Sugar Outfitters Validate License Key (in application code)

SugarOutfitters_ValidateLicense

/**
 * Returns true if license is valid, false otherwise
 * @param $response this parameter is passed by reference and will be updated with the actual response from
 *        calling the Sugar Outfitters API.  See: https://www.sugaroutfitters.com/docs/sugaroutfitters/selling-license-api
 * @return true or false
 */
function isLicenseValid(&$response) {
    //global $outfitters_config;
    global $sugar_config;
    $retVal = false;

    require_once("modules/weban_WebVisits/license/config.php");


    if( !isset( $sugar_config['outfitters_licenses'][$outfitters_config['shortname']] )) {
        $response = "Unable to find license_key, please go to license configuration.";
    }
    else {
        $license_key = $sugar_config['outfitters_licenses'][$outfitters_config['shortname']];
        $license_url = $outfitters_config['api_url'] . "/key/validate?public_key=" . $outfitters_config['public_key'] . "&key=$license_key";

        // I didn't need user validation so this block of code is untested.
        if(isset($outfitters_config['validate_users']) && $outfitters_config['validate_users'] == true) {
            $active_users = get_user_array(FALSE);
            $license_url .= '&user_count='.count($active_users);
        }

        //print "DEBUG: LICENSE URL : " . $license_url ."<BR>";

        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $license_url);
        curl_setopt($ch, CURLOPT_FAILONERROR, false);
        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_HEADER, false);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);

        $response = curl_exec($ch);
        $info = curl_getinfo($ch);
        curl_close($ch);

        //if it is not a 200 response assume a 400. Good enough for this purpose.
        if($info['http_code'] == 200) {
           $retVal = true;
           // Consider also checking "validated":true here... in case API starts returning 200 for failures also
        }
        else if( $info['http_code'] == 404 ) {
            $response .= "<P>URL Requested was: $license_url</P>";
        }
    }

    return $retVal;
}