The token relay still stood between the button and the file: every click
issued a short-lived token URL, so downloads never reached the real
source address directly.
- Render direct anchors (target=_blank) to the raw source URL in the
download box and the paid card, with inline extract-code buttons
- Retire the relay: delete Content\Download plus its init wiring, header
query-var branch and SEO noindex branch, and drop the dead
download-request flow from cms-download.js (cashier, scan-pay and
error views stay)
- Keep the dl_token table and the download logs page as read-only
history; unscheduling of the orphaned cleanup cron is preserved
The success modal added a second click between the download button and
the file: request -> "下载链接已生成" popup -> 立即下载. Drop it and open
the generated relay link right away, keeping the previous new-tab
behaviour; a missing link still surfaces the error view.
- Replace renderSuccess with startDownload (anchor + target=_blank)
- Remove the popup-only CSS: alert, code-row, copy button, chips, meta
and the download action skin; error, cashier and scan-pay views keep
their styles
Opening 余额功能 alone now enables cash-wallet pay (unless 余额支付 is explicitly off). Drop points-as-balance fallback, stop fake method injection, expose real wallet in cashiers, and honor auto_to_balance on recharge fulfill.
Allow pay_no_logged_in cash content orders (user_id=0), set aksrt_pay_* cookies
on paid, accept cookie in access state, and expose guest CTA on paywall/box.
Bump content sales on resource order paid; show order number/time in download
box; poll pending gateway payments; support download_limit_over_price overbuy.
Rewrite captcha core around aksrt_captcha_config only, require captcha
on login/comment/SMS/phone auth and related gates, wire frontend token
collection, and remove dead dual-source security settings plus slider enqueue.
kate522