11 files changed, 126 insertions, 41 deletions

diff --git a/include/RedDAV/RedBrowser.php b/include/RedDAV/RedBrowser.php
index dcd54ef82..6639250ae 100644
--- a/include/RedDAV/RedBrowser.php
+++ b/include/RedDAV/RedBrowser.php
@@ -41,7 +41,7 @@ class RedBrowser extends DAV\Browser\Plugin {
 	 */
 	public function __construct(&$auth) {
 		$this->auth = $auth;
-		parent::__construct(false, false);
+		parent::__construct(true, false);
 	}
 
 	/**
diff --git a/include/apps.php b/include/apps.php
index 91012b0ef..cd0c2984e 100644
--- a/include/apps.php
+++ b/include/apps.php
@@ -11,7 +11,10 @@ require_once('include/identity.php');
 function get_system_apps() {
 
 	$ret = array();
-	$files = glob('app/*.apd');
+	if(is_dir('apps'))
+		$files = glob('apps/*.apd');
+	else
+		$files = glob('app/*.apd');
 	if($files) {
 		foreach($files as $f) {
 			$x = parse_app_description($f);
diff --git a/include/bb2diaspora.php b/include/bb2diaspora.php
index 089838e97..a80b3343b 100644
--- a/include/bb2diaspora.php
+++ b/include/bb2diaspora.php
@@ -263,6 +263,17 @@ function bb2dmention_callback($match) {
 
 function bb2diaspora_itemwallwall(&$item) {
 
+	$author_exists = true;
+	if(! array_key_exists('author',$item)) {
+		$author_exists = false;
+		logger('bb2diaspora_itemwallwall: no author');
+		$r = q("select * from xchan where xchan_hash = '%s' limit 1",
+			dbesc($item['author_xchan'])
+		);
+		if($r)
+			$item['author'] = $r[0];
+	}
+
 	if(($item['mid'] == $item['parent_mid']) && ($item['author_xchan'] != $item['owner_xchan']) && (is_array($item['author']))) {
 		logger('bb2diaspora_itemwallwall: author: ' . print_r($item['author'],true), LOGGER_DEBUG);
 	}
@@ -275,6 +286,11 @@ function bb2diaspora_itemwallwall(&$item) {
 			. '[url=' . $item['author']['xchan_url'] . ']' . $item['author']['xchan_name'] . '[/url]' . "\n\n" 
 			. $item['body'];
 	}
+	// $item['author'] might cause a surprise further down the line if it wasn't expected to be here.
+ 
+	if(! $author_exists)
+		$unset($item['author']);
+
 }
 
 
diff --git a/include/bbcode.php b/include/bbcode.php
index d7a5ac457..6b7217f91 100644
--- a/include/bbcode.php
+++ b/include/bbcode.php
@@ -162,7 +162,7 @@ function bb_parse_app($match) {
 function bb_parse_element($match) {
 	$j = json_decode(base64url_decode($match[1]),true);
 	if($j) {
-		$o = EOL . '<a href="' . z_root() . '" foo="baz" onclick="importElement(\'' . $match[1] . '\'); return false;" >' . t('Install design element: ') . $j['pagetitle'] . '</a>' . EOL; 
+		$o = EOL . '<a href="#" onclick="importElement(\'' . $match[1] . '\'); return false;" >' . t('Install design element: ') . $j['pagetitle'] . '</a>' . EOL; 
 	}
 	return $o;
 }
@@ -823,7 +823,7 @@ function bbcode($Text,$preserve_nl = false, $tryoembed = true) {
 	// fix any escaped ampersands that may have been converted into links
 	$Text = preg_replace("/\<(.*?)(src|href)=(.*?)\&amp\;(.*?)\>/ism",'<$1$2=$3&$4>',$Text);
 
-	$Text = preg_replace("/\<(.*?)(src|href)=\"[^hfm](.*?)\>/ism",'<$1$2="">',$Text);
+	$Text = preg_replace("/\<(.*?)(src|href)=\"[^hfm#](.*?)\>/ism",'<$1$2="">',$Text);
 
 	call_hooks('bbcode',$Text);
 
diff --git a/include/diaspora.php b/include/diaspora.php
index f0687e51e..fb321a813 100755
--- a/include/diaspora.php
+++ b/include/diaspora.php
@@ -821,7 +821,7 @@ function diaspora_post($importer,$xml,$msg) {
 
 		foreach($tags as $tag) {
 			if(strpos($tag,'#') === 0) {
-				if(strpos($tag,'[url='))
+				if((strpos($tag,'[url=')) || (strpos($tag,'[zrl')))
 					continue;
 
 				// don't link tags that are already embedded in links
@@ -1050,7 +1050,7 @@ function diaspora_reshare($importer,$xml,$msg) {
 
 		foreach($tags as $tag) {
 			if(strpos($tag,'#') === 0) {
-				if(strpos($tag,'[url='))
+				if((strpos($tag,'[url=')) || (strpos($tag,'[zrl')))
 					continue;
 
 				// don't link tags that are already embedded in links
@@ -1087,7 +1087,7 @@ function diaspora_reshare($importer,$xml,$msg) {
 		}
 	}
 
-	// This won't work
+	// This won't work on redmatrix
 	$plink = 'https://'.substr($diaspora_handle,strpos($diaspora_handle,'@')+1).'/posts/'.$guid;
 
 	$datarray['uid'] = $importer['channel_id'];
@@ -1337,7 +1337,7 @@ function diaspora_comment($importer,$xml,$msg) {
 
 		foreach($tags as $tag) {
 			if(strpos($tag,'#') === 0) {
-				if(strpos($tag,'[url='))
+				if((strpos($tag,'[url=')) || (strpos($tag,'[zrl')))
 					continue;
 
 				// don't link tags that are already embedded in links
@@ -1379,6 +1379,8 @@ function diaspora_comment($importer,$xml,$msg) {
 	$datarray['mid'] = $guid;
 	$datarray['parent_mid'] = $parent_item['mid'];
 
+	// set the route to that of the parent so downstream hubs won't reject it.
+	$datarray['route'] = $parent_item['route'];
 
 	// No timestamps for comments? OK, we'll the use current time.
 	$datarray['changed'] = $datarray['created'] = $datarray['edited'] = datetime_convert();
@@ -1404,13 +1406,6 @@ function diaspora_comment($importer,$xml,$msg) {
 		$message_id = $result['item_id'];
 
 	if(($parent_item['item_flags'] & ITEM_ORIGIN) && (! $parent_author_signature)) {
-		q("insert into sign (`iid`,`signed_text`,`signature`,`signer`) values (%d,'%s','%s','%s') ",
-			intval($message_id),
-			dbesc($signed_data),
-			dbesc(base64_encode($author_signature)),
-			dbesc($diaspora_handle)
-		);
-
 		// if the message isn't already being relayed, notify others
 		// the existence of parent_author_signature means the parent_author or owner
 		// is already relaying.
@@ -1968,6 +1963,9 @@ function diaspora_like($importer,$xml,$msg) {
 
 	$arr['app']  = 'Diaspora';
 
+	// set the route to that of the parent so downstream hubs won't reject it.
+	$arr['route'] = $parent_item['route'];
+
 	$arr['item_private'] = $parent_item['item_private'];
 	$arr['verb'] = $activity;
 	$arr['obj_type'] = $objtype;
@@ -2446,6 +2444,7 @@ function diaspora_send_followup($item,$owner,$contact,$public_batch = false) {
 	else
 		return;
 
+
 	if(($item['verb'] === ACTIVITY_LIKE) && ($parent['mid'] === $parent['parent_mid'])) {
 		$tpl = get_markup_template('diaspora_like.tpl');
 		$like = true;
diff --git a/include/externals.php b/include/externals.php
index acfaae3b6..280daf4a4 100644
--- a/include/externals.php
+++ b/include/externals.php
@@ -85,6 +85,8 @@ function externals_run($argv, $argc){
 				if($j['success'] && $j['messages']) {
 					$sys = get_sys_channel();
 					foreach($j['messages'] as $message) {
+						// on these posts, clear any route info. 
+						$message['route'] = '';
 						$results = process_delivery(array('hash' => 'undefined'), get_item_elements($message),
 							array(array('hash' => $sys['xchan_hash'])), false, true);
 						$total ++;
diff --git a/include/identity.php b/include/identity.php
index fafb97bbb..4417f4028 100644
--- a/include/identity.php
+++ b/include/identity.php
@@ -1525,4 +1525,36 @@ function get_profile_fields_advanced($filter = 0) {
 	return $x;
 }
 
+/**
+ * @function notifications_off($channel_id)
+ *    Clear notifyflags for a channel - most likely during bulk import of content or other activity that is likely
+ *    to generate huge amounts of undesired notifications.
+ * @param int $channel_id
+ *    The channel to disable notifications for
+ * @returns int
+ *    Current notification flag value. Send this to notifications_on() to restore the channel settings when finished
+ *    with the activity requiring notifications_off(); 
+ */
+
+
 
+function notifications_off($channel_id) {
+	$r = q("select channel_notifyflags from channel where channel_id = %d limit 1",
+		intval($channel_id)
+	);
+	$x = q("update channel set channel_notifyflags = 0 where channel_id = %d limit 1",
+		intval($channel_id)
+	);
+
+	return intval($r[0]['channel_notifyflags']);
+
+}
+
+
+function notifications_on($channel_id,$value) {
+	$x = q("update channel set channel_notifyflags = %d where channel_id = %d limit 1",
+		intval($value),
+		intval($channel_id)
+	);
+	return $x;
+}
\ No newline at end of file
diff --git a/include/items.php b/include/items.php
index c9810bb7c..c4ae948b8 100755
--- a/include/items.php
+++ b/include/items.php
@@ -2072,6 +2072,7 @@ function item_store($arr,$allow_exec = false) {
 				return $ret;
 			}
 
+
 			// is the new message multi-level threaded?
 			// even though we don't support it now, preserve the info
 			// and re-attach to the conversation parent.
@@ -2414,7 +2415,7 @@ function item_store_update($arr,$allow_exec = false) {
 	$arr['commented']     = $orig[0]['commented'];
 	$arr['received']      = datetime_convert();
 	$arr['changed']       = datetime_convert();
-
+	$arr['route']         = ((array_key_exists('route',$arr)) ? trim($arr['route'])          : $orig[0]['route']);
 	$arr['diaspora_meta'] = ((x($arr,'diaspora_meta')) ? $arr['diaspora_meta']               : $orig[0]['diaspora_meta']);
 	$arr['location']      = ((x($arr,'location'))      ? notags(trim($arr['location']))      : $orig[0]['location']);
 	$arr['coord']         = ((x($arr,'coord'))         ? notags(trim($arr['coord']))         : $orig[0]['coord']);
@@ -2522,12 +2523,6 @@ function store_diaspora_comment_sig($datarray, $channel, $parent_item, $post_id)
 
 	// since Diaspora doesn't handle edits we can only do this for the original text and not update it.
 
-	$enabled = intval(get_config('system','diaspora_enabled'));
-	if(! $enabled) {
-		logger('mod_item: diaspora support disabled, not storing comment signature', LOGGER_DEBUG);
-		return;
-	}
-
 	require_once('include/bb2diaspora.php');
 	$signed_body = bb2diaspora_itembody($datarray);
 
@@ -2552,12 +2547,6 @@ function store_diaspora_comment_sig($datarray, $channel, $parent_item, $post_id)
 		intval($post_id) 
 	);
 
-	$r = q("insert into sign (`iid`,`signed_text`,`signature`,`signer`) values (%d,'%s','%s','%s') ",
-		intval($post_id),
-		dbesc($signed_text),
-		dbesc(base64_encode($authorsig)),
-		dbesc($diaspora_handle)
-	);
 	if(! $r)
 		logger('store_diaspora_comment_sig: DB write failed');
 
diff --git a/include/nav.php b/include/nav.php
index 7c9abce49..4f7d609aa 100644
--- a/include/nav.php
+++ b/include/nav.php
@@ -130,7 +130,7 @@ EOT;
 
 	if($observer) {
 			$userinfo = array(
-			'icon' => $observer['xchan_photo_m'],
+			'icon' => $observer['xchan_photo_s'],
 			'name' => $observer['xchan_addr'],
 		);
 	}
diff --git a/include/oembed.php b/include/oembed.php
index 8ce0fee96..e08b287d1 100755
--- a/include/oembed.php
+++ b/include/oembed.php
@@ -92,7 +92,8 @@ function oembed_fetch_url($embedurl){
 function oembed_format_object($j){
 	$a = get_app();
     $embedurl = $j->embedurl;
-	$jhtml = oembed_iframe($j->embedurl,(isset($j->width) ? $j->width : null), (isset($j->height) ? $j->height : null) );
+
+	$jhtml = oembed_iframe($j->embedurl,(isset($j->width) ? $j->width : null), (isset($j->height) ? $j->height : null));
 
 	$ret="<span class='oembed ".$j->type."'>";
 	switch ($j->type) {
@@ -127,7 +128,6 @@ function oembed_format_object($j){
 		}; break;
 		case "photo": {
 			$ret.= "<img width='".$j->width."' src='".$j->url."'>";
-			//$ret.= "<img width='".$j->width."' height='".$j->height."' src='".$j->url."'>";
 			$ret.="<br>";
 		}; break;  
 		case "link": {
@@ -163,13 +163,12 @@ function oembed_iframe($src,$width,$height) {
 	$height = intval($height) + 80;
 	$width  = intval($width) + 40;
 
-	$a = get_app();
-
-	$sandbox = ((strpos($src,get_app()->get_hostname())) ? ' sandbox="allow-scripts" ' : '');
+	$s = z_root() . '/oembed/' . base64url_encode($src);
 
-	$s = $a->get_baseurl()."/oembed/".base64url_encode($src);
+	// Make sure any children are sandboxed within their own iframe.
 
-	return '<iframe ' . $sandbox . ' height="' . $height . '" width="' . $width . '" src="' . $s . '" frameborder="no" >' . t('Embedded content') . '</iframe>'; 
+	return '<iframe height="' . $height . '" width="' . $width . '" src="' . $s . '" frameborder="no" >' 
+		. t('Embedded content') . '</iframe>'; 
 
 }
 
diff --git a/include/zot.php b/include/zot.php
index 3d59f00f3..fda2a2bea 100644
--- a/include/zot.php
+++ b/include/zot.php
@@ -1402,6 +1402,7 @@ function process_delivery($sender,$arr,$deliveries,$relay,$public = false) {
 
 		$perm = (($arr['mid'] == $arr['parent_mid']) ? 'send_stream' : 'post_comments');
 
+
 		// This is our own post, possibly coming from a channel clone
 
 		if($arr['owner_xchan'] == $d['hash']) {
@@ -1419,7 +1420,44 @@ function process_delivery($sender,$arr,$deliveries,$relay,$public = false) {
 			$result[] = array($d['hash'],'permission denied',$channel['channel_name'] . ' <' . $channel['channel_address'] . '@' . get_app()->get_hostname() . '>',$arr['mid']);
 			continue;
 		}
-	
+
+		if($arr['mid'] != $arr['parent_mid']) {
+
+			// check source route.
+			// We are only going to accept comments from this sender if the comment has the same route as the top-level-post,
+			// this is so that permissions mismatches between senders apply to the entire conversation
+			// As a side effect we will also do a preliminary check that we have the top-level-post, otherwise
+			// processing it is pointless. 
+
+			$r = q("select route from item where mid = '%s' and uid = %d limit 1",
+				dbesc($arr['parent_mid']),
+				intval($channel['channel_id'])
+			);
+			if(! $r) {
+				$result[] = array($d['hash'],'comment parent not found',$channel['channel_name'] . ' <' . $channel['channel_address'] . '@' . get_app()->get_hostname() . '>',$arr['mid']);
+				continue;
+			}
+			if($relay) {
+				// reset the route in case it travelled a great distance upstream
+				// use our parent's route so when we go back downstream we'll match
+				// with whatever route our parent has.
+				$arr['route'] = $r[0]['route'];
+			}
+			else {
+
+				// going downstream check that we have the same upstream provider that
+				// sent it to us originally. Ignore it if it came from another source
+				// (with potentially different permissions)
+
+				$current_route = (($arr['route']) ? $arr['route'] . ',' : '') . $sender['hash'];
+
+				if($r[0]['route'] != $current_route) {
+					$result[] = array($d['hash'],'comment route mismatch',$channel['channel_name'] . ' <' . $channel['channel_address'] . '@' . get_app()->get_hostname() . '>',$arr['mid']);
+					continue;
+				}
+			}
+		}
+
 		if($arr['item_restrict'] & ITEM_DELETED) {
 
 			// remove_community_tag is a no-op if this isn't a community tag activity
@@ -1442,13 +1480,18 @@ function process_delivery($sender,$arr,$deliveries,$relay,$public = false) {
 			intval($channel['channel_id'])
 		);
 		if($r) {
+			$item_id = $r[0]['id'];
 			if($arr['edited'] > $r[0]['edited']) {
 				$arr['id'] = $r[0]['id'];
 				$arr['uid'] = $channel['channel_id'];
 				update_imported_item($sender,$arr,$channel['channel_id']);
-			}	
-			$result[] = array($d['hash'],'updated',$channel['channel_name'] . ' <' . $channel['channel_address'] . '@' . get_app()->get_hostname() . '>',$arr['mid']);
-			$item_id = $r[0]['id'];
+				$result[] = array($d['hash'],'updated',$channel['channel_name'] . ' <' . $channel['channel_address'] . '@' . get_app()->get_hostname() . '>',$arr['mid']);
+				if(! $relay)
+					add_source_route($item_id,$sender['hash']);
+			}
+			else {
+				$result[] = array($d['hash'],'update ignored',$channel['channel_name'] . ' <' . $channel['channel_address'] . '@' . get_app()->get_hostname() . '>',$arr['mid']);
+			}
 		}
 		else {
 			$arr['aid'] = $channel['channel_account_id'];
@@ -1459,7 +1502,9 @@ function process_delivery($sender,$arr,$deliveries,$relay,$public = false) {
 				$item_id = $item_result['item_id'];
 				$parr = array('item_id' => $item_id,'item' => $arr,'sender' => $sender,'channel' => $channel);
 				call_hooks('activity_received',$parr);
-				add_source_route($item_id,$sender['hash']);
+				// don't add a source route if it's a relay or later recipients will get a route mismatch
+				if(! $relay)
+					add_source_route($item_id,$sender['hash']);
 			}
 			$result[] = array($d['hash'],(($item_id) ? 'posted' : 'storage failed:' . $item_result['message']),$channel['channel_name'] . ' <' . $channel['channel_address'] . '@' . get_app()->get_hostname() . '>',$arr['mid']);
 		}