Merge branch 'master', remote-tracking branch 'remotes/upstream/master'

* remotes/upstream/master:
  sort inbox by recently replied conversations first
  file as widget and basic filing implementation for duepuntozero,slackr much more work needed - this is just for test/evaluation currently
  don't count self in number of contatcs
  invite potential connectees to the free social web
  In HTML2BBCode: fetch the URL of [EMBED] using JavaScript instead of an ajax-call to a php-script. Once there actually is embedded Code in the HTML, this function is called after every single keypress. Not only is making an ajax-call every keypress bandith intensive - it also made typing hard / slow. Making a lot of JavaScript-RegExp-Computation every keypress isn't exactly great either, but still performs better.
  Some security against XSRF-attacks
  A 'PHP Fatal error:  Call to a member function getElementsByTagName() on a non-object in mod/parse_url.php on line 191' occurred when the linked HTML-File doesn't have a HEAD. The HTML-file couln't be link to in the editor therefore.
  Mostly some checks in order to avoid Notices; 1 real bugfix in /mod/network.php
  Avoid notices
  contact.network is used later to check if a direct link or a redirect by /redir/contactid should be used
  wasn't actually changed before
  Avoid a notice
  Avoid a Notice
  Avoid a Notice
  Avoid a Notice

* master:

9 files changed, 117 insertions, 48 deletions

diff --git a/mod/contacts.php b/mod/contacts.php
index 001bf12af..38ca570dd 100755
--- a/mod/contacts.php
+++ b/mod/contacts.php
@@ -445,7 +445,7 @@ function contacts_content(&$a) {
 
 	
 	$r = q("SELECT COUNT(*) AS `total` FROM `contact` 
-		WHERE `uid` = %d AND `pending` = 0 $sql_extra $sql_extra2 ",
+		WHERE `uid` = %d AND `self` = 0 AND `pending` = 0 $sql_extra $sql_extra2 ",
 		intval($_SESSION['uid']));
 	if(count($r)) {
 		$a->set_pager_total($r[0]['total']);
@@ -454,7 +454,7 @@ function contacts_content(&$a) {
 
 
 
-	$r = q("SELECT * FROM `contact` WHERE `uid` = %d AND `pending` = 0 $sql_extra $sql_extra2 ORDER BY `name` ASC LIMIT %d , %d ",
+	$r = q("SELECT * FROM `contact` WHERE `uid` = %d AND `self` = 0 AND `pending` = 0 $sql_extra $sql_extra2 ORDER BY `name` ASC LIMIT %d , %d ",
 		intval($_SESSION['uid']),
 		intval($a->pager['start']),
 		intval($a->pager['itemspage'])
@@ -465,8 +465,6 @@ function contacts_content(&$a) {
 	if(count($r)) {
 
 		foreach($r as $rr) {
-			if($rr['self'])
-				continue;
 
 			switch($rr['rel']) {
 				case CONTACT_IS_FRIEND:
diff --git a/mod/dfrn_request.php b/mod/dfrn_request.php
index bc159137d..4acb5c9bb 100755
--- a/mod/dfrn_request.php
+++ b/mod/dfrn_request.php
@@ -43,7 +43,7 @@ function dfrn_request_post(&$a) {
 		return;
 
 
-	if($_POST['cancel']) {
+	if(x($_POST, 'cancel')) {
 		goaway(z_root());
 	} 
 
@@ -666,7 +666,11 @@ function dfrn_request_content(&$a) {
 		$page_desc = sprintf( t('Diaspora members: Please do not use this form. Instead, enter "%s" into your Diaspora search bar.'), 
 			$target_addr) . EOL . EOL;
 
-		$page_desc .= t("Please enter your 'Identity Address' from one of the following supported social networks:");
+		$page_desc .= t("Please enter your 'Identity Address' from one of the following supported communications networks:");
+
+		$emailnet = t("<strike>Connect as an email follower</strike> \x28Coming soon\x29");
+
+		$invite_desc = t('If you are not yet a member of the free social web, <a href="http://dir.friendica.com/siteinfo">follow this link to find a public Friendica site and join us today</a>.');
 
 		$o .= replace_macros($tpl,array(
 			'$header' => t('Friend/Connection Request'),
@@ -682,6 +686,8 @@ function dfrn_request_content(&$a) {
 			'$diaspora' => t('Diaspora'),
 			'$diasnote' => t('- please share from your own site as noted above'),
 			'$your_address' => t('Your Identity Address:'),
+			'$invite_desc' => $invite_desc,
+			'$emailnet' => $emailnet,
 			'$submit' => t('Submit Request'),
 			'$cancel' => t('Cancel'),
 			'$nickname' => $a->argv[1],
diff --git a/mod/filer.php b/mod/filer.php
new file mode 100755
index 000000000..a9e213536
--- /dev/null
+++ b/mod/filer.php
@@ -0,0 +1,23 @@
+<?php
+
+require_once('include/security.php');
+require_once('include/bbcode.php');
+require_once('include/items.php');
+
+
+function filer_content(&$a) {
+
+	if(! local_user()) {
+		killme();
+	}
+
+	$term = notags(trim($_GET['term']));
+	$item_id = (($a->argc > 1) ? notags(trim($a->argv[1])) : 0);
+
+	logger('filer: tag ' . $term . ' item ' . $item_id);
+
+	if($item_id && strlen($term))
+		file_tag_save_file(local_user(),$item_id,$term);
+
+	killme();
+}
diff --git a/mod/message.php b/mod/message.php
index 57d45ee3c..65f692f3d 100755
--- a/mod/message.php
+++ b/mod/message.php
@@ -192,9 +192,9 @@ function message_content(&$a) {
 			$a->set_pager_total($r[0]['total']);
 	
 		$r = q("SELECT max(`mail`.`created`) AS `mailcreated`, min(`mail`.`seen`) AS `mailseen`, 
-			`mail`.* , `contact`.`name`, `contact`.`url`, `contact`.`thumb` 
+			`mail`.* , `contact`.`name`, `contact`.`url`, `contact`.`thumb` , `contact`.`network`  
 			FROM `mail` LEFT JOIN `contact` ON `mail`.`contact-id` = `contact`.`id` 
-			WHERE `mail`.`uid` = %d AND `from-url` $eq '%s' GROUP BY `parent-uri` ORDER BY `created` DESC  LIMIT %d , %d ",
+			WHERE `mail`.`uid` = %d AND `from-url` $eq '%s' GROUP BY `parent-uri` ORDER BY `mailcreated` DESC  LIMIT %d , %d ",
 			intval(local_user()),
 			dbesc($myprofile),
 			intval($a->pager['start']),
diff --git a/mod/network.php b/mod/network.php
index 861b5ab73..4f58fc4fb 100755
--- a/mod/network.php
+++ b/mod/network.php
@@ -44,8 +44,9 @@ function network_init(&$a) {
 	}
 	
 	$a->page['aside'] .= group_side('network','network',true,$group_id);
-	$a->page['aside'] .= networks_widget($a->get_baseurl() . '/network',(($_GET['nets']) ? $_GET['nets'] : ''));
+	$a->page['aside'] .= networks_widget($a->get_baseurl() . '/network',(x($_GET, 'nets') ? $_GET['nets'] : ''));
 	$a->page['aside'] .= saved_searches($search);
+	$a->page['aside'] .= fileas_widget($a->get_baseurl() . '/network',(x($_GET, 'file') ? $_GET['file'] : ''));
 
 }
 
@@ -132,15 +133,15 @@ function network_content(&$a, $update = 0) {
 		$starred_active = 'active';
 	}
 	
-	if($_GET['bmark']) {
+	if(x($_GET,'bmark')) {
 		$bookmarked_active = 'active';
 	}
 
-	if($_GET['conv']) {
+	if(x($_GET,'conv')) {
 		$conv_active = 'active';
 	}
 
-	if($_GET['spam']) {
+	if(x($_GET,'spam')) {
 		$spam_active = 'active';
 	}
 
@@ -248,7 +249,7 @@ function network_content(&$a, $update = 0) {
 		$def_acl = array('allow_cid' => '<' . intval($cid) . '>');
 
 	if(! $update) {
-		if(group) {
+		if($group) {
 			if(($t = group_public_members($group)) && (! get_pconfig(local_user(),'system','nowarn_insecure'))) {
 				notice( sprintf( tt('Warning: This group contains %s member from an insecure network.',
 									'Warning: This group contains %s members from an insecure network.',
@@ -498,7 +499,9 @@ function network_content(&$a, $update = 0) {
 
 			$items = conv_sort($items,$ordering);
 
-		}	
+		} else {
+			$items = array();
+		}
 	}
 
 
diff --git a/mod/parse_url.php b/mod/parse_url.php
index e0b378f68..27dac4d5d 100755
--- a/mod/parse_url.php
+++ b/mod/parse_url.php
@@ -188,7 +188,7 @@ function parse_url_content(&$a) {
 
 	if(! $text) {
 		logger('parsing meta');
-		$items = $domhead->getElementsByTagName('meta');
+		$items = (isset($domhead) && is_object($domhead) ? $domhead->getElementsByTagName('meta') : null);
 		if($items) {
 			foreach($items as $item) {
 				$property = $item->getAttribute('property');
diff --git a/mod/profile_photo.php b/mod/profile_photo.php
index e3dbdaf39..d1fd08eba 100755
--- a/mod/profile_photo.php
+++ b/mod/profile_photo.php
@@ -15,11 +15,13 @@ function profile_photo_init(&$a) {
 
 function profile_photo_post(&$a) {
 
-        if(! local_user()) {
-                notice ( t('Permission denied.') . EOL );
-                return;
-        }
-
+	if(! local_user()) {
+		notice ( t('Permission denied.') . EOL );
+		return;
+	}
+	
+	check_form_security_token_redirectOnErr('/profile_photo', 'profile_photo');
+        
 	if((x($_POST,'cropfinal')) && ($_POST['cropfinal'] == 1)) {
 
 		// phase 2 - we have finished cropping
@@ -148,7 +150,9 @@ function profile_photo_content(&$a) {
 			notice( t('Permission denied.') . EOL );
 			return;
 		};
-			
+		
+		check_form_security_token_redirectOnErr('/profile_photo', 'profile_photo');
+        
 		$resource_id = $a->argv[2];
 		//die(":".local_user());
 		$r=q("SELECT * FROM `photo` WHERE `uid` = %d AND `resource-id` = '%s' ORDER BY `scale` ASC",
@@ -203,6 +207,7 @@ function profile_photo_content(&$a) {
 			'$lbl_upfile' => t('Upload File:'),
 			'$title' => t('Upload Profile Photo'),
 			'$submit' => t('Upload'),
+			'$form_security_token' => get_form_security_token("profile_photo"),
 			'$select' => sprintf('%s %s', t('or'), ($newuser) ? '<a href="' . $a->get_baseurl() . '">' . t('skip this step') . '</a>' : '<a href="'. $a->get_baseurl() . '/photos/' . $a->user['nickname'] . '">' . t('select a photo from your photo albums') . '</a>')
 		));
 
@@ -218,6 +223,7 @@ function profile_photo_content(&$a) {
 			'$image_url' => $a->get_baseurl() . '/photo/' . $filename,
 			'$title' => t('Crop Image'),
 			'$desc' => t('Please adjust the image cropping for optimum viewing.'),
+			'$form_security_token' => get_form_security_token("profile_photo"),
 			'$done' => t('Done Editing')
 		));
 		return $o;
diff --git a/mod/profiles.php b/mod/profiles.php
index ccd7d5474..b307a2d43 100755
--- a/mod/profiles.php
+++ b/mod/profiles.php
@@ -21,6 +21,9 @@ function profiles_post(&$a) {
 			notice( t('Profile not found.') . EOL);
 			return;
 		}
+		
+		check_form_security_token_redirectOnErr('/profiles', 'profile_edit');
+		
 		$is_default = (($orig[0]['is-default']) ? 1 : 0);
 
 		$profile_name = notags(trim($_POST['profile_name']));
@@ -240,6 +243,8 @@ function profiles_content(&$a) {
 			goaway($a->get_baseurl() . '/profiles');
 			return; // NOTREACHED
 		}
+		
+		check_form_security_token_redirectOnErr('/profiles', 'profile_drop', 't');
 
 		// move every contact using this profile as their default to the user default
 
@@ -264,6 +269,8 @@ function profiles_content(&$a) {
 
 
 	if(($a->argc > 1) && ($a->argv[1] === 'new')) {
+		
+		check_form_security_token_redirectOnErr('/profiles', 'profile_new', 't');
 
 		$r0 = q("SELECT `id` FROM `profile` WHERE `uid` = %d",
 			intval(local_user()));
@@ -291,10 +298,13 @@ function profiles_content(&$a) {
 		info( t('New profile created.') . EOL);
 		if(count($r3) == 1)
 			goaway($a->get_baseurl() . '/profiles/' . $r3[0]['id']);
+		
 		goaway($a->get_baseurl() . '/profiles');
-	}		 
+	} 
 
 	if(($a->argc > 2) && ($a->argv[1] === 'clone')) {
+		
+		check_form_security_token_redirectOnErr('/profiles', 'profile_clone', 't');
 
 		$r0 = q("SELECT `id` FROM `profile` WHERE `uid` = %d",
 			intval(local_user()));
@@ -330,9 +340,11 @@ function profiles_content(&$a) {
 		info( t('New profile created.') . EOL);
 		if(count($r3) == 1)
 			goaway($a->get_baseurl() . '/profiles/' . $r3[0]['id']);
-	goaway($a->get_baseurl() . '/profiles');
-	return; // NOTREACHED
-	}		 
+		
+		goaway($a->get_baseurl() . '/profiles');
+		
+		return; // NOTREACHED
+	}
 
 
 	if(($a->argc > 1) && (intval($a->argv[1]))) {
@@ -371,6 +383,9 @@ function profiles_content(&$a) {
 		$is_default = (($r[0]['is-default']) ? 1 : 0);
 		$tpl = get_markup_template("profile_edit.tpl");
 		$o .= replace_macros($tpl,array(
+			'$form_security_token' => get_form_security_token("profile_edit"),
+			'$profile_clone_link' => 'profiles/clone/' . $r[0]['id'] . '?t=' . get_form_security_token("profile_clone"),
+			'$profile_drop_link' => 'profiles/drop/' . $r[0]['id'] . '?t=' . get_form_security_token("profile_drop"),
 			'$banner' => t('Edit Profile Details'),
 			'$submit' => t('Submit'),
 			'$viewprof' => t('View this profile'),
@@ -460,7 +475,8 @@ function profiles_content(&$a) {
 			$o .= replace_macros($tpl_header,array(
 				'$header' => t('Edit/Manage Profiles'),
 				'$chg_photo' => t('Change profile photo'),
-				'$cr_new' => t('Create New Profile')
+				'$cr_new' => t('Create New Profile'),
+				'$cr_new_link' => 'profiles/new?t=' . get_form_security_token("profile_new")
 			));
 
 
diff --git a/mod/settings.php b/mod/settings.php
index 2ef582fdf..f42fdb397 100755
--- a/mod/settings.php
+++ b/mod/settings.php
@@ -53,6 +53,8 @@ function settings_post(&$a) {
 	$old_page_flags = $a->user['page-flags'];
 
 	if(($a->argc > 1) && ($a->argv[1] === 'oauth') && x($_POST,'remove')){
+		check_form_security_token_redirectOnErr('/settings/oauth', 'settings_oauth');
+		
 		$key = $_POST['remove'];
 		q("DELETE FROM tokens WHERE id='%s' AND uid=%d",
 			dbesc($key),
@@ -63,6 +65,8 @@ function settings_post(&$a) {
 
 	if(($a->argc > 2) && ($a->argv[1] === 'oauth')  && ($a->argv[2] === 'edit'||($a->argv[2] === 'add')) && x($_POST,'submit')) {
 		
+		check_form_security_token_redirectOnErr('/settings/oauth', 'settings_oauth');
+		
 		$name   	= ((x($_POST,'name')) ? $_POST['name'] : '');
 		$key		= ((x($_POST,'key')) ? $_POST['key'] : '');
 		$secret		= ((x($_POST,'secret')) ? $_POST['secret'] : '');
@@ -105,13 +109,18 @@ function settings_post(&$a) {
 	}
 
 	if(($a->argc > 1) && ($a->argv[1] == 'addon')) {
+		check_form_security_token_redirectOnErr('/settings/addon', 'settings_addon');
+		
 		call_hooks('plugin_settings_post', $_POST);
 		return;
 	}
 
 	if(($a->argc > 1) && ($a->argv[1] == 'connectors')) {
-
-		if(x($_POST['imap-submit'])) {
+		
+		check_form_security_token_redirectOnErr('/settings/connectors', 'settings_connectors');
+		
+		if(x($_POST, 'imap-submit')) {
+			
 			$mail_server       = ((x($_POST,'mail_server')) ? $_POST['mail_server'] : '');
 			$mail_port         = ((x($_POST,'mail_port')) ? $_POST['mail_port'] : '');
 			$mail_ssl          = ((x($_POST,'mail_ssl')) ? strtolower(trim($_POST['mail_ssl'])) : '');
@@ -185,7 +194,8 @@ function settings_post(&$a) {
 		return;
 	}
 
-
+	check_form_security_token_redirectOnErr('/settings', 'settings');
+	
 	call_hooks('settings_post', $_POST);
 
 	if((x($_POST,'npassword')) || (x($_POST,'confirm'))) {
@@ -460,6 +470,7 @@ function settings_content(&$a) {
 		if(($a->argc > 2) && ($a->argv[2] === 'add')) {
 			$tpl = get_markup_template("settings_oauth_edit.tpl");
 			$o .= replace_macros($tpl, array(
+				'$form_security_token' => get_form_security_token("settings_oauth"),
 				'$tabs'		=> $tabs,
 				'$title'	=> t('Add application'),
 				'$submit'	=> t('Submit'),
@@ -486,6 +497,7 @@ function settings_content(&$a) {
 			
 			$tpl = get_markup_template("settings_oauth_edit.tpl");
 			$o .= replace_macros($tpl, array(
+				'$form_security_token' => get_form_security_token("settings_oauth"),
 				'$tabs'		=> $tabs,
 				'$title'	=> t('Add application'),
 				'$submit'	=> t('Update'),
@@ -500,6 +512,8 @@ function settings_content(&$a) {
 		}
 		
 		if(($a->argc > 3) && ($a->argv[2] === 'delete')) {
+			check_form_security_token_redirectOnErr('/settings/oauth', 'settings_oauth', 't');
+		
 			$r = q("DELETE FROM clients WHERE client_id='%s' AND uid=%d",
 					dbesc($a->argv[3]),
 					local_user());
@@ -518,6 +532,7 @@ function settings_content(&$a) {
 		
 		$tpl = get_markup_template("settings_oauth.tpl");
 		$o .= replace_macros($tpl, array(
+			'$form_security_token' => get_form_security_token("settings_oauth"),
 			'$baseurl'	=> $a->get_baseurl(),
 			'$title'	=> t('Connected Apps'),
 			'$add'		=> t('Add application'),
@@ -544,6 +559,7 @@ function settings_content(&$a) {
 		
 		$tpl = get_markup_template("settings_addons.tpl");
 		$o .= replace_macros($tpl, array(
+			'$form_security_token' => get_form_security_token("settings_addons"),
 			'$title'	=> t('Plugin Settings'),
 			'$tabs'		=> $tabs,
 			'$settings_addons' => $settings_addons
@@ -586,28 +602,28 @@ function settings_content(&$a) {
 
 	$tpl = get_markup_template("settings_connectors.tpl");
 		$o .= replace_macros($tpl, array(
+			'$form_security_token' => get_form_security_token("settings_connectors"),
+			
 			'$title'	=> t('Connector Settings'),
 			'$tabs'		=> $tabs,
 
-		'$diasp_enabled' => $diasp_enabled,
-		'$ostat_enabled' => $ostat_enabled,
-
-		'$h_imap' => t('Email/Mailbox Setup'),
-		'$imap_desc' => t("If you wish to communicate with email contacts using this service \x28optional\x29, please specify how to connect to your mailbox."),
-		'$imap_lastcheck' => array('imap_lastcheck', t('Last successful email check:'), $mail_chk,''),
-		'$mail_disabled' => (($mail_disabled) ? t('Email access is disabled on this site.') : ''),
-		'$mail_server'	=> array('mail_server',  t('IMAP server name:'), $mail_server, ''),
-		'$mail_port'	=> array('mail_port', 	 t('IMAP port:'), $mail_port, ''),
-		'$mail_ssl'		=> array('mail_ssl', 	 t('Security:'), strtoupper($mail_ssl), '', array( ''=>t('None'), 'TLS'=>'TLS', 'SSL'=>'SSL')),
-		'$mail_user'	=> array('mail_user',    t('Email login name:'), $mail_user, ''),
-		'$mail_pass'	=> array('mail_pass', 	 t('Email password:'), '', ''),
-		'$mail_replyto'	=> array('mail_replyto', t('Reply-to address:'), '', 'Optional'),
-		'$mail_pubmail'	=> array('mail_pubmail', t('Send public posts to all email contacts:'), $mail_pubmail, ''),
-		'$mail_action'	=> array('mail_action',	 t('Action after import:'), $mail_action, '', array(0=>t('None'), 1=>t('Delete'), 2=>t('Mark as seen'), 3=>t('Move to folder'))),
-		'$mail_movetofolder'	=> array('mail_movetofolder',	 t('Move to folder:'), $mail_movetofolder, ''),
-		'$submit' => t('Submit'),
-
-
+			'$diasp_enabled' => $diasp_enabled,
+			'$ostat_enabled' => $ostat_enabled,
+
+			'$h_imap' => t('Email/Mailbox Setup'),
+			'$imap_desc' => t("If you wish to communicate with email contacts using this service \x28optional\x29, please specify how to connect to your mailbox."),
+			'$imap_lastcheck' => array('imap_lastcheck', t('Last successful email check:'), $mail_chk,''),
+			'$mail_disabled' => (($mail_disabled) ? t('Email access is disabled on this site.') : ''),
+			'$mail_server'	=> array('mail_server',  t('IMAP server name:'), $mail_server, ''),
+			'$mail_port'	=> array('mail_port', 	 t('IMAP port:'), $mail_port, ''),
+			'$mail_ssl'		=> array('mail_ssl', 	 t('Security:'), strtoupper($mail_ssl), '', array( ''=>t('None'), 'TLS'=>'TLS', 'SSL'=>'SSL')),
+			'$mail_user'	=> array('mail_user',    t('Email login name:'), $mail_user, ''),
+			'$mail_pass'	=> array('mail_pass', 	 t('Email password:'), '', ''),
+			'$mail_replyto'	=> array('mail_replyto', t('Reply-to address:'), '', 'Optional'),
+			'$mail_pubmail'	=> array('mail_pubmail', t('Send public posts to all email contacts:'), $mail_pubmail, ''),
+			'$mail_action'	=> array('mail_action',	 t('Action after import:'), $mail_action, '', array(0=>t('None'), 1=>t('Delete'), 2=>t('Mark as seen'), 3=>t('Move to folder'))),
+			'$mail_movetofolder'	=> array('mail_movetofolder',	 t('Move to folder:'), $mail_movetofolder, ''),
+			'$submit' => t('Submit'),
 
 			'$settings_connectors' => $settings_connectors
 		));
@@ -805,6 +821,7 @@ function settings_content(&$a) {
 		'$submit' 	=> t('Submit'),
 		'$baseurl' => $a->get_baseurl(),
 		'$uid' => local_user(),
+		'$form_security_token' => get_form_security_token("settings"),
 		
 		'$nickname_block' => $prof_addr,