<?php

/**
 * DEMONSTRATION: License Bypass Vulnerability
 * This shows how the validatePurchase() method bypasses all license validation
 */

// Simulate the vulnerable validatePurchase method
function validatePurchase($module_name)
{
    // Setup (normal)
    $module = 'api_module';
    $verified = false;
    $verification_id = null; // No license key set

    // THE BYPASS: Always return true, ignore all validation
    return true;

    // This code below is NEVER executed due to the return statement above
    if (!empty($verification_id)) {
        // JWT token validation would happen here
        // Envato API verification would happen here
        // License key validation would happen here
    }

    // Module deactivation would happen here if validation failed
    return $verified;
}

// Test the bypass
echo "Testing license bypass...\n";
$result = validatePurchase('api');

if ($result === true) {
    echo "✅ BYPASS SUCCESSFUL: validatePurchase() returned true\n";
    echo "✅ Module would stay active regardless of license status\n";
    echo "✅ All API endpoints would be accessible\n";
} else {
    echo "❌ Bypass failed - proper validation occurred\n";
}

echo "\nThis demonstrates how unauthorized users can use the API without a valid license.\n";
