licence manager for woocommerce

  • Resolved japac

    (@japac)


    6 years, 3 months ago

    I started using the woocommerce license manager from you. and the plugin is really great. offers what you need in terms of product licensing. it is light, fast and intuitive. and contains what I really need.
    but there was a problem. an IT specialist who knows this better wrote to me that the plug has a hole that allows unauthorized viewing of generated keys.
    it’s a message from him:

    I’m using LMFWC, I have generated API keys for the plugin, but when I do:
    curl -k –location –request GET https: //my.host.address/? rest_route = / lmfwc / v2 / licenses
    Without providing api keys I receive a response as if I was authenticated.
    Is this a bug or a configuration issue?

    can you help explain and resolve this issue?

Viewing 3 replies - 1 through 3 (of 3 total)
  • Drazen Bebic

    (@drazenbebic)

    6 years, 3 months ago

    Hello @japac

    thank you for your message and for using my plugin.

    You are indeed correct, I will upload a hotfix tonight to fix this issue. Until then, you can completely disable this REST API Route in the plugin settings, here’s a screenshot:

    https://snipboard.io/TL9ymB.jpg

    When you do so, the following error message will be displayed:

    https://snipboard.io/UzPiJB.jpg

    As I said, I will upload a hotfix asap when I finish with work.

    PS: Thank you so much for bringing this to my attention, I was completely unaware of the problem until now.

    Thread Starter japac

    (@japac)

    6 years, 3 months ago

    hello,
    there is new more important problem. there is no possibility to check if licence key was used.
    look at this:

    Check license:

    $ curl -k –location –request GET https://server.local/?rest_route=/lmfwc/v2/licenses/validate/XRX-XY3-3YI
    {“success”:true,”data”:{“timesActivated”:0,”timesActivatedMax”:1,”remainingActivations”:1}}

    activate license

    $ curl -k –location –request GET https://server.local/?rest_route=/lmfwc/v2/licenses/activate/XRX-XY3-3YI
    {“success”:true,”data”:{“id”:”11″,”orderId”:”1502″,”productId”:”14″,”licenseKey”:”XRX-XY3-3YI”,”expiresAt”:null,”validFor”:”0″,”source”:”1″,”status”:”2″,”timesActivated”:”1″,”timesActivatedMax”:”1″,”createdAt”:”2020-03-10 20:22:31″,”createdBy”:”1″,”updatedAt”:”2020-03-19 20:09:55″,”updatedBy”:”0″}}

    check if error occurs if activated more than once

    $ curl -k –location –request GET https://server.local/?rest_route=/lmfwc/v2/licenses/activate/XRX-XY3-3YI
    {“success”:true,”data”:{“id”:”11″,”orderId”:”1502″,”productId”:”14″,”licenseKey”:”XRX-XY3-3YI”,”expiresAt”:null,”validFor”:”0″,”source”:”1″,”status”:”2″,”timesActivated”:”1″,”timesActivatedMax”:”1″,”createdAt”:”2020-03-10 20:22:31″,”createdBy”:”1″,”updatedAt”:”2020-03-19 20:09:55″,”updatedBy”:”0″}}

    no, so check again

    $ curl -k –location –request GET https://server.local/?rest_route=/lmfwc/v2/licenses/activate/XRX-XY3-3YI
    {“success”:true,”data”:{“id”:”11″,”orderId”:”1502″,”productId”:”14″,”licenseKey”:”XRX-XY3-3YI”,”expiresAt”:null,”validFor”:”0″,”source”:”1″,”status”:”2″,”timesActivated”:”1″,”timesActivatedMax”:”1″,”createdAt”:”2020-03-10 20:22:31″,”createdBy”:”1″,”updatedAt”:”2020-03-19 20:09:55″,”updatedBy”:”0″}}

    no, validate again

    $ curl -k –location –request GET https://server.local/?rest_route=/lmfwc/v2/licenses/validate/XRX-XY3-3YI
    {“success”:true,”data”:{“timesActivated”:0,”timesActivatedMax”:1,”remainingActivations”:1}}

    validation shows no change – still one activation remaining
    activate again

    $ curl -k –location –request GET https://server.local/?rest_route=/lmfwc/v2/licenses/validate/XRX-activate/XRX-XY3-3YI
    {“success”:true,”data”:{“id”:”11″,”orderId”:”1502″,”productId”:”14″,”licenseKey”:”XRX-XY3-3YI”,”expiresAt”:null,”validFor”:”0″,”source”:”1″,”status”:”2″,”timesActivated”:”1″,”timesActivatedMax”:”1″,”createdAt”:”2020-03-10 20:22:31″,”createdBy”:”1″,”updatedAt”:”2020-03-19 20:09:55″,”updatedBy”:”0″}}

    still no change

    $ curl -k –location –request GET https://server.local/?rest_route=/lmfwc/v2/licenses/activate/XRX-XY3validate/XRX-XY3-3YI
    {“success”:true,”data”:{“timesActivated”:0,”timesActivatedMax”:1,”remainingActivations”:1}}

    Drazen Bebic

    (@drazenbebic)

    6 years, 2 months ago

    @japac

    sorry for the late reply, but I have some good news.

    The plugin has been updated to version 2.2.0, and the critical issue with the REST route listing all licenses has been taken care of. Please update your plugin.

    Now, onto your other issue.
    Please try accessing the routes via wp-json and not the ?rest_route parameter. That should fix the issue. Here’s an example:

    http://www.example.com/wp-json/lmfwc/v2/licenses/activate/THE-PRETENDER

    You can provide the Auth header and include the user/pass there, or add the consumer_key and consumer_secret as URL parameters.

    Please let me know if this fixed the issue for you.

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘licence manager for woocommerce’ is closed to new replies.