How to check

[1theme]

Hello, we own a service of selling digital goods.

And I don't quite understand a few things.

First I would like to mention that we would like to make the user register an account before he downloads the good.

I have made an item in the admin section, which redirects the user to a page, that page will require the user to register.

Now how do I check this user has really paid? I have created a script that generates keys, which I am able to validate. Or even force them to a single e-mail. But the problem is, what if a user discovers that generator script ? He will be able to generate keys and use them to register accounts without paying. I wanted to check for the referer so I would validate the script only for e-junkie, but somehow e-junkie doesn't send the HTTP_REFERER.

So basically my question is. How do I check a user that has bought something and din't forcingly get the code ?

Thank you.

[E-junkie_Monster]

Our help pages here explain how we can send out order data after a purchase which you can use to validate a buyer which has been redirected to your login page:

http://www.e-junkie.com/ej/help.redirection.htm

http://www.e-junkie.com/ej/help.integration.htm



You may want to consider keeping your product buttons within the members area of your site though, so that buyers would have to register before they can even purchase. That way you can use us to deliver the downloads and generated codes ourselves rather than merely delivering the buyers to a login page after which you'd have to take care of all file delivery and code generation and security yourself.

[1theme]

I see.

That means I can validate if a transaction has been made through e-junkie and is not a fake one.

But consider the following.

What if a user has bought an item, and he recieved the success url. Which contains the data. In theory he will be able to share this link to others which might use it to create accounts which I can't track.

Is there a way to check for a specific transaction.

Let's say a transaction id is appended to each successfull payment, and as soon as the user registers, block that transaction id so no other users can use it to create accounts.



I might not understand everything correctly, but please bare with me.

Thank you.

[E-junkie_Guru]

Yes, when using our Redirection feature, the URL of the redirection landing page is necessarily exposed in their browser's address bar, so they could conceivably share that URL with others. You may find the tips discussed here of interest:

http://www.e-junkie.com/bb/topic/5205#post17645



However, buyers could still share the link that we provide to access their Redirection, and that link only expires after the Attempts and Hours you specify in the product's settings, but limiting Attempts to 1 may cause problems with antivirus link scanners expiring the link before the buyer can access it themselves. It's also not possible to have a single product which redirects to an URL and also provides a file download. Rather than redirecting to a registration page URL, we can recommend a different approach that would also avoid any need for buyers to register manually with information they'd already just provided at checkout.



Our Integration and Send Generated Codes features both include a 'handshake' value in the order details we transmit to a script at your end, which you can use to validate that any data transmission actually came from us, rather than from some hacker trying to spoof a transmission. We can also recommend doing a DNS reverse-lookup on the submission IP, to verify that IP resolves back to an e-junkie.com domain.



With that approach, your script would receive the buyer's order details from our server, automatically register them in your system, and either send them an email directly providing their access details (if you use our standard Integration method) or output a code back to us (such as a password or unique access URL) that we can include in the thank-you email we send to the buyer (if you use our Send Generated Codes feature):

http://www.e-junkie.com/ej/help.integration.htm

http://www.e-junkie.com/ej/help.keygen.htm



Also, since it appears you're selling WordPress themes, you might consider just using an existing WP membership plugin that already supports E-junkie. Offhand, we're aware of at least two such plugins that are known to support our integration methods:

http://www.memberwing.com/

http://digitalaccesspass.com/