wordpress-sdk icon indicating copy to clipboard operation
wordpress-sdk copied to clipboard

[feature-request] Upon license activation with a valid key, if the license is fully utilized provide a way to deactivate from another installation.

Open vovafeldman opened this issue 8 years ago • 2 comments

Feature suggestion by @bfintal

Licenses have a limited quota. Currently, we allow moving license between installations. But, in order to move a license, the user first must deactivate it on one install, and then activate it on another. Sometimes users forgot to do it which triggers unwanted support tickets.

In a perfect world without any security issues, the best UX would work like that:

  1. User enters license
  2. API validates the license
  3. If valid license but fully-utilized, show a dialog that will look like:

The license was already fully utilized. [Buy another license] or deactivate the license from one of your sites: ( * ) my.site1.com ( ) my.site2.com ( ) my.site3.com [ Cancel ] [ Buy another license ] [ Replace the license with my.site1.com ]

Note: By deactivating the license from my.site1.com, this site will not get any further plugin updates and you might loose the premium features.

Two security issues:

  1. If the license was purchased by an agency that built the site, viewing the sites list is a security vulnerability. The client shouldn't be able to see the agency's other clients.
  2. If the license was purchased by an agency that built the site, the user will be able to deactivate the license from another client's site which will basically loose the license.

An optional solution for would be moving that dialog box to the email. Basically, instead of showing that dialog box, emailing the list of sites to the license owner with an easy one click deactivation links. That way only the license owner will see the sites that are using the license, and only the license owner will confirm the deactivation. This solution can work, though it's pretty complex.

vovafeldman avatar Jan 17 '17 01:01 vovafeldman

Valid points, I also agree that the safest way around this would be to send an email to the account holder.

bfintal avatar Feb 07 '17 16:02 bfintal

Any updates on this? :)

bfintal avatar May 10 '17 16:05 bfintal