From 755b75161494ea9810ab0e38242cb1a318793ed3 Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Wed, 15 Mar 2017 16:55:47 -0700
Subject: Comanche: allow widgets to be class based and stored appropriately in
 Zotlabs

---
 include/widgets.php | 16 ----------------
 1 file changed, 16 deletions(-)

(limited to 'include')

diff --git a/include/widgets.php b/include/widgets.php
index c88c03f7e..54390ede4 100644
--- a/include/widgets.php
+++ b/include/widgets.php
@@ -174,22 +174,6 @@ function widget_follow($args) {
 }
 
 
-function widget_notes($arr) {
-	if(! local_channel())
-		return '';
-	if(! feature_enabled(local_channel(),'private_notes'))
-		return '';
-
-	$text = get_pconfig(local_channel(),'notes','text');
-
-	$o = replace_macros(get_markup_template('notes.tpl'), array(
-		'$banner' => t('Notes'),
-		'$text' => $text,
-		'$save' => t('Save'),
-	));
-
-	return $o;
-}
 
 
 function widget_savedsearch($arr) {
-- 
cgit v1.2.3


From 477ed97c2fbfff903f9ebf0ffa7fba078eeac10f Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Wed, 15 Mar 2017 18:31:34 -0700
Subject: convert more widgets to classes

---
 include/widgets.php | 133 ----------------------------------------------------
 1 file changed, 133 deletions(-)

(limited to 'include')

diff --git a/include/widgets.php b/include/widgets.php
index 54390ede4..3559f8a82 100644
--- a/include/widgets.php
+++ b/include/widgets.php
@@ -10,141 +10,8 @@ require_once('include/contact_widgets.php');
 require_once('include/attach.php');
 
 
-function widget_profile($args) {
 
-	$block = observer_prohibited();
-	return profile_sidebar(App::$profile, $block, true);
-}
-
-function widget_zcard($args) {
-
-	$block = observer_prohibited();
-	$channel = channelx_by_n(App::$profile_uid);
-	return get_zcard($channel,get_observer_hash(),array('width' => 875));
-}
-
-
-
-
-// FIXME The problem with the next widget is that we don't have a search function for webpages that we can send the links to.
-// Then we should also provide an option to search webpages and conversations.
-
-function widget_tagcloud($args) {
-
-	$o = '';
-	//$tab = 0;
-
-	$uid = App::$profile_uid;
-	$count = ((x($args,'count')) ? intval($args['count']) : 24);
-	$flags = 0;
-	$type = TERM_CATEGORY;
-
-	// FIXME there exists no $authors variable
-	$r = tagadelic($uid, $count, $authors, $owner, $flags, ITEM_TYPE_WEBPAGE, $type);
-
-	if($r) {
-		$o = '<div class="tagblock widget"><h3>' . t('Categories') . '</h3><div class="tags" align="center">';
-		foreach($r as $rr) {
-			$o .= '<span class="tag'.$rr[2].'">'.$rr[0].'</span> ' . "\r\n";
-		}
-		$o .= '</div></div>';
-	}
-	return $o;
-}
-
-function widget_collections($args) {
-	require_once('include/group.php');
-
-	$mode = ((array_key_exists('mode',$args)) ? $args['mode'] : 'conversation');
-	switch($mode) {
-		case 'conversation':
-				$every = argv(0);
-				$each = argv(0);
-				$edit = true;
-				$current = $_REQUEST['gid'];
-				$abook_id = 0;
-				$wmode = 0;
-				break;
-		case 'connections':
-				$every = 'connections';
-				$each = 'group';
-				$edit = true;
-				$current = $_REQUEST['gid'];
-				$abook_id = 0;
-				$wmode = 0;
-		case 'groups':
-				$every = 'connections';
-				$each = argv(0);
-				$edit = false;
-				$current = intval(argv(1));
-				$abook_id = 0;
-				$wmode = 1;
-				break;
-		case 'abook':
-				$every = 'connections';
-				$each = 'group';
-				$edit = false;
-				$current = 0;
-				$abook_id = App::$poi['abook_xchan'];
-				$wmode = 1;
-				break;
-		default:
-			return '';
-			break;
-	}
-
-	return group_side($every, $each, $edit, $current, $abook_id, $wmode);
-}
-
-function widget_suggestions($arr) {
-
-	if((! local_channel()) || (! feature_enabled(local_channel(),'suggest')))
-		return '';
-
-	require_once('include/socgraph.php');
-
-	$r = suggestion_query(local_channel(),get_observer_hash(),0,20);
-
-	if(! $r) {
-		return;
-	}
-
-	$arr = array();
-
-	// Get two random entries from the top 20 returned.
-	// We'll grab the first one and the one immediately following.
-	// This will throw some entropy intot he situation so you won't
-	// be looking at the same two mug shots every time the widget runs
-
-	$index = ((count($r) > 2) ? mt_rand(0,count($r) - 2) : 0);
 
-	for($x = $index; $x <= ($index+1); $x ++) {
-		$rr = $r[$x];
-		if(! $rr['xchan_url'])
-			break;
-
-		$connlnk = z_root() . '/follow/?url=' . $rr['xchan_addr'];
-
-		$arr[] = array(
-			'url' => chanlink_url($rr['xchan_url']),
-			'profile' => $rr['xchan_url'],
-			'name' => $rr['xchan_name'],
-			'photo' => $rr['xchan_photo_m'],
-			'ignlnk' => z_root() . '/directory?ignore=' . $rr['xchan_hash'],
-			'conntxt' => t('Connect'),
-			'connlnk' => $connlnk,
-			'ignore' => t('Ignore/Hide')
-		);
-	}
-
-	$o = replace_macros(get_markup_template('suggest_widget.tpl'),array(
-		'$title' => t('Suggestions'),
-		'$more' => t('See more...'),
-		'$entries' => $arr
-	));
-
-	return $o;
-}
 
 
 function widget_follow($args) {
-- 
cgit v1.2.3


From 17977effe775ef05a48a84da40da4b1f049b00d9 Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Wed, 15 Mar 2017 18:48:27 -0700
Subject: more widgets

---
 include/widgets.php | 154 +---------------------------------------------------
 1 file changed, 1 insertion(+), 153 deletions(-)

(limited to 'include')

diff --git a/include/widgets.php b/include/widgets.php
index 3559f8a82..20b4a312c 100644
--- a/include/widgets.php
+++ b/include/widgets.php
@@ -2,7 +2,7 @@
 /**
  * @file include/widgets.php
  *
- * @brief This file contains the widgets.
+ * @brief This file contains some widgets.
  */
 
 require_once('include/dir_fns.php');
@@ -10,158 +10,6 @@ require_once('include/contact_widgets.php');
 require_once('include/attach.php');
 
 
-
-
-
-
-function widget_follow($args) {
-	if(! local_channel())
-		return '';
-
-	$uid = App::$channel['channel_id'];
-	$r = q("select count(*) as total from abook where abook_channel = %d and abook_self = 0 ",
-		intval($uid)
-	);
-	if($r)
-		$total_channels = $r[0]['total'];
-	$limit = service_class_fetch($uid,'total_channels');
-	if($limit !== false) {
-		$abook_usage_message = sprintf( t("You have %1$.0f of %2$.0f allowed connections."), $total_channels, $limit);
-	}
-	else {
-		$abook_usage_message = '';
- 	}
-	return replace_macros(get_markup_template('follow.tpl'),array(
-		'$connect' => t('Add New Connection'),
-		'$desc' => t('Enter channel address'),
-		'$hint' => t('Examples: bob@example.com, https://example.com/barbara'),
-		'$follow' => t('Connect'),
-		'$abook_usage_message' => $abook_usage_message
-	));
-}
-
-
-
-
-function widget_savedsearch($arr) {
-	if((! local_channel()) || (! feature_enabled(local_channel(),'savedsearch')))
-		return '';
-
-	$search = ((x($_GET,'netsearch')) ? $_GET['netsearch'] : '');
-	if(! $search)
-		$search = ((x($_GET,'search')) ? $_GET['search'] : '');
-
-	if(x($_GET,'searchsave') && $search) {
-		$r = q("select * from term where uid = %d and ttype = %d and term = '%s' limit 1",
-			intval(local_channel()),
-			intval(TERM_SAVEDSEARCH),
-			dbesc($search)
-		);
-		if(! $r) {
-			q("insert into term ( uid,ttype,term ) values ( %d, %d, '%s') ",
-				intval(local_channel()),
-				intval(TERM_SAVEDSEARCH),
-				dbesc($search)
-			);
-		}
-	}
-
-	if(x($_GET,'searchremove') && $search) {
-		q("delete from term where uid = %d and ttype = %d and term = '%s'",
-			intval(local_channel()),
-			intval(TERM_SAVEDSEARCH),
-			dbesc($search)
-		);
-		$search = '';
-	}
-
-	$srchurl = App::$query_string;
-
-	$srchurl =  rtrim(preg_replace('/searchsave\=[^\&].*?(\&|$)/is','',$srchurl),'&');
-	$hasq = ((strpos($srchurl,'?') !== false) ? true : false);
-	$srchurl =  rtrim(preg_replace('/searchremove\=[^\&].*?(\&|$)/is','',$srchurl),'&');
-
-	$srchurl =  rtrim(preg_replace('/search\=[^\&].*?(\&|$)/is','',$srchurl),'&');
-	$srchurl =  rtrim(preg_replace('/submit\=[^\&].*?(\&|$)/is','',$srchurl),'&');
-	$srchurl = str_replace(array('?f=','&f='),array('',''),$srchurl);
-
-
-	$hasq = ((strpos($srchurl,'?') !== false) ? true : false);
-	$hasamp = ((strpos($srchurl,'&') !== false) ? true : false);
-
-	if(($hasamp) && (! $hasq))
-		$srchurl = substr($srchurl,0,strpos($srchurl,'&')) . '?f=&' . substr($srchurl,strpos($srchurl,'&')+1);
-
-	$o = '';
-
-	$r = q("select tid,term from term WHERE uid = %d and ttype = %d ",
-		intval(local_channel()),
-		intval(TERM_SAVEDSEARCH)
-	);
-
-	$saved = array();
-
-	if(count($r)) {
-		foreach($r as $rr) {
-			$saved[] = array(
-				'id'            => $rr['tid'],
-				'term'          => $rr['term'],
-				'dellink'       => z_root() . '/' . $srchurl . (($hasq || $hasamp) ? '' : '?f=') . '&amp;searchremove=1&amp;search=' . urlencode($rr['term']),
-				'srchlink'      => z_root() . '/' . $srchurl . (($hasq || $hasamp) ? '' : '?f=') . '&amp;search=' . urlencode($rr['term']),
-				'displayterm'   => htmlspecialchars($rr['term'], ENT_COMPAT,'UTF-8'),
-				'encodedterm'   => urlencode($rr['term']),
-				'delete'        => t('Remove term'),
-				'selected'      => ($search==$rr['term']),
-			);
-		}
-	}
-
-	$tpl = get_markup_template("saved_searches.tpl");
-	$o = replace_macros($tpl, array(
-		'$title'	 => t('Saved Searches'),
-		'$add'		 => t('add'),
-		'$searchbox' => searchbox($search, 'netsearch-box', $srchurl . (($hasq) ? '' : '?f='), true),
-		'$saved' 	 => $saved,
-	));
-
-	return $o;
-}
-
-function widget_sitesearch($arr) {
-
-	$search = ((x($_GET,'search')) ? $_GET['search'] : '');
-
-	$srchurl = App::$query_string;
-
-	$srchurl =  rtrim(preg_replace('/search\=[^\&].*?(\&|$)/is','',$srchurl),'&');
-	$srchurl =  rtrim(preg_replace('/submit\=[^\&].*?(\&|$)/is','',$srchurl),'&');
-	$srchurl = str_replace(array('?f=','&f='),array('',''),$srchurl);
-
-
-	$hasq = ((strpos($srchurl,'?') !== false) ? true : false);
-	$hasamp = ((strpos($srchurl,'&') !== false) ? true : false);
-
-	if(($hasamp) && (! $hasq))
-		$srchurl = substr($srchurl,0,strpos($srchurl,'&')) . '?f=&' . substr($srchurl,strpos($srchurl,'&')+1);
-
-	$o = '';
-
-	$saved = array();
-
-	$tpl = get_markup_template("sitesearch.tpl");
-	$o = replace_macros($tpl, array(
-		'$title'	 => t('Search'),
-		'$searchbox' => searchbox($search, 'netsearch-box', $srchurl . (($hasq) ? '' : '?f='), false),
-		'$saved' 	 => $saved,
-	));
-
-	return $o;
-}
-
-
-
-
-
 function widget_filer($arr) {
 	if(! local_channel())
 		return '';
-- 
cgit v1.2.3


From 47f4007951ce3311ee267a863a2cc46085c4892a Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Wed, 15 Mar 2017 19:30:57 -0700
Subject: more widgets

---
 include/widgets.php | 83 -----------------------------------------------------
 1 file changed, 83 deletions(-)

(limited to 'include')

diff --git a/include/widgets.php b/include/widgets.php
index 20b4a312c..3ede4df70 100644
--- a/include/widgets.php
+++ b/include/widgets.php
@@ -10,91 +10,8 @@ require_once('include/contact_widgets.php');
 require_once('include/attach.php');
 
 
-function widget_filer($arr) {
-	if(! local_channel())
-		return '';
-
 
-	$selected = ((x($_REQUEST,'file')) ? $_REQUEST['file'] : '');
 
-	$terms = array();
-	$r = q("select distinct term from term where uid = %d and ttype = %d order by term asc",
-		intval(local_channel()),
-		intval(TERM_FILE)
-	);
-	if(! $r)
-		return;
-
-	foreach($r as $rr)
-		$terms[] = array('name' => $rr['term'], 'selected' => (($selected == $rr['term']) ? 'selected' : ''));
-
-	return replace_macros(get_markup_template('fileas_widget.tpl'),array(
-		'$title' => t('Saved Folders'),
-		'$desc' => '',
-		'$sel_all' => (($selected == '') ? 'selected' : ''),
-		'$all' => t('Everything'),
-		'$terms' => $terms,
-		'$base' => z_root() . '/' . App::$cmd
-	));
-}
-
-function widget_archive($arr) {
-
-	$o = '';
-
-	if(! App::$profile_uid) {
-		return '';
-	}
-
-	$uid = App::$profile_uid;
-
-	if(! feature_enabled($uid,'archives'))
-		return '';
-
-	if(! perm_is_allowed($uid,get_observer_hash(),'view_stream'))
-		return '';
-
-	$wall = ((array_key_exists('wall', $arr)) ? intval($arr['wall']) : 0);
-	$style = ((array_key_exists('style', $arr)) ? $arr['style'] : 'select');
-	$showend = ((get_pconfig($uid,'system','archive_show_end_date')) ? true : false);
-	$mindate = get_pconfig($uid,'system','archive_mindate');
-	$visible_years = get_pconfig($uid,'system','archive_visible_years');
-	if(! $visible_years)
-		$visible_years = 5;
-
-	$url = z_root() . '/' . App::$cmd;
-
-	$ret = list_post_dates($uid,$wall,$mindate);
-
-	if(! count($ret))
-		return '';
-
-	$cutoff_year = intval(datetime_convert('',date_default_timezone_get(),'now','Y')) - $visible_years;
-	$cutoff = ((array_key_exists($cutoff_year,$ret))? true : false);
-
-	$o = replace_macros(get_markup_template('posted_date_widget.tpl'),array(
-		'$title' => t('Archives'),
-		'$size' => $visible_years,
-		'$cutoff_year' => $cutoff_year,
-		'$cutoff' => $cutoff,
-		'$url' => $url,
-		'$style' => $style,
-		'$showend' => $showend,
-		'$dates' => $ret
-	));
-	return $o;
-}
-
-
-function widget_fullprofile($arr) {
-
-	if(! App::$profile['profile_uid'])
-		return;
-
-	$block = observer_prohibited();
-
-	return profile_sidebar(App::$profile, $block);
-}
 
 function widget_shortprofile($arr) {
 
-- 
cgit v1.2.3


From f60309efa12be3b8d4f5b2c565ebdf7f051a987d Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Wed, 15 Mar 2017 20:11:28 -0700
Subject: more widget migrations

---
 include/widgets.php | 73 -----------------------------------------------------
 1 file changed, 73 deletions(-)

(limited to 'include')

diff --git a/include/widgets.php b/include/widgets.php
index 3ede4df70..86657fba6 100644
--- a/include/widgets.php
+++ b/include/widgets.php
@@ -13,82 +13,9 @@ require_once('include/attach.php');
 
 
 
-function widget_shortprofile($arr) {
 
-	if(! App::$profile['profile_uid'])
-		return;
-
-	$block = observer_prohibited();
-
-	return profile_sidebar(App::$profile, $block, true, true);
-}
-
-
-function widget_categories($arr) {
-
-
-	if(App::$profile['profile_uid'] && (! perm_is_allowed(App::$profile['profile_uid'],get_observer_hash(),'view_stream')))
-		return '';
-
-	$cat = ((x($_REQUEST,'cat')) ? htmlspecialchars($_REQUEST['cat'],ENT_COMPAT,'UTF-8') : '');
-	$srchurl = App::$query_string;
-	$srchurl =  rtrim(preg_replace('/cat\=[^\&].*?(\&|$)/is','',$srchurl),'&');
-	$srchurl = str_replace(array('?f=','&f='),array('',''),$srchurl);
-
-	return categories_widget($srchurl, $cat);
-
-}
-
-function widget_appcategories($arr) {
-
-	if(! local_channel())
-		return '';
-
-	$selected = ((x($_REQUEST,'cat')) ? htmlspecialchars($_REQUEST['cat'],ENT_COMPAT,'UTF-8') : '');
 
-	$srchurl =  rtrim(preg_replace('/cat\=[^\&].*?(\&|$)/is','',$srchurl),'&');
-	$srchurl = str_replace(array('?f=','&f='),array('',''),$srchurl);
 
-	$srchurl = z_root() . '/apps';
-
-	$terms = array();
-
-	$r = q("select distinct(term.term)
-        from term join app on term.oid = app.id
-        where app_channel = %d
-        and term.uid = app_channel
-        and term.otype = %d
-        and term.term != 'nav_featured_app'
-        order by term.term asc",
-		intval(local_channel()),
-	    intval(TERM_OBJ_APP)
-	);
-	if($r) {
-		foreach($r as $rr)
-			$terms[] = array('name' => $rr['term'], 'selected' => (($selected == $rr['term']) ? 'selected' : ''));
-
-		return replace_macros(get_markup_template('categories_widget.tpl'),array(
-			'$title' => t('Categories'),
-			'$desc' => '',
-			'$sel_all' => (($selected == '') ? 'selected' : ''),
-			'$all' => t('Everything'),
-			'$terms' => $terms,
-			'$base' => $srchurl,
-
-		));
-	}
-
-
-
-}
-
-
-
-function widget_appcloud($arr) {
-	if(! local_channel())
-		return '';
-	return app_tagblock(z_root() . '/apps');
-}
 
 
 function widget_tagcloud_wall($arr) {
-- 
cgit v1.2.3


From 6e101e458268c0f9b7bf461cea3c31c37b5e3791 Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Wed, 15 Mar 2017 20:56:12 -0700
Subject: widgets cont.

---
 include/widgets.php | 345 ----------------------------------------------------
 1 file changed, 345 deletions(-)

(limited to 'include')

diff --git a/include/widgets.php b/include/widgets.php
index 86657fba6..af23134c9 100644
--- a/include/widgets.php
+++ b/include/widgets.php
@@ -18,347 +18,16 @@ require_once('include/attach.php');
 
 
 
-function widget_tagcloud_wall($arr) {
 
 
-	if((! App::$profile['profile_uid']) || (! App::$profile['channel_hash']))
-		return '';
-	if(! perm_is_allowed(App::$profile['profile_uid'], get_observer_hash(), 'view_stream'))
-		return '';
-
-	$limit = ((array_key_exists('limit', $arr)) ? intval($arr['limit']) : 50);
-	if(feature_enabled(App::$profile['profile_uid'], 'tagadelic'))
-		return wtagblock(App::$profile['profile_uid'], $limit, '', App::$profile['channel_hash'], 'wall');
-
-	return '';
-}
-
-function widget_catcloud_wall($arr) {
-
-
-	if((! App::$profile['profile_uid']) || (! App::$profile['channel_hash']))
-		return '';
-	if(! perm_is_allowed(App::$profile['profile_uid'], get_observer_hash(), 'view_stream'))
-		return '';
-
-	$limit = ((array_key_exists('limit',$arr)) ? intval($arr['limit']) : 50);
-
-	return catblock(App::$profile['profile_uid'], $limit, '', App::$profile['channel_hash'], 'wall');
-}
-
-
-function widget_affinity($arr) {
-
-	if(! local_channel())
-		return '';
-	
-	// Get default cmin value from pconfig, but allow GET parameter to override
-	$cmin = intval(get_pconfig(local_channel(),'affinity','cmin'));
-	$cmin = (($cmin) ? $cmin : 0);
-	$cmin = ((x($_REQUEST,'cmin')) ? intval($_REQUEST['cmin']) : $cmin);
-	
-	// Get default cmax value from pconfig, but allow GET parameter to override
-	$cmax = intval(get_pconfig(local_channel(),'affinity','cmax'));
-	$cmax = (($cmax) ? $cmax : 99);
-	$cmax = ((x($_REQUEST,'cmax')) ? intval($_REQUEST['cmax']) : $cmax);
-
-
-	if(feature_enabled(local_channel(),'affinity')) {
-
-		$labels = array(
-			t('Me'),
-			t('Family'),
-			t('Friends'),
-			t('Acquaintances'),
-			t('All')
-		);
-		call_hooks('affinity_labels',$labels);
-		$label_str = '';
-
-		if($labels) {
-			foreach($labels as $l) {
-				if($label_str) {
-					$label_str .= ", '|'";
-					$label_str .= ", '" . $l . "'";
-				}
-				else
-					$label_str .= "'" . $l . "'";
-			}
-		}
-
-		$tpl = get_markup_template('main_slider.tpl');
-		$x = replace_macros($tpl,array(
-			'$val' => $cmin . ',' . $cmax,
-			'$refresh' => t('Refresh'),
-			'$labels' => $label_str,
-		));
-		$arr = array('html' => $x);
-		call_hooks('main_slider',$arr);
-		return $arr['html'];
-	}
-
- 	return '';
-}
-
-
-function widget_settings_menu($arr) {
-
-	if(! local_channel())
-		return;
-
-
-	$channel = App::get_channel();
-
-	$abook_self_id = 0;
-
-	// Retrieve the 'self' address book entry for use in the auto-permissions link
-
-	$role = get_pconfig(local_channel(),'system','permissions_role');
-
-	$abk = q("select abook_id from abook where abook_channel = %d and abook_self = 1 limit 1",
-		intval(local_channel())
-	);
-	if($abk)
-		$abook_self_id = $abk[0]['abook_id'];
-
-	$x = q("select count(*) as total from hubloc where hubloc_hash = '%s' and hubloc_deleted = 0 ",
-		dbesc($channel['channel_hash'])
-	);
-
-	$hublocs = (($x && $x[0]['total'] > 1) ? true : false);
-
-	$tabs = array(
-		array(
-			'label'	=> t('Account settings'),
-			'url' 	=> z_root().'/settings/account',
-			'selected'	=> ((argv(1) === 'account') ? 'active' : ''),
-		),
-
-		array(
-			'label'	=> t('Channel settings'),
-			'url' 	=> z_root().'/settings/channel',
-			'selected'	=> ((argv(1) === 'channel') ? 'active' : ''),
-		),
-
-	);
-
-	if(get_account_techlevel() > 0 && get_features()) {
-		$tabs[] = 	array(
-				'label'	=> t('Additional features'),
-				'url' 	=> z_root().'/settings/features',
-				'selected'	=> ((argv(1) === 'features') ? 'active' : ''),
-		);
-	}
-
-	$tabs[] =	array(
-		'label'	=> t('Feature/Addon settings'),
-		'url' 	=> z_root().'/settings/featured',
-		'selected'	=> ((argv(1) === 'featured') ? 'active' : ''),
-	);
-
-	$tabs[] =	array(
-		'label'	=> t('Display settings'),
-		'url' 	=> z_root().'/settings/display',
-		'selected'	=> ((argv(1) === 'display') ? 'active' : ''),
-	);
-
-	if($hublocs) {
-		$tabs[] = array(
-			'label' => t('Manage locations'),
-			'url' => z_root() . '/locs',
-			'selected' => ((argv(1) === 'locs') ? 'active' : ''),
-		);
-	}
-
-	$tabs[] =	array(
-		'label' => t('Export channel'),
-		'url' => z_root() . '/uexport',
-		'selected' => ''
-	);
-
-	$tabs[] =	array(
-		'label' => t('Connected apps'),
-		'url' => z_root() . '/settings/oauth',
-		'selected' => ((argv(1) === 'oauth') ? 'active' : ''),
-	);
-
-	if(get_account_techlevel() > 2) {
-		$tabs[] =	array(
-			'label' => t('Guest Access Tokens'),
-			'url' => z_root() . '/settings/tokens',
-			'selected' => ((argv(1) === 'tokens') ? 'active' : ''),
-		);
-	}
-
-	if(feature_enabled(local_channel(),'permcats')) {
-		$tabs[] = array(
-			'label' => t('Permission Groups'),
-			'url' => z_root() . '/settings/permcats',
-			'selected' => ((argv(1) === 'permcats') ? 'active' : ''),
-		);
-	}
 
 
-	if($role === false || $role === 'custom') {
-		$tabs[] = array(
-			'label' => t('Connection Default Permissions'),
-			'url' => z_root() . '/connedit/' . $abook_self_id,
-			'selected' => ''
-		);
-	}
 
-	if(feature_enabled(local_channel(),'premium_channel')) {
-		$tabs[] = array(
-			'label' => t('Premium Channel Settings'),
-			'url' => z_root() . '/connect/' . $channel['channel_address'],
-			'selected' => ''
-		);
-	}
 
-	if(feature_enabled(local_channel(),'channel_sources')) {
-		$tabs[] = array(
-			'label' => t('Channel Sources'),
-			'url' => z_root() . '/sources',
-			'selected' => ''
-		);
-	}
-
-	$tabtpl = get_markup_template("generic_links_widget.tpl");
-	return replace_macros($tabtpl, array(
-		'$title' => t('Settings'),
-		'$class' => 'settings-widget',
-		'$items' => $tabs,
-	));
-}
-
-
-function widget_mailmenu($arr) {
-	if (! local_channel())
-		return;
 
 
-	return replace_macros(get_markup_template('message_side.tpl'), array(
-		'$title' => t('Private Mail Menu'),
-		'$combined'=>array(
-			'label' => t('Combined View'),
-			'url' => z_root() . '/mail/combined',
-			'sel' => (argv(1) == 'combined'),
-		),
-		'$inbox'=>array(
-			'label' => t('Inbox'),
-			'url' => z_root() . '/mail/inbox',
-			'sel' => (argv(1) == 'inbox'),
-		),
-		'$outbox'=>array(
-			'label' => t('Outbox'),
-			'url' => z_root() . '/mail/outbox',
-			'sel' => (argv(1) == 'outbox'),
-		),
-		'$new'=>array(
-			'label' => t('New Message'),
-			'url' => z_root() . '/mail/new',
-			'sel'=> (argv(1) == 'new'),
-		)
-	));
-}
 
 
-function widget_conversations($arr) {
-	if (! local_channel())
-		return;
-
-	if(argc() > 1) {
-
-		switch(argv(1)) {
-			case 'combined':
-				$mailbox = 'combined';
-				$header = t('Conversations');
-				break;
-			case 'inbox':
-				$mailbox = 'inbox';
-				$header = t('Received Messages');
-				break;
-			case 'outbox':
-				$mailbox = 'outbox';
-				$header = t('Sent Messages');
-				break;
-			default:
-				$mailbox = 'combined';
-				$header = t('Conversations');
-				break;
-		}
-
-		require_once('include/message.php');
-
-		// private_messages_list() can do other more complicated stuff, for now keep it simple
-		$r = private_messages_list(local_channel(), $mailbox, App::$pager['start'], App::$pager['itemspage']);
-
-		if(! $r) {
-			info( t('No messages.') . EOL);
-			return $o;
-		}
-
-		$messages = array();
-
-		foreach($r as $rr) {
-
-			$messages[] = array(
-				'mailbox'      => $mailbox,
-				'id'           => $rr['id'],
-				'from_name'    => $rr['from']['xchan_name'],
-				'from_url'     => chanlink_hash($rr['from_xchan']),
-				'from_photo'   => $rr['from']['xchan_photo_s'],
-				'to_name'      => $rr['to']['xchan_name'],
-				'to_url'       => chanlink_hash($rr['to_xchan']),
-				'to_photo'     => $rr['to']['xchan_photo_s'],
-				'subject'      => (($rr['seen']) ? $rr['title'] : '<strong>' . $rr['title'] . '</strong>'),
-				'delete'       => t('Delete conversation'),
-				'body'         => $rr['body'],
-				'date'         => datetime_convert('UTC',date_default_timezone_get(),$rr['created'], 'c'),
-				'seen'         => $rr['seen'],
-				'selected'     => ((argv(2)) ? (argv(2) == $rr['id']) : ($r[0]['id'] == $rr['id']))
-			);
-		}
-
-		$tpl = get_markup_template('mail_head.tpl');
-		$o .= replace_macros($tpl, array(
-			'$header' => $header,
-			'$messages' => $messages
-		));
-
-		//$o .= alt_pager($a,count($r));
-
-	}
-
-	return $o;
-}
-
-function widget_eventstools($arr) {
-	if (! local_channel())
-		return;
-
-	return replace_macros(get_markup_template('events_tools_side.tpl'), array(
-		'$title' => t('Events Tools'),
-		'$export' => t('Export Calendar'),
-		'$import' => t('Import Calendar'),
-		'$submit' => t('Submit')
-	));
-}
-
-function widget_design_tools($arr) {
-
-	// mod menu doesn't load a profile. For any modules which load a profile, check it.
-	// otherwise local_channel() is sufficient for permissions.
-
-	if(App::$profile['profile_uid'])
-		if((App::$profile['profile_uid'] != local_channel()) && (! App::$is_sys))
-			return '';
-
-	if(! local_channel())
-		return '';
-
-	return design_tools();
-}
 
 function widget_website_portation_tools($arr) {
 
@@ -380,20 +49,6 @@ function widget_findpeople($arr) {
 }
 
 
-function widget_photo_albums($arr) {
-
-	if(! App::$profile['profile_uid'])
-		return '';
-	$channelx = channelx_by_n(App::$profile['profile_uid']);
-	if((! $channelx) || (! perm_is_allowed(App::$profile['profile_uid'], get_observer_hash(), 'view_storage')))
-		return '';
-	require_once('include/photos.php');
-	$sortkey = ((array_key_exists('sortkey',$arr)) ? $arr['sortkey'] : 'album');
-	$direction = ((array_key_exists('direction',$arr)) ? $arr['direction'] : 'asc');
-
-	return photos_album_widget($channelx, App::get_observer(),$sortkey,$direction);
-}
-
 
 function widget_vcard($arr) {
 	return vcard_from_xchan('', App::get_observer());
-- 
cgit v1.2.3


From 0908da95298bdd7dd96dcb45ac490f8e7aa73a8e Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Wed, 15 Mar 2017 21:26:28 -0700
Subject: widgets cont.

---
 include/widgets.php | 207 ----------------------------------------------------
 1 file changed, 207 deletions(-)

(limited to 'include')

diff --git a/include/widgets.php b/include/widgets.php
index af23134c9..8ccaad23b 100644
--- a/include/widgets.php
+++ b/include/widgets.php
@@ -12,22 +12,6 @@ require_once('include/attach.php');
 
 
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
 
 function widget_website_portation_tools($arr) {
 
@@ -50,10 +34,6 @@ function widget_findpeople($arr) {
 
 
 
-function widget_vcard($arr) {
-	return vcard_from_xchan('', App::get_observer());
-}
-
 
 /*
  * The following directory widgets are only useful on the directory page
@@ -68,114 +48,10 @@ function widget_dirtags($arr) {
 	return dir_tagblock(z_root() . '/directory', null);
 }
 
-function widget_menu_preview($arr) {
-	if(! App::$data['menu_item'])
-		return;
-	require_once('include/menu.php');
-
-	return menu_render(App::$data['menu_item']);
-}
-
-function widget_chatroom_list($arr) {
-
-
-	$r = Zotlabs\Lib\Chatroom::roomlist(App::$profile['profile_uid']);
-
-	if($r) {
-		return replace_macros(get_markup_template('chatroomlist.tpl'), array(
-			'$header' => t('Chatrooms'),
-			'$baseurl' => z_root(),
-			'$nickname' => App::$profile['channel_address'],
-			'$items' => $r,
-			'$overview' => t('Overview')
-		));
-	}
-}
-
-function widget_chatroom_members() {
-	$o = replace_macros(get_markup_template('chatroom_members.tpl'), array(
-		'$header' => t('Chat Members')
-	));
-
-	return $o;
-}
-
-function widget_wiki_list($arr) {
-
-	$channel = channelx_by_n(App::$profile_uid);
-
-	$wikis = Zotlabs\Lib\NativeWiki::listwikis($channel,get_observer_hash());
-
-	if($wikis) {
-		return replace_macros(get_markup_template('wikilist_widget.tpl'), array(
-			'$header' => t('Wiki List'),
-			'$channel' => $channel['channel_address'],
-			'$wikis' => $wikis['wikis']
-		));
-	}
-	return '';
-}
-
-function widget_wiki_pages($arr) {
-
-	$channelname = ((array_key_exists('channel',$arr)) ? $arr['channel'] : '');
-	$c = channelx_by_nick($channelname);
 
-	$wikiname = '';
-	if (array_key_exists('refresh', $arr)) {
-		$not_refresh = (($arr['refresh']=== true) ? false : true);
-	} else {
-		$not_refresh = true;
-	}
-	$pages = array();
-	if (! array_key_exists('resource_id', $arr)) {
-		$hide = true;
-	} else {
-		$p = Zotlabs\Lib\NativeWikiPage::page_list($c['channel_id'],get_observer_hash(),$arr['resource_id']);
-
-		if($p['pages']) {
-			$pages = $p['pages'];
-			$w = $p['wiki'];
-			// Wiki item record is $w['wiki']
-			$wikiname = $w['urlName'];
-			if (!$wikiname) {
-				$wikiname = '';
-			}
-		}
-	}
-	$can_create = perm_is_allowed(\App::$profile['uid'],get_observer_hash(),'write_wiki');
-
-	$can_delete = ((local_channel() && (local_channel() == \App::$profile['uid'])) ? true : false);
-
-	return replace_macros(get_markup_template('wiki_page_list.tpl'), array(
-			'$hide' => $hide,
-			'$resource_id' => $arr['resource_id'],
-			'$not_refresh' => $not_refresh,
-			'$header' => t('Wiki Pages'),
-			'$channel' => $channelname,
-			'$wikiname' => $wikiname,
-			'$pages' => $pages,
-			'$canadd' => $can_create,
-			'$candel' => $can_delete,
-			'$addnew' => t('Add new page'),
-			'$pageName' => array('pageName', t('Page name')),
-	));
-}
 
-function widget_wiki_page_history($arr) {
 
-	$pageUrlName = ((array_key_exists('pageUrlName', $arr)) ? $arr['pageUrlName'] : '');
-	$resource_id = ((array_key_exists('resource_id', $arr)) ? $arr['resource_id'] : '');
 
-	$pageHistory = Zotlabs\Lib\NativeWikiPage::page_history(array('channel_id' => App::$profile_uid, 'observer_hash' => get_observer_hash(), 'resource_id' => $resource_id, 'pageUrlName' => $pageUrlName));
-	return replace_macros(get_markup_template('nwiki_page_history.tpl'), array(
-		'$pageHistory' => $pageHistory['history'],
-		'$permsWrite' => $arr['permsWrite'],
-		'$name_lbl' => t('Name'),
-		'$msg_label' => t('Message','wiki_history')
-	));
-
-}
 
 function widget_bookmarkedchats($arr) {
 
@@ -749,27 +625,6 @@ function widget_activity($arr) {
 
 
 
-function widget_tasklist($arr) {
-
-	if (! local_channel())
-		return;
-
-	require_once('include/event.php');
-	$o .= '<script>var tasksShowAll = 0; $(document).ready(function() { tasksFetch(); $("#tasklist-new-form").submit(function(event) { event.preventDefault(); $.post( "tasks/new", $("#tasklist-new-form").serialize(), function(data) { tasksFetch();  $("#tasklist-new-summary").val(""); } ); return false; } )});</script>';
-	$o .= '<script>function taskComplete(id) { $.post("tasks/complete/"+id, function(data) { tasksFetch();}); }
-		function tasksFetch() {
-			$.get("tasks/fetch" + ((tasksShowAll) ? "/all" : ""), function(data) {
-				$(".tasklist-tasks").html(data.html);
-			});
-		}
-		</script>';
-
-	$o .= '<div class="widget">' . '<h3>' . t('Tasks') . '</h3><div class="tasklist-tasks">';
-	$o .= '</div><form id="tasklist-new-form" action="" ><input class="form-control" id="tasklist-new-summary" type="text" name="summary" value="" /></form>';
-	$o .= '</div>';
-	return $o;
-
-}
 
 
 function widget_helpindex($arr) {
@@ -814,68 +669,6 @@ function widget_helpindex($arr) {
 
 
 
-function widget_admin($arr) {
-
-	/*
-	 * Side bar links
-	 */
-
-	if(! is_site_admin()) {
-		return '';
-	}
-
-	$o = '';
-
-	// array( url, name, extra css classes )
-
-	$aside = array(
-		'site'      => array(z_root() . '/admin/site/',     t('Site'),           'site'),
-		'accounts'  => array(z_root() . '/admin/accounts/', t('Accounts'),       'accounts', 'pending-update', t('Member registrations waiting for confirmation')),
-		'channels'  => array(z_root() . '/admin/channels/', t('Channels'),       'channels'),
-		'security'  => array(z_root() . '/admin/security/', t('Security'),       'security'),
-		'features'  => array(z_root() . '/admin/features/', t('Features'),       'features'),
-		'plugins'   => array(z_root() . '/admin/plugins/',  t('Plugins'),        'plugins'),
-		'themes'    => array(z_root() . '/admin/themes/',   t('Themes'),         'themes'),
-		'queue'     => array(z_root() . '/admin/queue',     t('Inspect queue'),  'queue'),
-		'profs'     => array(z_root() . '/admin/profs',     t('Profile Fields'), 'profs'),
-		'dbsync'    => array(z_root() . '/admin/dbsync/',   t('DB updates'),     'dbsync')
-
-	);
-
-	/* get plugins admin page */
-
-	$r = q("SELECT * FROM addon WHERE plugin_admin = 1");
-
-	$plugins = array();
-	if($r) {
-		foreach ($r as $h){
-			$plugin = $h['aname'];
-			$plugins[] = array(z_root() . '/admin/plugins/' . $plugin, $plugin, 'plugin');
-			// temp plugins with admin
-			App::$plugins_admin[] = $plugin;
-		}
-	}
-
-	$logs = array(z_root() . '/admin/logs/', t('Logs'), 'logs');
-
-	$arr = array('links' => $aside,'plugins' => $plugins,'logs' => $logs);
-	call_hooks('admin_aside',$arr);
-
-	$o .= replace_macros(get_markup_template('admin_aside.tpl'), array(
-			'$admin' => $aside,
-			'$admtxt' => t('Admin'),
-			'$plugadmtxt' => t('Plugin Features'),
-			'$plugins' => $plugins,
-			'$logtxt' => t('Logs'),
-			'$logs' => $logs,
-			'$h_pending' => t('Member registrations waiting for confirmation'),
-			'$admurl'=> z_root() . '/admin/'
-	));
-
-	return $o;
-
-}
-
 
 
 function widget_album($args) {
-- 
cgit v1.2.3


From 0bad26e116499d9b656c28f64c81275df4bbecb6 Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Thu, 16 Mar 2017 17:11:48 -0700
Subject: the rest of the standard widgets converted

---
 include/widgets.php | 763 +---------------------------------------------------
 1 file changed, 1 insertion(+), 762 deletions(-)

(limited to 'include')

diff --git a/include/widgets.php b/include/widgets.php
index 8ccaad23b..8497d1848 100644
--- a/include/widgets.php
+++ b/include/widgets.php
@@ -2,768 +2,7 @@
 /**
  * @file include/widgets.php
  *
- * @brief This file contains some widgets.
+ * @brief This file may contain some widgets.
  */
 
-require_once('include/dir_fns.php');
-require_once('include/contact_widgets.php');
-require_once('include/attach.php');
-
-
-
-
-
-function widget_website_portation_tools($arr) {
-
-	// mod menu doesn't load a profile. For any modules which load a profile, check it.
-	// otherwise local_channel() is sufficient for permissions.
-
-	if(App::$profile['profile_uid'])
-		if((App::$profile['profile_uid'] != local_channel()) && (! App::$is_sys))
-			return '';
-
-	if(! local_channel())
-		return '';
-
-	return website_portation_tools();
-}
-
-function widget_findpeople($arr) {
-	return findpeople_widget();
-}
-
-
-
-
-/*
- * The following directory widgets are only useful on the directory page
- */
-
-
-function widget_dirsort($arr) {
-	return dir_sort_links();
-}
-
-function widget_dirtags($arr) {
-	return dir_tagblock(z_root() . '/directory', null);
-}
-
-
-
-
-
-
-function widget_bookmarkedchats($arr) {
-
-	if(! feature_enabled(App::$profile['profile_uid'],'ajaxchat'))
-		return '';
-
-	$h = get_observer_hash();
-	if(! $h)
-		return;
-	$r = q("select xchat_url, xchat_desc from xchat where xchat_xchan = '%s' order by xchat_desc",
-		dbesc($h)
-	);
-	if($r) {
-		for($x = 0; $x < count($r); $x ++) {
-			$r[$x]['xchat_url'] = zid($r[$x]['xchat_url']);
-		}
-	}
-	return replace_macros(get_markup_template('bookmarkedchats.tpl'),array(
-		'$header' => t('Bookmarked Chatrooms'),
-		'$rooms' => $r
-	));
-}
-
-function widget_suggestedchats($arr) {
-
-	if(! feature_enabled(App::$profile['profile_uid'],'ajaxchat'))
-		return '';
-
-	// There are reports that this tool does not ever remove chatrooms on dead sites,
-	// and also will happily link to private chats which you cannot enter.
-	// For those reasons, it will be disabled until somebody decides it's worth
-	// fixing and comes up with a plan for doing so.
-
-	return '';
-
-
-	// probably should restrict this to your friends, but then the widget will only work
-	// if you are logged in locally.
-
-	$h = get_observer_hash();
-	if(! $h)
-		return;
-	$r = q("select xchat_url, xchat_desc, count(xchat_xchan) as total from xchat group by xchat_url, xchat_desc order by total desc, xchat_desc limit 24");
-	if($r) {
-		for($x = 0; $x < count($r); $x ++) {
-			$r[$x]['xchat_url'] = zid($r[$x]['xchat_url']);
-		}
-	}
-	return replace_macros(get_markup_template('bookmarkedchats.tpl'),array(
-		'$header' => t('Suggested Chatrooms'),
-		'$rooms' => $r
-	));
-}
-
-function widget_item($arr) {
-
-	$channel_id = 0;
-	if(array_key_exists('channel_id',$arr) && intval($arr['channel_id']))
-		$channel_id = intval($arr['channel_id']);
-	if(! $channel_id)
-		$channel_id = App::$profile_uid;
-	if(! $channel_id)
-		return '';
-
-
-	if((! $arr['mid']) && (! $arr['title']))
-		return '';
-
-	if(! perm_is_allowed($channel_id, get_observer_hash(), 'view_pages'))
-		return '';
-
-	require_once('include/security.php');
-	$sql_extra = item_permissions_sql($channel_id);
-
-	if($arr['title']) {
-		$r = q("select item.* from item left join iconfig on item.id = iconfig.iid
-			where item.uid = %d and iconfig.cat = 'system' and iconfig.v = '%s'
-			and iconfig.k = 'WEBPAGE' and item_type = %d $sql_options $revision limit 1",
-			intval($channel_id),
-			dbesc($arr['title']),
-			intval(ITEM_TYPE_WEBPAGE)
-		);
-	}
-	else {
-		$r = q("select * from item where mid = '%s' and uid = %d and item_type = " . intval(ITEM_TYPE_WEBPAGE) . " $sql_extra limit 1",
-			dbesc($arr['mid']),
-			intval($channel_id)
-		);
-	}
-
-	if(! $r)
-		return '';
-
-	xchan_query($r);
-	$r = fetch_post_tags($r, true);
-
-	$o = prepare_page($r[0]);
-	return $o;
-}
-
-function widget_clock($arr) {
-
-	$miltime = 0;
-	if(isset($arr['military']) && $arr['military'])
-		$miltime = 1;
-
-$o = <<< EOT
-<div class="widget">
-<h3 class="clockface"></h3>
-<script>
-
-var timerID = null
-var timerRunning = false
-
-function stopclock(){
-    if(timerRunning)
-        clearTimeout(timerID)
-    timerRunning = false
-}
-
-function startclock(){
-    stopclock()
-    showtime()
-}
-
-function showtime(){
-    var now = new Date()
-    var hours = now.getHours()
-    var minutes = now.getMinutes()
-    var seconds = now.getSeconds()
-	var military = $miltime
-    var timeValue = ""
-	if(military)
-		timeValue = hours
-	else
-		timeValue = ((hours > 12) ? hours - 12 : hours)
-    timeValue  += ((minutes < 10) ? ":0" : ":") + minutes
-//    timeValue  += ((seconds < 10) ? ":0" : ":") + seconds
-	if(! military)
-	    timeValue  += (hours >= 12) ? " P.M." : " A.M."
-    $('.clockface').html(timeValue)
-    timerID = setTimeout("showtime()",1000)
-    timerRunning = true
-}
-
-$(document).ready(function() {
-	startclock();
-});
-
-</script>
-</div>
-EOT;
-return $o;
-
-}
-
-/**
- * @brief Widget to display a single photo.
- *
- * @param array $arr associative array with
- *    * \e string \b src URL of photo; URL must be an http or https URL
- *    * \e boolean \b zrl use zid in URL
- *    * \e string \b style CSS string
- *
- * @return string with parsed HTML
- */
-function widget_photo($arr) {
-
-	$style = $zrl = false;
-
-	if(array_key_exists('src', $arr) && isset($arr['src']))
-		$url = $arr['src'];
-
-	if(strpos($url, 'http') !== 0)
-		return '';
-
-	if(array_key_exists('style', $arr) && isset($arr['style']))
-		$style = $arr['style'];
-
-	// ensure they can't sneak in an eval(js) function
-
-	if(strpbrk($style, '(\'"<>') !== false)
-		$style = '';
-
-	if(array_key_exists('zrl', $arr) && isset($arr['zrl']))
-		$zrl = (($arr['zrl']) ? true : false);
-
-	if($zrl)
-		$url = zid($url);
-
-	$o = '<div class="widget">';
-
-	$o .= '<img ' . (($zrl) ? ' class="zrl" ' : '')
-				  . (($style) ? ' style="' . $style . '"' : '')
-				  . ' src="' . $url . '" alt="' . t('photo/image') . '">';
-
-	$o .= '</div>';
-
-	return $o;
-}
-
-
-function widget_cover_photo($arr) {
-
-	require_once('include/channel.php');
-	$o = '';
-
-	if(App::$module == 'channel' && $_REQUEST['mid'])
-		return '';
-
-	$channel_id = 0;
-	if(array_key_exists('channel_id', $arr) && intval($arr['channel_id']))
-		$channel_id = intval($arr['channel_id']);
-	if(! $channel_id)
-		$channel_id = App::$profile_uid;
-	if(! $channel_id)
-		return '';
-
-	$channel = channelx_by_n($channel_id);
-
-	if(array_key_exists('style', $arr) && isset($arr['style']))
-		$style = $arr['style'];
-	else
-		$style = 'width:100%; height: auto;';
-
-	// ensure they can't sneak in an eval(js) function
-
-	if(strpbrk($style,'(\'"<>') !== false)
-		$style = '';
-
-	if(array_key_exists('title', $arr) && isset($arr['title']))
-		$title = $arr['title'];
-	else
-		$title = $channel['channel_name'];
-
-	if(array_key_exists('subtitle', $arr) && isset($arr['subtitle']))
-		$subtitle = $arr['subtitle'];
-	else
-		$subtitle = str_replace('@','&#x40;',$channel['xchan_addr']);
-
-	$c = get_cover_photo($channel_id,'html');
-
-	if($c) {
-		$photo_html = (($style) ? str_replace('alt=',' style="' . $style . '" alt=',$c) : $c);
-
-		$o = replace_macros(get_markup_template('cover_photo_widget.tpl'),array(
-			'$photo_html'	=> $photo_html,
-			'$title'	=> $title,
-			'$subtitle'	=> $subtitle,
-			'$hovertitle' => t('Click to show more'),
-		));
-	}
-	return $o;
-}
-
-
-function widget_photo_rand($arr) {
-
-	require_once('include/photos.php');
-	$style = false;
-
-	if(array_key_exists('album', $arr) && isset($arr['album']))
-		$album = $arr['album'];
-	else
-		$album = '';
-
-	$channel_id = 0;
-	if(array_key_exists('channel_id', $arr) && intval($arr['channel_id']))
-		$channel_id = intval($arr['channel_id']);
-	if(! $channel_id)
-		$channel_id = App::$profile_uid;
-	if(! $channel_id)
-		return '';
-
-	$scale = ((array_key_exists('scale',$arr)) ? intval($arr['scale']) : 0);
-
-	$ret = photos_list_photos(array('channel_id' => $channel_id),App::get_observer(),$album);
-
-	$filtered = array();
-	if($ret['success'] && $ret['photos'])
-	foreach($ret['photos'] as $p)
-		if($p['imgscale'] == $scale)
-			$filtered[] = $p['src'];
-
-	if($filtered) {
-		$e = mt_rand(0, count($filtered) - 1);
-		$url = $filtered[$e];
-	}
-
-	if(strpos($url, 'http') !== 0)
-		return '';
-
-	if(array_key_exists('style', $arr) && isset($arr['style']))
-		$style = $arr['style'];
-
-	// ensure they can't sneak in an eval(js) function
-
-	if(strpos($style,'(') !== false)
-		return '';
-
-	$url = zid($url);
-
-	$o = '<div class="widget">';
-
-	$o .= '<img class="zrl" '
-		. (($style) ? ' style="' . $style . '"' : '')
-		. ' src="' . $url . '" alt="' . t('photo/image') . '">';
-
-	$o .= '</div>';
-
-	return $o;
-}
-
-
-function widget_random_block($arr) {
-
-	$channel_id = 0;
-	if(array_key_exists('channel_id',$arr) && intval($arr['channel_id']))
-		$channel_id = intval($arr['channel_id']);
-	if(! $channel_id)
-		$channel_id = App::$profile_uid;
-	if(! $channel_id)
-		return '';
-
-	if(array_key_exists('contains',$arr))
-		$contains = $arr['contains'];
-
-	$o = '';
-
-	require_once('include/security.php');
-	$sql_options = item_permissions_sql($channel_id);
-
-	$randfunc = db_getfunc('RAND');
-
-	$r = q("select item.* from item left join iconfig on item.id = iconfig.iid
-		where item.uid = %d and iconfig.cat = 'system' and iconfig.v like '%s' and iconfig.k = 'BUILDBLOCK' and
-		item_type = %d $sql_options order by $randfunc limit 1",
-		intval($channel_id),
-		dbesc('%' . $contains . '%'),
-		intval(ITEM_TYPE_BLOCK)
-	);
-
-	if($r) {
-		$o = '<div class="widget bblock">';
-		if($r[0]['title'])
-			$o .= '<h3>' . $r[0]['title'] . '</h3>';
-
-		$o .= prepare_text($r[0]['body'],$r[0]['mimetype']);
-		$o .= '</div>';
-	}
-
-	return $o;
-}
-
-
-function widget_rating($arr) {
-
-
-	$rating_enabled = get_config('system','rating_enabled');
-	if(! $rating_enabled) {
-		return;
-	}
-
-	if($arr['target'])
-		$hash = $arr['target'];
-	else
-		$hash = App::$poi['xchan_hash'];
-
-	if(! $hash)
-		return;
-
-	$url = '';
-	$remote = false;
-
-	if(remote_channel() && ! local_channel()) {
-		$ob = App::get_observer();
-		if($ob && $ob['xchan_url']) {
-			$p = parse_url($ob['xchan_url']);
-			if($p) {
-				$url = $p['scheme'] . '://' . $p['host'] . (($p['port']) ? ':' . $p['port'] : '');
-				$url .= '/rate?f=&target=' . urlencode($hash);
-			}
-			$remote = true;
-		}
-	}
-
-	$self = false;
-
-	if(local_channel()) {
-		$channel = App::get_channel();
-
-		if($hash == $channel['channel_hash'])
-			$self = true;
-
-		head_add_js('ratings.js');
-
-	}
-
-
-	$o = '<div class="widget">';
-	$o .= '<h3>' . t('Rating Tools') . '</h3>';
-
-	if((($remote) || (local_channel())) && (! $self)) {
-		if($remote)
-			$o .= '<a class="btn btn-block btn-primary btn-sm" href="' . $url . '"><i class="fa fa-pencil"></i> ' . t('Rate Me') . '</a>';
-		else
-			$o .= '<div class="btn btn-block btn-primary btn-sm" onclick="doRatings(\'' . $hash . '\'); return false;"><i class="fa fa-pencil"></i> ' . t('Rate Me') . '</div>';
-	}
-
-	$o .= '<a class="btn btn-block btn-default btn-sm" href="ratings/' . $hash . '"><i class="fa fa-eye"></i> ' . t('View Ratings') . '</a>';
-	$o .= '</div>';
-
-	return $o;
-
-}
-
-// used by site ratings pages to provide a return link
-function widget_pubsites($arr) {
-	if(App::$poi)
-		return;
-	return '<div class="widget"><ul class="nav nav-pills"><li><a href="pubsites">' . t('Public Hubs') . '</a></li></ul></div>';
-}
-
-
-function widget_forums($arr) {
-
-	if(! local_channel())
-		return '';
-
-	$o = '';
-
-	if(is_array($arr) && array_key_exists('limit',$arr))
-		$limit = " limit " . intval($limit) . " ";
-	else
-		$limit = '';
-
-	$unseen = 0;
-	if(is_array($arr) && array_key_exists('unseen',$arr) && intval($arr['unseen']))
-		$unseen = 1;
-
-	$perms_sql = item_permissions_sql(local_channel()) . item_normal();
-
-	$xf = false;
-
-	$x1 = q("select xchan from abconfig where chan = %d and cat = 'their_perms' and k = 'send_stream' and v = '0'",
-		intval(local_channel())
-	);
-	if($x1) {
-		$xc = ids_to_querystr($x1,'xchan',true);
-		$x2 = q("select xchan from abconfig where chan = %d and cat = 'their_perms' and k = 'tag_deliver' and v = '1' and xchan in (" . $xc . ") ",
-			intval(local_channel())
-		);
-		if($x2)
-			$xf = ids_to_querystr($x2,'xchan',true);
-	}
-
-	$sql_extra = (($xf) ? " and ( xchan_hash in (" . $xf . ") or xchan_pubforum = 1 ) " : " and xchan_pubforum = 1 "); 
-
-	$r1 = q("select abook_id, xchan_hash, xchan_name, xchan_url, xchan_photo_s from abook left join xchan on abook_xchan = xchan_hash where xchan_deleted = 0 and abook_channel = %d $sql_extra order by xchan_name $limit ",
-		intval(local_channel())
-	);
-	if(! $r1)
-		return $o;
-
-	$str = '';
-
-	// Trying to cram all this into a single query with joins and the proper group by's is tough.
-	// There also should be a way to update this via ajax.
-
-	for($x = 0; $x < count($r1); $x ++) {
-		$r = q("select sum(item_unseen) as unseen from item where owner_xchan = '%s' and uid = %d and item_unseen = 1 $perms_sql ",
-			dbesc($r1[$x]['xchan_hash']),
-			intval(local_channel())
-		);
-		if($r)
-			$r1[$x]['unseen'] = $r[0]['unseen'];
-
-/**
- * @FIXME
- * This SQL makes the counts correct when you get forum posts arriving from different routes/sources
- * (like personal channels). However the network query for these posts doesn't yet include this
- * correction and it makes the SQL for that query pretty hairy so this is left as a future exercise.
- * It may make more sense in that query to look for the mention in the body rather than another join,
- * but that makes it very inefficient.
- *
-		$r = q("select sum(item_unseen) as unseen from item left join term on oid = id where otype = %d and owner_xchan != '%s' and item.uid = %d and url = '%s' and ttype = %d $perms_sql ",
-			intval(TERM_OBJ_POST),
-			dbesc($r1[$x]['xchan_hash']),
-			intval(local_channel()),
-			dbesc($r1[$x]['xchan_url']),
-			intval(TERM_MENTION)
-		);
-		if($r)
-			$r1[$x]['unseen'] = ((array_key_exists('unseen',$r1[$x])) ? $r1[$x]['unseen'] + $r[0]['unseen'] : $r[0]['unseen']);
- *
- * end @FIXME
- */
-
-	}
-
-	if($r1) {
-		$o .= '<div class="widget">';
-		$o .= '<h3>' . t('Forums') . '</h3><ul class="nav nav-pills flex-column">';
-
-		foreach($r1 as $rr) {
-			if($unseen && (! intval($rr['unseen'])))
-				continue;
-			$o .= '<li class="nav-item"><a class="nav-link" href="network?f=&pf=1&cid=' . $rr['abook_id'] . '" ><span class="badge badge-default float-right">' . ((intval($rr['unseen'])) ? intval($rr['unseen']) : '') . '</span><img class ="menu-img-1" src="' . $rr['xchan_photo_s'] . '" /> ' . $rr['xchan_name'] . '</a></li>';
-		}
-		$o .= '</ul></div>';
-	}
-	return $o;
-
-}
-
-
-function widget_activity($arr) {
-
-	if(! local_channel())
-		return '';
-
-	$o = '';
-
-	if(is_array($arr) && array_key_exists('limit',$arr))
-		$limit = " limit " . intval($limit) . " ";
-	else
-		$limit = '';
-
-	$perms_sql = item_permissions_sql(local_channel()) . item_normal();
-
-	$r = q("select author_xchan from item where item_unseen = 1 and uid = %d $perms_sql",
-		intval(local_channel())
-	);
-
-	$contributors = [];
-	$arr = [];
-
-	if($r) {
-		foreach($r as $rv) {
-			if(array_key_exists($rv['author_xchan'],$contributors)) {
-				$contributors[$rv['author_xchan']] ++;
-			}
-			else {
-				$contributors[$rv['author_xchan']] = 1;
-			}
-		}
-		foreach($contributors as $k => $v) {
-			$arr[] = [ 'author_xchan' => $k, 'total' => $v	];	
-		}
-		usort($arr,'total_sort');
-		xchan_query($arr);
-	}
-
-	$x = [ 'entries' => $arr ];
-	call_hooks('activity_widget',$x);
-	$arr = $x['entries']; 
-
-	if($arr) {
-		$o .= '<div class="widget">';
-		$o .= '<h3>' . t('Activity','widget') . '</h3><ul class="nav nav-pills flex-column">';
-
-		foreach($arr as $rv) {
-			$o .= '<li class="nav-item"><a class="nav-link" href="network?f=&xchan=' . urlencode($rv['author_xchan']) . '" ><span class="badge badge-default float-right">' . ((intval($rv['total'])) ? intval($rv['total']) : '') . '</span><img src="' . $rv['author']['xchan_photo_s'] . '" class="menu-img-1" /> ' . $rv['author']['xchan_name'] . '</a></li>';
-		}
-		$o .= '</ul></div>';
-	}
-	return $o;
-
-}
-
-
-
-
-
-
-function widget_helpindex($arr) {
-
-	$o .= '<div class="widget">';
-
-	$level_0 = get_help_content('sitetoc');
-	if(! $level_0)
-		$level_0 = get_help_content('toc');
-
-	$level_0 = preg_replace('/\<ul(.*?)\>/','<ul class="nav nav-pills flex-column">',$level_0);
-
-	$levels = array();
-
-
-	if(argc() > 2) {
-		$path = '';
-		for($x = 1; $x < argc(); $x ++) {
-			$path .= argv($x) . '/';
-			$y = get_help_content($path . 'sitetoc');
-			if(! $y)
-				$y = get_help_content($path . 'toc');
-			if($y)
-				$levels[] = preg_replace('/\<ul(.*?)\>/','<ul class="nav nav-pills flex-column">',$y);
-		}
-	}
-
-	if($level_0)
-		$o .= $level_0;
-	if($levels) {
-		foreach($levels as $l) {
-			$o .= '<br /><br />';
-			$o .= $l;
-		}
-	}
-
-	$o .= '</div>';
-
-	return $o;
-
-}
-
-
-
-
-
-function widget_album($args) {
-
-	$owner_uid = App::$profile_uid;
-	$sql_extra = permissions_sql($owner_uid);
-
-
-	if(! perm_is_allowed($owner_uid,get_observer_hash(),'view_storage'))
-		return '';
-
-	if($args['album'])
-		$album = $args['album'];
-	if($args['title'])
-		$title = $args['title'];
-
-	/**
-	 * This may return incorrect permissions if you have multiple directories of the same name.
-	 * It is a limitation of the photo table using a name for a photo album instead of a folder hash
-	 */
-
-	if($album) {
-		$x = q("select hash from attach where filename = '%s' and uid = %d limit 1",
-			dbesc($album),
-			intval($owner_uid)
-		);
-		if($x) {
-			$y = attach_can_view_folder($owner_uid,get_observer_hash(),$x[0]['hash']);
-			if(! $y)
-				return '';
-		}
-	}
-
-	$order = 'DESC';
-
-	$r = q("SELECT p.resource_id, p.id, p.filename, p.mimetype, p.imgscale, p.description, p.created FROM photo p INNER JOIN
-		(SELECT resource_id, max(imgscale) imgscale FROM photo WHERE uid = %d AND album = '%s' AND imgscale <= 4 AND photo_usage IN ( %d, %d ) $sql_extra GROUP BY resource_id) ph
-		ON (p.resource_id = ph.resource_id AND p.imgscale = ph.imgscale)
-		ORDER BY created $order ",
-		intval($owner_uid),
-		dbesc($album),
-		intval(PHOTO_NORMAL),
-		intval(PHOTO_PROFILE)
-	);
-
-	//edit album name
-	$album_edit = null;
-
-	$photos = array();
-	if($r) {
-		$twist = 'rotright';
-		foreach($r as $rr) {
-
-			if($twist == 'rotright')
-				$twist = 'rotleft';
-			else
-				$twist = 'rotright';
-
-			$ext = $phototypes[$rr['mimetype']];
-
-			$imgalt_e = $rr['filename'];
-			$desc_e = $rr['description'];
-
-			$imagelink = (z_root() . '/photos/' . App::$profile['channel_address'] . '/image/' . $rr['resource_id']);
-
-
-			$photos[] = array(
-				'id' => $rr['id'],
-				'twist' => ' ' . $twist . rand(2,4),
-				'link' => $imagelink,
-				'title' => t('View Photo'),
-				'src' => z_root() . '/photo/' . $rr['resource_id'] . '-' . $rr['imgscale'] . '.' .$ext,
-				'alt' => $imgalt_e,
-				'desc'=> $desc_e,
-				'ext' => $ext,
-				'hash'=> $rr['resource_id'],
-				'unknown' => t('Unknown')
-			);
-		}
-	}
-
-
-	$tpl = get_markup_template('photo_album.tpl');
-	$o .= replace_macros($tpl, array(
-		'$photos' => $photos,
-		'$album' => (($title) ? $title : $album),
-		'$album_id' => rand(),
-		'$album_edit' => array(t('Edit Album'), $album_edit),
-		'$can_post' => false,
-		'$upload' => array(t('Upload'), z_root() . '/photos/' . App::$profile['channel_address'] . '/upload/' . bin2hex($album)),
-		'$order' => false,
-		'$upload_form' => $upload_form,
-		'$usage' => $usage_message
-	));
-
-	return $o;
-}
 
-- 
cgit v1.2.3


From 6c92a240cca673b4cdac25a2e64503a0d50c0124 Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Thu, 16 Mar 2017 18:36:58 -0700
Subject: remove include/widgets.php

---
 include/channel.php | 7 +------
 include/widgets.php | 8 --------
 2 files changed, 1 insertion(+), 14 deletions(-)
 delete mode 100644 include/widgets.php

(limited to 'include')

diff --git a/include/channel.php b/include/channel.php
index b838f8393..7cf78cb8b 100644
--- a/include/channel.php
+++ b/include/channel.php
@@ -1193,11 +1193,6 @@ function profile_sidebar($profile, $block = 0, $show_connect = true, $zcard = fa
 	else
 		$tpl = get_markup_template('profile_vcard.tpl');
 
-	require_once('include/widgets.php');
-
-//	if(! feature_enabled($profile['uid'],'hide_rating'))
-	$z = widget_rating(array('target' => $profile['channel_hash']));
-
 	$o .= replace_macros($tpl, array(
 		'$zcard'         => $zcard,
 		'$profile'       => $profile,
@@ -1211,7 +1206,7 @@ function profile_sidebar($profile, $block = 0, $show_connect = true, $zcard = fa
 		'$chanmenu'      => $channel_menu,
 		'$diaspora'      => $diaspora,
 		'$reddress'      => $reddress,
-		'$rating'        => $z,
+		'$rating'        => '',
 		'$contact_block' => $contact_block,
 		'$editmenu'	 => profile_edit_menu($profile['uid'])
 	));
diff --git a/include/widgets.php b/include/widgets.php
deleted file mode 100644
index 8497d1848..000000000
--- a/include/widgets.php
+++ /dev/null
@@ -1,8 +0,0 @@
-<?php
-/**
- * @file include/widgets.php
- *
- * @brief This file may contain some widgets.
- */
-
-
-- 
cgit v1.2.3


From 0f7832dc30fb4d8aedd24b6ad8a9e48876a77dd0 Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Mon, 13 Mar 2017 16:19:47 -0700
Subject: code_allowed is a real mess. Start the cleanup by remving the account
 level code allow and limiting to specific channels only. This reduces the
 possibility of cross channel security issues coming into play. Then provide a
 single function for checking the code permission. This is only partially done
 as we often need to check against the observer or logged in channel as well
 as the resource owner to ensure that this only returns true for local
 channels which also own the requested resource.

---
 include/channel.php | 17 +++++++++++++++++
 include/import.php  | 34 +++-------------------------------
 include/text.php    | 26 ++++----------------------
 3 files changed, 24 insertions(+), 53 deletions(-)

(limited to 'include')

diff --git a/include/channel.php b/include/channel.php
index 7cf78cb8b..f88a2f8aa 100644
--- a/include/channel.php
+++ b/include/channel.php
@@ -2247,3 +2247,20 @@ function channel_remove($channel_id, $local = true, $unset_session=false) {
 	}
 
 }
+
+/*
+ * This checks if a channel is allowed to publish executable code.
+ * It is up to the caller to determine if the observer or local_channel 
+ * is in fact the resource owner whose channel_id is being checked
+ */
+
+function channel_codeallowed($channel_id) {
+
+	if(! intval($channel_id))
+		return false;
+
+	$x = channelx_by_n($channel_id);
+	if(($x) && ($x['channel_pageflags'] & PAGE_ALLOWCODE))
+		return true;
+	return false;
+}
\ No newline at end of file
diff --git a/include/import.php b/include/import.php
index ac634639e..d0e15c89d 100644
--- a/include/import.php
+++ b/include/import.php
@@ -528,16 +528,8 @@ function sync_chatrooms($channel,$chatrooms) {
 function import_items($channel,$items,$sync = false,$relocate = null) {
 
 	if($channel && $items) {
-		$allow_code = false;
-		$r = q("select account_id, account_roles, channel_pageflags from account left join channel on channel_account_id = account_id 
-			where channel_id = %d limit 1",
-			intval($channel['channel_id'])
-		);
-		if($r) {
-			if(($r[0]['account_roles'] & ACCOUNT_ROLE_ALLOWCODE) || ($r[0]['channel_pageflags'] & PAGE_ALLOWCODE)) {
-				$allow_code = true;
-			}
-		}
+		
+		$allow_code = channel_codeallowed($channel['channel_id']);
 
 		$deliver = false;  // Don't deliver any messages or notifications when importing
 
@@ -1352,28 +1344,8 @@ function import_webpage_element($element, $channel, $type) {
 	}
 
 	// Verify ability to use html or php!!!
-	$execflag = false;
-	if($arr['mimetype'] === 'application/x-php' || $arr['mimetype'] === 'text/html') {
-		$z = q("select account_id, account_roles, channel_pageflags from account "
-			. "left join channel on channel_account_id = account_id where channel_id = %d limit 1", 
-			intval(local_channel())
-		);
 
-		if($z && (($z[0]['account_roles'] & ACCOUNT_ROLE_ALLOWCODE) || ($z[0]['channel_pageflags'] & PAGE_ALLOWCODE))) {
-			$execflag = true;
-		}
-		else {
-			logger('Unable to import element "' . $name .'" because AllowCode permission is denied.');
-			notice( t('Unable to import element "' . $name .'" because AllowCode permission is denied.') . EOL);
-			$element['import_success'] = 0;
-			return $element;
-		}
-	}
-		
-//	$z = q("select * from iconfig where v = '%s' and k = '%s' and cat = 'system' limit 1", 
-//		dbesc($name), 
-//		dbesc($namespace)
-//	);
+	$execflag = channel_codeallowed(local_channel());
 
 	$i = q("select id, edited, item_deleted from item where mid = '%s' and uid = %d limit 1", 
 		dbesc($arr['mid']), 
diff --git a/include/text.php b/include/text.php
index 911334a15..14ca19cef 100644
--- a/include/text.php
+++ b/include/text.php
@@ -104,15 +104,11 @@ function z_input_filter($channel_id,$s,$type = 'text/bbcode') {
 		return $s;
 	}
 
-	$r = q("select account_id, account_roles, channel_pageflags from account left join channel on channel_account_id = account_id where channel_id = %d limit 1",
+	$r = q("select channel_pageflags from channel where channel_id = %d limit 1",
 		intval($channel_id)
 	);
-	if($r) {
-		if(($r[0]['account_roles'] & ACCOUNT_ROLE_ALLOWCODE) || ($r[0]['channel_pageflags'] & PAGE_ALLOWCODE)) {
-			if(local_channel() && (get_account_id() == $r[0]['account_id'])) {
-				return $s;
-			}
-		}
+	if(($r) && (local_channel() == $channel_id) && ($r[0]['channel_pageflags'] & PAGE_ALLOWCODE)) {
+		return $s;
 	}
 
 	if($type === 'text/html')
@@ -1812,23 +1808,9 @@ function mimetype_select($channel_id, $current = 'text/bbcode') {
 	);
 
 
-	if(App::$is_sys) {
+	if((App::$is_sys) || (channel_codeallowed($channel_id) && $channel_id == local_channel())){
 		$x[] = 'application/x-php';
 	}
-	else {
-		$r = q("select account_id, account_roles, channel_pageflags from account left join channel on account_id = channel_account_id where
-			channel_id = %d limit 1",
-			intval($channel_id)
-		);
-
-		if($r) {
-			if(($r[0]['account_roles'] & ACCOUNT_ROLE_ALLOWCODE) || ($r[0]['channel_pageflags'] & PAGE_ALLOWCODE)) {
-				if(local_channel() && get_account_id() == $r[0]['account_id']) {
-					$x[] = 'application/x-php';
-				}
-			}
-		}
-	}
 
 	foreach($x as $y) {
 		$selected = (($y == $current) ? ' selected="selected" ' : '');
-- 
cgit v1.2.3


From 155b57c2de6e07147733f67605560c5ec00dc5e5 Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Tue, 14 Mar 2017 16:14:05 -0700
Subject: fix group by item query

---
 include/items.php | 32 +++++++++++++++-----------------
 1 file changed, 15 insertions(+), 17 deletions(-)

(limited to 'include')

diff --git a/include/items.php b/include/items.php
index 36445a46b..64e8f375e 100755
--- a/include/items.php
+++ b/include/items.php
@@ -3773,7 +3773,7 @@ function zot_feed($uid,$observer_hash,$arr) {
 	if(! is_sys_channel($uid))
 		$sql_extra = item_permissions_sql($uid,$observer_hash);
 
-	$limit = " LIMIT 100 ";
+	$limit = " LIMIT 5000 ";
 
 	if($mindate > NULL_DATE) {
 		$sql_extra .= " and ( created > '$mindate' or changed > '$mindate' ) ";
@@ -3785,15 +3785,7 @@ function zot_feed($uid,$observer_hash,$arr) {
 	}
 
 
-	$items = array();
-
-	/** @FIXME re-unite these SQL statements. There is no need for them to be separate. The mySQL is convoluted with misuse of group by. As it stands, there is a slight difference where the postgres version doesn't remove the duplicate parents up to 100. In practice this doesn't matter. It could be made to match behavior by adding "distinct on (parent) " to the front of the selection list, at a not-worth-it performance penalty (page temp results to disk). duplicates are still ignored in the in() clause, you just get less than 100 parents if there are many children. */
-
-	if(ACTIVE_DBTYPE == DBTYPE_POSTGRES) {
-		$groupby = '';
-	} else {
-		$groupby = 'GROUP BY parent';
-	}
+	$items = [];
 
 	$item_normal = item_normal();
 
@@ -3802,7 +3794,7 @@ function zot_feed($uid,$observer_hash,$arr) {
 			WHERE uid != %d
 			$item_normal
 			AND item_wall = 1
-			and item_private = 0 $sql_extra $groupby ORDER BY created ASC $limit",
+			and item_private = 0 $sql_extra ORDER BY created ASC $limit",
 			intval($uid)
 		);
 	}
@@ -3810,19 +3802,25 @@ function zot_feed($uid,$observer_hash,$arr) {
 		$r = q("SELECT parent, created, postopts from item
 			WHERE uid = %d $item_normal
 			AND item_wall = 1
-			$sql_extra $groupby ORDER BY created ASC $limit",
+			$sql_extra ORDER BY created ASC $limit",
 			intval($uid)
 		);
 	}
 
+	$parents = [];
+
 	if($r) {
-		for($x = 0; $x < count($r); $x ++) {
-			if(strpos($r[$x]['postopts'],'nodeliver') !== false) {
-				unset($r[$x]);
-			}
+		foreach($r as $rv) {
+			if(array_key_exists($rv['parent'],$parents))
+				continue;
+			if(strpos($rv['postopts'],'nodeliver') !== false)
+				continue;
+			$parents[$rv['parent']] = $rv;
+			if(count($parents) > 200)
+				break;
 		}
 
-		$parents_str = ids_to_querystr($r,'parent');
+		$parents_str = ids_to_querystr($parents,'parent');
 		$sys_query = ((is_sys_channel($uid)) ? $sql_extra : '');
 		$item_normal = item_normal();
 
-- 
cgit v1.2.3


From fa629841bd2fd150531a5494504a24b13a0c4503 Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Tue, 14 Mar 2017 17:07:29 -0700
Subject: input filter updates

---
 include/items.php | 87 +++++++++++++++++++++++--------------------------------
 include/text.php  | 18 +++++++-----
 2 files changed, 48 insertions(+), 57 deletions(-)

(limited to 'include')

diff --git a/include/items.php b/include/items.php
index 64e8f375e..382be2497 100755
--- a/include/items.php
+++ b/include/items.php
@@ -336,18 +336,6 @@ function post_activity_item($arr,$allow_code = false,$deliver = true) {
 	if(! array_key_exists('mimetype',$arr))
 		$arr['mimetype'] = 'text/bbcode';
 
-	if(array_key_exists('item_private',$arr) && $arr['item_private']) {
-
-		$arr['body'] = trim(z_input_filter($arr['uid'],$arr['body'],$arr['mimetype']));
-
-		if($channel) {
-			if($channel['channel_hash'] === $arr['author_xchan']) {
-				$arr['sig'] = base64url_encode(rsa_sign($arr['body'],$channel['channel_prvkey']));
-				$arr['item_verified'] = 1;
-			}
-		}
-	}
-
 	$arr['mid']          = ((x($arr,'mid')) ? $arr['mid'] : item_message_id());
 	$arr['parent_mid']   = ((x($arr,'parent_mid')) ? $arr['parent_mid'] : $arr['mid']);
 	$arr['thr_parent']   = ((x($arr,'thr_parent')) ? $arr['thr_parent'] : $arr['mid']);
@@ -1533,35 +1521,36 @@ function item_store($arr, $allow_exec = false, $deliver = true) {
 	// obsolete, but needed so as not to throw not-null constraints on some database driveres
 	$arr['item_flags']    = ((x($arr,'item_flags'))    ? intval($arr['item_flags'])          : 0 );
 
-	// only detect language if we have text content, and if the post is private but not yet
-	// obscured, make it so.
 
-	if((! array_key_exists('item_obscured',$arr)) || $arr['item_obscured'] == 0) {
 
-		$arr['lang'] = detect_language($arr['body']);
-		// apply the input filter here - if it is obscured it has been filtered already
-		$arr['body'] = trim(z_input_filter($arr['uid'],$arr['body'],$arr['mimetype']));
+	$arr['lang'] = detect_language($arr['body']);
+	// apply the input filter here
+	$arr['body'] = trim(z_input_filter($arr['body'],$arr['mimetype'],$allow_exec));
 
-		if(local_channel() && (local_channel() == $arr['uid']) && (! $arr['sig'])) {
+	if(local_channel() && (local_channel() == $arr['uid'])) {
+		if(! $arr['sig']) {
 			$channel = App::get_channel();
 			if($channel['channel_hash'] === $arr['author_xchan']) {
 				$arr['sig'] = base64url_encode(rsa_sign($arr['body'],$channel['channel_prvkey']));
 				$arr['item_verified'] = 1;
 			}
 		}
+	}
 
-		$allowed_languages = get_pconfig($arr['uid'],'system','allowed_languages');
+	if(! array_key_exists('sig',$arr))
+		$arr['sig'] = '';
 
-		if((is_array($allowed_languages)) && ($arr['lang']) && (! array_key_exists($arr['lang'],$allowed_languages))) {
-			$translate = array('item' => $arr, 'from' => $arr['lang'], 'to' => $allowed_languages, 'translated' => false);
-			call_hooks('item_translate', $translate);
-			if((! $translate['translated']) && (intval(get_pconfig($arr['uid'],'system','reject_disallowed_languages')))) {
-				logger('item_store: language ' . $arr['lang'] . ' not accepted for uid ' . $arr['uid']);
-				$ret['message'] = 'language not accepted';
-				return $ret;
-			}
-			$arr = $translate['item'];
+	$allowed_languages = get_pconfig($arr['uid'],'system','allowed_languages');
+
+	if((is_array($allowed_languages)) && ($arr['lang']) && (! array_key_exists($arr['lang'],$allowed_languages))) {
+		$translate = array('item' => $arr, 'from' => $arr['lang'], 'to' => $allowed_languages, 'translated' => false);
+		call_hooks('item_translate', $translate);
+		if((! $translate['translated']) && (intval(get_pconfig($arr['uid'],'system','reject_disallowed_languages')))) {
+			logger('item_store: language ' . $arr['lang'] . ' not accepted for uid ' . $arr['uid']);
+			$ret['message'] = 'language not accepted';
+			return $ret;
 		}
+		$arr = $translate['item'];
 	}
 
 	if((x($arr,'obj')) && is_array($arr['obj'])) {
@@ -1957,33 +1946,31 @@ function item_store_update($arr,$allow_exec = false, $deliver = true) {
 		return $ret;
 	}
 
-    if((! array_key_exists('item_obscured', $arr)) || $arr['item_obscured'] == 0) {
 
-		$arr['lang'] = detect_language($arr['body']);
+	$arr['lang'] = detect_language($arr['body']);
 
-        // apply the input filter here - if it is obscured it has been filtered already
-        $arr['body'] = trim(z_input_filter($arr['uid'],$arr['body'],$arr['mimetype']));
+	// apply the input filter here
+	$arr['body'] = trim($arr['body'],$arr['mimetype'],$allow_exec);
 
-		if(local_channel() && (local_channel() == $arr['uid']) && (! $arr['sig'])) {
-            $channel = App::get_channel();
-            if($channel['channel_hash'] === $arr['author_xchan']) {
-                $arr['sig'] = base64url_encode(rsa_sign($arr['body'],$channel['channel_prvkey']));
-                $arr['item_verified'] = 1;
-            }
-        }
+	if(local_channel() && (local_channel() == $arr['uid']) && (! $arr['sig'])) {
+		$channel = App::get_channel();
+		if($channel['channel_hash'] === $arr['author_xchan']) {
+			$arr['sig'] = base64url_encode(rsa_sign($arr['body'],$channel['channel_prvkey']));
+			$arr['item_verified'] = 1;
+		}
+	}
 
-		$allowed_languages = get_pconfig($arr['uid'],'system','allowed_languages');
+	$allowed_languages = get_pconfig($arr['uid'],'system','allowed_languages');
 
-		if((is_array($allowed_languages)) && ($arr['lang']) && (! array_key_exists($arr['lang'],$allowed_languages))) {
-			$translate = array('item' => $arr, 'from' => $arr['lang'], 'to' => $allowed_languages, 'translated' => false);
-			call_hooks('item_translate', $translate);
-			if((! $translate['translated']) && (intval(get_pconfig($arr['uid'],'system','reject_disallowed_languages')))) {
-				logger('item_store: language ' . $arr['lang'] . ' not accepted for uid ' . $arr['uid']);
-				$ret['message'] = 'language not accepted';
-				return $ret;
-			}
-			$arr = $translate['item'];
+	if((is_array($allowed_languages)) && ($arr['lang']) && (! array_key_exists($arr['lang'],$allowed_languages))) {
+		$translate = array('item' => $arr, 'from' => $arr['lang'], 'to' => $allowed_languages, 'translated' => false);
+		call_hooks('item_translate', $translate);
+		if((! $translate['translated']) && (intval(get_pconfig($arr['uid'],'system','reject_disallowed_languages')))) {
+			logger('item_store: language ' . $arr['lang'] . ' not accepted for uid ' . $arr['uid']);
+			$ret['message'] = 'language not accepted';
+			return $ret;
 		}
+		$arr = $translate['item'];
 	}
 
 	if((x($arr,'obj')) && is_array($arr['obj'])) {
diff --git a/include/text.php b/include/text.php
index 14ca19cef..c02499625 100644
--- a/include/text.php
+++ b/include/text.php
@@ -3,6 +3,7 @@
  * @file include/text.php
  */
 
+use \Zotlabs\Lib as Zlib;
 use \Michelf\MarkdownExtra;
 
 require_once("include/bbcode.php");
@@ -89,12 +90,10 @@ function escape_tags($string) {
 }
 
 
-function z_input_filter($channel_id,$s,$type = 'text/bbcode') {
+function z_input_filter($s,$type = 'text/bbcode',$allow_code = false) {
 
 	if($type === 'text/bbcode')
 		return escape_tags($s);
-	if($type === 'text/markdown')
-		return escape_tags($s);
 	if($type == 'text/plain')
 		return escape_tags($s);
 	if($type == 'application/x-pdl')
@@ -104,13 +103,17 @@ function z_input_filter($channel_id,$s,$type = 'text/bbcode') {
 		return $s;
 	}
 
-	$r = q("select channel_pageflags from channel where channel_id = %d limit 1",
-		intval($channel_id)
-	);
-	if(($r) && (local_channel() == $channel_id) && ($r[0]['channel_pageflags'] & PAGE_ALLOWCODE)) {
+	if($allow_code) {
+		if($type === 'text/markdown')
+			return htmlspecialchars($s,ENT_QUOTES);
 		return $s;
 	}
 
+	if($type === 'text/markdown') {
+		$x = new Zlib\MarkdownSoap($s);
+		return $x->clean();
+	}
+
 	if($type === 'text/html')
 		return purify_html($s);
 
@@ -1653,6 +1656,7 @@ function prepare_text($text, $content_type = 'text/bbcode', $cache = false) {
 			break;
 
 		case 'text/markdown':
+			$text = Zlib\MarkdownSoap::unescape($text);
 			$s = MarkdownExtra::defaultTransform($text);
 			break;
 
-- 
cgit v1.2.3


From ec5e1067bc0a949ceea7e28dbf11873e693b2586 Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Tue, 14 Mar 2017 21:40:11 -0700
Subject: store os_path and display_path with files

---
 include/attach.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

(limited to 'include')

diff --git a/include/attach.php b/include/attach.php
index 79313ab1a..f8227fb4b 100644
--- a/include/attach.php
+++ b/include/attach.php
@@ -705,8 +705,9 @@ function attach_store($channel, $observer_hash, $options = '', $arr = null) {
 	$os_relpath .= $hash;
 
 	// not yet used
-	$os_path = '';
-	$display_path = '';
+	$os_path = ltrim($os_relpath,'/');
+
+	$display_path = $pathname . '/' . $filename;
 
 	if($src)
 		@file_put_contents($os_basepath . $os_relpath,@file_get_contents($src));
-- 
cgit v1.2.3


From fa5115b3ed017f6aa22c99cad563de3934b171c2 Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Tue, 14 Mar 2017 22:02:28 -0700
Subject: add os_path and display_path to photos, fix some issues with multiple
 path separators after cloud/nickname in the content field of attach and
 photos

---
 include/attach.php             |  9 ++---
 include/photo/photo_driver.php | 88 +-----------------------------------------
 include/photos.php             | 11 +++---
 3 files changed, 12 insertions(+), 96 deletions(-)

(limited to 'include')

diff --git a/include/attach.php b/include/attach.php
index f8227fb4b..cbcdbc399 100644
--- a/include/attach.php
+++ b/include/attach.php
@@ -702,11 +702,10 @@ function attach_store($channel, $observer_hash, $options = '', $arr = null) {
 		$os_relpath .= $folder_hash . '/';
 	}
 
-	$os_relpath .= $hash;
-
-	// not yet used
-	$os_path = ltrim($os_relpath,'/');
+	$os_relpath  .= $hash;
+	$os_relpath   = ltrim($os_relpath,'/');
 
+	$os_path      = $os_relpath;
 	$display_path = $pathname . '/' . $filename;
 
 	if($src)
@@ -811,7 +810,7 @@ function attach_store($channel, $observer_hash, $options = '', $arr = null) {
 
 	if($is_photo) {
 
-		$args = array( 'source' => $source, 'visible' => $visible, 'resource_id' => $hash, 'album' => basename($pathname), 'os_path' => $os_basepath . $os_relpath, 'filename' => $filename, 'getimagesize' => $gis, 'directory' => $direct, 'options' => $options );
+		$args = array( 'source' => $source, 'visible' => $visible, 'resource_id' => $hash, 'album' => basename($pathname), 'os_syspath' => $os_basepath . $os_relpath, 'os_path' => $os_path, 'display_path' => $display_path, 'filename' => $filename, 'getimagesize' => $gis, 'directory' => $direct, 'options' => $options );
 		if($arr['contact_allow'])
 			$args['contact_allow'] = $arr['contact_allow'];
 		if($arr['group_allow'])
diff --git a/include/photo/photo_driver.php b/include/photo/photo_driver.php
index c8b3c3782..923e34dbe 100644
--- a/include/photo/photo_driver.php
+++ b/include/photo/photo_driver.php
@@ -380,7 +380,7 @@ abstract class photo_driver {
 				dbesc($p['album']),
 				intval($this->getHeight()),
 				intval($this->getWidth()),
-				(intval($p['os_storage']) ? dbescbin($p['os_path']) : dbescbin($this->imageString())),
+				(intval($p['os_storage']) ? dbescbin($p['os_syspath']) : dbescbin($this->imageString())),
 				intval($p['os_storage']),
 				intval(strlen($this->imageString())),
 				intval($p['imgscale']),
@@ -411,7 +411,7 @@ abstract class photo_driver {
 				dbesc($p['album']),
 				intval($this->getHeight()),
 				intval($this->getWidth()),
-				(intval($p['os_storage']) ? dbescbin($p['os_path']) : dbescbin($this->imageString())),
+				(intval($p['os_storage']) ? dbescbin($p['os_syspath']) : dbescbin($this->imageString())),
 				intval($p['os_storage']),
 				intval(strlen($this->imageString())),
 				intval($p['imgscale']),
@@ -429,90 +429,6 @@ abstract class photo_driver {
 		return $r;
 	}
 
-
-	// should be obsolete now
-
-	public function store($aid, $uid, $xchan, $rid, $filename, $album, $scale, $usage = PHOTO_NORMAL, $allow_cid = '', $allow_gid = '', $deny_cid = '', $deny_gid = '') {
-
-		$x = q("select id from photo where resource_id = '%s' and uid = %d and xchan = '%s' and imgscale = %d limit 1",
-				dbesc($rid),
-				intval($uid),
-				dbesc($xchan),
-				intval($scale)
-		);
-		if(count($x)) {
-			$r = q("UPDATE photo
-				set aid = %d,
-				uid = %d,
-				xchan = '%s',
-				resource_id = '%s',
-				created = '%s',
-				edited = '%s',
-				filename = '%s',
-				mimetype = '%s',
-				album = '%s',
-				height = %d,
-				width = %d,
-				content = '%s',
-				filesize = %d,
-				imgscale = %d,
-				photo_usage = %d,
-				allow_cid = '%s',
-				allow_gid = '%s',
-				deny_cid = '%s',
-				deny_gid = '%s'
-				where id = %d",
-
-				intval($aid),
-				intval($uid),
-				dbesc($xchan),
-				dbesc($rid),
-				dbesc(datetime_convert()),
-				dbesc(datetime_convert()),
-				dbesc(basename($filename)),
-				dbesc($this->getType()),
-				dbesc($album),
-				intval($this->getHeight()),
-				intval($this->getWidth()),
-				dbescbin($this->imageString()),
-				intval(strlen($this->imageString())),
-				intval($scale),
-				intval($photo_usage),
-				dbesc($allow_cid),
-				dbesc($allow_gid),
-				dbesc($deny_cid),
-				dbesc($deny_gid),
-				intval($x[0]['id'])
-			);
-		}
-		else {
-			$r = q("INSERT INTO photo
-				( aid, uid, xchan, resource_id, created, edited, filename, mimetype, album, height, width, content, filesize, imgscale, photo_usage, allow_cid, allow_gid, deny_cid, deny_gid )
-				VALUES ( %d, %d, '%s', '%s', '%s', '%s', '%s', '%s', '%s', %d, %d, '%s', %d, %d, %d, '%s', '%s', '%s', '%s' )",
-				intval($aid),
-				intval($uid),
-				dbesc($xchan),
-				dbesc($rid),
-				dbesc(datetime_convert()),
-				dbesc(datetime_convert()),
-				dbesc(basename($filename)),
-				dbesc($this->getType()),
-				dbesc($album),
-				intval($this->getHeight()),
-				intval($this->getWidth()),
-				dbescbin($this->imageString()),
-				intval(strlen($this->imageString())),
-				intval($scale),
-				intval($photo_usage),
-				dbesc($allow_cid),
-				dbesc($allow_gid),
-				dbesc($deny_cid),
-				dbesc($deny_gid)
-			);
-		}
-		return $r;
-	}
-
 }
 
 
diff --git a/include/photos.php b/include/photos.php
index c0f7dc8c4..22b3e0c88 100644
--- a/include/photos.php
+++ b/include/photos.php
@@ -67,8 +67,8 @@ function photo_upload($channel, $observer, $args) {
 
 	$os_storage = 0;
 
-	if($args['os_path'] && $args['getimagesize']) {
-		$imagedata = @file_get_contents($args['os_path']);
+	if($args['os_syspath'] && $args['getimagesize']) {
+		$imagedata = @file_get_contents($args['os_syspath']);
 		$filename = $args['filename'];
 		$filesize = strlen($imagedata);
 		// this is going to be deleted if it exists
@@ -153,7 +153,7 @@ function photo_upload($channel, $observer, $args) {
 		return $ret;
 	}
 
-	$exif = $ph->orient(($args['os_path']) ? $args['os_path'] : $src);
+	$exif = $ph->orient(($args['os_syspath']) ? $args['os_syspath'] : $src);
 
 	@unlink($src);
 
@@ -180,7 +180,8 @@ function photo_upload($channel, $observer, $args) {
 		'filename' => $filename, 'album' => $album, 'imgscale' => 0, 'photo_usage' => PHOTO_NORMAL,
 		'allow_cid' => $ac['allow_cid'], 'allow_gid' => $ac['allow_gid'],
 		'deny_cid' => $ac['deny_cid'], 'deny_gid' => $ac['deny_gid'],
-		'os_storage' => $os_storage, 'os_path' => $args['os_path']
+		'os_storage' => $os_storage, 'os_syspath' => $args['os_syspath'],
+		'os_path' => $args['os_path'], 'display_path' => $args['display_path']
 	);
 	if($args['created'])
 		$p['created'] = $args['created'];
@@ -205,7 +206,7 @@ function photo_upload($channel, $observer, $args) {
 		$errors = true;
 
 	unset($p['os_storage']);
-	unset($p['os_path']);
+	unset($p['os_syspath']);
 
 	if(($width > 1024 || $height > 1024) && (! $errors))
 		$ph->scaleImage(1024);
-- 
cgit v1.2.3


From 4387fb715b59be1ead2db8b12fa008160cd14ce7 Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Wed, 15 Mar 2017 15:53:03 -0700
Subject: ensure z_input_filter is called exactly once, since we now depend on
 the number of htmlspecialchars operations for markdown content. Also ensure
 that the content is escaped the correct number of times on imported items.

---
 include/items.php  | 68 ++++++++++++++++++++++++++++++++++++------------------
 include/photos.php |  9 ++++++++
 2 files changed, 55 insertions(+), 22 deletions(-)

(limited to 'include')

diff --git a/include/items.php b/include/items.php
index 382be2497..6e9c1c3d9 100755
--- a/include/items.php
+++ b/include/items.php
@@ -530,11 +530,6 @@ function get_item_elements($x,$allow_code = false) {
 
 	$arr = array();
 
-	if($allow_code)
-		$arr['body'] = $x['body'];
-	else
-		$arr['body'] = (($x['body']) ? htmlspecialchars($x['body'],ENT_COMPAT,'UTF-8',false) : '');
-
 	$key = get_config('system','pubkey');
 
 	$maxlen = get_max_import_size();
@@ -647,7 +642,17 @@ function get_item_elements($x,$allow_code = false) {
 			return array();
 	}
 
+	// Check signature on the body text received. 
+	// This presents an issue that we aren't verifying the text that is actually displayed
+	// on this site. We are however verifying the received text was exactly as received.
+	// We have every right to strip content that poses a security risk. You are welcome to
+	// create a plugin to verify the content after filtering if this offends you.  
+
 	if($arr['sig']) {
+
+		// check the supplied signature against the supplied content.
+		// Note that we will purify the content which could change it.
+
 		$r = q("select xchan_pubkey from xchan where xchan_hash = '%s' limit 1",
 			dbesc($arr['author_xchan'])
 		);
@@ -657,6 +662,14 @@ function get_item_elements($x,$allow_code = false) {
 			logger('get_item_elements: message verification failed.');
 	}
 
+	// if the input is markdown, remove one level of html escaping.
+	// It will be re-applied in item_store() and/or item_store_update().
+	// Do this after signature checking as the original signature
+	// was generated on the escaped content.
+
+	if($arr['mimetype'] === 'text/markdown')
+		$arr['body'] = \Zotlabs\Lib\MarkdownSoap::unescape($arr['body']);
+
 	if(array_key_exists('revision',$x)) {
 
 		// extended export encoding
@@ -1525,14 +1538,20 @@ function item_store($arr, $allow_exec = false, $deliver = true) {
 
 	$arr['lang'] = detect_language($arr['body']);
 	// apply the input filter here
-	$arr['body'] = trim(z_input_filter($arr['body'],$arr['mimetype'],$allow_exec));
-
-	if(local_channel() && (local_channel() == $arr['uid'])) {
-		if(! $arr['sig']) {
-			$channel = App::get_channel();
-			if($channel['channel_hash'] === $arr['author_xchan']) {
-				$arr['sig'] = base64url_encode(rsa_sign($arr['body'],$channel['channel_prvkey']));
-				$arr['item_verified'] = 1;
+
+	if(array_key_exists('input_filtered_signed',$arr)) {
+		unset($arr['input_filtered_signed']);
+	}
+	else {
+		$arr['body'] = trim(z_input_filter($arr['body'],$arr['mimetype'],$allow_exec));
+
+		if(local_channel() && (local_channel() == $arr['uid'])) {
+			if(! $arr['sig']) {
+				$channel = App::get_channel();
+				if($channel['channel_hash'] === $arr['author_xchan']) {
+					$arr['sig'] = base64url_encode(rsa_sign($arr['body'],$channel['channel_prvkey']));
+					$arr['item_verified'] = 1;
+				}
 			}
 		}
 	}
@@ -1946,17 +1965,22 @@ function item_store_update($arr,$allow_exec = false, $deliver = true) {
 		return $ret;
 	}
 
-
 	$arr['lang'] = detect_language($arr['body']);
 
-	// apply the input filter here
-	$arr['body'] = trim($arr['body'],$arr['mimetype'],$allow_exec);
-
-	if(local_channel() && (local_channel() == $arr['uid']) && (! $arr['sig'])) {
-		$channel = App::get_channel();
-		if($channel['channel_hash'] === $arr['author_xchan']) {
-			$arr['sig'] = base64url_encode(rsa_sign($arr['body'],$channel['channel_prvkey']));
-			$arr['item_verified'] = 1;
+	if(array_key_exists('input_filtered_signed',$arr)) {
+		unset($arr['input_filtered_signed']);
+	}
+	else {
+		$arr['body'] = trim(z_input_filter($arr['body'],$arr['mimetype'],$allow_exec));
+
+		if(local_channel() && (local_channel() == $arr['uid'])) {
+			if(! $arr['sig']) {
+				$channel = App::get_channel();
+				if($channel['channel_hash'] === $arr['author_xchan']) {
+					$arr['sig'] = base64url_encode(rsa_sign($arr['body'],$channel['channel_prvkey']));
+					$arr['item_verified'] = 1;
+				}
+			}
 		}
 	}
 
diff --git a/include/photos.php b/include/photos.php
index 22b3e0c88..dff45a0bc 100644
--- a/include/photos.php
+++ b/include/photos.php
@@ -337,12 +337,15 @@ function photo_upload($channel, $observer, $args) {
 			if($item['mid'] === $item['parent_mid']) {
 
 				$item['body'] = $summary;
+				$item['mimetype'] = 'text/bbcode';
 				$item['obj_type'] = ACTIVITY_OBJ_PHOTO;
 				$item['obj']	= json_encode($object);
 
 				$item['tgt_type'] = ACTIVITY_OBJ_ALBUM;
 				$item['target']	= json_encode($target);
 
+				$item['body'] = trim(z_input_filter($item['body'],$item['mimetype'],false));
+
 				if($item['author_xchan'] === $channel['channel_hash']) {
 					$item['sig'] = base64url_encode(rsa_sign($item['body'],$channel['channel_prvkey']));
 					$item['item_verified']  = 1;
@@ -350,6 +353,12 @@ function photo_upload($channel, $observer, $args) {
 				else {
 					$item['sig'] = '';
 				}
+
+				// notify item_store or item_store_update that the input has been filtered and signed already.
+				// The signing procedure in those functions uses local_channel() which may not apply here.
+
+				$item['input_filtered_signed'] = true;
+
 				$force = true;
 
 			}
-- 
cgit v1.2.3


From fd6b32758edb67c7e711eddd4c468a6ef459c478 Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Thu, 16 Mar 2017 01:16:29 -0700
Subject: namespace error

---
 include/items.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'include')

diff --git a/include/items.php b/include/items.php
index 6e9c1c3d9..8ae7ca818 100755
--- a/include/items.php
+++ b/include/items.php
@@ -530,7 +530,7 @@ function get_item_elements($x,$allow_code = false) {
 
 	$arr = array();
 
-	$key = get_config('system','pubkey');
+	$arr['body'] = $x['body'];
 
 	$maxlen = get_max_import_size();
 
-- 
cgit v1.2.3


From e9a5af6109a4a83a644432a2f39b47eb96303f4f Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Thu, 16 Mar 2017 18:19:03 -0700
Subject: simplify the message signing spaghetti

---
 include/items.php  | 61 ++++++++++++++++++++++++++----------------------------
 include/photos.php | 15 --------------
 2 files changed, 29 insertions(+), 47 deletions(-)

(limited to 'include')

diff --git a/include/items.php b/include/items.php
index 8ae7ca818..304a7acfc 100755
--- a/include/items.php
+++ b/include/items.php
@@ -1457,6 +1457,26 @@ function get_profile_elements($x) {
 }
 
 
+
+
+function item_sign(&$item) {
+
+	if(array_key_exists('sig',$item) && $item['sig'])
+		return;
+
+	$r = q("select channel_prvkey from channel where channel_id = %d and channel_hash = '%s' ",
+			intval($item['uid']),
+			dbesc($item['author_xchan'])
+	);
+	if(! $r)
+		return;
+
+	$item['sig'] = base64url_encode(rsa_sign($item['body'],$r[0]['channel_prvkey']));
+	$item['item_verified'] = 1;
+
+}
+
+
 /**
  * @brief
  *
@@ -1537,24 +1557,12 @@ function item_store($arr, $allow_exec = false, $deliver = true) {
 
 
 	$arr['lang'] = detect_language($arr['body']);
+
 	// apply the input filter here
 
-	if(array_key_exists('input_filtered_signed',$arr)) {
-		unset($arr['input_filtered_signed']);
-	}
-	else {
-		$arr['body'] = trim(z_input_filter($arr['body'],$arr['mimetype'],$allow_exec));
-
-		if(local_channel() && (local_channel() == $arr['uid'])) {
-			if(! $arr['sig']) {
-				$channel = App::get_channel();
-				if($channel['channel_hash'] === $arr['author_xchan']) {
-					$arr['sig'] = base64url_encode(rsa_sign($arr['body'],$channel['channel_prvkey']));
-					$arr['item_verified'] = 1;
-				}
-			}
-		}
-	}
+	$arr['body'] = trim(z_input_filter($arr['body'],$arr['mimetype'],$allow_exec));
+
+	item_sign($arr);
 
 	if(! array_key_exists('sig',$arr))
 		$arr['sig'] = '';
@@ -1967,22 +1975,11 @@ function item_store_update($arr,$allow_exec = false, $deliver = true) {
 
 	$arr['lang'] = detect_language($arr['body']);
 
-	if(array_key_exists('input_filtered_signed',$arr)) {
-		unset($arr['input_filtered_signed']);
-	}
-	else {
-		$arr['body'] = trim(z_input_filter($arr['body'],$arr['mimetype'],$allow_exec));
-
-		if(local_channel() && (local_channel() == $arr['uid'])) {
-			if(! $arr['sig']) {
-				$channel = App::get_channel();
-				if($channel['channel_hash'] === $arr['author_xchan']) {
-					$arr['sig'] = base64url_encode(rsa_sign($arr['body'],$channel['channel_prvkey']));
-					$arr['item_verified'] = 1;
-				}
-			}
-		}
-	}
+	// apply the input filter here
+
+	$arr['body'] = trim(z_input_filter($arr['body'],$arr['mimetype'],$allow_exec));
+
+	item_sign($arr);
 
 	$allowed_languages = get_pconfig($arr['uid'],'system','allowed_languages');
 
diff --git a/include/photos.php b/include/photos.php
index dff45a0bc..62c7f1c12 100644
--- a/include/photos.php
+++ b/include/photos.php
@@ -344,21 +344,6 @@ function photo_upload($channel, $observer, $args) {
 				$item['tgt_type'] = ACTIVITY_OBJ_ALBUM;
 				$item['target']	= json_encode($target);
 
-				$item['body'] = trim(z_input_filter($item['body'],$item['mimetype'],false));
-
-				if($item['author_xchan'] === $channel['channel_hash']) {
-					$item['sig'] = base64url_encode(rsa_sign($item['body'],$channel['channel_prvkey']));
-					$item['item_verified']  = 1;
-				}
-				else {
-					$item['sig'] = '';
-				}
-
-				// notify item_store or item_store_update that the input has been filtered and signed already.
-				// The signing procedure in those functions uses local_channel() which may not apply here.
-
-				$item['input_filtered_signed'] = true;
-
 				$force = true;
 
 			}
-- 
cgit v1.2.3


From d5525a38f185e37fe0101bc7ef6e67abf59f98f8 Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Sat, 18 Mar 2017 16:41:43 -0700
Subject: various input filter fixes

---
 include/event.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'include')

diff --git a/include/event.php b/include/event.php
index a9634d7a5..c57e52bc0 100644
--- a/include/event.php
+++ b/include/event.php
@@ -610,7 +610,7 @@ function parse_vobject($ical, $type) {
 	$ev['etype'] = $type;
 
 	$dtstart = $ical->DTSTART->getDateTime();
-	$ev['adjust'] = (($ical->DTSTART->isFloating()) ? 1 : 0);
+	$ev['adjust'] = (($ical->DTSTART->isFloating()) ? 0 : 1);
 
 	$ev['dtstart'] = datetime_convert((($ev['adjust']) ? 'UTC' : date_default_timezone_get()),'UTC',
 		$dtstart->format(\DateTime::W3C));
@@ -751,7 +751,7 @@ function event_import_ical($ical, $uid) {
 	}
 
 	$dtstart = $ical->DTSTART->getDateTime();
-	$ev['adjust'] = (($ical->DTSTART->isFloating()) ? 1 : 0);
+	$ev['adjust'] = (($ical->DTSTART->isFloating()) ? 0 : 1);
 
 //	logger('dtstart: ' . var_export($dtstart,true));
 
@@ -854,7 +854,7 @@ function event_import_ical_task($ical, $uid) {
 
 	$dtstart = $ical->DTSTART->getDateTime();
 
-	$ev['adjust'] = (($ical->DTSTART->isFloating()) ? 1 : 0);
+	$ev['adjust'] = (($ical->DTSTART->isFloating()) ? 0 : 1);
 
 //	logger('dtstart: ' . var_export($dtstart,true));
 
-- 
cgit v1.2.3


From 8caa4d9e37497645e3bd02aff2975f7851ee9837 Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Sun, 19 Mar 2017 19:43:00 -0700
Subject: attach_folder_rpaths() providing incorrect results

---
 include/attach.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'include')

diff --git a/include/attach.php b/include/attach.php
index cbcdbc399..d7c1b9da4 100644
--- a/include/attach.php
+++ b/include/attach.php
@@ -2243,11 +2243,12 @@ function attach_folder_select_list($channel_id) {
 	if($r) {
 		foreach($r as $rv) {
 			$x = attach_folder_rpaths($r,$rv);
-			if($x)
+			if($x) {
 				$out[$x[0]] = $x[1];
+			}
 		}
 	}
-
+logger('results: ' . print_r($out,true));
 	return $out;
 }
 
@@ -2266,7 +2267,6 @@ function attach_folder_rpaths($all_folders,$that_folder) {
 					continue;
 				if($selected['hash'] == $parent_hash) {
 					$path         = '/' . $selected['filename'] . $path;
-					$current_hash = $selected['hash'];
 					$parent_hash  = $selected['folder'];
 					$found = true;
 					break;
-- 
cgit v1.2.3


From 5915f31950a7b2314a6718854b7808475d394b44 Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Sun, 19 Mar 2017 21:39:28 -0700
Subject: add function attach_syspaths to calculate the contents of os_path and
 display_path; add this to the rename function. We will also need it to
 populate existing file/photo structures as an upgrade task.

---
 include/attach.php | 44 ++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 42 insertions(+), 2 deletions(-)

(limited to 'include')

diff --git a/include/attach.php b/include/attach.php
index d7c1b9da4..93401226d 100644
--- a/include/attach.php
+++ b/include/attach.php
@@ -2212,10 +2212,23 @@ function attach_move($channel_id, $resource_id, $new_folder_hash) {
 		intval($r[0]['id'])
 	);
 
+
+	$x = attach_syspaths($channel_id,$resource_id);
+
+	$t1 = q("update attach set os_path = '%s', display_path = '%s' where id = %d",
+		dbesc($x['os_path']),
+		dbesc($x['path']),
+		intval($r[0]['id'])
+	);
+
+
 	if($r[0]['is_photo']) {
-		$t = q("update photo set album = '%s', filename = '%s' where resource_id = '%s' and uid = %d",
+		$t = q("update photo set album = '%s', filename = '%s', os_path = '%s', display_path = '%s' 
+			where resource_id = '%s' and uid = %d",
 			dbesc($newdirname),
 			dbesc($filename),
+			dbesc($x['os_path']),
+			dbesc($x['path']),
 			dbesc($resource_id),
 			intval($channel_id)
 		);
@@ -2248,7 +2261,7 @@ function attach_folder_select_list($channel_id) {
 			}
 		}
 	}
-logger('results: ' . print_r($out,true));
+
 	return $out;
 }
 
@@ -2280,3 +2293,30 @@ function attach_folder_rpaths($all_folders,$that_folder) {
 
 	return (($error) ? false : [ $current_hash , $path ]);
 }
+
+
+function attach_syspaths($channel_id,$attach_hash) {
+
+	$os_path = '';
+	$path = '';
+	do {
+
+		$r = q("select folder, filename, hash from attach where hash = '%s' and uid = %d",
+			dbesc($attach_hash),
+			intval($channel_id)
+		);
+		if(! $r)
+			break;
+
+		$os_path = $r[0]['hash'] . (($os_path) ? '/' . $os_path : '');
+		$path = $r[0]['filename'] . (($path) ? '/' . $path : '');
+		$attach_hash = $r[0]['folder'];
+	}
+	while($attach_hash);
+
+	return [ 'os_path' => $os_path, 'path' => $path ];
+
+
+}
+
+
-- 
cgit v1.2.3


From 515f1e76b05c5b4544b7ee624d73cc3b7878d5ea Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Mon, 20 Mar 2017 21:53:39 -0700
Subject: perform attach_upgrade()

---
 include/attach.php | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

(limited to 'include')

diff --git a/include/attach.php b/include/attach.php
index 93401226d..c8582f8d3 100644
--- a/include/attach.php
+++ b/include/attach.php
@@ -2320,3 +2320,26 @@ function attach_syspaths($channel_id,$attach_hash) {
 }
 
 
+
+function attach_upgrade() {
+
+	$r = q("select id, uid, hash from attach where os_path = '' and display_path = '' limit 100");
+	if($r) {
+		foreach($r as $rv) {
+			$x = attach_syspaths($rv['uid'],$rv['hash']);
+			if($x) {
+				$w = q("update attach set os_path = '%s', display_path = '%s' where id = %d",
+					dbesc($x['os_path']),
+					dbesc($x['path']),
+					intval($rv['id'])
+				);
+				$y = q("update photo set os_path = '%s', display_path = '%s' where uid = %d and resource_id = '%s'",
+					dbesc($x['os_path']),
+					dbesc($x['path']),
+					intval($rv['uid']),
+					dbesc($rv['hash'])
+				);
+			}
+		}
+	}
+}
\ No newline at end of file
-- 
cgit v1.2.3


From b03cd330e5fe4ede362d77aa2269a3d0dccde62d Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Tue, 21 Mar 2017 20:11:48 -0700
Subject: begin the process of using the relevant attach directory/path for
 photo albums instead of an album basename which may not be unique. Created an
 'ellipsify()' function to shorten long names and keep the beginning and end
 intact

---
 include/photos.php | 48 ++++++++++++++++++++++++++++++++++--------------
 include/text.php   | 11 +++++++++++
 2 files changed, 45 insertions(+), 14 deletions(-)

(limited to 'include')

diff --git a/include/photos.php b/include/photos.php
index 62c7f1c12..de947fd4b 100644
--- a/include/photos.php
+++ b/include/photos.php
@@ -446,7 +446,7 @@ function photo_upload($channel, $observer, $args) {
  *   * \e boolean \b success
  *   * \e array \b albums
  */
-function photos_albums_list($channel, $observer, $sort_key = 'album', $direction = 'asc') {
+function photos_albums_list($channel, $observer, $sort_key = 'display_path', $direction = 'asc') {
 
 	$channel_id     = $channel['channel_id'];
 	$observer_xchan = (($observer) ? $observer['xchan_hash'] : '');
@@ -459,16 +459,31 @@ function photos_albums_list($channel, $observer, $sort_key = 'album', $direction
 	$sort_key = dbesc($sort_key);
 	$direction = dbesc($direction);
 
-	//$albums = q("SELECT count( distinct resource_id ) as total, album from photo where uid = %d and photo_usage IN ( %d, %d ) $sql_extra group by album order by $sort_key $direction",
-	//	intval($channel_id),
-	//	intval(PHOTO_NORMAL),
-	//	intval(PHOTO_PROFILE)
-	//);
-
-	// this query provides the same results but might perform better
-	$albums = q("SELECT count( distinct resource_id ) as total, album from photo where uid = %d and os_storage = 1 $sql_extra group by album order by $sort_key $direction",
+	$r = q("select display_path, hash from attach where is_dir = 1 and uid = %d order by $sort_key $direction",
 		intval($channel_id)
 	);
+	array_unshift($r,[ 'display_path' => '/', 'hash' => '' ]);
+	$str = ids_to_querystr($r,'hash',true);
+
+	$albums = [];
+
+	if($str) {
+		$x = q("select count( distinct hash ) as total, folder from attach where is_photo = 1 and uid = %d and folder in ( $str ) group by folder ",
+			intval($channel_id)
+		);
+		if($x) {
+			foreach($r as $rv) {
+				foreach($x as $xv) {
+					if($xv['folder'] === $rv['hash']) {
+						if($xv['total'] != 0) {
+							$albums[] = [ 'album' => $rv['display_path'], 'folder' => $xv['folder'], 'total' => $xv['total'] ];
+						}
+						continue;
+					}
+				}
+			}
+		}
+	}
 
 	// add various encodings to the array so we can just loop through and pick them out in a template
 
@@ -480,11 +495,12 @@ function photos_albums_list($channel, $observer, $sort_key = 'album', $direction
 		foreach($albums as $k => $album) {
 			$entry = array(
 				'text' => (($album['album']) ? $album['album'] : '/'),
+				'shorttext' => (($album['album']) ? ellipsify($album['album'],28) : '/'),
 				'jstext' => (($album['album']) ? addslashes($album['album']) : '/'),
 				'total' => $album['total'],
-				'url' => z_root() . '/photos/' . $channel['channel_address'] . '/album/' . bin2hex($album['album']),
+				'url' => z_root() . '/photos/' . $channel['channel_address'] . '/album/' . $album['folder'],
 				'urlencode' => urlencode($album['album']),
-				'bin2hex' => bin2hex($album['album'])
+				'bin2hex' => $album['folder']
 			);
 			$ret['albums'][] = $entry;
 		}
@@ -495,7 +511,7 @@ function photos_albums_list($channel, $observer, $sort_key = 'album', $direction
 	return $ret;
 }
 
-function photos_album_widget($channelx,$observer,$sortkey = 'album',$direction = 'asc') {
+function photos_album_widget($channelx,$observer,$sortkey = 'display_path',$direction = 'asc') {
 
 	$o = '';
 
@@ -508,6 +524,7 @@ function photos_album_widget($channelx,$observer,$sortkey = 'album',$direction =
 		$o = replace_macros(get_markup_template('photo_albums.tpl'),array(
 			'$nick'    => $channelx['channel_address'],
 			'$title'   => t('Photo Albums'),
+			'$recent'  => t('Recent Photos'),
 			'$albums'  => $albums['albums'],
 			'$baseurl' => z_root(),
 			'$upload'  => ((perm_is_allowed($channelx['channel_id'],(($observer) ? $observer['xchan_hash'] : ''),'write_storage'))
@@ -566,12 +583,15 @@ function photos_list_photos($channel, $observer, $album = '') {
  * @return boolean
  */
 function photos_album_exists($channel_id, $album) {
-	$r = q("SELECT id FROM photo WHERE album = '%s' AND uid = %d limit 1",
+
+	$sql_extra = permissions_sql($channel_id);
+
+	$r = q("SELECT folder, hash, is_dir, filename, os_path, display_path FROM attach WHERE hash = '%s' AND is_dir = 1 AND uid = %d $sql_extra limit 1",
 		dbesc($album),
 		intval($channel_id)
 	);
 
-	return (($r) ? true : false);
+	return (($r) ? $r[0] : false);
 }
 
 /**
diff --git a/include/text.php b/include/text.php
index c02499625..0a2073272 100644
--- a/include/text.php
+++ b/include/text.php
@@ -3130,3 +3130,14 @@ function array_escape_tags(&$v,$k) {
 	$v = escape_tags($v);
 }
 
+function ellipsify($s,$maxlen) {
+	if($maxlen & 1)
+		$maxlen --;
+	if($maxlen < 4)
+		$maxlen = 4;
+
+	if(mb_strlen($s) < $maxlen)
+		return $s;
+
+	return mb_substr($s,0,$maxlen / 2) . '...' . mb_substr($s,mb_strlen($s) - ($maxlen / 2));
+} 
\ No newline at end of file
-- 
cgit v1.2.3


From 032b6f193df3e9de1e0af1a742f047b4b3e29023 Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Tue, 21 Mar 2017 21:13:14 -0700
Subject: photos_album_exists() requires an observer to work correctly; provide
 it.

---
 include/photos.php | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

(limited to 'include')

diff --git a/include/photos.php b/include/photos.php
index de947fd4b..49c2d66f5 100644
--- a/include/photos.php
+++ b/include/photos.php
@@ -582,9 +582,8 @@ function photos_list_photos($channel, $observer, $album = '') {
  * @param string $album name of the album
  * @return boolean
  */
-function photos_album_exists($channel_id, $album) {
-
-	$sql_extra = permissions_sql($channel_id);
+function photos_album_exists($channel_id, $observer_hash, $album) {
+	$sql_extra = permissions_sql($channel_id,$observer_hash);
 
 	$r = q("SELECT folder, hash, is_dir, filename, os_path, display_path FROM attach WHERE hash = '%s' AND is_dir = 1 AND uid = %d $sql_extra limit 1",
 		dbesc($album),
-- 
cgit v1.2.3


From 9d0e2cbd89d69609b9173511eed53b6033008911 Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Tue, 21 Mar 2017 22:05:36 -0700
Subject: more work on the photo album mess

---
 include/photos.php | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

(limited to 'include')

diff --git a/include/photos.php b/include/photos.php
index 49c2d66f5..e73428478 100644
--- a/include/photos.php
+++ b/include/photos.php
@@ -623,14 +623,15 @@ function photos_album_rename($channel_id, $oldname, $newname) {
  */
 function photos_album_get_db_idstr($channel_id, $album, $remote_xchan = '') {
 
-	if ($remote_xchan) {
-		$r = q("SELECT distinct resource_id from photo where xchan = '%s' and uid = %d and album = '%s' ",
+	if($remote_xchan) {
+		$r = q("SELECT hash from attach where creator = '%s' and uid = %d and folder = '%s' ",
 			dbesc($remote_xchan),
 			intval($channel_id),
 			dbesc($album)
 		);
-	} else {
-		$r = q("SELECT distinct resource_id from photo where uid = %d and album = '%s' ",
+	}
+	else {
+		$r = q("SELECT hash from attach where uid = %d and folder = '%s' ",
 			intval($channel_id),
 			dbesc($album)
 		);
@@ -638,7 +639,7 @@ function photos_album_get_db_idstr($channel_id, $album, $remote_xchan = '') {
 	if ($r) {
 		$arr = array();
 		foreach ($r as $rr) {
-			$arr[] = "'" . dbesc($rr['resource_id']) . "'" ;
+			$arr[] = "'" . dbesc($rr['hash']) . "'" ;
 		}
 		$str = implode(',',$arr);
 		return $str;
-- 
cgit v1.2.3


From f1da00302091c6b9005083d41686934385e97cf8 Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Wed, 22 Mar 2017 16:11:38 -0700
Subject: some more photo issues

---
 include/attach.php | 12 +++++++-----
 include/photos.php |  7 ++++---
 2 files changed, 11 insertions(+), 8 deletions(-)

(limited to 'include')

diff --git a/include/attach.php b/include/attach.php
index c8582f8d3..675dd0da2 100644
--- a/include/attach.php
+++ b/include/attach.php
@@ -209,7 +209,7 @@ function attach_list_files($channel_id, $observer, $hash = '', $filename = '', $
 
 	// Retrieve all columns except 'data'
 
-	$r = q("select id, aid, uid, hash, filename, filetype, filesize, revision, folder, os_storage, is_dir, is_photo, flags, created, edited, allow_cid, allow_gid, deny_cid, deny_gid from attach where uid = %d $sql_extra ORDER BY $orderby $limit",
+	$r = q("select id, aid, uid, hash, filename, filetype, filesize, revision, folder, os_path, display_path, os_storage, is_dir, is_photo, flags, created, edited, allow_cid, allow_gid, deny_cid, deny_gid from attach where uid = %d $sql_extra ORDER BY $orderby $limit",
 		intval($channel_id)
 	);
 
@@ -284,6 +284,7 @@ function attach_by_hash($hash, $observer_hash, $rev = 0) {
 	return $ret;
 }
 
+
 function attach_can_view_folder($uid,$ob_hash,$folder_hash) {
 
 	$sql_extra = permissions_sql($uid,$ob_hash);
@@ -348,7 +349,7 @@ function attach_by_hash_nodata($hash, $observer_hash, $rev = 0) {
 
 	// Now we'll see if we can access the attachment
 
-	$r = q("select id, aid, uid, hash, creator, filename, filetype, filesize, revision, folder, os_storage, is_photo, is_dir, flags, created, edited, allow_cid, allow_gid, deny_cid, deny_gid from attach where uid = %d and hash = '%s' $sql_extra limit 1",
+	$r = q("select id, aid, uid, hash, creator, filename, filetype, filesize, revision, folder, os_storage, is_photo, os_path, display_path, is_dir, flags, created, edited, allow_cid, allow_gid, deny_cid, deny_gid from attach where uid = %d and hash = '%s' $sql_extra limit 1",
 		intval($r[0]['uid']),
 		dbesc($hash)
 	);
@@ -531,7 +532,7 @@ function attach_store($channel, $observer_hash, $options = '', $arr = null) {
 		if($options === 'update' &&  $arr && array_key_exists('revision',$arr))
 			$sql_options = " and revision = " . intval($arr['revision']) . " ";
 
-		$x = q("select id, aid, uid, filename, filetype, filesize, hash, revision, folder, os_storage, is_photo, flags, created, edited, allow_cid, allow_gid, deny_cid, deny_gid from attach where hash = '%s' and uid = %d $sql_options limit 1",
+		$x = q("select id, aid, uid, filename, filetype, filesize, hash, revision, folder, os_storage, is_photo, os_path, display_path, flags, created, edited, allow_cid, allow_gid, deny_cid, deny_gid from attach where hash = '%s' and uid = %d $sql_options limit 1",
 			dbesc($arr['hash']),
 			intval($channel_id)
 		);
@@ -929,7 +930,7 @@ function z_readdir($channel_id, $observer_hash, $pathname, $parent_hash = '') {
 	else
 		$paths = array($pathname);
 
-	$r = q("select id, aid, uid, hash, creator, filename, filetype, filesize, revision, folder, is_photo, is_dir, os_storage, flags, created, edited, allow_cid, allow_gid, deny_cid, deny_gid from attach where id = %d and folder = '%s' and filename = '%s' and is_dir != 0 " . permissions_sql($channel_id),
+	$r = q("select id, aid, uid, hash, creator, filename, filetype, filesize, revision, folder, os_path, display_path, is_photo, is_dir, os_storage, flags, created, edited, allow_cid, allow_gid, deny_cid, deny_gid from attach where id = %d and folder = '%s' and filename = '%s' and is_dir != 0 " . permissions_sql($channel_id),
 		intval($channel_id),
 		dbesc($parent_hash),
 		dbesc($paths[0])
@@ -2342,4 +2343,5 @@ function attach_upgrade() {
 			}
 		}
 	}
-}
\ No newline at end of file
+}
+
diff --git a/include/photos.php b/include/photos.php
index e73428478..a3869a72e 100644
--- a/include/photos.php
+++ b/include/photos.php
@@ -459,23 +459,24 @@ function photos_albums_list($channel, $observer, $sort_key = 'display_path', $di
 	$sort_key = dbesc($sort_key);
 	$direction = dbesc($direction);
 
-	$r = q("select display_path, hash from attach where is_dir = 1 and uid = %d order by $sort_key $direction",
+	$r = q("select display_path, hash from attach where is_dir = 1 and uid = %d $sql_extra order by $sort_key $direction",
 		intval($channel_id)
 	);
+
 	array_unshift($r,[ 'display_path' => '/', 'hash' => '' ]);
 	$str = ids_to_querystr($r,'hash',true);
 
 	$albums = [];
 
 	if($str) {
-		$x = q("select count( distinct hash ) as total, folder from attach where is_photo = 1 and uid = %d and folder in ( $str ) group by folder ",
+		$x = q("select count( distinct hash ) as total, folder from attach where is_photo = 1 and uid = %d and folder in ( $str ) $sql_extra group by folder ",
 			intval($channel_id)
 		);
 		if($x) {
 			foreach($r as $rv) {
 				foreach($x as $xv) {
 					if($xv['folder'] === $rv['hash']) {
-						if($xv['total'] != 0) {
+						if($xv['total'] != 0 && attach_can_view_folder($channel_id,$observer_xchan,$xv['folder'])) {
 							$albums[] = [ 'album' => $rv['display_path'], 'folder' => $xv['folder'], 'total' => $xv['total'] ];
 						}
 						continue;
-- 
cgit v1.2.3


From fe5f109af5f49811639779cf77dc25809be1b2a9 Mon Sep 17 00:00:00 2001
From: zotlabs <mike@macgirvin.com>
Date: Wed, 22 Mar 2017 19:31:43 -0700
Subject: more cloud updates - upgrade the DAV structures as well.

---
 include/attach.php | 46 ++++++++++++++++++++++++++++------------------
 1 file changed, 28 insertions(+), 18 deletions(-)

(limited to 'include')

diff --git a/include/attach.php b/include/attach.php
index 675dd0da2..ac50b05b1 100644
--- a/include/attach.php
+++ b/include/attach.php
@@ -811,7 +811,7 @@ function attach_store($channel, $observer_hash, $options = '', $arr = null) {
 
 	if($is_photo) {
 
-		$args = array( 'source' => $source, 'visible' => $visible, 'resource_id' => $hash, 'album' => basename($pathname), 'os_syspath' => $os_basepath . $os_relpath, 'os_path' => $os_path, 'display_path' => $display_path, 'filename' => $filename, 'getimagesize' => $gis, 'directory' => $direct, 'options' => $options );
+		$args = array( 'source' => $source, 'visible' => $visible, 'resource_id' => $hash, 'album' => $pathname, 'os_syspath' => $os_basepath . $os_relpath, 'os_path' => $os_path, 'display_path' => $display_path, 'filename' => $filename, 'getimagesize' => $gis, 'directory' => $direct, 'options' => $options );
 		if($arr['contact_allow'])
 			$args['contact_allow'] = $arr['contact_allow'];
 		if($arr['group_allow'])
@@ -915,7 +915,7 @@ function z_readdir($channel_id, $observer_hash, $pathname, $parent_hash = '') {
 		if(count($paths) > 1) {
 			$curpath = array_shift($paths);
 
-			$r = q("select hash, id, is_dir from attach where uid = %d and filename = '%s' and is_dir != 0 " . permissions_sql($channel_id) . " limit 1",
+			$r = q("select hash, id, is_dir from attach where uid = %d and filename = '%s' and is_dir != 0 " . permissions_sql($channel_id,$observer_hash) . " limit 1",
 				intval($channel_id),
 				dbesc($curpath)
 			);
@@ -969,12 +969,15 @@ function attach_mkdir($channel, $observer_hash, $arr = null) {
 
 	$sql_options = '';
 
-	$basepath = 'store/' . $channel['channel_address'];
+	$os_basepath = 'store/' . $channel['channel_address'];
 
-	logger('attach_mkdir: basepath: ' . $basepath);
+	logger('attach_mkdir: basepath: ' . $os_basepath);
+
+	if(! is_dir($os_basepath))
+		os_mkdir($os_basepath,STORAGE_DEFAULT_PERMISSIONS, true);
 
-	if(! is_dir($basepath))
-		os_mkdir($basepath,STORAGE_DEFAULT_PERMISSIONS, true);
+
+	$os_basepath .= '/';
 
 	if(! perm_is_allowed($channel_id, $observer_hash, 'write_storage')) {
 		$ret['message'] = t('Permission denied.');
@@ -1020,10 +1023,13 @@ function attach_mkdir($channel, $observer_hash, $arr = null) {
 
 		$lpath = '';
 		$lfile = $arr['folder'];
+		$dpath = '';
+
 		$sql_options = permissions_sql($channel['channel_id']);
 
+
 		do {
-			$r = q("select filename, hash, flags, is_dir, folder from attach where uid = %d and hash = '%s' and is_dir != 0
+			$r = q("select filename, hash, flags, is_dir, folder, display_path from attach where uid = %d and hash = '%s' and is_dir = 1
 				$sql_options limit 1",
 				intval($channel['channel_id']),
 				dbesc($lfile)
@@ -1033,22 +1039,26 @@ function attach_mkdir($channel, $observer_hash, $arr = null) {
 				$ret['message'] = t('Path not found.');
 				return $ret;
 			}
+
+			$dpath = $r[0]['filename'] . (($dpath) ? '/' . $dpath : ''); 
+
 			if($lfile)
-				$lpath = $r[0]['hash'] . '/' . $lpath;
+				$lpath = $r[0]['hash'] . (($lpath) ? '/' . $lpath : '');
+
 			$lfile = $r[0]['folder'];
+
 		} while ( ($r[0]['folder']) && intval($r[0]['is_dir'])) ;
-		$path = $basepath . '/' . $lpath;
+
+		$path = $lpath;
 	}
 	else
-		$path = $basepath . '/';
-
-	$path .= $arr['hash'];
+		$path = '';
 
 	$created = datetime_convert();
 
-	// not yet used
-	$os_path = '';
-	$display_path = '';
+	$os_path = ltrim($path . '/' . $arr['hash'],'/');
+	$display_path = ltrim($dpath . '/' . $arr['filename'],'/');
+
 
 	$r = q("INSERT INTO attach ( aid, uid, hash, creator, filename, filetype, filesize, revision, folder, os_storage, is_dir, content, created, edited, os_path, display_path, allow_cid, allow_gid, deny_cid, deny_gid )
 		VALUES ( %d, %d, '%s', '%s', '%s', '%s', %d, %d, '%s', %d, '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s' ) ",
@@ -1063,7 +1073,7 @@ function attach_mkdir($channel, $observer_hash, $arr = null) {
 		dbesc($arr['folder']),
 		intval(1),
 		intval(1),
-		dbescbin($path),
+		dbescbin($os_basepath . $os_path),
 		dbesc($created),
 		dbesc($created),
 		dbesc($os_path),
@@ -1075,7 +1085,7 @@ function attach_mkdir($channel, $observer_hash, $arr = null) {
 	);
 
 	if($r) {
-		if(os_mkdir($path, STORAGE_DEFAULT_PERMISSIONS, true)) {
+		if(os_mkdir($os_basepath . $os_path, STORAGE_DEFAULT_PERMISSIONS, true)) {
 			$ret['success'] = true;
 
 			// update the parent folder's lastmodified timestamp
@@ -1093,7 +1103,7 @@ function attach_mkdir($channel, $observer_hash, $arr = null) {
 				$ret['data'] = $z[0];
 		}
 		else {
-			logger('attach_mkdir: ' . mkdir . ' ' . $path . ' failed.');
+			logger('attach_mkdir: ' . mkdir . ' ' . $os_basepath . $os_path . ' failed.');
 			$ret['message'] = t('mkdir failed.');
 		}
 	}
-- 
cgit v1.2.3


From 7033966bb860ce21220e21d8feefc574fa9f88a7 Mon Sep 17 00:00:00 2001
From: Mario Vavti <mario@mariovavti.com>
Date: Wed, 29 Mar 2017 15:16:41 +0200
Subject: create channel_store_lowlevel()

---
 include/channel.php | 76 +++++++++++++++++++++++++++++++++++++++--------------
 1 file changed, 56 insertions(+), 20 deletions(-)

(limited to 'include')

diff --git a/include/channel.php b/include/channel.php
index f88a2f8aa..7ad4c6a4c 100644
--- a/include/channel.php
+++ b/include/channel.php
@@ -242,25 +242,22 @@ function create_identity($arr) {
 
 	$expire = 0;
 
-	$r = q("insert into channel ( channel_account_id, channel_primary,
-		channel_name, channel_address, channel_guid, channel_guid_sig,
-		channel_hash, channel_prvkey, channel_pubkey, channel_pageflags, channel_system, channel_expire_days, channel_timezone )
-		values ( %d, %d, '%s', '%s', '%s', '%s', '%s', '%s', '%s', %d, %d, %d, '%s' ) ",
-
-		intval($arr['account_id']),
-		intval($primary),
-		dbesc($name),
-		dbesc($nick),
-		dbesc($guid),
-		dbesc($sig),
-		dbesc($hash),
-		dbesc($key['prvkey']),
-		dbesc($key['pubkey']),
-		intval($pageflags),
-		intval($system),
-		intval($expire),
-		dbesc(App::$timezone)
-	);
+	$r = channel_store_lowlevel(
+		[
+			'channel_account_id'  => intval($arr['account_id']),
+			'channel_primary'     => intval($primary),
+			'channel_name'        => $name,
+			'channel_address'     => $nick,
+			'channel_guid'        => $guid,
+			'channel_guid_sig'    => $sig,
+			'channel_hash'        => $hash,
+			'channel_prvkey'      => $key['prvkey'],
+			'channel_pubkey'      => $key['pubkey'],
+			'channel_pageflags'   => intval($pageflags),
+			'channel_system'      => intval($system),
+			'channel_expire_days' => intval($expire),
+			'channel_timezone'    => App::$timezone
+		]
 
 	$r = q("select * from channel where channel_account_id = %d
 		and channel_guid = '%s' limit 1",
@@ -1990,6 +1987,45 @@ function remote_login() {
 }
 
 
+function channel_store_lowlevel($arr) {
+
+	$store = [
+		'channel_account_id'      => ((array_key_exists('channel_account_id',$arr))      ? $arr['channel_account_id']      : '0'),
+		'channel_primary'         => ((array_key_exists('channel_primary',$arr))         ? $arr['channel_primary']         : '0'),
+		'channel_name'            => ((array_key_exists('channel_name',$arr))            ? $arr['channel_name']            : ''),
+		'channel_address'         => ((array_key_exists('channel_address',$arr))         ? $arr['channel_address']         : ''),
+		'channel_guid'            => ((array_key_exists('channel_guid',$arr))            ? $arr['channel_guid']            : ''),
+		'channel_guid_sig'        => ((array_key_exists('channel_guid_sig',$arr))        ? $arr['channel_guid_sig']        : ''),
+		'channel_hash'            => ((array_key_exists('channel_hash',$arr))            ? $arr['channel_hash']            : ''),
+		'channel_timezone'        => ((array_key_exists('channel_timezone',$arr))        ? $arr['channel_timezone']        : 'UTC'),
+		'channel_location'        => ((array_key_exists('channel_location',$arr))        ? $arr['channel_location']        : ''),
+		'channel_theme'           => ((array_key_exists('channel_theme',$arr))           ? $arr['channel_theme']           : ''),
+		'channel_startpage'       => ((array_key_exists('channel_startpage',$arr))       ? $arr['channel_startpage']       : ''),
+		'channel_pubkey'          => ((array_key_exists('channel_pubkey',$arr))          ? $arr['channel_pubkey']          : ''),
+		'channel_prvkey'          => ((array_key_exists('channel_prvkey',$arr))          ? $arr['channel_prvkey']          : ''),
+		'channel_notifyflags'     => ((array_key_exists('channel_notifyflags',$arr))     ? $arr['channel_notifyflags']     : '65535'),
+		'channel_pageflags'       => ((array_key_exists('channel_pageflags',$arr))       ? $arr['channel_pageflags']       : '0'),
+		'channel_dirdate'         => ((array_key_exists('channel_dirdate',$arr))         ? $arr['channel_dirdate']         : NULL_DATE),
+		'channel_lastpost'        => ((array_key_exists('channel_lastpost',$arr))        ? $arr['channel_lastpost']        : NULL_DATE),
+		'channel_deleted'         => ((array_key_exists('channel_deleted',$arr))         ? $arr['channel_deleted']         : NULL_DATE),
+		'channel_max_anon_mail'   => ((array_key_exists('channel_max_anon_mail',$arr))   ? $arr['channel_max_anon_mail']   : '10'),
+		'channel_max_friend_req'  => ((array_key_exists('channel_max_friend_req',$arr))  ? $arr['channel_max_friend_req']  : '10'),
+		'channel_expire_days'     => ((array_key_exists('channel_expire_days',$arr))     ? $arr['channel_expire_days']     : '0'),
+		'channel_passwd_reset'    => ((array_key_exists('channel_passwd_reset',$arr))    ? $arr['channel_passwd_reset']    : ''),
+		'channel_default_group'   => ((array_key_exists('channel_default_group',$arr))   ? $arr['channel_default_group']   : ''),
+		'channel_allow_cid'       => ((array_key_exists('channel_allow_cid',$arr))       ? $arr['channel_allow_cid']       : ''),
+		'channel_allow_gid'       => ((array_key_exists('channel_allow_gid',$arr))       ? $arr['channel_allow_gid']       : ''),
+		'channel_deny_cid'        => ((array_key_exists('channel_deny_cid',$arr))        ? $arr['channel_deny_cid']        : ''),
+		'channel_deny_gid'        => ((array_key_exists('channel_deny_gid',$arr))        ? $arr['channel_deny_gid']        : ''),
+		'channel_removed'         => ((array_key_exists('channel_removed',$arr))         ? $arr['channel_removed']         : '0'),
+		'channel_system'          => ((array_key_exists('channel_system',$arr))          ? $arr['channel_system']          : '0'),
+		'channel_moved'           => ((array_key_exists('channel_moved',$arr))           ? $arr['channel_moved']           : '')
+	];
+
+	return create_table_from_array('channel',$store);
+
+}
+
 
 function profile_store_lowlevel($arr) {
 
@@ -2263,4 +2299,4 @@ function channel_codeallowed($channel_id) {
 	if(($x) && ($x['channel_pageflags'] & PAGE_ALLOWCODE))
 		return true;
 	return false;
-}
\ No newline at end of file
+}
-- 
cgit v1.2.3


From 29c9972b868468e3d37c8ed79a458288d3e35de0 Mon Sep 17 00:00:00 2001
From: Mario Vavti <mario@mariovavti.com>
Date: Wed, 29 Mar 2017 15:19:54 +0200
Subject: missing closing bracket and semicolon

---
 include/channel.php | 1 +
 1 file changed, 1 insertion(+)

(limited to 'include')

diff --git a/include/channel.php b/include/channel.php
index 7ad4c6a4c..1bdd5a478 100644
--- a/include/channel.php
+++ b/include/channel.php
@@ -258,6 +258,7 @@ function create_identity($arr) {
 			'channel_expire_days' => intval($expire),
 			'channel_timezone'    => App::$timezone
 		]
+	);
 
 	$r = q("select * from channel where channel_account_id = %d
 		and channel_guid = '%s' limit 1",
-- 
cgit v1.2.3