nixpanelandClaude Sonnet 5
cd66b70735
- New Integrity class checksums the files that implement/enforce the free/paid split (SubApps, Analytics, AnalyticsData, WhiteLabel, Shell, License itself, and the two bootstrap files) against a manifest generated at zip-build time. No manifest present (a dev checkout) is never treated as tampered. - License::is_feature_available() checks Integrity::is_tampered() before checking the actual license, so a distributed copy with the check stripped/commented out re-locks every paid feature even with an otherwise-valid license, rather than the plugin trusting whatever code happens to still be there. - bin/build-integrity-manifest.php generates the manifest against a staged zip-build copy (gitignored build artifact, same pattern as app/dist) — now a required step in the zip-build workflow. - Verified live: untampered+unlicensed stays locked, untampered+licensed unlocks, one tampered file re-locks regardless of license status (tested via a temporary mu-plugin faking an active license, kept outside any protected file so it didn't itself trip the check). This raises the bar against the realistic low-effort case (finding and deleting/inverting the one license-check line) but can't stop someone who rewrites a file's logic to never call the gate, or who edits this integrity check itself — an inherent limit of protection living in plain, editable PHP. Co-Authored-By: Claude Sonnet 5 <[email protected]>
8 lines
104 B
Plaintext
8 lines
104 B
Plaintext
app/node_modules/
|
|
app/dist/
|
|
dist/
|
|
admin/src/Licensing/integrity-manifest.json
|
|
*.log
|
|
.DS_Store
|
|
Thumbs.db
|