Merge branch '2.6RC'2.6

69 files changed, 1984 insertions, 323 deletions

diff --git a/Zotlabs/Module/Acl.php b/Zotlabs/Module/Acl.php
index c3c50cac2..83fafbdff 100644
--- a/Zotlabs/Module/Acl.php
+++ b/Zotlabs/Module/Acl.php
@@ -412,10 +412,12 @@ class Acl extends \Zotlabs\Web\Controller {
 			$directory = find_upstream_directory($dirmode);
 			$url = $directory['url'] . '/dirsearch';
 		}
+
+		$token = get_config('system','realm_token');
 	
 		$count = (x($_REQUEST,'count') ?  $_REQUEST['count'] : 100);
 		if($url) {
-			$query = $url . '?f=' ;
+			$query = $url . '?f=' . (($token) ? '&t=' . urlencode($token) : '');
 			$query .= '&name=' . urlencode($search) . "&limit=$count" . (($address) ? '&address=' . urlencode($search) : '');
 	
 			$x = z_fetch_url($query);
diff --git a/Zotlabs/Module/Admin.php b/Zotlabs/Module/Admin.php
index 536d85dde..30f3dfa48 100644
--- a/Zotlabs/Module/Admin.php
+++ b/Zotlabs/Module/Admin.php
@@ -52,6 +52,8 @@ class Admin extends \Zotlabs\Web\Controller {
 		 * Page content
 		 */
 
+		nav_set_selected('Admin');
+
 		$o = '';
 
 		if(argc() > 1) {
@@ -91,10 +93,10 @@ class Admin extends \Zotlabs\Web\Controller {
 			intval(ACCOUNT_BLOCKED)
 		);
 		if ($r) {
-			$accounts['total']    = array('label' => t('# Accounts'), 'val' => $r[0]['total']);
-			$accounts['blocked']  = array('label' => t('# blocked accounts'), 'val' => $r[0]['blocked']);
-			$accounts['expired']  = array('label' => t('# expired accounts'), 'val' => $r[0]['expired']);
-			$accounts['expiring'] = array('label' => t('# expiring accounts'), 'val' => $r[0]['expiring']);
+			$accounts['total']    = array('label' => t('Accounts'), 'val' => $r[0]['total']);
+			$accounts['blocked']  = array('label' => t('Blocked accounts'), 'val' => $r[0]['blocked']);
+			$accounts['expired']  = array('label' => t('Expired accounts'), 'val' => $r[0]['expired']);
+			$accounts['expiring'] = array('label' => t('Expiring accounts'), 'val' => $r[0]['expiring']);
 		}
 
 		// pending registrations
@@ -105,9 +107,9 @@ class Admin extends \Zotlabs\Web\Controller {
 		$channels = array();
 		$r = q("SELECT COUNT(*) AS total, COUNT(CASE WHEN channel_primary = 1 THEN 1 ELSE NULL END) AS main, COUNT(CASE WHEN channel_primary = 0 THEN 1 ELSE NULL END) AS clones FROM channel WHERE channel_removed = 0");
 		if ($r) {
-			$channels['total']  = array('label' => t('# Channels'), 'val' => $r[0]['total']);
-			$channels['main']   = array('label' => t('# primary'), 'val' => $r[0]['main']);
-			$channels['clones'] = array('label' => t('# clones'), 'val' => $r[0]['clones']);
+			$channels['total']  = array('label' => t('Channels'), 'val' => $r[0]['total']);
+			$channels['main']   = array('label' => t('Primary'), 'val' => $r[0]['main']);
+			$channels['clones'] = array('label' => t('Clones'), 'val' => $r[0]['clones']);
 		}
 
 		// We can do better, but this is a quick queue status
@@ -118,14 +120,11 @@ class Admin extends \Zotlabs\Web\Controller {
 		// If no plugins active return 0, otherwise list of plugin names
 		$plugins = (count(\App::$plugins) == 0) ? count(\App::$plugins) : \App::$plugins;
 
+		if(is_array($plugins))
+			sort($plugins);
+
 		// Could be extended to provide also other alerts to the admin
 		$alertmsg = '';
-		// annoy admin about upcoming unsupported PHP version
-		if (version_compare(PHP_VERSION, '5.4', '<')) {
-			$alertmsg = 'Your PHP version ' . PHP_VERSION . ' will not be supported with the next major release of $Projectname. You are strongly urged to upgrade to a current version.'
-				. '<br>PHP 5.3 has reached its <a href="http://php.net/eol.php" class="alert-link">End of Life (EOL)</a> in August 2014.'
-				. ' A list about current PHP versions can be found <a href="http://php.net/supported-versions.php" class="alert-link">here</a>.';
-		}
 
 		$vmaster = get_repository_version('master');
 		$vdev = get_repository_version('dev');
diff --git a/Zotlabs/Module/Admin/Site.php b/Zotlabs/Module/Admin/Site.php
index d05e70aa9..4c5b82e78 100644
--- a/Zotlabs/Module/Admin/Site.php
+++ b/Zotlabs/Module/Admin/Site.php
@@ -17,7 +17,6 @@ class Site {
 		check_form_security_token_redirectOnErr('/admin/site', 'admin_site');
 
 		$sitename 			=	((x($_POST,'sitename'))			? notags(trim($_POST['sitename']))			: '');
-		$server_role 		=	((x($_POST,'server_role'))		? notags(trim($_POST['server_role']))		: 'standard');
 
 		$banner				=	((x($_POST,'banner'))			? trim($_POST['banner'])				: false);
 
@@ -68,7 +67,6 @@ class Site {
 		if(array_key_exists('techlevel', $_POST))
 			$techlevel = intval($_POST['techlevel']);
 
-		set_config('system', 'server_role', $server_role);
 		set_config('system', 'feed_contacts', $feed_contacts);
 		set_config('system', 'delivery_interval', $delivery_interval);
 		set_config('system', 'delivery_batch_count', $delivery_batch_count);
@@ -254,12 +252,6 @@ class Site {
 		// now invert the logic for the setting.
 		$discover_tab = (1 - $discover_tab);
 
-		$server_roles = [
-			'basic'    => t('Basic/Minimal Social Networking'),
-			'standard' => t('Standard Configuration (default)'),
-			'pro'      => t('Professional')
-		];
-
 		$techlevels = [
 			'0' => t('Beginner/Basic'),
 			'1' => t('Novice - not skilled but willing to learn'),
@@ -286,8 +278,6 @@ class Site {
 			// name, label, value, help string, extra data...
 			'$sitename' 		=> array('sitename', t("Site name"), htmlspecialchars(get_config('system','sitename'), ENT_QUOTES, 'UTF-8'),''),
 
-			'$server_role' 		=> array('server_role', t("Server Configuration/Role"), get_config('system','server_role'),'',$server_roles),
-
 			'$techlevel' => [ 'techlevel', t('Site default technical skill level'), get_config('system','techlevel'), t('Used to provide a member experience matched to technical comfort level'), $techlevels ],
 
 			'$techlock' => [ 'techlock', t('Lock the technical skill level setting'), get_config('system','techlevel_lock'), t('Members can set their own technical comfort level by default') ],
diff --git a/Zotlabs/Module/Ap_probe.php b/Zotlabs/Module/Ap_probe.php
new file mode 100644
index 000000000..769cd4c4e
--- /dev/null
+++ b/Zotlabs/Module/Ap_probe.php
@@ -0,0 +1,38 @@
+<?php
+namespace Zotlabs\Module;
+
+require_once('include/zot.php');
+
+
+class Ap_probe extends \Zotlabs\Web\Controller {
+
+	function get() {
+	
+		$o .= '<h3>ActivityPub Probe Diagnostic</h3>';
+	
+		$o .= '<form action="ap_probe" method="get">';
+		$o .= 'Lookup URI: <input type="text" style="width: 250px;" name="addr" value="' . $_GET['addr'] .'" /><br>';
+		$o .= 'Request Signed version: <input type=checkbox name="magenv" value="1" ><br>';
+		$o .= '<input type="submit" name="submit" value="Submit" /></form>'; 
+	
+		$o .= '<br /><br />';
+	
+		if(x($_GET,'addr')) {
+			$addr = $_GET['addr'];
+
+			if($_GET['magenv']) {
+				$headers = 'Accept: application/magic-envelope+json, application/ld+json; profile="https://www.w3.org/ns/activitystreams"';
+			}
+			else {
+				$headers = 'Accept: application/ld+json; profile="https://www.w3.org/ns/activitystreams"';
+			}
+
+			$redirects = 0;
+		    $x = z_fetch_url($addr,true,$redirects, [ 'headers' => [ $headers ]]);
+	    	if($x['success'])
+				$o .= '<pre>' . str_replace(['\\n','\\'],["\n",''],jindent($x['body'])) . '</pre>';
+		}
+		return $o;
+	}
+	
+}
diff --git a/Zotlabs/Module/Appman.php b/Zotlabs/Module/Appman.php
index 70cc7e44b..5c0667357 100644
--- a/Zotlabs/Module/Appman.php
+++ b/Zotlabs/Module/Appman.php
@@ -84,6 +84,20 @@ class Appman extends \Zotlabs\Web\Controller {
 		}
 
 		$channel = \App::get_channel();
+
+		if(argc() > 2) {
+			if(argv(2) === 'moveup') {
+				Zlib\Apps::moveup(local_channel(),argv(1));
+			}
+			if(argv(2) === 'movedown') {
+				Zlib\Apps::movedown(local_channel(),argv(1));
+			}
+			goaway(z_root() . '/apporder');
+		}
+
+
+
+
 		$app = null;
 		$embed = null;
 		if($_REQUEST['appid']) {
diff --git a/Zotlabs/Module/Apporder.php b/Zotlabs/Module/Apporder.php
new file mode 100644
index 000000000..1097a01eb
--- /dev/null
+++ b/Zotlabs/Module/Apporder.php
@@ -0,0 +1,40 @@
+<?php
+
+namespace Zotlabs\Module;
+
+use \Zotlabs\Lib as Zlib;
+
+class Apporder extends \Zotlabs\Web\Controller {
+
+	function post() {
+
+	}
+
+	function get() {
+       $syslist = array();
+        $list = Zlib\Apps::app_list(local_channel(), false, 'nav_featured_app');
+        if($list) {
+            foreach($list as $li) {
+                $syslist[] = Zlib\Apps::app_encode($li);
+            }
+        }
+        Zlib\Apps::translate_system_apps($syslist);
+
+	    usort($syslist,'Zotlabs\\Lib\\Apps::app_name_compare');
+
+    	$syslist = Zlib\Apps::app_order(local_channel(),$syslist);
+
+	    foreach($syslist as $app) {
+    	    $nav_apps[] = Zlib\Apps::app_render($app,'nav-order');
+
+		}
+
+	return replace_macros(get_markup_template('apporder.tpl'),
+		[
+			'$header' => t('Change Order of Navigation Apps'),
+			'$desc' => t('Use arrows to move the corresponding app up or down in the display list'),
+			'$nav_apps' => $nav_apps
+		]
+	);
+	}
+}
diff --git a/Zotlabs/Module/Authorize.php b/Zotlabs/Module/Authorize.php
new file mode 100644
index 000000000..06f66c456
--- /dev/null
+++ b/Zotlabs/Module/Authorize.php
@@ -0,0 +1,71 @@
+<?php
+
+namespace Zotlabs\Module;
+
+
+class Authorize extends \Zotlabs\Web\Controller {
+
+
+	function get() {
+
+
+			// workaround for HTTP-auth in CGI mode
+			if (x($_SERVER, 'REDIRECT_REMOTE_USER')) {
+				$userpass = base64_decode(substr($_SERVER["REDIRECT_REMOTE_USER"], 6)) ;
+				if(strlen($userpass)) {
+					list($name, $password) = explode(':', $userpass);
+					$_SERVER['PHP_AUTH_USER'] = $name;
+					$_SERVER['PHP_AUTH_PW'] = $password;
+				}
+			}
+
+			if (x($_SERVER, 'HTTP_AUTHORIZATION')) {
+				$userpass = base64_decode(substr($_SERVER["HTTP_AUTHORIZATION"], 6)) ;
+				if(strlen($userpass)) {
+					list($name, $password) = explode(':', $userpass);
+					$_SERVER['PHP_AUTH_USER'] = $name;
+					$_SERVER['PHP_AUTH_PW'] = $password;
+				}
+			}
+
+
+
+
+	require_once('include/oauth2.php');
+
+	$request = \OAuth2\Request::createFromGlobals();
+	$response = new \OAuth2\Response();
+
+	// validate the authorize request
+	if (! $oauth2_server->validateAuthorizeRequest($request, $response)) {
+	    $response->send();
+    	killme();
+	}
+
+	// display an authorization form
+	if (empty($_POST)) {
+
+	  return '
+<form method="post">
+  <label>Do You Authorize TestClient?</label><br />
+  <input type="submit" name="authorized" value="yes">
+  <input type="submit" name="authorized" value="no">
+</form>';
+	}
+
+	// print the authorization code if the user has authorized your client
+	$is_authorized = ($_POST['authorized'] === 'yes');
+	$oauth2_server->handleAuthorizeRequest($request, $response, $is_authorized);
+	if ($is_authorized) {
+		// this is only here so that you get to see your code in the cURL request. Otherwise, 
+		// we'd redirect back to the client
+		$code = substr($response->getHttpHeader('Location'), strpos($response->getHttpHeader('Location'), 'code=')+5, 40);
+		echo("SUCCESS! Authorization Code: $code");
+		
+	}
+
+	$response->send();
+	killme();
+	}
+
+}
\ No newline at end of file
diff --git a/Zotlabs/Module/Block.php b/Zotlabs/Module/Block.php
index e671730f6..d0fed44fe 100644
--- a/Zotlabs/Module/Block.php
+++ b/Zotlabs/Module/Block.php
@@ -3,8 +3,6 @@ namespace Zotlabs\Module;
 
 require_once('include/items.php');
 require_once('include/conversation.php');
-require_once('include/page_widgets.php');
-
 
 class Block extends \Zotlabs\Web\Controller {
 
diff --git a/Zotlabs/Module/Bookmarks.php b/Zotlabs/Module/Bookmarks.php
index 682f8e76c..e62f5ce96 100644
--- a/Zotlabs/Module/Bookmarks.php
+++ b/Zotlabs/Module/Bookmarks.php
@@ -7,6 +7,9 @@ class Bookmarks extends \Zotlabs\Web\Controller {
 	function init() {
 		if(! local_channel())
 			return;
+
+		nav_set_selected(t('View Bookmarks'));
+
 		$item_id = intval($_REQUEST['item']);
 		$burl = trim($_REQUEST['burl']);
 	
diff --git a/Zotlabs/Module/Cdav.php b/Zotlabs/Module/Cdav.php
new file mode 100644
index 000000000..d0619ef0b
--- /dev/null
+++ b/Zotlabs/Module/Cdav.php
@@ -0,0 +1,1209 @@
+<?php
+namespace Zotlabs\Module;
+
+require_once('include/event.php');
+
+class Cdav extends \Zotlabs\Web\Controller {
+
+	function init() {
+
+		if((argv(1) !== 'calendar') && (argv(1) !== 'addressbook')) {
+
+			// workaround for HTTP-auth in CGI mode
+			if (x($_SERVER, 'REDIRECT_REMOTE_USER')) {
+				$userpass = base64_decode(substr($_SERVER["REDIRECT_REMOTE_USER"], 6)) ;
+				if(strlen($userpass)) {
+					list($name, $password) = explode(':', $userpass);
+					$_SERVER['PHP_AUTH_USER'] = $name;
+					$_SERVER['PHP_AUTH_PW'] = $password;
+				}
+			}
+
+			if (x($_SERVER, 'HTTP_AUTHORIZATION')) {
+				$userpass = base64_decode(substr($_SERVER["HTTP_AUTHORIZATION"], 6)) ;
+				if(strlen($userpass)) {
+					list($name, $password) = explode(':', $userpass);
+					$_SERVER['PHP_AUTH_USER'] = $name;
+					$_SERVER['PHP_AUTH_PW'] = $password;
+				}
+			}
+
+			/**
+			 * This server combines both CardDAV and CalDAV functionality into a single
+			 * server. It is assumed that the server runs at the root of a HTTP domain (be
+			 * that a domainname-based vhost or a specific TCP port.
+			 *
+			 * This example also assumes that you're using SQLite and the database has
+			 * already been setup (along with the database tables).
+			 *
+			 * You may choose to use MySQL instead, just change the PDO connection
+			 * statement.
+			 */
+
+			/**
+			 * UTC or GMT is easy to work with, and usually recommended for any
+			 * application.
+			 */
+			date_default_timezone_set('UTC');
+
+			/**
+			 * Make sure this setting is turned on and reflect the root url for your WebDAV
+			 * server.
+			 *
+			 * This can be for example the root / or a complete path to your server script.
+			 */
+
+			$baseUri = '/cdav/';
+
+			/**
+			 * Database
+			 *
+			 */
+
+			$pdo = \DBA::$dba->db;
+
+			// Autoloader
+			require_once 'vendor/autoload.php';
+
+			/**
+			 * The backends. Yes we do really need all of them.
+			 *
+			 * This allows any developer to subclass just any of them and hook into their
+			 * own backend systems.
+			 */
+
+			$auth = new \Zotlabs\Storage\BasicAuth();
+			$auth->setRealm(ucfirst(\Zotlabs\Lib\System::get_platform_name()) . 'CalDAV/CardDAV');
+
+			if (local_channel()) {
+				logger('loggedin');
+				$channel = \App::get_channel();
+				$auth->setCurrentUser($channel['channel_address']);
+				$auth->channel_id = $channel['channel_id'];
+				$auth->channel_hash = $channel['channel_hash'];
+				$auth->channel_account_id = $channel['channel_account_id'];
+				if($channel['channel_timezone'])
+					$auth->setTimezone($channel['channel_timezone']);
+				$auth->observer = $channel['channel_hash'];
+
+				$principalUri = 'principals/' . $channel['channel_address'];
+				if(!cdav_principal($principalUri)) {
+					$this->activate($pdo, $channel);
+					if(!cdav_principal($principalUri)) {
+						return;
+					}
+				}
+
+			}
+
+
+			$principalBackend = new \Sabre\DAVACL\PrincipalBackend\PDO($pdo);
+			$carddavBackend   = new \Sabre\CardDAV\Backend\PDO($pdo);
+			$caldavBackend    = new \Sabre\CalDAV\Backend\PDO($pdo);
+
+			/**
+			 * The directory tree
+			 *
+			 * Basically this is an array which contains the 'top-level' directories in the
+			 * WebDAV server.
+			 */
+
+			$nodes = [
+				// /principals
+				new \Sabre\CalDAV\Principal\Collection($principalBackend),
+				// /calendars
+				new \Sabre\CalDAV\CalendarRoot($principalBackend, $caldavBackend),
+				// /addressbook
+				new \Sabre\CardDAV\AddressBookRoot($principalBackend, $carddavBackend),
+			];
+
+			// The object tree needs in turn to be passed to the server class
+
+			$server = new \Sabre\DAV\Server($nodes);
+
+			if(isset($baseUri))
+				$server->setBaseUri($baseUri);
+
+			// Plugins
+			$server->addPlugin(new \Sabre\DAV\Auth\Plugin($auth));
+			//$server->addPlugin(new \Sabre\DAV\Browser\Plugin());
+			$server->addPlugin(new \Sabre\DAV\Sync\Plugin());
+			$server->addPlugin(new \Sabre\DAV\Sharing\Plugin());
+			$server->addPlugin(new \Sabre\DAVACL\Plugin());
+
+			// CalDAV plugins
+			$server->addPlugin(new \Sabre\CalDAV\Plugin());
+			$server->addPlugin(new \Sabre\CalDAV\SharingPlugin());
+			//$server->addPlugin(new \Sabre\CalDAV\Schedule\Plugin());
+			$server->addPlugin(new \Sabre\CalDAV\ICSExportPlugin());
+
+			// CardDAV plugins
+			$server->addPlugin(new \Sabre\CardDAV\Plugin());
+			$server->addPlugin(new \Sabre\CardDAV\VCFExportPlugin());
+
+			// And off we go!
+			$server->exec();
+
+			killme();
+
+		}
+
+	}
+
+	function post() {
+		if(! local_channel())
+			return;
+
+		$channel = \App::get_channel();
+		$principalUri = 'principals/' . $channel['channel_address'];
+
+		if(!cdav_principal($principalUri))
+			return;
+
+		$pdo = \DBA::$dba->db;
+
+		require_once 'vendor/autoload.php';
+
+		if(argc() == 2 && argv(1) === 'calendar') {
+
+			$caldavBackend = new \Sabre\CalDAV\Backend\PDO($pdo);
+			$calendars = $caldavBackend->getCalendarsForUser($principalUri);
+
+			//create new calendar
+			if($_REQUEST['{DAV:}displayname'] && $_REQUEST['create']) {
+				do {
+					$duplicate = false;
+					$calendarUri = random_string(40);
+
+					$r = q("SELECT uri FROM calendarinstances WHERE principaluri = '%s' AND uri = '%s' LIMIT 1",
+						dbesc($principalUri),
+						dbesc($calendarUri)
+					);
+
+					if (count($r))
+						$duplicate = true;
+				} while ($duplicate == true);
+
+				$properties = [
+					'{DAV:}displayname' => $_REQUEST['{DAV:}displayname'],
+					'{http://apple.com/ns/ical/}calendar-color' => $_REQUEST['color'],
+					'{urn:ietf:params:xml:ns:caldav}calendar-description' => $channel['channel_name']
+				];
+
+				$id = $caldavBackend->createCalendar($principalUri, $calendarUri, $properties);
+
+				// set new calendar to be visible
+				set_pconfig(local_channel(), 'cdav_calendar' , $id[0], 1);
+			}
+
+			//create new calendar object via ajax request
+			if($_REQUEST['submit'] === 'create_event' && $_REQUEST['title'] && $_REQUEST['target'] && $_REQUEST['dtstart']) {
+
+				$id = explode(':', $_REQUEST['target']);
+
+				if(!cdav_perms($id[0],$calendars,true))
+					return;
+
+				$title = $_REQUEST['title'];
+				$dtstart = new \DateTime($_REQUEST['dtstart']);
+				if($_REQUEST['dtend'])
+					$dtend = new \DateTime($_REQUEST['dtend']);
+				$description = $_REQUEST['description'];
+				$location = $_REQUEST['location'];
+
+				do {
+					$duplicate = false;
+					$objectUri = random_string(40) . '.ics';
+
+					$r = q("SELECT uri FROM calendarobjects WHERE calendarid = %s AND uri = '%s' LIMIT 1",
+						intval($id[0]),
+						dbesc($objectUri)
+					);
+
+					if (count($r))
+						$duplicate = true;
+				} while ($duplicate == true);
+
+
+				$vcalendar = new \Sabre\VObject\Component\VCalendar([
+				    'VEVENT' => [
+					'SUMMARY' => $title,
+					'DTSTART' => $dtstart
+				    ]
+				]);
+				if($dtend)
+					$vcalendar->VEVENT->add('DTEND', $dtend);
+				if($description)
+					$vcalendar->VEVENT->add('DESCRIPTION', $description);
+				if($location)
+					$vcalendar->VEVENT->add('LOCATION', $location);
+
+				$calendarData = $vcalendar->serialize();
+
+				$caldavBackend->createCalendarObject($id, $objectUri, $calendarData);
+
+				killme();
+			}
+
+			//edit calendar name and color
+			if($_REQUEST['{DAV:}displayname'] && $_REQUEST['edit'] && $_REQUEST['id']) {
+
+				$id = explode(':', $_REQUEST['id']);
+
+				if(! cdav_perms($id[0],$calendars))
+					return;
+
+				$mutations = [
+					'{DAV:}displayname' => $_REQUEST['{DAV:}displayname'],
+					'{http://apple.com/ns/ical/}calendar-color' => $_REQUEST['color']
+				];
+
+				$patch = new \Sabre\DAV\PropPatch($mutations);
+
+				$caldavBackend->updateCalendar($id, $patch);
+
+				$patch->commit();
+
+			}
+
+			//edit calendar object via ajax request
+			if($_REQUEST['submit'] === 'update_event' && $_REQUEST['uri'] && $_REQUEST['title'] && $_REQUEST['target'] && $_REQUEST['dtstart']) {
+
+				$id = explode(':', $_REQUEST['target']);
+
+				if(!cdav_perms($id[0],$calendars,true))
+					return;
+
+				$uri = $_REQUEST['uri'];
+				$title = $_REQUEST['title'];
+				$dtstart = new \DateTime($_REQUEST['dtstart']);
+				$dtend = $_REQUEST['dtend'] ? new \DateTime($_REQUEST['dtend']) : '';
+				$description = $_REQUEST['description'];
+				$location = $_REQUEST['location'];
+
+				$object = $caldavBackend->getCalendarObject($id, $uri);
+
+				$vcalendar = \Sabre\VObject\Reader::read($object['calendardata']);
+
+				if($title)
+					$vcalendar->VEVENT->SUMMARY = $title;
+				if($dtstart)
+					$vcalendar->VEVENT->DTSTART = $dtstart;
+				if($dtend)
+					$vcalendar->VEVENT->DTEND = $dtend;
+				else
+					unset($vcalendar->VEVENT->DTEND);
+				if($description)
+					$vcalendar->VEVENT->DESCRIPTION = $description;
+				if($location)
+					$vcalendar->VEVENT->LOCATION = $location;
+
+				$calendarData = $vcalendar->serialize();
+
+				$caldavBackend->updateCalendarObject($id, $uri, $calendarData);
+
+				killme();
+			}
+
+			//delete calendar object via ajax request
+			if($_REQUEST['delete'] && $_REQUEST['uri'] && $_REQUEST['target']) {
+
+				$id = explode(':', $_REQUEST['target']);
+
+				if(!cdav_perms($id[0],$calendars,true))
+					return;
+
+				$uri = $_REQUEST['uri'];
+
+				$caldavBackend->deleteCalendarObject($id, $uri);
+
+				killme();
+			}
+
+			//edit calendar object date/timeme via ajax request (drag and drop)
+			if($_REQUEST['update'] && $_REQUEST['id'] && $_REQUEST['uri']) {
+
+				$id = [$_REQUEST['id'][0], $_REQUEST['id'][1]];
+
+				if(!cdav_perms($id[0],$calendars,true))
+					return;
+
+				$uri = $_REQUEST['uri'];
+				$dtstart = new \DateTime($_REQUEST['dtstart']);
+				$dtend = $_REQUEST['dtend'] ? new \DateTime($_REQUEST['dtend']) : '';
+
+				$object = $caldavBackend->getCalendarObject($id, $uri);
+
+				$vcalendar = \Sabre\VObject\Reader::read($object['calendardata']);
+
+				if($dtstart) {
+					$vcalendar->VEVENT->DTSTART = $dtstart;
+				}
+				if($dtend) {
+					$vcalendar->VEVENT->DTEND = $dtend;
+				}
+				else {
+					unset($vcalendar->VEVENT->DTEND);
+				}
+
+				$calendarData = $vcalendar->serialize();
+
+				$caldavBackend->updateCalendarObject($id, $uri, $calendarData);
+
+				killme();
+			}
+
+			//share a calendar - this only works on local system (with channels on the same server)
+			if($_REQUEST['sharee'] && $_REQUEST['share']) {
+
+				$id = [intval($_REQUEST['calendarid']), intval($_REQUEST['instanceid'])];
+
+				if(! cdav_perms($id[0],$calendars))
+					return;
+
+				$hash = $_REQUEST['sharee'];
+
+				$sharee_arr = channelx_by_hash($hash);
+
+				$sharee = new \Sabre\DAV\Xml\Element\Sharee();
+
+				$sharee->href = 'mailto:' . $sharee_arr['xchan_addr'];
+				$sharee->principal = 'principals/' . $sharee_arr['channel_address'];
+				$sharee->access = intval($_REQUEST['access']);
+				$sharee->properties = ['{DAV:}displayname' => $channel['channel_name']];
+
+				$caldavBackend->updateInvites($id, [$sharee]);
+			}
+		}
+
+		if(argc() >= 2 && argv(1) === 'addressbook') {
+
+			$carddavBackend = new \Sabre\CardDAV\Backend\PDO($pdo);
+			$addressbooks = $carddavBackend->getAddressBooksForUser($principalUri);
+
+			//create new addressbook
+			if($_REQUEST['{DAV:}displayname'] && $_REQUEST['create']) {
+				do {
+					$duplicate = false;
+					$addressbookUri = random_string(20);
+
+					$r = q("SELECT uri FROM addressbooks WHERE principaluri = '%s' AND uri = '%s' LIMIT 1",
+						dbesc($principalUri),
+						dbesc($addressbookUri)
+					);
+
+					if (count($r))
+						$duplicate = true;
+				} while ($duplicate == true);
+
+				$properties = ['{DAV:}displayname' => $_REQUEST['{DAV:}displayname']];
+
+				$carddavBackend->createAddressBook($principalUri, $addressbookUri, $properties);
+			}
+
+			//edit addressbook
+			if($_REQUEST['{DAV:}displayname'] && $_REQUEST['edit'] && intval($_REQUEST['id'])) {
+
+				$id = $_REQUEST['id'];
+
+				if(! cdav_perms($id,$addressbooks))
+					return;
+
+				$mutations = [
+					'{DAV:}displayname' => $_REQUEST['{DAV:}displayname']
+				];
+
+				$patch = new \Sabre\DAV\PropPatch($mutations);
+
+				$carddavBackend->updateAddressBook($id, $patch);
+
+				$patch->commit();
+			}
+
+			//create addressbook card
+			if($_REQUEST['create'] && $_REQUEST['target'] && $_REQUEST['fn']) {
+				$id = $_REQUEST['target'];
+
+				do {
+					$duplicate = false;
+					$uri = random_string(40) . '.vcf';
+
+					$r = q("SELECT uri FROM cards WHERE addressbookid = %s AND uri = '%s' LIMIT 1",
+						intval($id),
+						dbesc($uri)
+					);
+
+					if (count($r))
+						$duplicate = true;
+				} while ($duplicate == true);
+
+				//TODO: this mostly duplictes the procedure in update addressbook card. should move this part to a function to avoid duplication
+				$fn = $_REQUEST['fn'];
+
+				$vcard = new \Sabre\VObject\Component\VCard([
+					'FN' => $fn,
+					'N' => array_reverse(explode(' ', $fn))
+				]);
+
+				$org = $_REQUEST['org'];
+				if($org) {
+					$vcard->ORG = $org;
+				}
+
+				$title = $_REQUEST['title'];
+				if($title) {
+					$vcard->TITLE = $title;
+				}
+
+				$tel = $_REQUEST['tel'];
+				$tel_type = $_REQUEST['tel_type'];
+				if($tel) {
+					$i = 0;
+					foreach($tel as $item) {
+						if($item) {
+							$vcard->add('TEL', $item, ['type' => $tel_type[$i]]);
+						}
+						$i++;
+					}
+				}
+
+				$email = $_REQUEST['email'];
+				$email_type = $_REQUEST['email_type'];
+				if($email) {
+					$i = 0;
+					foreach($email as $item) {
+						if($item) {
+							$vcard->add('EMAIL', $item, ['type' => $email_type[$i]]);
+						}
+						$i++;
+					}
+				}
+
+				$impp = $_REQUEST['impp'];
+				$impp_type = $_REQUEST['impp_type'];
+				if($impp) {
+					$i = 0;
+					foreach($impp as $item) {
+						if($item) {
+							$vcard->add('IMPP', $item, ['type' => $impp_type[$i]]);
+						}
+						$i++;
+					}
+				}
+
+				$url = $_REQUEST['url'];
+				$url_type = $_REQUEST['url_type'];
+				if($url) {
+					$i = 0;
+					foreach($url as $item) {
+						if($item) {
+							$vcard->add('URL', $item, ['type' => $url_type[$i]]);
+						}
+						$i++;
+					}
+				}
+
+				$adr = $_REQUEST['adr'];
+				$adr_type = $_REQUEST['adr_type'];
+
+				if($adr) {
+					$i = 0;
+					foreach($adr as $item) {
+						if($item) {
+							$vcard->add('ADR', $item, ['type' => $adr_type[$i]]);
+						}
+						$i++;
+					}
+				}
+
+				$note = $_REQUEST['note'];
+				if($note) {
+					$vcard->NOTE = $note;
+				}
+
+				$cardData = $vcard->serialize();
+
+				$carddavBackend->createCard($id, $uri, $cardData);
+
+			}
+
+			//edit addressbook card
+			if($_REQUEST['update'] && $_REQUEST['uri'] && $_REQUEST['target']) {
+
+				$id = $_REQUEST['target'];
+
+				if(!cdav_perms($id,$addressbooks))
+					return;
+
+				$uri = $_REQUEST['uri'];
+
+				$object = $carddavBackend->getCard($id, $uri);
+				$vcard = \Sabre\VObject\Reader::read($object['carddata']);
+
+				$fn = $_REQUEST['fn'];
+				if($fn) {
+					$vcard->FN = $fn;
+					$vcard->N = array_reverse(explode(' ', $fn));
+				}
+
+				$org = $_REQUEST['org'];
+				if($org) {
+					$vcard->ORG = $org;
+				}
+				else {
+					unset($vcard->ORG);
+				}
+
+				$title = $_REQUEST['title'];
+				if($title) {
+					$vcard->TITLE = $title;
+				}
+				else {
+					unset($vcard->TITLE);
+				}
+
+				$tel = $_REQUEST['tel'];
+				$tel_type = $_REQUEST['tel_type'];
+				if($tel) {
+					$i = 0;
+					unset($vcard->TEL);
+					foreach($tel as $item) {
+						if($item) {
+							$vcard->add('TEL', $item, ['type' => $tel_type[$i]]);
+						}
+						$i++;
+					}
+				}
+				else {
+					unset($vcard->TEL);
+				}
+
+				$email = $_REQUEST['email'];
+				$email_type = $_REQUEST['email_type'];
+				if($email) {
+					$i = 0;
+					unset($vcard->EMAIL);
+					foreach($email as $item) {
+						if($item) {
+							$vcard->add('EMAIL', $item, ['type' => $email_type[$i]]);
+						}
+						$i++;
+					}
+				}
+				else {
+					unset($vcard->EMAIL);
+				}
+
+				$impp = $_REQUEST['impp'];
+				$impp_type = $_REQUEST['impp_type'];
+				if($impp) {
+					$i = 0;
+					unset($vcard->IMPP);
+					foreach($impp as $item) {
+						if($item) {
+							$vcard->add('IMPP', $item, ['type' => $impp_type[$i]]);
+						}
+						$i++;
+					}
+				}
+				else {
+					unset($vcard->IMPP);
+				}
+
+				$url = $_REQUEST['url'];
+				$url_type = $_REQUEST['url_type'];
+				if($url) {
+					$i = 0;
+					unset($vcard->URL);
+					foreach($url as $item) {
+						if($item) {
+							$vcard->add('URL', $item, ['type' => $url_type[$i]]);
+						}
+						$i++;
+					}
+				}
+				else {
+					unset($vcard->URL);
+				}
+
+				$adr = $_REQUEST['adr'];
+				$adr_type = $_REQUEST['adr_type'];
+				if($adr) {
+					$i = 0;
+					unset($vcard->ADR);
+					foreach($adr as $item) {
+						if($item) {
+							$vcard->add('ADR', $item, ['type' => $adr_type[$i]]);
+						}
+						$i++;
+					}
+				}
+				else {
+					unset($vcard->ADR);
+				}
+
+				$note = $_REQUEST['note'];
+				if($note) {
+					$vcard->NOTE = $note;
+				}
+				else {
+					unset($vcard->NOTE);
+				}
+
+				$cardData = $vcard->serialize();
+
+				$carddavBackend->updateCard($id, $uri, $cardData);
+			}
+
+			//delete addressbook card
+			if($_REQUEST['delete'] && $_REQUEST['uri'] && $_REQUEST['target']) {
+
+				$id = $_REQUEST['target'];
+
+				if(!cdav_perms($id,$addressbooks))
+					return;
+
+				$uri = $_REQUEST['uri'];
+
+				$carddavBackend->deleteCard($id, $uri);
+			}
+		}
+
+		//Import calendar or addressbook
+		if(($_FILES) && array_key_exists('userfile',$_FILES) && intval($_FILES['userfile']['size']) && $_REQUEST['target']) {
+
+			$src = @file_get_contents($_FILES['userfile']['tmp_name']);
+
+			if($src) {
+
+				if($_REQUEST['c_upload']) {
+					$id = explode(':', $_REQUEST['target']);
+					$ext = 'ics';
+					$table = 'calendarobjects';
+					$column = 'calendarid';
+					$objects = new \Sabre\VObject\Splitter\ICalendar($src);
+					$profile = \Sabre\VObject\Node::PROFILE_CALDAV;
+					$backend = new \Sabre\CalDAV\Backend\PDO($pdo);
+				}
+
+				if($_REQUEST['a_upload']) {
+					$id[] = intval($_REQUEST['target']);
+					$ext = 'vcf';
+					$table = 'cards';
+					$column = 'addressbookid';
+					$objects = new \Sabre\VObject\Splitter\VCard($src);
+					$profile = \Sabre\VObject\Node::PROFILE_CARDDAV;
+					$backend = new \Sabre\CardDAV\Backend\PDO($pdo);
+				}
+
+				while ($object = $objects->getNext()) {
+
+					if($_REQUEST['a_upload']) {
+						$object = $object->convert(\Sabre\VObject\Document::VCARD40);
+					}
+
+					$ret = $object->validate($profile & \Sabre\VObject\Node::REPAIR);
+
+					//level 3 Means that the document is invalid,
+					//level 2 means a warning. A warning means it's valid but it could cause interopability issues,
+					//level 1 means that there was a problem earlier, but the problem was automatically repaired.
+
+					if($ret[0]['level'] < 3) {
+						do {
+							$duplicate = false;
+							$objectUri = random_string(40) . '.' . $ext;
+
+							$r = q("SELECT uri FROM $table WHERE $column = %d AND uri = '%s' LIMIT 1",
+								dbesc($id[0]),
+								dbesc($objectUri)
+							);
+
+							if (count($r))
+								$duplicate = true;
+						} while ($duplicate == true);
+
+						if($_REQUEST['c_upload']) {
+							$backend->createCalendarObject($id, $objectUri, $object->serialize());
+						}
+
+						if($_REQUEST['a_upload']) {
+							$backend->createCard($id[0], $objectUri, $object->serialize());
+						}
+					}
+					else {
+						if($_REQUEST['c_upload']) {
+							notice( '<strong>' . t('INVALID EVENT DISMISSED!') . '</strong>' . EOL .
+								'<strong>' . t('Summary: ') . '</strong>' . (($object->VEVENT->SUMMARY) ? $object->VEVENT->SUMMARY : t('Unknown')) . EOL .
+								'<strong>' . t('Date: ') . '</strong>' . (($object->VEVENT->DTSTART) ? $object->VEVENT->DTSTART : t('Unknown')) . EOL .
+								'<strong>' . t('Reason: ') . '</strong>' . $ret[0]['message'] . EOL
+							);
+						}
+
+						if($_REQUEST['a_upload']) {
+							notice( '<strong>' . t('INVALID CARD DISMISSED!') . '</strong>' . EOL .
+								'<strong>' . t('Name: ') . '</strong>' . (($object->FN) ? $object->FN : t('Unknown')) . EOL .
+								'<strong>' . t('Reason: ') . '</strong>' . $ret[0]['message'] . EOL
+							);
+						}
+					}
+				}
+			}
+			@unlink($src);
+		}
+	}
+
+	function get() {
+
+		if(!local_channel())
+			return;
+
+		$channel = \App::get_channel();
+		$principalUri = 'principals/' . $channel['channel_address'];
+
+		$pdo = \DBA::$dba->db;
+
+		require_once 'vendor/autoload.php';
+
+		head_add_css('cdav.css');
+
+		if(!cdav_principal($principalUri)) {
+			$this->activate($pdo, $channel);
+			if(!cdav_principal($principalUri)) {
+				return;
+			}
+		}
+
+		if(argv(1) === 'calendar') {
+			nav_set_selected(t('CalDAV'));
+			$caldavBackend = new \Sabre\CalDAV\Backend\PDO($pdo);
+			$calendars = $caldavBackend->getCalendarsForUser($principalUri);
+		}
+
+		//Display calendar(s) here
+		if(argc() == 2 && argv(1) === 'calendar') {
+
+			head_add_css('/library/fullcalendar/fullcalendar.css');
+			head_add_css('cdav_calendar.css');
+
+			head_add_js('/library/moment/moment.min.js', 1);
+			head_add_js('/library/fullcalendar/fullcalendar.min.js', 1);
+			head_add_js('/library/fullcalendar/locale-all.js', 1);
+
+			foreach($calendars as $calendar) {
+				$editable = (($calendar['share-access'] == 2) ? 'false' : 'true');  // false/true must be string since we're passing it to javascript
+				$color = (($calendar['{http://apple.com/ns/ical/}calendar-color']) ? $calendar['{http://apple.com/ns/ical/}calendar-color'] : '#3a87ad');
+				$sharer = (($calendar['share-access'] == 3) ? $calendar['{urn:ietf:params:xml:ns:caldav}calendar-description'] : '');
+				$switch = get_pconfig(local_channel(), 'cdav_calendar', $calendar['id'][0]);
+				if($switch) {
+					$sources .= '{
+						url: \'/cdav/calendar/json/' . $calendar['id'][0] . '/' . $calendar['id'][1] . '\',
+						color: \'' . $color . '\'
+					 }, ';
+				}
+
+				if($calendar['share-access'] != 2) {
+					$writable_calendars[] = [
+						'displayname' => $calendar['{DAV:}displayname'],
+						'sharer' => $sharer,
+						'id' => $calendar['id']
+					];
+				}
+			}
+
+			$sources = rtrim($sources, ', ');
+
+			$first_day = get_pconfig(local_channel(),'system','cal_first_day');
+			$first_day = (($first_day) ? $first_day : 0);
+
+			$title = ['title', t('Event title')];
+			$dtstart = ['dtstart', t('Start date and time'), '', t('Example: YYYY-MM-DD HH:mm')];
+			$dtend = ['dtend', t('End date and time'), '', t('Example: YYYY-MM-DD HH:mm')];
+			$description = ['description', t('Description')];
+			$location = ['location', t('Location')];
+
+			$o .= replace_macros(get_markup_template('cdav_calendar.tpl'), [
+				'$sources' => $sources,
+				'$color' => $color,
+				'$lang' => \App::$language,
+				'$first_day' => $first_day,
+				'$prev'	=> t('Previous'),
+				'$next'	=> t('Next'),
+				'$today' => t('Today'),
+				'$month' => t('Month'),
+				'$week' => t('Week'),
+				'$day' => t('Day'),
+				'$list_month' => t('List month'),
+				'$list_week' => t('List week'),
+				'$list_day' => t('List day'),
+				'$title' => $title,
+				'$writable_calendars' => $writable_calendars,
+				'$dtstart' => $dtstart,
+				'$dtend' => $dtend,
+				'$description' => $description,
+				'$location' => $location,
+				'$more' => t('More'),
+				'$less' => t('Less'),
+				'$calendar_select_label' => t('Select calendar'),
+				'$delete' => t('Delete'),
+				'$delete_all' => t('Delete all'),
+				'$cancel' => t('Cancel'),
+				'$recurrence_warning' => t('Sorry! Editing of recurrent events is not yet implemented.')
+			]);
+
+			return $o;
+
+		}
+
+		//Provide json data for calendar
+		if(argc() == 5 && argv(1) === 'calendar' && argv(2) === 'json'  && intval(argv(3)) && intval(argv(4))) {
+
+			$id = [argv(3), argv(4)];
+
+			if(! cdav_perms($id[0],$calendars))
+				killme();
+
+			if (x($_GET,'start'))
+				$start = new \DateTime($_GET['start']);
+			if (x($_GET,'end'))
+				$end = new \DateTime($_GET['end']);
+
+			$filters['name'] = 'VCALENDAR';
+			$filters['prop-filters'][0]['name'] = 'VEVENT';
+			$filters['comp-filters'][0]['name'] = 'VEVENT';
+			$filters['comp-filters'][0]['time-range']['start'] = $start;
+			$filters['comp-filters'][0]['time-range']['end'] = $end;
+
+			$uris = $caldavBackend->calendarQuery($id, $filters);
+			if($uris) {
+
+				$objects = $caldavBackend->getMultipleCalendarObjects($id, $uris);
+
+				foreach($objects as $object) {
+
+					$vcalendar = \Sabre\VObject\Reader::read($object['calendardata']);
+
+					if(isset($vcalendar->VEVENT->RRULE))
+						$vcalendar = $vcalendar->expand($start, $end);
+
+					foreach($vcalendar->VEVENT as $vevent) {
+						$title = (string)$vevent->SUMMARY;
+						$dtstart = (string)$vevent->DTSTART;
+						$dtend = (string)$vevent->DTEND;
+						$description = (string)$vevent->DESCRIPTION;
+						$location = (string)$vevent->LOCATION;
+
+						$rw = ((cdav_perms($id[0],$calendars,true)) ? true : false);
+						$recurrent = ((isset($vevent->{'RECURRENCE-ID'})) ? true : false);
+
+						$editable = $rw ? true : false;
+
+						if($recurrent)
+							$editable = false;
+
+						$allDay = false;
+
+						// allDay event rules
+						if(!strpos($dtstart, 'T') && !strpos($dtend, 'T'))
+							$allDay = true;
+						if(strpos($dtstart, 'T000000') && strpos($dtend, 'T000000'))
+							$allDay = true;
+
+						$events[] = [
+							'calendar_id' => $id,
+							'uri' => $object['uri'],
+							'title' => $title,
+							'start' => $dtstart,
+							'end' => $dtend,
+							'description' => $description,
+							'location' => $location,
+							'allDay' => $allDay,
+							'editable' => $editable,
+							'recurrent' => $recurrent,
+							'rw' => $rw
+						];
+					}
+				}
+				json_return_and_die($events);
+			}
+			else {
+				killme();
+			}
+		}
+
+		//enable/disable calendars
+		if(argc() == 5 && argv(1) === 'calendar' && argv(2) === 'switch'  && intval(argv(3)) && (argv(4) == 1 || argv(4) == 0)) {
+			$id = argv(3);
+
+			if(! cdav_perms($id,$calendars))
+				killme();
+
+			set_pconfig(local_channel(), 'cdav_calendar' , argv(3), argv(4));
+			killme();
+		}
+
+		//drop calendar
+		if(argc() == 5 && argv(1) === 'calendar' && argv(2) === 'drop' && intval(argv(3)) && intval(argv(4))) {
+			$id = [argv(3), argv(4)];
+
+			if(! cdav_perms($id[0],$calendars))
+				killme();
+
+			$caldavBackend->deleteCalendar($id);
+			killme();
+		}
+
+		//drop sharee
+		if(argc() == 6 && argv(1) === 'calendar' && argv(2) === 'dropsharee'  && intval(argv(3)) && intval(argv(4))) {
+
+			$id = [argv(3), argv(4)];
+			$hash = argv(5);
+
+			if(! cdav_perms($id[0],$calendars))
+				killme();
+
+			$sharee_arr = channelx_by_hash($hash);
+
+			$sharee = new \Sabre\DAV\Xml\Element\Sharee();
+
+			$sharee->href = 'mailto:' . $sharee_arr['xchan_addr'];
+			$sharee->principal = 'principals/' . $sharee_arr['channel_address'];
+			$sharee->access = 4;
+			$caldavBackend->updateInvites($id, [$sharee]);
+
+			killme();
+		}
+
+
+		if(argv(1) === 'addressbook') {
+			nav_set_selected(t('CardDAV'));
+			$carddavBackend = new \Sabre\CardDAV\Backend\PDO($pdo);
+			$addressbooks = $carddavBackend->getAddressBooksForUser($principalUri);
+		}
+
+		//Display Adressbook here
+		if(argc() == 3 && argv(1) === 'addressbook' && intval(argv(2))) {
+
+			$id = argv(2);
+
+			$displayname = cdav_perms($id,$addressbooks);
+
+			if(!$displayname)
+				return;
+
+			head_add_css('cdav_addressbook.css');
+
+			$o = '';
+
+			$sabrecards = $carddavBackend->getCards($id);
+			foreach($sabrecards as $sabrecard) {
+				$uris[] = $sabrecard['uri'];
+			}
+
+			if($uris) {
+				$objects = $carddavBackend->getMultipleCards($id, $uris);
+
+				foreach($objects as $object) {
+					$vcard = \Sabre\VObject\Reader::read($object['carddata']);
+
+					$photo = '';
+					if($vcard->PHOTO) {
+						$photo_value = strtolower($vcard->PHOTO->getValueType()); // binary or uri
+						if($photo_value === 'binary') {
+							$photo_type = strtolower($vcard->PHOTO['TYPE']); // mime jpeg, png or gif
+							$photo = 'data:image/' . $photo_type . ';base64,' . base64_encode((string)$vcard->PHOTO);
+						}
+						else {
+							$url = parse_url((string)$vcard->PHOTO);
+							$photo = 'data:' . $url['path'];
+						}
+					}
+
+					$fn = '';
+					if($vcard->FN) {
+						$fn = (string)$vcard->FN;
+					}
+
+					$org = '';
+					if($vcard->ORG) {
+						$org = (string)$vcard->ORG;
+					}
+
+					$title = '';
+					if($vcard->TITLE) {
+						$title = (string)$vcard->TITLE;
+					}
+
+					$tels = [];
+					if($vcard->TEL) {
+						foreach($vcard->TEL as $tel) {
+							$type = (($tel['TYPE']) ? translate_type((string)$tel['TYPE']) : '');
+							$tels[] = [
+								'type' => $type,
+								'nr' => (string)$tel
+							];
+						}
+					}
+
+					$emails = [];
+					if($vcard->EMAIL) {
+						foreach($vcard->EMAIL as $email) {
+							$type = (($email['TYPE']) ? translate_type((string)$email['TYPE']) : '');
+							$emails[] = [
+								'type' => $type,
+								'address' => (string)$email
+							];
+						}
+					}
+
+					$impps = [];
+					if($vcard->IMPP) {
+						foreach($vcard->IMPP as $impp) {
+							$type = (($impp['TYPE']) ? translate_type((string)$impp['TYPE']) : '');
+							$impps[] = [
+								'type' => $type,
+								'address' => (string)$impp
+							];
+						}
+					}
+
+					$urls = [];
+					if($vcard->URL) {
+						foreach($vcard->URL as $url) {
+							$type = (($url['TYPE']) ? translate_type((string)$url['TYPE']) : '');
+							$urls[] = [
+								'type' => $type,
+								'address' => (string)$url
+							];
+						}
+					}
+
+					$adrs = [];
+					if($vcard->ADR) {
+						foreach($vcard->ADR as $adr) {
+							$type = (($adr['TYPE']) ? translate_type((string)$adr['TYPE']) : '');
+							$adrs[] = [
+								'type' => $type,
+								'address' => $adr->getParts()
+							];
+						}
+					}
+
+					$note = '';
+					if($vcard->NOTE) {
+						$note = (string)$vcard->NOTE;
+					}
+
+					$cards[] = [
+						'id' => $object['id'],
+						'uri' => $object['uri'],
+
+						'photo' => $photo,
+						'fn' => $fn,
+						'org' => $org,
+						'title' => $title,
+						'tels' => $tels,
+						'emails' => $emails,
+						'impps' => $impps,
+						'urls' => $urls,
+						'adrs' => $adrs,
+						'note' => $note
+					];
+				}
+
+				usort($cards, function($a, $b) { return strcasecmp($a['fn'], $b['fn']); });
+			}
+
+			$o .= replace_macros(get_markup_template('cdav_addressbook.tpl'), [
+				'$id' => $id,
+				'$cards' => $cards,
+				'$displayname' => $displayname,
+				'$name_label' => t('Name'),
+				'$org_label' => t('Organisation'),
+				'$title_label' => t('Title'),
+				'$tel_label' => t('Phone'),
+				'$email_label' => t('Email'),
+				'$impp_label' => t('Instant messenger'),
+				'$url_label' => t('Website'),
+				'$adr_label' => t('Address'),
+				'$note_label' => t('Note'),
+				'$mobile' => t('Mobile'),
+				'$home' => t('Home'),
+				'$work' => t('Work'),
+				'$other' => t('Other'),
+				'$add_card' => t('Add Contact'),
+				'$add_field' => t('Add Field'),
+				'$create' => t('Create'),
+				'$update' => t('Update'),
+				'$delete' => t('Delete'),
+				'$cancel' => t('Cancel'),
+				'$po_box' => t('P.O. Box'),
+				'$extra' => t('Additional'),
+				'$street' => t('Street'),
+				'$locality' => t('Locality'),
+				'$region' => t('Region'),
+				'$zip_code' => t('ZIP Code'),
+				'$country' => t('Country')
+			]);
+
+			return $o;
+		}
+
+		//delete addressbook
+		if(argc() > 3 && argv(1) === 'addressbook' && argv(2) === 'drop' && intval(argv(3))) {
+			$id = argv(3);
+
+			if(! cdav_perms($id,$addressbooks))
+				return;
+
+			$carddavBackend->deleteAddressBook($id);
+			killme();
+		}
+
+	}
+
+	function activate($pdo, $channel) {
+
+		if(! $channel)
+			return;
+
+		$uri = 'principals/' . $channel['channel_address'];
+		
+
+		$r = q("select * from principals where uri = '%s' limit 1",
+			dbesc($uri)
+		);
+		if($r) {
+			$r = q("update principals set email = '%s', displayname = '%s' where uri = '%s' ",
+				dbesc($channel['xchan_addr']),
+				dbesc($channel['channel_name']),
+				dbesc($uri)
+			);
+		}
+		else {
+			$r = q("insert into principals ( uri, email, displayname ) values('%s','%s','%s') ",
+				dbesc($uri),
+				dbesc($channel['xchan_addr']),
+				dbesc($channel['channel_name'])
+			);
+
+			//create default calendar
+			$caldavBackend = new \Sabre\CalDAV\Backend\PDO($pdo);
+			$properties = [
+				'{DAV:}displayname' => t('Default Calendar'),
+				'{http://apple.com/ns/ical/}calendar-color' => '#3a87ad',
+				'{urn:ietf:params:xml:ns:caldav}calendar-description' => $channel['channel_name']
+			];
+
+			$id = $caldavBackend->createCalendar($uri, 'default', $properties);
+			set_pconfig(local_channel(), 'cdav_calendar' , $id[0], 1);
+
+			//create default addressbook
+			$carddavBackend = new \Sabre\CardDAV\Backend\PDO($pdo);
+			$properties = ['{DAV:}displayname' => t('Default Addressbook')];
+			$carddavBackend->createAddressBook($uri, $default, $properties);
+
+		}
+	}
+
+
+}
diff --git a/Zotlabs/Module/Channel.php b/Zotlabs/Module/Channel.php
index 61df35a60..a44984c97 100644
--- a/Zotlabs/Module/Channel.php
+++ b/Zotlabs/Module/Channel.php
@@ -94,7 +94,7 @@ class Channel extends \Zotlabs\Web\Controller {
 		}
 		else {
 			if(\App::$profile['profile_uid'] == local_channel()) {
-				nav_set_selected('home');
+				nav_set_selected(t('Channel Home'));
 			}
 		}
 
@@ -217,10 +217,10 @@ class Channel extends \Zotlabs\Web\Controller {
 		else {
 
 			if(x($category)) {
-				$sql_extra .= protect_sprintf(term_query('item', $category, TERM_CATEGORY));
+				$sql_extra2 .= protect_sprintf(term_item_parent_query(\App::$profile['profile_uid'],'item', $category, TERM_CATEGORY));
 			}
 			if(x($hashtags)) {
-				$sql_extra .= protect_sprintf(term_query('item', $hashtags, TERM_HASHTAG, TERM_COMMUNITYTAG));
+				$sql_extra2 .= protect_sprintf(term_item_parent_query(\App::$profile['profile_uid'],'item', $hashtags, TERM_HASHTAG, TERM_COMMUNITYTAG));
 			}
 
 			if($datequery) {
@@ -236,9 +236,9 @@ class Channel extends \Zotlabs\Web\Controller {
 
 			if($load || ($checkjs->disabled())) {
 				if($mid) {
-					$r = q("SELECT parent AS item_id from item where mid = '%s' and uid = %d $item_normal
+					$r = q("SELECT parent AS item_id from item where mid like '%s' and uid = %d $item_normal
 						AND item_wall = 1 $sql_extra limit 1",
-						dbesc($mid),
+						dbesc($mid . '%'),
 						intval(\App::$profile['profile_uid'])
 					);
 					if (! $r) {
@@ -325,8 +325,8 @@ class Channel extends \Zotlabs\Web\Controller {
 				'$order' => '',
 				'$list' => ((x($_REQUEST,'list')) ? intval($_REQUEST['list']) : 0),
 				'$file' => '',
-				'$cats' => (($category) ? $category : ''),
-				'$tags' => (($hashtags) ? $hashtags : ''),
+				'$cats' => (($category) ? urlencode($category) : ''),
+				'$tags' => (($hashtags) ? urlencode($hashtags) : ''),
 				'$mid' => $mid,
 				'$verb' => '',
 				'$dend' => $datequery,
@@ -365,10 +365,10 @@ class Channel extends \Zotlabs\Web\Controller {
 
 
 		if($checkjs->disabled()) {
-			$o .= conversation($a,$items,'channel',$update,'traditional');
+			$o .= conversation($items,'channel',$update,'traditional');
 		}
 		else {
-			$o .= conversation($a,$items,'channel',$update,$page_mode);
+			$o .= conversation($items,'channel',$update,$page_mode);
 		}
 
 		if((! $update) || ($checkjs->disabled())) {
diff --git a/Zotlabs/Module/Chanview.php b/Zotlabs/Module/Chanview.php
index 01ee74d5a..24ab9b022 100644
--- a/Zotlabs/Module/Chanview.php
+++ b/Zotlabs/Module/Chanview.php
@@ -102,27 +102,32 @@ class Chanview extends \Zotlabs\Web\Controller {
 		}
 
 		$is_zot = false;
+		$connected = false;
 	
 		if (\App::$poi) {
 			$url = \App::$poi['xchan_url'];
 			if(\App::$poi['xchan_network'] === 'zot') {
 				$is_zot = true;
 			}			
+			if(local_channel()) {
+				$c = q("select abook_id from abook where abook_channel = %d and abook_xchan = '%s' limit 1",
+					intval(local_channel()),
+					dbesc(\App::$poi['xchan_hash'])
+				);
+				if($c)
+					$connected = true;
+			}
 		}
-
+		
 		// We will load the chanview template if it's a foreign network, 
 		// just so that we can provide a connect button along with a profile
 		// photo. Chances are we can't load the remote profile into an iframe
 		// because of cross-domain security headers. So provide a link to
 		// the remote profile. 
-
+		// If we are already connected, just go to the profile.
 		// Zot channels will usually have a connect link.
-		// If it isn't zot, 'pro' members won't be able to use the connect
-		// button as it is a foreign network so just send them to the remote
-		// profile.  
-
 	
-		if($is_zot || \Zotlabs\Lib\System::get_server_role() === 'pro') {
+		if($is_zot || $connected) {
 			if($is_zot && $observer) {
 				$url = zid($url);
 			}
diff --git a/Zotlabs/Module/Chat.php b/Zotlabs/Module/Chat.php
index 23a3e65da..138ca1cb5 100644
--- a/Zotlabs/Module/Chat.php
+++ b/Zotlabs/Module/Chat.php
@@ -89,9 +89,11 @@ class Chat extends \Zotlabs\Web\Controller {
 	
 	function get() {
 	
-		if(local_channel())
+		if(local_channel()) {
 			$channel = \App::get_channel();
-	
+			nav_set_selected(t('My Chatrooms'));
+		}
+
 		$ob = \App::get_observer();
 		$observer = get_observer_hash();
 		if(! $observer) {
diff --git a/Zotlabs/Module/Cloud.php b/Zotlabs/Module/Cloud.php
index 7370eeda3..75191a279 100644
--- a/Zotlabs/Module/Cloud.php
+++ b/Zotlabs/Module/Cloud.php
@@ -86,12 +86,13 @@ class Cloud extends \Zotlabs\Web\Controller {
 	//	require_once('\Zotlabs\Storage/QuotaPlugin.php');
 	//	$server->addPlugin(new \Zotlabs\Storage\\QuotaPlugin($auth));
 
-		ob_start();
+//		ob_start();
 		// All we need to do now, is to fire up the server
 		$server->exec();
 
-		ob_end_flush();
-
+//		ob_end_flush();
+		if($browser->build_page)
+			construct_page();
 		killme();
 	}
 
diff --git a/Zotlabs/Module/Connections.php b/Zotlabs/Module/Connections.php
index b079ae860..6ad1e9528 100644
--- a/Zotlabs/Module/Connections.php
+++ b/Zotlabs/Module/Connections.php
@@ -19,7 +19,7 @@ class Connections extends \Zotlabs\Web\Controller {
 	
 	}
 	
-		function get() {
+	function get() {
 	
 		$sort_type = 0;
 		$o = '';
@@ -29,6 +29,8 @@ class Connections extends \Zotlabs\Web\Controller {
 			notice( t('Permission denied.') . EOL);
 			return login();
 		}
+
+		nav_set_selected(t('Connections'));
 	
 		$blocked     = false;
 		$hidden      = false;
@@ -63,15 +65,14 @@ class Connections extends \Zotlabs\Web\Controller {
 					$hidden = true;
 					break;
 				case 'archived':
-					$search_flags = " and abook_archived = 1 ";
-					$head = t('Archived');
+					$search_flags = " and ( abook_archived = 1 OR abook_not_here = 1) ";
+					$head = t('Archived/Unreachable');
 					$archived = true;
 					break;
 				case 'pending':
 					$search_flags = " and abook_pending = 1 ";
 					$head = t('New');
 					$pending = true;
-					nav_set_selected('intros');
 					break;
 				case 'ifpending':
 					$r = q("SELECT COUNT(abook.abook_id) AS total FROM abook left join xchan on abook.abook_xchan = xchan.xchan_hash where abook_channel = %d and abook_pending = 1 and abook_self = 0 and abook_ignored = 0 and xchan_deleted = 0 and xchan_orphan = 0 ",
@@ -81,7 +82,6 @@ class Connections extends \Zotlabs\Web\Controller {
 						$search_flags = " and abook_pending = 1 ";
 						$head = t('New');
 						$pending = true;
-						nav_set_selected('intros');
 						\App::$argv[1] = 'pending';
 					}
 					else {
@@ -91,7 +91,6 @@ class Connections extends \Zotlabs\Web\Controller {
 						\App::$argc = 1;
 						unset(\App::$argv[1]);
 					}
-					nav_set_selected('intros');
 					break;
 	//			case 'unconnected':
 	//				$search_flags = " and abook_unconnected = 1 ";
@@ -168,10 +167,10 @@ class Connections extends \Zotlabs\Web\Controller {
 			),
 	
 			'archived' => array(
-				'label' => t('Archived'),
+				'label' => t('Archived/Unreachable'),
 				'url'   => z_root() . '/connections/archived',
 				'sel'   => ($archived) ? 'active' : '',
-				'title' => t('Only show archived connections'),
+				'title' => t('Only show archived/unreachable connections'),
 			),
 	
 			'hidden' => array(
@@ -243,7 +242,8 @@ class Connections extends \Zotlabs\Web\Controller {
 						((intval($rr['abook_archived'])) ? t('Archived') : ''),
 						((intval($rr['abook_hidden'])) ? t('Hidden') : ''),
 						((intval($rr['abook_ignored'])) ? t('Ignored') : ''),
-						((intval($rr['abook_blocked'])) ? t('Blocked') : '')
+						((intval($rr['abook_blocked'])) ? t('Blocked') : ''),
+						((intval($rr['abook_not_here'])) ? t('Not connected at this location') : '')
 					);
 	
 					foreach($status as $str) {
@@ -257,11 +257,12 @@ class Connections extends \Zotlabs\Web\Controller {
 					$contacts[] = array(
 						'img_hover' => sprintf( t('%1$s [%2$s]'),$rr['xchan_name'],$rr['xchan_url']),
 						'edit_hover' => t('Edit connection'),
+						'edit' => t('Edit'),
 						'delete_hover' => t('Delete connection'),
 						'id' => $rr['abook_id'],
 						'thumb' => $rr['xchan_photo_m'], 
 						'name' => $rr['xchan_name'],
-						'classes' => (intval($rr['abook_archived']) ? 'archived' : ''),
+						'classes' => ((intval($rr['abook_archived']) || intval($rr['abook_not_here'])) ? 'archived' : ''),
 						'link' => z_root() . '/connedit/' . $rr['abook_id'],
 						'deletelink' => z_root() . '/connedit/' . intval($rr['abook_id']) . '/drop',
 						'delete' => t('Delete'),
diff --git a/Zotlabs/Module/Connedit.php b/Zotlabs/Module/Connedit.php
index 484e69b52..d301c2d45 100644
--- a/Zotlabs/Module/Connedit.php
+++ b/Zotlabs/Module/Connedit.php
@@ -842,6 +842,22 @@ class Connedit extends \Zotlabs\Web\Controller {
 			}
 			else
 				$locstr = t('none');
+
+			$clone_warn = '';
+			$clonable = (in_array($contact['xchan_network'],['zot','rss']) ? true : false);
+			if(! $clonable) {
+				$clone_warn = '<strong>';
+				$clone_warn .= ((intval($contact['abook_not_here'])) 
+					? t('This connection is unreachable from this location.')
+					: t('This connection may be unreachable from other channel locations.')
+				);
+				$clone_warn .= '</strong><br>' . t('Location independence is not supported by their network.');
+			}
+					
+
+
+			if(intval($contact['abook_not_here']) && $unclonable)
+				$not_here = t('This connection is unreachable from this location. Location independence is not supported by their network.');
 	
 			$o .= replace_macros($tpl, [
 				'$header'         => (($self) ? t('Connection Default Permissions') : sprintf( t('Connection: %s'),$contact['xchan_name'])),
@@ -856,6 +872,7 @@ class Connedit extends \Zotlabs\Web\Controller {
 				'$addr_text'      => t('This connection\'s primary address is'),
 				'$loc_text'       => t('Available locations:'),
 				'$locstr'         => $locstr,
+				'$unclonable'     => $clone_warn,
 				'$notself'        => (($self) ? '' : '1'),
 				'$self'           => (($self) ? '1' : ''),
 				'$autolbl'        => t('The permissions indicated on this page will be applied to all new connections.'),
diff --git a/Zotlabs/Module/Directory.php b/Zotlabs/Module/Directory.php
index edcf43cd6..6268e99c6 100644
--- a/Zotlabs/Module/Directory.php
+++ b/Zotlabs/Module/Directory.php
@@ -77,7 +77,7 @@ class Directory extends \Zotlabs\Web\Controller {
 		$pubforums = get_directory_setting($observer, 'pubforums');
 	
 		$o = '';
-		nav_set_selected('directory');
+		nav_set_selected(t('Directory'));
 	
 		if(x($_POST,'search'))
 			$search = notags(trim($_POST['search']));
@@ -233,7 +233,7 @@ class Directory extends \Zotlabs\Web\Controller {
 	
 							$age = '';
 							if(strlen($rr['birthday'])) {
-								if(($years = age($rr['birthday'],'UTC','')) != 0)
+								if(($years = age($rr['birthday'],'UTC','')) > 0)
 									$age = $years;
 							}
 	
diff --git a/Zotlabs/Module/Display.php b/Zotlabs/Module/Display.php
index 815672091..df3cb1e2b 100644
--- a/Zotlabs/Module/Display.php
+++ b/Zotlabs/Module/Display.php
@@ -308,12 +308,12 @@ class Display extends \Zotlabs\Web\Controller {
 	
 	
 		if ($checkjs->disabled()) {
-			$o .= conversation($a, $items, 'display', $update, 'traditional');
+			$o .= conversation($items, 'display', $update, 'traditional');
 			if ($items[0]['title'])
 				\App::$page['title'] = $items[0]['title'] . " - " . \App::$page['title'];
 		} 
 		else {
-			$o .= conversation($a, $items, 'display', $update, 'client');
+			$o .= conversation($items, 'display', $update, 'client');
 		}
 	
 		if($updateable) {
diff --git a/Zotlabs/Module/Editpost.php b/Zotlabs/Module/Editpost.php
index 629bdd3fd..a54c42e7f 100644
--- a/Zotlabs/Module/Editpost.php
+++ b/Zotlabs/Module/Editpost.php
@@ -39,6 +39,11 @@ class Editpost extends \Zotlabs\Web\Controller {
 			return;
 		}
 
+		if($itm[0]['resource_type'] === 'photo' && $itm[0]['resource_id']) {
+			notice( t('Item is not editable') . EOL);
+			return;
+		}
+
 		if($itm[0]['resource_type'] === 'event' && $itm[0]['resource_id']) {
 			goaway(z_root() . '/events/' . $itm[0]['resource_id'] . '?expandform=1');
 		}
diff --git a/Zotlabs/Module/Editwebpage.php b/Zotlabs/Module/Editwebpage.php
index db33cd1db..da536a729 100644
--- a/Zotlabs/Module/Editwebpage.php
+++ b/Zotlabs/Module/Editwebpage.php
@@ -112,7 +112,7 @@ class Editwebpage extends \Zotlabs\Web\Controller {
 			intval($itm[0]['id'])
 		);
 		if($item_id)
-			$page_title = $item_id[0]['v'];
+			$page_title = urldecode($item_id[0]['v']);
 
 		$mimetype = $itm[0]['mimetype'];
 
diff --git a/Zotlabs/Module/Events.php b/Zotlabs/Module/Events.php
index edc6dd3f0..0541f5e9b 100644
--- a/Zotlabs/Module/Events.php
+++ b/Zotlabs/Module/Events.php
@@ -272,7 +272,7 @@ class Events extends \Zotlabs\Web\Controller {
 			return;
 		}
 	
-		nav_set_selected('all_events');
+		nav_set_selected(t('Events'));
 	
 		if((argc() > 2) && (argv(1) === 'ignore') && intval(argv(2))) {
 			$r = q("update event set dismissed = 1 where id = %d and uid = %d",
diff --git a/Zotlabs/Module/Filestorage.php b/Zotlabs/Module/Filestorage.php
index 785dff394..d6f363e77 100644
--- a/Zotlabs/Module/Filestorage.php
+++ b/Zotlabs/Module/Filestorage.php
@@ -5,14 +5,6 @@ namespace Zotlabs\Module;
  *
  */
 
-require_once('include/attach.php');
-
-
-/**
- *
- * @param object &$a
- */
-
 class Filestorage extends \Zotlabs\Web\Controller {
 
 	function post() {
@@ -36,7 +28,7 @@ class Filestorage extends \Zotlabs\Web\Controller {
 		$channel = \App::get_channel();
 
 		$acl = new \Zotlabs\Access\AccessList($channel);
-		$acl->set_from_array($_REQUEST);
+		$acl->set_from_array($_POST);
 		$x = $acl->get();
 
 		$cloudPath = get_parent_cloudpath($channel_id, $channel['channel_address'], $resource);
diff --git a/Zotlabs/Module/Getfile.php b/Zotlabs/Module/Getfile.php
index 3d859d94b..0b05d78a4 100644
--- a/Zotlabs/Module/Getfile.php
+++ b/Zotlabs/Module/Getfile.php
@@ -35,6 +35,7 @@ class Getfile extends \Zotlabs\Web\Controller {
 		$sig      = $_POST['signature'];
 		$resource = $_POST['resource'];
 		$revision = intval($_POST['revision']);
+		$resolution = (-1);
 	
 		if(! $hash)
 			killme();
@@ -46,6 +47,11 @@ class Getfile extends \Zotlabs\Web\Controller {
 			killme();
 		}
 	
+		if(substr($resource,-2,1) == '-') {
+			$resolution = intval(substr($resource,-1,1));
+			$resource = substr($resource,0,-2);
+		}			
+
 		$slop = intval(get_pconfig($channel['channel_id'],'system','getfile_time_slop'));
 		if($slop < 1)
 			$slop = 3;
@@ -63,6 +69,35 @@ class Getfile extends \Zotlabs\Web\Controller {
 			killme();
 		}
 		
+
+		if($resolution > 0) {
+			$r = q("select * from photo where resource_id = '%s' and uid = %d limit 1",
+				dbesc($resource),
+				intval($channel['channel_id'])
+			);
+			if($r) {
+				header('Content-type: ' . $r[0]['mimetype']);
+
+				if(intval($r[0]['os_storage'])) {
+					$fname = dbunescbin($r[0]['content']);
+					if(strpos($fname,'store') !== false)
+						$istream = fopen($fname,'rb');
+					else
+						$istream = fopen('store/' . $channel['channel_address'] . '/' . $fname,'rb');
+					$ostream = fopen('php://output','wb');
+					if($istream && $ostream) {
+						pipe_streams($istream,$ostream);
+						fclose($istream);
+						fclose($ostream);
+					}
+				}
+				else {
+					echo dbunescbin($r[0]['content']);
+				}
+			}			
+			killme();
+		}
+
 		$r = attach_by_hash($resource,$channel['channel_hash'],$revision);
 	
 		if(! $r['success']) {
diff --git a/Zotlabs/Module/Group.php b/Zotlabs/Module/Group.php
index 646310356..93a089d02 100644
--- a/Zotlabs/Module/Group.php
+++ b/Zotlabs/Module/Group.php
@@ -56,6 +56,7 @@ class Group extends \Zotlabs\Web\Controller {
 				);
 				if($r)
 					info( t('Privacy group updated.') . EOL );
+				build_sync_packet(local_channel(),null,true);
 			}
 	
 			goaway(z_root() . '/group/' . argv(1) . '/' . argv(2));
@@ -63,7 +64,8 @@ class Group extends \Zotlabs\Web\Controller {
 		return;	
 	}
 	
-		function get() {
+	function get() {
+
 		$change = false;
 	
 		logger('mod_group: ' . \App::$cmd,LOGGER_DEBUG);
diff --git a/Zotlabs/Module/Hcard.php b/Zotlabs/Module/Hcard.php
index 13097939e..912c84fd2 100644
--- a/Zotlabs/Module/Hcard.php
+++ b/Zotlabs/Module/Hcard.php
@@ -14,6 +14,8 @@ class Hcard extends \Zotlabs\Web\Controller {
 	        return;
 	    }
 	
+		logger('hcard_request: ' . $which, LOGGER_DEBUG);
+
 	    $profile = '';
 	    $channel = \App::get_channel();
 	
diff --git a/Zotlabs/Module/Help.php b/Zotlabs/Module/Help.php
index e247416d9..e98cb9d4d 100644
--- a/Zotlabs/Module/Help.php
+++ b/Zotlabs/Module/Help.php
@@ -15,7 +15,7 @@ require_once('include/help.php');
 class Help extends \Zotlabs\Web\Controller {
 
 	function get() {
-		nav_set_selected('help');
+		nav_set_selected(t('Help'));
 
 		if($_REQUEST['search']) {
 			$o .= '<div id="help-content" class="generic-content-wrapper">';
@@ -44,42 +44,42 @@ class Help extends \Zotlabs\Web\Controller {
 
 			return $o;
 		}
-                
-                
-                if(argc() > 2 && argv(argc()-2) === 'assets') {
-                        $path = '';
-                        for($x = 1; $x < argc(); $x ++) {
-                                if(strlen($path))
-                                        $path .= '/';
-                                $path .= argv($x);
-                        }
-                        $realpath = 'doc/' . $path;
-                         //Set the content-type header as appropriate
-                        $imageInfo = getimagesize($realpath);
-                        switch ($imageInfo[2]) {
-                            case IMAGETYPE_JPEG:
-                                header("Content-Type: image/jpeg");
-                                break;
-                            case IMAGETYPE_GIF:
-                                header("Content-Type: image/gif");
-                                break;
-                            case IMAGETYPE_PNG:
-                                header("Content-Type: image/png");
-                                break;
-                           default:
-                                break;
-                        }
-                        header("Content-Length: " . filesize($realpath));
+				
+				
+		if(argc() > 2 && argv(argc()-2) === 'assets') {
+			$path = '';
+			for($x = 1; $x < argc(); $x ++) {
+				if(strlen($path))
+					$path .= '/';
+				$path .= argv($x);
+			}
+			$realpath = 'doc/' . $path;
+			 //Set the content-type header as appropriate
+			$imageInfo = getimagesize($realpath);
+			switch ($imageInfo[2]) {
+				case IMAGETYPE_JPEG:
+					header("Content-Type: image/jpeg");
+					break;
+				case IMAGETYPE_GIF:
+					header("Content-Type: image/gif");
+					break;
+				case IMAGETYPE_PNG:
+					header("Content-Type: image/png");
+					break;
+			   default:
+					break;
+			}
+			header("Content-Length: " . filesize($realpath));
 
-                        // dump the picture and stop the script
-                        readfile($realpath);
-                        killme();
-                }
+			// dump the picture and stop the script
+			readfile($realpath);
+			killme();
+		}
 
 		$headings = [
-			'about' => t('About'),
-			'member' => t('Members'),
-			'admin' => t('Administrators'),
+			'about'     => t('About'),
+			'member'    => t('Members'),
+			'admin'     => t('Administrators'),
 			'developer' => t('Developers'),
 			'tutorials' => t('Tutorials')
 		];
@@ -87,13 +87,13 @@ class Help extends \Zotlabs\Web\Controller {
 		if(array_key_exists(argv(1), $headings))
 			$heading = $headings[argv(1)];
 
-                $content =  get_help_content();
+		$content =  get_help_content();
 
 		return replace_macros(get_markup_template('help.tpl'), array(
-			'$title' => t('$Projectname Documentation'),
+			'$title'      => t('$Projectname Documentation'),
 			'$tocHeading' => t('Contents'),
-			'$content' => $content,
-			'$heading' => $heading
+			'$content'    => $content,
+			'$heading'    => $heading
 		));
 	}
 
diff --git a/Zotlabs/Module/Import.php b/Zotlabs/Module/Import.php
index ce3fd469a..40ce8f6d1 100644
--- a/Zotlabs/Module/Import.php
+++ b/Zotlabs/Module/Import.php
@@ -121,8 +121,7 @@ class Import extends \Zotlabs\Web\Controller {
 				$t = sprintf( t('Warning: Database versions differ by %1$d updates.'), $v2 - $v1 );
 				notice($t);
 			}
-			if(array_key_exists('server_role',$data['compatibility']) && $data['compatibility']['server_role'] == 'basic')
-				$moving = true;
+
 		}
 
 		if($moving)
@@ -333,6 +332,10 @@ class Import extends \Zotlabs\Web\Controller {
 					$abook['abook_feed']        = (($abook['abook_flags'] & 0x0100 ) ? 1 : 0);
 				}
 
+				if(array_key_exists('abook_instance',$abook) && $abook['abook_instance'] && strpos($abook['abook_instance'],z_root()) === false) {
+					$abook['abook_not_here'] = 1;
+				} 
+
 				if($abook['abook_self']) {
 					$role = get_pconfig($channel['channel_id'],'system','permissions_role');
 					if(($role === 'forum') || ($abook['abook_my_perms'] & PERMS_W_TAGWALL)) {
diff --git a/Zotlabs/Module/Invite.php b/Zotlabs/Module/Invite.php
index 6b6f80a31..bbd98150d 100644
--- a/Zotlabs/Module/Invite.php
+++ b/Zotlabs/Module/Invite.php
@@ -49,7 +49,7 @@ class Invite extends \Zotlabs\Web\Controller {
 			if(! $recip)
 				continue;
 	
-			if(! valid_email($recip)) {
+			if(! validate_email($recip)) {
 				notice(  sprintf( t('%s : Not a valid email address.'), $recip) . EOL);
 				continue;
 			}
@@ -88,12 +88,14 @@ class Invite extends \Zotlabs\Web\Controller {
 	}
 	
 	
-		function get() {
+	function get() {
 	
 		if(! local_channel()) {
 			notice( t('Permission denied.') . EOL);
 			return;
 		}
+
+		nav_set_selected(t('Invite'));
 	
 		$tpl = get_markup_template('invite.tpl');
 		$invonly = false;
diff --git a/Zotlabs/Module/Item.php b/Zotlabs/Module/Item.php
index ec36c22d8..5e7a3fbc0 100644
--- a/Zotlabs/Module/Item.php
+++ b/Zotlabs/Module/Item.php
@@ -33,7 +33,7 @@ class Item extends \Zotlabs\Web\Controller {
 		// This will change. Figure out who the observer is and whether or not
 		// they have permission to post here. Else ignore the post.
 	
-		if((! local_channel()) && (! remote_channel()) && (! x($_REQUEST,'commenter')))
+		if((! local_channel()) && (! remote_channel()) && (! x($_REQUEST,'anonname')))
 			return;
 
 		$uid = local_channel();
@@ -77,7 +77,7 @@ class Item extends \Zotlabs\Web\Controller {
 	
 		call_hooks('post_local_start', $_REQUEST);
 	
-	//	 logger('postvars ' . print_r($_REQUEST,true), LOGGER_DATA);
+		// logger('postvars ' . print_r($_REQUEST,true), LOGGER_DATA);
 	
 		$api_source = ((x($_REQUEST,'api_source') && $_REQUEST['api_source']) ? true : false);
 	
@@ -205,10 +205,29 @@ class Item extends \Zotlabs\Web\Controller {
 			$route = $parent_item['route'];
 	
 		}
+
+		$moderated = false;
 	
-		if(! $observer)
+		if(! $observer) {
 			$observer = \App::get_observer();
+			if(! $observer) {
+				$observer = anon_identity_init($_REQUEST);
+				if($observer) {
+					$moderated = true;
+					$remote_xchan = $remote_observer = $observer;
+				}
+			}
+		} 			
 	
+		if(! $observer) {
+			notice( t('Permission denied.') . EOL) ;
+			if($api_source)
+				return ( [ 'success' => false, 'message' => 'permission denied' ] );	
+			if(x($_REQUEST,'return')) 
+				goaway(z_root() . "/" . $return_path );
+			killme();
+		}
+
 		if($parent) {
 			logger('mod_item: item_post parent=' . $parent);
 			$can_comment = false;
@@ -312,7 +331,7 @@ class Item extends \Zotlabs\Web\Controller {
 		$walltowall = false;
 		$walltowall_comment = false;
 	
-		if($remote_xchan)
+		if($remote_xchan && ! $moderated)
 			$observer = $remote_observer;
 	
 		if($observer) {
@@ -615,7 +634,7 @@ class Item extends \Zotlabs\Web\Controller {
 					$attach_link = '';
 					$hash = substr($mtch,0,strpos($mtch,','));
 					$rev = intval(substr($mtch,strpos($mtch,',')));
-					$r = attach_by_hash_nodata($hash,$rev);
+					$r = attach_by_hash_nodata($hash, $observer['xchan_hash'], $rev);
 					if($r['success']) {
 						$attachments[] = array(
 							'href'     => z_root() . '/attach/' . $r['data']['hash'],
@@ -799,7 +818,7 @@ class Item extends \Zotlabs\Web\Controller {
 			$datarray['owner'] = $owner_xchan;
 			$datarray['author'] = $observer;
 			$datarray['attach'] = json_encode($datarray['attach']);
-			$o = conversation($a,array($datarray),'search',false,'preview');
+			$o = conversation(array($datarray),'search',false,'preview');
 	//		logger('preview: ' . $o, LOGGER_DEBUG);
 			echo json_encode(array('preview' => $o));
 			killme();
@@ -842,8 +861,8 @@ class Item extends \Zotlabs\Web\Controller {
 		}
 	
 	
-		if(mb_strlen($datarray['title']) > 255)
-			$datarray['title'] = mb_substr($datarray['title'],0,255);
+		if(mb_strlen($datarray['title']) > 191)
+			$datarray['title'] = mb_substr($datarray['title'],0,191);
 	
 		if($webpage) {
 			Zlib\IConfig::Set($datarray,'system', webpage_to_namespace($webpage),
@@ -909,6 +928,11 @@ class Item extends \Zotlabs\Web\Controller {
 	
 			if($parent) {
 	
+				// prevent conversations which you are involved from being expired
+
+				if(local_channel())
+					retain_item($parent);
+
 				// only send comment notification if this is a wall-to-wall comment,
 				// otherwise it will happen during delivery
 	
@@ -996,6 +1020,10 @@ class Item extends \Zotlabs\Web\Controller {
 			\Zotlabs\Daemon\Master::Summon(array('Notifier', $notify_type, $post_id));
 	
 		logger('post_complete');
+
+		if($moderated) {
+			info(t('Your comment is awaiting approval.') . EOL);
+		}
 	
 		// figure out how to return, depending on from whence we came
 	
diff --git a/Zotlabs/Module/Lang.php b/Zotlabs/Module/Lang.php
index 69f10fe6d..84776c3ea 100644
--- a/Zotlabs/Module/Lang.php
+++ b/Zotlabs/Module/Lang.php
@@ -5,6 +5,7 @@ namespace Zotlabs\Module;
 class Lang extends \Zotlabs\Web\Controller {
 
 	function get() {
+		nav_set_selected(t('Language'));
 		return lang_selector();
 	}
 	
diff --git a/Zotlabs/Module/Like.php b/Zotlabs/Module/Like.php
index 5ce8ec7f0..c995079ce 100644
--- a/Zotlabs/Module/Like.php
+++ b/Zotlabs/Module/Like.php
@@ -373,6 +373,10 @@ class Like extends \Zotlabs\Web\Controller {
 	
 			$links = array(array('rel' => 'alternate','type' => 'text/html', 'href' => $item['plink']));
 			$objtype = (($item['resource_type'] === 'photo') ? ACTIVITY_OBJ_PHOTO : ACTIVITY_OBJ_NOTE ); 
+
+			if($objtype === ACTIVITY_OBJ_NOTE && (! intval($item['item_thread_top'])))
+				$objtype = ACTIVITY_OBJ_COMMENT;
+
 	
 			$body = $item['body'];
 	
@@ -500,6 +504,11 @@ class Like extends \Zotlabs\Web\Controller {
 	
 		$post = item_store($arr);	
 		$post_id = $post['item_id'];
+
+		// save the conversation from expiration
+
+		if(local_channel() && array_key_exists('item',$post) && (intval($post['item']['id']) != intval($post['item']['parent'])))
+			retain_item($post['item']['parent']); 
 	
 		$arr['id'] = $post_id;
 	
diff --git a/Zotlabs/Module/Mail.php b/Zotlabs/Module/Mail.php
index d605a78a9..e5509961a 100644
--- a/Zotlabs/Module/Mail.php
+++ b/Zotlabs/Module/Mail.php
@@ -22,32 +22,40 @@ class Mail extends \Zotlabs\Web\Controller {
 		$recipient = ((x($_REQUEST,'messageto'))    ? notags(trim($_REQUEST['messageto']))    : '');
 		$rstr      = ((x($_REQUEST,'messagerecip')) ? notags(trim($_REQUEST['messagerecip'])) : '');
 		$preview   = ((x($_REQUEST,'preview'))      ? intval($_REQUEST['preview'])            : 0);
-		$expires   = ((x($_REQUEST,'expires')) ? datetime_convert(date_default_timezone_get(),'UTC', $_REQUEST['expires']) : NULL_DATE);
+		$expires   = ((x($_REQUEST,'expires'))      ? datetime_convert(date_default_timezone_get(),'UTC', $_REQUEST['expires']) : NULL_DATE);
+		$raw       = ((x($_REQUEST,'raw'))          ? intval($_REQUEST['raw'])                : 0);
+		$mimetype  = ((x($_REQUEST,'mimetype'))     ? notags(trim($_REQUEST['mimetype']))     : 'text/bbcode');
 
 		if($preview) {
 
-			$body = cleanup_bbcode($body);
-			$results = linkify_tags($a, $body, local_channel());
+			if($raw) {
+				$body = mail_prepare_binary(['id' => 'M0']);
+				echo json_encode(['preview' => $body]);
+			}
+			else {
+				$body = cleanup_bbcode($body);
+				$results = linkify_tags($a, $body, local_channel());
 
-			if(preg_match_all('/(\[attachment\](.*?)\[\/attachment\])/',$body,$match)) {
-				$attachments = array();
-				foreach($match[2] as $mtch) {
-					$hash = substr($mtch,0,strpos($mtch,','));
-					$rev = intval(substr($mtch,strpos($mtch,',')));
-					$r = attach_by_hash_nodata($hash,get_observer_hash(),$rev);
-					if($r['success']) {
-						$attachments[] = array(
-							'href'     => z_root() . '/attach/' . $r['data']['hash'],
-							'length'   =>  $r['data']['filesize'],
-							'type'     => $r['data']['filetype'],
-							'title'    => urlencode($r['data']['filename']),
-							'revision' => $r['data']['revision']
-						);
+				if(preg_match_all('/(\[attachment\](.*?)\[\/attachment\])/',$body,$match)) {
+					$attachments = array();
+					foreach($match[2] as $mtch) {
+						$hash = substr($mtch,0,strpos($mtch,','));
+						$rev = intval(substr($mtch,strpos($mtch,',')));
+						$r = attach_by_hash_nodata($hash,get_observer_hash(),$rev);
+						if($r['success']) {
+							$attachments[] = array(
+								'href'     => z_root() . '/attach/' . $r['data']['hash'],
+								'length'   =>  $r['data']['filesize'],
+								'type'     => $r['data']['filetype'],
+								'title'    => urlencode($r['data']['filename']),
+								'revision' => $r['data']['revision']
+							);
+						}
+						$body = trim(str_replace($match[1],'',$body));
 					}
-					$body = trim(str_replace($match[1],'',$body));
 				}
+				echo json_encode(['preview' => zidify_links(smilies(bbcode($body)))]);
 			}
-			echo json_encode(['preview' => zidify_links(smilies(bbcode($body)))]);
 			killme();
 		} 
 
@@ -102,36 +110,10 @@ class Mail extends \Zotlabs\Web\Controller {
 			}
 		}
 	
-	//	if(feature_enabled(local_channel(),'richtext')) {
-	//		$body = fix_mce_lf($body);
-	//	}
-	
 		require_once('include/text.php');
 		linkify_tags($a, $body, local_channel());
 	
-		// I don't think this is used any more.
-
-		if($preview) {
-			$mail = [
-				'mailbox'     => 'outbox',
-				'id'          => 0,
-				'mid'         => 'M0',
-				'from_name'   => $channel['xchan_name'],
-				'from_url'    => $channel['xchan_url'],
-				'from_photo'  => $channel['xchan_photo_s'],
-				'subject'     => zidify_links(smilies(bbcode($subject))),
-				'body'        => zidify_links(smilies(bbcode($body))),
-				'attachments' => '',
-				'can_recall'  => false,
-				'is_recalled' => '',
-				'date'        => datetime_convert('UTC',date_default_timezone_get(),$message['created'], 'c')
-			];
-			
-			echo replace_macros(get_markup_template('mail_conv.tpl'), [ '$mail' => $mail ] );
-			killme();
 
-		}
-	
 		if(! $recipient) {
 			notice('No recipient found.');
 			\App::$argc = 2;
@@ -141,7 +123,7 @@ class Mail extends \Zotlabs\Web\Controller {
 	
 		// We have a local_channel, let send_message use the session channel and save a lookup
 		
-		$ret = send_message(0, $recipient, $body, $subject, $replyto, $expires);
+		$ret = send_message(0, $recipient, $body, $subject, $replyto, $expires, $mimetype, $raw);
 	
 		if($ret['success']) {
 			xchan_mail_query($ret['mail']);
@@ -158,7 +140,7 @@ class Mail extends \Zotlabs\Web\Controller {
 	function get() {
 	
 		$o = '';
-		nav_set_selected('messages');
+		nav_set_selected(t('Mail'));
 	
 		if(! local_channel()) {
 			notice( t('Permission denied.') . EOL);
diff --git a/Zotlabs/Module/Manage.php b/Zotlabs/Module/Manage.php
index e541ee077..2d8f39ded 100644
--- a/Zotlabs/Module/Manage.php
+++ b/Zotlabs/Module/Manage.php
@@ -10,6 +10,8 @@ class Manage extends \Zotlabs\Web\Controller {
 			notice( t('Permission denied.') . EOL);
 			return;
 		}
+
+		nav_set_selected('Manage');
 	
 		require_once('include/security.php');
 	
diff --git a/Zotlabs/Module/Moderate.php b/Zotlabs/Module/Moderate.php
new file mode 100644
index 000000000..9af43420d
--- /dev/null
+++ b/Zotlabs/Module/Moderate.php
@@ -0,0 +1,76 @@
+<?php
+
+namespace Zotlabs\Module;
+
+require_once('include/conversation.php');
+
+
+class Moderate extends \Zotlabs\Web\Controller {
+
+
+	function get() {
+		if(! local_channel()) {
+			notice( t('Permission denied.') . EOL);
+			return;
+		}
+
+
+		if(argc() > 2) {
+			$post_id = intval(argv(1));
+			if(! $post_id)
+				goaway(z_root() . '/moderate');
+
+			$action = argv(2);
+
+			$r = q("select * from item where uid = %d and id = %d and item_blocked = %d limit 1",
+				intval(local_channel()),
+				intval($post_id),
+				intval(ITEM_MODERATED)
+			);
+
+			if($r) {
+				if($action === 'approve') {
+					q("update item set item_blocked = 0 where uid = %d and id = %d",
+						intval(local_channel()),
+						intval($post_id)
+					);
+					notice( t('Comment approved') . EOL);
+				}
+				elseif($action === 'drop') {
+					drop_item($post_id,false);
+					notice( t('Comment deleted') . EOL);
+				} 
+			
+				$r = q("select * from item where id = %d",
+					intval($post_id)
+				);
+				if($r) {
+					xchan_query($r);
+					$sync_item = fetch_post_tags($r);
+					build_sync_packet(local_channel(),array('item' => array(encode_item($sync_item[0],true))));
+				}
+				if($action === 'approve') {
+					\Zotlabs\Daemon\Master::Summon(array('Notifier', 'comment-new', $post_id));
+				}
+				goaway(z_root() . '/moderate');
+			}
+		}
+		$r = q("select item.id as item_id, item.* from item where item.uid = %d and item_blocked = %d and item_deleted = 0 order by created desc limit 60",
+			intval(local_channel()),
+			intval(ITEM_MODERATED)
+		);
+
+		if($r) {
+			xchan_query($r);
+			$items = fetch_post_tags($r,true);
+		}
+		else {
+			$items = array();
+		}
+
+		$o = conversation($items,'moderate',false,'traditional');
+		return $o;
+
+	}
+
+}
\ No newline at end of file
diff --git a/Zotlabs/Module/Mood.php b/Zotlabs/Module/Mood.php
index eeb050040..85c8a3042 100644
--- a/Zotlabs/Module/Mood.php
+++ b/Zotlabs/Module/Mood.php
@@ -110,17 +110,17 @@ class Mood extends \Zotlabs\Web\Controller {
 	
 	
 	
-		function get() {
+	function get() {
 	
 		if(! local_channel()) {
 			notice( t('Permission denied.') . EOL);
 			return;
 		}
-	
+
+		nav_set_selected(t('Mood'));
+
 		$parent = ((x($_GET,'parent')) ? intval($_GET['parent']) : '0');
 	
-	
-	
 		$verbs = get_mood_verbs();
 	
 		$shortlist = array();
diff --git a/Zotlabs/Module/Network.php b/Zotlabs/Module/Network.php
index 1c7c70019..e5c059af5 100644
--- a/Zotlabs/Module/Network.php
+++ b/Zotlabs/Module/Network.php
@@ -154,7 +154,7 @@ class Network extends \Zotlabs\Web\Controller {
 				));
 			}
 	
-			nav_set_selected('network');
+			nav_set_selected(t('Activity'));
 
 			$channel_acl = array(
 				'allow_cid' => $channel['channel_allow_cid'], 
@@ -325,8 +325,8 @@ class Network extends \Zotlabs\Web\Controller {
 				'$xchan'   => $xchan,
 				'$order'   => $order,
 				'$file'    => $file,
-				'$cats'    => $category,
-				'$tags'    => $hashtags,
+				'$cats'    => urlencode($category),
+				'$tags'    => urlencode($hashtags),
 				'$dend'    => $datequery,
 				'$mid'     => '',
 				'$verb'     => $verb,
@@ -409,8 +409,9 @@ class Network extends \Zotlabs\Web\Controller {
 		}
 	
 		$abook_uids = " and abook.abook_channel = " . local_channel() . " ";
-	
-		if($firehose && (! get_config('system','disable_discover_tab'))) {
+
+		$disable_discover_tab = get_config('system','disable_discover_tab') || get_config('system','disable_discover_tab') === false;
+		if($firehose && (! $disable_discover_tab)) {
 			require_once('include/channel.php');
 			$sys = get_sys_channel();
 			$uids = " and item.uid  = " . intval($sys['channel_id']) . " ";
@@ -551,7 +552,7 @@ class Network extends \Zotlabs\Web\Controller {
 	
 		$mode = (($nouveau) ? 'network-new' : 'network');
 	
-		$o .= conversation($a,$items,$mode,$update,$page_mode);
+		$o .= conversation($items,$mode,$update,$page_mode);
 	
 		if(($items) && (! $update))
 			$o .= alt_pager($a,count($items));
diff --git a/Zotlabs/Module/New_channel.php b/Zotlabs/Module/New_channel.php
index 8e6fd1d37..cfd45e909 100644
--- a/Zotlabs/Module/New_channel.php
+++ b/Zotlabs/Module/New_channel.php
@@ -134,7 +134,7 @@ class New_channel extends \Zotlabs\Web\Controller {
 		$name = array('name', t('Name or caption'), ((x($_REQUEST,'name')) ? $_REQUEST['name'] : ''), t('Examples: "Bob Jameson", "Lisa and her Horses", "Soccer", "Aviation Group"'), "*");
 		$nickhub = '@' . \App::get_hostname();
 		$nickname = array('nickname', t('Choose a short nickname'), ((x($_REQUEST,'nickname')) ? $_REQUEST['nickname'] : ''), sprintf( t('Your nickname will be used to create an easy to remember channel address e.g. nickname%s'), $nickhub), "*");
-		$role = array('permissions_role' , t('Channel role and privacy'), ($privacy_role) ? $privacy_role : 'social', t('Select a channel role with your privacy requirements.') . ' <a href="help/roles" target="_blank">' . t('Read more about roles') . '</a>',$perm_roles);
+		$role = array('permissions_role' , t('Channel role and privacy'), ($privacy_role) ? $privacy_role : 'social', t('Select a channel role with your privacy requirements.') . ' <a href="help/member/member_guide#Account_Permission_Roles" target="_blank">' . t('Read more about roles') . '</a>',$perm_roles);
 	
 		$o = replace_macros(get_markup_template('new_channel.tpl'), array(
 			'$title'        => t('Create Channel'),
diff --git a/Zotlabs/Module/Oembed.php b/Zotlabs/Module/Oembed.php
index 9394e5942..aee5ea079 100644
--- a/Zotlabs/Module/Oembed.php
+++ b/Zotlabs/Module/Oembed.php
@@ -22,7 +22,7 @@ class Oembed extends \Zotlabs\Web\Controller {
 			}
 		
 			else {
-				echo "<html><head><base target=\"_blank\" /></head><body>";
+				echo "<html><head><base target=\"_blank\" rel=\"nofollow noopener\" /></head><body>";
 				$src = base64url_decode(argv(1));
 				$j = oembed_fetch_url($src);
 				echo $j['html'];
diff --git a/Zotlabs/Module/Oep.php b/Zotlabs/Module/Oep.php
index dc0547a42..9c05f5e3f 100644
--- a/Zotlabs/Module/Oep.php
+++ b/Zotlabs/Module/Oep.php
@@ -108,7 +108,7 @@ class Oep extends \Zotlabs\Web\Controller {
 		$ret['type'] = 'rich';
 	
 		$w = (($maxwidth) ? $maxwidth : 640);
-		$h = (($maxheight) ? $maxheight : $w * 2 / 3);
+		$h = (($maxheight) ? $maxheight : intval($w * 2 / 3));
 	
 		$ret['html'] = '<div style="width: ' . $w . '; height: ' . $h . '; font-family: sans-serif,arial,freesans;" >' . $o . '</div>';
 		
@@ -167,7 +167,7 @@ class Oep extends \Zotlabs\Web\Controller {
 		$ret['type'] = 'rich';
 	
 		$w = (($maxwidth) ? $maxwidth : 640);
-		$h = (($maxheight) ? $maxheight : $w * 2 / 3);
+		$h = (($maxheight) ? $maxheight : intval($w * 2 / 3));
 	
 		$ret['html'] = '<div style="width: ' . $w . '; height: ' . $h . '; font-family: sans-serif,arial,freesans;" >' . $o . '</div>';
 		
diff --git a/Zotlabs/Module/Page.php b/Zotlabs/Module/Page.php
index 6ef285dd0..c142afe77 100644
--- a/Zotlabs/Module/Page.php
+++ b/Zotlabs/Module/Page.php
@@ -3,7 +3,6 @@ namespace Zotlabs\Module;
 
 require_once('include/items.php');
 require_once('include/conversation.php');
-require_once('include/page_widgets.php');
 
 
 class Page extends \Zotlabs\Web\Controller {
@@ -43,11 +42,31 @@ class Page extends \Zotlabs\Web\Controller {
 	
 		$channel_address = argv(1);
 	
+		// Always look first for the page name prefixed by the observer language; for instance page/nickname/de/foo
+		// followed by page/nickname/foo if that is not found.
+		// If your browser language is de and you want to access the default in this case, 
+		// use page/nickname/-/foo to over-ride the language and access only the page with pagelink of 'foo'
+
+		$page_name = '';
+		$ignore_language = false;
+
+		for($x = 2; $x < argc(); $x ++) {
+			if($page_name === '' && argv($x) === '-') {
+				$ignore_language = true;
+				continue;
+			}
+			if($page_name)
+				$page_name .= '/';
+			$page_name .= argv($x);
+		}
+
+
 		// The page link title was stored in a urlencoded format
 		// php or the browser may/will have decoded it, so re-encode it for our search
 	
-		$page_id = urlencode(argv(2));
-	
+		$page_id = urlencode($page_name);
+		$lang_page_id = urlencode(\App::$language . '/' . $page_name);
+
 		$u = q("select channel_id from channel where channel_address = '%s' limit 1",
 			dbesc($channel_address)
 		);
@@ -64,16 +83,31 @@ class Page extends \Zotlabs\Web\Controller {
 	
 		require_once('include/security.php');
 		$sql_options = item_permissions_sql($u[0]['channel_id']);
-	
-		$r = q("select item.* from item left join iconfig on item.id = iconfig.iid
-			where item.uid = %d and iconfig.cat = 'system' and iconfig.v = '%s' and item.item_delayed = 0 
-			and (( iconfig.k = 'WEBPAGE' and item_type = %d ) 
-			OR ( iconfig.k = 'PDL' AND item_type = %d )) $sql_options $revision limit 1",
-			intval($u[0]['channel_id']),
-			dbesc($page_id),
-			intval(ITEM_TYPE_WEBPAGE),
-			intval(ITEM_TYPE_PDL)
-		);
+
+		$r = null;	
+
+		if(! $ignore_language) {
+			$r = q("select item.* from item left join iconfig on item.id = iconfig.iid
+				where item.uid = %d and iconfig.cat = 'system' and iconfig.v = '%s' and item.item_delayed = 0 
+				and (( iconfig.k = 'WEBPAGE' and item_type = %d ) 
+				OR ( iconfig.k = 'PDL' AND item_type = %d )) $sql_options $revision limit 1",
+				intval($u[0]['channel_id']),
+				dbesc($lang_page_id),
+				intval(ITEM_TYPE_WEBPAGE),
+				intval(ITEM_TYPE_PDL)
+			);
+		}
+		if(! $r) {
+			$r = q("select item.* from item left join iconfig on item.id = iconfig.iid
+				where item.uid = %d and iconfig.cat = 'system' and iconfig.v = '%s' and item.item_delayed = 0 
+				and (( iconfig.k = 'WEBPAGE' and item_type = %d ) 
+				OR ( iconfig.k = 'PDL' AND item_type = %d )) $sql_options $revision limit 1",
+				intval($u[0]['channel_id']),
+				dbesc($page_id),
+				intval(ITEM_TYPE_WEBPAGE),
+				intval(ITEM_TYPE_PDL)
+			);
+		}
 		if(! $r) {
 	
 			// Check again with no permissions clause to see if it is a permissions issue
diff --git a/Zotlabs/Module/Photo.php b/Zotlabs/Module/Photo.php
index dc4ae670e..8a110f925 100644
--- a/Zotlabs/Module/Photo.php
+++ b/Zotlabs/Module/Photo.php
@@ -154,7 +154,9 @@ class Photo extends \Zotlabs\Web\Controller {
 					intval($resolution)
 				);
 
-				if($r && $r[0]['photo_usage'] == PHOTO_COVER)
+				// viewing cover photos is allowed unless a plugin chooses to block it. 
+
+				if($r && intval($r[0]['photo_usage']) === PHOTO_COVER && $resolution >= PHOTO_RES_COVER_1200)
 					$allowed = 1;
  
 				$d = [ 'imgscale' => $resolution, 'resource_id' => $photo, 'photo' => $r, 'allowed' => $allowed ];
diff --git a/Zotlabs/Module/Photos.php b/Zotlabs/Module/Photos.php
index 18d7abc48..0f80f46a5 100644
--- a/Zotlabs/Module/Photos.php
+++ b/Zotlabs/Module/Photos.php
@@ -554,6 +554,8 @@ class Photos extends \Zotlabs\Web\Controller {
 		$sql_item = item_permissions_sql($owner_uid,get_observer_hash());
 		$sql_extra = permissions_sql($owner_uid,get_observer_hash(),'photo');
 		$sql_attach = permissions_sql($owner_uid,get_observer_hash(),'attach');
+
+		nav_set_selected(t('Photos'));
 	
 		$o = "";
 	
diff --git a/Zotlabs/Module/Poke.php b/Zotlabs/Module/Poke.php
index cf8d83023..0bd1187c7 100644
--- a/Zotlabs/Module/Poke.php
+++ b/Zotlabs/Module/Poke.php
@@ -41,7 +41,10 @@ class Poke extends \Zotlabs\Web\Controller {
 		$activity = ACTIVITY_POKE . '#' . urlencode($verbs[$verb][0]);
 	
 		$contact_id = intval($_REQUEST['cid']);
-		if(! $contact_id)
+
+		$xchan = trim($_REQUEST['xchan']);
+
+		if(! ($contact_id || $xchan))
 			return;
 	
 		$parent = ((x($_REQUEST,'parent')) ? intval($_REQUEST['parent']) : 0);
@@ -49,13 +52,20 @@ class Poke extends \Zotlabs\Web\Controller {
 		logger('poke: verb ' . $verb . ' contact ' . $contact_id, LOGGER_DEBUG);
 	
 	
-		$r = q("SELECT * FROM abook left join xchan on xchan_hash = abook_xchan where abook_id = %d and abook_channel = %d LIMIT 1",
-			intval($contact_id),
-			intval($uid)
-		);
-	
+		if($contact_id) {
+			$r = q("SELECT * FROM abook left join xchan on xchan_hash = abook_xchan where abook_id = %d and abook_channel = %d LIMIT 1",
+				intval($contact_id),
+				intval($uid)
+			);
+		}
+		if($xchan) {
+			$r = q("SELECT * FROM xchan where xchan_hash like ( '%s' ) LIMIT 1",
+				dbesc($xchan . '%')
+			);
+		}
+			
 		if(! $r) {
-			logger('poke: no target ' . $contact_id);
+			logger('poke: no target.');
 			return;
 		}
 	
@@ -79,7 +89,7 @@ class Poke extends \Zotlabs\Web\Controller {
 				$deny_gid     = $r[0]['deny_gid'];
 			}
 		}
-		else {
+		elseif($contact_id) {
 	
 			$item_private = ((x($_GET,'private')) ? intval($_GET['private']) : 0);
 	
@@ -92,9 +102,11 @@ class Poke extends \Zotlabs\Web\Controller {
 	
 		$arr = array();
 	
+
+
 		$arr['item_wall']     = 1;
 		$arr['owner_xchan']   = (($parent_item) ? $parent_item['owner_xchan'] : $channel['channel_hash']);
-		$arr['parent_mid']    = (($parent_mid) ? $parent_mid : $mid);
+		$arr['parent_mid']    = (($parent_mid) ? $parent_mid : '');
 		$arr['title']         = '';
 		$arr['allow_cid']     = $allow_cid;
 		$arr['allow_gid']     = $allow_gid;
@@ -131,12 +143,14 @@ class Poke extends \Zotlabs\Web\Controller {
 	
 	
 	
-		function get() {
+	function get() {
 	
 		if(! local_channel()) {
 			notice( t('Permission denied.') . EOL);
 			return;
 		}
+
+		nav_set_selected(t('Poke'));
 	
 		$name = '';
 		$id = '';
diff --git a/Zotlabs/Module/Probe.php b/Zotlabs/Module/Probe.php
index 7fc0e8ff5..859bed315 100644
--- a/Zotlabs/Module/Probe.php
+++ b/Zotlabs/Module/Probe.php
@@ -7,7 +7,9 @@ require_once('include/zot.php');
 class Probe extends \Zotlabs\Web\Controller {
 
 	function get() {
-	
+
+		nav_set_selected(t('Remote Diagnostics'));
+
 		$o .= '<h3>Probe Diagnostic</h3>';
 	
 		$o .= '<form action="probe" method="get">';
diff --git a/Zotlabs/Module/Profile.php b/Zotlabs/Module/Profile.php
index ab349b05d..6930d50ca 100644
--- a/Zotlabs/Module/Profile.php
+++ b/Zotlabs/Module/Profile.php
@@ -21,6 +21,8 @@ class Profile extends \Zotlabs\Web\Controller {
 			\App::$error = 404;
 			return;
 		}
+
+		nav_set_selected('Profile');
 	
 		$profile = '';
 		$channel = \App::get_channel();
diff --git a/Zotlabs/Module/Profile_photo.php b/Zotlabs/Module/Profile_photo.php
index e8f0e5186..47b627015 100644
--- a/Zotlabs/Module/Profile_photo.php
+++ b/Zotlabs/Module/Profile_photo.php
@@ -190,7 +190,7 @@ class Profile_photo extends \Zotlabs\Web\Controller {
 						build_sync_packet($channel['channel_id'],array('file' => array($sync)));
 
 
-					// Similarly, tell the nav bar to bypass the cache and update the avater image.
+					// Similarly, tell the nav bar to bypass the cache and update the avatar image.
 					$_SESSION['reload_avatar'] = true;
 	
 					info( t('Shift-reload the page or clear browser cache if the new photo does not display immediately.') . EOL);
diff --git a/Zotlabs/Module/Profiles.php b/Zotlabs/Module/Profiles.php
index f6e8b11ed..b1cf9596c 100644
--- a/Zotlabs/Module/Profiles.php
+++ b/Zotlabs/Module/Profiles.php
@@ -9,7 +9,7 @@ class Profiles extends \Zotlabs\Web\Controller {
 
 	function init() {
 	
-		nav_set_selected('profiles');
+		nav_set_selected('Profiles');
 	
 		if(! local_channel()) {
 			return;
diff --git a/Zotlabs/Module/Pubstream.php b/Zotlabs/Module/Pubstream.php
index 46210abb1..42aa2b51b 100644
--- a/Zotlabs/Module/Pubstream.php
+++ b/Zotlabs/Module/Pubstream.php
@@ -16,8 +16,8 @@ class Pubstream extends \Zotlabs\Web\Controller {
 				return login();
 		}
 	
-	
-		if(get_config('system','disable_discover_tab'))
+		$disable_discover_tab = get_config('system','disable_discover_tab') || get_config('system','disable_discover_tab') === false;
+		if($disable_discover_tab)
 			return;
 	
 		$item_normal = item_normal();
@@ -167,7 +167,7 @@ class Pubstream extends \Zotlabs\Web\Controller {
 		// fake it
 		$mode = ('network');
 	
-		$o .= conversation($a,$items,$mode,$update,$page_mode);
+		$o .= conversation($items,$mode,$update,$page_mode);
 	
 		if(($items) && (! $update))
 			$o .= alt_pager($a,count($items));
diff --git a/Zotlabs/Module/Randprof.php b/Zotlabs/Module/Randprof.php
index dc2e925fe..94ec095cb 100644
--- a/Zotlabs/Module/Randprof.php
+++ b/Zotlabs/Module/Randprof.php
@@ -8,7 +8,7 @@ class Randprof extends \Zotlabs\Web\Controller {
 	function init() {
 		$x = random_profile();
 		if($x)
-			goaway(chanlink_url($x));
+			goaway(chanlink_hash($x));
 	
 		/** FIXME this doesn't work at the moment as a fallback */
 		goaway(z_root() . '/profile');
diff --git a/Zotlabs/Module/React.php b/Zotlabs/Module/React.php
index ed4f87e7e..6cd79c952 100644
--- a/Zotlabs/Module/React.php
+++ b/Zotlabs/Module/React.php
@@ -39,6 +39,10 @@ class React extends \Zotlabs\Web\Controller {
 			$n['author_xchan'] = $channel['channel_hash'];
 
 			$x = item_store($n); 
+
+			if(local_channel())
+				retain_item($postid);
+
 			if($x['success']) {
 				$nid = $x['item_id'];
 				 \Zotlabs\Daemon\Master::Summon(array('Notifier','like',$nid));
diff --git a/Zotlabs/Module/Register.php b/Zotlabs/Module/Register.php
index 1d8944d8e..d4573156c 100644
--- a/Zotlabs/Module/Register.php
+++ b/Zotlabs/Module/Register.php
@@ -151,7 +151,7 @@ class Register extends \Zotlabs\Web\Controller {
 		$new_channel = false;
 		$next_page = 'new_channel';
 	
-		if(get_config('system','auto_channel_create') || get_config('system','server_role') == 'basic') {
+		if(get_config('system','auto_channel_create')) {
 			$new_channel = auto_channel_create($result['account']['account_id']);
 			if($new_channel['success']) {
 				$channel_id = $new_channel['channel']['channel_id'];
@@ -237,14 +237,12 @@ class Register extends \Zotlabs\Web\Controller {
 		$name = array('name', t('Name or caption'), ((x($_REQUEST,'name')) ? $_REQUEST['name'] : ''), t('Examples: "Bob Jameson", "Lisa and her Horses", "Soccer", "Aviation Group"'));
 		$nickhub = '@' . str_replace(array('http://','https://','/'), '', get_config('system','baseurl'));
 		$nickname = array('nickname', t('Choose a short nickname'), ((x($_REQUEST,'nickname')) ? $_REQUEST['nickname'] : ''), sprintf( t('Your nickname will be used to create an easy to remember channel address e.g. nickname%s'), $nickhub));
-		$role = array('permissions_role' , t('Channel role and privacy'), ($privacy_role) ? $privacy_role : 'social', t('Select a channel role with your privacy requirements.') . ' <a href="help/roles" target="_blank">' . t('Read more about roles') . '</a>',$perm_roles);
+		$role = array('permissions_role' , t('Channel role and privacy'), ($privacy_role) ? $privacy_role : 'social', t('Select a channel role with your privacy requirements.') . ' <a href="help/member/member_guide#Account_Permission_Roles" target="_blank">' . t('Read more about roles') . '</a>',$perm_roles);
 		$tos = array('tos', $label_tos, '', '', array(t('no'),t('yes')));
 
-		$server_role = get_config('system','server_role');	
 
-
-		$auto_create  = (($server_role == 'basic') || (get_config('system','auto_channel_create')) ? true : false);
-		$default_role = (($server_role == 'basic') ? 'social' : get_config('system','default_permissions_role'));
+		$auto_create  = (get_config('system','auto_channel_create') ? true : false);
+		$default_role = get_config('system','default_permissions_role');
 	
 		require_once('include/bbcode.php');
 	
diff --git a/Zotlabs/Module/Rpost.php b/Zotlabs/Module/Rpost.php
index 1349cd1c5..731eab82e 100644
--- a/Zotlabs/Module/Rpost.php
+++ b/Zotlabs/Module/Rpost.php
@@ -59,6 +59,8 @@ class Rpost extends \Zotlabs\Web\Controller {
 			}
 			return login();
 		}
+
+		nav_set_selected(t('Post'));
 	
 		// If we have saved rpost session variables, but nothing in the current $_REQUEST, recover the saved variables
 	
diff --git a/Zotlabs/Module/Search.php b/Zotlabs/Module/Search.php
index aacdc88e7..e1d35b879 100644
--- a/Zotlabs/Module/Search.php
+++ b/Zotlabs/Module/Search.php
@@ -15,14 +15,14 @@ class Search extends \Zotlabs\Web\Controller {
 		if((get_config('system','block_public')) || (get_config('system','block_public_search'))) {
 			if ((! local_channel()) && (! remote_channel())) {
 				notice( t('Public access denied.') . EOL);
-			return;
+				return;
 			}
 		}
 	
 		if($load)
 			$_SESSION['loadtime'] = datetime_convert();
 	
-		nav_set_selected('search');
+		nav_set_selected(t('Search'));
 	
 		require_once("include/bbcode.php");
 		require_once('include/security.php');
@@ -81,11 +81,12 @@ class Search extends \Zotlabs\Web\Controller {
 			return $o;
 	
 		if($tag) {
-			$sql_extra = sprintf(" AND item.id IN (select oid from term where otype = %d and ttype in ( %d , %d) and term = '%s') ",
+			$wildtag = str_replace('*','%',$search);
+			$sql_extra = sprintf(" AND item.id IN (select oid from term where otype = %d and ttype in ( %d , %d) and term like '%s') ",
 				intval(TERM_OBJ_POST),
 				intval(TERM_HASHTAG),
 				intval(TERM_COMMUNITYTAG),
-				dbesc(protect_sprintf($search))
+				dbesc(protect_sprintf($wildtag))
 			);
 		}
 		else {
@@ -144,7 +145,7 @@ class Search extends \Zotlabs\Web\Controller {
 	
 		}
 	
-		$item_normal = item_normal();
+		$item_normal = item_normal_search();
 		$pub_sql = public_permissions_sql($observer_hash);
 	
 		require_once('include/channel.php');
@@ -225,7 +226,7 @@ class Search extends \Zotlabs\Web\Controller {
 		else
 			$o .= '<h2>' . sprintf( t('Search results for: %s'),htmlspecialchars($search, ENT_COMPAT,'UTF-8')) . '</h2>';
 	
-		$o .= conversation($a,$items,'search',$update,'client');
+		$o .= conversation($items,'search',$update,'client');
 	
 		$o .= '</div>';
 	
diff --git a/Zotlabs/Module/Settings.php b/Zotlabs/Module/Settings.php
index 76794e21c..79031c98f 100644
--- a/Zotlabs/Module/Settings.php
+++ b/Zotlabs/Module/Settings.php
@@ -53,7 +53,7 @@ class Settings extends \Zotlabs\Web\Controller {
 	
 	function get() {
 	
-		nav_set_selected('settings');
+		nav_set_selected('Settings');
 	
 		if((! local_channel()) || ($_SESSION['delegate'])) {
 			notice( t('Permission denied.') . EOL );
diff --git a/Zotlabs/Module/Settings/Account.php b/Zotlabs/Module/Settings/Account.php
index ec176797d..18890e89f 100644
--- a/Zotlabs/Module/Settings/Account.php
+++ b/Zotlabs/Module/Settings/Account.php
@@ -16,7 +16,7 @@ class Account {
 
 		$account = \App::get_account();
 		if($email != $account['account_email']) {
-			if(! valid_email($email))
+			if(! validate_email($email))
 				$errs[] = t('Not valid email.');
 			$adm = trim(get_config('system','admin_email'));
 			if(($adm) && (strcasecmp($email,$adm) == 0)) {
diff --git a/Zotlabs/Module/Settings/Channel.php b/Zotlabs/Module/Settings/Channel.php
index 56a7d0d8e..3e6adcf8d 100644
--- a/Zotlabs/Module/Settings/Channel.php
+++ b/Zotlabs/Module/Settings/Channel.php
@@ -324,7 +324,7 @@ class Channel {
 		foreach($global_perms as $k => $perm) {
 			$options = array();
 			foreach($perm_opts as $opt) {
-				if((! strstr($k,'view')) && $opt[1] == PERMS_PUBLIC)
+				if(((! strstr($k,'view')) && $k !== 'post_comments') && $opt[1] == PERMS_PUBLIC)
 					continue;
 				$options[$opt[1]] = $opt[0];
 			}
@@ -489,7 +489,6 @@ class Channel {
 	
 			'$h_prv' 	=> t('Security and Privacy Settings'),
 			'$permissions_set' => $permissions_set,
-			'$server_role' => \Zotlabs\Lib\System::get_server_role(),
 			'$perms_set_msg' => t('Your permissions are already configured. Click to view/adjust'),
 	
 			'$hide_presence' => array('hide_presence', t('Hide my online presence'),$hide_presence, t('Prevents displaying in your profile that you are online'), $yes_no),
diff --git a/Zotlabs/Module/Settings/Featured.php b/Zotlabs/Module/Settings/Featured.php
index 4885abd1d..ebe2996d3 100644
--- a/Zotlabs/Module/Settings/Featured.php
+++ b/Zotlabs/Module/Settings/Featured.php
@@ -10,14 +10,16 @@ class Featured {
 	
 		call_hooks('feature_settings_post', $_POST);
 	
-		if(intval($_POST['affinity_cmax'])) {
-			set_pconfig(local_channel(),'affinity','cmax',intval($_POST['affinity_cmax']));
-		}
-		if(intval($_POST['affinity_cmin'])) {
-			set_pconfig(local_channel(),'affinity','cmin',intval($_POST['affinity_cmin']));			
-		}
-		if(intval($_POST['affinity_cmax']) || intval($_POST['affinity_cmin'])) {
-			info( t('Affinity Slider settings updated.') . EOL);
+		if($_POST['affinity_slider-submit']) {
+			if(intval($_POST['affinity_cmax'])) {
+				set_pconfig(local_channel(),'affinity','cmax',intval($_POST['affinity_cmax']));
+			}
+			if(intval($_POST['affinity_cmin'])) {
+				set_pconfig(local_channel(),'affinity','cmin',intval($_POST['affinity_cmin']));			
+			}
+			if(intval($_POST['affinity_cmax']) || intval($_POST['affinity_cmin'])) {
+				info( t('Affinity Slider settings updated.') . EOL);
+			}
 		}
 		
 		build_sync_packet();
diff --git a/Zotlabs/Module/Setup.php b/Zotlabs/Module/Setup.php
index d4c31fd4e..2134288d6 100644
--- a/Zotlabs/Module/Setup.php
+++ b/Zotlabs/Module/Setup.php
@@ -73,9 +73,6 @@ class Setup extends \Zotlabs\Web\Controller {
 				$phpath = trim($_POST['phpath']);
 				$adminmail = trim($_POST['adminmail']);
 				$siteurl = trim($_POST['siteurl']);
-				$server_role = trim($_POST['server_role']);
-				if(! $server_role)
-					$server_role = 'standard';
 
 				// $siteurl should not have a trailing slash
 
@@ -103,9 +100,6 @@ class Setup extends \Zotlabs\Web\Controller {
 				$timezone = trim($_POST['timezone']);
 				$adminmail = trim($_POST['adminmail']);
 				$siteurl = trim($_POST['siteurl']);
-				$server_role = trim($_POST['server_role']);
-				if(! $server_role)
-					$server_role = 'standard';
 
 				if($siteurl != z_root()) {
 					$test = z_fetch_url($siteurl."/setup/testrewrite");
@@ -134,7 +128,7 @@ class Setup extends \Zotlabs\Web\Controller {
 					'$dbpass'      => $dbpass,
 					'$dbdata'      => $dbdata,
 					'$dbtype'      => $dbtype,
-					'$server_role' => $server_role,
+					'$server_role' => 'pro',
 					'$timezone'    => $timezone,
 					'$siteurl'     => $siteurl,
 					'$site_id'     => random_string(),
@@ -192,14 +186,17 @@ class Setup extends \Zotlabs\Web\Controller {
 		}
 		$db_return_text = '';
 		if(x(\App::$data, 'db_installed')) {
-			$txt = '<p style="font-size: 130%;">';
-			$txt .= t('Your site database has been installed.') . EOL;
+			$pass = 'Installation succeeded!';
+			$icon = 'check';
+			$txt = t('Your site database has been installed.') . EOL;
 			$db_return_text .= $txt;
 		}
 		if(x(\App::$data, 'db_failed')) {
+			$pass = 'Database install failed!';
+			$icon = 'exclamation-triangle';
 			$txt = t('You may need to import the file "install/schema_xxx.sql" manually using a database client.') . EOL;
 			$txt .= t('Please see the file "install/INSTALL.txt".') . EOL ."<hr>" ;
-			$txt .= "<pre>".\App::$data['db_failed'] . "</pre>". EOL ;
+			$txt .= "<pre>" . \App::$data['db_failed'] . "</pre>". EOL ;
 			$db_return_text .= $txt;
 		}
 		if(\DBA::$dba && \DBA::$dba->connected) {
@@ -223,8 +220,10 @@ class Setup extends \Zotlabs\Web\Controller {
 			$tpl = get_markup_template('install.tpl');
 			return replace_macros($tpl, array(
 				'$title' => $install_title,
-				'$pass' => '',
-				'$text' => $db_return_text . $this->what_next(),
+				'$icon' => $icon,
+				'$pass' => $pass,
+				'$text' => $db_return_text,
+				'$what_next' => $this->what_next()
 			));
 		}
 
@@ -324,11 +323,6 @@ class Setup extends \Zotlabs\Web\Controller {
 				$siteurl = trim($_POST['siteurl']);
 				$timezone = ((x($_POST,'timezone')) ? ($_POST['timezone']) : 'America/Los_Angeles');
 
-				$server_roles = [
-					'basic'    => t('Basic/Minimal Social Networking'),
-					'standard' => t('Standard Configuration (default)'),
-					'pro'      => t('Professional')
-				];
 
 				$tpl = get_markup_template('install_settings.tpl');
 				$o .= replace_macros($tpl, array(
@@ -348,8 +342,6 @@ class Setup extends \Zotlabs\Web\Controller {
 
 					'$siteurl' => array('siteurl', t('Website URL'), z_root(), t('Please use SSL (https) URL if available.')),
 
-					'$server_role' => array('server_role', t("Server Configuration/Role"), 'standard','',$server_roles),
-
 					'$timezone' => array('timezone', t('Please select a default timezone for your website'), $timezone, '', get_timezones()),
 
 					'$baseurl' => z_root(),
@@ -408,7 +400,7 @@ class Setup extends \Zotlabs\Web\Controller {
 		if(!$passed) {
 			$help .= t('Could not find a command line version of PHP in the web server PATH.'). EOL;
 			$help .= t('If you don\'t have a command line version of PHP installed on server, you will not be able to run background polling via cron.') . EOL;
-			$help .= EOL . EOL ;
+			$help .= EOL;
 			$tpl = get_markup_template('field_input.tpl');
 			$help .= replace_macros($tpl, array(
 				'$field' => array('phpath', t('PHP executable path'), $phpath, t('Enter full path to php executable. You can leave this blank to continue the installation.')),
@@ -456,7 +448,7 @@ class Setup extends \Zotlabs\Web\Controller {
 				userReadableSize($result['max_upload_filesize']),
 				$result['max_file_uploads']
 				);
-		$help .= '<br>' . t('You can adjust these settings in the server php.ini file.');
+		$help .= '<br><br>' . t('You can adjust these settings in the server php.ini file.');
 
 		$this->check_add($checks, t('PHP upload limits'), true, false, $help);
 	}
@@ -748,12 +740,12 @@ class Setup extends \Zotlabs\Web\Controller {
 
 		$baseurl = z_root();
 		return
-			t('<h1>What next</h1>')
-			."<p>".t('IMPORTANT: You will need to [manually] setup a scheduled task for the poller.')
+			t('<h1>What next?</h1>')
+			."<div class=\"alert alert-info\">".t('IMPORTANT: You will need to [manually] setup a scheduled task for the poller.').EOL
 			.t('Please see the file "install/INSTALL.txt".')
-			."</p><p>"
+			."</div><div>"
 			.t("Go to your new hub <a href='$baseurl/register'>registration page</a> and register as new member. Remember to use the same email you have entered as administrator email. This will allow you to enter the site admin panel.")
-			."</p>";
+			."</div>";
 	}
 
 	/**
diff --git a/Zotlabs/Module/Share.php b/Zotlabs/Module/Share.php
index fcc2486ba..5c4811c59 100644
--- a/Zotlabs/Module/Share.php
+++ b/Zotlabs/Module/Share.php
@@ -76,7 +76,7 @@ class Share extends \Zotlabs\Web\Controller {
 		$observer = \App::get_observer();
 		$parsed = $observer['xchan_url'];
 		if($parsed) {
-			$post_url = $parsed['scheme'] . ':' . $parsed['host'] . (($parsed['port']) ? ':' . $parsed['port'] : '')
+			$post_url = $parsed['scheme'] . '://' . $parsed['host'] . (($parsed['port']) ? ':' . $parsed['port'] : '')
 				. '/rpost';
 	
 			/**
diff --git a/Zotlabs/Module/Sharedwithme.php b/Zotlabs/Module/Sharedwithme.php
index 5d6d0f7da..2c97e9726 100644
--- a/Zotlabs/Module/Sharedwithme.php
+++ b/Zotlabs/Module/Sharedwithme.php
@@ -4,6 +4,11 @@ require_once('include/conversation.php');
 require_once('include/text.php');
 
 
+/**
+ * @file Zotlabs/Module/Sharedwithme.php
+ *
+ */
+
 class Sharedwithme extends \Zotlabs\Web\Controller {
 
 	function get() {
diff --git a/Zotlabs/Module/Siteinfo.php b/Zotlabs/Module/Siteinfo.php
index 7c3918425..fafd51f65 100644
--- a/Zotlabs/Module/Siteinfo.php
+++ b/Zotlabs/Module/Siteinfo.php
@@ -5,14 +5,13 @@ namespace Zotlabs\Module;
 class Siteinfo extends \Zotlabs\Web\Controller {
 
 	function init() {
-		if (argv(1) ===  'json') {
+logger(print_r($_REQUEST,true));
+		if (argv(1) === 'json' || $_REQUEST['module_format'] === 'json') {
 			$data = get_site_info();
 			json_return_and_die($data);
 		}
 	}
-	
-	
-	
+		
 	function get() {
 	
 		$siteinfo = replace_macros(get_markup_template('siteinfo.tpl'),
diff --git a/Zotlabs/Module/Siteinfo_json.php b/Zotlabs/Module/Siteinfo_json.php
deleted file mode 100644
index 99c22610f..000000000
--- a/Zotlabs/Module/Siteinfo_json.php
+++ /dev/null
@@ -1,14 +0,0 @@
-<?php
-namespace Zotlabs\Module;
-
-
-class Siteinfo_json extends \Zotlabs\Web\Controller {
-
-	function init() {
-	
-		$data = get_site_info();
-		json_return_and_die($data);
-	
-	}
-	
-}
diff --git a/Zotlabs/Module/Suggest.php b/Zotlabs/Module/Suggest.php
index 2a69145ed..c3f4a6d5a 100644
--- a/Zotlabs/Module/Suggest.php
+++ b/Zotlabs/Module/Suggest.php
@@ -28,6 +28,8 @@ class Suggest extends \Zotlabs\Web\Controller {
 			notice( t('Permission denied.') . EOL);
 			return;
 		}
+
+		nav_set_selected(t('Suggest Channels'));
 	
 		$_SESSION['return_url'] = z_root() . '/' . \App::$cmd;
 	
diff --git a/Zotlabs/Module/Token.php b/Zotlabs/Module/Token.php
new file mode 100644
index 000000000..e0d9d74d7
--- /dev/null
+++ b/Zotlabs/Module/Token.php
@@ -0,0 +1,40 @@
+<?php
+
+namespace Zotlabs\Module;
+
+
+class Token extends \Zotlabs\Web\Controller {
+
+
+	function get() {
+
+
+			// workaround for HTTP-auth in CGI mode
+			if (x($_SERVER, 'REDIRECT_REMOTE_USER')) {
+				$userpass = base64_decode(substr($_SERVER["REDIRECT_REMOTE_USER"], 6)) ;
+				if(strlen($userpass)) {
+					list($name, $password) = explode(':', $userpass);
+					$_SERVER['PHP_AUTH_USER'] = $name;
+					$_SERVER['PHP_AUTH_PW'] = $password;
+				}
+			}
+
+			if (x($_SERVER, 'HTTP_AUTHORIZATION')) {
+				$userpass = base64_decode(substr($_SERVER["HTTP_AUTHORIZATION"], 6)) ;
+				if(strlen($userpass)) {
+					list($name, $password) = explode(':', $userpass);
+					$_SERVER['PHP_AUTH_USER'] = $name;
+					$_SERVER['PHP_AUTH_PW'] = $password;
+				}
+			}
+
+
+
+
+	require_once('include/oauth2.php');
+	$oauth2_server->handleTokenRequest(\OAuth2\Request::createFromGlobals())->send(); 
+
+	killme();
+	}
+
+}
\ No newline at end of file
diff --git a/Zotlabs/Module/Wall_attach.php b/Zotlabs/Module/Wall_attach.php
index c6fe7518e..03d4cb37b 100644
--- a/Zotlabs/Module/Wall_attach.php
+++ b/Zotlabs/Module/Wall_attach.php
@@ -2,16 +2,25 @@
 namespace Zotlabs\Module;
 
 require_once('include/attach.php');
-require_once('include/channel.php');
 require_once('include/photos.php');
 
-
 class Wall_attach extends \Zotlabs\Web\Controller {
 
+	function init() {
+		logger('request_method: ' . $_SERVER['REQUEST_METHOD'],LOGGER_DATA,LOG_INFO);
+		logger('wall_attach: ' . print_r($_REQUEST,true),LOGGER_DEBUG,LOG_INFO);
+		logger('wall_attach files: ' . print_r($_FILES,true),LOGGER_DEBUG,LOG_INFO);
+		// for testing without actually storing anything
+		//		http_status_exit(200,'OK');
+	}
+
+
 	function post() {
 	
 		$using_api = false;
-	
+
+		$result = [];	
+
 		if($_REQUEST['api_source'] && array_key_exists('media',$_FILES)) {
 			$using_api = true;
 		}
@@ -28,7 +37,46 @@ class Wall_attach extends \Zotlabs\Web\Controller {
 
 		if(! $channel)
 			killme();
-	
+
+		$matches = [];
+		$partial = false;
+
+		$x = preg_match('/bytes (\d*)\-(\d*)\/(\d*)/',$_SERVER['HTTP_CONTENT_RANGE'],$matches);
+		if($x) {
+			// logger('Content-Range: ' . print_r($matches,true));
+			$partial = true;
+		}
+
+		if($partial) {
+			$x = save_chunk($channel,$matches[1],$matches[2],$matches[3]);
+			if($x['partial']) {
+				header('Range: bytes=0-' . (($x['length']) ? $x['length'] - 1 : 0));
+				json_return_and_die($result);
+			}
+			else {
+				header('Range: bytes=0-' . (($x['size']) ? $x['size'] - 1 : 0));
+
+				$_FILES['userfile'] = [
+					'name'     => $x['name'],
+					'type'     => $x['type'],
+					'tmp_name' => $x['tmp_name'],
+					'error'    => $x['error'],
+					'size'     => $x['size']
+				];
+			}
+		}
+		else {	
+			if(! array_key_exists('userfile',$_FILES)) {
+				$_FILES['userfile'] = [
+					'name'     => $_FILES['files']['name'],
+					'type'     => $_FILES['files']['type'],
+					'tmp_name' => $_FILES['files']['tmp_name'],
+					'error'    => $_FILES['files']['error'],
+					'size'     => $_FILES['files']['size']
+				];
+			}
+		}
+
 		$observer = \App::get_observer();
 	
 	
@@ -51,10 +99,11 @@ class Wall_attach extends \Zotlabs\Web\Controller {
 	
 		if($using_api)
 			return $s;
-	
-		echo $s;
-		killme();
-	
+
+		$result['message'] = $s;
+		json_return_and_die($result);
+		
 	}
 	
+
 }
diff --git a/Zotlabs/Module/Webpages.php b/Zotlabs/Module/Webpages.php
index 5e3091dfa..e449a790f 100644
--- a/Zotlabs/Module/Webpages.php
+++ b/Zotlabs/Module/Webpages.php
@@ -34,7 +34,9 @@ class Webpages extends \Zotlabs\Web\Controller {
 			\App::$error = 404;
 			return;
 		}
-	
+
+		nav_set_selected(t('Webpages'));
+
 		$which = argv(1);
 		
 		$_SESSION['return_url'] = \App::$query_string;
@@ -179,11 +181,8 @@ class Webpages extends \Zotlabs\Web\Controller {
 		// so just list titles and an edit link.
 	
 	
-		/** @TODO - this should be replaced with pagelist_widget */
-	
 		$sql_extra = item_permissions_sql($owner);
 	
-
 		$r = q("select * from iconfig left join item on iconfig.iid = item.id 
 			where item.uid = %d and iconfig.cat = 'system' and iconfig.k = 'WEBPAGE' and item_type = %d 
 			$sql_extra order by item.created desc",
@@ -191,12 +190,6 @@ class Webpages extends \Zotlabs\Web\Controller {
 			intval(ITEM_TYPE_WEBPAGE)
 		);
 
-//		$r = q("select * from item_id left join item on item_id.iid = item.id 
-//			where item_id.uid = %d and service = 'WEBPAGE' and item_type = %d $sql_extra order by item.created desc",
-//			intval($owner),
-//			intval(ITEM_TYPE_WEBPAGE)
-//		);
-	
 		if(! $r)
 			$x['pagetitle'] = 'home';
 
@@ -218,13 +211,15 @@ class Webpages extends \Zotlabs\Web\Controller {
 					'created'	=> $rr['created'],
 					'edited'	=> $rr['edited'],
 					'mimetype'	=> $rr['mimetype'],
-					'pagetitle'	=> $rr['v'],
+					'pageurl'	=> str_replace('%2f','/',$rr['v']),
+					'pagetitle'	=> urldecode($rr['v']),
 					'mid'		=> $rr['mid'],
 					'layout_mid'    => $rr['layout_mid']
 				);
 				$pages[$rr['iid']][] = array(
 					'url'		=> $rr['iid'],
-					'pagetitle'	=> $rr['v'],
+					'pageurl'	=> str_replace('%2f','/',$rr['v']),
+					'pagetitle'	=> urldecode($rr['v']),
 					'title'		=> $rr['title'],
 					'created'	=> datetime_convert('UTC',date_default_timezone_get(),$rr['created']),
 					'edited'	=> datetime_convert('UTC',date_default_timezone_get(),$rr['edited']),
diff --git a/Zotlabs/Module/Wfinger.php b/Zotlabs/Module/Wfinger.php
index 9623a676b..07a7b7735 100644
--- a/Zotlabs/Module/Wfinger.php
+++ b/Zotlabs/Module/Wfinger.php
@@ -117,7 +117,7 @@ class Wfinger extends \Zotlabs\Web\Controller {
 	
 				[
 					'rel'      => 'http://ostatus.org/schema/1.0/subscribe',
-					'template' => z_root() . '/follow/url={uri}',
+					'template' => z_root() . '/follow?f=&url={uri}',
 				],
 	
 				[
diff --git a/Zotlabs/Module/Wiki.php b/Zotlabs/Module/Wiki.php
index f879e221a..4dc11c683 100644
--- a/Zotlabs/Module/Wiki.php
+++ b/Zotlabs/Module/Wiki.php
@@ -42,7 +42,7 @@ class Wiki extends \Zotlabs\Web\Controller {
 
 		if(! feature_enabled(\App::$profile_uid,'wiki')) {
 			notice( t('Not found') . EOL);
-     		return;
+			return;
  		}
 
 
@@ -76,6 +76,8 @@ class Wiki extends \Zotlabs\Web\Controller {
 
 			$wiki_owner = true;
 
+			nav_set_selected(t('Wiki'));
+
 			// Obtain the default permission settings of the channel
 			$owner_acl = array(
 				'allow_cid' => $owner['channel_allow_cid'],
@@ -192,6 +194,7 @@ class Wiki extends \Zotlabs\Web\Controller {
 				goaway(z_root() . '/' . argv(0) . '/' . argv(1) . '/' . $wikiUrlName . '/Home');
 
 			case 4:
+			default:
 
 				// GET /wiki/channel/wiki/page
 				// Fetch the wiki info and determine observer permissions
@@ -243,9 +246,15 @@ class Wiki extends \Zotlabs\Web\Controller {
 				$wikiheaderPage = urldecode($pageUrlName);
 
 				$renamePage = (($wikiheaderPage === 'Home') ? '' : t('Rename page'));
+				$p = [];
 
-				$p = Zlib\NativeWikiPage::get_page_content(array('channel_id' => $owner['channel_id'], 'observer_hash' => $observer_hash, 'resource_id' => $resource_id, 'pageUrlName' => $pageUrlName));
-				if(! $p['success']) {
+				if(! $ignore_language) {
+					$p = Zlib\NativeWikiPage::get_page_content(array('channel_id' => $owner['channel_id'], 'observer_hash' => $observer_hash, 'resource_id' => $resource_id, 'pageUrlName' => $langPageUrlName));
+				}
+				if(! ($p && $p['success'])) {
+					$p = Zlib\NativeWikiPage::get_page_content(array('channel_id' => $owner['channel_id'], 'observer_hash' => $observer_hash, 'resource_id' => $resource_id, 'pageUrlName' => $pageUrlName));
+				}
+				if(! ($p && $p['success'])) {
 					notice( t('Error retrieving page content') . EOL);
 					goaway(z_root() . '/' . argv(0) . '/' . argv(1) );
 				}
@@ -267,8 +276,8 @@ class Wiki extends \Zotlabs\Web\Controller {
 				}
 				$showPageControls = $wiki_editor;
 				break;
-			default:	// Strip the extraneous URL components
-				goaway('/' . argv(0) . '/' . argv(1) . '/' . $wikiUrlName . '/' . $pageUrlName);
+//			default:	// Strip the extraneous URL components
+//				goaway('/' . argv(0) . '/' . argv(1) . '/' . $wikiUrlName . '/' . $pageUrlName);
 		}
 		
 
@@ -348,6 +357,7 @@ class Wiki extends \Zotlabs\Web\Controller {
 				$html = Zlib\NativeWikiPage::convert_links(zidify_links(smilies(bbcode($content))),$wikiURL);
 			}
 			else {
+
 				$bb = Zlib\NativeWikiPage::bbcode($content);
 				$x = new ZLib\MarkdownSoap($bb);
 				$md = $x->clean();
diff --git a/Zotlabs/Module/Xrd.php b/Zotlabs/Module/Xrd.php
index 7b36576e0..64e5042cb 100644
--- a/Zotlabs/Module/Xrd.php
+++ b/Zotlabs/Module/Xrd.php
@@ -9,6 +9,7 @@ class Xrd extends \Zotlabs\Web\Controller {
 	function init() {
 	
 		$uri = urldecode(notags(trim($_GET['uri'])));
+		$subject = $uri;
 		logger('xrd: ' . $uri,LOGGER_DEBUG);
 	
 		$resource = $uri;
@@ -30,13 +31,7 @@ class Xrd extends \Zotlabs\Web\Controller {
 		);
 		if(! $r) 
 			killme();
-	
-		$dspr = replace_macros(get_markup_template('xrd_diaspora.tpl'),array(
-			'$baseurl' => z_root(),
-			'$dspr_guid' => $r[0]['channel_guid'] . str_replace('.','',\App::get_hostname()),
-			'$dspr_key' => base64_encode(pemtorsa($r[0]['channel_pubkey']))
-		));
-	
+		
 		$salmon_key = salmon_key($r[0]['channel_pubkey']);
 	
 		header('Access-Control-Allow-Origin: *');
@@ -49,11 +44,11 @@ class Xrd extends \Zotlabs\Web\Controller {
 			if($aliases[$x] === $resource)
 				unset($aliases[$x]);
 		}
-	
-	
+		
 		$o = replace_macros(get_markup_template('xrd_person.tpl'), array(
 			'$nick'        => $r[0]['channel_address'],
 			'$accturi'     => $resource,
+			'$subject'     => $subject,
 			'$aliases'     => $aliases,
 			'$profile_url' => z_root() . '/channel/'       . $r[0]['channel_address'],
 			'$hcard_url'   => z_root() . '/hcard/'         . $r[0]['channel_address'],
@@ -61,12 +56,8 @@ class Xrd extends \Zotlabs\Web\Controller {
 			'$zot_post'    => z_root() . '/post/'          . $r[0]['channel_address'],
 			'$poco_url'    => z_root() . '/poco/'          . $r[0]['channel_address'],
 			'$photo'       => z_root() . '/photo/profile/l/' . $r[0]['channel_id'],
-			'$dspr'        => $dspr,
-	//		'$salmon'      => z_root() . '/salmon/'        . $r[0]['channel_address'],
-	//		'$salmen'      => z_root() . '/salmon/'        . $r[0]['channel_address'] . '/mention',
 			'$modexp'      => 'data:application/magic-public-key,'  . $salmon_key,
-			'$subscribe'   => z_root() . '/follow?url={uri}',
-			'$bigkey'      =>  salmon_key($r[0]['channel_pubkey'])
+			'$subscribe'   => z_root() . '/follow?f=&url={uri}',
 		));