I still think the way Metabox did their key licensing management system is perhaps one of the most elegant solutions I have seen.
If the Bricks team takes a look at how the Metabox team did it, I am quite sure that they could definitely implement something (albeit more limited/simpler) so that key encryption won’t be such a bother.
Where are we on this? I too am concerned in this regard to the license - like, do a website - pass it off to client - then what? Is that violating the license agreement, then? I do have a lifetime license and want to keep it - but also be able to just hand sites off to clients. Do they need to then buy their own bricks keys? What’s the official solution here, and what’s the idea?
I understand the concept behind this writ in the license agreement is that one does not publicly sell or provide key to someone else, but, like sinanisler presented, w/ the key in the database stored as clear text, anyone w/ the access to db basically gets the key and can simply use it to deploy other sites.
Not that clients are aware, I’d say, for most part - but what if? What’s the official standpoint - it’s been over a year and a half since this was posted…
We’ve addressed this internally by adding support for defining the Bricks license key via a BRICKS_LICENSE_KEY PHP constant, so the key does not have to be stored in the database for blueprint, cloned, or client-handoff workflows.
This is currently staged and not part of a public release yet. We’ll update this thread once it ships
We’ve addressed this in Bricks 2.4-beta (beta release), now available for manual download from your Bricks account.
Please read the changelog entry before testing, and let us know if you experience any issues. Note: beta builds are not recommended for production sites.
Hello friends. Bricks version 2.4 has just been released. I updated my site and immediately checked how the license key is handled in the database regarding encryption.
Unfortunately, nothing has changed.
I tried deactivating and then reactivating the license on my site, but the key is still stored in plain text. I wouldn’t want my license key to fall into the wrong hands so easily. Please look into this.
I’ve seen how Crocoblock plugins handle licenses—they allow you to generate a unique key for each client site that is tied specifically to that domain. That gave me confidence that my personal key wouldn’t end up in the wrong hands and that I wouldn’t be violating the license agreement.
Yes, I am aware of allowlists and blocklists, but when working in an agency setting, I would prefer to have more control over the connected sites.
Thanks for your hard work.
Yes, I saw that, but it doesn’t solve the original issue raised in this discussion—an issue that dates back to 2024. Defining the key via a constant involves adding it to wp-config.php, which in some cases is stored on the client’s hosting environment, meaning the client could potentially access it at any time.
