Merge branch 'master', remote-tracking branch 'remotes/upstream/master'

* remotes/upstream/master:
  turn registration code into a standalone function for re-use
  query using both `id` and `parent`
  prevent email from leaking in feeds
  y didn't i think of this b4?
  some zero theming on settings page
  missing delimiter
  transition to beta for private forums
  rev update
  Friendicaland - you can't 'live' on a demo server.
  Create a "potential default group" called "Friends" on registration.
  fix private photos that also have a size specification
  private group tests, cont.
  hide private group if desired
  prvgroup should see intros
  private group fix
  possible sql injection in search
  bugfixes: private photo embeds and search for strings with %

* master:

1 files changed, 12 insertions, 4 deletions

diff --git a/include/diaspora.php b/include/diaspora.php
index 3f2cdf8e4..f7c2c5e8e 100644
--- a/include/diaspora.php
+++ b/include/diaspora.php
@@ -2055,8 +2055,12 @@ function diaspora_send_followup($item,$owner,$contact,$public_batch = false) {
 	$myaddr = $owner['nickname'] . '@' .  substr($a->get_baseurl(), strpos($a->get_baseurl(),'://') + 3);
 	$theiraddr = $contact['addr'];
 
-	$p = q("select guid from item where parent = %d limit 1",
-		$item['parent']
+	// The first item in the `item` table with the parent id is the parent. However, MySQL doesn't always
+	// return the items ordered by `item`.`id`, in which case the wrong item is chosen as the parent.
+	// The only item with `parent` and `id` as the parent id is the parent item.
+	$p = q("select guid from item where parent = %d and id = %d limit 1",
+		intval($item['parent']),
+		intval($item['parent'])
 	);
 	if(count($p))
 		$parent_guid = $p[0]['guid'];
@@ -2111,8 +2115,12 @@ function diaspora_send_relay($item,$owner,$contact,$public_batch = false) {
 	$theiraddr = $contact['addr'];
 
 
-	$p = q("select guid from item where parent = %d limit 1",
-		$item['parent']
+	// The first item in the `item` table with the parent id is the parent. However, MySQL doesn't always
+	// return the items ordered by `item`.`id`, in which case the wrong item is chosen as the parent.
+	// The only item with `parent` and `id` as the parent id is the parent item.
+	$p = q("select guid from item where parent = %d and id = %d limit 1",
+		intval($item['parent']),
+		intval($item['parent'])
 	);
 	if(count($p))
 		$parent_guid = $p[0]['guid'];