[MC] Downloads Manager 1.2.5

Downloads Manager 1.2.5 makes every console and log message translatable, keeps scan results readable in any language, and fixes direct URL downloads being refused on PHP 8.3. It requires [MC] Core Library 1.0.4: update Core Library first.

Changelog

Translations

• Console command help and output, the health check, scan details and error log messages now use phrases, so they can be translated
• Virus scan details are stored as codes and shown in the viewer's language. Scans recorded before this update keep their original text.

Bug fixes

• On PHP 8.3 and later, a direct URL download whose host resolves to an IPv4-mapped IPv6 address is judged by the IPv4 address it carries. Previously every such address was refused as reserved, even a public one. Private addresses are still refused.
• The download auto-watch setting on the account Preferences page is placed more reliably when other add-ons also change that part of the page

Other changes

• Requires [MC] Core Library 1.0.4
• The options group sits in alphabetical order among the other MC add-ons
• Custom code that reacts to a failed file scan now receives a scan detail code instead of English text

Documentation

• Full changelog

Downloads Manager 1.2.4 alerts members who are mentioned in a comment and lines up the scan icon under the download button. This version requires PHP 8.1.

Changelog

Bug fixes

• Mentioning a member in a comment, or adding a mention while editing one, now sends them an alert. Previously the comment saved but the poster saw an error and no alert was sent.
• The scan icon beside the version and file size under the download button sits level with the text instead of below it

Upgrade notes

• Requires PHP 8.1 or later

Documentation

• Full changelog

We have released a new maintenance update focusing on stability. This update requires Core Library 1.0.3.

Changes

• The admin audit log now uses the shared audit log from Core Library, so it looks and works the same as the audit logs in other add-ons.
• Filters live in a Filters menu, and each active filter shows as a chip you can remove on its own.
• Filter by actor using their username. Entries by deleted users can still be filtered.
• Filter by content type, content ID and action. The action list is grouped by content type.
• Each entry shows a colored label for how serious the action is.
• The entry details page shows what changed, with readable field names and links to the downloads, versions, files and users involved.
• CSV export now includes the whole filtered log instead of stopping at 10,000 rows. Dates are in your timezone, with the offset included.

Performance

• Filtering by content ID is faster on large logs.

Bug fixes

• Row highlighting by severity in the audit log now shows. It never appeared before.
• Settings shown as yes or no in an entry's details are no longer treated as links to records.
• A content ID with no content type selected is now ignored instead of being applied.
• Uninstalling now also clears the cached audit log summary.

We have released a new version focused on performance and stability along with a few changes.

Important change that will affect every add-on:

All of our add-ons are now using Core Library in order to maintain shared helpers and utilities across add-ons for easier maintenance and to keep add-ons cleaner. Core Library also covers our branding for all add-ons in one switch without having to turn it off in every add-on.

This update will require Core Library 1.0.1.

Changes

• Downloads Manager admin pages now have their own admin permission, "Manage [MC] Downloads Manager". Super administrators are unaffected. Other administrators need it granted under Admin > Administrators.
• API keys with super-user access now only skip permission checks when the request asks for it with api_bypass_permissions=1, matching XenForo. Creating downloads, comments and reviews through the API now needs a user.
• The "Remove branding" option has moved to [MC] Core Library and now covers every MC add-on. Your existing setting is kept.

Performance

• New-version and comment notifications to large watcher lists are sent in the background instead of slowing down the upload.
• "Download all as ZIP" streams the saved archive directly instead of copying it on every download. Old archives are cleaned up.
• External files are no longer re-read three times after they are fetched.
• Search results, alerts, watched lists and author pages use fewer database queries.
• The option tabs code only runs on the options page.

Bug fixes

• Links stop working when the download is deleted, unapproved or still a draft, and for banned users.
• Links locked to an IP address are checked on every request.
• Guests and members who cannot view the category can now use a link shared with them.
• Previews no longer show files that are quarantined, still being scanned or failed checks.
• "Download all as ZIP" is rebuilt when a file's scan result changes, so a file quarantined later is no longer inside it.
• A file replaced while the old one was being scanned no longer inherits the old file's result.
• Periodic rescans keep clean files downloadable while they run. A scanner outage no longer quarantines the whole library. Only an infected result quarantines a previously clean file.
• Download gates from other add-ons, such as the NSFW gate, now apply to downloads and ZIP downloads, not only previews.
• Download links handed out after passing the gates only work for the visitor who passed them.
• Rate limits, CAPTCHA and IP-locked share links can no longer be bypassed with a faked IP header.
• An occasional "rate limit reached" on a first download no longer happens.
• Authors can no longer approve their own downloads through inline moderation.
• Approve and release in the moderation queue only act on items still waiting for that action.
• Handling reports now needs moderator permissions, so authors cannot close reports about their own content.
• Attaching an existing thread as a download's discussion now needs you to have started it or be able to edit it.
• Reviews can only be linked to a version of the download being reviewed.
• Comments and reviews awaiting approval now appear in the approval queue. Existing ones are added during the upgrade.
• Versions awaiting approval now appear in the approval queue. Rejecting a version no longer leaves its files behind.
• A version held as spam or scheduled for later no longer becomes the current version early.
• Version and file endpoints no longer return unpublished, scheduled or deleted content.
• Posting a comment uses the same checks as the website.
• Category changes need the new admin permission.
• Share token lists now respect the chosen sort order.
• Fetching from private network addresses used by some cloud providers is now blocked.
• Fetching stops at the category's file size limit instead of trusting the size the remote server reports.
• Large external files no longer fail after 60 seconds.
• Links to servers that reject quick checks, such as signed S3 links, are no longer marked as dead.
• Dead link checks no longer stall when many files have checking turned off.
• Archive previews no longer use PHP's Phar extension.
• Soft deleting and restoring a download now updates counts, search, the news feed and tags.
• Batch hard delete in the admin area now does the full cleanup.
• Review counts are now consistent everywhere.
• Review fields can now use every field type, including stars, date and colour.
• Deleting the last visible version no longer leaves a broken current version.
• Integrity checks no longer report files that are still being fetched as missing.
• Temporary upload files are cleaned up when saving a file fails.
• The listing filter no longer shows old results when typing quickly, keeps the list when a request fails, and no longer fills your browser history.
• The Download button no longer stays stuck loading after closing a password or CAPTCHA prompt.
• The "too many files" upload message now shows proper text.
• The magnet link fallback button now passes the full magnet link to your torrent client.

We have released a new maintenance update that fixes a critical issue with XenForo 2.3.13. Please update to the latest version before upgrading.

• XenForo 2.3.13 introduces new security measures that caused a fatal error regarding our shared copyright footer.

We have released a major new version with new features

Features

Virus scanning

• Uploaded files can now be scanned for malware before they become downloadable
• Supported engines
  • ClamAV (daemon)
  • VirusTotal
• Files with detected threats are quarantined and require action before they become available or deleted
• Scans run in the background so uploads are never blocked waiting on an engine
• Configurable fail modes either hold the file for a moderator or release with a warning flag
• Per-category scan modes
• Integrates with [MC] Quarantine's engines
• Scan badges on downloads so members can see results for themeselves

Unified moderation queue

• Moderation queue now includes a unified front including pending downloads, quarantined files, and dead links.
• Available both in the Admin CP and front end moderator queue
• Subsequently, the dead links page has been removed and merged into the moderation queue

Admin CP dashboard

• All new dashboard available in the Admin CP for quick glance at various information blocks including download stats, activity over time, top downloads, virus scan state, storage, recent activity and items that need attention

We have released a new version with new features, improvements and bug fixes!

• We have a brand new layout option for the index: Card layout! This layout includes taller cards and features the download's cover! Requested by @ratix_gunz
  • Full element visibility options located in style properties
• In addition to the card layout, we have also included a Global cover option, so ALL downloads can have a beautiful cover even if they didn't upload one. Without a default cover set, we have a generic striped CSS banner being used.
  • Global cover < Category cover < Individual cover
• Modern filter improvements!
  • Added created by and watching filter.
  • Added ascending/descending filter
• Added a loading spinner to the download button! This will generally, only appear during slow internet connections while the download is being served to the user. It does NOT track download progress. There isn't a fully reliable way to do that in all scenarios, so leaving that task with your browser.
• Fixed an issue where text overflowed outside the download button. Reported by @ratix_gunz
• Fixed an issue where category titles were overflowing outside their chips on the modern filter. Reported by @ratix_gunz
• Other small performance improvements

You can view the new layout on our demo site.

We have released a new version with one improvement and a few bug fixes:

• New style property to expand collapsed changelog by default
• Fixed an issue where the discussion_type was not being attached on changed threads, only automatically created threads
• Comments API now reject hard-delete with 404 unless caller is super user or has appropriate permission
• Fixed an issue where user could preview certain files on version view page without appropriate permission

A new update has been released that adds new features, expanded API/webhooks, and many improvements and bug fixes.

New Features

• Per-download criteria gates. Authors can now attach a criteria gate to an individual download, in addition to any gate set on its category. The two are evaluated together, with author and team member bypass. Admins get a per-gate "allow on downloads" toggle and can restrict which user groups may apply a gate.
• Reaction gates. Downloads can be gated behind a reaction, configurable per-download and per-category, with authors and team members always bypassing. A reaction-lock mode controls whether a user can change or remove their reaction after reacting, with an optional relock if the reaction is later removed.
• Expanded REST API.
  • Reviews (new): List, get, create, delete (soft/hard), add / remove author reply and enriched results (reactions, url, can-edit flag, core columns)
  • Downloads: Get now includes with_dependencies and with_field_valuesand watch/unwatch toggle endpoints
  • Categories: Watch / unwatch toggle endpoint, custom field read endpoints, review field read entpoints
  • Share tokens (new): List, create, get, revoke
  • Prefixes: Prefix read endpoints (list / single), prefix group endpoints (list / single)
  • Custom fields: Field read endpoints (list / single)
• Expanded webhook coverage
  • Reviews: Author reply added / removed, state change (also fires on soft-delete and undelete)
  • Downloads: Watch / unwatch toggle
  • Categories (new): Insert, update, delete, watch / unwatch, thread-settings changed
  • Share tokens (new): Issued, used, revoked
  • Team members: Added, removed, updated

Bug Fixes/Improvements

• Comment soft-delete retention is now measured from a dedicated deleted-date column.
• API comment posting now checks the comment permission, and the single-primary-file rule is enforced.
• Review IP addresses are logged after save
• SVG and SVGZ previews now render inside a CSP sandbox.
• Download and version creation is now wrapped in a single transaction.
• Comment counters are maintained correctly on soft-delete and restore.
• Removed duplicate audit-log rows created during API create, edit, and delete.
• Share-token redirects now use a 302 (the previous 301 was cacheable).
• Download statistics are now bucketed in UTC for consistent daily totals.
• Corrected the orphan-cleanup count report, and closed a ZIP temporary-file leak

With criteria gates you will now be able to allow them to be used on individual downloads, instead of categories only, as well as which user groups can use specific gates. User groups will need to have permission to apply criteria gates to their downloads.

If both the download and category it resides in has gates, both must be passed to access content.



Users will be able to apply that gate on their downloads when uploading or editing.



With reaction gates, you can enable them per category and/or per download. Reaction gates always require a positive reaction. If the category requires reactions, users will not be able to set or disable the reaction requirement. Of course, requiring reactions on individual downloads will require permission.

Same mechanism for authors requiring reactions on, as the other individual gates.



If a download has both criteria restrictions and reaction requirements, all the requirements will be listed together.

We have finally released our importers for Downloads Manager. Importers are available as a separate add-on for customers free of charge.

Two sources are supported:

• XenForo Resource Manager (2.3+) on the same site. Resources, versions, files, custom fields, prefixes, reviews, watchers, tags, icons and discussion thread links are all carried across.
• Invision Community 4 (Downloads) from a separate installation. The importer connects to your IC4 database, reads files from the IC4 uploads folder, and uses the import log from a prior IC4 forum import to attribute downloads to the right XenForo members and link them to the right threads.

For every category, prefix group, prefix and custom field, you decide whether to map it to an existing record in Downloads Manager, create a new one, or skip it. Imports are resumable, will not duplicate rows if re-run, and finish with an automatic rebuild of category counters and the prefix, field and content-permission caches.

Requirements: XenForo 2.3.0 or newer and [MC] Downloads Manager 1.0.4 or newer. The XFRM importer also needs XenForo Resource Manager 2.3.0 or newer installed and active. The IC4 importer also needs access to the IC4 database, read access to the IC4 uploads folder, and a prior IC4 forum import.

We recommend running an import against a copy of your site before importing into production.

Area	XFRM	IC4
Categories (tree preserved)	✓	✓
Prefix groups and prefixes	✓	X
Custom fields	✓	✓
Custom field values	✓	✓
Downloads (state, author, counters, description)	✓	✓
Versions	✓	✓
Binary files	✓	✓
URL type files	X	✓
Resource icons	✓	X
Screenshots (appended to description as attachments)	X	✓
Description and changelog attachments	✓	X
Reviews	✓	✓
Watchers / follows	✓	✓
Tags	✓	✓
Discussion thread linking	✓	✓ (via forum-import log)