Merge remote-tracking branch 'upstream/master'

15 files changed, 404 insertions, 121 deletions

diff --git a/mod/dirfind.php b/mod/dirfind.php
index 75b1c4976..34c54dd91 100755
--- a/mod/dirfind.php
+++ b/mod/dirfind.php
@@ -46,7 +46,7 @@ function dirfind_content(&$a) {
 			foreach($j->results as $jj) {
 				
 				$o .= replace_macros($tpl,array(
-					'$url' => $jj->url,
+					'$url' => zrl($jj->url),
 					'$name' => $jj->name,
 					'$photo' => $jj->photo,
 					'$tags' => $jj->tags
diff --git a/mod/filer.php b/mod/filer.php
index 82537848b..3cd1bfe22 100755
--- a/mod/filer.php
+++ b/mod/filer.php
@@ -11,8 +11,8 @@ function filer_content(&$a) {
 		killme();
 	}
 
-	$term = notags(trim($_GET['term']));
-	$item_id = (($a->argc > 1) ? notags(trim($a->argv[1])) : 0);
+	$term = unxmlify(trim($_GET['term']));
+	$item_id = (($a->argc > 1) ? intval($a->argv[1]) : 0);
 
 	logger('filer: tag ' . $term . ' item ' . $item_id);
 
@@ -25,7 +25,7 @@ function filer_content(&$a) {
 		$filetags = explode("][", trim($filetags,"[]"));
 		$tpl = get_markup_template("filer_dialog.tpl");
 		$o = replace_macros($tpl, array(
-			'$field' => array('term', t("File as:"), '', '', $filetags, t('- select -')),
+			'$field' => array('term', t("Save to Folder:"), '', '', $filetags, t('- select -')),
 			'$submit' => t('Save'),
 		));
 		
diff --git a/mod/filerm.php b/mod/filerm.php
index 66b684dc9..c520fec7a 100644
--- a/mod/filerm.php
+++ b/mod/filerm.php
@@ -6,8 +6,8 @@ function filerm_content(&$a) {
 		killme();
 	}
 
-	$term = notags(trim($_GET['term']));
-	$item_id = (($a->argc > 1) ? notags(trim($a->argv[1])) : 0);
+	$term = unxmlify(trim($_GET['term']));
+	$item_id = (($a->argc > 1) ? intval($a->argv[1]) : 0);
 
 	logger('filerm: tag ' . $term . ' item ' . $item_id);
 
diff --git a/mod/friendica.php b/mod/friendica.php
index d5dad9448..52a064224 100755
--- a/mod/friendica.php
+++ b/mod/friendica.php
@@ -4,8 +4,12 @@ function friendica_init(&$a) {
 	if ($a->argv[1]=="json"){
 		$register_policy = Array('REGISTER_CLOSED', 'REGISTER_APPROVE', 'REGISTER_OPEN');
 
+		$sql_extra = '';
+		if(x($a->config,'admin_nickname')) {
+			$sql_extra = sprintf(" AND nickname = '%s' ",dbesc($a->config['admin_nickname']));
+		}
 		if (isset($a->config['admin_email']) && $a->config['admin_email']!=''){
-			$r = q("SELECT username, nickname FROM user WHERE email='%s'", $a->config['admin_email']);
+			$r = q("SELECT username, nickname FROM user WHERE email='%s' $sql_extra", dbesc($a->config['admin_email']));
 			$admin = array(
 				'name' => $r[0]['username'],
 				'profile'=> $a->get_baseurl().'/profile/'.$r[0]['nickname'],
diff --git a/mod/match.php b/mod/match.php
index 1ae7848a6..926df1dff 100755
--- a/mod/match.php
+++ b/mod/match.php
@@ -51,7 +51,7 @@ function match_content(&$a) {
 				
 				$connlnk = $a->get_baseurl() . '/follow/?url=' . $jj->url;
 				$o .= replace_macros($tpl,array(
-					'$url' => $jj->url,
+					'$url' => zrl($jj->url),
 					'$name' => $jj->name,
 					'$photo' => $jj->photo,
 					'$inttxt' => ' ' . t('is interested in:'),
diff --git a/mod/message.php b/mod/message.php
index 949e5616c..1369fde2e 100755
--- a/mod/message.php
+++ b/mod/message.php
@@ -192,15 +192,12 @@ function message_content(&$a) {
 		return $o;
 	}
 
-	if(($a->argc == 1) || ($a->argc == 2 && $a->argv[1] === 'sent')) {
+	if($a->argc == 1) {
+
+		// list messages
 
 		$o .= $header;
 		
-		if($a->argc == 2)
-			$eq = sprintf( "AND `from-url` = '%s'", dbesc($myprofile)); 
-		else
-			$eq = '';
-
 		$r = q("SELECT count(*) AS `total` FROM `mail` 
 			WHERE `mail`.`uid` = %d AND `from-url` $eq '%s' GROUP BY `parent-uri` ORDER BY `created` DESC",
 			intval(local_user()),
@@ -213,7 +210,7 @@ function message_content(&$a) {
 			`mail`.* , `contact`.`name`, `contact`.`url`, `contact`.`thumb` , `contact`.`network`,
 			count( * ) as count
 			FROM `mail` LEFT JOIN `contact` ON `mail`.`contact-id` = `contact`.`id` 
-			WHERE `mail`.`uid` = %d  $eq GROUP BY `parent-uri` ORDER BY `mailcreated` DESC  LIMIT %d , %d ",
+			WHERE `mail`.`uid` = %d GROUP BY `parent-uri` ORDER BY `mailcreated` DESC  LIMIT %d , %d ",
 			intval(local_user()),
 			//
 			intval($a->pager['start']),
@@ -226,9 +223,13 @@ function message_content(&$a) {
 
 		$tpl = get_markup_template('mail_list.tpl');
 		foreach($r as $rr) {
-			if ($rr['from-url'] == $myprofile){
+			if($rr['unknown']) {
+				$partecipants = sprintf( t("Unknown sender - %s"),$rr['from-name']);
+			}
+			elseif (link_compare($rr['from-url'],$myprofile)){
 				$partecipants = sprintf( t("You and %s"), $rr['name']);
-			} else {
+			}
+			else {
 				$partecipants = sprintf( t("%s and You"), $rr['from-name']);
 			}
 			
@@ -237,7 +238,7 @@ function message_content(&$a) {
 				'$from_name' => $partecipants,
 				'$from_url' => (($rr['network'] === NETWORK_DFRN) ? $a->get_baseurl(true) . '/redir/' . $rr['contact-id'] : $rr['url']),
 				'$sparkle' => ' sparkle',
-				'$from_photo' => $rr['thumb'],
+				'$from_photo' => (($rr['thumb']) ? $rr['thumb'] : $rr['from-photo']),
 				'$subject' => template_escape((($rr['mailseen']) ? $rr['title'] : '<strong>' . $rr['title'] . '</strong>')),
 				'$delete' => t('Delete conversation'),
 				'$body' => template_escape($rr['body']),
@@ -300,7 +301,11 @@ function message_content(&$a) {
 
 		$mails = array();
 		$seen = 0;
+		$unknown = false;
+
 		foreach($messages as $message) {
+			if($message['unknown'])
+				$unknown = true;
 			if($message['from-url'] == $myprofile) {
 				$from_url = $myprofile;
 				$sparkle = '';
@@ -326,7 +331,7 @@ function message_content(&$a) {
 		}
 		$select = $message['name'] . '<input type="hidden" name="messageto" value="' . $contact_id . '" />';
 		$parent = '<input type="hidden" name="replyto" value="' . $message['parent-uri'] . '" />';
-		
+			
 
 		$tpl = get_markup_template('mail_display.tpl');
 		$o = replace_macros($tpl, array(
@@ -334,7 +339,8 @@ function message_content(&$a) {
 			'$thread_subject' => $message['title'],
 			'$thread_seen' => $seen,
 			'$delete' =>  t('Delete conversation'),
-			
+			'$canreply' => (($unknown) ? false : '1'),
+			'$unknown_text' => t("No secure communications available. You <strong>may</strong> be able to respond from the sender's profile page."),			
 			'$mails' => $mails,
 			
 			// reply
diff --git a/mod/network.php b/mod/network.php
index 5ca0a8c7d..d27945a86 100755
--- a/mod/network.php
+++ b/mod/network.php
@@ -393,7 +393,7 @@ function network_content(&$a, $update = 0) {
 		);
 	}
 	if(strlen($file)) {
-		$sql_extra .= file_tag_file_query('item',$file);
+		$sql_extra .= file_tag_file_query('item',unxmlify($file));
 	}
 
 	if($conv) {
diff --git a/mod/notifications.php b/mod/notifications.php
index ff131010f..690a99562 100755
--- a/mod/notifications.php
+++ b/mod/notifications.php
@@ -37,7 +37,11 @@ function notifications_post(&$a) {
 				intval($intro_id)
 			);	
 			if(! $fid) {
-				$r = q("DELETE FROM `contact` WHERE `id` = %d AND `uid` = %d AND `self` = 0 LIMIT 1", 
+
+				// The check for blocked and pending is in case the friendship was already approved
+				// and we just want to get rid of the now pointless notification
+
+				$r = q("DELETE FROM `contact` WHERE `id` = %d AND `uid` = %d AND `self` = 0 AND `blocked` = 1 AND `pending` = 1 LIMIT 1", 
 					intval($contact_id),
 					intval(local_user())
 				);
@@ -145,7 +149,7 @@ function notifications_content(&$a) {
 						'$contact_id' => $rr['contact-id'],
 						'$photo' => ((x($rr,'fphoto')) ? $rr['fphoto'] : "images/person-175.jpg"),
 						'$fullname' => $rr['fname'],
-						'$url' => $rr['furl'],
+						'$url' => zrl($rr['furl']),
 						'$hidden' => array('hidden', t('Hide this contact from others'), ($rr['hidden'] == 1), ''),
 						'$activity' => array('activity', t('Post a new friend activity'), 1, t('if applicable')),
 
@@ -195,7 +199,7 @@ function notifications_content(&$a) {
 					'$fullname' => $rr['name'],
 					'$hidden' => array('hidden', t('Hide this contact from others'), ($rr['hidden'] == 1), ''),
 					'$activity' => array('activity', t('Post a new friend activity'), 1, t('if applicable')),
-					'$url' => $rr['url'],
+					'$url' => zrl($rr['url']),
 					'$knowyou' => $knowyou,
 					'$approve' => t('Approve'),
 					'$note' => $rr['note'],
diff --git a/mod/register.php b/mod/register.php
index 6d0e2700b..630c0a675 100755
--- a/mod/register.php
+++ b/mod/register.php
@@ -8,6 +8,8 @@ function register_post(&$a) {
 	$verified = 0;
 	$blocked  = 1;
 
+	$arr = array('post' => $_POST);
+	call_hooks('register_post', $arr);
 
 	$max_dailies = intval(get_config('system','max_daily_registrations'));
 	if($max_dailes) {
@@ -218,8 +220,8 @@ function register_post(&$a) {
 	$spubkey = $spkey["key"];
 
 	$r = q("INSERT INTO `user` ( `guid`, `username`, `password`, `email`, `openid`, `nickname`,
-		`pubkey`, `prvkey`, `spubkey`, `sprvkey`, `register_date`, `verified`, `blocked` )
-		VALUES ( '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', %d, %d )",
+		`pubkey`, `prvkey`, `spubkey`, `sprvkey`, `register_date`, `verified`, `blocked`, `timezone` )
+		VALUES ( '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', %d, %d, 'UTC' )",
 		dbesc(generate_user_guid()),
 		dbesc($username),
 		dbesc($new_password_encoded),
@@ -540,6 +542,11 @@ function register_content(&$a) {
 	$license = '';
 
 	$o = get_markup_template("register.tpl");
+
+	$arr = array('template' => $o);
+
+	call_hooks('register_form',$arr);
+
 	$o = replace_macros($o, array(
 		'$oidhtml' => $oidhtml,
 		'$invitations' => get_config('system','invitation_only'),
diff --git a/mod/search.php b/mod/search.php
index 50e7a6abc..6495fc8e5 100755
--- a/mod/search.php
+++ b/mod/search.php
@@ -97,19 +97,16 @@ function search_content(&$a) {
 	// OR your own posts if you are a logged in member
 	// No items will be shown if the member has a blocked profile wall. 
 
-	$s_regx  = sprintf("AND ( `item`.`body` REGEXP '%s' OR `item`.`tag` REGEXP '%s' )", 
-		dbesc(preg_quote($search)), dbesc('\\]' . preg_quote($search) . '\\['));
-
-	$search_alg = $s_regx;
-
 	$r = q("SELECT COUNT(*) AS `total`
 		FROM `item` LEFT JOIN `contact` ON `contact`.`id` = `item`.`contact-id` LEFT JOIN `user` ON `user`.`uid` = `item`.`uid`
 		WHERE `item`.`visible` = 1 AND `item`.`deleted` = 0 and `item`.`moderated` = 0
 		AND (( `item`.`allow_cid` = ''  AND `item`.`allow_gid` = '' AND `item`.`deny_cid`  = '' AND `item`.`deny_gid`  = '' AND `item`.`private` = 0 AND `user`.`hidewall` = 0) 
 			OR `item`.`uid` = %d )
 		AND `contact`.`blocked` = 0 AND `contact`.`pending` = 0
-		$search_alg ",
-		intval(local_user())
+		AND ( `item`.`body` REGEXP '%s' OR `item`.`tag` REGEXP '%s' )", 
+		intval(local_user()),
+		dbesc(preg_quote($search)), 
+		dbesc('\\]' . preg_quote($search) . '\\[')
 	);
 
 	if(count($r))
@@ -131,9 +128,11 @@ function search_content(&$a) {
 		AND (( `item`.`allow_cid` = ''  AND `item`.`allow_gid` = '' AND `item`.`deny_cid`  = '' AND `item`.`deny_gid`  = '' AND `item`.`private` = 0 AND `user`.`hidewall` = 0 ) 
 			OR `item`.`uid` = %d )
 		AND `contact`.`blocked` = 0 AND `contact`.`pending` = 0
-		$search_alg
+		AND ( `item`.`body` REGEXP '%s' OR `item`.`tag` REGEXP '%s' ) 
 		ORDER BY `received` DESC LIMIT %d , %d ",
 		intval(local_user()),
+		dbesc(preg_quote($search)), 
+		dbesc('\\]' . preg_quote($search) . '\\['),
 		intval($a->pager['start']),
 		intval($a->pager['itemspage'])
 
diff --git a/mod/settings.php b/mod/settings.php
index db7330fb5..926d1faa5 100755
--- a/mod/settings.php
+++ b/mod/settings.php
@@ -1,6 +1,19 @@
 <?php
 
 
+function get_theme_config_file($theme){
+	$a = get_app();
+	$base_theme = $a->theme_info['extends'];
+	
+	if (file_exists("view/theme/$theme/config.php")){
+		return "view/theme/$theme/config.php";
+	} 
+	if (file_exists("view/theme/$base_theme/config.php")){
+		return "view/theme/$base_theme/config.php";
+	}
+	return null;
+}
+
 function settings_init(&$a) {
 	if(local_user()) {
 		profile_load($a,$a->user['nickname']);
@@ -193,6 +206,45 @@ function settings_post(&$a) {
 		call_hooks('connector_settings_post', $_POST);
 		return;
 	}
+	
+	if(($a->argc > 1) && ($a->argv[1] == 'display')) {
+		
+		check_form_security_token_redirectOnErr('/settings/display', 'settings_display');
+
+		$theme = ((x($_POST,'theme')) ? notags(trim($_POST['theme']))  : $a->user['theme']);
+		$nosmile = ((x($_POST,'nosmile')) ? intval($_POST['nosmile'])  : 0);  
+		$browser_update   = ((x($_POST,'browser_update')) ? intval($_POST['browser_update']) : 0);
+		$browser_update   = $browser_update * 1000;
+		if($browser_update < 10000)
+			$browser_update = 40000;
+
+		$itemspage_network   = ((x($_POST,'itemspage_network')) ? intval($_POST['itemspage_network']) : 40);
+		if($itemspage_network > 100)
+					$itemspage_network = 40;
+
+
+		set_pconfig(local_user(),'system','update_interval', $browser_update);
+		set_pconfig(local_user(),'system','itemspage_network', $itemspage_network);
+		set_pconfig(local_user(),'system','no_smilies',$nosmile);
+
+
+		if ($theme == $a->user['theme']){
+			// call theme_post only if theme has not benn changed
+			if( ($themeconfigfile = get_theme_config_file($theme)) != null){
+				require_once($themeconfigfile);
+				theme_post($a);
+			}
+		}
+
+
+		$r = q("UPDATE `user` SET `theme` = '%s' WHERE `uid` = %d LIMIT 1",
+				dbesc($theme),
+				intval(local_user())
+		);
+	
+		goaway($a->get_baseurl(true) . '/settings/display' );
+		return; // NOTREACHED
+	}
 
 	check_form_security_token_redirectOnErr('/settings', 'settings');
 	
@@ -227,7 +279,7 @@ function settings_post(&$a) {
 		}
 	}
 
-	$theme            = ((x($_POST,'theme'))      ? notags(trim($_POST['theme']))        : $a->user['theme']);
+	
 	$username         = ((x($_POST,'username'))   ? notags(trim($_POST['username']))     : '');
 	$email            = ((x($_POST,'email'))      ? notags(trim($_POST['email']))        : '');
 	$timezone         = ((x($_POST,'timezone'))   ? notags(trim($_POST['timezone']))     : '');
@@ -242,14 +294,6 @@ function settings_post(&$a) {
 	$expire_starred   = ((x($_POST,'expire_starred')) ? intval($_POST['expire_starred']) : 0);
 	$expire_photos    = ((x($_POST,'expire_photos'))? intval($_POST['expire_photos'])	 : 0);
 
-	$browser_update   = ((x($_POST,'browser_update')) ? intval($_POST['browser_update']) : 0);
-	$browser_update   = $browser_update * 1000;
-	if($browser_update < 10000)
-		$browser_update = 40000;
-
-	$itemspage_network   = ((x($_POST,'itemspage_network')) ? intval($_POST['itemspage_network']) : 40);
-	if($itemspage_network > 100)
-                $itemspage_network = 40;
 
 
 	$allow_location   = (((x($_POST,'allow_location')) && (intval($_POST['allow_location']) == 1)) ? 1: 0);
@@ -259,11 +303,12 @@ function settings_post(&$a) {
 	$page_flags       = (((x($_POST,'page-flags')) && (intval($_POST['page-flags']))) ? intval($_POST['page-flags']) : 0);
 	$blockwall        = (((x($_POST,'blockwall')) && (intval($_POST['blockwall']) == 1)) ? 0: 1); // this setting is inverted!
 	$blocktags        = (((x($_POST,'blocktags')) && (intval($_POST['blocktags']) == 1)) ? 0: 1); // this setting is inverted!
-
+	$unkmail          = (((x($_POST,'unkmail')) && (intval($_POST['unkmail']) == 1)) ? 1: 0);
+	$cntunkmail       = ((x($_POST,'cntunkmail')) ? intval($_POST['cntunkmail']) : 0);
 	$suggestme        = ((x($_POST,'suggestme')) ? intval($_POST['suggestme'])  : 0);  
 	$hide_friends     = (($_POST['hide-friends'] == 1) ? 1: 0);
 	$hidewall         = (($_POST['hidewall'] == 1) ? 1: 0);
-	$nosmile          = ((x($_POST,'nosmile')) ? intval($_POST['nosmile'])  : 0);  
+
 
 	$notify = 0;
 
@@ -345,11 +390,9 @@ function settings_post(&$a) {
 	set_pconfig(local_user(),'expire','photos', $expire_photos);
 
 	set_pconfig(local_user(),'system','suggestme', $suggestme);
-	set_pconfig(local_user(),'system','update_interval', $browser_update);
-	set_pconfig(local_user(),'system','itemspage_network', $itemspage_network);
-	set_pconfig(local_user(),'system','no_smilies',$nosmile);
 
-	$r = q("UPDATE `user` SET `username` = '%s', `email` = '%s', `openid` = '%s', `timezone` = '%s',  `allow_cid` = '%s', `allow_gid` = '%s', `deny_cid` = '%s', `deny_gid` = '%s', `notify-flags` = %d, `page-flags` = %d, `default-location` = '%s', `allow_location` = %d, `theme` = '%s', `maxreq` = %d, `expire` = %d, `openidserver` = '%s', `blockwall` = %d, `hidewall` = %d, `blocktags` = %d  WHERE `uid` = %d LIMIT 1",
+
+	$r = q("UPDATE `user` SET `username` = '%s', `email` = '%s', `openid` = '%s', `timezone` = '%s',  `allow_cid` = '%s', `allow_gid` = '%s', `deny_cid` = '%s', `deny_gid` = '%s', `notify-flags` = %d, `page-flags` = %d, `default-location` = '%s', `allow_location` = %d, `maxreq` = %d, `expire` = %d, `openidserver` = '%s', `blockwall` = %d, `hidewall` = %d, `blocktags` = %d, `unkmail` = %d, `cntunkmail` = %d  WHERE `uid` = %d LIMIT 1",
 			dbesc($username),
 			dbesc($email),
 			dbesc($openid),
@@ -362,13 +405,14 @@ function settings_post(&$a) {
 			intval($page_flags),
 			dbesc($defloc),
 			intval($allow_location),
-			dbesc($theme),
 			intval($maxreq),
 			intval($expire),
 			dbesc($openidserver),
 			intval($blockwall),
 			intval($hidewall),
 			intval($blocktags),
+			intval($unkmail),
+			intval($cntunkmail),
 			intval(local_user())
 	);
 	if($r)
@@ -441,6 +485,12 @@ function settings_content(&$a) {
 			'sel'	=> (($a->argc == 1)?'active':''),
 		),	
 		array(
+			'label'	=> t('Display settings'),
+			'url' 	=> $a->get_baseurl(true).'/settings/display',
+			'sel'	=> (($a->argc > 1) && ($a->argv[1] === 'display')?'active':''),
+		),	
+		
+		array(
 			'label'	=> t('Connector settings'),
 			'url' 	=> $a->get_baseurl(true).'/settings/connectors',
 			'sel'	=> (($a->argc > 1) && ($a->argv[1] === 'connectors')?'active':''),
@@ -578,31 +628,31 @@ function settings_content(&$a) {
 		$diasp_enabled = sprintf( t('Built-in support for %s connectivity is %s'), t('Diaspora'), ((get_config('system','diaspora_enabled')) ? t('enabled') : t('disabled')));
 		$ostat_enabled = sprintf( t('Built-in support for %s connectivity is %s'), t('StatusNet'), ((get_config('system','ostatus_disabled')) ? t('disabled') : t('enabled')));
 
-	$mail_disabled = ((function_exists('imap_open') && (! get_config('system','imap_disabled'))) ? 0 : 1);
-	if(get_config('system','dfrn_only'))
-		$mail_disabled = 1;
+		$mail_disabled = ((function_exists('imap_open') && (! get_config('system','imap_disabled'))) ? 0 : 1);
+		if(get_config('system','dfrn_only'))
+			$mail_disabled = 1;
 
-	if(! $mail_disabled) {
-		$r = q("SELECT * FROM `mailacct` WHERE `uid` = %d LIMIT 1",
-			local_user()
-		);
-	}
-	else {
-		$r = null;
-	}
+		if(! $mail_disabled) {
+			$r = q("SELECT * FROM `mailacct` WHERE `uid` = %d LIMIT 1",
+				local_user()
+			);
+		}
+		else {
+			$r = null;
+		}
 
-	$mail_server       = ((count($r)) ? $r[0]['server'] : '');
-	$mail_port         = ((count($r) && intval($r[0]['port'])) ? intval($r[0]['port']) : '');
-	$mail_ssl          = ((count($r)) ? $r[0]['ssltype'] : '');
-	$mail_user         = ((count($r)) ? $r[0]['user'] : '');
-	$mail_replyto      = ((count($r)) ? $r[0]['reply_to'] : '');
-	$mail_pubmail      = ((count($r)) ? $r[0]['pubmail'] : 0);
-	$mail_action       = ((count($r)) ? $r[0]['action'] : 0);
-	$mail_movetofolder = ((count($r)) ? $r[0]['movetofolder'] : '');
-	$mail_chk          = ((count($r)) ? $r[0]['last_check'] : '0000-00-00 00:00:00');
+		$mail_server       = ((count($r)) ? $r[0]['server'] : '');
+		$mail_port         = ((count($r) && intval($r[0]['port'])) ? intval($r[0]['port']) : '');
+		$mail_ssl          = ((count($r)) ? $r[0]['ssltype'] : '');
+		$mail_user         = ((count($r)) ? $r[0]['user'] : '');
+		$mail_replyto      = ((count($r)) ? $r[0]['reply_to'] : '');
+		$mail_pubmail      = ((count($r)) ? $r[0]['pubmail'] : 0);
+		$mail_action       = ((count($r)) ? $r[0]['action'] : 0);
+		$mail_movetofolder = ((count($r)) ? $r[0]['movetofolder'] : '');
+		$mail_chk          = ((count($r)) ? $r[0]['last_check'] : '0000-00-00 00:00:00');
 
 
-	$tpl = get_markup_template("settings_connectors.tpl");
+		$tpl = get_markup_template("settings_connectors.tpl");
 		$o .= replace_macros($tpl, array(
 			'$form_security_token' => get_form_security_token("settings_connectors"),
 			
@@ -632,6 +682,78 @@ function settings_content(&$a) {
 		return $o;
 	}
 
+	/*
+	 * DISPLAY SETTINGS
+	 */
+	if(($a->argc > 1) && ($a->argv[1] === 'display')) {
+		$default_theme = get_config('system','theme');
+		if(! $default_theme)
+			$default_theme = 'default';
+
+		$allowed_themes_str = get_config('system','allowed_themes');
+		$allowed_themes_raw = explode(',',$allowed_themes_str);
+		$allowed_themes = array();
+		if(count($allowed_themes_raw))
+			foreach($allowed_themes_raw as $x)
+				if(strlen(trim($x)))
+					$allowed_themes[] = trim($x);
+
+		
+		$themes = array();
+		$files = glob('view/theme/*');
+		if($allowed_themes) {
+			foreach($allowed_themes as $th) {
+				$f = $th;
+				$is_experimental = file_exists('view/theme/' . $th . '/experimental');
+				$unsupported = file_exists('view/theme/' . $th . '/unsupported');
+				if (!$is_experimental or ($is_experimental && (get_config('experimentals','exp_themes')==1 or get_config('experimentals','exp_themes')===false))){ 
+					$theme_name = (($is_experimental) ?  sprintf("%s - \x28Experimental\x29", $f) : $f);
+					$themes[$f]=$theme_name;
+				}
+			}
+		}
+		$theme_selected = (!x($_SESSION,'theme')? $default_theme : $_SESSION['theme']);
+		
+		$browser_update = intval(get_pconfig(local_user(), 'system','update_interval'));
+		$browser_update = (($browser_update == 0) ? 40 : $browser_update / 1000); // default if not set: 40 seconds
+
+		$itemspage_network = intval(get_pconfig(local_user(), 'system','itemspage_network'));
+		$itemspage_network = (($itemspage_network > 0 && $itemspage_network < 101) ? $itemspage_network : 40); // default if not set: 40 items
+		
+		$nosmile = get_pconfig(local_user(),'system','no_smilies');
+		$nosmile = (($nosmile===false)? '0': $nosmile); // default if not set: 0
+
+
+		$theme_config = "";
+		if( ($themeconfigfile = get_theme_config_file($theme_selected)) != null){
+			require_once($themeconfigfile);
+			$theme_config = theme_content($a);
+		}
+		
+		$tpl = get_markup_template("settings_display.tpl");
+		$o = replace_macros($tpl, array(
+			'$tabs' 	=> $tabs,
+			'$ptitle' 	=> t('Display Settings'),
+			'$form_security_token' => get_form_security_token("settings_display"),
+			'$submit' 	=> t('Submit'),
+			'$baseurl' => $a->get_baseurl(true),
+			'$uid' => local_user(),
+		
+			'$theme'	=> array('theme', t('Display Theme:'), $theme_selected, '', $themes),
+			'$ajaxint'   => array('browser_update',  t("Update browser every xx seconds"), $browser_update, t('Minimum of 10 seconds, no maximum')),
+			'$itemspage_network'   => array('itemspage_network',  t("Number of items to display on the network page:"), $itemspage_network, t('Maximum of 100 items')),
+			'$nosmile'	=> array('nosmile', t("Don't show emoticons"), $nosmile, ''),
+			
+			'$theme_config' => $theme_config,
+		));
+		
+		return $o;
+	}
+	
+	
+	/*
+	 * ACCOUNT SETTINGS
+	 */
 
 	require_once('include/acl_selectors.php');
 
@@ -641,17 +763,19 @@ function settings_content(&$a) {
 	if(count($p))
 		$profile = $p[0];
 
-	$username = $a->user['username'];
-	$email    = $a->user['email'];
-	$nickname = $a->user['nickname'];
-	$timezone = $a->user['timezone'];
-	$notify   = $a->user['notify-flags'];
-	$defloc   = $a->user['default-location'];
-	$openid   = $a->user['openid'];
-	$maxreq   = $a->user['maxreq'];
-	$expire   = ((intval($a->user['expire'])) ? $a->user['expire'] : '');
-	$blockwall = $a->user['blockwall'];
-	$blocktags = $a->user['blocktags'];
+	$username   = $a->user['username'];
+	$email      = $a->user['email'];
+	$nickname   = $a->user['nickname'];
+	$timezone   = $a->user['timezone'];
+	$notify     = $a->user['notify-flags'];
+	$defloc     = $a->user['default-location'];
+	$openid     = $a->user['openid'];
+	$maxreq     = $a->user['maxreq'];
+	$expire     = ((intval($a->user['expire'])) ? $a->user['expire'] : '');
+	$blockwall  = $a->user['blockwall'];
+	$blocktags  = $a->user['blocktags'];
+	$unkmail    = $a->user['unkmail'];
+	$cntunkmail = $a->user['cntunkmail'];
 
 	$expire_items = get_pconfig(local_user(), 'expire','items');
 	$expire_items = (($expire_items===false)? '1' : $expire_items); // default if not set: 1
@@ -669,14 +793,7 @@ function settings_content(&$a) {
 	$suggestme = get_pconfig(local_user(), 'system','suggestme');
 	$suggestme = (($suggestme===false)? '0': $suggestme); // default if not set: 0
 
-	$browser_update = intval(get_pconfig(local_user(), 'system','update_interval'));
-	$browser_update = (($browser_update == 0) ? 40 : $browser_update / 1000); // default if not set: 40 seconds
 
-	$itemspage_network = intval(get_pconfig(local_user(), 'system','itemspage_network'));
-	$itemspage_network = (($itemspage_network > 0 && $itemspage_network < 101) ? $itemspage_network : 40); // default if not set: 40 items
-	
-	$nosmile = get_pconfig(local_user(),'system','no_smilies');
-	$nosmile = (($nosmile===false)? '0': $nosmile); // default if not set: 0
 	
 	if(! strlen($a->user['timezone']))
 		$timezone = date_default_timezone_get();
@@ -758,6 +875,12 @@ function settings_content(&$a) {
 	));
 
 
+	$unkmail = replace_macros($opt_tpl,array(
+			'$field' 	=> array('unkmail',  t('Permit unknown people to send you private mail?'), $unkmail, '', array(t('No'),t('Yes'))),
+
+	));
+
+
 	$invisible = (((! $profile['publish']) && (! $profile['net-publish']))
 		? true : false);
 
@@ -765,33 +888,7 @@ function settings_content(&$a) {
 		info( t('Profile is <strong>not published</strong>.') . EOL );
 
 	
-	$default_theme = get_config('system','theme');
-	if(! $default_theme)
-		$default_theme = 'default';
-
-	$allowed_themes_str = get_config('system','allowed_themes');
-	$allowed_themes_raw = explode(',',$allowed_themes_str);
-	$allowed_themes = array();
-	if(count($allowed_themes_raw))
-		foreach($allowed_themes_raw as $x)
-			if(strlen(trim($x)))
-				$allowed_themes[] = trim($x);
 
-	
-	$themes = array();
-	$files = glob('view/theme/*');
-	if($allowed_themes) {
-		foreach($allowed_themes as $th) {
-			$f = $th;
-			$is_experimental = file_exists('view/theme/' . $th . '/experimental');
-			$unsupported = file_exists('view/theme/' . $th . '/unsupported');
-			if (!$is_experimental or ($is_experimental && (get_config('experimentals','exp_themes')==1 or get_config('experimentals','exp_themes')===false))){ 
-				$theme_name = (($is_experimental) ?  sprintf("%s - \x28Experimental\x29", $f) : $f);
-				$themes[$f]=$theme_name;
-			}
-		}
-	}
-	$theme_selected = (!x($_SESSION,'theme')? $default_theme : $_SESSION['theme']);
 
 
 	$subdir = ((strlen($a->get_path())) ? '<br />' . t('or') . ' ' . $a->get_baseurl(true) . '/profile/' . $nickname : '');
@@ -842,10 +939,7 @@ function settings_content(&$a) {
 		'$timezone' => array('timezone_select' , t('Your Timezone:'), select_timezone($timezone), ''),
 		'$defloc'	=> array('defloc', t('Default Post Location:'), $defloc, ''),
 		'$allowloc' => array('allow_location', t('Use Browser Location:'), ($a->user['allow_location'] == 1), ''),
-		'$theme'	=> array('theme', t('Display Theme:'), $theme_selected, '', $themes),
-		'$ajaxint'   => array('browser_update',  t("Update browser every xx seconds"), $browser_update, t('Minimum of 10 seconds, no maximum')),
-		'$itemspage_network'   => array('itemspage_network',  t("Number of items to display on the network page:"), $itemspage_network, t('Maximum of 100 items')),
-		'$nosmile'	=> array('nosmile', t("Don't show emoticons"), $nosmile, ''),
+		
 
 		'$h_prv' 	=> t('Security and Privacy Settings'),
 
@@ -863,7 +957,8 @@ function settings_content(&$a) {
 		'$profile_in_net_dir' => $profile_in_net_dir,
 		'$hide_friends' => $hide_friends,
 		'$hide_wall' => $hide_wall,
-		
+		'$unkmail' => $unkmail,		
+		'$cntunkmail' 	=> array('cntunkmail', t('Maximum private messages per day from unknown people:'), $cntunkmail ,t("\x28to prevent spam abuse\x29")),
 		
 		
 		'$h_not' 	=> t('Notification Settings'),
diff --git a/mod/suggest.php b/mod/suggest.php
index b8ca423c5..7a86d53a1 100755
--- a/mod/suggest.php
+++ b/mod/suggest.php
@@ -52,7 +52,7 @@ function suggest_content(&$a) {
 		$connlnk = $a->get_baseurl() . '/follow/?url=' . (($rr['connect']) ? $rr['connect'] : $rr['url']);			
 
 		$o .= replace_macros($tpl,array(
-			'$url' => $rr['url'],
+			'$url' => zrl($rr['url']),
 			'$name' => $rr['name'],
 			'$photo' => $rr['photo'],
 			'$ignlnk' => $a->get_baseurl() . '/suggest?ignore=' . $rr['id'],
diff --git a/mod/view.php b/mod/view.php
new file mode 100644
index 000000000..15b3733b3
--- /dev/null
+++ b/mod/view.php
@@ -0,0 +1,17 @@
+<?php
+/**
+ * load view/theme/$current_theme/style.php with friendica contex
+ */
+ 
+function view_init($a){
+	header("Content-Type: text/css");
+		
+	if ($a->argc == 4){
+		$theme = $a->argv[2];
+		$THEMEPATH = "view/theme/$theme";
+		if(file_exists("view/theme/$theme/style.php"))
+			require_once("view/theme/$theme/style.php");
+	}
+	
+	killme();
+}
diff --git a/mod/viewcontacts.php b/mod/viewcontacts.php
index 6b66f60d7..e7d26b73e 100755
--- a/mod/viewcontacts.php
+++ b/mod/viewcontacts.php
@@ -54,6 +54,8 @@ function viewcontacts_content(&$a) {
 
 		if($is_owner && ($rr['network'] === NETWORK_DFRN) && ($rr['rel']))
 			$url = 'redir/' . $rr['id'];
+		else
+			$url = zrl($url);
 
 		$contacts[] = array(
 			'id' => $rr['id'],
diff --git a/mod/wallmessage.php b/mod/wallmessage.php
new file mode 100644
index 000000000..1a4882b64
--- /dev/null
+++ b/mod/wallmessage.php
@@ -0,0 +1,149 @@
+<?php
+
+require_once('include/message.php');
+
+function wallmessage_post(&$a) {
+
+	$replyto = get_my_url();
+	if(! $replyto) {
+		notice( t('Permission denied.') . EOL);
+		return;
+	}
+
+	$subject   = ((x($_REQUEST,'subject'))   ? notags(trim($_REQUEST['subject']))   : '');
+	$body      = ((x($_REQUEST,'body'))      ? escape_tags(trim($_REQUEST['body'])) : '');
+
+	$recipient = (($a->argc > 1) ? notags($a->argv[1]) : '');
+	if((! $recipient) || (! $body)) {
+		return;
+	}
+
+	$r = q("select * from user where nickname = '%s' limit 1",
+		dbesc($recipient)
+	);
+
+	if(! count($r)) {
+		logger('wallmessage: no recipient');
+		return;
+	}
+
+	$user = $r[0];
+
+	if(! intval($user['unkmail'])) {
+		notice( t('Permission denied.') . EOL);
+		return;
+	}
+
+	$r = q("select count(*) as total from mail where uid = %d and created > UTC_TIMESTAMP() - INTERVAL 1 day and unknown = 1",
+			intval($user['uid'])
+	);
+
+	if($r[0]['total'] > $user['cntunkmail']) {
+		notice( sprintf( t('Number of daily wall messages for %s exceeded. Message failed.', $user['username'])));
+		return;
+	}
+
+	// Work around doubled linefeeds in Tinymce 3.5b2
+dbg(1);
+	$body = str_replace("\r\n","\n",$body);
+	$body = str_replace("\n\n","\n",$body);
+
+	
+	$ret = send_wallmessage($user, $body, $subject, $replyto);
+
+	switch($ret){
+		case -1:
+			notice( t('No recipient selected.') . EOL );
+			break;
+		case -2:
+			notice( t('Unable to check your home location.') . EOL );
+			break;
+		case -3:
+			notice( t('Message could not be sent.') . EOL );
+			break;
+		case -4:
+			notice( t('Message collection failure.') . EOL );
+			break;
+		default:
+			info( t('Message sent.') . EOL );
+	}
+dbg(0);
+//	goaway($a->get_baseurl() . '/profile/' . $user['nickname']);
+	
+}
+
+
+function wallmessage_content(&$a) {
+
+	if(! get_my_url()) {
+		notice( t('Permission denied.') . EOL);
+		return;
+	}
+
+	$recipient = (($a->argc > 1) ? $a->argv[1] : '');
+
+	if(! $recipient) {
+		notice( t('No recipient.') . EOL);
+		return;
+	}
+
+	$r = q("select * from user where nickname = '%s' limit 1",
+		dbesc($recipient)
+	);
+
+	if(! count($r)) {
+		notice( t('No recipient.') . EOL);
+		logger('wallmessage: no recipient');
+		return;
+	}
+
+	$user = $r[0];
+
+	if(! intval($user['unkmail'])) {
+		notice( t('Permission denied.') . EOL);
+		return;
+	}
+
+	$r = q("select count(*) as total from mail where uid = %d and created > UTC_TIMESTAMP() - INTERVAL 1 day and unknown = 1",
+			intval($user['uid'])
+	);
+
+	if($r[0]['total'] > $user['cntunkmail']) {
+		notice( sprintf( t('Number of daily wall messages for %s exceeded. Message failed.', $user['username'])));
+		return;
+	}
+
+
+
+	$tpl = get_markup_template('wallmsg-header.tpl');
+
+		$a->page['htmlhead'] .= replace_macros($tpl, array(
+			'$baseurl' => $a->get_baseurl(true),
+			'$editselect' => '/(profile-jot-text|prvmail-text)/',
+			'$nickname' => $user['nickname'],
+			'$linkurl' => t('Please enter a link URL:')
+		));
+	
+
+	
+		$tpl = get_markup_template('wallmessage.tpl');
+		$o .= replace_macros($tpl,array(
+			'$header' => t('Send Private Message'),
+			'$subheader' => sprintf( t('If you wish for %s to respond, please check that the privacy settings on your site allow private mail from unknown senders.'), $user['username']),
+			'$to' => t('To:'),
+			'$subject' => t('Subject:'),
+			'$recipname' => $user['username'],
+			'$nickname' => $user['nickname'],
+			'$subjtxt' => ((x($_REQUEST,'subject')) ? strip_tags($_REQUEST['subject']) : ''),
+			'$text' => ((x($_REQUEST,'body')) ? escape_tags(htmlspecialchars($_REQUEST['body'])) : ''),
+			'$readonly' => '',
+			'$yourmessage' => t('Your message:'),
+			'$select' => $select,
+			'$parent' => '',
+			'$upload' => t('Upload photo'),
+			'$insert' => t('Insert web link'),
+			'$wait' => t('Please wait')
+		));
+
+		return $o;
+	}