plugin management + user tables and torrents table text column migrate

public/ajax.php

@@ -157,6 +157,28 @@ class AjaxInterface{
         $rep = new \App\Repositories\ExamRepository();
         return $rep->assignToUser($CURUSER['id'], $params['exam_id']);
     }
+
+    public static function addToken($params)
+    {
+        global $CURUSER;
+        if (empty($params['name'])) {
+            throw new \InvalidArgumentException("Name is required");
+        }
+        $user = \App\Models\User::query()->findOrFail($CURUSER['id'], \App\Models\User::$commonFields);
+        $user->createToken($params['name']);
+        return true;
+    }
+
+    public static function removeToken($params)
+    {
+        global $CURUSER;
+        if (empty($params['id'])) {
+            throw new \InvalidArgumentException("id is required");
+        }
+        $user = \App\Models\User::query()->findOrFail($CURUSER['id'], \App\Models\User::$commonFields);
+        $user->tokens()->where('id', $params['id'])->delete();
+        return true;
+    }
 }
 
 $class = 'AjaxInterface';
@@ -171,5 +193,6 @@ try {
         throw new \RuntimeException("Invalid action: $action");
     }
 }catch(\Throwable $exception){
+    do_log($exception->getMessage() . $exception->getTraceAsString(), "error");
     exit(json_encode(fail($exception->getMessage(), $_POST)));
 }

public/announce.php

@@ -26,45 +26,13 @@ if (isset($passkey) && strlen($passkey) != 32) warn("Invalid passkey (" . strlen
 
 $redis = $Cache->getRedis();
 $torrentNotExistsKey = "torrent_not_exists";
-$authKeyInvalidKey = "authkey_invalid";
 $passkeyInvalidKey = "passkey_invalid";
 $isReAnnounce = false;
 $reAnnounceInterval = 5;
 $frequencyInterval = 30;
 $isStoppedOrCompleted = !empty($GLOBALS['event']) && in_array($GLOBALS['event'], array('completed', 'stopped'));
 $userAuthenticateKey = "";
-if (!empty($_GET['authkey'])) {
-    $authkey = $_GET['authkey'];
-    $parts = explode("|", $authkey);
-    if (count($parts) != 3) {
-        warn("authkey format error");
-    }
-    $authKeyTid = $parts[0];
-    $authKeyUid = $userAuthenticateKey = $parts[1];
-    $subAuthkey = sprintf("%s|%s", $authKeyTid, $authKeyUid);
-    //check ReAnnounce
-    $lockParams = [
-        'user' => $authKeyUid,
-        'info_hash' => $info_hash
-    ];
-
-    $lockString = http_build_query($lockParams);
-    $lockKey = "isReAnnounce:" . md5($lockString);
-    if (!$redis->set($lockKey, TIMENOW, ['nx', 'ex' => $reAnnounceInterval])) {
-        $isReAnnounce = true;
-    }
-    $reAnnounceCheckByAuthKey = "reAnnounceCheckByAuthKey:$subAuthkey";
-    if (!$isStoppedOrCompleted && !$isReAnnounce && !$redis->set($reAnnounceCheckByAuthKey, TIMENOW, ['nx', 'ex' => $frequencyInterval])) {
-        $msg = "Request too frequent(a)";
-        do_log(sprintf("[ANNOUNCE] %s key: %s already exists, value: %s", $msg, $reAnnounceCheckByAuthKey, TIMENOW));
-        warn($msg, 300);
-    }
-    if ($redis->get("$authKeyInvalidKey:$authkey")) {
-        $msg = "Invalid authkey";
-        do_log("[ANNOUNCE] $msg");
-        warn($msg);
-    }
-} elseif (!empty($_GET['passkey'])) {
+if (!empty($_GET['passkey'])) {
     $passkey = $userAuthenticateKey = $_GET['passkey'];
     if ($redis->get("$passkeyInvalidKey:$passkey")) {
         $msg = "Passkey invalid";
@@ -81,7 +49,7 @@ if (!empty($_GET['authkey'])) {
         $isReAnnounce = true;
     }
 } else {
-    warn("Require passkey or authkey");
+    warn("Require passkey");
 }
 
 if ($redis->get("$torrentNotExistsKey:$info_hash")) {
@@ -95,20 +63,7 @@ if (!$isStoppedOrCompleted && !$isReAnnounce && !$redis->set($torrentReAnnounceK
     do_log(sprintf("[ANNOUNCE] %s key: %s already exists, value: %s", $msg, $torrentReAnnounceKey, TIMENOW));
     warn($msg, 300);
 }
-
-
 dbconn_announce();
-//check authkey
-if (!empty($_REQUEST['authkey'])) {
-    try {
-        $GLOBALS['passkey'] = $_GET['passkey'] = get_passkey_by_authkey($_REQUEST['authkey']);
-    } catch (\Exception $exception) {
-        $redis->set("$authKeyInvalidKey:".$_REQUEST['authkey'], TIMENOW, ['ex' => 3600*24]);
-        warn($exception->getMessage());
-    }
-}
-
-
 
 //4. GET IP AND CHECK PORT
 $ip = getip();	// avoid to get the spoof ip from some agent
@@ -229,12 +184,6 @@ if (!$torrent) {
 }
 $GLOBALS['torrent'] = $torrent;
 $torrentid = $torrent["id"];
-if (isset($authKeyTid) && $authKeyTid != $torrentid) {
-    $redis->set("$authKeyInvalidKey:$authkey", TIMENOW, ['ex' => 3600*24]);
-    $msg = "Invalid authkey: $authkey 2";
-    do_log("[ANNOUNCE] $msg");
-    warn($msg);
-}
 if ($torrent['banned'] == 'yes') {
     if (!user_can('seebanned', false, $az['id'])) {
         err("torrent banned");

public/css/filament/forms/forms.css

@@ -13,7 +13,7 @@ cropperjs/dist/cropper.min.css:
 
 filepond/dist/filepond.min.css:
   (*!
-   * FilePond 4.32.5
+   * FilePond 4.32.6
    * Licensed under MIT, https://opensource.org/licenses/MIT/
    * Please visit https://pqina.nl/filepond/ for details.
    *)

public/details.php

@@ -11,8 +11,9 @@ if (!isset($id) || !$id)
 die();
 
 $taxonomyFields = "sources.name AS source_name, media.name AS medium_name, codecs.name AS codec_name, standards.name AS standard_name, processings.name AS processing_name, teams.name AS team_name, audiocodecs.name AS audiocodec_name";
-$res = sql_query("SELECT torrents.cache_stamp, torrents.sp_state, torrents.url, torrents.small_descr, torrents.seeders, torrents.banned, torrents.leechers, torrents.info_hash, torrents.filename, nfo, LENGTH(torrents.nfo) AS nfosz, torrents.last_action, torrents.name, torrents.owner, torrents.save_as, torrents.descr, torrents.visible, torrents.size, torrents.added, torrents.views, torrents.hits, torrents.times_completed, torrents.id, torrents.type, torrents.numfiles, torrents.anonymous, torrents.pt_gen, torrents.technical_info, torrents.hr, torrents.promotion_until, torrents.promotion_time_type, torrents.approval_status, torrents.price,
-       categories.name AS cat_name, categories.mode as search_box_id, $taxonomyFields
+$extraFields = "torrent_extras.descr, torrent_extras.nfo, LENGTH(torrent_extras.nfo) AS nfosz, torrent_extras.media_info as technical_info";
+$res = sql_query("SELECT torrents.cache_stamp, torrents.sp_state, torrents.url, torrents.small_descr, torrents.seeders, torrents.banned, torrents.leechers, torrents.info_hash, torrents.filename, torrents.last_action, torrents.name, torrents.owner, torrents.save_as, torrents.visible, torrents.size, torrents.added, torrents.views, torrents.hits, torrents.times_completed, torrents.id, torrents.type, torrents.numfiles, torrents.anonymous, torrents.hr, torrents.promotion_until, torrents.promotion_time_type, torrents.approval_status, torrents.price,
+       categories.name AS cat_name, categories.mode as search_box_id, $taxonomyFields, $extraFields
 FROM torrents LEFT JOIN categories ON torrents.category = categories.id
     LEFT JOIN sources ON torrents.source = sources.id
     LEFT JOIN media ON torrents.medium = media.id
@@ -21,6 +22,7 @@ FROM torrents LEFT JOIN categories ON torrents.category = categories.id
     LEFT JOIN processings ON torrents.processing = processings.id
     LEFT JOIN teams ON torrents.team = teams.id
     LEFT JOIN audiocodecs ON torrents.audiocodec = audiocodecs.id
+    LEFT JOIN torrent_extras ON torrents.id = torrent_extras.torrent_id
 WHERE torrents.id = $id LIMIT 1")
 or sqlerr();
 $row = mysql_fetch_array($res);
@@ -398,11 +400,6 @@ JS;
 				echo $Cache->next_row();
 		}
 	}
-
-	if (get_setting('main.enable_pt_gen_system') == 'yes' && !empty($row['pt_gen'])) {
-	    $ptGen = new \Nexus\PTGen\PTGen();
-	    $ptGen->updateTorrentPtGen($row);
-    }
 		if (!empty($otherCopiesIdArr))
 		{
 //			$where_area = " url = " . sqlesc((int)$imdb_id) ." AND torrents.id != ".sqlesc($id);

public/download.php

@@ -139,7 +139,6 @@ if (strlen($CURUSER['passkey']) != 32) {
 	$CURUSER['passkey'] = md5($CURUSER['username'].date("Y-m-d H:i:s").$CURUSER['passhash']);
 	sql_query("UPDATE users SET passkey=".sqlesc($CURUSER['passkey'])." WHERE id=".sqlesc($CURUSER['id']));
 }
-$trackerReportAuthKey = $torrentRep->getTrackerReportAuthKey($id, $CURUSER['id'], true);
 $dict = \Rhilip\Bencode\Bencode::load($fn);
 $dict['announce'] = $ssl_torrent . $base_announce_url . "?passkey=" . $CURUSER['passkey'];
 do_log(sprintf("[ANNOUNCE_URL], user: %s, torrent: %s, url: %s", $CURUSER['id'] ?? '', $id, $dict['announce']));
@@ -221,6 +220,5 @@ else
 //header ("Content-Disposition: attachment; filename=".$row["filename"]."");
 //ob_implicit_flush(true);
 //print(benc($dict));
-\Nexus\Database\NexusDB::cache_put("authkey2passkey:$trackerReportAuthKey", $CURUSER['passkey'], 3600*24);
 echo \Rhilip\Bencode\Bencode::encode($dict);
 ?>

public/takeedit.php

@@ -25,7 +25,7 @@ if (!$id)
 	die();
 
 
-$res = sql_query("SELECT id, category, owner, filename, save_as, anonymous, picktype, picktime, added, pt_gen, banned FROM torrents WHERE id = ".mysql_real_escape_string($id));
+$res = sql_query("SELECT id, category, owner, filename, save_as, anonymous, picktype, picktime, added, banned FROM torrents WHERE id = ".mysql_real_escape_string($id));
 $row = mysql_fetch_array($res);
 $torrentAddedTimeString = $row['added'];
 if (!$row)
@@ -35,6 +35,7 @@ if ($CURUSER["id"] != $row["owner"] && !user_can('torrentmanage'))
 	bark($lang_takeedit['std_not_owner']);
 $oldcatmode = get_single_value("categories","mode","WHERE id=".sqlesc($row['category']));
 $updateset = array();
+$extraUpdate = [];
 
 //$fname = $row["filename"];
 //preg_match('/^(.+)\.torrent$/si', $fname, $matches);
@@ -45,19 +46,23 @@ $url = parse_imdb_id($_POST['url'] ?? '');
 /**
  * add PT-Gen
  * @since 1.6
+ *
+ * @deprecated
+ * @since 1.9
  */
-if (!empty($_POST['pt_gen'])) {
-    $postPtGen = $_POST['pt_gen'];
-    $existsPtGenInfo = json_decode($row['pt_gen'], true) ?? [];
-    $ptGen = new \Nexus\PTGen\PTGen();
-    if ($postPtGen != $ptGen->getLink($existsPtGenInfo)) {
-        $updateset[] = "pt_gen = " . sqlesc($postPtGen);
-    }
-} else {
-    $updateset[] = "pt_gen = ''";
-}
+//if (!empty($_POST['pt_gen'])) {
+//    $postPtGen = $_POST['pt_gen'];
+//    $existsPtGenInfo = json_decode($row['pt_gen'], true) ?? [];
+//    $ptGen = new \Nexus\PTGen\PTGen();
+//    if ($postPtGen != $ptGen->getLink($existsPtGenInfo)) {
+//        $updateset[] = "pt_gen = " . sqlesc($postPtGen);
+//    }
+//} else {
+//    $updateset[] = "pt_gen = ''";
+//}
 
-$updateset[] = "technical_info = " . sqlesc($_POST['technical_info'] ?? '');
+//$updateset[] = "technical_info = " . sqlesc($_POST['technical_info'] ?? '');
+$extraUpdate["media_info"] = $_POST['technical_info'] ?? '';
 $torrentOperationLog = [];
 
 
@@ -70,8 +75,11 @@ if ($nfoaction == "update")
 	if ($nfofile['size'] > 65535)
 		bark($lang_takeedit['std_nfo_too_big']);
 	$nfofilename = $nfofile['tmp_name'];
-	if (@is_uploaded_file($nfofilename) && @filesize($nfofilename) > 0)
-		$updateset[] = "nfo = " . sqlesc(str_replace("\x0d\x0d\x0a", "\x0d\x0a", file_get_contents($nfofilename)));
+	if (@is_uploaded_file($nfofilename) && @filesize($nfofilename) > 0) {
+//        $updateset[] = "nfo = " . sqlesc(str_replace("\x0d\x0d\x0a", "\x0d\x0a", file_get_contents($nfofilename)));
+        $extraUpdate["nfo"] = str_replace("\x0d\x0d\x0a", "\x0d\x0a", file_get_contents($nfofilename));
+    }
+
 	$Cache->delete_value('nfo_block_torrent_id_'.$id);
 }
 elseif ($nfoaction == "remove"){
@@ -93,7 +101,8 @@ if ($oldcatmode != $newcatmode && !$allowmove)
 	bark($lang_takeedit['std_cannot_move_torrent']);
 $updateset[] = "anonymous = '" . (!empty($_POST["anonymous"]) ? "yes" : "no") . "'";
 $updateset[] = "name = " . sqlesc($name);
-$updateset[] = "descr = " . sqlesc($descr);
+//$updateset[] = "descr = " . sqlesc($descr);
+$extraUpdate["descr"] = $descr;
 $updateset[] = "url = " . sqlesc($url);
 $updateset[] = "small_descr = " . sqlesc($_POST["small_descr"]);
 //$updateset[] = "ori_descr = " . sqlesc($descr);
@@ -232,7 +241,9 @@ if (user_can('torrent-set-price') && $paidTorrentEnabled) {
 $sql = "UPDATE torrents SET " . join(",", $updateset) . " WHERE id = $id";
 do_log("[UPDATE_TORRENT]: $sql");
 $affectedRows = sql_query($sql) or sqlerr(__FILE__, __LINE__);
-fire_event("torrent_updated", \App\Models\Torrent::query()->find($id), $torrentOld);
+$torrentInfo = \App\Models\Torrent::query()->find($id);
+$torrentInfo->extra()->update($extraUpdate);
+fire_event("torrent_updated", $torrentInfo, $torrentOld);
 $dateTimeStringNow = date("Y-m-d H:i:s");
 
 /**

public/takeupload.php

@@ -330,8 +330,8 @@ $insert = [
     'type' => $type,
     'url' => $url,
     'small_descr' => $small_descr,
-    'descr' => $descr,
-    'ori_descr' => $descr,
+//    'descr' => $descr,
+//    'ori_descr' => $descr,
     'category' => $catid,
     'source' => $sourceid,
     'medium' => $mediumid,
@@ -346,12 +346,21 @@ $insert = [
     'last_action' => $dateTimeStringNow,
     'nfo' => $nfo,
     'info_hash' => $infohash,
-    'pt_gen' => $_POST['pt_gen'] ?? '',
-    'technical_info' => $_POST['technical_info'] ?? '',
+//    'pt_gen' => $_POST['pt_gen'] ?? '',
+//    'technical_info' => $_POST['technical_info'] ?? '',
     'cover' => $cover,
     'pieces_hash' => sha1($info['pieces']),
     'cache_stamp' => time(),
 ];
+/**
+ * migrate to extra table and remove pt_gen field
+ * @since 1.9
+ */
+$extra = [
+    'descr' => $descr,
+    'media_info' => $_POST['technical_info'] ?? '',
+    'nfo' => $nfo,
+];
 if (isset($_POST['hr'][$catmod]) && isset(\App\Models\Torrent::$hrStatus[$_POST['hr'][$catmod]]) && user_can('torrent_hr')) {
     $insert['hr'] = $_POST['hr'][$catmod];
 }
@@ -432,6 +441,7 @@ if (!empty($tagIdArr)) {
 foreach ($filelist as $file) {
 	@sql_query("INSERT INTO files (torrent, filename, size) VALUES ($id, ".sqlesc($file[0]).",".$file[1].")");
 }
+\App\Models\TorrentExtra::query()->create($extra);
 
 //===add karma
 KPS("+",$uploadtorrent_bonus,$CURUSER["id"]);

public/usercp.php

@@ -844,17 +844,16 @@ EOD;
 				if ($CURUSER['privacy'] != $privacy) $privacyupdated = 1;
 
 				$user = $CURUSER["id"];
-				$query = sprintf("UPDATE users SET " . implode(",", $updateset) . " WHERE id ='%s'",
-				mysql_real_escape_string($user));
-				$result = sql_query($query);
-				if (!$result)
-				sqlerr(__FILE__,__LINE__);
-
-				if (!empty($_REQUEST['resetauthkey']) && $_REQUEST['resetauthkey'] == 1) {
-				    //reset authkey
-				    $torrentRep = new \App\Repositories\TorrentRepository();
-				    $torrentRep->resetTrackerReportAuthKeySecret($user);
-                }
+                \Nexus\Database\NexusDB::transaction(function () use ($user, $updateset) {
+                    $query = sprintf("UPDATE users SET " . implode(",", $updateset) . " WHERE id ='%s'", mysql_real_escape_string($user));
+                    sql_query($query);
+                    if (!empty($_REQUEST['resetauthkey']) && $_REQUEST['resetauthkey'] == 1) {
+                        //reset authkey
+                        $torrentRep = new \App\Repositories\TorrentRepository();
+                        $torrentRep->resetTrackerReportAuthKeySecret($user);
+                    }
+                    do_action("usercp_security_update", $_POST);
+                });
 				$to = "usercp.php?action=security&type=saved";
 				if ($changedemail == 1)
 				$to .= "&mail=1";
@@ -891,7 +890,8 @@ EOD;
 				print("<input type=\"hidden\" name=\"two_step_secret\" value=\"$two_step_secret\">");
 				print("<input type=\"hidden\" name=\"two_step_code\" value=\"$two_step_code\">");
 				Print("<tr><td class=\"rowhead nowrap\" valign=\"top\" align=\"right\" width=1%>".$lang_usercp['row_security_check']."</td><td valign=\"top\" align=\"left\" width=\"99%\"><input type=password name=oldpassword style=\"width: 200px\"><br /><font class=small>".$lang_usercp['text_security_check_note']."</font></td></tr>\n");
-				submit();
+				do_action("usercp_security_update_confirm", $_POST);
+                submit();
 				print("</table>");
 				stdfoot();
 				die;
@@ -900,7 +900,7 @@ EOD;
 				print("<tr><td colspan=2 class=\"heading\" valign=\"top\" align=\"center\"><font color=red>".$lang_usercp['text_saved'].($_GET["mail"] == "1" ? $lang_usercp['std_confirmation_email_sent'] : "")." ".($_GET["passkey"] == "1" ? $lang_usercp['std_passkey_reset'] : "")." ".($_GET["password"] == "1" ? $lang_usercp['std_password_changed'] : "")." ".($_GET["privacy"] == "1" ? $lang_usercp['std_privacy_level_updated'] : "")."</font></td></tr>\n");
 			form ("security");
 			tr_small($lang_usercp['row_reset_passkey'],"<input type=checkbox name=resetpasskey value=1 />".$lang_usercp['checkbox_reset_my_passkey']."<br /><font class=small>".$lang_usercp['text_reset_passkey_note']."</font>", 1);
-			tr_small($lang_usercp['row_reset_authkey'],"<input type=checkbox name=resetauthkey value=1 />".$lang_usercp['checkbox_reset_my_authkey']."<br /><font class=small>".$lang_usercp['text_reset_authkey_note']."</font>", 1);
+//			tr_small($lang_usercp['row_reset_authkey'],"<input type=checkbox name=resetauthkey value=1 />".$lang_usercp['checkbox_reset_my_authkey']."<br /><font class=small>".$lang_usercp['text_reset_authkey_note']."</font>", 1);
 
 			//two step authentication
             if (!empty($CURUSER['two_step_secret'])) {
@@ -926,7 +926,8 @@ EOD;
 
 			if ($disableemailchange != 'no' && $smtptype != 'none') //system-wide setting
 				tr_small($lang_usercp['row_email_address'], "<input type=\"text\" name=\"email\" style=\"width: 200px\" value=\"" . htmlspecialchars($CURUSER["email"]) . "\" /> <br /><font class=small>".$lang_usercp['text_email_address_note']."</font>", 1);
-			tr_small($lang_usercp['row_change_password'], "<input type=\"password\" name=\"chpassword\" style=\"width: 200px\" />", 1);
+            do_action("usercp_security_setting_form");
+            tr_small($lang_usercp['row_change_password'], "<input type=\"password\" name=\"chpassword\" style=\"width: 200px\" />", 1);
 			tr_small($lang_usercp['row_type_password_again'], "<input type=\"password\" name=\"passagain\" style=\"width: 200px\" />", 1);
 			tr_small($lang_usercp['row_privacy_level'],  priv("normal", $lang_usercp['radio_normal']) . " " . priv("low", $lang_usercp['radio_low']) . " " . priv("strong", $lang_usercp['radio_strong']), 1);
 			submit();
@@ -1119,6 +1120,81 @@ JS;
 }
 //end seed box
 
+//token start
+$token = '';
+$tokenLabel = nexus_trans("token.label");
+$columnName = nexus_trans('label.name');
+$columnCreatedAt = nexus_trans('label.created_at');
+$actionCreate = nexus_trans('label.create');
+//$res = \App\Models\SeedBoxRecord::query()->where('uid', $CURUSER['id'])->where('type', \App\Models\SeedBoxRecord::TYPE_USER)->get();
+//if ($res->count() > 0)
+//{
+//    $seedBox .= "<table border='1' cellspacing='0' cellpadding='5' id='seed-box-table'><tr><td class='colhead'>ID</td><td class='colhead'>{$columnOperator}</td><td class='colhead'>{$columnBandwidth}</td><td class='colhead'>{$columnIP}</td><td class='colhead'>{$columnComment}</td><td class='colhead'>{$columnStatus}</td><td class='colhead'></td></tr>";
+//    foreach ($res as $seedBoxRecord)
+//    {
+//        $seedBox .= "<tr>";
+//        $seedBox .= sprintf('<td>%s</td>', $seedBoxRecord->id);
+//        $seedBox .= sprintf('<td>%s</td>', $seedBoxRecord->operator);
+//        $seedBox .= sprintf('<td>%s</td>', $seedBoxRecord->bandwidth ?: '');
+//        $seedBox .= sprintf('<td>%s</td>', $seedBoxRecord->ip ?: sprintf('%s ~ %s', $seedBoxRecord->ip_begin, $seedBoxRecord->ip_end));
+//        $seedBox .= sprintf('<td>%s</td>', $seedBoxRecord->comment);
+//        $seedBox .= sprintf('<td>%s</td>', $seedBoxRecord->statusText);
+//        $seedBox .= sprintf('<td><img style="cursor: pointer" class="staff_delete remove-seed-box-btn" src="pic/trans.gif" alt="D" title="%s" data-id="%s"></td>', $lang_functions['text_delete'], $seedBoxRecord->id);
+//        $seedBox .= "</tr>";
+//    }
+//    $seedBox .= '</table>';
+//}
+$token .= sprintf('<div><input type="button" id="add-token-box-btn" value="%s"/></div>', $actionCreate);
+tr_small($tokenLabel, $token, 1);
+$tokenFoxForm = <<<FORM
+<div class="form-box">
+<form id="token-box-form">
+    <div class="form-control-row">
+        <div class="label">{$columnName}</div>
+        <div class="field"><input type="text" name="params[name]"></div>
+    </div>
+</form>
+</div>
+FORM;
+    $tokenBoxJs = <<<JS
+jQuery('#add-token-box-btn').on('click', function () {
+    layer.open({
+        type: 1,
+        title: "{$tokenLabel} {$actionCreate}",
+        content: `$tokenFoxForm`,
+        btn: ['OK'],
+        btnAlign: 'c',
+        yes: function () {
+            let params = jQuery('#token-box-form').serialize()
+            jQuery.post('ajax.php', params + "&action=addToken", function (response) {
+                console.log(response)
+                if (response.ret != 0) {
+                    layer.alert(response.msg)
+                    return
+                }
+                window.location.reload()
+            }, 'json')
+        }
+    })
+});
+jQuery('#token-box-table').on('click', '.remove-token-box-btn', function () {
+    let params = {action: "removeToken", params: {id: jQuery(this).attr("data-id")}}
+    layer.confirm("{$lang_functions['std_confirm_remove']}", {btnAlign: 'c'}, function (index) {
+        jQuery.post('ajax.php', params, function (response) {
+            console.log(response)
+            if (response.ret != 0) {
+                layer.alert(response.msg)
+                return
+            }
+            window.location.reload()
+        }, 'json')
+    })
+});
+JS;
+    \Nexus\Nexus::js($tokenBoxJs, 'footer', false);
+
+//token end
+
 if ($forumposts)
 	tr($lang_usercp['row_forum_posts'], $forumposts." [<a href=\"userhistory.php?action=viewposts&id=".$CURUSER['id']."\" title=\"".$lang_usercp['link_view_posts']."\">".$lang_usercp['text_view']."</a>] (".$dayposts.$lang_usercp['text_posts_per_day']."; ".$percentages.$lang_usercp['text_of_total_posts'].")", 1);
 ?>

public/userdetails.php

@@ -496,9 +496,22 @@ if (user_can('prfmanage') && $user["class"] < get_user_class())
 
 	if (user_can('cruprfmanage'))
 	{
-		$modcomment = htmlspecialchars($user["modcomment"]);
+        $modcomment = \App\Models\UserModifyLog::query()
+            ->where("user_id", $user["id"])
+            ->orderBy("id", "desc")
+            ->limit(20)
+            ->get()
+            ->implode("content", "\n")
+        ;
 		tr($lang_userdetails['row_comment'], "<textarea cols=\"60\" rows=\"6\" name=\"modcomment\">".$modcomment."</textarea>", 1);
-		$bonuscomment = htmlspecialchars($user["bonuscomment"]);
+        $bonuscomment = \App\Models\BonusLogs::query()
+            ->where("uid", $user["id"])
+            ->orderBy("id", "desc")
+            ->limit(20)
+            ->get()
+            ->map(fn ($item) => sprintf("%s - %s", $item->created_at->format("Y-m-d"), $item->comment))
+            ->implode("\n")
+        ;
 		tr($lang_userdetails['row_seeding_karma'], "<textarea cols=\"60\" rows=\"6\" name=\"bonuscomment\" readonly=\"readonly\">".$bonuscomment."</textarea>", 1);
 	}
 	$warned = $user["warned"] == "yes";

public/viewnfo.php

@@ -8,7 +8,7 @@ $id = intval($_GET["id"] ?? 0);
 if (!user_can('viewnfo') || !is_valid_id($id) || $enablenfo_main != 'yes')
 permissiondenied();
 
-$r = sql_query("SELECT name,nfo FROM torrents WHERE id=$id") or sqlerr();
+$r = sql_query("SELECT torrents.name, torrent_extras.nfo FROM torrents left join torrent_extras on torrents.id=torrent_extras.torrent_id WHERE torrents.id=$id") or sqlerr();
 $a = mysql_fetch_assoc($r) or die($lang_viewnfo['std_puke']);
 
 //error_reporting(E_ERROR | E_WARNING | E_PARSE | E_NOTICE);