Skip to content

Releases: vibtools/Licora

Release list

Licora v5.0.1.1 — High Security Stabilization for PHP License Management

Licora v5.0.1.1 — High Security Stabilization for PHP License Management Latest
Latest

Choose a tag to compare

View all tags
@victorsteele victorsteele released this 23 Jul 17:30
v5.0.1.1
7fafd2c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Licora v5.0.1.1 — High Security Stabilization

Release date: 2026-07-23
Release type: Backward-compatible security stabilization
Baseline: v5.0.1-baseline
Baseline source commit: c3db5759ac2539ab1525c73530ef5984b4b73ed6

Summary

Licora v5.0.1.1 is a stable, backward-compatible security release for the open-source, self-hosted PHP and MySQL/MariaDB license management system maintained by Vib Tools.

This release improves API authentication, Viewer authorization, installer protection, authenticated encryption, administrator session security, rate-limit consistency, audit logging, and HTTP security headers without changing existing API contracts, database schema, license formats, routes, or client integrations.

Licora v5.0.1.1 applies surgical security fixes to the existing PHP and MySQL/MariaDB license-management system. It does not redesign the application, rename routes, change the database schema, alter the license format, remove features, or replace the current architecture.

Download

GitHub automatically provides the complete source for tag v5.0.1.1 as:

  • Source code (zip)
  • Source code (tar.gz)

These archives represent the exact stable release commit:

7fafd2c34b3425df6ef310b9f25ffa426588d294

Security fixes

Bearer authentication

Authorization: Bearer TOKEN is normalized correctly before API-key hashing. Existing X-API-Key, raw authorization-token, and JSON api_key compatibility remains available.

Viewer permissions

Viewer accounts remain read-only. Server-side permission checks now block:

  • License CSV export from the bulk-license action.
  • API-key test actions.
  • Full API-key decryption and display.

Manager and Super Admin behavior remains unchanged.

Installer hardening

The existing installer flow is preserved while adding:

  • Existing-installation detection through includes/config.local.php, the legacy root configuration marker, or database environment configuration.
  • HTTP 403 installer lock response after installation.
  • Installer CSRF protection before application configuration exists.
  • A documented manual recovery procedure.

Temporary administrator warning

The admin panel detects the seeded admin / ChangeMe!2026 credential pair and displays a critical warning. Licora never disables, deletes, or changes the account automatically.

Versioned authenticated encryption

New encrypted license and API-key records use the v2: format:

  • AES-256-CBC encryption.
  • Independent encryption and authentication keys.
  • HMAC-SHA-256 integrity authentication.
  • Random initialization vectors.

Existing unversioned encrypted values continue to decrypt through the legacy compatibility path. No existing encrypted record requires migration.

Session security

The existing 30-minute inactivity timeout is enforced by every authenticated admin-page check. Existing login flow, session key names, and logout route remain unchanged.

Rate limiting

Rate-limit updates now use a MySQL/MariaDB advisory lock per IP and endpoint. This reduces concurrent counter races without changing limits, endpoint behavior, HTTP responses, or JSON contracts. The previous implementation remains as a compatibility fallback if advisory locks are unavailable.

Security logging

The release adds security audit entries for denied management/delete actions and session invalidation. Development API logs no longer print API-key values or hash prefixes.

Security headers

The application and installer send:

  • X-Content-Type-Options: nosniff
  • Referrer-Policy: same-origin

No Content Security Policy or cross-origin policy was added because the existing administration interface uses external CDN resources.

Compatibility guarantees

The following remain unchanged:

  • Database schema, tables, columns, indexes, foreign keys, and triggers.
  • SQL migration files and upgrade order.
  • License-key format and generation.
  • License validation behavior.
  • Public API URLs.
  • Existing API JSON field names and response structures.
  • Legacy /api/check_license.php response format.
  • Admin routes and file locations.
  • Cron entry points.
  • UI layout and frontend assets, except the required temporary-credential warning.
  • Existing encrypted data.
  • Existing API keys, license keys, devices, logs, and audit history.

Regression validation

The validation suite now runs:

  1. PHP syntax checks for every PHP file.
  2. Security smoke tests.
  3. Compatibility regression checks.
  4. JavaScript syntax validation.
  5. Public-release marker scan.
  6. SQL seed-scope validation.

The compatibility test verifies immutable hashes for the database schema, migrations, cron scripts, CSS, and JavaScript; confirms route and session compatibility; validates Bearer normalization and encryption compatibility; and confirms viewer export/test restrictions.

Remaining known limitations

  • /api/check_license.php remains unauthenticated by default because mandatory authentication would break existing integrations. The endpoint retains its exact JSON behavior and receives the concurrency-safe rate limiter and global security headers.
  • API keys remain reversibly stored for Manager and Super Admin viewing compatibility. New copies use authenticated versioned encryption, and Viewer access is blocked.
  • Legacy encrypted values retain their original decryption path. They are not automatically rewritten.
  • Full database-backed HTTP regression testing still requires a configured MySQL/MariaDB test deployment.
  • Security headers intentionally avoid CSP because the current UI depends on external Bootstrap, Bootstrap Icons, Tailwind, and Chart.js resources.

Upgrade

No database migration is required.

  1. Back up the current repository, private configuration, and database.
  2. Apply the v5.0.1.1 source update.
  3. Run bash scripts/validate.sh.
  4. Confirm that existing encrypted values can still be viewed by an authorized Manager or Super Admin.
  5. Confirm that the installer returns the locked message on an installed system.
  6. Test primary and legacy API clients in a non-production environment.
Assets 2
Loading

Licora v5.0.1-baseline — Immutable PHP License Management System Baseline

Licora v5.0.1-baseline — Immutable PHP License Management System Baseline

Choose a tag to compare

View all tags
@victorsteele victorsteele released this 23 Jul 10:43
v5.0.1-baseline
c3db575

Licora v5.0.1-baseline — Immutable Baseline Snapshot

Licora v5.0.1-baseline is the permanent source-code and documentation baseline for the Licora open-source central license management system.

Licora is a self-hosted PHP and MySQL/MariaDB software license management platform designed for license creation, license validation, API-key binding, application scoping, device-limit enforcement, administrator access control, audit logging, security monitoring, database backup, and operational license administration.

This baseline release preserves the verified state of Licora before subsequent development phases. It contains no runtime feature changes, bug fixes, refactoring, database modifications, API changes, authentication changes, UI changes, or license-generation changes.

Baseline Identity

  • Project: Licora — Central License Management System
  • Maintainer: Vib Tools
  • Release tag: v5.0.1-baseline
  • Frozen source commit: c3db5759ac2539ab1525c73530ef5984b4b73ed6
  • Baseline documentation commit: ebd641858ccfd45b34f80d45039681df18c2fe6f
  • Default branch: main
  • License: MIT
  • Baseline date: July 23, 2026

The v5.0.1-baseline annotated Git tag points directly to the frozen source commit:

c3db5759ac2539ab1525c73530ef5984b4b73ed6

Current Platform

Licora currently operates as a server-rendered PHP application with MySQL or MariaDB database storage.

Runtime requirements

  • PHP 8.0 or later
  • MySQL or MariaDB
  • PDO MySQL extension
  • OpenSSL extension
  • JSON extension
  • Apache-compatible web server configuration
  • InnoDB database engine
  • utf8mb4 database encoding

No PHP framework, Composer runtime dependency, JavaScript build system, queue worker, webhook service, or background application framework is required by the current baseline.

Current License Management Features

The frozen Licora baseline includes the following existing capabilities:

  • Software license-key generation
  • License activation and validation
  • License expiration management
  • License suspension and reactivation
  • License deletion
  • Bulk license creation
  • Bulk license operations
  • License extension by hours or days
  • Device-limit enforcement
  • Device registration
  • Existing-device reconnection
  • Device activation and deactivation
  • API-key management
  • API-key hashing
  • API-key application binding
  • Application scope support
  • API request counting
  • Per-hour API rate-limit configuration
  • License blacklist management
  • Device blacklist support
  • IP blacklist support
  • License activity logs
  • API request logs
  • Administrative audit trail
  • Administrator account management
  • Role-based administrative access
  • Dashboard statistics
  • Health-status page
  • Settings management
  • SQL database backup
  • Expiring-license cron processing
  • Log and rate-limit cleanup cron processing
  • Dark-mode administration interface
  • Client-side searching, filtering, and pagination

Public License Validation API

The baseline contains two existing public API entry points:

Primary validation endpoint

POST /api/verify.php

The primary endpoint supports:

  • API-key authentication
  • License-key validation
  • Device identification
  • Application ID context
  • Application version context
  • API-key application binding
  • License status checks
  • License expiration checks
  • Device-limit checks
  • Blacklist checks
  • API logging
  • Request-rate limiting
  • Conditional CORS handling

Legacy validation endpoint

POST /api/check_license.php

The legacy endpoint accepts license-validation requests without the primary API-key contract.

The complete immutable request headers, JSON fields, response structures, behavior, and status-code documentation are preserved in BASELINE.md.

Administration Interface

The current Licora administration interface includes the following existing pages and routes:

/admin/index.php
/admin/login.php
/admin/logout.php
/admin/admins.php
/admin/api_keys.php
/admin/license.php
/admin/device.php
/admin/logs.php
/admin/audit.php
/admin/settings.php
/admin/backup.php
/admin/health.php

The administration interface provides license management, device administration, API-key control, logs, audit records, configuration settings, backups, health information, and administrator-account management.

Database Baseline

The frozen database contract contains 11 logical tables:

admin_users
api_keys
api_logs
audit_trail
blacklist
devices
failed_logins
licenses
logs
rate_limits
settings

The schema includes:

  • Primary keys
  • Unique indexes
  • Secondary indexes
  • Foreign-key constraints
  • Automatic timestamps
  • License status enumeration
  • Administrator role enumeration
  • Blacklist type enumeration
  • Device activity tracking
  • API request tracking
  • Audit records
  • Configuration settings

The baseline also preserves two database triggers:

update_device_last_active
update_license_timestamp

Existing schema and migration files remain unchanged:

database.sql
migration.sql
migration-v4.sql
migration-v5.sql
migration-v5-fix.sql
migration-v5-hotfix.sql

Authentication and Authorization Baseline

The current authentication system includes:

  • Username and password authentication
  • CSRF protection on login
  • Password hashing
  • Bcrypt password support
  • Legacy MD5 and SHA-1 password compatibility
  • Automatic password rehashing after successful legacy login
  • Session ID regeneration
  • Failed-login tracking
  • IP-based login-attempt limiting
  • Account lockout
  • User-agent session validation
  • Administrator roles
  • Super-administrator access
  • Manager access
  • Viewer access
  • Permission checks for administrative actions

The current session cookie configuration includes:

  • Session-only cookie lifetime
  • HttpOnly
  • SameSite=Lax
  • Conditional Secure behavior when HTTPS is detected

Two-factor authentication fields and settings exist in the database baseline, while a complete two-factor authentication challenge workflow is not part of the current runtime behavior.

Encryption and Hashing Baseline

The current Licora baseline uses:

  • AES-256-CBC for reversible encrypted values
  • Random initialization vectors for encrypted data
  • SHA-256 hashing for API-key lookup
  • Bcrypt for current administrator passwords
  • Cryptographically secure random-byte generation
  • SHA-256 file checksums for baseline integrity verification

License keys are stored in their current plain and encrypted representations according to the existing implementation.

No encryption format, key-generation method, hashing method, license-key format, or validation behavior has been changed in this release.

Immutable Baseline Documentation

This release adds only the following baseline and release metadata files:

BASELINE.md
BASELINE_CHECKSUMS.sha256
BASELINE_MANIFEST.md
RELEASE_NOTES_BASELINE.md

BASELINE.md

Contains the complete frozen project snapshot, including:

  • Repository identity
  • Version information
  • Folder and file counts
  • Complete folder tree
  • Public API contract
  • Database schema snapshot
  • Feature inventory
  • Configuration snapshot
  • Security baseline
  • Existing limitations
  • Administrative routes
  • Cron entry points
  • Compatibility contract
  • Critical file checksum references

BASELINE_CHECKSUMS.sha256

Contains SHA-256 checksums for critical runtime files, including:

  • PHP application files
  • API handlers
  • Authentication files
  • Security files
  • Database schema
  • Migration files
  • Administration assets
  • Cron scripts
  • Configuration files
  • Validation scripts
  • Security smoke tests

These checksums allow future repository states to be compared against the frozen baseline and help detect unintended changes.

BASELINE_MANIFEST.md

Records:

  • Frozen commit hash
  • Baseline tag
  • Version
  • File count
  • Folder count
  • Public API count
  • Admin-page count
  • Database-table count
  • Generated baseline documentation
  • Compatibility-contract references
  • Audit references
  • Baseline date

RELEASE_NOTES_BASELINE.md

Documents the current Licora system state without introducing a roadmap, proposed architecture, implementation plan, or future-development commitment.

Repository Snapshot

At the frozen source commit, the repository baseline contains:

  • 96 source and documentation files
  • 17 directories excluding the repository root
  • 28 PHP files
  • 6 core PHP classes
  • 2 public API endpoints
  • 12 administration pages
  • 11 logical database tables
  • 2 database triggers
  • 6 SQL schema and migration files
  • 2 cron entry points
  • 1 local administration CSS file
  • 1 local administration JavaScript file

Cron Entry Points

The current scheduled-maintenance entry points are:

cron/check_expiring.php
cron/cleanup.php

These paths are part of the immutable compatibility contract and remain unchanged.

Compatibility Guarantee

This baseline release does not change:

  • Public API URLs
  • API request JSON
  • API response JSON
  • HTTP routes
  • Database schema
  • Database table names
  • Database column names
  • Indexes
  • Foreign keys
  • Database triggers
  • Migration SQL
  • License-key format
  • License generation
  • License validation behavior
  • Device registration behavior
  • Device-limit enforcement
  • Encryption format
  • API-key hashing
  • Password hashing
  • Authentication behavior
  • Authorization roles
  • Session structure
  • CSRF handling
  • Configuration constants
  • Configuration keys
  • Cron file locations
  • Administ...
Read more
Loading