Introduction

Overview

WordPress is a great platform but for storing sensitive information it is not the most secure platform.

In some circumstances you may want to ask your customers for sensitive information (such as usernames & passwords) and this data is probably best not stored in your WordPress database.

If a hacker gains access to your site via a theme / plugin exploit then they will have access to your database and be able to view all your data.

For that reason we added secure fields to the FAST ticket plugin. These fields are not stored in the WordPress DB but are instead sent to a WordPress hook where you can send this data to be stored elsewhere.

In this example we will show you how to set up a simple API that receives this data and stores it in a MySQL database. Your agents can then log into this more secure site to access the data if they need it.

Requirements

  • Web server (Linux recommended)
  • PHP (7.0+ recommended)
  • MySQL (5.6+ recommended)

How it works

We will now walk you through how Secure fields on tickets works.

  • User creates a ticket and enters some secure information

How

  • Fast Plugin calls fast_filter_save_secure_fields filter with secure field values
  • Fast Secure Fields Plugin adds a hook that takes values from fast_filter_save_secure_fields filter and makes a POST request to secure API
  • Secure API saves the values in a MySQL database
  • Agent logs in and views ticket, notices that the ticket has login information

How

  • Agent clicks view link which takes him to the external landing page of the api.

How

  • The ticket field is auto filled in, but agent must log in to get access to the data
  • Agent can now access the secure data, there are handy copy buttons to copy info to clipboard and url fields are automatically turned into links.

How

Files

Inside the fast-secure-fields-example.zip you will find the followin files and folders

Folder / File Description
docs/ The docs your are looking at now
fast-secure-fields-example-plugin.zip Secure fields plugin that adds a hook that will send ticket secure fields to the API
secure-api.zip The PHP API used to store secure data

Setting up the API

Web Server

You will need a PHP MySQL enabled server, we would recommend Digital Ocean for this.

Useful links

You will need to set up Apache or NGINX, PHP and MySQL on your new webserver.

Setup LAMP stack

How to set up MySQL in Ubuntu

MySQL Setup

Once you have your server up and running log in and create a database, this is easier if you have a GUI like PHPMyAdmin but it can also be done easily from the command line.

Create Database

mysql -u username -p
*enter password*
create database secure;

Create Database Tables

Then there is a handy sql dump file in the zip called database.sql you can use this to create the 2 tables the API needs with this command.

mysql -u username -p secure < database.sql

Add a user to the database

Create a SHA512 of the users password here.

Login to mysql and insert the user

    mysql -u username -p secure
    INSERT INTO `users` (`id`, `username`, `password`, `login_count`) VALUES (NULL, 'morris', 'd404559f602eab6fd602ac7680dacbfaadd13630335e951f097af3900e9de176b6db28512f2e000b9d04fba5133e8b1c6e8df59db3a8ab9d60be4b97cc9e81db', '0')

API Setup

Here is how you can set up the PHP API and agent access page.

Upload PHP files

Upload the contents of the secure-api.zip file into your web server root (/var/www on Ubuntu)

Install dependencies

Type the following command from the root of your secure-api installation folder:

composer install

You will need to have Composer installed on your machine.

Configure Fields

Edit config.php file to make sure the API can connect to your new database.

    define('FAST_SECURE_DATABASE_TYPE', 'mysql');
    define('FAST_SECURE_DATABASE_NAME', 'secure-api');
    define('FAST_SECURE_DATABASE_SERVER', '127.0.0.1');
    define('FAST_SECURE_DATABASE_USERNAME', 'root');
    define('FAST_SECURE_DATABASE_PASSWORD', 'root');
    define('FAST_SECURE_MAX_LOGIN_ATTEMPTS', 3);
    define('FAST_SECURE_ENCRYPTION', 'sha512');
    define('FAST_SECURE_TOKEN', 'wUSEfkjcXNuJT82kcyuQ7x53qLcTnPV5QvK3Kfzp5Yu4ZwxrLAKc9PQn3aX7E8kGqBfJjF4YwMx67yUPytJLmZbnCtBE7KJNGVaECs3JvgEgWJf8zgaXDHgdjkLJxZ');
  • FAST_SECURE_DATABASE_TYPE: Type of DB you want to connect to
  • FAST_SECURE_DATABASE_NAME: Name of DB
  • FAST_SECURE_DATABASE_SERVER: URL of server
  • FAST_SECURE_DATABASE_USERNAME: Username to log in with
  • FAST_SECURE_DATABASE_PASSWORD: Password to log in with
  • FAST_SECURE_MAX_LOGIN_ATTEMPTS: Max number of login attempts before user is locked
  • FAST_SECURE_ENCRYPTION: Encryption used to store passwords in DB
  • FAST_SECURE_TOKEN: Bearer token needed to authenticate requests

You should only need to change the database name user and password to match the DB you set up in the previous step.

Once the site is up and running you should see a site that looks like this at the root

API

API web server setup

You should also configure your Apache / NGinx server to point to the /api/index.php file.

See slim guide for instructions on how to configure the API.

Once you have the API set up you should be able to POST to it using the following endpoint.

mysite.com/api/fields

You will need to include the following Authentication header

Authorization: Bearer wUSEfkjcXNuJT82kcyuQ7x53qLcTnPV5QvK3Kfzp5Yu4ZwxrLAKc9PQn3aX7E8kGqBfJjF4YwMx67yUPytJLmZbnCtBE7KJNGVaECs3JvgEgWJf8zgaXDHgdjkLJxZ

The bearer token will need to match with the FAST_SECURE_TOKEN define in the config.php file.

This is already done for you by the Fast Secure Fields Plugin which is also included and instructions are detailed below.

Setting up the FAST Secure Fields Plugin

Installing the plugin

You will need to install the plugin fast-secure-fields-example-plugin.zip

  • Log in to your WordPress admin panel
  • Click on the Plugins menu item on the left side menu
  • Click Add New

  • At the top of the page you will see an Upload Plugin button, click that

  • Next click Choose file button in the box that appears below

  • Select the fast-secure-fields-example-plugin.zip file you downloaded from CodeCanyon

  • When the zip file has finished uploading click the Activate Plugin button

  • That's all. You will now see a new Fast Secure Fields menu in your admin panel.

Configure the plugin

There are only 2 settings you need to configure in the plugin.

  • Secure Server URL: The url that points to your API endpoint.
  • Secure Server Bearer Token: The bearer token set in your config.php file.

Fast

After that all this plugin does is takes the secure fields data from your plugin and passes it on to your API.

Setting up FAST secure fields

Create secure fields

Create some secure fields to store in your API.

  • Log into WordPress
  • Goto Fast Support -> Extra Fields option page
  • Click the edit fields button on the secure fields table

Fast

  • Click the secure fields tab and add some fields

Fast

  • Click the save icon in the top bar

Enable secure fields

  • Log into WordPress
  • Goto Fast Support -> Extra Fields option page
  • Turn the Enable Secure Fields to on
  • Enter the link to your API that you set up above

Fast

  • Click save changes

After that your secure fields should show up when new users create a ticket.