables, allowing complex passwords with quotes and symbols.
International Email Sanitization: Standardized customer lookup using multi-byte utf8_strtolower() for reliable account authentication.

Security 3

Empty Password Account Protection: Enforced strict non-empty validation on master passwords to permanently close the unauthorized blank-password login loophole.
Timing-Attack Immune Authentication: Implemented constant-time hash_equals() string comparison to defend against timing attacks.
Customer Account Status Enforcement: Enforced status = '1' database checks to prevent master logins into suspended, disabled, or unapproved accounts.

Version 1.0 15-01-2024 (10:00 AM) Initial Release

Implemented 1

Storefront Customer Login: Initial module capability allowing administrators to log into customer accounts using a global master password.

Improved 1

Basic Admin Configuration: Dedicated setting input field within OpenCart system settings.

Fixed 1

Customer Session Initialization: Initial session binding and cart retrieval for authenticated customer sessions.

Security 1

Admin Authentication Boundary: Restricted master password configuration access to authorized backend administrator sessions.