diff --git a/ui/ui/user-orderPlan.tpl b/ui/ui/user-orderPlan.tpl
index 79852912..191c945c 100644
--- a/ui/ui/user-orderPlan.tpl
+++ b/ui/ui/user-orderPlan.tpl
@@ -37,17 +37,17 @@
                                     </div>
                                     <div class="box-body">
                                         <div class="btn-group btn-group-justified" role="group" aria-label="...">
-                                            <a href="{$_url}order/gateway/radius/{$plan['id']}"
+                                            <a href="{$_url}order/gateway/radius/{$plan['id']}&stoken={App::getToken()}"
                                                 onclick="return confirm('{Lang::T('Buy this? your active package will be overwrite')}')"
                                                 class="btn btn-sm btn-block btn-warning text-black">Buy</a>
                                             {if $_c['enable_balance'] == 'yes' && $_user['balance']>=$plan['price']}
-                                                <a href="{$_url}order/pay/radius/{$plan['id']}"
+                                                <a href="{$_url}order/pay/radius/{$plan['id']}&stoken={App::getToken()}"
                                                     onclick="return confirm('{Lang::T('Pay this with Balance? your active package will be overwrite')}')"
                                                     class="btn btn-sm btn-block btn-success">{Lang::T('Pay With Balance')}</a>
                                             {/if}
                                         </div>
                                         {if $_c['enable_balance'] == 'yes' && $_c['allow_balance_transfer'] == 'yes' && $_user['balance']>=$plan['price']}
-                                            <a href="{$_url}order/send/radius/{$plan['id']}"
+                                            <a href="{$_url}order/send/radius/{$plan['id']}&stoken={App::getToken()}"
                                                 onclick="return confirm('{Lang::T('Buy this for friend account?')}')"
                                                 class="btn btn-sm btn-block btn-primary">{Lang::T('Buy for friend')}</a>
                                         {/if}
@@ -88,17 +88,17 @@
                                     </div>
                                     <div class="box-body">
                                         <div class="btn-group btn-group-justified" role="group" aria-label="...">
-                                            <a href="{$_url}order/gateway/radius/{$plan['id']}"
+                                            <a href="{$_url}order/gateway/radius/{$plan['id']}&stoken={App::getToken()}"
                                                 onclick="return confirm('{Lang::T('Buy this? your active package will be overwrite')}')"
                                                 class="btn btn-sm btn-block btn-warning text-black">Buy</a>
                                             {if $_c['enable_balance'] == 'yes' && $_user['balance']>=$plan['price']}
-                                                <a href="{$_url}order/pay/radius/{$plan['id']}"
+                                                <a href="{$_url}order/pay/radius/{$plan['id']}&stoken={App::getToken()}"
                                                     onclick="return confirm('{Lang::T('Pay this with Balance? your active package will be overwrite')}')"
                                                     class="btn btn-sm btn-block btn-success">{Lang::T('Pay With Balance')}</a>
                                             {/if}
                                         </div>
                                         {if $_c['enable_balance'] == 'yes' && $_c['allow_balance_transfer'] == 'yes' && $_user['balance']>=$plan['price']}
-                                            <a href="{$_url}order/send/radius/{$plan['id']}"
+                                            <a href="{$_url}order/send/radius/{$plan['id']}&stoken={App::getToken()}"
                                                 onclick="return confirm('{Lang::T('Buy this for friend account?')}')"
                                                 class="btn btn-sm btn-block btn-primary">{Lang::T('Buy for friend')}</a>
                                         {/if}
@@ -139,17 +139,17 @@
                                     </div>
                                     <div class="box-body">
                                         <div class="btn-group btn-group-justified" role="group" aria-label="...">
-                                            <a href="{$_url}order/gateway/pppoe/{$plan['id']}"
+                                            <a href="{$_url}order/gateway/pppoe/{$plan['id']}&stoken={App::getToken()}"
                                                 onclick="return confirm('{Lang::T('Buy this? your active package will be overwritten')}')"
                                                 class="btn btn-sm btn-block btn-warning text-black">Buy</a>
                                             {if $_c['enable_balance'] == 'yes' && $_user['balance']>=$plan['price']}
-                                                <a href="{$_url}order/pay/pppoe/{$plan['id']}"
+                                                <a href="{$_url}order/pay/pppoe/{$plan['id']}&stoken={App::getToken()}"
                                                     onclick="return confirm('{Lang::T('Pay this with Balance? your active package will be overwritten')}')"
                                                     class="btn btn-sm btn-block btn-success">{Lang::T('Pay With Balance')}</a>
                                             {/if}
                                         </div>
                                         {if $_c['enable_balance'] == 'yes' && $_c['allow_balance_transfer'] == 'yes' && $_user['balance']>=$plan['price']}
-                                            <a href="{$_url}order/send/pppoe/{$plan['id']}"
+                                            <a href="{$_url}order/send/pppoe/{$plan['id']}&stoken={App::getToken()}"
                                                 onclick="return confirm('{Lang::T('Buy this for friend account?')}')"
                                                 class="btn btn-sm btn-block btn-primary">{Lang::T('Buy for friend')}</a>
                                         {/if}
@@ -189,17 +189,17 @@
                                     </div>
                                     <div class="box-body">
                                         <div class="btn-group btn-group-justified" role="group" aria-label="...">
-                                            <a href="{$_url}order/gateway/hotspot/{$plan['id']}"
+                                            <a href="{$_url}order/gateway/hotspot/{$plan['id']}&stoken={App::getToken()}"
                                                 onclick="return confirm('{Lang::T('Buy this? your active package will be overwritten')}')"
                                                 class="btn btn-sm btn-block btn-warning text-black">Buy</a>
                                             {if $_c['enable_balance'] == 'yes' && $_user['balance']>=$plan['price']}
-                                                <a href="{$_url}order/pay/hotspot/{$plan['id']}"
+                                                <a href="{$_url}order/pay/hotspot/{$plan['id']}&stoken={App::getToken()}"
                                                     onclick="return confirm('{Lang::T('Pay this with Balance? your active package will be overwritten')}')"
                                                     class="btn btn-sm btn-block btn-success">{Lang::T('Pay With Balance')}</a>
                                             {/if}
                                         </div>
                                         {if $_c['enable_balance'] == 'yes' && $_c['allow_balance_transfer'] == 'yes' && $_user['balance']>=$plan['price']}
-                                            <a href="{$_url}order/send/hotspot/{$plan['id']}"
+                                            <a href="{$_url}order/send/hotspot/{$plan['id']}&stoken={App::getToken()}"
                                                 onclick="return confirm('{Lang::T('Buy this for friend account?')}')"
                                                 class="btn btn-sm btn-block btn-primary">{Lang::T('Buy for friend')}</a>
                                         {/if}
@@ -249,17 +249,17 @@
                                             </div>
                                             <div class="box-body">
                                                 <div class="btn-group btn-group-justified" role="group" aria-label="...">
-                                                    <a href="{$_url}order/gateway/{$router['id']}/{$plan['id']}"
+                                                    <a href="{$_url}order/gateway/{$router['id']}/{$plan['id']}&stoken={App::getToken()}"
                                                         onclick="return confirm('{Lang::T('Buy this? your active package will be overwrite')}')"
                                                         class="btn btn-sm btn-block btn-warning text-black">Buy</a>
                                                     {if $_c['enable_balance'] == 'yes' && $_user['balance']>=$plan['price']}
-                                                        <a href="{$_url}order/pay/{$router['id']}/{$plan['id']}"
+                                                        <a href="{$_url}order/pay/{$router['id']}/{$plan['id']}&stoken={App::getToken()}"
                                                             onclick="return confirm('{Lang::T('Pay this with Balance? your active package will be overwrite')}')"
                                                             class="btn btn-sm btn-block btn-success">{Lang::T('Pay With Balance')}</a>
                                                     {/if}
                                                 </div>
                                                 {if $_c['enable_balance'] == 'yes' && $_c['allow_balance_transfer'] == 'yes' && $_user['balance']>=$plan['price']}
-                                                    <a href="{$_url}order/send/{$router['id']}/{$plan['id']}"
+                                                    <a href="{$_url}order/send/{$router['id']}/{$plan['id']}&stoken={App::getToken()}"
                                                         onclick="return confirm('{Lang::T('Buy this for friend account?')}')"
                                                         class="btn btn-sm btn-block btn-primary">{Lang::T('Buy for friend')}</a>
                                                 {/if}
@@ -298,17 +298,17 @@
                                             </div>
                                             <div class="box-body">
                                                 <div class="btn-group btn-group-justified" role="group" aria-label="...">
-                                                    <a href="{$_url}order/gateway/{$router['id']}/{$plan['id']}"
+                                                    <a href="{$_url}order/gateway/{$router['id']}/{$plan['id']}&stoken={App::getToken()}"
                                                         onclick="return confirm('{Lang::T('Buy this? your active package will be overwrite')}')"
                                                         class="btn btn-sm btn-block btn-warning text-black">Buy</a>
                                                     {if $_c['enable_balance'] == 'yes' && $_user['balance']>=$plan['price']}
-                                                        <a href="{$_url}order/pay/{$router['id']}/{$plan['id']}"
+                                                        <a href="{$_url}order/pay/{$router['id']}/{$plan['id']}&stoken={App::getToken()}"
                                                             onclick="return confirm('{Lang::T('Pay this with Balance? your active package will be overwrite')}')"
                                                             class="btn btn-sm btn-block btn-success">{Lang::T('Pay With Balance')}</a>
                                                     {/if}
                                                 </div>
                                                 {if $_c['enable_balance'] == 'yes' && $_c['allow_balance_transfer'] == 'yes' && $_user['balance']>=$plan['price']}
-                                                    <a href="{$_url}order/send/{$router['id']}/{$plan['id']}"
+                                                    <a href="{$_url}order/send/{$router['id']}/{$plan['id']}&stoken={App::getToken()}"
                                                         onclick="return confirm('{Lang::T('Buy this for friend account?')}')"
                                                         class="btn btn-sm btn-block btn-primary">{Lang::T('Buy for friend')}</a>
                                                 {/if}
@@ -348,17 +348,17 @@
                                             </div>
                                             <div class="box-body">
                                                 <div class="btn-group btn-group-justified" role="group" aria-label="...">
-                                                    <a href="{$_url}order/gateway/{$router['id']}/{$plan['id']}"
+                                                    <a href="{$_url}order/gateway/{$router['id']}/{$plan['id']}&stoken={App::getToken()}"
                                                         onclick="return confirm('{Lang::T('Buy this? your active package will be overwrite')}')"
                                                         class="btn btn-sm btn-block btn-warning text-black">Buy</a>
                                                     {if $_c['enable_balance'] == 'yes' && $_user['balance']>=$plan['price']}
-                                                        <a href="{$_url}order/pay/{$router['id']}/{$plan['id']}"
+                                                        <a href="{$_url}order/pay/{$router['id']}/{$plan['id']}&stoken={App::getToken()}"
                                                             onclick="return confirm('{Lang::T('Pay this with Balance? your active package will be overwrite')}')"
                                                             class="btn btn-sm btn-block btn-success">{Lang::T('Pay With Balance')}</a>
                                                     {/if}
                                                 </div>
                                                 {if $_c['enable_balance'] == 'yes' && $_c['allow_balance_transfer'] == 'yes' && $_user['balance']>=$plan['price']}
-                                                    <a href="{$_url}order/send/{$router['id']}/{$plan['id']}"
+                                                    <a href="{$_url}order/send/{$router['id']}/{$plan['id']}&stoken={App::getToken()}"
                                                         onclick="return confirm('{Lang::T('Buy this for friend account?')}')"
                                                         class="btn btn-sm btn-block btn-primary">{Lang::T('Buy for friend')}</a>
                                                 {/if}
@@ -395,17 +395,17 @@
                                             </div>
                                             <div class="box-body">
                                                 <div class="btn-group btn-group-justified" role="group" aria-label="...">
-                                                    <a href="{$_url}order/gateway/{$router['id']}/{$plan['id']}"
+                                                    <a href="{$_url}order/gateway/{$router['id']}/{$plan['id']}&stoken={App::getToken()}"
                                                         onclick="return confirm('{Lang::T('Buy this? your active package will be overwrite')}')"
                                                         class="btn btn-sm btn-block btn-warning text-black">Buy</a>
                                                     {if $_c['enable_balance'] == 'yes' && $_user['balance']>=$plan['price']}
-                                                        <a href="{$_url}order/pay/{$router['id']}/{$plan['id']}"
+                                                        <a href="{$_url}order/pay/{$router['id']}/{$plan['id']}&stoken={App::getToken()}"
                                                             onclick="return confirm('{Lang::T('Pay this with Balance? your active package will be overwrite')}')"
                                                             class="btn btn-sm btn-block btn-success">{Lang::T('Pay With Balance')}</a>
                                                     {/if}
                                                 </div>
                                                 {if $_c['enable_balance'] == 'yes' && $_c['allow_balance_transfer'] == 'yes' && $_user['balance']>=$plan['price']}
-                                                    <a href="{$_url}order/send/{$router['id']}/{$plan['id']}"
+                                                    <a href="{$_url}order/send/{$router['id']}/{$plan['id']}&stoken={App::getToken()}"
                                                         onclick="return confirm('{Lang::T('Buy this for friend account?')}')"
                                                         class="btn btn-sm btn-block btn-primary">{Lang::T('Buy for friend')}</a>
                                                 {/if}