search

taobataoma / meanTorrent

meanTorrent - MEAN.JS BitTorrent Private Tracker - Full-Stack JavaScript Using MongoDB, Express, AngularJS, and Node.js, A BitTorrent Private Tracker CMS with Multilingual, and IRC announce support, CloudFlare support. Demo at:
https://mean.im
Other
489 stars 146 forks source link

Suggestions #20

Open nearsou opened 6 years ago

nearsou commented 6 years ago

Hi! I just found about meanTorrent and I think you did a great work there. I love it ! However, I would like to see some features and adjustments made in futur updates :thumbsup:

Here are some suggestions:

Nemcio commented 6 years ago

One might add:

nearsou commented 6 years ago

Hello there, here is some update that can be accomplished, this is only ideas, if it's possible feel free to do it or not 👍 :) Hi @taobataoma I wish a good and happy new year 2018 !

BUG report :

CSS :

General

Forum:

Show in user post forum :

Security :

Already done:

taobataoma commented 6 years ago

@nearsou very thanks for your idea, they are very good, so i will add it to my dev plan if i feel it is compatible for meanTorrent. meanTorrent get better and better because of you and other friends.

forum main category value is configure in torrents, admin oper can add sub discuss area and manage it by admin menu 'Forums configure', This is designed to reduce the workload reasonably.

emoji issues is on MARKED module, fixed it maybe need a long time.

'announce Editor' not only delete the passkey of torrent file, it change the old announce url to your configure announce url in torrent.js, also can changed from other tracker server`s announce url, it can changed from any torrent file.

nearsou commented 6 years ago

@nearsou very thanks for your idea, they are very good, so i will add it to my dev plan if i feel it is compatible for meanTorrent. meanTorrent get better and better because of you and other friends.

No problem my friend !

forum main category value is configure in torrents, admin oper can add sub discuss area and manage it by admin menu 'Forums configure', This is designed to reduce the workload reasonably.

So if I want I can create another main category like 'Affairs' I need to do it manually in the code ?

emoji issues is on MARKED module, fixed it maybe need a long time.

I dont know if its right thing but I found this maybe it can help https://github.com/chjj/marked/pull/238#discussion-diff-21877341 https://github.com/chjj/marked/pull/238/files#r21877341

'announce Editor' not only delete the passkey of torrent file, it change the old announce url to your configure announce url in torrent.js, also can changed from other tracker server`s announce url, it can changed from any torrent file.

Ok thanks for the answers !

taobataoma commented 6 years ago

@nearsou about emoji i need more time. another, if you want create new main category, you must need to edit the config file 'torrent.js', this is a specialized config setting file for meanTorrent now, is so easy, the forum only is a simple discuss area, It's just a service to Mean, not a professional forum :)

nearsou commented 6 years ago

Oh I understand now, well thanks for the answer ! 😄

taobataoma commented 6 years ago

@nearsou

1, admin can delete user account in admin menu 'manager users' and enter user detail page, and can edit user displayname 2, in forum, readonly can set on forum and topic, when create a forum by admin and set readOnly(Users are forbidden to post new topics), then only oper/admin can post new topic, normal users only can list topic, and can post new reply if topic is not set readOnly(Users are forbidden to post new replies), if set readOnly on topic when you post new topic, then only oper/admin can post new reply, normal user only can list replies. meanTorrent separately control readOnly on forum and topic, i think this is a great idea, what do you think about it?

nearsou commented 6 years ago

1, admin can delete user account in admin menu 'manager users' and enter user detail page, and can edit user displayname

I'm sorry I didn't see that option haha forgive me.

2, in forum, readonly can set on forum and topic, when create a forum by admin and set readOnly(Users are forbidden to post new topics), then only oper/admin can post new topic, normal users only can list topic, and can post new reply if topic is not set readOnly(Users are forbidden to post new replies), if set readOnly on topic when you post new topic, then only oper/admin can post new reply, normal user only can list replies. meanTorrent separately control readOnly on forum and topic, i think this is a great idea, what do you think about it?

This is good idea there, but when normal user create topic he has the right to set the topic on readonly right ?

taobataoma commented 6 years ago

@nearsou yes, normal user also can set readonly for his topic at bottom of submit form before submit.

i already fixed 'SCORE_NOT_ENOUGH' translate string, has many string is return from server, i will put them into translate file later.

nearsou commented 6 years ago

@taobataoma this is what I was looking for, is this good to allow him to set topic readonly ? I mean there is no reason to do so, tell me what you think :)

taobataoma commented 6 years ago

@nearsou Of course, there's no scene to need normal user to set only for his topic, this is can limit to oper and admin, But this function doesn't have any special impact, what i need is in readonly forum, normal user can post new reply into not readonly topic.

nearsou commented 6 years ago

@taobataoma Oh yes you are right and I see now what did you mean earlier. 😄

taobataoma commented 6 years ago

@nearsou 'delete a whole category' issues, i need your detail of specific operation steps, thanks!

messages issues already fixed.

nearsou commented 6 years ago

Ok, in Forums post new topic, pin it to global status > go to Forum Configure > Delete the forum where you create the topic global status > return to the forum and see the topic is still there in global status with error and not deleted

nearsou commented 6 years ago

I have finished the translation you can add it if you want, tell me if I miss something, I'll try to update, translate it when I can and when something changes here in this post 👍 :) translation-file-fr.zip

taobataoma commented 6 years ago

@nearsou very thanks for your translation file! 👍

about 'delete forum' issues already fixed, however, it is not a professional forum, delete a forum will have a lot of complex statistical work needs to be done, but also easily lead to statistical errors, so I did not delete these themes, just hide them, so try not to do this operation so as to avoid too much garbage, of course, this is not perfect. Fortunately, this operation will not demand too much and too frequent. :smile:

nearsou commented 6 years ago

@nearsou very thanks for your translation file! 👍

No problem!

about 'delete forum' issues already fixed, however, it is not a professional forum, delete a forum will have a lot of complex statistical work needs to be done, but also easily lead to statistical errors, so I did not delete these themes, just hide them, so try not to do this operation so as to avoid too much garbage, of course, this is not perfect. Fortunately, this operation will not demand too much and too frequent. 😄

I got it, yes but I wasn't thinking they will stay after deleting the forum, I will not touch that anymore, anyway, I think in the forums you did the minimum requiered and this is good enough, very thanks @taobataoma !

taobataoma commented 6 years ago

@nearsou infinite ratio showed fine now, and I don't understand why there are so many decimals of score number, and now it's forced to display 2 decimal places.

the score system is a interesting, complex statistical systems, meanTorrent will design more and more score events to help users get more score, and now has achieved the introduction is not the same, it needs to improve it in the future

another issues, When I invite someone (not official invitation) with score and active the account, all the status is fine on localhost and demo site. please test again if you have time, thanks.

nearsou commented 6 years ago

the score system is a interesting, complex statistical systems, meanTorrent will design more and more score events to help users get more score, and now has achieved the introduction is not the same, it needs to improve it in the future

Thanks I appreciate it.

another issues, When I invite someone (not official invitation) with score and active the account, all the status is fine on localhost and demo site. please test again if you have time, thanks.

Yes you are right, It seems problem solved don't know how, I can't reproduce the bug anymore, thanks for the answers.

taobataoma commented 6 years ago

@nearsou meanTorrentConfig content just display some of the settings through the browser to the user, and there will be no security problems, because the important settings in the server side has a judgment, if you modify the browser variable value does not have practical effect. Of course, you remind me, I will carefully filter again, to avoid missing some important restrictions.

nearsou commented 6 years ago

@nearsou meanTorrentConfig content just display some of the settings through the browser to the user, and there will be no security problems, because the important settings in the server side has a judgment, if you modify the browser variable value does not have practical effect. Of course, you remind me, I will carefully filter again, to avoid missing some important restrictions.

@taobataoma Good to hear 👍 but is there any way to hide this part just in case ?

I flew over all the CMS and I think I did all the suggestion that meanTorrent needs, thanks to you for giving your time to continue this project, and im glad I could help ! 😃

taobataoma commented 6 years ago

@nearsou Add 'Contact Staff' Tab to contact the staff directly instead of @ email as '/about/black' , '/vip/donate' or 'torrents/uploads'

this need more detail explain please

Option to set user limit signup 400/400 of maximum registeration users for example

signup has setting switch, and need this maximum setting?

Disable account user when he is not logged while X time

I think about this, i do not want to disable login, i think let user to login, but can not download anything, user can reactive account by score(maybe a lot of score number). but this function need few time.

system notification

about this function, i will optimization it, add 'system notice' type into current message types, let it include forum reply notice, forum thumbs up notice, torrent thumbs up notice, torrent comment reply change notice, h&r warning adding(remove) notice...... etc. and in message list page, i will add classification button to list every category messages.

System shopping

this is a good idea, but it is very complex, let me to think about it, i can add it into my dev queue and do it after release.

for other suggestions, i have no idea now, let me check it one by one later, if i do not mention it, you can keep them in the list. Thank you for doing these things, and you'll make meanTorrent better and better.

nearsou commented 6 years ago

this need more detail explain please

Make a staff inbox page especially to send message for support (all the admin) instead of putting email to contact them, well you can fill that just by putting link like this (/messages/send?to=59fb42c5d2ba652e38d1cf15|nearsou) which is good too...

signup has setting switch, and need this maximum setting?

Yeah no need to do that I forget that you can disable invitation anytime in the setting, nevermind.

about this function, i will optimization it, add 'system notice' type into current message types, let it include forum reply notice, forum thumbs up notice, torrent thumbs up notice, torrent comment reply change notice, h&r warning adding(remove) notice...... etc. and in message list page, i will add classification button to list every category messages.

This is huge thing to do, thank you.

this is a good idea, but it is very complex, let me to think about it, i can add it into my dev queue and do it after release.

Yes, I know, I was thinking about how to put more thing to buy, but if you feel its complexe, just try to do the basics.

for other suggestions, i have no idea now, let me check it one by one later, if i do not mention it, you can keep them in the list. Thank you for doing these things, and you'll make meanTorrent better and better.

No problem ! I wish you good continuation.

ObiWanTwo commented 6 years ago

If I may suggest also, the actual SMTP code only accepts email providers such as GMail : 

mailer: {
    from: process.env.MAILER_FROM || 'admin@chd.im',
    options: {
      service: process.env.MAILER_SERVICE_PROVIDER || 'Gmail',
      auth: {
        user: process.env.MAILER_EMAIL_ID || 'example@gmail.com',
        pass: process.env.MAILER_PASSWORD || 'password'
      }
    }
}

Is it possible to add support for real SMTP Servers instead of actual popular providers to help keep staff anonymity ?

taobataoma commented 6 years ago

@Answer-Man meanTorrent used nodemailer to send email, it is not only support GMAIL, here is the services list doc Well-known services, It has a lot of configurable options, and you see if you can meet your needs。

tojoaijo commented 6 years ago

Hi al, @nearsou I apologize for taking advantage of your publication to give a suggestion :) Just a suggestion: how if the admin will receive an message (or email) when someone have upload a torrent on the website (on Private torrent)? because, the admin need to "Review" the torrent before the client can seed the file and if we can have a link that list all torrents not "review" yet by admin. This is just a suggestion but feel free to do it or not @taobataoma :)

nearsou commented 6 years ago

Hi al, @nearsou I apologize for taking advantage of your publication to give a suggestion :)

No problem you can take a part of suggestion

Just a suggestion: how if the admin will receive an message (or email) when someone have upload a torrent on the website (on Private torrent)?

This maybe will be in th notification system as "- When your torrent was deleted or approuved (if deleted then send reason why with message notification) "

because, the admin need to "Review" the torrent before the client can seed the file and if we can have a link that list all torrents not "review" yet by admin. This is just a suggestion but feel free to do it or not @taobataoma :)

You can already see this in manage torrent in panel admin '/admin/torrents' https://puu.sh/yvRA5/8a2cd93984.png

tojoaijo commented 6 years ago

You can already see this in manage torrent in panel admin '/admin/torrents'

I see it but this need to check on every categories, so if we can have 1 link regroup all files which not been reviewed by admin

This maybe will be in th notification system as "- When your torrent was deleted or approuved (if deleted then send reason why with message notification) "

Yes, and we just add a notification to admin when someone has upload a torrent

nearsou commented 6 years ago

I see it but this need to check on every categories, so if we can have 1 link regroup all files which not been reviewed by admin

In todo list of @taobataoma we can see that he will do :

So expect that you can see it later 😄

tojoaijo commented 6 years ago

ah ok, I haven't seen it :smile:

taobataoma commented 6 years ago

@tojoaijo I will add a road to list all new torrent for admin later.

ObiWanTwo commented 6 years ago

I've been having some issues with the inbox. I cannot clearly distinguish which message came from who or who's talking because the CSS for the received messages and the send ones is pretty much the same (light green, alined, profile icons on the same side). So I've been thinking of a way to make it more comfortable to read and Facebook's inbox came to my mind: visually simple and clean. Isn't possible to rearrange the CSS so that it looks and feels better ? Here is an example: FB

taobataoma commented 6 years ago

@nearsou

Also if user enter wrong username and password x times in a row, get access(by IP) for x times, to prevent brute forcing and more security

I carefully thought about this problem. This kind of login failure numbers limit does not have much benefit. If we only count the number of password errors and then prohibit the account, it is unfair to the users themselves, because someone malicious login causes the account to be banned. If the statistical password error number and IP address binding, then the user can login because the IP address is not the same, if the same IP address and the number of errors enough, we can prohibit the IP address of the user attempts to login. However, the workload of the forbidden program is much more than that of a normal login and return password error, so this prohibition is not really meaningful. what did you think about?

Phogo commented 6 years ago

I think this would be better handled serverside with fail2ban or similar.

nearsou commented 6 years ago

I carefully thought about this problem. This kind of login failure numbers limit does not have much benefit. If we only count the number of password errors and then prohibit the account, it is unfair to the users themselves, because someone malicious login causes the account to be banned. If the statistical password error number and IP address binding, then the user can login because the IP address is not the same, if the same IP address and the number of errors enough, we can prohibit the IP address of the user attempts to login. However, the workload of the forbidden program is much more than that of a normal login and return password error, so this prohibition is not really meaningful. what did you think about?

hmm I don't know, I've seen many popular tracker doing this like (Asiandvdclub or Apollo) Otherwise why not prohibit just the IP, if you fail to enter input x time and no matter what username/password is ? However users can still always reset their password if they forget it anyway... Thing is you can use the login connection to spam many times to try to login without repercussion.

ObiWanTwo commented 6 years ago

Fail2ban wouldn't give you as much flexibility as a ban on a specific page for a specific reason would do. With fail2ban/firewalls you may limit the number of requests done per ip over a specific protocol but you can't control for which request flood the target should be banned. It isn't a matter of protecting the server but a way to secure users accounts from being stolen by bruteforce. My thoughts on this are: You should probably ban an IP for multiple connection trials using the login form, whether the trials were on the same account or not.

ObiWanTwo commented 6 years ago

In the admin profile (in your demo website) we see: Torrents seeding：2 profile but when clicking on "detail" only one torrent appears : seeding The same problem subsists with "Uploaded torrents", you've uploaded 79 torrents but the displayed number is 65. Or maybe these are dummy numbers for testing purposes ? Can you also please add details for Forum topics/Forum replies ?

taobataoma commented 6 years ago

@Answer-Man

In the admin profile (in your demo website) we see: Torrents seeding：2 profile but when clicking on "detail" only one torrent appears : seeding The same problem subsists with "Uploaded torrents", you've uploaded 79 torrents but the displayed number is 65. Or maybe these are dummy numbers for testing purposes ?

I found this issues on demo site, Some data contain test data in it, so it doesn't look normal, but I will check it again. If these data are abnormal on your site, please contact me again.

ObiWanTwo commented 6 years ago

So as @nearsou has done, I'm going to make a list of suggestions that I'm going to update instead of spamming this thread.

Security Improvements:

Issues:

Global:

I hope this can be useful to you.

taobataoma commented 6 years ago

@Answer-Man

Hide admin IP addresses from everyone (even other admin/oper).

meanTorrent do not show ip of any user in userinfo page, only in admin manager user page, so any user can not view admins ip.

Force user's disconnection if he has been banned while still logged in.

can not disconnect user timely if he has been banned, but user can not download and announce when his status change to banned and idle. I think this is enough. and user can not login again when he is disconnection.

When a torrent is made VIP it's hidden from everyone (including operatons) in both the homepage and the search engine.

that is right, when a torrent become VIP resources, it do not show in everywhere, only show in vip list section, VIP has its own special download area and not everywhere, I think there is no problem in this logic.

Make a user's status modification (idle/inactive/banned) display in his profile immediately after the modification is done. At this time, we need to sign out and then sign back in for the information to display to the user himself.

this is like above, can not disconnect user timely if he has been banned, but he do not need to sign out and sign back, the status will changed when he refresh any page, Even if it is not refresh, the download and announce is forbidden and can see tooltip info with why can not to do this.

Make an option to hide the profile information (oper/admin can still see them).

this is already done, in profile setting page, you can checked 'Hide more account detail info', then your more detail info will be hidden for other normal user.

Make User Rules/VIP Rules editable from the page itself.

meanTorrent support Multilingual, maybe edit the translate file is the simplest road.

Add an Announcement/News tab in which the staff can pin/push forum topics. As Gazelle does with its homepage.

this is in my dev plan, I will add more info on homepage, and these info come from forum topics, admin notice, site sale etc.

Other not mentioned items, I can do it later.

ObiWanTwo commented 6 years ago

meanTorrent do not show ip of any user in userinfo page, only in admin manager user page, so any user can not view admins ip.

I'm talking about hiding it from other admins/oper, from users that have access to the admin manager user page.

can not disconnect user timely if he has been banned, but user can not download and announce when his status change to banned and idle. I think this is enough. and user can not login again when he is disconnection.

What you can do to force disconnection is to ban the user's cookies. His browser will disconnect him when it will check for valid cookies. Because the banned user can continue to see forum/chat...etc until he decides by his own will to disconnect and that's not safe.

that is right, when a torrent become VIP resources, it do not show in everywhere, only show in vip list section, VIP has its own special download area and not everywhere, I think there is no problem in this logic.

It's logic, but this also means that a VIP torrent has less visibility from VIP users than other torrents as it will not bump up in the homepage. This is a minor issue, so do as you please.

the status will changed when he refresh any page, Even if it is not refresh, the download and announce is forbidden and can see tooltip info with why can not to do this.

My bad, it did not try to refresh manually. I thought the website would do it when browsing.

meanTorrent support Multilingual, maybe edit the translate file is the simplest road.

But then only the sysadmin can edit them. There is no way for the other staff members to directly modify without waiting for a sysadmin to connect. You are loading a separate VIP Rules file for each language, you could make the user edit the rules for each languages as well (either way, they need to do it even without this feature).
Thank you for your quick response.

tojoaijo commented 6 years ago

Hello all friends :) This is not an issue but it's better to rectify it:

GIT_REPO: 'Power by ©meanTottent

it's on "modules\core\client\app\trans-string-en.js" and "modules\core\client\app\trans-string-zh.js", line "878" we just have to change "meanTottent" to "meanTorrent"

taobataoma commented 6 years ago

@nearsou

Add auto system donation : Possible to add only the minimum like the most used method Paypal API ? which I think is already included. If it's too complicated for the full auto then do it as semi-auto(without changing VIP status when donate) : User donate and fill the form through paypal url, sends the response back as text with the mount and ID in Admin panel tab. In this way users dont need to send pm to admin each time and no need to justify his donation and after that admin gives the VIP status manually to the user. What do you think ?

The best way is auto change all status after donation through the payment api, but this is hard and need more time, let me think or do it later and later

nearsou commented 6 years ago

The best way is auto change all status after donation through the payment api, but this is hard and need more time, let me think or do it later and later

Ok nice ! I didn't know you were still on it, thanks for the answer. 😄

taobataoma commented 6 years ago

@nearsou

Set option to "review" for maker group doesnt work. It passes the torrent if "review" selected or not.

issue is fixed,

taobataoma commented 6 years ago

@nearsou

Does the total ratio of user count in H&R ? or count in general ? If not, it's better to put total ratio limit and force normal user to maintain above 0.75 for example ? (To force them to keep sharing the minimum required and not just unlimited download, so maybe new user got minimum 5GB+ free at the beginning)...

The total ratio include all up/download data with sale coefficient with vip coefficient and include H&R torrent up/down count, and each H&R has own up/down(with out sale&vip coefficient) count and ratio, H&R warning from as H&R ratio and seed time, if H&R warning number too more(can configure) so can not continue download any things, but can continue the warning H&R torrent and to seed to upgrade his single H&R torrent ratio.

The total ratio doesn't matter to H&R ratio, if the total ratio too less(can configure), can not download any thing but can seed. this ratio check after user signup 30 days(default 30, can configure), so new user can upgrade his total ratio in this 30 days. admin can set many torrent for sale or free, this total ratio is easy for new users. so not need default up data 5G like you said.

taobataoma commented 6 years ago

@nearsou

Does the ratio H&R work properly ? I shared the file to 3.0(1.5 settings) and it didn't remove the H&R, it seems that uploaded doesnt count

Let me check it.

I wonder if seedtime is working too, I have a question, this is in Milliseconds right ? seedTime: 60 60 1000 24 7, can I change this value for testing purpose ?

Yes, time is in Milliseconds, you can edit it in torrent.js, 60 60 1000 24 7 means 7 days.

taobataoma commented 6 years ago

@nearsou

I don't know if you have finished the announce, but now the downloading doesnt work anymore, I can see peer but it's not starting 🤔 . Does the ratio H&R work properly ? I shared the file to 3.0(1.5 settings) and it didn't remove the H&R, it seems that uploaded/ratio doesnt count, but it detects and gives you H&R.

Which client are you used to download?

The announce data to tracker is a very complicated, because some client run announce request is different, like as announce interval time, some client used value by returned from tracker, some client used custom value, this is not important, the first important different is some client do not include uploaded/downloaded value in request, I tested 'Vuze' for mac v5.7.6, it is not report the value, so tracker server can not receive data and to update user status value. did you used it?

The second trouble is some client do not announce the 'stoped' event to tracker server when user quit client directly with no normal stop all seeding/leeching torrents. like as Transmission for mac v2.92,

You should know, when a client start a up/down task and announce to tracker, server will create a 'Peer' record include user`s id, peer_id, torrent_id, uploaded, downloaded, seed status, ratio, etc. and remove this record when user announce stop event. but, when user quit client directly, server can receive the stop event, so do not to remove this record, and when user open client again and start same session, server will create a new record with these value because the 'peer_id' is not same as above, ok, now, the old record is became ghost, I can delete the ghost peer record with some rules, such as idle time? but, delete these ghost record maybe bring new error, because the cause of idle time too long maybe by server down? maybe user s network? If user has no quit client and up/down work fine, only can not announce to tracker, so the 'peer_id' is not changed, when server is ok, but the record is deleted, then server will create a new record to save user data, this will cause inaccurate data to be reported. I work hard with these problem.

now, maybe all are fine, but, the data problem with 'Vuze' is big trouble, do you have any idea?

I've been solving this problem these days. :smile:

nearsou commented 6 years ago

I use Deluge latest version with qBittorent, yes it depends on which client do you use, I didn't know that, now it's working fine on qBittorent with Bittorent. However in user info tab didnt display the seeder now https://puu.sh/yLx9n/025e6e7675.png I don't know much about client and their problems, all I know is sometimes trackers bans some client to avoid this sort of problem Thanks on your effort on that @taobataoma 😄

taobataoma commented 6 years ago

@nearsou because change the announce logic, so count number of user and torrent maybe Incorrect.