Merge pull request #1 from friendica/master

Red master has been merged

28 files changed, 688 insertions, 76 deletions

diff --git a/mod/admin.php b/mod/admin.php
index 464edddd4..14657bd1a 100644
--- a/mod/admin.php
+++ b/mod/admin.php
@@ -65,6 +65,11 @@ function admin_post(&$a){
 			case 'dbsync':
 				admin_page_dbsync_post($a);
 				break;
+
+			case 'profs':
+				admin_page_profs_post($a);
+				break;
+
 		}
 	}
 
@@ -95,6 +100,7 @@ function admin_content(&$a) {
 		'plugins'    =>	Array($a->get_baseurl(true)."/admin/plugins/", t("Plugins") , "plugins"),
 		'themes'     =>	Array($a->get_baseurl(true)."/admin/themes/", t("Themes") , "themes"),
 		'hubloc'     =>	Array($a->get_baseurl(true)."/admin/hubloc/", t("Server") , "server"),
+		'profs'      => array(z_root() . '/admin/profs', t('Profile Config'), 'profs'),
 		'dbsync'     => Array($a->get_baseurl(true)."/admin/dbsync/", t('DB updates'), "dbsync")
 	);
 	
@@ -155,6 +161,9 @@ function admin_content(&$a) {
 			case 'dbsync':
 				$o = admin_page_dbsync($a);
 				break;
+			case 'profs':
+				$o = admin_page_profs($a);
+				break;
 			default:
 				notice( t("Item not found.") );
 		}
@@ -630,7 +639,7 @@ function admin_page_users_post(&$a){
 	if (x($_POST,'page_users_delete')){
 		require_once("include/Contact.php");
 		foreach($users as $uid){
-			account_remove($uid,true);
+			account_remove($uid,true,false);
 		}
 		notice( sprintf( tt("%s user deleted", "%s users deleted", count($users)), count($users)) );
 	}
@@ -672,7 +681,7 @@ function admin_page_users(&$a){
                 check_form_security_token_redirectOnErr('/admin/users', 'admin_users', 't');
 				// delete user
 				require_once("include/Contact.php");
-				account_remove($uid,true);
+				account_remove($uid,true,false);
 				
 				notice( sprintf(t("User '%s' deleted"), $account[0]['account_email']) . EOL);
 			}; break;
@@ -1317,3 +1326,17 @@ readable.");
 	));
 }
 
+function admin_page_profs_post(&$a) {
+
+
+}
+
+function admin_page_profs(&$a) {
+
+
+}
+
+
+
+
+
diff --git a/mod/cloud.php b/mod/cloud.php
index 3734f769a..1765c0b69 100644
--- a/mod/cloud.php
+++ b/mod/cloud.php
@@ -34,6 +34,17 @@
  */
 function cloud_init(&$a) {
 
+	// call ($currenttheme)_init since we're operating outside of index.php
+
+	$theme_info_file = "view/theme/".current_theme()."/php/theme.php";
+	if (file_exists($theme_info_file)){
+		require_once($theme_info_file);
+		if(function_exists(str_replace('-','_',current_theme()) . '_init')) {
+			$func = str_replace('-','_',current_theme()) . '_init';
+			$func($a);
+		}
+	}
+
 	require_once('include/reddav.php');
 
 	if(! is_dir('store'))
diff --git a/mod/connections.php b/mod/connections.php
index 1875ed908..028889647 100644
--- a/mod/connections.php
+++ b/mod/connections.php
@@ -337,6 +337,9 @@ function connections_content(&$a) {
 	}
 	$sql_extra .= (($searching) ? protect_sprintf(" AND xchan_name like '%$search_txt%' ") : "");
 
+	if($_REQUEST['gid']) {
+		$sql_extra .= " and xchan_hash in ( select xchan from group_member where gid = " . intval($_REQUEST['gid']) . " and uid = " . intval(local_user()) . " ) ";
+	}
  	
 	$r = q("SELECT COUNT(abook.abook_id) AS total FROM abook left join xchan on abook.abook_xchan = xchan.xchan_hash 
 		where abook_channel = %d and not (abook_flags & %d) and not (xchan_flags & %d ) $sql_extra $sql_extra2 ",
diff --git a/mod/connedit.php b/mod/connedit.php
index b9f0299e2..b2de42343 100644
--- a/mod/connedit.php
+++ b/mod/connedit.php
@@ -118,13 +118,14 @@ function connedit_post(&$a) {
 		intval(local_user())
 	);
 
-	if($orig_record[0]['abook_profile'] != $profile_id) { //Update profile photo permissions
+	if($orig_record[0]['abook_profile'] != $profile_id) { 
+		//Update profile photo permissions
 
-                logger('As a new profile was assigned updateing profile photos');
-                require_once('mod/profile_photo.php');
-                profile_photo_set_profile_perms($profile_id);
+		logger('As a new profile was assigned updating profile photos');
+		require_once('mod/profile_photo.php');
+		profile_photo_set_profile_perms($profile_id);
 
-        }
+	}
 
 
 	if($r)
@@ -147,12 +148,44 @@ function connedit_post(&$a) {
 				group_add_member(local_user(),'',$a->poi['abook_xchan'],$g['id']);
 		}
 
-
-
 		// Check if settings permit ("post new friend activity" is allowed, and 
 		// friends in general or this friend in particular aren't hidden) 
 		// and send out a new friend activity
-		// TODO
+
+		$pr = q("select * from profile where uid = %d and is_default = 1 and hide_friends = 0",
+			intval($channel['channel_id'])
+		);
+		if(($pr) && (! ($abook_flags & ABOOK_FLAG_HIDDEN)) 
+			&& (intval(get_pconfig($channel['channel_id'],'system','post_newfriend')))) {
+			$xarr = array();
+			$xarr['verb'] = ACTIVITY_FRIEND;
+			$xarr['item_flags'] = ITEM_WALL|ITEM_ORIGIN|ITEM_THREAD_TOP;
+			$xarr['owner_xchan'] = $xarr['author_xchan'] = $channel['channel_hash'];
+			$xarr['allow_cid'] = $channel['channel_allow_cid'];
+			$xarr['allow_gid'] = $channel['channel_allow_gid'];
+			$xarr['deny_cid'] = $channel['channel_deny_cid'];
+			$xarr['deny_gid'] = $channel['channel_deny_gid'];
+			$xarr['item_private'] = (($xarr['allow_cid']||$xarr['allow_gid']||$xarr['deny_cid']||$xarr['deny_gid']) ? 1 : 0);
+			$obj = array(
+				'type' => ACTIVITY_OBJ_PERSON,
+				'title' => $a->poi['xchan_name'],
+				'id' => $a->poi['xchan_hash'],
+				'link' => array(
+					array('rel' => 'alternate', 'type' => 'text/html', 'href' => $a->poi['xchan_url']),
+					array('rel' => 'photo', 'type' => $a->poi['xchan_photo_mimetype'], 'href' => $a->poi['xchan_photo_l'])
+       			),
+   			);
+			$xarr['object'] = json_encode($obj);
+			$xarr['obj_type'] = ACTIVITY_OBJ_PERSON;
+
+			$xarr['body'] = '[zrl=' . $channel['xchan_url'] . ']' . $channel['xchan_name'] . '[/zrl]' . ' ' . t('is now connected to') . ' ' . '[zrl=' . $a->poi['xchan_url'] . ']' . $a->poi['xchan_name'] . '[/zrl]';
+
+			$xarr['body'] .= "\n\n\n" . '[zrl=' . $a->poi['xchan_url'] . '][zmg=80x80]' . $a->poi['xchan_photo_m'] . '[/zmg][/zrl]';
+
+			post_activity_item($xarr);
+
+		}
+
 
 		// pull in a bit of content if there is any to pull in
 		proc_run('php','include/onepoll.php',$contact_id);
@@ -231,12 +264,10 @@ function connedit_content(&$a) {
 		$cmd = argv(2);
 
 		$orig_record = q("SELECT abook.*, xchan.* FROM abook left join xchan on abook_xchan = xchan_hash
-			WHERE abook_id = %d AND abook_channel = %d AND NOT ( abook_flags & %d ) and not ( abook_flags & %d ) LIMIT 1",
+			WHERE abook_id = %d AND abook_channel = %d AND NOT ( abook_flags & %d ) LIMIT 1",
 			intval($contact_id),
 			intval(local_user()),
-			intval(ABOOK_FLAG_SELF),
-			// allow drop even if pending, just duplicate the self query
-			intval(($cmd === 'drop') ? ABOOK_FLAG_SELF : ABOOK_FLAG_PENDING)
+			intval(ABOOK_FLAG_SELF)
 		);
 
 		if(! count($orig_record)) {
@@ -306,7 +337,8 @@ function connedit_content(&$a) {
 			goaway($a->get_baseurl(true) . '/connedit/' . $contact_id);
 		}
 
-		// We'll prevent somebody from unapproving a contact.
+		// We'll prevent somebody from unapproving an already approved contact.
+		// Though maybe somebody will want this eventually (??)
 
 		if($cmd === 'approve') {
 			if($orig_record[0]['abook_flags'] & ABOOK_FLAG_PENDING) {
@@ -326,11 +358,21 @@ function connedit_content(&$a) {
 		if($cmd === 'drop') {
 
 			require_once('include/Contact.php');
+
 // FIXME
-//			terminate_friendship($a->get_channel(),$orig_record[0]);
+// We need to send either a purge or a refresh packet to the other side (the channel being unfriended). 
+// The issue is that the abook DB record _may_ get destroyed when we call contact_remove. As the notifier runs
+// in the background there could be a race condition preventing this packet from being sent in all cases.
+// PLACEHOLDER
 
 			contact_remove(local_user(), $orig_record[0]['abook_id']);
-// FIXME - send to clones
+			build_sync_packet(0 /* use the current local_user */, 
+				array('abook' => array(
+					'abook_xchan' => $orig_record[0]['abook_xchan'],
+					'entry_deleted' => true)
+				)
+			);
+
 			info( t('Connection has been removed.') . EOL );
 			if(x($_SESSION,'return_url'))
 				goaway($a->get_baseurl(true) . '/' . $_SESSION['return_url']);
diff --git a/mod/directory.php b/mod/directory.php
index b11b0d410..8dbed4115 100644
--- a/mod/directory.php
+++ b/mod/directory.php
@@ -199,20 +199,37 @@ function directory_content(&$a) {
 						$a->data['directory_keywords'] = $j['keywords'];
 					}
 
-//					logger('mod_directory: entries: ' . print_r($entries,true), LOGGER_DATA);
+					logger('mod_directory: entries: ' . print_r($entries,true), LOGGER_DATA);
 
-					$o .= replace_macros($tpl, array(
-						'$search' => $search,
-						'$desc' => t('Find'),
-						'$finddsc' => t('Finding:'),
-						'$safetxt' => htmlspecialchars($search,ENT_QUOTES,'UTF-8'),
-						'$entries' => $entries,
-						'$dirlbl' => t('Directory'),
-						'$submit' => t('Find')
-					));
 
+					if($_REQUEST['aj']) {
+						if($entries) {
+							$o = replace_macros(get_markup_template('directajax.tpl'),array(
+								'$entries' => $entries
+							));
+						}
+						else {
+							$o = '<div id="content-complete"></div>';
+						}
+						echo $o;
+						killme();
+					}
+					else {
 
-					$o .= alt_pager($a,$j['records'], t('next page'), t('previous page'));
+						$o .= "<script> var page_query_args = '" . $a->query_string . "'; </script>";
+						$o .= replace_macros($tpl, array(
+							'$search' => $search,
+							'$desc' => t('Find'),
+							'$finddsc' => t('Finding:'),
+							'$safetxt' => htmlspecialchars($search,ENT_QUOTES,'UTF-8'),
+							'$entries' => $entries,
+							'$dirlbl' => t('Directory'),
+							'$submit' => t('Find')
+						));
+
+//						$o .= alt_pager($a,$j['records'], t('next page'), t('previous page'));
+
+					}
 
 				}
 				else {
diff --git a/mod/dirsearch.php b/mod/dirsearch.php
index 0ace4ecae..b72d303b7 100644
--- a/mod/dirsearch.php
+++ b/mod/dirsearch.php
@@ -325,8 +325,18 @@ function dir_parse_query($s) {
 
 function list_public_sites() {
 
-
-	$r = q("select * from site where site_access != 0 and site_register !=0 order by rand()");
+	$realm = get_directory_realm();
+	if($realm == DIRECTORY_REALM) {
+		$r = q("select * from site where site_access != 0 and site_register !=0 and ( site_realm = '%s' or site_realm = '') order by rand()",
+			dbesc($realm)
+		);
+	}
+	else {
+		$r = q("select * from site where site_access != 0 and site_register !=0 and site_realm = '%s' order by rand()",
+			dbesc($realm)
+		);
+	}
+		
 	$ret = array('success' => false);
 
 	if($r) {
diff --git a/mod/display.php b/mod/display.php
index 31cce95d3..c389eb976 100644
--- a/mod/display.php
+++ b/mod/display.php
@@ -139,7 +139,9 @@ function display_content(&$a, $update = 0, $load = false) {
 
 	}
 
-	$sql_extra = public_permissions_sql(get_observer_hash());
+	$observer_hash = get_observer_hash();
+
+	$sql_extra = public_permissions_sql($observer_hash);
 
 	if(($update && $load) || ($_COOKIE['jsAvailable'] != 1)) {
 
@@ -170,12 +172,19 @@ function display_content(&$a, $update = 0, $load = false) {
 			}
 			if($r === null) {
 
+				// in case somebody turned off public access to sys channel content using permissions
+				// make that content unsearchable by ensuring the owner_xchan can't match
+
+				if(! perm_is_allowed($sys['channel_id'],$observer_hash,'view_stream'))
+					$sys['xchan_hash'] .= 'disabled';
+
+
 				$r = q("SELECT * from item
 					WHERE item_restrict = 0
 					and mid = '%s'
 					AND (((( `item`.`allow_cid` = ''  AND `item`.`allow_gid` = '' AND `item`.`deny_cid`  = '' 
 					AND `item`.`deny_gid`  = '' AND item_private = 0 ) 
-					and owner_xchan in ( " . stream_perms_xchans(($observer) ? (PERMS_NETWORK|PERMS_PUBLIC) : PERMS_PUBLIC) . " ))
+					and owner_xchan in ( " . stream_perms_xchans(($observer_hash) ? (PERMS_NETWORK|PERMS_PUBLIC) : PERMS_PUBLIC) . " ))
 					OR owner_xchan = '%s')
 					$sql_extra )
 					group by mid limit 1",
diff --git a/mod/frphotos.php b/mod/frphotos.php
new file mode 100644
index 000000000..8d6197fa3
--- /dev/null
+++ b/mod/frphotos.php
@@ -0,0 +1,87 @@
+<?php
+
+
+
+function frphotos_init(&$a) {
+
+	if(! local_user())
+		return;
+
+	if(intval(get_pconfig(local_user(),'frphotos','complete')))
+		return;
+
+	$channel = $a->get_channel();
+	
+	$fr_server = $_REQUEST['fr_server'];
+	$fr_username = $_REQUEST['fr_username'];
+	$fr_password = $_REQUEST['fr_password'];
+
+	$cookies = 'store/[data]/frphoto_cookie_' . $channel['channel_address'];
+
+	if($fr_server && $fr_username && $fr_password) {
+
+		$ch = curl_init($fr_server . '/api/friendica/photos/list');
+
+		curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
+       	curl_setopt ($ch, CURLOPT_COOKIEFILE, $cookies);
+        curl_setopt ($ch, CURLOPT_COOKIEJAR, $cookies);
+		curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
+		curl_setopt($ch, CURLOPT_USERPWD, $fr_username . ':' . $fr_password); 
+		curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);                          
+		curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);                           
+		curl_setopt($ch, CURLOPT_USERAGENT, 'RedMatrix');
+ 
+		$output = curl_exec($ch);
+		curl_close($ch);
+
+		$j = json_decode($output,true);
+
+//		echo print_r($j,true);
+
+		$total = 0;
+		if(count($j)) {
+			foreach($j as $jj) {
+
+				$r = q("select uid from photo where resource_id = '%s' and uid = %d limit 1",
+					dbesc($jj),
+					intval($channel['channel_id'])
+				);
+				if($r) 
+					continue;
+
+				$total ++;
+				proc_run('php','util/frphotohelper.php',$jj, $channel['channel_address'], urlencode($fr_server));
+				sleep(3);
+			}
+		}
+		if($total) {
+			set_pconfig(local_user(),'frphotos','complete','1');
+		}
+		@unlink($cookies);
+		goaway(z_root() . '/photos/' . $channel['channel_address']);
+	}
+}
+
+
+function frphotos_content(&$a) {
+
+	if(! local_user()) {
+		notice( t('Permission denied') . EOL);
+		return;
+	}
+
+	if(intval(get_pconfig(local_user(),'frphotos','complete'))) {
+		info('Friendica photos have already been imported into this channel.');
+		return;
+	}
+
+	$o = replace_macros(get_markup_template('frphotos.tpl'),array( 
+		'$header' => t('Friendica Photo Album Import'),
+		'$desc' => t('This will import all your Friendica photo albums to this Red channel.'),
+		'$fr_server' => array('fr_server', t('Friendica Server base URL'),'',''),
+		'$fr_username' => array('fr_username', t('Friendica Login Username'),'',''),
+		'$fr_password' => array('fr_password', t('Friendica Login Password'),'',''),
+		'$submit' => t('Submit'),
+	));
+	return $o;
+}
diff --git a/mod/hcard.php b/mod/hcard.php
new file mode 100644
index 000000000..3cb2fa01e
--- /dev/null
+++ b/mod/hcard.php
@@ -0,0 +1,54 @@
+<?php
+
+function hcard_init(&$a) {
+
+   if(argc() > 1)
+        $which = argv(1);
+    else {
+        notice( t('Requested profile is not available.') . EOL );
+        $a->error = 404;
+        return;
+    }
+
+    $profile = '';
+    $channel = $a->get_channel();
+
+    if((local_user()) && (argc() > 2) && (argv(2) === 'view')) {
+        $which = $channel['channel_address'];
+        $profile = argv(1);
+        $r = q("select profile_guid from profile where id = %d and uid = %d limit 1",
+            intval($profile),
+            intval(local_user())
+        );
+        if(! $r)
+            $profile = '';
+        $profile = $r[0]['profile_guid'];
+    }
+
+    $a->page['htmlhead'] .= '<link rel="alternate" type="application/atom+xml" href="' . $a->get_baseurl() . '/feed/' . $which .'" />' . "\r\n" ;
+
+    if(! $profile) {
+        $x = q("select channel_id as profile_uid from channel where channel_address = '%s' limit 1",
+            dbesc(argv(1))
+        );
+        if($x) {
+            $a->profile = $x[0];
+        }
+    }
+
+	profile_load($a,$which,$profile);
+
+
+}
+
+
+function hcard_content(&$a) {
+
+	require_once('include/widgets.php');
+	return widget_profile(array());
+
+
+
+}
+
+
diff --git a/mod/invite.php b/mod/invite.php
index 9e37d1e6d..12080c4d9 100644
--- a/mod/invite.php
+++ b/mod/invite.php
@@ -117,18 +117,6 @@ function invite_content(&$a) {
 		}
 	}			
 
-//	$dirloc = get_config('system','directory_submit_url');
-//	if(strlen($dirloc)) {
-//		if($a->config['system']['register_policy'] == REGISTER_CLOSED)
-//			$linktxt = sprintf( t('Visit %s for a list of public sites that you can join. Friendica members on other sites can all connect with each other, as well as with members of many other social networks.'), dirname($dirloc) . '/siteinfo');
-//		elseif($a->config['system']['register_policy'] != REGISTER_CLOSED)
-//			$linktxt = sprintf( t('To accept this invitation, please visit and register at %s or any other public Friendica website.'), $a->get_baseurl())
-//			. "\r\n" . "\r\n" . sprintf( t('Friendica sites all inter-connect to create a huge privacy-enhanced social web that is owned and controlled by its members. They can also connect with many traditional social networks. See %s for a list of alternate Friendica sites you can join.'),dirname($dirloc) . '/siteinfo');
-//	}
-//	else {
-//		$o = t('Our apologies. This system is not currently configured to connect with other public sites or invite members.');
-//		return $o;
-//	}
 
 	$ob = $a->get_observer();
 	if(! $ob)
@@ -141,18 +129,16 @@ function invite_content(&$a) {
 		'$invite' => t('Send invitations'),
 		'$addr_text' => t('Enter email addresses, one per line:'),
 		'$msg_text' => t('Your message:'),
-		'$default_message' => t('You are cordially invited to join me and some other close friends on the Red Matrix - a revolutionary new decentralised communication and information tool.') . "\r\n" . "\r\n"
+		'$default_message' => t('Please join my community on RedMatrix.') . "\r\n" . "\r\n"
 			. $linktxt
-			. (($invonly) ? "\r\n" . "\r\n" . t('You will need to supply this invitation code: $invite_code') . "\r\n" . "\r\n" : '') 
-			. t('Please visit my channel at')
+			. (($invonly) ? "\r\n" . "\r\n" . t('You will need to supply this invitation code: ') . $invite_code . "\r\n" . "\r\n" : '') 
+			. t('1. Register at any RedMatrix location (they are all inter-connected)')
+			. "\r\n" . "\r\n" . z_root() . '/register'
+			. "\r\n" . "\r\n" . t('2. Enter my RedMatrix network address into the site searchbar.')
+			. "\r\n" . "\r\n" . $ob['xchan_addr'] . ' (' . t('or visit ') . z_root() . '/channel/' . $channel['channel_address'] . ')'
 			. "\r\n" . "\r\n"
-			. z_root() . "/channel/" . $channel['channel_address']
-			. "\r\n" . "\r\n"
-						. t('Once you have registered (on ANY Red Matrix site - they are all inter-connected), please connect with my Red Matrix channel address:') 
-			. "\r\n" . "\r\n" . $ob['xchan_addr']
-			. "\r\n" . "\r\n" . t('Click the [Register] link on the following page to join.') . "\r\n" . "\r\n" . z_root()
-
-			. "\r\n" . "\r\n" . t('For more information about the Red Matrix Project and why it has the potential to change the internet as we know it, please visit http://getzot.com') . "\r\n" . "\r\n"  ,
+			. t('3. Click [Connect]')
+			. "\r\n" . "\r\n"  ,
 		'$submit' => t('Submit')
 	));
 
diff --git a/mod/item.php b/mod/item.php
index d4739244a..92dc3e7c6 100644
--- a/mod/item.php
+++ b/mod/item.php
@@ -81,7 +81,6 @@ function item_post(&$a) {
 	$layout_mid  = ((x($_REQUEST,'layout_mid'))  ? escape_tags($_REQUEST['layout_mid']): '');
 	$plink       = ((x($_REQUEST,'permalink'))   ? escape_tags($_REQUEST['permalink']) : '');
 
-
 	/*
 	Check service class limits
 	*/
@@ -258,8 +257,11 @@ function item_post(&$a) {
 		logger('mod_item: post accepted from ' . $observer['xchan_name'] . ' for ' . $owner_xchan['xchan_name'], LOGGER_DEBUG);
 	}
 		
-
-
+	$public_policy = ((x($_REQUEST,'public_policy')) ? escape_tags($_REQUEST['public_policy']) : map_scope($channel['channel_r_stream'],true));
+	if($webpage)
+		$public_policy = '';
+	if($public_policy)
+		$private = 1;
 
 	if($orig_post) {
 		$private = 0;
@@ -275,12 +277,14 @@ function item_post(&$a) {
 			$str_contact_allow = $orig_post['allow_cid'];
 			$str_group_deny    = $orig_post['deny_gid'];
 			$str_contact_deny  = $orig_post['deny_cid'];
+			$public_policy     = $orig_post['public_policy'];
 		}
 
 		if((strlen($str_group_allow)) 
 			|| strlen($str_contact_allow) 
 			|| strlen($str_group_deny) 
-			|| strlen($str_contact_deny)) {
+			|| strlen($str_contact_deny)
+			|| strlen($public_policy)) {
 			$private = 1;
 		}
 
@@ -344,6 +348,7 @@ function item_post(&$a) {
 				|| strlen($str_contact_allow) 
 				|| strlen($str_group_deny) 
 				|| strlen($str_contact_deny)
+				|| strlen($public_policy)
 		) ? 1 : 0);
 
 		// If this is a comment, set the permissions from the parent.
@@ -355,10 +360,12 @@ function item_post(&$a) {
 				|| strlen($parent_item['allow_cid']) 
 				|| strlen($parent_item['allow_gid']) 
 				|| strlen($parent_item['deny_cid']) 
-				|| strlen($parent_item['deny_gid'])) {
+				|| strlen($parent_item['deny_gid'])
+				|| strlen($parent_item['public_policy'])) {
 				$private = (($parent_item['item_private']) ? $parent_item['item_private'] : 1);
 			}
 
+			$public_policy     = $parent_item['public_policy'];
 			$str_contact_allow = $parent_item['allow_cid'];
 			$str_group_allow   = $parent_item['allow_gid'];
 			$str_contact_deny  = $parent_item['deny_cid'];
@@ -423,8 +430,8 @@ function item_post(&$a) {
 	if($mimetype === 'text/bbcode') {
 
 		if(local_user() && local_user() == $profile_uid && feature_enabled(local_user(),'markdown')) {
-			require_once('include/bb2diaspora.php');
-			$body = diaspora2bb($body,true);
+			require_once('include/bb2diaspora.php');			
+			$body = diaspora2bb(escape_tags($body),true);
 		}
 
 
@@ -705,6 +712,7 @@ function item_post(&$a) {
 	$datarray['item_restrict']  = $item_restrict;
 	$datarray['item_flags']     = $item_flags;
 	$datarray['layout_mid']     = $layout_mid;
+	$datarray['public_policy']  = $public_policy;
 	$datarray['comment_policy'] = map_scope($channel['channel_w_comment']); 
 	$datarray['term']           = $post_tags;
 	$datarray['plink']          = $plink;
@@ -1076,6 +1084,13 @@ function handle_tag($a, &$body, &$access_tag, &$str_tags, $profile_uid, $tag) {
 			else
 				$newname = str_replace('_',' ',$name);
 
+			// do this bit over since we started over with $name
+
+			if(substr($newname,-1,1) === '+') {
+				$forum = true;
+				$newname = substr($newname,0,-1);
+			}
+
 			//select someone from this user's contacts by name
 			$r = q("SELECT * FROM abook left join xchan on abook_xchan = xchan_hash  
 				WHERE xchan_name = '%s' AND abook_channel = %d LIMIT 1",
@@ -1087,7 +1102,7 @@ function handle_tag($a, &$body, &$access_tag, &$str_tags, $profile_uid, $tag) {
 				//select someone by attag or nick and the name passed in
 				$r = q("SELECT * FROM abook left join xchan on abook_xchan = xchan_hash  
 					WHERE xchan_addr like ('%s') AND abook_channel = %d LIMIT 1",
-						dbesc($newname . '@%'),
+						dbesc(((strpos($newname,'@')) ? $newname : $newname . '@%')),
 						intval($profile_uid)
 				);
 			}
@@ -1161,6 +1176,8 @@ function handle_tag($a, &$body, &$access_tag, &$str_tags, $profile_uid, $tag) {
 			}
 		}
 	}
+
+
 	return array('replaced' => $replaced, 'termtype' => $termtype, 'term' => $newname, 'url' => $url, 'contact' => $r[0]);
 }
 
diff --git a/mod/lockview.php b/mod/lockview.php
index 0ea708c80..8903bdec6 100644
--- a/mod/lockview.php
+++ b/mod/lockview.php
@@ -26,6 +26,11 @@ function lockview_content(&$a) {
 
 	$item = $r[0];
 
+	if(array_key_exists('public_policy',$item) && $item['public_policy']) {
+		echo '<li>' . translate_scope($item['public_policy']) . '</li>';
+		killme();
+	}
+
 	if($item['uid'] != local_user()) {
 		echo '<li>' . t('Remote privacy information not available.') . '</li>';
 		killme();
diff --git a/mod/mail.php b/mod/mail.php
index 6976209b7..b7297443c 100644
--- a/mod/mail.php
+++ b/mod/mail.php
@@ -229,7 +229,7 @@ function mail_content(&$a) {
 			'$attach' => t('Attach file'),
 			'$insert' => t('Insert web link'),
 			'$wait' => t('Please wait'),
-			'$submit' => t('Submit'),
+			'$submit' => t('Send'),
 			'$defexpire' => '',
 			'$feature_expire' => ((feature_enabled(local_user(),'content_expire')) ? true : false),
 			'$expires' => t('Set expiration date'),
diff --git a/mod/manage.php b/mod/manage.php
index 0772e2d61..1920967e6 100644
--- a/mod/manage.php
+++ b/mod/manage.php
@@ -52,6 +52,78 @@ function manage_content(&$a) {
 					$selected_channel = $channels[$x];
 				$channels[$x]['default'] = (($channels[$x]['channel_id'] == $account['account_default_channel']) ? "1" : ''); 
 				$channels[$x]['default_links'] = '1';
+
+
+				$c = q("SELECT id, item_restrict, item_flags FROM item
+					WHERE (item_restrict = %d) and ( item_flags & %d ) and uid = %d",
+					intval(ITEM_VISIBLE),
+					intval(ITEM_UNSEEN),
+					intval($channels[$x]['channel_id'])
+				);
+
+				if($c) {	
+					foreach ($c as $it) {
+						if($it['item_flags'] & ITEM_WALL)
+							$channels[$x]['home'] ++;
+						else
+							$channels[$x]['network'] ++;
+					}
+				}
+
+
+				$intr = q("SELECT COUNT(abook.abook_id) AS total FROM abook left join xchan on abook.abook_xchan = xchan.xchan_hash where abook_channel = %d and (abook_flags & %d) and not ((abook_flags & %d) or (xchan_flags & %d))",
+					intval($channels[$x]['channel_id']),
+					intval(ABOOK_FLAG_PENDING),
+					intval(ABOOK_FLAG_SELF|ABOOK_FLAG_IGNORED),
+					intval(XCHAN_FLAGS_DELETED|XCHAN_FLAGS_ORPHAN)
+				);
+
+				if($intr)
+					$channels[$x]['intros'] = intval($intr[0]['total']);
+
+
+				$mails = q("SELECT count(id) as total from mail WHERE channel_id = %d AND not (mail_flags & %d) and from_xchan != '%s' ",
+					intval($channels[$x]['channel_id']),
+					intval(MAIL_SEEN),		
+					dbesc($channels[$x]['channel_hash'])
+				);
+
+				if($mails)
+					$channels[$x]['mail'] = intval($mails[0]['total']);
+		
+
+				$events = q("SELECT type, start, adjust FROM `event`
+					WHERE `event`.`uid` = %d AND start < '%s' AND start > '%s' and `ignore` = 0
+					ORDER BY `start` ASC ",
+					intval($channels[$x]['channel_id']),
+					dbesc(datetime_convert('UTC', date_default_timezone_get(), 'now + 7 days')),
+					dbesc(datetime_convert('UTC', date_default_timezone_get(), 'now - 1 days'))
+				);
+
+				if($events) {
+					$channels[$x]['all_events'] = count($events);
+
+					if($channels[$x]['all_events']) {
+						$str_now = datetime_convert('UTC', date_default_timezone_get(), 'now', 'Y-m-d');
+						foreach($events as $e) {
+							$bd = false;
+							if($e['type'] === 'birthday') {
+								$channels[$x]['birthdays'] ++;
+								$bd = true;
+							}
+							else {
+								$channels[$x]['events'] ++;
+							}
+							if(datetime_convert('UTC', ((intval($e['adjust'])) ? date_default_timezone_get() : 'UTC'), $e['start'], 'Y-m-d') === $str_now) {
+								$channels[$x]['all_events_today'] ++;
+								if($bd)
+									$channels[$x]['birthdays_today'] ++;
+								else
+									$channels[$x]['events_today'] ++;
+							}
+						}
+					}
+				}
 			}
 		}
 		
@@ -72,7 +144,6 @@ function manage_content(&$a) {
 		array( 'new_channel', t('Create a new channel'), t('Create a new channel'))
 	);
 
-
 	$o = replace_macros(get_markup_template('channels.tpl'), array(
 		'$header'           => t('Channel Manager'),
 		'$msg_selected'     => t('Current Channel'),
diff --git a/mod/network.php b/mod/network.php
index f12471467..97870a6a1 100644
--- a/mod/network.php
+++ b/mod/network.php
@@ -315,6 +315,21 @@ function network_content(&$a, $update = 0, $load = false) {
 	}
 
 	$simple_update = (($update) ? " and ( item.item_flags & " . intval(ITEM_UNSEEN) . " ) " : '');
+
+	// This fixes a very subtle bug so I'd better explain it. You wake up in the morning or return after a day
+	// or three and look at your matrix page - after opening up your browser. The first page loads just as it 
+	// should. All of a sudden a few seconds later, page 2 will get inserted at the beginning of the page 
+	// (before the page 1 content). The update code is actually doing just what it's supposed
+	// to, it's fetching posts that have the ITEM_UNSEEN bit set. But the reason that page 2 content is being
+	// returned in an UPDATE is because you hadn't gotten that far yet - you're still on page 1 and everything 
+	// that we loaded for page 1 is now marked as seen. But the stuff on page 2 hasn't been. So... it's being
+	// treated as "new fresh" content because it is unseen. We need to distinguish it somehow from content 
+	// which "arrived as you were reading page 1". We're going to do this
+	// by storing in your session the current UTC time whenever you LOAD a network page, and only UPDATE items
+	// which are both ITEM_UNSEEN and have "changed" since that time. Cross fingers...
+
+	if($update && $_SESSION['loadtime']) 
+		$simple_update .= " and item.changed > '" . datetime_convert('UTC','UTC',$_SESSION['loadtime']) . "' "; 
 	if($load)
 		$simple_update = '';
 
@@ -345,6 +360,8 @@ function network_content(&$a, $update = 0, $load = false) {
 
 		if($load) {
 
+			$_SESSION['loadtime'] = datetime_convert();
+
 			// Fetch a page full of parent items for this page
 
 			$r = q("SELECT distinct item.id AS item_id FROM item 
diff --git a/mod/photos.php b/mod/photos.php
index c43beb8d4..428aff2a0 100644
--- a/mod/photos.php
+++ b/mod/photos.php
@@ -618,6 +618,12 @@ function photos_content(&$a) {
 
 	if($datatype === 'album') {
 
+		if((strlen($datum) & 1) || (! ctype_xdigit($datum))) {
+			notice( t('Album name could not be decoded') . EOL);
+			logger('mod_photos: illegal album encoding: ' . $datum);
+			$datum = '';
+		}
+
 		$album = hex2bin($datum);
 
 		$r = q("SELECT `resource_id`, max(`scale`) AS `scale` FROM `photo` WHERE `uid` = %d AND `album` = '%s' 
diff --git a/mod/profiles.php b/mod/profiles.php
index f6392d4ab..b938e836b 100644
--- a/mod/profiles.php
+++ b/mod/profiles.php
@@ -126,6 +126,33 @@ function profiles_init(&$a) {
 		return; // NOTREACHED
 	}
 
+	if((argc() > 2) && (argv(1) === 'export')) {
+		
+		$r1 = q("SELECT * FROM `profile` WHERE `uid` = %d AND `id` = %d LIMIT 1",
+			intval(local_user()),
+			intval(argv(2))
+		);
+		if(! $r1) {
+			notice( t('Profile unavailable to export.') . EOL);
+			$a->error = 404;
+			return;
+		}
+		header('content-type: application/octet_stream');
+		header('content-disposition: attachment; filename="' . $r1[0]['profile_name'] . '.json"' );
+
+		unset($r1[0]['id']);
+		unset($r1[0]['aid']);
+		unset($r1[0]['uid']);
+		unset($r1[0]['is_default']);
+		unset($r1[0]['publish']);
+		unset($r1[0]['profile_name']);
+		unset($r1[0]['profile_guid']);
+		echo json_encode($r1[0]);
+		killme();
+	}
+
+
+
 
 	// Run profile_load() here to make sure the theme is set before
 	// we start loading content
@@ -159,6 +186,33 @@ function profiles_post(&$a) {
 
 	call_hooks('profile_post', $_POST);
 
+	// import from json export file.
+ 	// Only import fields that are allowed on this hub
+
+	if(x($_FILES,'userfile')) {
+		$src      = $_FILES['userfile']['tmp_name'];
+		$filesize = intval($_FILES['userfile']['size']);
+		if($filesize) {
+			$j = @json_decode(@file_get_contents($src),true);
+			@unlink($src);
+			if($j) {
+				$fields = get_profile_fields_advanced();
+				if($fields) {
+					foreach($j as $jj => $v) {
+						foreach($fields as $f => $n) {
+							if($jj == $f) {
+								$_POST[$f] = $v;
+								break;
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+	
+
+
 	if((argc() > 1) && (argv(1) !== "new") && intval(argv(1))) {
 		$orig = q("SELECT * FROM `profile` WHERE `id` = %d AND `uid` = %d LIMIT 1",
 			intval($a->argv[1]),
@@ -178,6 +232,12 @@ function profiles_post(&$a) {
 			notify( t('Profile Name is required.') . EOL);
 			return;
 		}
+
+		if($_POST['dob']) {
+			$year = substr($_POST['dob'],0,4);
+			$month = substr($_POST['dob'],5,2);
+			$day = substr($_POST['dob'],8,2);
+		}
 	
 		$year = intval($_POST['year']);
 		if($year < 1900 || $year > 2100 || $year < 0)
@@ -458,11 +518,18 @@ function profiles_content(&$a) {
 
 	$o = '';
 
+	$channel = $a->get_channel();
+
 	if(! local_user()) {
 		notice( t('Permission denied.') . EOL);
 		return;
 	}
 
+	require_once('include/identity.php');
+
+	$profile_fields_basic    = get_profile_fields_basic();
+	$profile_fields_advanced = get_profile_fields_advanced();
+
 	if((argc() > 1) && (intval(argv(1)))) {
 		$r = q("SELECT * FROM `profile` WHERE `id` = %d AND `uid` = %d LIMIT 1",
 			intval($a->argv[1]),
@@ -485,6 +552,12 @@ function profiles_content(&$a) {
 			'$editselect' => $editselect,
 		));
 
+		$advanced = ((feature_enabled(local_user(),'advanced_profiles')) ? true : false);
+		if($advanced)
+			$fields = $profile_fields_advanced;
+		else
+			$fields = $profile_fields_basic;
+
 
 		$opt_tpl = get_markup_template("profile-hide_friends.tpl");
 		$hide_friends = replace_macros($opt_tpl,array(
@@ -505,19 +578,24 @@ function profiles_content(&$a) {
 		$o .= replace_macros($tpl,array(
 
 			'$form_security_token' => get_form_security_token("profile_edit"),
-			'$profile_clone_link'  => 'profiles/clone/' . $r[0]['id'] . '?t=' 
-				. get_form_security_token("profile_clone"),
+			'$profile_clone_link'  => ((feature_enabled(local_user(),'multi_profiles')) ? 'profiles/clone/' . $r[0]['id'] . '?t=' 
+				. get_form_security_token("profile_clone") : ''),
 			'$profile_drop_link'   => 'profiles/drop/' . $r[0]['id'] . '?t=' 
 				. get_form_security_token("profile_drop"),
 
+			'$fields'       => $fields,
 			'$guid'         => $r[0]['profile_guid'],
 			'$banner'       => t('Edit Profile Details'),
 			'$submit'       => t('Submit'),
 			'$viewprof'     => t('View this profile'),
+			'$editvis' 	    => t('Edit visibility'),
 			'$profpic'      => t('Change Profile Photo'),
 			'$cr_prof'      => t('Create a new profile using these settings'),
 			'$cl_prof'      => t('Clone this profile'),
 			'$del_prof'     => t('Delete this profile'),
+			'$exportable'   => feature_enabled(local_user(),'profile_export'),
+			'$lbl_import'   => t('Import profile from file'),
+			'$lbl_export'   => t('Export profile to file'),
 			'$lbl_profname' => t('Profile Name:'),
 			'$lbl_fullname' => t('Your Full Name:'),
 			'$lbl_title'    => t('Title/Description:'),
@@ -557,7 +635,9 @@ function profiles_content(&$a) {
 			'$baseurl'      => $a->get_baseurl(true),
 			'$profile_id'   => $r[0]['id'],
 			'$profile_name' => $r[0]['profile_name'],
-			'$default'      => (($is_default) ? '<p id="profile-edit-default-desc">' . t('This is your <strong>public</strong> profile.<br />It <strong>may</strong> be visible to anybody using the internet.') . '</p>' : ""),
+			'$is_default'   => $is_default,
+			'$default'      => t('This is your default profile.') . EOL . translate_scope(map_scope($channel['channel_r_profile'])),
+			'$advanced'     => $advanced,
 			'$name'         => $r[0]['name'],
 			'$pdesc'        => $r[0]['pdesc'],
 			'$dob'          => dob($r[0]['dob']),
@@ -569,10 +649,13 @@ function profiles_content(&$a) {
 			'$country_name' => $r[0]['country_name'],
 			'$age'          => ((intval($r[0]['dob'])) ? '(' . t('Age: ') . age($r[0]['dob'],$a->user['timezone'],$a->user['timezone']) . ')' : ''),
 			'$gender'       => gender_selector($r[0]['gender']),
+			'$gender_min'       => gender_selector_min($r[0]['gender']),
 			'$marital'      => marital_selector($r[0]['marital']),
+			'$marital_min'      => marital_selector_min($r[0]['marital']),
 			'$with'         => $r[0]['with'],
 			'$howlong'      => ($r[0]['howlong'] === '0000-00-00 00:00:00' ? '' : datetime_convert('UTC',date_default_timezone_get(),$r[0]['howlong'])),
 			'$sexual'       => sexpref_selector($r[0]['sexual']),
+			'$sexual_min'       => sexpref_selector_min($r[0]['sexual']),
 			'$about'        => $r[0]['about'],
 			'$homepage'     => $r[0]['homepage'],
 			'$hometown'     => $r[0]['hometown'],
@@ -624,7 +707,7 @@ function profiles_content(&$a) {
 					'$alt' => t('Profile Image'),
 					'$profile_name' => $rr['profile_name'],
 					'$visible' => (($rr['is_default']) 
-						? '<strong>' . t('visible to everybody') . '</strong>' 
+						? '<strong>' . translate_scope(map_scope($channel['channel_r_profile'])) . '</strong>' 
 						: '<a href="' . $a->get_baseurl(true) . '/profperm/' . $rr['id'] . '" />' . t('Edit visibility') . '</a>')
 				));
 			}
diff --git a/mod/receive.php b/mod/receive.php
new file mode 100644
index 000000000..c5a2dc4e0
--- /dev/null
+++ b/mod/receive.php
@@ -0,0 +1,76 @@
+<?php
+
+/**
+ * Diaspora endpoint
+ */
+
+
+//require_once('include/salmon.php');
+require_once('include/crypto.php');
+require_once('include/diaspora.php');
+
+	
+function receive_post(&$a) {
+
+
+	$enabled = intval(get_config('system','diaspora_enabled'));
+	if(! $enabled) {
+		logger('mod-diaspora: disabled');
+		http_status_exit(500);
+	}
+
+	$public = false;
+
+	if((argc() == 2) && (argv(1) === 'public')) {
+		$public = true;
+	}
+	else {
+
+		if(argc() != 3 || argv(1) !== 'users')
+			http_status_exit(500);
+
+		$guid = argv(2);
+
+		$r = q("SELECT * FROM channel left join account on account_id = channel_account_id WHERE channel_guid = '%s' AND account_flags = 0 LIMIT 1",
+			dbesc($guid)
+		);
+		if(! $r)
+			http_status_exit(500);
+
+		$importer = $r[0];
+	}
+
+	// It is an application/x-www-form-urlencoded that has been urlencoded twice.
+
+	logger('mod-diaspora: receiving post', LOGGER_DEBUG);
+
+	$xml = urldecode($_POST['xml']);
+
+	logger('mod-diaspora: new salmon ' . $xml, LOGGER_DATA);
+
+	if(! $xml)
+		http_status_exit(500);
+
+	logger('mod-diaspora: message is okay', LOGGER_DEBUG);
+
+	$msg = diaspora_decode($importer,$xml);
+
+	logger('mod-diaspora: decoded', LOGGER_DEBUG);
+
+	logger('mod-diaspora: decoded msg: ' . print_r($msg,true), LOGGER_DATA);
+
+	if(! is_array($msg))
+		http_status_exit(500);
+
+	logger('mod-diaspora: dispatching', LOGGER_DEBUG);
+
+	$ret = 0;
+	if($public)
+		diaspora_dispatch_public($msg);
+	else
+		$ret = diaspora_dispatch($importer,$msg);
+
+	http_status_exit(($ret) ? $ret : 200);
+	// NOTREACHED
+}
+
diff --git a/mod/removeaccount.php b/mod/removeaccount.php
new file mode 100644
index 000000000..1f9dbcafa
--- /dev/null
+++ b/mod/removeaccount.php
@@ -0,0 +1,66 @@
+<?php
+
+function removeaccount_post(&$a) {
+
+	if(! local_user())
+		return;
+
+	if(x($_SESSION,'submanage') && intval($_SESSION['submanage']))
+		return;
+
+	if((! x($_POST,'qxz_password')) || (! strlen(trim($_POST['qxz_password']))))
+		return;
+
+	if((! x($_POST,'verify')) || (! strlen(trim($_POST['verify']))))
+		return;
+
+	if($_POST['verify'] !== $_SESSION['remove_account_verify'])
+		return;
+
+
+	$account = $a->get_account();
+	$account_id = get_account_id();
+
+	if(! account_verify_password($account['account_email'],$_POST['qxz_password']))
+		return;
+
+	if($account['account_password_changed'] != '0000-00-00 00:00:00') {
+		$d1 = datetime_convert('UTC','UTC','now - 48 hours');
+		if($account['account_password_changed'] > d1) {
+			notice( t('Account removals are not allowed within 48 hours of changing the account password.') . EOL);
+			return;
+		}
+	}
+
+	require_once('include/Contact.php');
+
+	$global_remove = intval($_POST['global']);
+
+	account_remove($account_id,true);
+	
+}
+
+
+
+function removeaccount_content(&$a) {
+
+	if(! local_user())
+		goaway(z_root());
+
+	$hash = random_string();
+
+	$_SESSION['remove_account_verify'] = $hash;
+	$tpl = get_markup_template('removeaccount.tpl');
+	$o .= replace_macros($tpl, array(
+		'$basedir' => $a->get_baseurl(),
+		'$hash' => $hash,
+		'$title' => t('Remove This Account'),
+		'$desc' => t('This will completely remove this account including all its channels from the network. Once this has been done it is not recoverable.'),
+		'$passwd' => t('Please enter your password for verification:'),
+		'$global' => array('global', t('Remove this account, all its channels and all its channel clones from the network'), false, t('By default only the instances of the channels located on this hub will be removed from the network')),
+		'$submit' => t('Remove Account')
+	));
+
+	return $o;		
+
+}
\ No newline at end of file
diff --git a/mod/removeme.php b/mod/removeme.php
index f0b4ae3c0..13bf6cf63 100644
--- a/mod/removeme.php
+++ b/mod/removeme.php
@@ -23,11 +23,19 @@ function removeme_post(&$a) {
 	if(! account_verify_password($account['account_email'],$_POST['qxz_password']))
 		return;
 
+	if($account['account_password_changed'] != '0000-00-00 00:00:00') {
+		$d1 = datetime_convert('UTC','UTC','now - 48 hours');
+		if($account['account_password_changed'] > d1) {
+			notice( t('Channel removals are not allowed within 48 hours of changing the account password.') . EOL);
+			return;
+		}
+	}
+
 	require_once('include/Contact.php');
 
 	$global_remove = intval($_POST['global']);
 
-	channel_remove(local_user(),1 - $global_remove);
+	channel_remove(local_user(),1 - $global_remove,true);
 
 }
 
diff --git a/mod/rpost.php b/mod/rpost.php
index 80406ebef..933db24e3 100644
--- a/mod/rpost.php
+++ b/mod/rpost.php
@@ -115,7 +115,7 @@ function rpost_content(&$a) {
 		'nickname' => $channel['channel_address'],
 		'lockstate' => (($channel['channel_allow_cid'] || $channel['channel_allow_gid'] 
 			|| $channel['channel_deny_cid'] || $channel['channel_deny_gid']) ? 'lock' : 'unlock'),
-		'acl' => populate_acl($channel, $false),
+		'acl' => populate_acl($channel),
 		'bang' => '',
 //		'channel_select' => true,
 		'visitor' => true,
diff --git a/mod/search.php b/mod/search.php
index 663d355e2..15ac71376 100644
--- a/mod/search.php
+++ b/mod/search.php
@@ -23,6 +23,7 @@ function search_content(&$a,$update = 0, $load = false) {
 
 
 	$observer = $a->get_observer();
+	$observer_hash = (($observer) ? $observer['xchan_hash'] : '');
 
 	$o = '<div id="live-search"></div>' . "\r\n";
 
@@ -113,7 +114,7 @@ function search_content(&$a,$update = 0, $load = false) {
 
 	}
 
-	$pub_sql = public_permissions_sql(get_observer_hash());
+	$pub_sql = public_permissions_sql($observer_hash);
 
 	require_once('include/identity.php');
 
@@ -124,6 +125,11 @@ function search_content(&$a,$update = 0, $load = false) {
 		$a->set_pager_itemspage(((intval($itemspage)) ? $itemspage : 20));
 		$pager_sql = sprintf(" LIMIT %d, %d ",intval($a->pager['start']), intval($a->pager['itemspage']));
 
+		// in case somebody turned off public access to sys channel content with permissions
+
+		if(! perm_is_allowed($sys['channel_id'],$observer_hash,'view_stream'))
+			$sys['xchan_hash'] .= 'disabled';
+
 		if($load) {
 			$r = null;
 
diff --git a/mod/settings.php b/mod/settings.php
index e036755fc..d6ebf9e90 100644
--- a/mod/settings.php
+++ b/mod/settings.php
@@ -135,6 +135,7 @@ function settings_post(&$a) {
 
 		$theme = ((x($_POST,'theme')) ? notags(trim($_POST['theme']))  : $a->channel['channel_theme']);
 		$mobile_theme = ((x($_POST,'mobile_theme')) ? notags(trim($_POST['mobile_theme']))  : '');
+		$user_scalable = ((x($_POST,'user_scalable')) ? intval($_POST['user_scalable'])  : 0);
 		$nosmile = ((x($_POST,'nosmile')) ? intval($_POST['nosmile'])  : 0);  
 		$browser_update   = ((x($_POST,'browser_update')) ? intval($_POST['browser_update']) : 0);
 		$browser_update   = $browser_update * 1000;
@@ -151,7 +152,7 @@ function settings_post(&$a) {
 		}
 
 //		$chanview_full = ((x($_POST,'chanview_full')) ? intval($_POST['chanview_full']) : 0);
-
+		set_pconfig(local_user(),'system','user_scalable',$user_scalable);
 		set_pconfig(local_user(),'system','update_interval', $browser_update);
 		set_pconfig(local_user(),'system','itemspage', $itemspage);
 		set_pconfig(local_user(),'system','no_smilies',$nosmile);
@@ -202,10 +203,11 @@ function settings_post(&$a) {
 			if(! $errs) {
 				$salt = random_string(32);
 				$password_encoded = hash('whirlpool', $salt . $newpass);
-				$r = q("update account set account_salt = '%s', account_password = '%s' 
+				$r = q("update account set account_salt = '%s', account_password = '%s', account_password_changed = '%s' 
 					where account_id = %d limit 1",
 					dbesc($salt),
 					dbesc($password_encoded),
+					dbesc(datetime_convert()),
 					intval(get_account_id())
 				);
 				if($r)
@@ -627,6 +629,7 @@ function settings_content(&$a) {
 			'$submit' 	=> t('Submit'),
 			'$email' 	=> array('email', t('Email Address:'), $email, ''),
 			'$removeme' => t('Remove Account'),
+			'$removeaccount' => t('Remove this account from this server including all its channels'),
 			'$permanent' => t('Warning: This action is permanent and cannot be reversed.'),
 			'$account_settings' => $account_settings
 		));
@@ -726,6 +729,9 @@ function settings_content(&$a) {
 		}
 		$theme_selected = (!x($_SESSION,'theme')? $default_theme : $_SESSION['theme']);
 		$mobile_theme_selected = (!x($_SESSION,'mobile_theme')? $default_mobile_theme : $_SESSION['mobile_theme']);
+
+		$user_scalable = get_pconfig(local_user(),'system','user_scalable');
+		$user_scalable = (($user_scalable===false)? '1': $user_scalable); // default if not set: 1
 		
 		$browser_update = intval(get_pconfig(local_user(), 'system','update_interval'));
 		$browser_update = (($browser_update == 0) ? 40 : $browser_update / 1000); // default if not set: 40 seconds
@@ -752,11 +758,13 @@ function settings_content(&$a) {
 		
 			'$theme'	=> array('theme', t('Display Theme:'), $theme_selected, '', $themes, 'preview'),
 			'$mobile_theme'	=> array('mobile_theme', t('Mobile Theme:'), $mobile_theme_selected, '', $mobile_themes, ''),
+			'$user_scalable' => array('user_scalable', t("Enable user zoom on mobile devices"), $user_scalable, ''),
 			'$ajaxint'   => array('browser_update',  t("Update browser every xx seconds"), $browser_update, t('Minimum of 10 seconds, no maximum')),
 			'$itemspage'   => array('itemspage',  t("Maximum number of conversations to load at any time:"), $itemspage, t('Maximum of 100 items')),
 			'$nosmile'	=> array('nosmile', t("Don't show emoticons"), $nosmile, ''),
 			'$layout_editor' => t('System Page Layout Editor - (advanced)'),
 			'$theme_config' => $theme_config,
+			'$expert' => feature_enabled(local_user(),'expert'),
 		));
 		
 		return $o;
diff --git a/mod/setup.php b/mod/setup.php
index ad5394335..a8f3a1f47 100755
--- a/mod/setup.php
+++ b/mod/setup.php
@@ -569,7 +569,7 @@ function check_htaccess(&$checks) {
 				$help = t('SSL certificate cannot be validated. Fix certificate or disable https access to this site.') . EOL;
 				$help .= t('If you have https access to your website or allow connections to TCP port 443 (the https: port), you MUST use a browser-valid certificate. You MUST NOT use self-signed certificates!') . EOL;
 				$help .= t('This restriction is incorporated because public posts from you may for example contain references to images on your own hub.') . EOL;
-				$help .= t('If your certificate is not recognised, members of other sites (who may themselves have valid certificates) will get a warning message on their own site complaining about security issues.') . EOL;
+				$help .= t('If your certificate is not recognized, members of other sites (who may themselves have valid certificates) will get a warning message on their own site complaining about security issues.') . EOL;
 				$help .= t('This can cause usability issues elsewhere (not just on your own site) so we must insist on this requirement.') .EOL;
 				$help .= t('Providers are available that issue free certificates which are browser-valid.'). EOL;
 
diff --git a/mod/siteinfo.php b/mod/siteinfo.php
index bdf9b1af6..9674965e1 100644
--- a/mod/siteinfo.php
+++ b/mod/siteinfo.php
@@ -95,7 +95,7 @@ function siteinfo_content(&$a) {
 
 	$o = replace_macros(get_markup_template('siteinfo.tpl'), array(
                 '$title' => t('Red'),
-		'$description' => t('This is a hub of the Red Matrix - a global cooperative network of decentralised privacy enhanced websites.'),
+		'$description' => t('This is a hub of the Red Matrix - a global cooperative network of decentralized privacy enhanced websites.'),
 		'$version' => $version,
 		'$commit' => $commit,
 		'$web_location' => t('Running at web location') . ' ' . z_root(),
diff --git a/mod/sitelist.php b/mod/sitelist.php
index 1e6d0fcfb..95cf862df 100644
--- a/mod/sitelist.php
+++ b/mod/sitelist.php
@@ -18,6 +18,12 @@ function sitelist_init(&$a) {
 	if($open)
 		$sql_extra = " and site_register = " . intval(REGISTER_OPEN) . " ";
 
+	$realm = get_directory_realm();
+	if($realm == DIRECTORY_REALM) {
+		$sql_extra .= " and ( site_realm = '" . dbesc($realm) . "' or site_realm = '') ";
+	}
+	else
+		$sql_extra .= " and site_realm = '" . dbesc($realm) . "' ";
 
 	$result = array('success' => false);
 
diff --git a/mod/thing.php b/mod/thing.php
index b6d59a3ee..73722c5fa 100644
--- a/mod/thing.php
+++ b/mod/thing.php
@@ -321,7 +321,7 @@ function thing_content(&$a) {
 		'$profile_lbl' => t('Select a profile'),
 		'$profile_select' => contact_profile_assign(''),
 		'$verb_lbl' => $channel['channel_name'],
-		'$activity' => array('activity',t('Post an activity'),true,t('Only sends to viewers of the applicable profile')),
+		'$activity' => array('activity',t('Post an activity'),((array_key_exists('activity',$_REQUEST)) ? $_REQUEST['activity'] : true),t('Only sends to viewers of the applicable profile')),
 		'$verb_select' => obj_verb_selector(),
 		'$thing_lbl' => t('Name of thing e.g. something'),
 		'$url_lbl' => t('URL of thing (optional)'),
diff --git a/mod/zfinger.php b/mod/zfinger.php
index d1493da03..cf8a3fda1 100644
--- a/mod/zfinger.php
+++ b/mod/zfinger.php
@@ -297,6 +297,7 @@ function zfinger_init(&$a) {
 		$ret['site']['sitename'] = get_config('system','sitename');
 		$ret['site']['sellpage'] = get_config('system','sellpage');
 		$ret['site']['location'] = get_config('system','site_location');
+		$ret['site']['realm'] = get_directory_realm();
 
 	}
 	call_hooks('zot_finger',$ret);