We are currently working in a “death march” mode in order to launch our new site, Stuffed Tracker 2.0 and Stuffed Sync on the 1st of September. Also we are going to launch a new sales system, integrated with our payment-taking partner ShareIt.
The integration is quite simple actually — whenever a customer pays for our product, ShareIt’s own keygen server should make a POST request to our script to get the key (which is just a short text string in our case) that will be presented to the customer at the end of the payment process. This whole process is described in the SDK that you can download from ShareIt if you are a registered author in their system.
I’ve already done this integration before, but I’ve used Perl back then. The new version of our sales system is built with PHP. And unexpectedly we’ve got a big problem because of this yesterday. I’ve actually had to spend the whole day on fixing it, instead of doing other important things.
So, to save time for someone who might also want to use PHP to write a keygen for ShareIt, here is the whole story.
In order to install a new keygen for a particular product in ShareIt’s system, you need to write them an email, in which you should specify the URL of your keygen. Then they use a special tool, called KeyTest.exe (provided with their SDK), to check that your keygen is actually working. This tool is quite simple; it just submits several test values to your keygen via a POST request and then displays the response.
So we’ve got stuck on this testing phase yesterday. We’ve manually tested our keygen with several POST requests containing the required fields that ShareIt should provide to us and everything worked perfectly. So we happily submitted the keygen to ShareIt and quite soon got a response from them that our keygen is not working in their “test environment” (which is their slang for this KeyTest.exe tool).
This was a surprise to us, but we really haven’t tested our keygen using KeyTest.exe up to this moment. So we’ve launching this tool and tried to submit a test POST request to our keygen with it. And it didn’t work just as ShareIt has told us.
Here is the most interesting thing: after we’ve started debugging our script, we’ve quickly realized that PHP doesn’t populate $_POST or $_REQUEST variables when KeyTest.exe makes its request. Yes, that’s right — we’ve got nothing in these variables, just as if no parameters were submitted at all.
It was quite strange, to say the least. Obviously ShareIt uses this tool to test keygens everyday and they should have noticed that it doesn’t submit any parameters in its POST requests. So we’ve continued digging deeper.
I’ve opened up Ethereal (which is a great network traffic monitoring tool, btw) and started capturing TCP traffic during KeyTest.exe POST requests. And immediately I’ve found the problem – KeyTest.exe wasn’t specifying Content-Type with its request, so PHP didn’t know how to handle the data submitted via POST.
Thankfully, in cases like this, PHP creates a special variable called $HTTP_RAW_POST_DATA in which it stores all data that was passed to it in the POST request (basically everything it gets from STDIN). And, lo and behold, we’ve found the missing parameters there. It was trivial after this to make our keygen work with ShareIt’s KeyTest.exe tool.
But our problems were not over yet. We’ve wrote a new email to ShareIt saying that we’ve finally made our keygen work. But in their response ShareIt told us that the keygen still doesn’t work.
What the hell, we thought and looked again at the values that KeyTest.exe submits. For some reason one parameter called PURCHASE_ID was specified as equal to 0. We had a test in our keygen that specifically tested that this parameter is not 0; if it was, then our keygen returned an error.
We’ve added this test because the description of this parameter in the SDK says this: “Type: decimal string representation of an unsigned 32bit integer number > 0” (emphasis is mine).
Not surprisingly any more, after we’ve removed the test for this parameter and sent yet another email to ShareIt, our keygen was finally accepted.
And that’s the happy end of this story. Hope it helps someone.