Wow, I have googled high and low for exactly this kind of functionality in zen-cart and just now ran across this thread - I guess I just wasn't phrasing the question just right. It seems to me that this is some basic functionality that has been missing in zen-cart for far too long...I mean not everyone that uses zen-cart wants to sell thousands of different doo-dads and chotckies, some of us just want to sell homegrown software products and integrate some kind of licensing scheme into our online store.
As it turns out, I also have been working (independently) on a mod that suits my particular needs. If there is interest by other zenners for this, I would be willing to share my ideas and, in the process, maybe learn a thing or two about how zen-cart really works ;)
My concept:
1. create a product_licenses table to store customer license keys (it's interesting to note that my table looks nearly identical to more-solutions'ss - I guess great minds think alike ;)
2. Customers that wish to demo our software must first create an account before they are permitted to download. This makes sense and is commonly done anyway.
3. When the customer runs the application for the first time, s/he is prompted by the app to enter their user id/password provided at time of registration. The app then talks http to our web server (via a client_license_req.php file), and sends us the user's login info, product ID (hard coded into the app), machine ID (this is how we lock the license to a single machine), and operating system info (in case we only support certain versions of O.S.). This "initial contact" inserts a place holder record for the customers_id in the product_licenses table, which will later be filled in with a valid license_key if the customer decides to buy.
4. The product_licenses table contains registration_date and expiration_date fields which define the evaluation period (typically 30 days, although the store manager can change this manually on a per-product basis).
5. The app then encrypts some information and stores it on the user's machine in a "super secret file". If some crafty individuals discover and remove this information in an attempt to reset their evaluation period, the app assumes it is being run for the first time and again prompts for user login info. Since the demo expiration date is already in our product_licenses table, the crafty individual really hasn't gained anything. If they really, really, really want to outsmart our licensing scheme, they can try creating another user account and doing another download...but then we still have their machine ID, so we can prevent them from resetting their evaluation period. This means that if they wanted to use our software in a perpetual evaluation mode, they would have to continually swap out their machine and re-register and re-download and...probably more work than it's worth!
6. Every time the app is run during the evaluation period, it connects to our server and requests the license_key. If the key is empty, the app starts up in "evaluation mode" and knows when the evaluation period is over - after that it simply won't run anymore. If the machine is NOT connected to the internet and can't get the license information, the app simply uses the encrypted evaluation period expiration date from the "super secret file". If the "super secret file" was removed, the app just won't run.
7. If the customer HAS purchased a license during the evaluation period, we populate the product_licenses table with a valid license_key at the time the order confirmation email is sent. The license key is generated using uniqid() and we always make sure it really IS unique by looking in the product_licenses table first to see if it has already been assigned.
8. The next time the app is run after the purchase confirmation, it will receive a valid license key from the server, and become activated. This license information is updated in the "super secret file" on the user's machine, so even if it is run disconnected from the internet, the app will remain activated. If the app can not connect to the internet, the user can still activate the app by entering the license key that was emailed to them.
So far I have the table definition, the client_license_req.php and the zen-cart menu and administration page for the product_licenses table. Still to be done is the hook in the order confirmation email which inserts the license key into the product_licenses table, but thanks to this email thread, I now know where to look for that.
Can anyone find any flaws in this licensing scheme that can be circumvented by a potential crafty hacker? Any comments/suggestions for improving this scheme would be much appreciated.
BTW, when this is all done, I'm planing on making it available as an add-on mod...as soon as I can figure out how to do that :)
Bob


Reply With Quote

