Merge branch '7.8RC'7.8

37 files changed, 394 insertions, 296 deletions

diff --git a/Zotlabs/Daemon/Externals.php b/Zotlabs/Daemon/Externals.php
index fb35a65c7..5b7954c2f 100644
--- a/Zotlabs/Daemon/Externals.php
+++ b/Zotlabs/Daemon/Externals.php
@@ -133,7 +133,7 @@ class Externals {
 								continue;
 							}
 
-							$obj_id = isset($message['object']['id']) ?? $message['object'];
+							$obj_id = $message['object']['id'] ?? $message['object'];
 
 							Libzot::fetch_conversation($importer, $obj_id);
 							$total++;
diff --git a/Zotlabs/Daemon/Notifier.php b/Zotlabs/Daemon/Notifier.php
index 8aee08fe6..776cf4f63 100644
--- a/Zotlabs/Daemon/Notifier.php
+++ b/Zotlabs/Daemon/Notifier.php
@@ -111,6 +111,12 @@ class Notifier {
 
 		$sys         = get_sys_channel();
 		$normal_mode = true;
+		$upstream = false;
+		$uplink = false;
+		$target_item = [];
+		$parent_item = [];
+		$top_level_post = false;
+		$relay_to_owner = false;
 
 		if ($cmd === 'keychange') {
 			self::$channel = channelx_by_n($item_id);
@@ -360,8 +366,6 @@ class Notifier {
 			// the hostname in the message_id and provides a second (fallback) opinion.
 
 			$relay_to_owner = (!$top_level_post && intval($target_item['item_origin']) && comment_local_origin($target_item));
-			$uplink         = false;
-			$upstream       = false;
 
 			// $cmd === 'relay' indicates the owner is sending it to the original recipients
 			// don't allow the item in the relay command to relay to owner under any circumstances, it will loop
diff --git a/Zotlabs/Daemon/Onepoll.php b/Zotlabs/Daemon/Onepoll.php
index 79fd06df9..f2b5d8c58 100644
--- a/Zotlabs/Daemon/Onepoll.php
+++ b/Zotlabs/Daemon/Onepoll.php
@@ -46,6 +46,7 @@ class Onepoll {
 		}
 
 		$contact      = $contacts[0];
+
 		$importer_uid = $contact['abook_channel'];
 
 		$importer = channelx_by_n($importer_uid);
@@ -53,7 +54,7 @@ class Onepoll {
 		if (!$importer)
 			return;
 
-		logger("onepoll: poll: ({$contact['id']}) IMPORTER: {$importer['xchan_name']}, CONTACT: {$contact['xchan_name']}");
+		logger("onepoll: poll: ($contact_id) IMPORTER: {$importer['xchan_name']}, CONTACT: {$contact['xchan_name']}");
 
 		$last_update = ((($contact['abook_updated'] === $contact['abook_created']) || ($contact['abook_updated'] <= NULL_DATE))
 			? datetime_convert('UTC', 'UTC', 'now - 7 days')
diff --git a/Zotlabs/Lib/Activity.php b/Zotlabs/Lib/Activity.php
index 7840e9999..4ff13bc04 100644
--- a/Zotlabs/Lib/Activity.php
+++ b/Zotlabs/Lib/Activity.php
@@ -646,15 +646,15 @@ class Activity {
 
 		$ret = [];
 
-		if (is_array($item['attachment']) && $item['attachment']) {
+		if (isset($item['attachment'])) {
 			$ptr = $item['attachment'];
 			if (!array_key_exists(0, $ptr)) {
 				$ptr = [$ptr];
 			}
 			foreach ($ptr as $att) {
 				$entry = [];
-				if ($att['type'] === 'PropertyValue') {
-					if (array_key_exists('name', $att) && $att['name']) {
+				if (isset($att['type']) && $att['type'] === 'PropertyValue') {
+					if (isset($att['name'])) {
 						$key = explode('.', $att['name']);
 						if (count($key) === 3 && $key[0] === 'zot') {
 							$entry['cat']     = $key[1];
@@ -674,7 +674,7 @@ class Activity {
 
 		$ret = [];
 
-		if (array_key_exists('attachment', $item) && is_array($item['attachment'])) {
+		if (isset($item['attachment'])) {
 			$ptr = $item['attachment'];
 			if (!array_key_exists(0, $ptr)) {
 				$ptr = [$ptr];
@@ -1523,22 +1523,31 @@ class Activity {
 	}
 
 
-	static function actor_store($url, $person_obj, $force = false) {
+	static function actor_store($url, $person_obj = null, $force = false) {
+
+		if ($person_obj === null) {
+			$tgt = self::fetch($url);
+			if (is_array($tgt) && ActivityStreams::is_an_actor($tgt['type'])) {
+				self::actor_store($tgt['id'], $tgt);
+			}
+			return;
+		}
 
 		if (!is_array($person_obj)) {
 			return;
 		}
 
 		/* not implemented
-				if (array_key_exists('movedTo',$person_obj) && $person_obj['movedTo'] && ! is_array($person_obj['movedTo'])) {
-					$tgt = self::fetch($person_obj['movedTo']);
-					if (is_array($tgt)) {
-						self::actor_store($person_obj['movedTo'],$tgt);
-						ActivityPub::move($person_obj['id'],$tgt);
-					}
-					return;
-				}
+		if (array_key_exists('movedTo',$person_obj) && $person_obj['movedTo'] && ! is_array($person_obj['movedTo'])) {
+			$tgt = self::fetch($person_obj['movedTo']);
+			if (is_array($tgt)) {
+				self::actor_store($person_obj['movedTo'],$tgt);
+				ActivityPub::move($person_obj['id'],$tgt);
+			}
+			return;
+		}
 		*/
+
 		$ap_hubloc = null;
 
 		$hublocs = self::get_actor_hublocs($url);
@@ -1600,7 +1609,7 @@ class Activity {
 		$m = parse_url($url);
 		if ($m) {
 			$hostname = $m['host'];
-			$baseurl  = $m['scheme'] . '://' . $m['host'] . (($m['port']) ? ':' . $m['port'] : '');
+			$baseurl  = $m['scheme'] . '://' . $m['host'] . ((isset($m['port'])) ? ':' . $m['port'] : '');
 			$site_url = $m['scheme'] . '://' . $m['host'];
 		}
 
@@ -1609,7 +1618,7 @@ class Activity {
 		}
 
 		$icon = z_root() . '/' . get_default_profile_photo(300);
-		if ($person_obj['icon']) {
+		if (isset($person_obj['icon'])) {
 			if (is_array($person_obj['icon'])) {
 				if (array_key_exists('url', $person_obj['icon'])) {
 					$icon = $person_obj['icon']['url'];
@@ -1715,7 +1724,7 @@ class Activity {
 					'xchan_guid'      => $url,
 					'xchan_pubkey'    => escape_tags($pubkey),
 					'xchan_addr'      => $webfinger_addr,
-					'xchan_url'       => escape_tags($profile),
+					'xchan_url'       => $profile,
 					'xchan_name'      => escape_tags($name),
 					'xchan_name_date' => datetime_convert(),
 					'xchan_network'   => 'activitypub'
@@ -1791,9 +1800,13 @@ class Activity {
 
 	// sort function width decreasing
 	static function vid_sort($a, $b) {
-		if ($a['width'] === $b['width'])
+		$a_width = $a['width'] ?? 0;
+		$b_width = $b['width'] ?? 0;
+
+		if ($a_width === $b_width)
 			return 0;
-		return (($a['width'] > $b['width']) ? -1 : 1);
+
+		return (($a_width > $b_width) ? -1 : 1);
 	}
 
 	static function create_note($channel, $observer_hash, $act) {
@@ -2239,11 +2252,11 @@ class Activity {
 
 			// over-ride the object timestamp with the activity
 
-			if ($act->data['published']) {
+			if (isset($act->data['published'])) {
 				$s['created'] = datetime_convert('UTC', 'UTC', $act->data['published']);
 			}
 
-			if ($act->data['updated']) {
+			if (isset($act->data['updated'])) {
 				$s['edited'] = datetime_convert('UTC', 'UTC', $act->data['updated']);
 			}
 
@@ -2277,12 +2290,6 @@ class Activity {
 				}
 			}
 
-			if ($act->type === 'Announce') {
-				$s['author_xchan'] = $obj_actor['id'];
-				$s['mid'] = $act->obj['id'];
-				$s['parent_mid'] = $act->obj['id'];
-			}
-
 			if ($act->type === 'emojiReaction') {
 				$content['content'] = (($act->tgt && $act->tgt['type'] === 'Image') ? '[img=32x32]' . $act->tgt['url'] . '[/img]' : '&#x' . $act->tgt['name'] . ';');
 			}
@@ -2461,12 +2468,17 @@ class Activity {
 			$s['comments_closed'] = datetime_convert('UTC', 'UTC', $act->obj['closed']);
 		}
 
+		if (!$response_activity) {
+			if ($act->type === 'Announce') {
+				$s['author_xchan'] = self::get_attributed_to_actor_url($act);
+				$s['mid'] = $act->obj['id'];
+				$s['parent_mid'] = $act->obj['id'];
+			}
 
-		// we will need a hook here to extract magnet links e.g. peertube
-		// right now just link to the largest mp4 we find that will fit in our
-		// standard content region
+			// we will need a hook here to extract magnet links e.g. peertube
+			// right now just link to the largest mp4 we find that will fit in our
+			// standard content region
 
-		if (!$response_activity) {
 			if ($act->obj['type'] === 'Video') {
 
 				$vtypes = [
@@ -2673,15 +2685,14 @@ class Activity {
 			}
 		}
 
-		if (!$s['plink']) {
+        if (!(isset($s['plink']) && $s['plink'])) {
 			$s['plink'] = $s['mid'];
 		}
 
 		// assume this is private unless specifically told otherwise.
 
 		$s['item_private'] = 1;
-
-		if ($act->recips && in_array(ACTIVITY_PUBLIC_INBOX, $act->recips)) {
+		if ($act->recips && (in_array(ACTIVITY_PUBLIC_INBOX, $act->recips) || in_array('Public', $act->recips) || in_array('as:Public', $act->recips))) {
 			$s['item_private'] = 0;
 		}
 
@@ -2699,7 +2710,7 @@ class Activity {
 
 		// This is a zot6 packet and the raw activitypub or diaspora message json
 		// is possibly available in the attachement.
-		if (array_key_exists('signed', $raw_arr) && is_array($act->data['attachment'])) {
+		if (array_key_exists('signed', $raw_arr) && isset($act->data['attachment']) && is_array($act->data['attachment'])) {
 			foreach($act->data['attachment'] as $a) {
 				if (
 					isset($a['type']) && $a['type'] === 'PropertyValue' &&
@@ -2719,7 +2730,7 @@ class Activity {
 		}
 
 		// old style: can be removed after most hubs are on 7.0.2
-		elseif (array_key_exists('signed', $raw_arr) && is_array($act->obj) && is_array($act->obj['attachment'])) {
+		elseif (array_key_exists('signed', $raw_arr) && is_array($act->obj) && isset($act->data['attachment']) && is_array($act->obj['attachment'])) {
 			foreach($act->obj['attachment'] as $a) {
 				if (
 					isset($a['type']) && $a['type'] === 'PropertyValue' &&
@@ -2763,6 +2774,7 @@ class Activity {
 
 		set_iconfig($s, 'activitypub', 'recips', $act->raw_recips);
 
+
 		$hookinfo = [
 			'act' => $act,
 			's'   => $s
@@ -2772,6 +2784,8 @@ class Activity {
 
 		$s = $hookinfo['s'];
 
+
+
 		return $s;
 
 	}
@@ -2866,7 +2880,7 @@ class Activity {
 
 			// The $item['item_fetched'] flag is set in fetch_and_store_parents().
 			// In this case we should check against author permissions because sender is not owner.
-			if (perm_is_allowed($channel['channel_id'], (($item['item_fetched']) ? $item['author_xchan'] : $observer_hash), 'send_stream') || $is_sys_channel) {
+			if (perm_is_allowed($channel['channel_id'], ((isset($item['item_fetched']) && $item['item_fetched']) ? $item['author_xchan'] : $observer_hash), 'send_stream') || $is_sys_channel) {
 				$allowed = true;
 			}
 			// TODO: not implemented
@@ -3005,30 +3019,34 @@ class Activity {
 				dbesc($item['parent_mid']),
 				intval($item['uid'])
 			);
+
 			if (!$parent) {
 				if (!plugin_is_installed('pubcrawl')) {
 					return;
 				}
 				else {
 					$fetch = false;
+
 					// TODO: debug
 					// if (perm_is_allowed($channel['channel_id'],$observer_hash,'send_stream') && (PConfig::Get($channel['channel_id'],'system','hyperdrive',true) || $act->type === 'Announce')) {
 					if (perm_is_allowed($channel['channel_id'], $observer_hash, 'send_stream') || $is_sys_channel) {
 						$fetch = (($fetch_parents) ? self::fetch_and_store_parents($channel, $observer_hash, $item, $force) : false);
 					}
+
 					if ($fetch) {
 						$parent = q("select * from item where mid = '%s' and uid = %d limit 1",
 							dbesc($item['parent_mid']),
 							intval($item['uid'])
 						);
 					}
-					else {
-						logger('no parent');
-						return;
-					}
 				}
 			}
 
+			if (!$parent) {
+				logger('no parent');
+				return;
+			}
+
 			if ($parent[0]['parent_mid'] !== $item['parent_mid']) {
 				$item['thr_parent'] = $item['parent_mid'];
 			}
@@ -3875,6 +3893,19 @@ class Activity {
 		return $hookdata['actor'];
 	}
 
+	static function get_unknown_actor($act) {
+
+		// try other get_actor providers (e.g. diaspora)
+		$hookdata = [
+			'activity' => $act,
+			'actor' => null
+		];
+
+		call_hooks('get_actor_provider', $hookdata);
+
+		return $hookdata['actor'];
+	}
+
 	static function get_actor_hublocs($url, $options = 'all') {
 
 		switch ($options) {
@@ -3966,4 +3997,35 @@ class Activity {
 		return $ret;
 	}
 
+	static function get_attributed_to_actor_url($act) {
+
+		$url = '';
+
+		if (!isset($act->obj['attributedTo'])) {
+			return $url;
+		}
+
+		if (is_string($act->obj['attributedTo'])) {
+			$url = $act->obj['attributedTo'];
+		}
+
+		if (is_array($act->obj['attributedTo'])) {
+			foreach($act->obj['attributedTo'] as $a) {
+				if (is_array($a) && isset($a['type']) && $a['type'] === 'Person') {
+					if (isset($a['id'])) {
+						$url = $a['id'];
+						break;
+					}
+				}
+				elseif (is_string($a)) {
+					$url = $a;
+					break;
+				}
+			}
+		}
+
+		return $url;
+
+	}
+
 }
diff --git a/Zotlabs/Lib/ActivityStreams.php b/Zotlabs/Lib/ActivityStreams.php
index e77b501b3..a07fdacb7 100644
--- a/Zotlabs/Lib/ActivityStreams.php
+++ b/Zotlabs/Lib/ActivityStreams.php
@@ -116,17 +116,17 @@ class ActivityStreams {
 				$this->obj['object'] = $this->get_compound_property($this->obj['object']);
 			}
 
-			if ($this->obj && is_array($this->obj) && $this->obj['actor'])
+			if ($this->obj && is_array($this->obj) && isset($this->obj['actor']))
 				$this->obj['actor'] = $this->get_actor('actor', $this->obj);
-			if ($this->tgt && is_array($this->tgt) && $this->tgt['actor'])
+			if ($this->tgt && is_array($this->tgt) && isset($this->tgt['actor']))
 				$this->tgt['actor'] = $this->get_actor('actor', $this->tgt);
 
 			$this->parent_id = $this->get_property_obj('inReplyTo');
 
-			if ((!$this->parent_id) && is_array($this->obj)) {
+			if ((!$this->parent_id) && is_array($this->obj) && isset($this->obj['inReplyTo'])) {
 				$this->parent_id = $this->obj['inReplyTo'];
 			}
-			if ((!$this->parent_id) && is_array($this->obj)) {
+			if ((!$this->parent_id) && is_array($this->obj) && isset($this->obj['id'])) {
 				$this->parent_id = $this->obj['id'];
 			}
 		}
@@ -294,7 +294,7 @@ class ActivityStreams {
 		if (!$s) {
 			return false;
 		}
-		return (in_array($s, ['Like', 'Dislike', 'Flag', 'Block', 'Announce', 'Accept', 'Reject', 'TentativeAccept', 'TentativeReject', 'emojiReaction', 'EmojiReaction', 'EmojiReact']));
+		return (in_array($s, ['Like', 'Dislike', 'Flag', 'Block', 'Accept', 'Reject', 'TentativeAccept', 'TentativeReject', 'emojiReaction', 'EmojiReaction', 'EmojiReact']));
 	}
 
 	/**
@@ -308,20 +308,25 @@ class ActivityStreams {
 
 	function get_actor($property, $base = '', $namespace = '') {
 		$x = $this->get_property_obj($property, $base, $namespace);
+
 		if ($this->is_url($x)) {
 			$y = Activity::get_cached_actor($x);
 			if ($y) {
 				return $y;
 			}
 		}
+
 		$actor = $this->get_compound_property($property, $base, $namespace, true);
+
 		if (is_array($actor) && self::is_an_actor($actor['type'])) {
 			if (array_key_exists('id', $actor) && (!array_key_exists('inbox', $actor))) {
 				$actor = $this->fetch_property($actor['id']);
 			}
 			return $actor;
 		}
-		return null;
+
+		return Activity::get_unknown_actor($this->data);
+
 	}
 
 
diff --git a/Zotlabs/Lib/Apps.php b/Zotlabs/Lib/Apps.php
index 98ebc546a..a29992bbc 100644
--- a/Zotlabs/Lib/Apps.php
+++ b/Zotlabs/Lib/Apps.php
@@ -521,8 +521,13 @@ class Apps {
 		$hosturl = '';
 
 		if(local_channel()) {
-			if(self::app_installed(local_channel(),$papp) && !$papp['deleted'])
+			if(self::app_installed(local_channel(),$papp)) {
 				$installed = true;
+			}
+
+			if ($installed && isset($papp['deleted']) && $papp['deleted']) {
+				$installed = false;
+			}
 
 			$hosturl = z_root() . '/';
 		}
diff --git a/Zotlabs/Lib/Enotify.php b/Zotlabs/Lib/Enotify.php
index 07c426960..5a09ade90 100644
--- a/Zotlabs/Lib/Enotify.php
+++ b/Zotlabs/Lib/Enotify.php
@@ -815,10 +815,10 @@ class Enotify {
 
 		localize_item($item);
 
-		if($item['shortlocalize']) {
+		if(isset($item['shortlocalize'])) {
 			$itemem_text = $item['shortlocalize'];
 		}
-		elseif($item['localize']) {
+		elseif(isset($item['localize'])) {
 			$itemem_text = $item['localize'];
 		}
 		else {
diff --git a/Zotlabs/Lib/Libzot.php b/Zotlabs/Lib/Libzot.php
index ba3c642cf..6f7d74606 100644
--- a/Zotlabs/Lib/Libzot.php
+++ b/Zotlabs/Lib/Libzot.php
@@ -251,7 +251,7 @@ class Libzot {
 
 		$url = null;
 
-		if ($them['hubloc_id_url']) {
+		if (isset($them['hubloc_id_url']) && $them['hubloc_id_url']) {
 			$url = $them['hubloc_id_url'];
 		}
 		else {
@@ -304,8 +304,14 @@ class Libzot {
 
 		$record = Zotfinger::exec($url, $channel);
 
+		if (!$record) {
+			return false;
+		}
+
 		// Check the HTTP signature
 		$hsig = $record['signature'];
+		$hsig_valid = false;
+
 		if ($hsig && $hsig['signer'] === $url && $hsig['header_valid'] === true && $hsig['content_valid'] === true) {
 			$hsig_valid = true;
 		}
@@ -898,11 +904,11 @@ class Libzot {
 		$s = Libsync::sync_locations($arr, $arr);
 
 		if ($s) {
-			if ($s['change_message'])
+			if (isset($s['change_message']))
 				$what .= $s['change_message'];
-			if ($s['changed'])
+			if (isset($s['changed']))
 				$changed = $s['changed'];
-			if ($s['message'])
+			if (isset($s['message']))
 				$ret['message'] .= $s['message'];
 		}
 
@@ -1227,7 +1233,7 @@ class Libzot {
 					return;
 				}
 
-				$r = q("select hubloc_hash, hubloc_network, hubloc_url from hubloc where hubloc_id_url = '%s'",
+				$r = q("select hubloc_hash, hubloc_network, hubloc_url from hubloc where hubloc_id_url = '%s' order by hubloc_id desc",
 					dbesc($AS->actor['id'])
 				);
 
@@ -1235,7 +1241,7 @@ class Libzot {
 					// Author is unknown to this site. Perform channel discovery and try again.
 					$z = discover_by_webbie($AS->actor['id']);
 					if ($z) {
-						$r = q("select hubloc_hash, hubloc_network, hubloc_url from hubloc where hubloc_id_url = '%s'",
+						$r = q("select hubloc_hash, hubloc_network, hubloc_url from hubloc where hubloc_id_url = '%s' order by hubloc_id desc",
 							dbesc($AS->actor['id'])
 						);
 					}
@@ -1255,7 +1261,7 @@ class Libzot {
 
 				if(filter_var($env['sender'], FILTER_VALIDATE_URL)) {
 					// in individual delivery, change owner if needed
-					$s = q("select hubloc_hash, hubloc_url from hubloc where hubloc_id_url = '%s' and hubloc_network = 'zot6' limit 1",
+					$s = q("select hubloc_hash, hubloc_url from hubloc where hubloc_id_url = '%s' and hubloc_network = 'zot6' order by hubloc_id desc limit 1",
 						dbesc($env['sender'])
 					);
 
@@ -1738,7 +1744,7 @@ class Libzot {
 					if (in_array('undefined', $existing_route) || $last_hop == 'undefined' || $sender == 'undefined')
 						$last_hop = '';
 
-					$current_route = (($arr['route']) ? $arr['route'] . ',' : '') . $sender;
+					$current_route = ((isset($arr['route']) && $arr['route']) ? $arr['route'] . ',' : '') . $sender;
 
 					if ($last_hop && $last_hop != $sender) {
 						logger('comment route mismatch: parent route = ' . $r[0]['route'] . ' expected = ' . $current_route, LOGGER_DEBUG);
@@ -1763,7 +1769,7 @@ class Libzot {
 				dbesc($arr['author_xchan'])
 			);
 
-			if (intval($arr['item_deleted'])) {
+			if (isset($arr['item_deleted']) && $arr['item_deleted']) {
 
 				// remove_community_tag is a no-op if this isn't a community tag activity
 				self::remove_community_tag($sender, $arr, $channel['channel_id']);
@@ -2014,11 +2020,11 @@ class Libzot {
 				$arr['owner_xchan'] = $a['signature']['signer'];
 			}
 
-			if ($AS->meta['hubloc'] || $arr['author_xchan'] === $arr['owner_xchan']) {
+			if (isset($AS->meta['hubloc']) || $arr['author_xchan'] === $arr['owner_xchan']) {
 				$arr['item_verified'] = true;
 			}
 
-			if ($AS->meta['signed_data']) {
+			if (isset($AS->meta['signed_data'])) {
 				IConfig::Set($arr, 'activitypub', 'signed_data', $AS->meta['signed_data'], false);
 				$j = json_decode($AS->meta['signed_data'], true);
 				if ($j) {
@@ -2512,14 +2518,14 @@ class Libzot {
 				$access_policy = ACCESS_PRIVATE;
 		}
 
-		$directory_url = htmlspecialchars((string)$arr['directory_url'], ENT_COMPAT, 'UTF-8', false);
-		$url           = htmlspecialchars((string)strtolower($arr['url']), ENT_COMPAT, 'UTF-8', false);
-		$sellpage      = htmlspecialchars((string)$arr['sellpage'], ENT_COMPAT, 'UTF-8', false);
-		$site_location = htmlspecialchars((string)$arr['location'], ENT_COMPAT, 'UTF-8', false);
-		$site_realm    = htmlspecialchars((string)$arr['realm'], ENT_COMPAT, 'UTF-8', false);
-		$site_project  = htmlspecialchars((string)$arr['project'], ENT_COMPAT, 'UTF-8', false);
-		$site_crypto   = ((array_key_exists('encryption', $arr) && is_array($arr['encryption'])) ? htmlspecialchars((string)implode(',', $arr['encryption']), ENT_COMPAT, 'UTF-8', false) : '');
-		$site_version  = ((array_key_exists('version', $arr)) ? htmlspecialchars((string)$arr['version'], ENT_COMPAT, 'UTF-8', false) : '');
+		$directory_url = ((isset($arr['directory_url'])) ? htmlspecialchars($arr['directory_url'], ENT_COMPAT, 'UTF-8', false) : '');
+		$url           = ((isset($arr['url'])) ? htmlspecialchars(strtolower($arr['url']), ENT_COMPAT, 'UTF-8', false) : '');
+		$sellpage      = ((isset($arr['sellpage'])) ? htmlspecialchars($arr['sellpage'], ENT_COMPAT, 'UTF-8', false) : '');
+		$site_location = ((isset($arr['location'])) ? htmlspecialchars($arr['location'], ENT_COMPAT, 'UTF-8', false) : '');
+		$site_realm    = ((isset($arr['realm'])) ? htmlspecialchars($arr['realm'], ENT_COMPAT, 'UTF-8', false) : '');
+		$site_project  = ((isset($arr['project'])) ? htmlspecialchars($arr['project'], ENT_COMPAT, 'UTF-8', false) : '');
+		$site_crypto   = ((isset($arr['encryption']) && is_array($arr['encryption'])) ? htmlspecialchars(implode(',', $arr['encryption']), ENT_COMPAT, 'UTF-8', false) : '');
+		$site_version  = ((isset($arr['version'])) ? htmlspecialchars($arr['version'], ENT_COMPAT, 'UTF-8', false) : '');
 
 		// You can have one and only one primary directory per realm.
 		// Downgrade any others claiming to be primary. As they have
@@ -2729,14 +2735,15 @@ class Libzot {
 		$token     = ((x($arr, 'token')) ? $arr['token'] : '');
 		$feed      = ((x($arr, 'feed')) ? intval($arr['feed']) : 0);
 
+		$ztarget_hash = EMPTY_STR;
+
 		if ($ztarget) {
-			$t = q("select * from hubloc where hubloc_id_url = '%s' and hubloc_network = 'zot6' limit 1",
+			$t = q("select * from hubloc where hubloc_id_url = '%s' and hubloc_network = 'zot6' order by hubloc_id desc limit 1",
 				dbesc($ztarget)
 			);
 			if ($t) {
 
 				$ztarget_hash = $t[0]['hubloc_hash'];
-
 			}
 			else {
 
@@ -2744,7 +2751,6 @@ class Libzot {
 				// permissions we would know about them and we only want to know who they are to
 				// enumerate their specific permissions
 
-				$ztarget_hash = EMPTY_STR;
 			}
 		}
 
@@ -2920,12 +2926,11 @@ class Libzot {
 		// This is a template - %s will be replaced with the follow_url we discover for the return channel.
 
 		if ($special_channel) {
-			$ret['connect_url'] = (($e['xchan_connpage']) ? $e['xchan_connpage'] : z_root() . '/connect/' . $e['channel_address']);
+			$ret['connect_url'] = $e['xchan_connpage'] ?? z_root() . '/connect/' . $e['channel_address'];
 		}
 
 		// This is a template for our follow url, %s will be replaced with a webbie
-		if (!$ret['follow_url'])
-			$ret['follow_url'] = z_root() . '/follow?f=&url=%s';
+		$ret['follow_url'] = $ret['follow_url'] ?? z_root() . '/follow?f=&url=%s';
 
 		$permissions = get_all_perms($e['channel_id'], $ztarget_hash, false, false);
 
@@ -3194,7 +3199,7 @@ class Libzot {
 		}
 
 		foreach ($arr as $v) {
-			if ($v[$check] === 'zot6') {
+			if (isset($v[$check]) && $v[$check] === 'zot6') {
 				return $v;
 			}
 		}
diff --git a/Zotlabs/Lib/Queue.php b/Zotlabs/Lib/Queue.php
index 246b42667..c3f9cda20 100644
--- a/Zotlabs/Lib/Queue.php
+++ b/Zotlabs/Lib/Queue.php
@@ -110,21 +110,30 @@ class Queue {
 			return false;
 		}
 
+		$hash = $arr['hash'] ?? '';
+		$account_id = $arr['account_id'] ?? 0;
+		$channel_id = $arr['channel_id'] ?? 0;
+		$driver = $arr['driver'] ?? 'zot6';
+		$posturl = $arr['posturl'] ?? '';
+		$priority = $arr['priority'] ?? 0;
+		$notify = $arr['notify'] ?? '';
+		$msg = $arr['msg'] ?? '';
+
 		$x = q("insert into outq ( outq_hash, outq_account, outq_channel, outq_driver, outq_posturl, outq_async, outq_priority,
 			outq_created, outq_updated, outq_scheduled, outq_notify, outq_msg )
 			values ( '%s', %d, %d, '%s', '%s', %d, %d, '%s', '%s', '%s', '%s', '%s' )",
-			dbesc($arr['hash']),
-			intval($arr['account_id']),
-			intval($arr['channel_id']),
-			dbesc(($arr['driver']) ? $arr['driver'] : 'zot6'),
-			dbesc($arr['posturl']),
+			dbesc($hash),
+			intval($account_id),
+			intval($channel_id),
+			dbesc($driver),
+			dbesc($posturl),
 			intval(1),
-			intval(isset($arr['priority']) ? $arr['priority'] : 0),
+			intval($priority),
 			dbesc(datetime_convert()),
 			dbesc(datetime_convert()),
 			dbesc(datetime_convert()),
-			dbesc($arr['notify']),
-			dbesc(($arr['msg']) ? $arr['msg'] : '')
+			dbesc($notify),
+			dbesc($msg)
 		);
 		return $x;
 
diff --git a/Zotlabs/Lib/System.php b/Zotlabs/Lib/System.php
index 3cc46fbda..087378f16 100644
--- a/Zotlabs/Lib/System.php
+++ b/Zotlabs/Lib/System.php
@@ -16,13 +16,13 @@ class System {
 	}
 
 	static public function get_site_name() {
-		if(is_array(\App::$config) && is_array(\App::$config['system']) && \App::$config['system']['sitename'])
+		if(is_array(\App::$config) && is_array(\App::$config['system']) && isset(\App::$config['system']['sitename']))
 			return \App::$config['system']['sitename'];
 		return '';
 	}
 
 	static public function get_project_version() {
-		if(is_array(\App::$config) && is_array(\App::$config['system']) && \App::$config['system']['hide_version'])
+		if(is_array(\App::$config) && is_array(\App::$config['system']) && isset(\App::$config['system']['hide_version']))
 			return '';
 		if(is_array(\App::$config) && is_array(\App::$config['system']) && array_key_exists('std_version',\App::$config['system']))
 			return \App::$config['system']['std_version'];
@@ -31,33 +31,33 @@ class System {
 	}
 
 	static public function get_update_version() {
-		if(is_array(\App::$config) && is_array(\App::$config['system']) && \App::$config['system']['hide_version'])
+		if(is_array(\App::$config) && is_array(\App::$config['system']) && isset(\App::$config['system']['hide_version']))
 			return '';
 		return DB_UPDATE_VERSION;
 	}
 
 
 	static public function get_notify_icon() {
-		if(is_array(\App::$config) && is_array(\App::$config['system']) && \App::$config['system']['email_notify_icon_url'])
+		if(is_array(\App::$config) && is_array(\App::$config['system']) && isset(\App::$config['system']['email_notify_icon_url']))
 			return \App::$config['system']['email_notify_icon_url'];
 		return z_root() . DEFAULT_NOTIFY_ICON;
 	}
 
 	static public function get_site_icon() {
-		if(is_array(\App::$config) && is_array(\App::$config['system']) && \App::$config['system']['site_icon_url'])
+		if(is_array(\App::$config) && is_array(\App::$config['system']) && isset(\App::$config['system']['site_icon_url']))
 			return \App::$config['system']['site_icon_url'];
 		return z_root() . DEFAULT_PLATFORM_ICON ;
 	}
 
 
 	static public function get_project_link() {
-		if(is_array(\App::$config) && is_array(\App::$config['system']) && \App::$config['system']['project_link'])
+		if(is_array(\App::$config) && is_array(\App::$config['system']) && isset(\App::$config['system']['project_link']))
 			return \App::$config['system']['project_link'];
 		return 'https://hubzilla.org';
 	}
 
 	static public function get_project_srclink() {
-		if(is_array(\App::$config) && is_array(\App::$config['system']) && \App::$config['system']['project_srclink'])
+		if(is_array(\App::$config) && is_array(\App::$config['system']) && isset(\App::$config['system']['project_srclink']))
 			return \App::$config['system']['project_srclink'];
 		return 'https://framagit.org/hubzilla/core.git';
 	}
@@ -68,7 +68,7 @@ class System {
 
 
 	static public function get_zot_revision() {
-		$x = [ 'revision' => ZOT_REVISION ]; 
+		$x = [ 'revision' => ZOT_REVISION ];
 		call_hooks('zot_revision',$x);
 		return $x['revision'];
 	}
diff --git a/Zotlabs/Lib/ThreadItem.php b/Zotlabs/Lib/ThreadItem.php
index a02c1415e..8cc0f6aa5 100644
--- a/Zotlabs/Lib/ThreadItem.php
+++ b/Zotlabs/Lib/ThreadItem.php
@@ -98,7 +98,7 @@ class ThreadItem {
 		$is_item = false;
 		$osparkle = '';
 		$total_children = $this->count_descendants();
-		$unseen_comments = (($item['real_uid']) ? 0 : $this->count_unseen_descendants());
+		$unseen_comments = ((isset($item['real_uid']) && $item['real_uid']) ? 0 : $this->count_unseen_descendants());
 
  		$conv = $this->get_conversation();
 		$observer = $conv->get_observer();
@@ -148,7 +148,7 @@ class ThreadItem {
 		}
 
 		if ($lock) {
- 			if (($item['mid'] == $item['parent_mid']) && count(get_terms_oftype($item['term'],TERM_FORUM))) {
+ 			if (($item['mid'] == $item['parent_mid']) && isset($item['term']) && count(get_terms_oftype($item['term'], TERM_FORUM))) {
  				$privacy_warning = true;
 				$conv_flags['parent_privacy_warning'] = true;
  			}
@@ -180,7 +180,7 @@ class ThreadItem {
 			$dropping = false;
 		}
 
-
+		$drop = [];
 		if($dropping) {
 			$drop = array(
 				'dropping' => $dropping,
@@ -191,13 +191,6 @@ class ThreadItem {
 			$drop = [ 'dropping' => true, 'delete' => t('Admin Delete') ];
 		}
 
-// FIXME
-		if($observer_is_pageowner) {
-			$multidrop = array(
-				'select' => t('Select'),
-			);
-		}
-
 		$filer = ((($conv->get_profile_owner() == local_channel()) && (! array_key_exists('real_uid',$item))) ? t("Save to Folder") : false);
 
 		$profile_avatar = $item['author']['xchan_photo_m'];
@@ -207,7 +200,6 @@ class ThreadItem {
 		$location = format_location($item);
 		$isevent = false;
 		$attend = null;
-		$canvote = false;
 
 		// process action responses - e.g. like/dislike/attend/agree/whatever
 		$response_verbs = array('like');
@@ -227,17 +219,6 @@ class ThreadItem {
 			$response_verbs[] = 'answer';
 		}
 
-		$consensus = (intval($item['item_consensus']) ? true : false);
-		if($consensus) {
-			$response_verbs[] = 'agree';
-			$response_verbs[] = 'disagree';
-			$response_verbs[] = 'abstain';
-			if($this->is_commentable() && $observer) {
-				$conlabels = array( t('I agree'), t('I disagree'), t('I abstain'));
-				$canvote = true;
-			}
-		}
-
 		if(! feature_enabled($conv->get_profile_owner(),'dislike'))
 			unset($conv_responses['dislike']);
 
@@ -245,7 +226,8 @@ class ThreadItem {
 
 		$my_responses = [];
 		foreach($response_verbs as $v) {
-			$my_responses[$v] = (($conv_responses[$v][$item['mid'] . '-m']) ? 1 : 0);
+
+			$my_responses[$v] = ((isset($conv_responses[$v][$item['mid'] . '-m'])) ? 1 : 0);
 		}
 
 		$like_count = ((x($conv_responses['like'],$item['mid'])) ? $conv_responses['like'][$item['mid']] : '');
@@ -283,14 +265,11 @@ class ThreadItem {
 		$this->check_wall_to_wall();
 
 		if($this->is_toplevel()) {
-			// FIXME check this permission
-			if($conv->get_profile_owner() === local_channel() || intval($item['item_private']) === 0) {
-
-				$star = array(
+			if((local_channel() && $conv->get_profile_owner() === local_channel()) || (local_channel() && App::$module === 'pubstream')) {
+				$star = [
 					'toggle' => t("Toggle Star Status"),
 					'isstarred' => ((intval($item['item_starred'])) ? true : false),
-				);
-
+				];
 			}
 		}
 		else {
@@ -307,7 +286,7 @@ class ThreadItem {
 		$tagger = [];
 
 		// FIXME - check this permission
-		if($conv->get_profile_owner() == local_channel()) {
+		if(local_channel() && $conv->get_profile_owner() == local_channel()) {
 			/* disable until we agree on how to implemnt this in zot6/activitypub
 			$tagger = array(
 				'tagit' => t("Add Tag"),
@@ -330,20 +309,26 @@ class ThreadItem {
 		if(($item['obj_type'] === ACTIVITY_OBJ_EVENT) && $conv->get_profile_owner() == local_channel())
 			$has_event = true;
 
+		$like = [];
+		$dislike = [];
+		$reply_to = [];
+
 		if($this->is_commentable() && $observer) {
 			$like = array( t("I like this \x28toggle\x29"), t("like"));
 			$dislike = array( t("I don't like this \x28toggle\x29"), t("dislike"));
 			$reply_to = array( t("Reply on this comment"), t("reply"), t("Reply to"));
 		}
 
+		$share = [];
+		$embed = [];
 		if ($shareable) {
 			// This actually turns out not to be possible in some protocol stacks without opening up hundreds of new issues.
 			// Will allow it only for uri resolvable sources.
 			if(strpos($item['mid'],'http') === 0) {
-				$share = []; //Not yet ready for primetime
+				//Not yet ready for primetime
 				//$share = array( t('Repeat This'), t('repeat'));
 			}
-			$embed = array( t('Share This'), t('share'));
+			$embed = [t('Share This'), t('share')];
 		}
 
 		$dreport = '';
@@ -352,11 +337,13 @@ class ThreadItem {
 		if($keep_reports === 0)
 			$keep_reports = 10;
 
-		if((! get_config('system','disable_dreport')) && strcmp(datetime_convert('UTC','UTC',$item['created']),datetime_convert('UTC','UTC',"now - $keep_reports days")) > 0) {
+		$dreport_link = '';
+		if((intval($item['item_type']) == ITEM_TYPE_POST) && (! get_config('system','disable_dreport')) && strcmp(datetime_convert('UTC','UTC',$item['created']),datetime_convert('UTC','UTC',"now - $keep_reports days")) > 0) {
 			$dreport = t('Delivery Report');
 			$dreport_link = gen_link_id($item['mid']);
 		}
 
+		$is_new = false;
 		if(strcmp(datetime_convert('UTC','UTC',$item['created']),datetime_convert('UTC','UTC','now - 12 hours')) > 0)
 			$is_new = true;
 
@@ -426,9 +413,6 @@ class ThreadItem {
 			'author_is_group_actor' => (($item['author']['xchan_pubforum']) ? t('Forum') : ''),
 			'isevent' => $isevent,
 			'attend' => $attend,
-			'consensus' => $consensus,
-			'conlabels' => $conlabels,
-			'canvote' => $canvote,
 			'linktitle' => (($item['author']['xchan_addr']) ? $item['author']['xchan_addr'] : $item['author']['xchan_url']),
 			'olinktitle' => (($item['owner']['xchan_addr']) ? $item['owner']['xchan_addr'] : $item['owner']['xchan_url']),
 			'llink' => $item['llink'],
@@ -497,7 +481,6 @@ class ThreadItem {
 			'bookmark'  => (($conv->get_profile_owner() == local_channel() && local_channel() && $has_bookmarks) ? t('Save Bookmarks') : ''),
 			'addtocal'  => (($has_event) ? t('Add to Calendar') : ''),
 			'drop'      => $drop,
-			'multidrop' => ((feature_enabled($conv->get_profile_owner(),'multi_delete')) ? $multidrop : ''),
 			'dropdown_extras' => $dropdown_extras,
 // end toolbar buttons
 			'unseen_comments' => $unseen_comments,
@@ -520,7 +503,7 @@ class ThreadItem {
 			'modal_dismiss' => t('Close'),
 			'showlike' => $showlike,
 			'showdislike' => $showdislike,
-			'comment' => ($item['item_delayed'] ? '' : $this->get_comment_box($indent)),
+			'comment' => ($item['item_delayed'] ? '' : $this->get_comment_box()),
 			'previewing' => ($conv->is_preview() ? true : false ),
 			'preview_lbl' => t('This is an unsaved preview'),
 			'wait' => t('Please wait'),
@@ -814,7 +797,7 @@ class ThreadItem {
 	 *      _ The comment box string (empty if no comment box)
 	 *      _ false on failure
 	 */
-	private function get_comment_box($indent) {
+	private function get_comment_box() {
 
 		if(!$this->is_toplevel() && !get_config('system','thread_allow')) {
 			return '';
@@ -860,7 +843,6 @@ class ThreadItem {
 			'$edurl' => t('Insert Link'),
 			'$edvideo' => t('Video'),
 			'$preview' => t('Preview'), // ((feature_enabled($conv->get_profile_owner(),'preview')) ? t('Preview') : ''),
-			'$indent' => $indent,
 			'$can_upload' => (perm_is_allowed($conv->get_profile_owner(),get_observer_hash(),'write_storage') && $conv->is_uploadable()),
 			'$feature_encrypt' => ((feature_enabled($conv->get_profile_owner(),'content_encrypt')) ? true : false),
 			'$encrypt' => t('Encrypt text'),
diff --git a/Zotlabs/Lib/Webfinger.php b/Zotlabs/Lib/Webfinger.php
index 611c36889..8484fb797 100644
--- a/Zotlabs/Lib/Webfinger.php
+++ b/Zotlabs/Lib/Webfinger.php
@@ -56,7 +56,7 @@ class Webfinger {
 				if($m['scheme'] !== 'https') {
 					return false;
 				}
-				self::$server = $m['host'] . (($m['port']) ? ':' . $m['port'] : '');
+				self::$server = $m['host'] . ((isset($m['port'])) ? ':' . $m['port'] : '');
 			}
 			else {
 				return false;
@@ -86,7 +86,7 @@ class Webfinger {
 	/**
 	 * @brief fetch a webfinger resource and return a zot6 discovery url if present
 	 *
-	 */ 
+	 */
 
 	static function zot_url($resource) {
 
diff --git a/Zotlabs/Module/Acl.php b/Zotlabs/Module/Acl.php
index 5b37f2707..9dc422e6b 100644
--- a/Zotlabs/Module/Acl.php
+++ b/Zotlabs/Module/Acl.php
@@ -66,6 +66,11 @@ class Acl extends \Zotlabs\Web\Controller {
 			killme();
 
 		$permitted = [];
+		$sql_extra = '';
+		$sql_extra2 = '';
+		$sql_extra3 = '';
+		$sql_extra2_xchan = '';
+		$order_extra2 = '';
 
 		if(in_array($type, [ 'm', 'a', 'c', 'f' ])) {
 
@@ -81,7 +86,6 @@ class Acl extends \Zotlabs\Web\Controller {
 
 		}
 
-
 		if($search) {
 			$sql_extra = " AND pgrp.gname LIKE " . protect_sprintf( "'%" . dbesc($search) . "%'" ) . " ";
 			$sql_extra2 = "AND ( xchan_name LIKE " . protect_sprintf( "'%" . dbesc($search) . "%'" ) . " OR xchan_addr LIKE " . protect_sprintf( "'%" . dbesc(punify($search)) . ((strpos($search,'@') === false) ? "%@%'"  : "%'")) . ") ";
@@ -100,10 +104,6 @@ class Acl extends \Zotlabs\Web\Controller {
 			$sql_extra3 = "AND ( xchan_addr like " . protect_sprintf( "'%" . dbesc(punify($search)) . "%'" ) . " OR xchan_name like " . protect_sprintf( "'%" . dbesc($search) . "%'" ) . " ) ";
 
 		}
-		else {
-			$sql_extra = $sql_extra2 = $sql_extra3 = "";
-		}
-
 
 		$groups = array();
 		$contacts = array();
@@ -342,7 +342,7 @@ class Acl extends \Zotlabs\Web\Controller {
 			$x = [];
 			foreach($r as $g) {
 
-				if(in_array($g['net'],['rss','anon','unknown']) && ($type != 'a'))
+				if(isset($g['net']) && in_array($g['net'], ['rss','anon','unknown']) && ($type != 'a'))
 					continue;
 
 				$g['hash'] = urlencode($g['hash']);
@@ -383,7 +383,7 @@ class Acl extends \Zotlabs\Web\Controller {
 							"self"     => (intval($g['abook_self']) ? 'abook-self' : ''),
 							"taggable" => '',
 							"label"    => '',
-							"net"      => $g['net']
+							"net"      => $g['net'] ?? ''
 						);
 					}
 				}
diff --git a/Zotlabs/Module/Admin/Queue.php b/Zotlabs/Module/Admin/Queue.php
index 8a843083b..8a20324d0 100644
--- a/Zotlabs/Module/Admin/Queue.php
+++ b/Zotlabs/Module/Admin/Queue.php
@@ -12,18 +12,18 @@ class Queue {
 
 		$o = '';
 
-		$expert = ((array_key_exists('expert',$_REQUEST)) ? intval($_REQUEST['expert']) : 0);
+		$expert = $_REQUEST['expert'] ?? false;
 
-		if($_REQUEST['drophub']) {
+		if(isset($_REQUEST['drophub'])) {
 			hubloc_mark_as_down($_REQUEST['drophub']);
 			LibQueue::remove_by_posturl($_REQUEST['drophub']);
 		}
 
-		if($_REQUEST['emptyhub']) {
+		if(isset($_REQUEST['emptyhub'])) {
 			LibQueue::remove_by_posturl($_REQUEST['emptyhub']);
 		}
 
-		if($_REQUEST['deliverhub']) {
+		if(isset($_REQUEST['deliverhub'])) {
 
 			$hubq = q("SELECT * FROM outq WHERE outq_posturl = '%s'",
 				dbesc($_REQUEST['deliverhub'])
@@ -39,7 +39,6 @@ class Queue {
 
 		for($x = 0; $x < count($r); $x ++) {
 			$r[$x]['eurl'] = urlencode($r[$x]['outq_posturl']);
-			$r[$x]['connected'] = datetime_convert('UTC',date_default_timezone_get(),$r[$x]['connected'],'Y-m-d');
 		}
 
 		$o = replace_macros(get_markup_template('admin_queue.tpl'), array(
diff --git a/Zotlabs/Module/Channel.php b/Zotlabs/Module/Channel.php
index aebc70c15..24a3fd44f 100644
--- a/Zotlabs/Module/Channel.php
+++ b/Zotlabs/Module/Channel.php
@@ -67,7 +67,7 @@ class Channel extends Controller {
 
 			if ($sigdata && $sigdata['signer'] && $sigdata['header_valid']) {
 				$data = json_encode(Libzot::zotinfo(['guid_hash' => $channel['channel_hash'], 'target_url' => $sigdata['signer']]));
-				$s = q("select site_crypto, hubloc_sitekey from site left join hubloc on hubloc_url = site_url where hubloc_id_url = '%s' and hubloc_network = 'zot6' limit 1",
+				$s = q("select site_crypto, hubloc_sitekey from site left join hubloc on hubloc_url = site_url where hubloc_id_url = '%s' and hubloc_network = 'zot6' order by hubloc_id desc limit 1",
 					dbesc($sigdata['signer'])
 				);
 
@@ -267,6 +267,7 @@ class Channel extends Controller {
 					'reset'               => t('Reset form')
 				];
 
+				$a = '';
 				$o .= status_editor($a, $x, false, 'Channel');
 			}
 
diff --git a/Zotlabs/Module/Contactedit.php b/Zotlabs/Module/Contactedit.php
index d306039d2..58c3380a1 100644
--- a/Zotlabs/Module/Contactedit.php
+++ b/Zotlabs/Module/Contactedit.php
@@ -103,7 +103,7 @@ class Contactedit extends Controller {
 				dbesc($profile_id),
 				intval(local_channel())
 			);
-			if (!count($r)) {
+			if (!$r) {
 				notice(t('Could not locate selected profile.') . EOL);
 				return;
 			}
@@ -452,8 +452,8 @@ class Contactedit extends Controller {
 
 		if (is_ajax()) {
 			json_return_and_die([
-				'success' => ((intval($_REQUEST['success'])) ? intval($_REQUEST['success']) : 1),
-				'message' => (($_REQUEST['success']) ? t('Contact updated') : t('Contact update failed')),
+				'success' => ((isset($_REQUEST['success'])) ? intval($_REQUEST['success']) : 1),
+				'message' => ((isset($_REQUEST['success'])) ? t('Contact updated') : t('Contact update failed')),
 				'id' => $contact_id,
 				'title' => $header_html,
 				'role' => ((intval($contact['abook_pending'])) ? '' : $roles_dict[$current_permcat]),
diff --git a/Zotlabs/Module/Home.php b/Zotlabs/Module/Home.php
index 315d05af6..8d78960cc 100644
--- a/Zotlabs/Module/Home.php
+++ b/Zotlabs/Module/Home.php
@@ -36,7 +36,7 @@ class Home extends Controller {
 
 		$channel = App::get_channel();
 		if (local_channel() && $channel && $channel['xchan_url'] && !$splash) {
-			$dest = (($ret['startpage']) ? $ret['startpage'] : '');
+			$dest = $ret['startpage'] ?? '';
 			if (!$dest)
 				$dest = get_config('system', 'startpage');
 			if (!$dest)
diff --git a/Zotlabs/Module/Hq.php b/Zotlabs/Module/Hq.php
index efbfcf084..cd95ac4b0 100644
--- a/Zotlabs/Module/Hq.php
+++ b/Zotlabs/Module/Hq.php
@@ -47,24 +47,11 @@ class Hq extends \Zotlabs\Web\Controller {
 		$sys = get_sys_channel();
 		$sys_item = false;
 		$sql_extra = '';
-
-		if(! $item_hash) {
-			//$r = q("SELECT mid FROM item
-				//WHERE uid = %d $item_normal
-				//AND mid = parent_mid
-				//AND item_private IN (0, 1)
-				//ORDER BY created DESC LIMIT 1",
-				//intval(local_channel())
-			//);
-			//if($r[0]['mid']) {
-				//$item_hash = $r[0]['mid'];
-			//}
-		}
+		$target_item = null;
+		$o = '';
 
 		if($item_hash) {
 
-			$target_item = null;
-
 			$r = q("select id, uid, mid, parent_mid, thr_parent, verb, item_type, item_deleted, item_blocked from item where mid = '%s' limit 1",
 				dbesc($item_hash)
 			);
@@ -115,7 +102,7 @@ class Hq extends \Zotlabs\Web\Controller {
 			];
 
 			$a = '';
-			$o = status_editor($a, $x, true);
+			$o .= status_editor($a, $x, true);
 
 		}
 
diff --git a/Zotlabs/Module/Import_progress.php b/Zotlabs/Module/Import_progress.php
index 761d2f215..5c68f9ff1 100644
--- a/Zotlabs/Module/Import_progress.php
+++ b/Zotlabs/Module/Import_progress.php
@@ -49,11 +49,6 @@ class Import_progress extends \Zotlabs\Web\Controller {
 			}
 
 			$ccompleted_str = t('Item sync completed but no items were found!');
-
-			if(argv(1) === 'resume_itemsync') {
-				Master::Summon(["Content_importer","0","0001-01-01 00:00:00","2021-10-02 19:49:14","ct5","https%3A%2F%2Fhub.somaton.com"]);
-				goaway('/import_progress');
-			}
 		}
 
 		$cprogress_str = ((intval($cprogress)) ? $cprogress . '%' : $cprogress);
@@ -76,8 +71,6 @@ class Import_progress extends \Zotlabs\Web\Controller {
 				Master::Summon($f['next_cmd']);
 				goaway('/import_progress');
 			}
-
-
 		}
 		else {
 			$fprogress = 'waiting to start...';
diff --git a/Zotlabs/Module/Item.php b/Zotlabs/Module/Item.php
index e1ba2b2f0..588391843 100644
--- a/Zotlabs/Module/Item.php
+++ b/Zotlabs/Module/Item.php
@@ -387,7 +387,7 @@ class Item extends Controller {
 		$categories    = ((x($_REQUEST, 'category')) ? escape_tags($_REQUEST['category']) : '');
 		$webpage       = ((x($_REQUEST, 'webpage')) ? intval($_REQUEST['webpage']) : 0);
 		$item_obscured = ((x($_REQUEST, 'obscured')) ? intval($_REQUEST['obscured']) : 0);
-		$pagetitle     = ((x($_REQUEST, 'pagetitle')) ? escape_tags(urlencode($_REQUEST['pagetitle'])) : '');
+		$pagetitle     = ((x($_REQUEST, 'pagetitle')) ? escape_tags($_REQUEST['pagetitle']) : '');
 		$layout_mid    = ((x($_REQUEST, 'layout_mid')) ? escape_tags($_REQUEST['layout_mid']) : '');
 		$plink         = ((x($_REQUEST, 'permalink')) ? escape_tags($_REQUEST['permalink']) : '');
 		$obj_type      = ((x($_REQUEST, 'obj_type')) ? escape_tags($_REQUEST['obj_type']) : ACTIVITY_OBJ_NOTE);
@@ -411,7 +411,7 @@ class Item extends Controller {
 		}
 
 		if ($pagetitle) {
-			$pagetitle = strtolower(URLify::transliterate($pagetitle));
+			$pagetitle = str_replace('/', '-', strtolower(URLify::transliterate($pagetitle)));
 		}
 
 
diff --git a/Zotlabs/Module/Network.php b/Zotlabs/Module/Network.php
index f4f6cc8d1..00fed55c2 100644
--- a/Zotlabs/Module/Network.php
+++ b/Zotlabs/Module/Network.php
@@ -129,6 +129,9 @@ class Network extends \Zotlabs\Web\Controller {
 		$pf       = ((x($_GET, 'pf'))    ? $_GET['pf']            : '');
 		$unseen   = ((x($_GET, 'unseen'))    ? $_GET['unseen']            : '');
 
+		$status_editor = '';
+
+
 		if (Apps::system_app_installed(local_channel(), 'Affinity Tool')) {
 			$affinity_locked = intval(get_pconfig(local_channel(), 'affinity', 'lock', 1));
 			if ($affinity_locked) {
@@ -208,6 +211,7 @@ class Network extends \Zotlabs\Web\Controller {
 				'reset' => t('Reset form')
 			);
 
+			$a = '';
 			$status_editor = status_editor($a, $x, false, 'Network');
 			$o .= $status_editor;
 
@@ -370,9 +374,9 @@ class Network extends \Zotlabs\Web\Controller {
 			// ActivityStreams specification.
 
 			if (substr($verb, 0, 1) === '.') {
-				$verb = substr($verb, 1);
+				$sql_verb = substr($verb, 1);
 				$sql_extra .= sprintf(" AND item.obj_type like '%s' ",
-					dbesc(protect_sprintf('%' . $verb . '%'))
+					dbesc(protect_sprintf('%' . $sql_verb . '%'))
 				);
 			}
 			else {
diff --git a/Zotlabs/Module/Outbox.php b/Zotlabs/Module/Outbox.php
index 503b464d1..24a3399a5 100644
--- a/Zotlabs/Module/Outbox.php
+++ b/Zotlabs/Module/Outbox.php
@@ -76,7 +76,7 @@ class Outbox extends Controller {
 				App::set_pager_itemspage(30);
 			}
 
-			if (App::$pager['unset'] && $total > 30) {
+			if (isset(App::$pager['unset']) && $total > 30) {
 				$ret = Activity::paged_collection_init($total, App::$query_string);
 			}
 			else {
diff --git a/Zotlabs/Module/Owa.php b/Zotlabs/Module/Owa.php
index e30aa5fb4..0922eb5d4 100644
--- a/Zotlabs/Module/Owa.php
+++ b/Zotlabs/Module/Owa.php
@@ -32,14 +32,14 @@ class Owa extends Controller {
 				$keyId = $sigblock['keyId'];
 				if ($keyId) {
 					$r = q("SELECT * FROM hubloc LEFT JOIN xchan ON hubloc_hash = xchan_hash
-						WHERE hubloc_id_url = '%s' AND xchan_pubkey != '' ",
+						WHERE hubloc_id_url = '%s' AND hubloc_deleted = 0 ORDER BY hubloc_id DESC",
 						dbesc($keyId)
 					);
 					if (! $r) {
-						$found = discover_by_webbie(str_replace('acct:','',$keyId));
+						$found = discover_by_webbie($keyId);
 						if ($found) {
 							$r = q("SELECT * FROM hubloc LEFT JOIN xchan ON hubloc_hash = xchan_hash
-								WHERE hubloc_id_url = '%s' AND xchan_pubkey != '' ",
+								WHERE hubloc_id_url = '%s' AND hubloc_deleted = 0 ORDER BY hubloc_id DESC ",
 								dbesc($keyId)
 							);
 						}
@@ -61,10 +61,43 @@ class Owa extends Controller {
 								logger('OWA fail: ' . $hubloc['hubloc_id'] . ' ' . $hubloc['hubloc_id_url']);
 							}
 						}
+
+						if (!$ret['success']) {
+
+							// Possible a reinstall?
+							// In this case we probably already have an old hubloc
+							// but not the new one yet.
+
+							$found = discover_by_webbie($keyId);
+
+							if ($found) {
+								$r = q("SELECT * FROM hubloc LEFT JOIN xchan ON hubloc_hash = xchan_hash
+									WHERE hubloc_id_url = '%s' AND hubloc_deleted = 0 ORDER BY hubloc_id DESC LIMIT 1",
+									dbesc($keyId)
+								);
+
+								if ($r) {
+									$verified = HTTPSig::verify(file_get_contents('php://input'), $r[0]['xchan_pubkey']);
+									if ($verified && $verified['header_signed'] && $verified['header_valid'] && ($verified['content_valid'] || (! $verified['content_signed']))) {
+										logger('OWA header: ' . print_r($verified,true), LOGGER_DATA);
+										logger('OWA success: ' . $r[0]['hubloc_id_url'], LOGGER_DATA);
+										$ret['success'] = true;
+										$token = random_string(32);
+										Verify::create('owt', 0, $token, $r[0]['hubloc_id_url']);
+										$result = '';
+										openssl_public_encrypt($token, $result, $r[0]['xchan_pubkey']);
+										$ret['encrypted_token'] = base64url_encode($result);
+									} else {
+										logger('OWA fail: ' . $hubloc['hubloc_id'] . ' ' . $hubloc['hubloc_id_url']);
+									}
+								}
+							}
+						}
 					}
 				}
 			}
 		}
+
 		json_return_and_die($ret,'application/x-zot+json');
 	}
 }
diff --git a/Zotlabs/Module/Poke.php b/Zotlabs/Module/Poke.php
index d60a7f426..596de58a3 100644
--- a/Zotlabs/Module/Poke.php
+++ b/Zotlabs/Module/Poke.php
@@ -3,6 +3,7 @@ namespace Zotlabs\Module; /** @file */
 
 use App;
 use Zotlabs\Lib\Apps;
+use Zotlabs\Lib\Activity;
 use Zotlabs\Web\Controller;
 
 /**
@@ -107,11 +108,6 @@ class Poke extends Controller {
 			$deny_gid      = (($item_private) ? '' : $channel['channel_deny_gid']);
 		}
 
-
-		$arr = array();
-
-
-
 		$arr['item_wall']     = 1;
 		$arr['owner_xchan']   = (($parent_item) ? $parent_item['owner_xchan'] : $channel['channel_hash']);
 		$arr['parent_mid']    = (($parent_mid) ? $parent_mid : '');
@@ -122,26 +118,15 @@ class Poke extends Controller {
 		$arr['deny_gid']      = $deny_gid;
 		$arr['verb']          = $activity;
 		$arr['item_private']  = $item_private;
-		$arr['obj_type']      = ACTIVITY_OBJ_PERSON;
+		$arr['obj_type']      = ACTIVITY_OBJ_NOTE;
 		$arr['body']          = '[zrl=' . $channel['xchan_url'] . ']' . $channel['xchan_name'] . '[/zrl]' . ' ' . t($verbs[$verb][0]) . ' ' . '[zrl=' . $target['xchan_url'] . ']' . $target['xchan_name'] . '[/zrl]';
-
-		$obj = array(
-			'type' => ACTIVITY_OBJ_PERSON,
-			'title' => $target['xchan_name'],
-			'id' => $target['xchan_hash'],
-			'link' => array(
-				array('rel' => 'alternate', 'type' => 'text/html', 'href' => $target['xchan_url']),
-				array('rel' => 'photo', 'type' => $target['xchan_photo_mimetype'], 'href' => $target['xchan_photo_l'])
-			),
-		);
-
-		$arr['obj'] = json_encode($obj);
-
 		$arr['item_origin']   = 1;
 		$arr['item_wall']     = 1;
 		$arr['item_unseen']   = 1;
 		if(! $parent_item)
-			$item['item_thread_top'] = 1;
+			$arr['item_thread_top'] = 1;
+
+		$arr['obj'] = Activity::encode_item($arr);
 
 
 		post_activity_item($arr);
@@ -198,8 +183,8 @@ class Poke extends Controller {
 			$desc = t('Poke somebody');
 		}
 		else {
-			$title = t('Poke/Prod');
-			$desc = t('Poke, prod or do other things to somebody');
+			$title = t('Poke');
+			$desc = t('Poke or ping somebody');
 		}
 
 		$o = replace_macros(get_markup_template('poke_content.tpl'),array(
@@ -207,7 +192,7 @@ class Poke extends Controller {
 			'$poke_basic' => $poke_basic,
 			'$desc' => $desc,
 			'$clabel' => t('Recipient'),
-			'$choice' => t('Choose what you wish to do to recipient'),
+			'$choice' => t('Choose action'),
 			'$verbs' => $shortlist,
 			'$parent' => $parent,
 			'$prv_desc' => t('Make this post private'),
diff --git a/Zotlabs/Module/Rmagic.php b/Zotlabs/Module/Rmagic.php
index ab9ad059e..2950dca5e 100644
--- a/Zotlabs/Module/Rmagic.php
+++ b/Zotlabs/Module/Rmagic.php
@@ -6,21 +6,21 @@ use Zotlabs\Lib\Libzot;
 class Rmagic extends \Zotlabs\Web\Controller {
 
 	function init() {
-	
+
 		if(local_channel())
 			goaway(z_root());
-	
+
 		$me = get_my_address();
 		if($me) {
-			$r = q("select hubloc_url from hubloc where hubloc_addr = '%s'",
+			$r = q("select hubloc_url, hubloc_network from hubloc where hubloc_addr = '%s' and hubloc_deleted = 0",
 				dbesc($me)
-			);		
+			);
 			if(! $r) {
 				$w = discover_by_webbie($me);
 				if($w) {
-					$r = q("select hubloc_url from hubloc where hubloc_addr = '%s'",
+					$r = q("select hubloc_url, hubloc_network from hubloc where hubloc_addr = '%s' and hubloc_deleted = 0",
 						dbesc($me)
-					);		
+					);
 				}
 			}
 
@@ -33,39 +33,39 @@ class Rmagic extends \Zotlabs\Web\Controller {
 			}
 		}
 	}
-	
+
 	function post() {
-	
+
 		$address = trim($_REQUEST['address']);
-	
+
 		if(strpos($address,'@') === false) {
 			$arr = array('address' => $address);
-			call_hooks('reverse_magic_auth', $arr);		
-	
+			call_hooks('reverse_magic_auth', $arr);
+
 			// if they're still here...
-			notice( t('Authentication failed.') . EOL);		
+			notice( t('Authentication failed.') . EOL);
 			return;
 		}
 		else {
-	
+
 			// Presumed Red identity. Perform reverse magic auth
-	
+
 			if(strpos($address,'@') === false) {
 				notice('Invalid address.');
 				return;
 			}
-	
+
 			$r = null;
 			if($address) {
-				$r = q("select hubloc_url from hubloc where hubloc_addr = '%s'",
+				$r = q("select hubloc_url, hubloc_network from hubloc where hubloc_addr = '%s' and hubloc_deleted = 0",
 					dbesc($address)
-				);		
+				);
 				if(! $r) {
 					$w = discover_by_webbie($address);
 					if($w) {
-						$r = q("select hubloc_url from hubloc where hubloc_addr = '%s'",
+						$r = q("select hubloc_url, hubloc_network from hubloc where hubloc_addr = '%s' and hubloc_deleted = 0",
 							dbesc($address)
-						);		
+						);
 					}
 				}
 			}
@@ -76,20 +76,20 @@ class Rmagic extends \Zotlabs\Web\Controller {
 			}
 			else {
 				$url = 'https://' . substr($address,strpos($address,'@')+1);
-			}	
-	
-			if($url) {	
-				if($_SESSION['return_url']) 
+			}
+
+			if($url) {
+				if($_SESSION['return_url'])
 					$dest = bin2hex(z_root() . '/' . str_replace('zid=','zid_=',$_SESSION['return_url']));
 				else
 					$dest = bin2hex(z_root() . '/' . str_replace([ 'rmagic', 'zid=' ] ,[ '', 'zid_='],\App::$query_string));
-	
+
 				goaway($url . '/magic' . '?f=&owa=1&bdest=' . $dest);
 			}
 		}
 	}
-	
-	
+
+
 	function get() {
 		return replace_macros(get_markup_template('rmagic.tpl'),
 			[
@@ -97,6 +97,6 @@ class Rmagic extends \Zotlabs\Web\Controller {
 				'$address' => [ 'address', t('Enter your channel address (e.g. channel@example.com)'), '', '' ],
 				'$submit'  => t('Authenticate')
 			]
-		);	
+		);
 	}
 }
diff --git a/Zotlabs/Module/Search.php b/Zotlabs/Module/Search.php
index efea7bbdd..da4752186 100644
--- a/Zotlabs/Module/Search.php
+++ b/Zotlabs/Module/Search.php
@@ -59,15 +59,18 @@ class Search extends Controller {
 		$o .= search($search, 'search-box', '/search', ((local_channel()) ? true : false));
 
 		if (local_channel() && strpos($search, 'https://') === 0 && !$update && !$load) {
-			if (strpos($search, 'b64.') !== false) {
-				if (strpos($search, '?') !== false) {
-					$search = strtok($search, '?');
+
+			$url = htmlspecialchars_decode($search);
+
+			if (strpos($url, 'b64.') !== false) {
+				if (strpos($url, '?') !== false) {
+					$url = strtok($url, '?');
 				}
 
-				$search = unpack_link_id(basename($search));
+				$url = unpack_link_id(basename($url));
 			}
 
-			$f = Libzot::fetch_conversation(App::get_channel(), punify($search), true);
+			$f = Libzot::fetch_conversation(App::get_channel(), punify($url), true);
 
 			if ($f) {
 				$mid = $f[0]['message_id'];
@@ -83,7 +86,7 @@ class Search extends Controller {
 			else {
 				// try other fetch providers (e.g. diaspora, pubcrawl)
 				$hookdata = [
-					'url' => punify($search)
+					'url' => punify($url)
 				];
 				call_hooks('fetch_provider', $hookdata);
 			}
diff --git a/Zotlabs/Module/Siteinfo.php b/Zotlabs/Module/Siteinfo.php
index a8c5bda91..be6862c6b 100644
--- a/Zotlabs/Module/Siteinfo.php
+++ b/Zotlabs/Module/Siteinfo.php
@@ -10,14 +10,14 @@ class Siteinfo extends \Zotlabs\Web\Controller {
 			json_return_and_die($data);
 		}
 	}
-		
+
 	function get() {
 
 		$federated = [];
 		call_hooks('federated_transports',$federated);
-	
+
 		$siteinfo = replace_macros(get_markup_template('siteinfo.tpl'),
-			[ 
+			[
 				'$title' => t('About this site'),
 				'$sitenametxt' => t('Site Name'),
 				'$sitename' => \Zotlabs\Lib\System::get_site_name(),
@@ -29,7 +29,7 @@ class Siteinfo extends \Zotlabs\Web\Controller {
 				'$prj_header' => t('Software and Project information'),
 				'$prj_name' => t('This site is powered by $Projectname'),
 				'$prj_transport' => t('Federated and decentralised networking and identity services provided by Zot'),
-				'$transport_link' => '<a href="https://zotlabs.com">https://zotlabs.com</a>',
+				'$transport_link' => '<a href="https://zotlabs.org">https://zotlabs.org</a>',
 
 				'$additional_text' => t('Additional federated transport protocols:'),
 				'$additional_fed' => implode(', ', $federated),
@@ -41,11 +41,11 @@ class Siteinfo extends \Zotlabs\Web\Controller {
 			]
 		);
 
-		call_hooks('about_hook', $siteinfo); 	
+		call_hooks('about_hook', $siteinfo);
 
 		return $siteinfo;
 
 	}
 
-	
+
 }
diff --git a/Zotlabs/Module/Sse_bs.php b/Zotlabs/Module/Sse_bs.php
index ad9be0938..3a4e4e09e 100644
--- a/Zotlabs/Module/Sse_bs.php
+++ b/Zotlabs/Module/Sse_bs.php
@@ -41,7 +41,7 @@ class Sse_bs extends Controller {
 		self::$offset = 0;
 		self::$xchans = '';
 
-		if($_REQUEST['sse_rmids'])
+		if(isset($_REQUEST['sse_rmids']))
 			self::mark_read($_REQUEST['sse_rmids']);
 
 		if(!empty($_REQUEST['nquery']) && $_REQUEST['nquery'] !== '%') {
@@ -580,12 +580,12 @@ class Sse_bs extends Controller {
 
 					$forums[$x]['notify_link'] = z_root() . '/network/?f=&pf=1&unseen=1&cid=' . $forums[$x]['abook_id'];
 					$forums[$x]['name'] = $forums[$x]['xchan_name'];
-					$forums[$x]['addr'] = $forums[$x]['xchan_addr'];
+					$forums[$x]['addr'] = $forums[$x]['xchan_addr'] ?? $forums[$x]['xchan_url'];
 					$forums[$x]['url'] = $forums[$x]['xchan_url'];
 					$forums[$x]['photo'] = $forums[$x]['xchan_photo_s'];
 					$forums[$x]['unseen'] = count($b64mids);
-					$forums[$x]['private_forum'] = (($forums[$x]['private_forum']) ? 'lock' : '');
-					$forums[$x]['message'] = (($forums[$x]['private_forum']) ? t('Private forum') : t('Public forum'));
+					$forums[$x]['private_forum'] = ((isset($forums[$x]['private_forum']) && $forums[$x]['private_forum']) ? 'lock' : '');
+					$forums[$x]['message'] = ((isset($forums[$x]['private_forum']) && $forums[$x]['private_forum']) ? t('Private forum') : t('Public forum'));
 					$forums[$x]['mids'] = json_encode($b64mids);
 
 					unset($forums[$x]['abook_id']);
diff --git a/Zotlabs/Module/Wfinger.php b/Zotlabs/Module/Wfinger.php
index 6d0e78587..048fcde3f 100644
--- a/Zotlabs/Module/Wfinger.php
+++ b/Zotlabs/Module/Wfinger.php
@@ -21,7 +21,7 @@ class Wfinger extends \Zotlabs\Web\Controller {
 		elseif(x($_SERVER,'HTTP_X_FORWARDED_PROTO') && ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https'))
 			$scheme = 'https';
 
-		$zot = intval($_REQUEST['zot']);
+		$zot = $_REQUEST['zot'] ?? '';
 
 		if(($scheme !== 'https') && (! $zot)) {
 			header($_SERVER["SERVER_PROTOCOL"] . ' ' . 500 . ' ' . 'Webfinger requires HTTPS');
diff --git a/Zotlabs/Photo/PhotoDriver.php b/Zotlabs/Photo/PhotoDriver.php
index f50ef17ae..fc34f87a9 100644
--- a/Zotlabs/Photo/PhotoDriver.php
+++ b/Zotlabs/Photo/PhotoDriver.php
@@ -421,30 +421,30 @@ abstract class PhotoDriver {
 
 		$p = [];
 
-		$p['aid'] = ((intval($arr['aid'])) ? intval($arr['aid']) : 0);
-		$p['uid'] = ((intval($arr['uid'])) ? intval($arr['uid']) : 0);
-		$p['xchan'] = (($arr['xchan']) ? $arr['xchan'] : '');
-		$p['resource_id'] = (($arr['resource_id']) ? $arr['resource_id'] : '');
-		$p['filename'] = (($arr['filename']) ? $arr['filename'] : '');
-		$p['mimetype'] = (($arr['mimetype']) ? $arr['mimetype'] : $this->getType());
-		$p['album'] = (($arr['album']) ? $arr['album'] : '');
-		$p['imgscale'] = ((intval($arr['imgscale'])) ? intval($arr['imgscale']) : 0);
-		$p['allow_cid'] = (($arr['allow_cid']) ? $arr['allow_cid'] : '');
-		$p['allow_gid'] = (($arr['allow_gid']) ? $arr['allow_gid'] : '');
-		$p['deny_cid'] = (($arr['deny_cid']) ? $arr['deny_cid'] : '');
-		$p['deny_gid'] = (($arr['deny_gid']) ? $arr['deny_gid'] : '');
-		$p['edited'] = (($arr['edited']) ? $arr['edited'] : datetime_convert());
-		$p['title'] = (($arr['title']) ? $arr['title'] : '');
-		$p['description'] = (($arr['description']) ? $arr['description'] : '');
-		$p['photo_usage'] = intval($arr['photo_usage']);
-		$p['os_storage'] = intval($arr['os_storage']);
-		$p['os_path'] = $arr['os_path'];
-		$p['os_syspath'] = ((array_key_exists('os_syspath', $arr)) ? $arr['os_syspath'] : '');
-		$p['display_path'] = (($arr['display_path']) ? $arr['display_path'] : '');
-		$p['width'] = (($arr['width']) ? $arr['width'] : $this->getWidth());
-		$p['height'] = (($arr['height']) ? $arr['height'] : $this->getHeight());
-		$p['expires'] = (($arr['expires']) ? $arr['expires'] : gmdate('Y-m-d H:i:s', time() + get_config('system', 'photo_cache_time', 86400)));
-		$p['profile'] = ((array_key_exists('profile', $arr)) ? intval($arr['profile']) : 0);
+		$p['aid'] = $arr['aid'] ?? 0;
+		$p['uid'] = $arr['uid'] ?? 0;
+		$p['xchan'] = $arr['xchan'] ?? '';
+		$p['resource_id'] = $arr['resource_id'] ?? '';
+		$p['filename'] = $arr['filename'] ?? '';
+		$p['mimetype'] = $arr['mimetype'] ?? $this->getType();
+		$p['album'] = $arr['album'] ?? '';
+		$p['imgscale'] = $arr['imgscale'] ?? 0;
+		$p['allow_cid'] = $arr['allow_cid'] ?? '';
+		$p['allow_gid'] = $arr['allow_gid'] ?? '';
+		$p['deny_cid'] = $arr['deny_cid'] ?? '';
+		$p['deny_gid'] = $arr['deny_gid'] ?? '';
+		$p['edited'] = $arr['edited'] ?? datetime_convert();
+		$p['title'] = $arr['title'] ?? '';
+		$p['description'] = $arr['description'] ?? '';
+		$p['photo_usage'] = $arr['photo_usage'] ?? PHOTO_NORMAL;
+		$p['os_storage'] = $arr['os_storage'] ?? 1;
+		$p['os_path'] = $arr['os_path'] ?? '';
+		$p['os_syspath'] = $arr['os_syspath'] ?? '';
+		$p['display_path'] = $arr['display_path'] ?? '';
+		$p['width'] = $arr['width'] ?? $this->getWidth();
+		$p['height'] = $arr['height'] ?? $this->getHeight();
+		$p['expires'] = $arr['expires'] ?? gmdate('Y-m-d H:i:s', time() + get_config('system', 'photo_cache_time', 86400));
+		$p['profile'] = $arr['profile'] ?? 0;
 
 		if(! intval($p['imgscale']))
 			logger('save: ' . print_r($arr, true), LOGGER_DATA);
@@ -452,7 +452,7 @@ abstract class PhotoDriver {
 		$x = q("select id, created from photo where resource_id = '%s' and uid = %d and xchan = '%s' and imgscale = %d limit 1", dbesc($p['resource_id']), intval($p['uid']), dbesc($p['xchan']), intval($p['imgscale']));
 
 		if($x) {
-			$p['created'] = (($x['created']) ? $x['created'] : $p['edited']);
+			$p['created'] = $x['created'] ?? $p['edited'];
 			$r = q("UPDATE photo set
 				aid = %d,
 				uid = %d,
@@ -483,7 +483,7 @@ abstract class PhotoDriver {
 				where id = %d",
 			intval($p['aid']), intval($p['uid']), dbesc($p['xchan']), dbesc($p['resource_id']), dbescdate($p['created']), dbescdate($p['edited']), dbesc(basename($p['filename'])), dbesc($p['mimetype']), dbesc($p['album']), intval($p['height']), intval($p['width']), (intval($p['os_storage']) ? dbescbin($p['os_syspath']) : dbescbin($this->imageString())), intval($p['os_storage']), (intval($p['os_storage']) ? @filesize($p['os_syspath']) : strlen($this->imageString())), intval($p['imgscale']), intval($p['photo_usage']), dbesc($p['title']), dbesc($p['description']), dbesc($p['os_path']), dbesc($p['display_path']), dbesc($p['allow_cid']), dbesc($p['allow_gid']), dbesc($p['deny_cid']), dbesc($p['deny_gid']), dbescdate($p['expires']), intval($p['profile']), intval($x[0]['id']));
 		} else {
-			$p['created'] = (($arr['created']) ? $arr['created'] : $p['edited']);
+			$p['created'] = $arr['created'] ?? $p['edited'];
 			$r = q("INSERT INTO photo
 				( aid, uid, xchan, resource_id, created, edited, filename, mimetype, album, height, width, content, os_storage, filesize, imgscale, photo_usage, title, description, os_path, display_path, allow_cid, allow_gid, deny_cid, deny_gid, expires, profile )
 				VALUES ( %d, %d, '%s', '%s', '%s', '%s', '%s', '%s', '%s', %d, %d, '%s', %d, %d, %d, %d, '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', %d)", intval($p['aid']), intval($p['uid']), dbesc($p['xchan']), dbesc($p['resource_id']), dbescdate($p['created']), dbescdate($p['edited']), dbesc(basename($p['filename'])), dbesc($p['mimetype']), dbesc($p['album']), intval($p['height']), intval($p['width']), (intval($p['os_storage']) ? dbescbin($p['os_syspath']) : dbescbin($this->imageString())), intval($p['os_storage']), (intval($p['os_storage']) ? @filesize($p['os_syspath']) : strlen($this->imageString())), intval($p['imgscale']), intval($p['photo_usage']), dbesc($p['title']), dbesc($p['description']), dbesc($p['os_path']), dbesc($p['display_path']), dbesc($p['allow_cid']), dbesc($p['allow_gid']), dbesc($p['deny_cid']), dbesc($p['deny_gid']), dbescdate($p['expires']), intval($p['profile']));
diff --git a/Zotlabs/Web/HTTPHeaders.php b/Zotlabs/Web/HTTPHeaders.php
index 4be51a8f3..902d637f7 100644
--- a/Zotlabs/Web/HTTPHeaders.php
+++ b/Zotlabs/Web/HTTPHeaders.php
@@ -20,7 +20,7 @@ class HTTPHeaders {
 					}
 				}
 				else {
-					if($this->in_progress['k']) {
+					if(isset($this->in_progress['k'])) {
 						$this->parsed[] = [ $this->in_progress['k'] => $this->in_progress['v'] ];
 						$this->in_progress = [];
 					}
@@ -30,7 +30,7 @@ class HTTPHeaders {
 				}
 
 			}
-			if($this->in_progress['k']) {
+			if(isset($this->in_progress['k'])) {
 				$this->parsed[] = [ $this->in_progress['k'] => $this->in_progress['v'] ];
 				$this->in_progress = [];
 			}
diff --git a/Zotlabs/Web/HTTPSig.php b/Zotlabs/Web/HTTPSig.php
index cb41c2b7d..35b8054e6 100644
--- a/Zotlabs/Web/HTTPSig.php
+++ b/Zotlabs/Web/HTTPSig.php
@@ -299,6 +299,7 @@ class HTTPSig {
 
 		// Check the local cache first, but remove any fragments like #main-key since these won't be present in our cached data
 		$url = ((strpos($id, '#')) ? substr($id, 0, strpos($id, '#')) : $id);
+		$best = [];
 
 		// $force is used to ignore the local cache and only use the remote data; for instance the cached key might be stale
 		if (!$force) {
@@ -374,6 +375,8 @@ class HTTPSig {
 
 	static function get_webfinger_key($id, $force = false) {
 
+		$best = [];
+
 		if (!$force) {
 			$x = q("select * from xchan left join hubloc on xchan_hash = hubloc_hash where hubloc_id_url = '%s' and hubloc_network in ('zot6', 'activitypub') order by hubloc_id desc",
 				dbesc($id)
@@ -420,6 +423,9 @@ class HTTPSig {
 	 */
 
 	static function get_zotfinger_key($id, $force = false) {
+
+		$best = [];
+
 		if (!$force) {
 			$x = q("select * from xchan left join hubloc on xchan_hash = hubloc_hash where hubloc_id_url = '%s' and hubloc_network = 'zot6' order by hubloc_id desc",
 				dbesc($id)
diff --git a/Zotlabs/Web/WebServer.php b/Zotlabs/Web/WebServer.php
index 70c6eb9b8..9fa5a7797 100644
--- a/Zotlabs/Web/WebServer.php
+++ b/Zotlabs/Web/WebServer.php
@@ -58,12 +58,13 @@ class WebServer {
 		if((x($_GET,'zid')) && (! \App::$install)) {
 			\App::$query_string = strip_zids(\App::$query_string);
 			if(! local_channel()) {
-				if ($_SESSION['my_address']!=$_GET['zid']) {
+				if (!isset($_SESSION['my_address']) || $_SESSION['my_address'] != $_GET['zid']) {
 					$_SESSION['my_address'] = $_GET['zid'];
 					$_SESSION['authenticated'] = 0;
 				}
-				if(! $_SESSION['authenticated'])
+				if(!$_SESSION['authenticated']) {
 					zid_init();
+				}
 			}
 		}
 
diff --git a/Zotlabs/Widget/Channel_activities.php b/Zotlabs/Widget/Channel_activities.php
index ab1db09ba..9acde591d 100644
--- a/Zotlabs/Widget/Channel_activities.php
+++ b/Zotlabs/Widget/Channel_activities.php
@@ -25,7 +25,7 @@ class Channel_activities {
 		self::$uid = local_channel();
 		self::$channel = App::get_channel();
 
-		$o .= '<div id="channel-activities" class="d-none overflow-hidden">';
+		$o = '<div id="channel-activities" class="d-none overflow-hidden">';
 		$o .= '<h2 class="mb-4">Welcome ' . self::$channel['channel_name'] . '!</h2>';
 		//$o .= 'Last login date: ' . get_pconfig(self::$uid, 'system', 'stored_login_date') . ' from ' . get_pconfig(self::$uid, 'system', 'stored_login_addr');
 
@@ -44,6 +44,7 @@ class Channel_activities {
 
 		if (!$hookdata['activities']) {
 			$o .= '<h3>No recent activity to display</h3>';
+			$o .= '</div>';
 			return $o;
 		}
 
@@ -51,8 +52,6 @@ class Channel_activities {
 
 		array_multisort($keys, SORT_DESC, $hookdata['activities']);
 
-	//	hz_syslog('activities: ' . print_r($hookdata['activities'], true));
-
 		foreach($hookdata['activities'] as $a) {
 			$o .= replace_macros(get_markup_template($a['tpl']), [
 				'$url' => $a['url'],
diff --git a/Zotlabs/Widget/Cover_photo.php b/Zotlabs/Widget/Cover_photo.php
index 11d9c4715..8d42becb5 100644
--- a/Zotlabs/Widget/Cover_photo.php
+++ b/Zotlabs/Widget/Cover_photo.php
@@ -34,7 +34,10 @@ class Cover_photo {
 		if(! array_key_exists('channels_visited',$_SESSION)) {
 			$_SESSION['channels_visited'] = [];
 		}
-		$_SESSION['channels_visited'][] = $channel_id;
+
+		if (!in_array($channel_id, $_SESSION['channels_visited'])) {
+			$_SESSION['channels_visited'][] = $channel_id;
+		}
 
 		$channel = channelx_by_n($channel_id);
 
diff --git a/Zotlabs/Widget/Messages.php b/Zotlabs/Widget/Messages.php
index 3d9ed8955..c92b9e311 100644
--- a/Zotlabs/Widget/Messages.php
+++ b/Zotlabs/Widget/Messages.php
@@ -45,11 +45,14 @@ class Messages {
 		if (!local_channel())
 			return;
 
-		if (isset($options['offset']) && $options['offset'] == -1) {
+		$offset = $options['offset'] ?? 0;
+		$type = $options['type'] ?? 'default';
+
+		if ($offset == -1) {
 			return;
 		}
 
-		if (isset($options['type']) && $options['type'] == 'notification') {
+		if ($type == 'notification') {
 			return self::get_notices_page($options);
 		}
 
@@ -58,15 +61,9 @@ class Messages {
 		$entries = [];
 		$limit = 30;
 		$dummy_order_sql = '';
-
-		$offset = 0;
-		if ($options['offset']) {
-			$offset = intval($options['offset']);
-		}
-
 		$loadtime = (($offset) ? $_SESSION['messages_loadtime'] : datetime_convert());
 
-		switch($options['type']) {
+		switch($type) {
 			case 'direct':
 				$type_sql = ' AND item_private = 2 ';
 				// $dummy_order_sql has no other meaning but to trick
@@ -98,8 +95,21 @@ class Messages {
 
 		foreach($items as $item) {
 
+			$hook_data = [
+				'uid' => $item['uid'],
+				'owner_xchan' => $item['owner_xchan'],
+				'author_xchan' => $item['author_xchan'],
+				'cancel' => false
+			];
+
+			call_hooks('messages_widget', $hook_data);
+
+			if ($hook_data['cancel']) {
+				continue;
+			}
+
 			$info = '';
-			if ($options['type'] == 'direct') {
+			if ($type == 'direct') {
 				$info .= self::get_dm_recipients($channel, $item);
 			}
 
diff --git a/Zotlabs/Widget/Notifications.php b/Zotlabs/Widget/Notifications.php
index 0e02d5cc1..a4e632a9f 100644
--- a/Zotlabs/Widget/Notifications.php
+++ b/Zotlabs/Widget/Notifications.php
@@ -13,6 +13,7 @@ class Notifications {
 	function widget($arr) {
 
 		$channel = \App::get_channel();
+		$notifications = [];
 
 		if(local_channel()) {
 			$notifications[] = [