Product ID Validation #

Version note: Product ID validation was added to all public license endpoints in v2.0.0.

What It Is #

All public license endpoints (activate, deactivate, validate, check-in, verify) now require a product_id parameter. The system verifies that the license key belongs to the specified product. If it does not match, the request is rejected.

Why It Matters #

Without product ID validation, a license key for Product A could theoretically be used to activate Product B. This “cross-product activation” vulnerability is now closed.

Example of what was previously possible (now blocked):
A customer has a valid license for “Plugin A”. They attempt to use that license key on a request that specifies Product B’s product_id. In v2.0.0, this returns a dmsilm_product_mismatch error.

The validate_product_ownership() Helper #

Internally, product ID validation is performed by DMSILM_API_Licenses::validate_product_ownership(). This function:

1. Looks up the license record by key or ID
2. Checks that license->product_id matches the product_id parameter in the request
3. Returns a WP_Error with code dmsilm_product_mismatch if they do not match

This check runs on every activate, deactivate, validate, check-in, and verify call.

What product_id to Use #

The product_id value is the DDLS internal product ID — NOT the WooCommerce product ID. Find your product IDs in DDLS > Products (the ID column or URL parameter when editing a product).

Migration Guide for Existing Integrations #

If your client software was built against the v1.x API:

1. Retrieve your DDLS product ID from DDLS > Products
2. Add "product_id": to all activation, deactivation, and validation API calls
3. Handle the new dmsilm_product_mismatch error code in your error handling logic