diff --git a/public/invite.php b/public/invite.php
index 384b4d6b..159dfc4d 100644
--- a/public/invite.php
+++ b/public/invite.php
@@ -8,8 +8,9 @@ $id = intval($_GET["id"] ?? 0);
 $type = unesc($_GET["type"] ?? '');
 $menuSelected = $_REQUEST['menu'] ?? 'invitee';
 $pageSize = 50;
+if (($CURUSER['id'] != $id && !user_can('viewinvite')) || !is_valid_id($id))
+    stderr($lang_invite['std_sorry'],$lang_invite['std_permission_denied']);
 $userRep = new \App\Repositories\UserRepository();
-
 function inviteMenu ($selected = "invitee") {
     global $lang_invite, $id, $CURUSER, $invitesystem, $userRep;
     begin_main_frame("", false, "100%");
diff --git a/public/medal.php b/public/medal.php
new file mode 100644
index 00000000..c81d12ed
--- /dev/null
+++ b/public/medal.php
@@ -0,0 +1,68 @@
+<?php
+require "../include/bittorrent.php";
+
+$query = \App\Models\Medal::query();
+$q = htmlspecialchars($_REQUEST['q'] ?? '');
+if (!empty($q)) {
+    $query->where('username', 'name', "%{$q}%");
+}
+$total = (clone $query)->count();
+$perPage = 50;
+list($paginationTop, $paginationBottom, $limit, $offset) = pager($perPage, $total, "?");
+$rows = (clone $query)->offset($offset)->take($perPage)->orderBy('id', 'desc')->get();
+$q = htmlspecialchars($q);
+$title = nexus_trans('medal.label');
+$columnNameLabel = nexus_trans('label.name');
+$columnImageLargeLabel = nexus_trans('medal.fields.image_large');
+$columnPriceLabel = nexus_trans('medal.fields.price');
+$columnDurationLabel = nexus_trans('medal.fields.duration');
+$columnDescriptionLabel = nexus_trans('medal.fields.description');
+$columnActionLabel = nexus_trans('nexus.action');
+$filterForm = <<<FORM
+<div>
+    <h1 style="text-align: center">$title</h1>
+    <form id="filterForm" action="{$_SERVER['REQUEST_URI']}" method="get">
+        <input id="q" type="text" name="q" value="{$q}" placeholder="username">
+        <input type="submit">
+        <input type="reset" onclick="document.getElementById('q').value='';document.getElementById('filterForm').submit();">
+    </form>
+</div>
+FORM;
+stdhead($title);
+begin_main_frame();
+$table = <<<TABLE
+<table border="1" cellspacing="0" cellpadding="5" width="100%">
+<thead>
+<tr>
+<td class="colhead">ID</td>
+<td class="colhead">$columnNameLabel</td>
+<td class="colhead">$columnImageLargeLabel</td>
+<td class="colhead">$columnDurationLabel</td>
+<td class="colhead">$columnDescriptionLabel</td>
+<td class="colhead">$columnActionLabel</td>
+</tr>
+</thead>
+TABLE;
+$table .= '<tbody>';
+$userMedals = \App\Models\UserMedal::query()->where('uid', $CURUSER['id'])->get()->keyBy('medal_id');
+foreach ($rows as $row) {
+    if ($userMedals->has($CURUSER['id'])) {
+        $btnText = nexus_trans('medal.buy_already');
+        $disabled = ' disabled';
+    } else {
+        $btnText = nexus_trans('medal.buy_btn');
+        $disabled = '';
+    }
+    $action = sprintf(
+        '<input type="button" value="%s"%s>',
+        $btnText, $disabled
+    );
+    $table .= sprintf(
+        '<tr><td>%s</td><td>%s</td><td><img src="%s" style="max-width: 100px" /></td><td>%s</td><td>%s</td><td>%s</td>',
+        $row->id, $row->name, $row->image_large, $row->duration, $row->description, $action
+    );
+}
+$table .= '</tbody></table>';
+echo $filterForm . $table . $paginationBottom;
+stdfoot();
+
diff --git a/resources/lang/zh_CN/medal.php b/resources/lang/zh_CN/medal.php
index b3099d15..20cf0f4f 100644
--- a/resources/lang/zh_CN/medal.php
+++ b/resources/lang/zh_CN/medal.php
@@ -12,4 +12,13 @@ return [
         \App\Models\Medal::GET_TYPE_EXCHANGE => '兑换',
         \App\Models\Medal::GET_TYPE_GRANT => '授予',
     ],
+    'fields' => [
+        'get_type' => '获取方式',
+        'description' => '描述',
+        'image_large' => '图片',
+        'price' => '价格',
+        'duration' => '购买后有效期(天)',
+    ],
+    'buy_already' => '已经购买',
+    'but_btn' => '购买',
 ];
diff --git a/resources/lang/zh_CN/nexus.php b/resources/lang/zh_CN/nexus.php
index 24ce2f71..30a4ab7a 100644
--- a/resources/lang/zh_CN/nexus.php
+++ b/resources/lang/zh_CN/nexus.php
@@ -12,4 +12,5 @@ return [
     'unselect_all' => '全不选',
     'increment' => '增加',
     'decrement' => '减少',
+    'action' => '操作',
 ];