How To Let ONLY Paying Customers View Special Videos?

I want to allow paying customers ONLY to view special videos within Zen Cart. I'm already able to embed videos within Zen Cart Product pages but currently have no way to restrict access. After viewing much older threads on related topic I found some possible solution(s) but I'm not sure there are better ways to do this in 2012. See below:
################################################################################
From http://www.irishwebmasterforum.com/e-commerce/9115-private-ecommerce-site.html

QUESTION: Hi All,

I've been asked to help design an eCommerce site for a friend of mine. We're playing around with Prestashop at the moment and finding it very very good. Basically he imports a product and wants to sell direct to customers on one site, and to people in the trade on another. What are his (our) options with regard making a site (Prestahop or otherwise), and requiring people to login before they can see products or prices (so as customers can't view trade prices).

ANSWER 1: Another option is (and many do this) is to have 2 sites on the one domain. (well 3 actually)

You can have the main site ie: https://www.yoursite.ie with links to the other 2 sites - retail.yoursite.ie & wholesale.yoursite.ie

So, after setting them up your retail customers can go straight to the retail site and your trade customers can go to the trade site where prices will only be shown after they register and are approved as a trade customer by the Admin (site owner).

ANSWER 2: From http://www.zen-cart.com/showthread.php?40870-Is-it-possible-to-password-protect-certain-items&highlight=password+protect+video

the reply was; Far as I know, there's no way to do 'product by customer' in Zencart yet.

Considering how easy it is to install and copy a template to Zencart, if I were going to do what you've described, I'd install a separate installation of Zencart for each wedding in it's own subdirectory (/millerwedding) and give the guests a password for that site. You'd only have to style it once, and copy the template to future sites. One-product carts are pretty easy to design, anyway.
################################################################################

Given that these responses date from 2006, is there a better answer in 2012?

I can't determine through searching Google, the Forum, or the ZC User Manual whether Zen Cart permits multiple simultaneous login instances using the same login and password. I'm setting up a ZC store that permits paying customers to watch videos within Product Pages. I don't want a customer to share login details so that other non-paying customers can view these videos simultaneously from other computers.

I just signed into one of my sites using the same login credentials using FireFox and IE-9 with no issue (which sounds like it might be an issue for you).

Thanks for reply. Your empirical test doesn't test logins from different IP addresses. What do the experts familiar with ZC code and features have to say?

Zen Cart doesn't prevent simultaneous logins to customer accounts.
If a customer shares their password with someone else, that's up to them. Just like you sharing your gmail password with someone else.

Thanks DrByte! Do you know of any means/tactic available to deter shared use of login data in order to receive information and services that have not been paid for?

I'm setting up a ZC store that permits paying customers to watch videos within Product Pages. I don't want a customer to share login details so that other non-paying customers can view these videos simultaneously from other computers. Since Zen Cart permits multiple (read no limit) logins with the same ID and password from different IP addresses, what solution(s)/tactic may exist to deter guests from acquiring information or services that they have not paid for from a Zen Cart store?

Yourvirtualworld:

I'm setting up a ZC store that permits paying customers to watch videos within Product Pages. I don't want a customer to share login details so that other non-paying customers can view these videos simultaneously from other computers. Since Zen Cart permits multiple (read no limit) logins with the same ID and password from different IP addresses, what solution(s)/tactic may exist to deter guests from acquiring information or services that they have not paid for from a Zen Cart store?Be aware that locking down to a specific IP won't work either.
My laptop when mobile gets a different IP address on every page viewed.

gilby:

My laptop when mobile gets a different IP address on every page viewed.

I call BS on this one. :)

A different IP address everytime you reconnect to your provider, yes, quite possible, even probable, but a new IP for every page viewed, I think not.

Cheers
Rod

I suppose you could write your own plugin to store the customer's IP address and customer number and time of login in a new database table when they login, and have it delete it when they logout or after a predetermined length of time. Then when new logins happen, check to see if you've already got that customer number in the table of logged-in users. You'd have to also build some garbage-collection logic in case your customers don't log out, since you won't want to lock them out just because they didn't intentionally log out, hence the need to store their login time. You might even want to make it update the time every time they click a link on your site, so you know when to consider them logged out.

That's one way to tackle it anyway.

You might consider shortening it and not preventing simultaneous logins, but preventing simultaneous viewings, by only tracking that information when they attempt to view something, and pop up a suitable message if it's found they're already viewing.

Or you could tackle it backwards: if someone starts viewing from another computer, kill the playback for the first computer. That way whoever's doing the sharing will quickly stop since it's seriously inconveniencing their own enjoyment. Of course that would require streaming the content instead of allowing it to be downloaded as a typical video file can be.

Those are a couple ideas you might consider.

Thanks DrByte! I'm especially fond of your second idea, especially if the popup message won't stay away until all other viewing occurences cease. The underlying message to all viewers is that something wrong is going on and others, including the provider, are immediately aware of it. That's powerful group psychology at play.

How complex of a coding job is that?

(More than 500 videos here)

Perhaps the simplest solution is to get at the root of the problem by programming the necessary code that will prevent more than one user at a time from logging into their account. How hard is that?

Perhaps the simplest solution is to get at the root of the problem by programming the necessary code that will prevent more than one user at a time from logging into their account. How hard is that?

The way Netflix does it is by controlling the entire playback experience with their own playback viewer tool. On the PC I believe it's flash-based, but there might be other technologies that could work.

As far as limiting logins, my earlier post gave the outline of the coding requirements.

Netflix and my company is like David and Goliath. God knows how much underlying code they've established to make their service viable and maintain security. My site uses a flash based player to offer up progressive streaming but has no capability/features to control viewing.
I have passed on your outlined coding logic to vendors/programmers at http://www.guru.com . Thanks so much for your contributed experience and expertise DrByte. Perhaps there is an adventurous soul in our Forum that can contribute it back to the entire community and gain his/her "15 minutes of fame". Such a mod would most likely open up new ecommerce possibilities for Zen Cart knowing that shop owners can safely and cost effectively offer up multimedia content in real time and put us on more equal footing with the Netflix giants of the online world.

I've posed this question before on ZC forums and didn't really receive a fully developed solution, just pointers. I contacted custom programmers who tried to get WAY more $ than the solution appeared to merit.:shocking: I've scoured the Internet to solve the following problem:
I want to prevent dual, multiple, simultaneous logins leading to membership fraud because I want to run a subscription based website showing pay per view educational videos. The proposed login/access scheme will grant access for paid customers who pass the mySQL username/password validation. One user can login but Zen Cart must prevent others who try to use the same login credentials from a different machine. Since I'm far from a code jockey I'm not in a good position to challenge, endorse, or implement any of these four suggestions below so I'm soliciting the expertise of my ZC gurus to lead the way for me and others who face the same challenge so we can keep it within the family. A great answer requires a pretty in depth understanding of how Zen Cart works under the hood. Please comment/critique these ideas and indicate which is best and give the nuts and bolts on implementation is Zen Cart 1.39h.

SUGGESTION #1

Paste the below code into my header file, which is an include on every page of my site.

#Prevent Membership Fraud
//check if someone is logged in
if (isset($_SESSION['user_id'])) {
//connect to your db
require('../../../connect.php');
/build query using hirer_id and current_session_id, get count. If query comes back with a 1, it means there is a match. A match is good because it means no one else logged in during their session. On the other hand, a 0 indicates that no match, meaning someone else logged in simultaneously. Zeros get the boot of death./
$result = mysql_query('SELECT COUNT(*) FROM user WHERE user_id='.$_SESSION['user_id']." AND session_id='".mysql_real_escape_string(md5(session_id()))."'");
$login_status = mysql_result($result,0,0);
//recall 1 is good, 0 is bad
if (0 == $login_status) {
//give them the boot
//this is copied from my logout script
$_SESSION = array(); //destroy the variables
session_destroy(); //destroy the session itself
setcookie(session_name(), '', time()-300, '/', '', 0); //destroy the cookie
echo 'Hey, someone else logged in using your account info which means you get the boot.';
exit();
}
}

SUGGESTION #2

function authenticateUser($id, $hash, $databaseLink) {
# SQL
$sql = 'SELECT EXISTS(
SELECT 1
FROM tbl_users
WHERE id = ''.mysql_real_escape_string($id).''
AND hash = ''.mysql_real_escape_string($hash).''
LIMIT 1
);';

# Run Query
if ($query = mysql_query($sql, $databaseLink)) {
    # Get the first row of the results
    # Assuming 'id' is your primary key, there
    # should only ever be one row anyway.       
    $result = mysql_fetch_row($query);

    # Casting to boolean isn't strictly necessary here
    # its included to indicate the mysql result should
    # only ever been 1 or 0.
    return (bool)($result[0]);
} else {
    # Query error :(
    return false;
}

}

SUGGESTION #3

...//form submission
if(isset($_POST['login']))
{
//kill existing session
session_destroy();
//start login process
$user_name = $_POST['user_name'];
$password = md5($_POST['password']);
$login = "SELECT * FROM users WHERE user_name = '$user_name' AND password = '$password'";
$login_query =mysql_query($login);
if (!$login_query)
echo mysql_error();
//check for actual user
...
...
//if user is real (real password, id, etc)
while ($results = mysq_fetch_array($login_query, MYSQL_ASSOC))
{
$userID = $results['userID'];
...
...
}//end results loop
$_SESSION['userID'] = $userID;
}//end of if-login check

SUGGESTION #4

Use the IP to block users from multiple machines,
$_SERVER['REMOTE_ADDR']

Yourvirtualworld:

I've posed this question before on ZC forums and didn't really receive a fully developed solution, just pointers. I contacted custom programmers who tried to get WAY more $ than the solution appeared to merit.:shocking: I've scoured the Internet to solve the following problem:
I want to prevent dual, multiple, simultaneous logins leading to membership fraud because I want to run a subscription based website showing pay per view educational videos. The proposed login/access scheme will grant access for paid customers who pass the mySQL username/password validation. One user can login but Zen Cart must prevent others who try to use the same login credentials from a different machine. Since I'm far from a code jockey I'm not in a good position to challenge, endorse, or implement any of these four suggestions below so I'm soliciting the expertise of my ZC gurus to lead the way for me and others who face the same challenge so we can keep it within the family. A great answer requires a pretty in depth understanding of how Zen Cart works under the hood. Please comment/critique these ideas and indicate which is best and give the nuts and bolts on implementation is Zen Cart 1.39h.
The only way I can see this working is to use a hardware key.
This will restrict access to one key at a time.

Is this such a significant issue for you that you need to "fix" it?

Have your customers been hacked?

Are your customers acting fraudulently by "sharing" the login details with others?
Then maybe you need to reset their account access when 2 logins occur at the same time.

In addition to the other suggestions offered previously, you might consider adding two-factor authentication. That way if someone wants to share their login with someone else, they'll have to at least give that other person their cellphone in order to respond with the correct PIN code. Or similar concept.

Or, as suggested earlier, build your live-streaming tool to detect whether a certain user is already accessing content from your streaming server, and stop the streaming if that is detected. But, Zen Cart isn't your live-streaming tool, so this really isn't a Zen Cart issue.