Merge branch 'dev' into perms

21 files changed, 225 insertions, 42 deletions

diff --git a/Zotlabs/Daemon/Cron.php b/Zotlabs/Daemon/Cron.php
index f23cb14dc..d5b41274b 100644
--- a/Zotlabs/Daemon/Cron.php
+++ b/Zotlabs/Daemon/Cron.php
@@ -41,7 +41,6 @@ class Cron {
 		require_once('include/sharedwithme.php');
 		apply_updates();
 	
-
 		// expire any expired mail
 
 		q("delete from mail where expires != '%s' and expires < %s ",
@@ -93,6 +92,18 @@ class Cron {
 					intval($rr['id'])
 				);
 				if($x) {
+					$z = q("select * from item where id = %d",
+						intval($message_id)
+					);
+					if($z) {
+						xchan_query($z);
+						$sync_item = fetch_post_tags($z);
+						build_sync_packet($sync_item[0]['uid'],
+							[ 
+								'item' => [ encode_item($sync_item[0],true) ]
+							]
+						);
+					}
 					Master::Summon(array('Notifier','wall-new',$rr['id']));
 				}
 			}
diff --git a/Zotlabs/Daemon/Cron_weekly.php b/Zotlabs/Daemon/Cron_weekly.php
index 1d8420947..ba4b67ff5 100644
--- a/Zotlabs/Daemon/Cron_weekly.php
+++ b/Zotlabs/Daemon/Cron_weekly.php
@@ -15,7 +15,6 @@ class Cron_weekly {
 
 		call_hooks('cron_weekly',datetime_convert());
 
-
 		z_check_cert();
 
 		require_once('include/hubloc.php');
diff --git a/Zotlabs/Daemon/CurlAuth.php b/Zotlabs/Daemon/CurlAuth.php
new file mode 100644
index 000000000..be12bc779
--- /dev/null
+++ b/Zotlabs/Daemon/CurlAuth.php
@@ -0,0 +1,55 @@
+<?php
+
+namespace Zotlabs\Daemon;
+
+// generate a curl compatible cookie file with an authenticated session for the given channel_id. 
+// If this file is then used with curl and the destination url is sent through zid() or manually 
+// manipulated to add a zid, it should allow curl to provide zot magic-auth across domains.
+
+// Handles expiration of stale cookies currently by deleting them and rewriting the file.  
+
+class CurlAuth {
+
+	static public function run($argc,$argv) {
+
+		if($argc != 2)
+			killme();
+
+		\App::$session->start();
+
+		$_SESSION['authenticated'] = 1;
+		$_SESSION['uid'] = $argv[1];
+
+		$x = session_id();
+
+		$f = 'store/[data]/cookie_' . $argv[1];
+		$c = 'store/[data]/cookien_' . $argv[1];
+
+		$e = file_exists($f);
+
+		$output = '';
+
+		if($e) {
+			$lines = file($f);
+			if($lines) {
+				foreach($lines as $line) {
+					if(strlen($line) > 0 && $line[0] != '#' && substr_count($line, "\t") == 6) {
+						$tokens = explode("\t", $line);
+						$tokens = array_map('trim', $tokens);
+						if($tokens[4] > time()) {
+							$output .= $line . "\n";
+						}
+					}
+					else
+						$output .= $line;
+				}
+			}
+		}
+		$t = time() + (24 * 3600);
+		file_put_contents($f, $output . 'HttpOnly_' . \App::get_hostname() . "\tFALSE\t/\tTRUE\t$t\tPHPSESSID\t" . $x, (($e) ? FILE_APPEND : 0));
+
+		file_put_contents($c,$x);
+
+		killme();
+	}
+}
\ No newline at end of file
diff --git a/Zotlabs/Lib/Apps.php b/Zotlabs/Lib/Apps.php
index 20556212a..19ed1b612 100644
--- a/Zotlabs/Lib/Apps.php
+++ b/Zotlabs/Lib/Apps.php
@@ -33,8 +33,9 @@ class Apps {
 		$files = glob('addon/*/*.apd');
 		if($files) {
 			foreach($files as $f) {
-				$n = basename($f,'.apd');
-				if(plugin_is_installed($n)) {
+				$path = explode('/',$f);
+				$plugin = $path[1];
+				if(plugin_is_installed($plugin)) {
 					$x = self::parse_app_description($f,$translate);
 					if($x) {
 						$ret[] = $x;
diff --git a/Zotlabs/Lib/SuperCurl.php b/Zotlabs/Lib/SuperCurl.php
index 40ca1addb..1c8583ff5 100644
--- a/Zotlabs/Lib/SuperCurl.php
+++ b/Zotlabs/Lib/SuperCurl.php
@@ -26,6 +26,7 @@ class SuperCurl {
 
 	private $request_method = 'GET';
 	private $upload = false;
+	private $cookies = false;
 
 
     private function set_data($s) {
@@ -62,6 +63,11 @@ class SuperCurl {
 					case 'http_auth':
 						$this->auth = $v;
 						break;
+					case 'magicauth':
+						// currently experimental
+						$this->magicauth = $v;
+						\Zotlabs\Daemon\Master::Summon([ 'CurlAuth', $v ]);
+						break;
 					case 'custom':
 						$this->request_method = $v;
 						break;
@@ -90,8 +96,17 @@ class SuperCurl {
 
 	function exec() {
 		$opts = $this->curlopts;
+		$url = $this->url;
 		if($this->auth)
 			$opts['http_auth'] = $this->auth;
+		if($this->magicauth) {
+			$opts['cookiejar']  = 'store/[data]/cookie_' . $this->magicauth;
+			$opts['cookiefile'] = 'store/[data]/cookie_' . $this->magicauth;
+			$opts['cookie'] = 'PHPSESSID=' . trim(file_get_contents('store/[data]/cookien_' . $this->magicauth));
+			$c = channelx_by_n($this->magicauth);
+			if($c)
+				$url = zid($this->url,$c['channel_address'] . '@' . \App::get_hostname());
+		}	
 		if($this->custom)
 			$opts['custom'] = $this->custom;
 		if($this->headers)
diff --git a/Zotlabs/Lib/ThreadItem.php b/Zotlabs/Lib/ThreadItem.php
index f724ac95d..6625b7b52 100644
--- a/Zotlabs/Lib/ThreadItem.php
+++ b/Zotlabs/Lib/ThreadItem.php
@@ -418,7 +418,7 @@ class ThreadItem {
 			if(($nb_children > $visible_comments) || ($thread_level > 1)) {
 				$result['children'][0]['comment_firstcollapsed'] = true;
 				$result['children'][0]['num_comments'] = $comment_count_txt;
-				$result['children'][0]['hide_text'] = t('[+] show all');
+				$result['children'][0]['hide_text'] = sprintf( t('%s show all'), '<i class="fa fa-chevron-down"></i>');
 				if($thread_level > 1) {
 					$result['children'][$nb_children - 1]['comment_lastcollapsed'] = true;
 				}
diff --git a/Zotlabs/Module/Connedit.php b/Zotlabs/Module/Connedit.php
index feed9cb1a..7db4950b1 100644
--- a/Zotlabs/Module/Connedit.php
+++ b/Zotlabs/Module/Connedit.php
@@ -433,7 +433,7 @@ class Connedit extends \Zotlabs\Web\Controller {
 				else {
 	
 					// if you are on a different network we'll force a refresh of the connection basic info
-					Zotlabs\Daemon\Master::Summon(array('Notifier','permission_update',$contact_id));
+					\Zotlabs\Daemon\Master::Summon(array('Notifier','permission_update',$contact_id));
 				}
 				goaway(z_root() . '/connedit/' . $contact_id);
 			}
diff --git a/Zotlabs/Module/Cover_photo.php b/Zotlabs/Module/Cover_photo.php
index 9887b8203..886958b37 100644
--- a/Zotlabs/Module/Cover_photo.php
+++ b/Zotlabs/Module/Cover_photo.php
@@ -50,7 +50,7 @@ class Cover_photo extends \Zotlabs\Web\Controller {
 		
 		check_form_security_token_redirectOnErr('/cover_photo', 'cover_photo');
 	        
-		if((x($_POST,'cropfinal')) && ($_POST['cropfinal'] == 1)) {
+		if((array_key_exists('cropfinal',$_POST)) && ($_POST['cropfinal'] == 1)) {
 	
 			// phase 2 - we have finished cropping
 	
diff --git a/Zotlabs/Module/Dreport.php b/Zotlabs/Module/Dreport.php
index e8709c952..17ed6515e 100644
--- a/Zotlabs/Module/Dreport.php
+++ b/Zotlabs/Module/Dreport.php
@@ -16,7 +16,24 @@ class Dreport extends \Zotlabs\Web\Controller {
 		$channel = \App::get_channel();
 		
 		$mid = ((argc() > 1) ? argv(1) : '');
-	
+
+		if($mid === 'push') {
+			$table = 'push';
+			$mid = ((argc() > 2) ? argv(2) : '');
+			if($mid) {	
+				$i = q("select id from item where mid = '%s' and author_xchan = '%s' and uid = %d",
+					dbesc($mid),
+					dbesc($channel['channel_hash']),
+					intval($channel['channel_id'])
+				);
+				if($i) {
+					\Zotlabs\Daemon\Master::Summon([ 'Notifier', 'edit_post', $i[0]['id'] ]);
+				}
+			}
+			sleep(3);
+			goaway(z_root() . '/dreport/' . urlencode($mid));
+		}
+
 		if($mid === 'mail') {
 			$table = 'mail';
 			$mid = ((argc() > 2) ? argv(2) : '');
@@ -59,11 +76,7 @@ class Dreport extends \Zotlabs\Web\Controller {
 			notice( t('no results') . EOL);
 			return;
 		}
-	
-		$o .= '<div class="generic-content-wrapper-styled">';
-		$o .= '<h2>' . sprintf( t('Delivery report for %1$s'),substr($mid,0,32)) . '...' . '</h2>';
-		$o .= '<table>';
-	
+		
 		for($x = 0; $x < count($r); $x++ ) {
 			$r[$x]['name'] = escape_tags(substr($r[$x]['dreport_recip'],strpos($r[$x]['dreport_recip'],' ')));
 	
@@ -119,13 +132,24 @@ class Dreport extends \Zotlabs\Web\Controller {
 		}
 	
 		usort($r,'self::dreport_gravity_sort');
-			
-	
+
+		$entries = array();
 		foreach($r as $rr) {
-			$o .= '<tr><td width="40%">' . $rr['name'] . '</td><td width="20%">' . escape_tags($rr['dreport_result']) . '</td><td width="20%">' . escape_tags($rr['dreport_time']) . '</td></tr>';
+			$entries[] = [ 
+				'name' => $rr['name'],					
+				'result' => escape_tags($rr['dreport_result']),
+				'time' => escape_tags(datetime_convert('UTC',date_default_timezone_get(),$rr['dreport_time']))
+			];
 		}
-		$o .= '</table>';
-		$o .= '</div>';
+
+		$o = replace_macros(get_markup_template('dreport.tpl'), array(
+			'$title' => sprintf( t('Delivery report for %1$s'),substr($mid,0,32)) . '...',
+			'$table' => $table,
+			'$mid' => urlencode($mid),
+			'$push' => t('Redeliver'),
+			'$entries' => $entries
+		));
+	
 	
 		return $o;
 	
diff --git a/Zotlabs/Module/Events.php b/Zotlabs/Module/Events.php
index 3f3f9fb4c..3187cddb4 100644
--- a/Zotlabs/Module/Events.php
+++ b/Zotlabs/Module/Events.php
@@ -668,8 +668,10 @@ class Events extends \Zotlabs\Web\Controller {
 				'$export'	=> array(z_root()."/events/$y/$m/export",t('Export'),'',''),
 				'$calendar'	=> cal($y,$m,$links, ' eventcal'),
 				'$events'	=> $events,
-				'$upload'	=> t('Import'),
-				'$submit'	=> t('Submit'),
+				'$view_label'   => t('View'),
+				'$month'        => t('Month'),
+				'$week'         => t('Week'),
+				'$day'          => t('Day'),
 				'$prev'		=> t('Previous'),
 				'$next'		=> t('Next'),
 				'$today'	=> t('Today'),
diff --git a/Zotlabs/Module/Import_items.php b/Zotlabs/Module/Import_items.php
index 07b1c620c..f20cbfe7e 100644
--- a/Zotlabs/Module/Import_items.php
+++ b/Zotlabs/Module/Import_items.php
@@ -78,6 +78,8 @@ class Import_items extends \Zotlabs\Web\Controller {
 	//	logger('import: data: ' . print_r($data,true));
 	//	print_r($data);
 	
+		if(! is_array($data))
+			return;
 	
 		if(array_key_exists('compatibility',$data) && array_key_exists('database',$data['compatibility'])) {
 			$v1 = substr($data['compatibility']['database'],-4);
diff --git a/Zotlabs/Module/New_channel.php b/Zotlabs/Module/New_channel.php
index 30d7c83c6..26883b6e2 100644
--- a/Zotlabs/Module/New_channel.php
+++ b/Zotlabs/Module/New_channel.php
@@ -62,7 +62,7 @@ class New_channel extends \Zotlabs\Web\Controller {
 	
 	}
 	
-		function post() {
+	function post() {
 	
 		$arr = $_POST;
 	
@@ -96,7 +96,7 @@ class New_channel extends \Zotlabs\Web\Controller {
 	
 	}
 	
-		function get() {
+	function get() {
 	
 		$acc = \App::get_account();
 	
@@ -125,9 +125,9 @@ class New_channel extends \Zotlabs\Web\Controller {
 			}
 		}
 	
-		$name = array('name', t('Name or caption'), ((x($_REQUEST,'name')) ? $_REQUEST['name'] : ''), t('Examples: "Bob Jameson", "Lisa and her Horses", "Soccer", "Aviation Group"'));
+		$name = array('name', t('Name or caption'), ((x($_REQUEST,'name')) ? $_REQUEST['name'] : ''), t('Examples: "Bob Jameson", "Lisa and her Horses", "Soccer", "Aviation Group"'), "*");
 		$nickhub = '@' . \App::get_hostname();
-		$nickname = array('nickname', t('Choose a short nickname'), ((x($_REQUEST,'nickname')) ? $_REQUEST['nickname'] : ''), sprintf( t('Your nickname will be used to create an easy to remember channel address e.g. nickname%s'), $nickhub));
+		$nickname = array('nickname', t('Choose a short nickname'), ((x($_REQUEST,'nickname')) ? $_REQUEST['nickname'] : ''), sprintf( t('Your nickname will be used to create an easy to remember channel address e.g. nickname%s'), $nickhub), "*");
 		$privacy_role = ((x($_REQUEST,'permissions_role')) ? $_REQUEST['permissions_role'] :  "" );
 		$role = array('permissions_role' , t('Channel role and privacy'), ($privacy_role) ? $privacy_role : 'social', t('Select a channel role with your privacy requirements.') . ' <a href="help/roles" target="_blank">' . t('Read more about roles') . '</a>',get_roles());
 	
diff --git a/Zotlabs/Module/Photo.php b/Zotlabs/Module/Photo.php
index 5148c4a94..66aaec49f 100644
--- a/Zotlabs/Module/Photo.php
+++ b/Zotlabs/Module/Photo.php
@@ -2,6 +2,7 @@
 namespace Zotlabs\Module;
 
 require_once('include/security.php');
+require_once('include/attach.php');
 require_once('include/photo/photo_driver.php');
 
 
@@ -10,6 +11,8 @@ class Photo extends \Zotlabs\Web\Controller {
 	function init() {
 	
 		$prvcachecontrol = false;
+		$streaming = null;
+		$channel = null;
 	
 		switch(argc()) {
 			case 4:
@@ -131,6 +134,8 @@ class Photo extends \Zotlabs\Web\Controller {
 	
 				$sql_extra = permissions_sql($r[0]['uid']);
 	
+				$channel = channelx_by_n($r[0]['uid']);
+
 				// Now we'll see if we can access the photo
 	
 				$r = q("SELECT * FROM photo WHERE resource_id = '%s' AND imgscale = %d $sql_extra LIMIT 1",
@@ -141,8 +146,9 @@ class Photo extends \Zotlabs\Web\Controller {
 				if($r && $allowed) {
 					$data = dbunescbin($r[0]['content']);
 					$mimetype = $r[0]['mimetype'];
-					if(intval($r[0]['os_storage']))
-						$data = file_get_contents($data);
+					if(intval($r[0]['os_storage'])) {
+						$streaming = $data;
+					}
 				}
 				else {
 	
@@ -242,7 +248,25 @@ class Photo extends \Zotlabs\Web\Controller {
 			header("Cache-Control: max-age=" . $cache);
 	
 		}
-		echo $data;
+
+		// If it's a file resource, stream it. 
+
+		if($streaming && $channel) {
+			if(strpos($streaming,'store') !== false)
+				$istream = fopen($streaming,'rb');
+			else
+				$istream = fopen('store/' . $channel['channel_address'] . '/' . $streaming,'rb');
+			$ostream = fopen('php://output','wb');
+			if($istream && $ostream) {
+				pipe_streams($istream,$ostream);
+				fclose($istream);
+				fclose($ostream);
+			}
+		}
+		else {
+			echo $data;
+		}
+
 		killme();
 		// NOTREACHED
 	}
diff --git a/Zotlabs/Module/Profile_photo.php b/Zotlabs/Module/Profile_photo.php
index 62c5e99ae..f459f7deb 100644
--- a/Zotlabs/Module/Profile_photo.php
+++ b/Zotlabs/Module/Profile_photo.php
@@ -53,7 +53,7 @@ class Profile_photo extends \Zotlabs\Web\Controller {
 		
 		check_form_security_token_redirectOnErr('/profile_photo', 'profile_photo');
 	        
-		if((array_key_exists('postfinal',$_POST)) && (intval($_POST['cropfinal']) == 1)) {
+		if((array_key_exists('cropfinal',$_POST)) && (intval($_POST['cropfinal']) == 1)) {
 	
 			// phase 2 - we have finished cropping
 	
@@ -90,12 +90,11 @@ class Profile_photo extends \Zotlabs\Web\Controller {
 			$srcY = $_POST['ystart'];
 			$srcW = $_POST['xfinal'] - $srcX;
 			$srcH = $_POST['yfinal'] - $srcY;
-	
+
 			$r = q("SELECT * FROM photo WHERE resource_id = '%s' AND uid = %d AND imgscale = %d LIMIT 1",
 				dbesc($image_id),
 				dbesc(local_channel()),
 				intval($scale));
-	
 			if($r) {
 	
 				$base_image = $r[0];
@@ -181,6 +180,8 @@ class Profile_photo extends \Zotlabs\Web\Controller {
 						dbesc(datetime_convert()),
 						dbesc($channel['xchan_hash'])
 					);
+					// Similarly, tell the nav bar to bypass the cache and update the avater image.
+					$_SESSION['reload_avatar'] = true;
 	
 					info( t('Shift-reload the page or clear browser cache if the new photo does not display immediately.') . EOL);
 	
diff --git a/Zotlabs/Module/Register.php b/Zotlabs/Module/Register.php
index 7cd1ee501..6afa4a94c 100644
--- a/Zotlabs/Module/Register.php
+++ b/Zotlabs/Module/Register.php
@@ -259,7 +259,8 @@ class Register extends \Zotlabs\Web\Controller {
 			'$email'        => $email,
 			'$pass1'        => $password,
 			'$pass2'        => $password2,
-			'$submit'       => ((UNO || $auto_create || $registration_is) ? t('Register') : t('Proceed to create your first channel'))
+			'$submit'       => t('Register'),
+			'$verify_note'  => t('This site may require email verification after submitting this form. If you are returned to a login page, please check your email for instructions.')
 		));
 	
 		return $o;
diff --git a/Zotlabs/Module/Setup.php b/Zotlabs/Module/Setup.php
index c4878e217..c5d0ccc21 100644
--- a/Zotlabs/Module/Setup.php
+++ b/Zotlabs/Module/Setup.php
@@ -596,7 +596,7 @@ class Setup extends \Zotlabs\Web\Controller {
 	
 		if(! is_writable('store')) {
 			$status = false;
-			$help = t('Red uses the store directory to save uploaded files. The web server needs to have write access to the store directory under the Red top level folder') . EOL;
+			$help = t('This software uses the store directory to save uploaded files. The web server needs to have write access to the store directory under the Red top level folder') . EOL;
 			$help .= t('Please ensure that the user that your web server runs as (e.g. www-data) has write access to this folder.').EOL;
 		}
 	
@@ -639,6 +639,9 @@ class Setup extends \Zotlabs\Web\Controller {
 					$help .= t('If your certificate is not recognized, members of other sites (who may themselves have valid certificates) will get a warning message on their own site complaining about security issues.') . EOL;
 					$help .= t('This can cause usability issues elsewhere (not just on your own site) so we must insist on this requirement.') .EOL;
 					$help .= t('Providers are available that issue free certificates which are browser-valid.'). EOL;
+
+					$help .= t('If you are confident that the certificate is valid and signed by a trusted authority, check to see if you have failed to install an intermediate cert. These are not normally required by browsers, but are required for server-to-server communications.') . EOL;
+
 	
 					$this->check_add($checks, t('SSL certificate validation'), false, true, $help);
 				}
@@ -695,6 +698,7 @@ class Setup extends \Zotlabs\Web\Controller {
 		// install the standard theme
 		set_config('system', 'allowed_themes', 'redbasic');
 	
+
 		// Set a lenient list of ciphers if using openssl. Other ssl engines
 		// (e.g. NSS used in RedHat) require different syntax, so hopefully
 		// the default curl cipher list will work for most sites. If not,
@@ -704,7 +708,9 @@ class Setup extends \Zotlabs\Web\Controller {
 		// z_fetch_url() is also used to import shared links and other content
 		// so in theory most any cipher could show up and we should do our best
 		// to make the content available rather than tell folks that there's a
-		// weird SSL error which they can't do anything about.
+		// weird SSL error which they can't do anything about. This does not affect
+		// the SSL server, but is only a client negotiation to find something workable.
+		// Hence it will not make your system susceptible to POODL or other nasties.
 	
 		$x = curl_version();
 		if(stristr($x['ssl_version'],'openssl'))
diff --git a/Zotlabs/Module/Starred.php b/Zotlabs/Module/Starred.php
index 73a2dc808..4f1d99ec6 100644
--- a/Zotlabs/Module/Starred.php
+++ b/Zotlabs/Module/Starred.php
@@ -30,7 +30,20 @@ class Starred extends \Zotlabs\Web\Controller {
 			intval(local_channel()),
 			intval($message_id)
 		);
-	
+
+		$r = q("select * from item where id = %d",
+				intval($message_id)
+		);
+		if($r) {
+			xchan_query($r);
+			$sync_item = fetch_post_tags($r);
+			build_sync_packet(local_channel(),[ 
+				'item' => [ 
+					encode_item($sync_item[0],true)
+				]
+			]);
+		}
+
 		header('Content-type: application/json');
 		echo json_encode(array('result' => $item_starred));
 		killme();
diff --git a/Zotlabs/Module/Tagger.php b/Zotlabs/Module/Tagger.php
index 0a46cf56d..25f518d53 100644
--- a/Zotlabs/Module/Tagger.php
+++ b/Zotlabs/Module/Tagger.php
@@ -129,9 +129,14 @@ class Tagger extends \Zotlabs\Web\Controller {
 		
 		store_item_tag($item['uid'],$item['id'],TERM_OBJ_POST,TERM_COMMUNITYTAG,$term,$tagid);
 		$ret = post_activity_item($arr);
-	
-		if($ret['success'])
-			\Zotlabs\Daemon\Master::Summon(array('Notifier','tag',$ret['activity']['id']));
+
+		if($ret['success']) {
+			build_sync_packet(local_channel(),
+				[ 
+					'item' => [ encode_item($ret['activity'],true) ]
+				]
+			);
+		}
 	
 		killme();
 	
diff --git a/Zotlabs/Module/Viewconnections.php b/Zotlabs/Module/Viewconnections.php
index 7523c259b..4364d482a 100644
--- a/Zotlabs/Module/Viewconnections.php
+++ b/Zotlabs/Module/Viewconnections.php
@@ -10,8 +10,11 @@ class Viewconnections extends \Zotlabs\Web\Controller {
 		if(observer_prohibited()) {
 			return;
 		}
-		if(argc() > 1)
+
+		if(argc() > 1) {
 			profile_load(argv(1));
+		}
+
 	}
 	
 	function get() {
diff --git a/Zotlabs/Module/Wiki.php b/Zotlabs/Module/Wiki.php
index 38b49effc..55a52ea6d 100644
--- a/Zotlabs/Module/Wiki.php
+++ b/Zotlabs/Module/Wiki.php
@@ -25,8 +25,23 @@ class Wiki extends \Zotlabs\Web\Controller {
 	}
 
 	function get() {
+
+		if(observer_prohibited(true)) {
+			return login();
+		}
+
+		if(! feature_enabled(\App::$profile_uid,'wiki')) {
+			notice( t('Not found') . EOL);
+     		return;
+ 		}
+	
+		$tab = 'wiki';
+	
+	
 		require_once('include/wiki.php');
 		require_once('include/acl_selectors.php');
+		require_once('include/conversation.php');
+
 		// TODO: Combine the interface configuration into a unified object
 		// Something like $interface = array('new_page_button' => false, 'new_wiki_button' => false, ...)
 		$wiki_owner = false;
@@ -128,7 +143,8 @@ class Wiki extends \Zotlabs\Web\Controller {
 				$content = ($p['content'] !== '' ? htmlspecialchars_decode($p['content'],ENT_COMPAT) : '"# New page\n"');
 				// Render the Markdown-formatted page content in HTML
 				require_once('library/markdown.php');	
-				$renderedContent = wiki_convert_links(Markdown(json_decode($content)),argv(0).'/'.argv(1).'/'.$wikiUrlName);
+				$html = wiki_generate_toc(purify_html(Markdown(json_decode($content))));
+				$renderedContent = wiki_convert_links($html,argv(0).'/'.argv(1).'/'.$wikiUrlName);
 				$hide_editor = false;
 				$showPageControls = $wiki_editor;
 				$showNewWikiButton = $wiki_owner;
@@ -151,6 +167,11 @@ class Wiki extends \Zotlabs\Web\Controller {
 			)
 		);
 				
+		$is_owner = ((local_channel()) && (local_channel() == \App::$profile['profile_uid']) ? true : false);
+		
+		$o .= profile_tabs($a, $is_owner, \App::$profile['channel_address']);
+
+
 		$o .= replace_macros(get_markup_template('wiki.tpl'),array(
 			'$wikiheaderName' => $wikiheaderName,
 			'$wikiheaderPage' => $wikiheaderPage,
@@ -200,7 +221,7 @@ class Wiki extends \Zotlabs\Web\Controller {
 			$content = $_POST['content'];
 			$resource_id = $_POST['resource_id']; 
 			require_once('library/markdown.php');
-			$html = purify_html(Markdown($content));
+			$html = wiki_generate_toc(purify_html(Markdown($content)));
 			$w = wiki_get_wiki($resource_id);
 			$wikiURL = argv(0).'/'.argv(1).'/'.$w['urlName'];
 			$html = wiki_convert_links($html,$wikiURL);
diff --git a/Zotlabs/Storage/Browser.php b/Zotlabs/Storage/Browser.php
index f875cbf33..713d75108 100644
--- a/Zotlabs/Storage/Browser.php
+++ b/Zotlabs/Storage/Browser.php
@@ -219,7 +219,7 @@ class Browser extends DAV\Browser\Plugin {
 
 		$output = '';
 		if ($this->enablePost) {
-			$this->server->emit('onHTMLActionsPanel', array($parent, &$output));
+			$this->server->emit('onHTMLActionsPanel', array($parent, &$output, $path));
 		}
 
 		$html .= replace_macros(get_markup_template('cloud.tpl'), array(
@@ -266,7 +266,7 @@ class Browser extends DAV\Browser\Plugin {
 	 * @param \Sabre\DAV\INode $node
 	 * @param string &$output
 	 */
-	public function htmlActionsPanel(DAV\INode $node, &$output) {
+	public function htmlActionsPanel(DAV\INode $node, &$output, $path) {
 		if (! $node instanceof DAV\ICollection)
 			return;