[MC] Downloads Manager 1.2.3

We have released a new maintenance update focusing on stability. This update requires Core Library 1.0.3.

Changes

• The admin audit log now uses the shared audit log from Core Library, so it looks and works the same as the audit logs in other add-ons.
• Filters live in a Filters menu, and each active filter shows as a chip you can remove on its own.
• Filter by actor using their username. Entries by deleted users can still be filtered.
• Filter by content type, content ID and action. The action list is grouped by content type.
• Each entry shows a colored label for how serious the action is.
• The entry details page shows what changed, with readable field names and links to the downloads, versions, files and users involved.
• CSV export now includes the whole filtered log instead of stopping at 10,000 rows. Dates are in your timezone, with the offset included.

Performance

• Filtering by content ID is faster on large logs.

Bug fixes

• Row highlighting by severity in the audit log now shows. It never appeared before.
• Settings shown as yes or no in an entry's details are no longer treated as links to records.
• A content ID with no content type selected is now ignored instead of being applied.
• Uninstalling now also clears the cached audit log summary.

We have released a new version focused on performance and stability along with a few changes.

Important change that will affect every add-on:

All of our add-ons are now using Core Library in order to maintain shared helpers and utilities across add-ons for easier maintenance and to keep add-ons cleaner. Core Library also covers our branding for all add-ons in one switch without having to turn it off in every add-on.

This update will require Core Library 1.0.1.

Changes

• Downloads Manager admin pages now have their own admin permission, "Manage [MC] Downloads Manager". Super administrators are unaffected. Other administrators need it granted under Admin > Administrators.
• API keys with super-user access now only skip permission checks when the request asks for it with api_bypass_permissions=1, matching XenForo. Creating downloads, comments and reviews through the API now needs a user.
• The "Remove branding" option has moved to [MC] Core Library and now covers every MC add-on. Your existing setting is kept.

Performance

• New-version and comment notifications to large watcher lists are sent in the background instead of slowing down the upload.
• "Download all as ZIP" streams the saved archive directly instead of copying it on every download. Old archives are cleaned up.
• External files are no longer re-read three times after they are fetched.
• Search results, alerts, watched lists and author pages use fewer database queries.
• The option tabs code only runs on the options page.

Bug fixes

• Links stop working when the download is deleted, unapproved or still a draft, and for banned users.
• Links locked to an IP address are checked on every request.
• Guests and members who cannot view the category can now use a link shared with them.
• Previews no longer show files that are quarantined, still being scanned or failed checks.
• "Download all as ZIP" is rebuilt when a file's scan result changes, so a file quarantined later is no longer inside it.
• A file replaced while the old one was being scanned no longer inherits the old file's result.
• Periodic rescans keep clean files downloadable while they run. A scanner outage no longer quarantines the whole library. Only an infected result quarantines a previously clean file.
• Download gates from other add-ons, such as the NSFW gate, now apply to downloads and ZIP downloads, not only previews.
• Download links handed out after passing the gates only work for the visitor who passed them.
• Rate limits, CAPTCHA and IP-locked share links can no longer be bypassed with a faked IP header.
• An occasional "rate limit reached" on a first download no longer happens.
• Authors can no longer approve their own downloads through inline moderation.
• Approve and release in the moderation queue only act on items still waiting for that action.
• Handling reports now needs moderator permissions, so authors cannot close reports about their own content.
• Attaching an existing thread as a download's discussion now needs you to have started it or be able to edit it.
• Reviews can only be linked to a version of the download being reviewed.
• Comments and reviews awaiting approval now appear in the approval queue. Existing ones are added during the upgrade.
• Versions awaiting approval now appear in the approval queue. Rejecting a version no longer leaves its files behind.
• A version held as spam or scheduled for later no longer becomes the current version early.
• Version and file endpoints no longer return unpublished, scheduled or deleted content.
• Posting a comment uses the same checks as the website.
• Category changes need the new admin permission.
• Share token lists now respect the chosen sort order.
• Fetching from private network addresses used by some cloud providers is now blocked.
• Fetching stops at the category's file size limit instead of trusting the size the remote server reports.
• Large external files no longer fail after 60 seconds.
• Links to servers that reject quick checks, such as signed S3 links, are no longer marked as dead.
• Dead link checks no longer stall when many files have checking turned off.
• Archive previews no longer use PHP's Phar extension.
• Soft deleting and restoring a download now updates counts, search, the news feed and tags.
• Batch hard delete in the admin area now does the full cleanup.
• Review counts are now consistent everywhere.
• Review fields can now use every field type, including stars, date and colour.
• Deleting the last visible version no longer leaves a broken current version.
• Integrity checks no longer report files that are still being fetched as missing.
• Temporary upload files are cleaned up when saving a file fails.
• The listing filter no longer shows old results when typing quickly, keeps the list when a request fails, and no longer fills your browser history.
• The Download button no longer stays stuck loading after closing a password or CAPTCHA prompt.
• The "too many files" upload message now shows proper text.
• The magnet link fallback button now passes the full magnet link to your torrent client.

We have released a new maintenance update that fixes a critical issue with XenForo 2.3.13. Please update to the latest version before upgrading.

• XenForo 2.3.13 introduces new security measures that caused a fatal error regarding our shared copyright footer.

We have released a major new version with new features

Features

Virus scanning

• Uploaded files can now be scanned for malware before they become downloadable
• Supported engines
  • ClamAV (daemon)
  • VirusTotal
• Files with detected threats are quarantined and require action before they become available or deleted
• Scans run in the background so uploads are never blocked waiting on an engine
• Configurable fail modes either hold the file for a moderator or release with a warning flag
• Per-category scan modes
• Integrates with [MC] Quarantine's engines
• Scan badges on downloads so members can see results for themeselves

Unified moderation queue

• Moderation queue now includes a unified front including pending downloads, quarantined files, and dead links.
• Available both in the Admin CP and front end moderator queue
• Subsequently, the dead links page has been removed and merged into the moderation queue

Admin CP dashboard

• All new dashboard available in the Admin CP for quick glance at various information blocks including download stats, activity over time, top downloads, virus scan state, storage, recent activity and items that need attention

We have released a new version with new features, improvements and bug fixes!

• We have a brand new layout option for the index: Card layout! This layout includes taller cards and features the download's cover! Requested by @ratix_gunz
  • Full element visibility options located in style properties
• In addition to the card layout, we have also included a Global cover option, so ALL downloads can have a beautiful cover even if they didn't upload one. Without a default cover set, we have a generic striped CSS banner being used.
  • Global cover < Category cover < Individual cover
• Modern filter improvements!
  • Added created by and watching filter.
  • Added ascending/descending filter
• Added a loading spinner to the download button! This will generally, only appear during slow internet connections while the download is being served to the user. It does NOT track download progress. There isn't a fully reliable way to do that in all scenarios, so leaving that task with your browser.
• Fixed an issue where text overflowed outside the download button. Reported by @ratix_gunz
• Fixed an issue where category titles were overflowing outside their chips on the modern filter. Reported by @ratix_gunz
• Other small performance improvements

You can view the new layout on our demo site.

We have released a new version with one improvement and a few bug fixes:

• New style property to expand collapsed changelog by default
• Fixed an issue where the discussion_type was not being attached on changed threads, only automatically created threads
• Comments API now reject hard-delete with 404 unless caller is super user or has appropriate permission
• Fixed an issue where user could preview certain files on version view page without appropriate permission

A new update has been released that adds new features, expanded API/webhooks, and many improvements and bug fixes.

New Features

• Per-download criteria gates. Authors can now attach a criteria gate to an individual download, in addition to any gate set on its category. The two are evaluated together, with author and team member bypass. Admins get a per-gate "allow on downloads" toggle and can restrict which user groups may apply a gate.
• Reaction gates. Downloads can be gated behind a reaction, configurable per-download and per-category, with authors and team members always bypassing. A reaction-lock mode controls whether a user can change or remove their reaction after reacting, with an optional relock if the reaction is later removed.
• Expanded REST API.
  • Reviews (new): List, get, create, delete (soft/hard), add / remove author reply and enriched results (reactions, url, can-edit flag, core columns)
  • Downloads: Get now includes with_dependencies and with_field_valuesand watch/unwatch toggle endpoints
  • Categories: Watch / unwatch toggle endpoint, custom field read endpoints, review field read entpoints
  • Share tokens (new): List, create, get, revoke
  • Prefixes: Prefix read endpoints (list / single), prefix group endpoints (list / single)
  • Custom fields: Field read endpoints (list / single)
• Expanded webhook coverage
  • Reviews: Author reply added / removed, state change (also fires on soft-delete and undelete)
  • Downloads: Watch / unwatch toggle
  • Categories (new): Insert, update, delete, watch / unwatch, thread-settings changed
  • Share tokens (new): Issued, used, revoked
  • Team members: Added, removed, updated

Bug Fixes/Improvements

• Comment soft-delete retention is now measured from a dedicated deleted-date column.
• API comment posting now checks the comment permission, and the single-primary-file rule is enforced.
• Review IP addresses are logged after save
• SVG and SVGZ previews now render inside a CSP sandbox.
• Download and version creation is now wrapped in a single transaction.
• Comment counters are maintained correctly on soft-delete and restore.
• Removed duplicate audit-log rows created during API create, edit, and delete.
• Share-token redirects now use a 302 (the previous 301 was cacheable).
• Download statistics are now bucketed in UTC for consistent daily totals.
• Corrected the orphan-cleanup count report, and closed a ZIP temporary-file leak

With criteria gates you will now be able to allow them to be used on individual downloads, instead of categories only, as well as which user groups can use specific gates. User groups will need to have permission to apply criteria gates to their downloads.

If both the download and category it resides in has gates, both must be passed to access content.



Users will be able to apply that gate on their downloads when uploading or editing.



With reaction gates, you can enable them per category and/or per download. Reaction gates always require a positive reaction. If the category requires reactions, users will not be able to set or disable the reaction requirement. Of course, requiring reactions on individual downloads will require permission.

Same mechanism for authors requiring reactions on, as the other individual gates.



If a download has both criteria restrictions and reaction requirements, all the requirements will be listed together.

We have finally released our importers for Downloads Manager. Importers are available as a separate add-on for customers free of charge.

Two sources are supported:

• XenForo Resource Manager (2.3+) on the same site. Resources, versions, files, custom fields, prefixes, reviews, watchers, tags, icons and discussion thread links are all carried across.
• Invision Community 4 (Downloads) from a separate installation. The importer connects to your IC4 database, reads files from the IC4 uploads folder, and uses the import log from a prior IC4 forum import to attribute downloads to the right XenForo members and link them to the right threads.

For every category, prefix group, prefix and custom field, you decide whether to map it to an existing record in Downloads Manager, create a new one, or skip it. Imports are resumable, will not duplicate rows if re-run, and finish with an automatic rebuild of category counters and the prefix, field and content-permission caches.

Requirements: XenForo 2.3.0 or newer and [MC] Downloads Manager 1.0.4 or newer. The XFRM importer also needs XenForo Resource Manager 2.3.0 or newer installed and active. The IC4 importer also needs access to the IC4 database, read access to the IC4 uploads folder, and a prior IC4 forum import.

We recommend running an import against a copy of your site before importing into production.

Area	XFRM	IC4
Categories (tree preserved)	✓	✓
Prefix groups and prefixes	✓	X
Custom fields	✓	✓
Custom field values	✓	✓
Downloads (state, author, counters, description)	✓	✓
Versions	✓	✓
Binary files	✓	✓
URL type files	X	✓
Resource icons	✓	X
Screenshots (appended to description as attachments)	X	✓
Description and changelog attachments	✓	X
Reviews	✓	✓
Watchers / follows	✓	✓
Tags	✓	✓
Discussion thread linking	✓	✓ (via forum-import log)

A new version has been released. This is primarily a maintenance release focused on improving third party theme compatibility and polishing. One found security issue has been patched as well.

• Security: Hardened external URL fetching against DNS rebinding
• Improvement: Strip cells now flex: 1 1 so lone trailing cells fill their row
• Improvement: Improved status labels theming for dark mode
• Improvement: Addressed 3rd party theme compatibility issues
• Improvement: Error consolidation in draft mode and custom fields have been improved.
• Improvement: Renamed share links to share tokens
• Bug fix: Specific UI.X theme issues have been addressed
• Bug fix: SHA-256 cell hidden when primary file is externally linked

A new version has been released with one new feature and various bug fixes

• New Feature: We have introduced dead link probing. When an external URL is linked instead of fetched (uploaded), we now periodically (admin configurable) probe external files for dead links.
  • New dead links admin page to triage warning + hidden files, withstate/search filters and bulk recheck.
  • AdminCP dashboard notice when any files are flagged.
  • Authors (and co-owners ) receive alerts on each state change.
  • Per-file health badge on the version view; per-file probe toggle for moderators.
  • Five options under Protection (probing on/off, interval, failure threshold, batch size, time budget),
• Improvement: Visual improvements made to external URL status labels
• Bug fix: Service\Download\Upload::extractExtension() now handles compound extensions properly
• Bug fix: Implement XF\Entity\LinkableInterface to Version and Review entity
• Bug fix: Fix modern filter not working on boards without full friendly URLS
• Bug fix: 2 LESS files were misconfigured resulting in 2 broken areas.

Version files list now show a status icon for healthy links. Icon will change depending on status.

Clicking on the status will open an overlay with the ability to probe immediately or disable probing. This is available to moderators.

Administrators will receive a notice on the admin homepage when external URLs have been flagged.

Dead links page will allow you to view all dead links captured by the cron. It also allows you to view ALL links if you would like to browse all external URLs.