Secure WordPress paid plugin

时间:2010-08-11 作者:Adhip Gupta

我想创建一个WordPress插件,但也希望确保该插件只能在使用序列键激活后才能使用,该序列键对于每个域都应该是唯一的。

假设:

我必须向用户提供实际的源代码,不能使用VideoPress类型的安全性,这只是来自插件服务器的实际内容的JavaScript包装

  • 我想确保一个普通PHP开发人员的新手将无法轻松解决安全问题
  • 3 个回复
    SO网友:EAMann

    Option 1 - Process some data on your system

    I wouldn\'t place all of the plug-in\'s processing on your own server, but pick one or two vital functions and keep them hosted on your system. Then require an API key for each site that uses the plug-in so that they can communicate with your server.

    Option 2 - Encrypt stored data and require a hosted decryption key

    Another alternative is a basic encryption setup - this is actually a system I\'ve been toying with for a while, I just haven\'t bothered to deploy it anywhere yet. The code itself (to stay true to the GPL) is all plaintext just like you\'d expect. However, all stored data (default values, plug-in settings, etc) is encrypted before being saved to the database. The trick here is that the plug-in on the remote system doesn\'t have the decryption key - in order to decrypt the data, it has to post its API key to your system which then responds with the decryption key. This can then be stored in a transient (temporary option) for a certain period of time before being flushed - that way you don\'t have a site hitting your server every 2 seconds during heavy traffic.

    The downsides of this approach might outweigh the benefits, though (which is why I haven\'t deployed it anywhere yet). First of all, a savvy programmer can capture the decryption key and then they don\'t need your server any more. Or they could just flush out all the encryption/decryption hooks and run in plaintext. This is the advantage of open source for the user and the disadvantage to the developer who wants to distribute a free-but-restricted system.

    The other downside is the dependency on your server. Storing a key in a transient lifts some of the burden off your server ... but if your site goes down for an hour or two, then every site using your plug-in goes down for an hour or two unless you plan for some kind of graceful deactivation. Also, it would mean you\'d have to keep said server up-and-running indefinitely if people continue using your system.

    Option 3 - Limit the features of the "free" version

    A last option, and one I\'m actively working on using, is to split your plug-in\'s featureset and functionality. The core of the system (UI, basic features, etc) is freely available without registration. For more advanced features, users have to register their copy, gain an activation key, then enter that key into the UI to complete the process - the plug-in then verifies with your server and downloads additional premium "add-ons" to the system.

    The disadvantage here is that once downloaded, all the code now rests on the user\'s site and, under the GPL, they can still redistribute the full package. The advantage is that it only depends on your system once and doesn\'t require any kind of long-term download/processing support.


    Any way you decide to move forward, you\'re either going to be hit with maintaining some sort of external API on your server or providing the full source of the system to your users. If you keep some functionality on your system, you almost have to guarantee 100% uptime for it to be worth it. If you\'re going to provide the full source, there\'s no way (under the GPL) to prevent someone else from re-distributing your system.

    SO网友:hakre

    你不能向WordPress用户隐藏源代码,也不能因为授权问题而限制插件的重新发布。

    您正在使用插件创建WordPress派生版本,您的用户有权获取其源代码并自由重新发布(请参阅four freedoms in free software).

    假设WordPress是根据GPLv2授权的,并且您拥有非美国客户,那么您应该处理您的(“受保护”)产品中可能存在的违反GPL的问题。

    您正在尝试为用户实现供应商锁定。

    SO网友:John P Bloch

    拥有一个拥有安全许可证的分布式插件的唯一方法是在自己的服务器上运行插件的主要功能,比如Akismet,这是任何半途而废的程序员都无法破解的。用户必须向您的服务器发送包含其许可证密钥的请求。如果密钥已签出,请执行源代码并将结果发送回。

    结束

    相关推荐