Merge remote-tracking branch 'upstream/develop' into develop

LICENSE

@@ -1,5 +1,5 @@
 Friendica Communications Server
-Copyright (c) 2010-2013 the Friendica Project
+Copyright (c) 2010-2016 the Friendica Project
 
 	This program is free software: you can redistribute it and/or modify
     it under the terms of the GNU Affero General Public License as published by

boot.php

@@ -36,7 +36,7 @@ require_once('include/dbstructure.php');
 
 define ( 'FRIENDICA_PLATFORM',     'Friendica');
 define ( 'FRIENDICA_CODENAME',     'Asparagus');
-define ( 'FRIENDICA_VERSION',      '3.5' );
+define ( 'FRIENDICA_VERSION',      '3.5.1-dev' );
 define ( 'DFRN_PROTOCOL_VERSION',  '2.23'    );
 define ( 'DB_UPDATE_VERSION',      1202      );
 

doc/Settings.md

@@ -9,7 +9,8 @@ This number should decrease quickly.
 The second is the messages which could for various reasons not being delivered.
 They will be resend later.
 You can have a quick glance into that second queus in the "Inspect Queue" section of the admin panel.
-If you have activated the background workers, there might be a third number representing the count of jobs queued for the workers.
+If you have activated the background workers, there is a third number representing the count of jobs queued for the workers.
+These worker tasks are prioritised and are done accordingly.
 
 Then you get an overview of the accounts on your node, which can be moderated in the "Users" section of the panel.
 As well as an overview of the currently active addons

doc/de/Settings.md

@@ -9,8 +9,9 @@ Diese Zahl sollte sich relativ schnell sinken.
 Die zweite Zahl gibt die Anzahl von Nachrichten an, die nicht zugestellt werden konnten.
 Die Zustellung wird zu einem späteren Zeitpunkt noch einmal versucht.
 Unter dem Punkt "Warteschlange Inspizieren" kannst du einen schnellen Blick auf die zweite Warteschlange werfen.
-Solltest du für die Hintergrundprozesse die Worker aktiviert haben, könntest du eine dritte Zahl angezeigt bekommen.
+Solltest du für die Hintergrundprozesse die Worker aktiviert haben, wird eine dritte Zahl angezeigt.
 Diese repräsentiert die Anzahl der Aufgaben, die die Worker noch vor sich haben.
+Die Aufgaben der Worker sind priorisiert und werden anhand dieser Prioritäten abgearbeitet.
 
 Des weiteren findest du eine Übersicht über die Accounts auf dem Friendica Knoten, die unter dem Punkt "Nutzer" moderiert werden können.
 Sowie eine Liste der derzeit aktivierten Addons.

include/auth_ejabberd.php

@@ -47,9 +47,8 @@ require_once("boot.php");
 
 global $a, $db;
 
-if(is_null($a)) {
+if (is_null($a))
 	$a = new App;
-}
 
 if (is_null($db)) {
 	@include(".htconfig.php");
@@ -66,94 +65,177 @@ $bDebug	= get_config('jabber','debug');
 
 $oAuth = new exAuth($sLogFile, $bDebug);
 
-class exAuth
-{
+class exAuth {
 	private $sLogFile;
 	private $bDebug;
 
 	private $rLogFile;
 
-	public function __construct($sLogFile, $bDebug)
-	{
+	/**
+	 * @brief Create the class and do the authentification studd
+	 *
+	 * @param string $sLogFile The logfile name
+	 * @param boolean $bDebug Debug mode
+	 */
+	public function __construct($sLogFile, $bDebug) {
 		global $db;
 
 		// setter
 		$this->sLogFile 	= $sLogFile;
 		$this->bDebug		= $bDebug;
 
-		// ovo ne provjeravamo jer ako ne mozes kreirati log file, onda si u kvascu :)
+		// Open the logfile if the logfile name is defined
 		if ($this->sLogFile != '')
 			$this->rLogFile = fopen($this->sLogFile, "a") or die("Error opening log file: ". $this->sLogFile);
 
 		$this->writeLog("[exAuth] start");
 
-		// ovdje bi trebali biti spojeni na MySQL, imati otvoren log i zavrtit cekalicu
+		// We are connected to the SQL server and are having a log file.
 		do {
+			// Quit if the database connection went down
+			if (!$db->connected()) {
+				$this->writeDebugLog("[debug] the database connection went down");
+				return;
+			}
+
 			$iHeader = fgets(STDIN, 3);
 			$aLength = unpack("n", $iHeader);
 			$iLength = $aLength["1"];
-			if($iLength > 0) {
-				// ovo znaci da smo nesto dobili
+
+			// No data? Then quit
+			if ($iLength == 0) {
+				$this->writeDebugLog("[debug] we got no data");
+				return;
+			}
+
+			// Fetching the data
 			$sData = fgets(STDIN, $iLength + 1);
 			$this->writeDebugLog("[debug] received data: ". $sData);
 			$aCommand = explode(":", $sData);
 			if (is_array($aCommand)) {
 				switch ($aCommand[0]) {
 					case "isuser":
-							// provjeravamo je li korisnik dobar
+						// Check the existance of a given username
+						$this->isuser($aCommand);
+						break;
+					case "auth":
+						// Check if the givven password is correct
+						$this->auth($aCommand);
+						break;
+					case "setpass":
+						// We don't accept the setting of passwords here
+						$this->writeLog("[exAuth] setpass command disabled");
+						fwrite(STDOUT, pack("nn", 2, 0));
+						break;
+					default:
+						// We don't know the given command
+						$this->writeLog("[exAuth] unknown command ". $aCommand[0]);
+						fwrite(STDOUT, pack("nn", 2, 0));
+						break;
+				}
+			} else {
+				$this->writeDebugLog("[debug] invalid command string");
+				fwrite(STDOUT, pack("nn", 2, 0));
+			}
+		} while (true);
+	}
+
+	/**
+	 * @brief Check if the given username exists
+	 *
+	 * @param array $aCommand The command array
+	 */
+	private function isuser($aCommand) {
+		global $a;
+
+		// Check if there is a username
 		if (!isset($aCommand[1])) {
 			$this->writeLog("[exAuth] invalid isuser command, no username given");
 			fwrite(STDOUT, pack("nn", 2, 0));
-							} else {
-								// ovdje provjeri je li korisnik OK
+			return;
+		}
+
+		// Now we check if the given user is valid
 		$sUser = str_replace(array("%20", "(a)"), array(" ", "@"), $aCommand[1]);
-								$this->writeDebugLog("[debug] checking isuser for ". $sUser);
-								$sQuery = "SELECT `uid` FROM `user` WHERE `nickname`='". $db->escape($sUser) ."'";
+		$this->writeDebugLog("[debug] checking isuser for ". $sUser."@".$aCommand[2]);
+
+		// If the hostnames doesn't match, we try to check remotely
+		if ($a->get_hostname() != $aCommand[2])
+			$found = $this->check_user($aCommand[2], $aCommand[1], true);
+		else {
+			$sQuery = "SELECT `uid` FROM `user` WHERE `nickname`='".dbesc($sUser)."'";
 			$this->writeDebugLog("[debug] using query ". $sQuery);
-								if ($oResult = q($sQuery)){
-									if ($oResult) {
-										// korisnik OK
+			$r = q($sQuery);
+			$found = dbm::is_result($r);
+		}
+
+		if ($found) {
+			// The user is okay
 			$this->writeLog("[exAuth] valid user: ". $sUser);
 			fwrite(STDOUT, pack("nn", 2, 1));
 		} else {
-										// korisnik nije OK
+			// The user isn't okay
 			$this->writeLog("[exAuth] invalid user: ". $sUser);
 			fwrite(STDOUT, pack("nn", 2, 0));
 		}
-									//$oResult->close();
-								} else {
-									$this->writeLog("[MySQL] invalid query: ". $sQuery);
-									fwrite(STDOUT, pack("nn", 2, 0));
 	}
+
+	/**
+	 * @brief Check remote user existance via HTTP(S)
+	 *
+	 * @param string $host The hostname
+	 * @param string $user Username
+	 * @param boolean $ssl Should the check be done via SSL?
+	 *
+	 * @return boolean Was the user found?
+	 */
+	private function check_user($host, $user, $ssl) {
+
+		$url = ($ssl ? "https":"http")."://".$host."/noscrape/".$user;
+
+		$data = z_fetch_url($url);
+
+		if (!is_array($data))
+			return(false);
+
+		if ($data["return_code"] != "200")
+			return(false);
+
+		$json = @json_decode($data["body"]);
+		if (!is_object($json))
+			return(false);
+
+		return($json->nick == $user);
 	}
-						break;
-						case "auth":
-							// provjeravamo autentifikaciju korisnika
+
+	/**
+	 * @brief Authenticate the givven user and password
+	 *
+	 * @param array $aCommand The command array
+	 */
+	private function auth($aCommand) {
+		global $a;
+
+		// check user authentication
 		if (sizeof($aCommand) != 4) {
 			$this->writeLog("[exAuth] invalid auth command, data missing");
 			fwrite(STDOUT, pack("nn", 2, 0));
-							} else {
-								// ovdje provjeri prijavu
+			return;
+		}
+
+		// We now check if the password match
 		$sUser = str_replace(array("%20", "(a)"), array(" ", "@"), $aCommand[1]);
-								$this->writeDebugLog("[debug] doing auth for ". $sUser);
-								//$sQuery = "SELECT `uid`, `password` FROM `user` WHERE `password`='".hash('whirlpool',$aCommand[3])."' AND `nickname`='". $db->escape($sUser) ."'";
-								$sQuery = "SELECT `uid`, `password` FROM `user` WHERE `nickname`='". $db->escape($sUser) ."'";
+		$this->writeDebugLog("[debug] doing auth for ".$sUser."@".$aCommand[2]);
+
+		// If the hostnames doesn't match, we try to authenticate remotely
+		if ($a->get_hostname() != $aCommand[2])
+			$Error = !$this->check_credentials($aCommand[2], $aCommand[1], $aCommand[3], true);
+		else {
+			$sQuery = "SELECT `uid`, `password` FROM `user` WHERE `nickname`='".dbesc($sUser)."'";
 			$this->writeDebugLog("[debug] using query ". $sQuery);
 			if ($oResult = q($sQuery)) {
 				$uid = $oResult[0]["uid"];
 				$Error = ($oResult[0]["password"] != hash('whirlpool',$aCommand[3]));
-/*
-									if ($oResult[0]["password"] == hash('whirlpool',$aCommand[3])) {
-										// korisnik OK
-										$this->writeLog("[exAuth] authentificated user ". $sUser ."@". $aCommand[2]);
-										fwrite(STDOUT, pack("nn", 2, 1));
-									} else {
-										// korisnik nije OK
-										$this->writeLog("[exAuth] authentification failed for user ". $sUser ."@". $aCommand[2]);
-										fwrite(STDOUT, pack("nn", 2, 0));
-									}
-									$oResult->close();
-*/
 			} else {
 				$this->writeLog("[MySQL] invalid query: ". $sQuery);
 				$Error = true;
@@ -164,6 +246,7 @@ class exAuth
 				$this->writeLog("[exAuth] got password ".$oConfig[0]["v"]);
 				$Error = ($aCommand[3] != $oConfig[0]["v"]);
 			}
+		}
 
 		if ($Error) {
 			$this->writeLog("[exAuth] authentification failed for user ".$sUser."@". $aCommand[2]);
@@ -173,55 +256,70 @@ class exAuth
 			fwrite(STDOUT, pack("nn", 2, 1));
 		}
 	}
-						break;
-						case "setpass":
-							// postavljanje zaporke, onemoguceno
-							$this->writeLog("[exAuth] setpass command disabled");
-							fwrite(STDOUT, pack("nn", 2, 0));
-						break;
-						default:
-							// ako je uhvaceno ista drugo
-							$this->writeLog("[exAuth] unknown command ". $aCommand[0]);
-							fwrite(STDOUT, pack("nn", 2, 0));
-						break;
-					}
-				} else {
-					$this->writeDebugLog("[debug] invalid command string");
-					fwrite(STDOUT, pack("nn", 2, 0));
-				}
-			}
-			unset ($iHeader);
-			unset ($aLength);
-			unset ($iLength);
-			unset($aCommand);
-		} while (true);
+
+	/**
+	 * @brief Check remote credentials via HTTP(S)
+	 *
+	 * @param string $host The hostname
+	 * @param string $user Username
+	 * @param string $password Password
+	 * @param boolean $ssl Should the check be done via SSL?
+	 *
+	 * @return boolean Are the credentials okay?
+	 */
+	private function check_credentials($host, $user, $password, $ssl) {
+		$this->writeDebugLog("[debug] check credentials for user ".$user." on ".$host);
+
+		$url = ($ssl ? "https":"http")."://".$host."/api/account/verify_credentials.json";
+
+		$ch = curl_init();
+		curl_setopt($ch, CURLOPT_URL, $url);
+		curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
+		curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5);
+		curl_setopt($ch, CURLOPT_HEADER, true);
+		curl_setopt($ch, CURLOPT_NOBODY, true);
+		curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
+		curl_setopt($ch, CURLOPT_USERPWD, $user.':'.$password);
+
+		$header = curl_exec($ch);
+		$curl_info = @curl_getinfo($ch);
+		$http_code = $curl_info["http_code"];
+		curl_close($ch);
+
+		$this->writeDebugLog("[debug] got HTTP code ".$http_code);
+
+		return ($http_code == 200);
 	}
 
-	public function __destruct()
-	{
-		// zatvori log file
+	/**
+	 * @brief write data to the logfile
+	 *
+	 * @param string $sMessage The logfile message
+	 */
+	private function writeLog($sMessage) {
+		if (is_resource($this->rLogFile))
+			fwrite($this->rLogFile, date("r")." ".$sMessage."\n");
+	}
+
+	/**
+	 * @brief write debug data to the logfile
+	 *
+	 * @param string $sMessage The logfile message
+	 */
+	private function writeDebugLog($sMessage) {
+		if ($this->bDebug)
+			$this->writeLog($sMessage);
+	}
+
+	/**
+	 * @brief destroy the class
+	 */
+	public function __destruct() {
+		// close the log file
 		$this->writeLog("[exAuth] stop");
 
-		if (is_resource($this->rLogFile)){
+		if (is_resource($this->rLogFile))
 			fclose($this->rLogFile);
 	}
 }
-
-	private function writeLog($sMessage)
-	{
-		if (is_resource($this->rLogFile)) {
-			fwrite($this->rLogFile, date("r") ." ". $sMessage ."\n");
-		}
-	}
-
-	private function writeDebugLog($sMessage)
-	{
-		if ($this->bDebug){
-			$this->writeLog($sMessage);
-		}
-	}
-
-}
 ?>
-
-

include/dba.php

@@ -249,6 +249,15 @@ class dba {
 		}
 	}
 
+	function connected() {
+		if ($this->mysqli)
+			$connected = $this->db->ping();
+		else
+			$connected = mysql_ping($this->db);
+
+		return $connected;
+	}
+
 	function __destruct() {
 		if ($this->db)
 			if($this->mysqli)

include/text.php

@@ -988,7 +988,7 @@ function search($s,$id='search-box',$url='search',$save = false, $aside = true)
 	$a = get_app();
 
 	$values = array(
-			'$s' => $s,
+			'$s' => htmlspecialchars($s),
 			'$id' => $id,
 			'$action_url' => $url,
 			'$search_label' => t('Search'),

mod/admin.php

@@ -460,6 +460,7 @@ function admin_page_summary(&$a) {
 		'$title' => t('Administration'),
 		'$page' => t('Summary'),
 		'$queues' => $queues,
+		'$workeractive' => get_config('system','worker'),
 		'$users' => array(t('Registered users'), $users),
 		'$accounts' => $accounts,
 		'$pending' => array(t('Pending registrations'), $pending),
@@ -1868,6 +1869,12 @@ function admin_page_logs(&$a){
 		LOGGER_ALL	=> 'All'
 	);
 	
+	if (ini_get('log_errors')) {
+		$phplogenabled = t('PHP log currently enabled.');
+	} else {
+		$phplogenabled = t('PHP log currently disabled.');
+	}
+
 	$t = get_markup_template("admin_logs.tpl");
 
 	return replace_macros($t, array(
@@ -1887,6 +1894,7 @@ function admin_page_logs(&$a){
 		'$phpheader' => t("PHP logging"),
 		'$phphint' => t("To enable logging of PHP errors and warnings you can add the following to the .htconfig.php file of your installation. The filename set in the 'error_log' line is relative to the friendica top-level directory and must be writeable by the web server. The option '1' for 'log_errors' and 'display_errors' is to enable these options, set to '0' to disable them."),
 		'$phplogcode' => "error_reporting(E_ERROR | E_WARNING | E_PARSE);\nini_set('error_log','php.out');\nini_set('log_errors','1');\nini_set('display_errors', '1');",
+		'$phplogenabled' => $phplogenabled,
 	));
 }
 

mod/profile.php

@@ -10,7 +10,7 @@ function profile_init(&$a) {
 		$a->page['aside'] = '';
 
 	if($a->argc > 1)
-		$which = $a->argv[1];
+		$which = htmlspecialchars($a->argv[1]);
 	else {
 		$r = q("select nickname from user where blocked = 0 and account_expired = 0 and account_removed = 0 and verified = 1 order by rand() limit 1");
 		if(count($r)) {
@@ -27,7 +27,7 @@ function profile_init(&$a) {
 	$profile = 0;
 	if((local_user()) && ($a->argc > 2) && ($a->argv[2] === 'view')) {
 		$which = $a->user['nickname'];
-		$profile = $a->argv[1];
+		$profile = htmlspecialchars($a->argv[1]);
 	}
 	else {
 		auto_redir($a, $which);

view/templates/admin_logs.tpl

@@ -14,6 +14,7 @@
 
 	<h2>{{$phpheader}}</h2>
 	<div>
+		<p>{{$phplogenabled}}<p>
 		<p>{{$phphint}}</p>
 		<pre>{{$phplogcode}}</pre>
 	</div>

view/templates/admin_summary.tpl

@@ -4,7 +4,7 @@
 
 	<dl>
 		<dt>{{$queues.label}}</dt>
-		<dd>{{$queues.deliverq}} - <a href="{{$baseurl}}/admin/queue">{{$queues.queue}}</a>{{if $queues.workerq}} - {{$queues.workerq}}{{/if}}</dd>
+		<dd>{{$queues.deliverq}} - <a href="{{$baseurl}}/admin/queue">{{$queues.queue}}</a>{{if $workeractive}} - {{$queues.workerq}}{{/if}}</dd>
 	</dl>
 	<dl>
 		<dt>{{$pending.0}}</dt>

view/theme/frio/frameworks/autosize/LICENSE.md

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2015 Jack Moore
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

view/theme/frio/frameworks/autosize/autosize.js

@@ -0,0 +1,262 @@
+/*!
+	Autosize 3.0.17
+	license: MIT
+	http://www.jacklmoore.com/autosize
+*/
+(function (global, factory) {
+	if (typeof define === 'function' && define.amd) {
+		define(['exports', 'module'], factory);
+	} else if (typeof exports !== 'undefined' && typeof module !== 'undefined') {
+		factory(exports, module);
+	} else {
+		var mod = {
+			exports: {}
+		};
+		factory(mod.exports, mod);
+		global.autosize = mod.exports;
+	}
+})(this, function (exports, module) {
+	'use strict';
+
+	var set = typeof Set === 'function' ? new Set() : (function () {
+		var list = [];
+
+		return {
+			has: function has(key) {
+				return Boolean(list.indexOf(key) > -1);
+			},
+			add: function add(key) {
+				list.push(key);
+			},
+			'delete': function _delete(key) {
+				list.splice(list.indexOf(key), 1);
+			} };
+	})();
+
+	var createEvent = function createEvent(name) {
+		return new Event(name);
+	};
+	try {
+		new Event('test');
+	} catch (e) {
+		// IE does not support `new Event()`
+		createEvent = function (name) {
+			var evt = document.createEvent('Event');
+			evt.initEvent(name, true, false);
+			return evt;
+		};
+	}
+
+	function assign(ta) {
+		if (!ta || !ta.nodeName || ta.nodeName !== 'TEXTAREA' || set.has(ta)) return;
+
+		var heightOffset = null;
+		var clientWidth = ta.clientWidth;
+		var cachedHeight = null;
+
+		function init() {
+			var style = window.getComputedStyle(ta, null);
+
+			if (style.resize === 'vertical') {
+				ta.style.resize = 'none';
+			} else if (style.resize === 'both') {
+				ta.style.resize = 'horizontal';
+			}
+
+			if (style.boxSizing === 'content-box') {
+				heightOffset = -(parseFloat(style.paddingTop) + parseFloat(style.paddingBottom));
+			} else {
+				heightOffset = parseFloat(style.borderTopWidth) + parseFloat(style.borderBottomWidth);
+			}
+			// Fix when a textarea is not on document body and heightOffset is Not a Number
+			if (isNaN(heightOffset)) {
+				heightOffset = 0;
+			}
+
+			update();
+		}
+
+		function changeOverflow(value) {
+			{
+				// Chrome/Safari-specific fix:
+				// When the textarea y-overflow is hidden, Chrome/Safari do not reflow the text to account for the space
+				// made available by removing the scrollbar. The following forces the necessary text reflow.
+				var width = ta.style.width;
+				ta.style.width = '0px';
+				// Force reflow:
+				/* jshint ignore:start */
+				ta.offsetWidth;
+				/* jshint ignore:end */
+				ta.style.width = width;
+			}
+
+			ta.style.overflowY = value;
+
+			resize();
+		}
+
+		function getParentOverflows(el) {
+			var arr = [];
+
+			while (el && el.parentNode && el.parentNode instanceof Element) {
+				if (el.parentNode.scrollTop) {
+					arr.push({
+						node: el.parentNode,
+						scrollTop: el.parentNode.scrollTop });
+				}
+				el = el.parentNode;
+			}
+
+			return arr;
+		}
+
+		function resize() {
+			var originalHeight = ta.style.height;
+			var overflows = getParentOverflows(ta);
+			var docTop = document.documentElement && document.documentElement.scrollTop; // Needed for Mobile IE (ticket #240)
+
+			ta.style.height = 'auto';
+
+			var endHeight = ta.scrollHeight + heightOffset;
+
+			if (ta.scrollHeight === 0) {
+				// If the scrollHeight is 0, then the element probably has display:none or is detached from the DOM.
+				ta.style.height = originalHeight;
+				return;
+			}
+
+			ta.style.height = endHeight + 'px';
+
+			// used to check if an update is actually necessary on window.resize
+			clientWidth = ta.clientWidth;
+
+			// prevents scroll-position jumping
+			overflows.forEach(function (el) {
+				el.node.scrollTop = el.scrollTop;
+			});
+
+			if (docTop) {
+				document.documentElement.scrollTop = docTop;
+			}
+		}
+
+		function update() {
+			resize();
+
+			var computed = window.getComputedStyle(ta, null);
+			var computedHeight = Math.round(parseFloat(computed.height));
+			var styleHeight = Math.round(parseFloat(ta.style.height));
+
+			// The computed height not matching the height set via resize indicates that
+			// the max-height has been exceeded, in which case the overflow should be set to visible.
+			if (computedHeight !== styleHeight) {
+				if (computed.overflowY !== 'visible') {
+					changeOverflow('visible');
+				}
+			} else {
+				// Normally keep overflow set to hidden, to avoid flash of scrollbar as the textarea expands.
+				if (computed.overflowY !== 'hidden') {
+					changeOverflow('hidden');
+				}
+			}
+
+			if (cachedHeight !== computedHeight) {
+				cachedHeight = computedHeight;
+				var evt = createEvent('autosize:resized');
+				ta.dispatchEvent(evt);
+			}
+		}
+
+		var pageResize = function pageResize() {
+			if (ta.clientWidth !== clientWidth) {
+				update();
+			}
+		};
+
+		var destroy = (function (style) {
+			window.removeEventListener('resize', pageResize, false);
+			ta.removeEventListener('input', update, false);
+			ta.removeEventListener('keyup', update, false);
+			ta.removeEventListener('autosize:destroy', destroy, false);
+			ta.removeEventListener('autosize:update', update, false);
+			set['delete'](ta);
+
+			Object.keys(style).forEach(function (key) {
+				ta.style[key] = style[key];
+			});
+		}).bind(ta, {
+			height: ta.style.height,
+			resize: ta.style.resize,
+			overflowY: ta.style.overflowY,
+			overflowX: ta.style.overflowX,
+			wordWrap: ta.style.wordWrap });
+
+		ta.addEventListener('autosize:destroy', destroy, false);
+
+		// IE9 does not fire onpropertychange or oninput for deletions,
+		// so binding to onkeyup to catch most of those events.
+		// There is no way that I know of to detect something like 'cut' in IE9.
+		if ('onpropertychange' in ta && 'oninput' in ta) {
+			ta.addEventListener('keyup', update, false);
+		}
+
+		window.addEventListener('resize', pageResize, false);
+		ta.addEventListener('input', update, false);
+		ta.addEventListener('autosize:update', update, false);
+		set.add(ta);
+		ta.style.overflowX = 'hidden';
+		ta.style.wordWrap = 'break-word';
+
+		init();
+	}
+
+	function destroy(ta) {
+		if (!(ta && ta.nodeName && ta.nodeName === 'TEXTAREA')) return;
+		var evt = createEvent('autosize:destroy');
+		ta.dispatchEvent(evt);
+	}
+
+	function update(ta) {
+		if (!(ta && ta.nodeName && ta.nodeName === 'TEXTAREA')) return;
+		var evt = createEvent('autosize:update');
+		ta.dispatchEvent(evt);
+	}
+
+	var autosize = null;
+
+	// Do nothing in Node.js environment and IE8 (or lower)
+	if (typeof window === 'undefined' || typeof window.getComputedStyle !== 'function') {
+		autosize = function (el) {
+			return el;
+		};
+		autosize.destroy = function (el) {
+			return el;
+		};
+		autosize.update = function (el) {
+			return el;
+		};
+	} else {
+		autosize = function (el, options) {
+			if (el) {
+				Array.prototype.forEach.call(el.length ? el : [el], function (x) {
+					return assign(x, options);
+				});
+			}
+			return el;
+		};
+		autosize.destroy = function (el) {
+			if (el) {
+				Array.prototype.forEach.call(el.length ? el : [el], destroy);
+			}
+			return el;
+		};
+		autosize.update = function (el) {
+			if (el) {
+				Array.prototype.forEach.call(el.length ? el : [el], update);
+			}
+			return el;
+		};
+	}
+
+	module.exports = autosize;
+});

view/theme/frio/frameworks/autosize/autosize.min.js

@@ -0,0 +1,6 @@
+/*!
+	Autosize 3.0.17
+	license: MIT
+	http://www.jacklmoore.com/autosize
+*/
+!function(e,t){if("function"==typeof define&&define.amd)define(["exports","module"],t);else if("undefined"!=typeof exports&&"undefined"!=typeof module)t(exports,module);else{var n={exports:{}};t(n.exports,n),e.autosize=n.exports}}(this,function(e,t){"use strict";function n(e){function t(){var t=window.getComputedStyle(e,null);"vertical"===t.resize?e.style.resize="none":"both"===t.resize&&(e.style.resize="horizontal"),l="content-box"===t.boxSizing?-(parseFloat(t.paddingTop)+parseFloat(t.paddingBottom)):parseFloat(t.borderTopWidth)+parseFloat(t.borderBottomWidth),isNaN(l)&&(l=0),a()}function n(t){var n=e.style.width;e.style.width="0px",e.offsetWidth,e.style.width=n,e.style.overflowY=t,r()}function o(e){for(var t=[];e&&e.parentNode&&e.parentNode instanceof Element;)e.parentNode.scrollTop&&t.push({node:e.parentNode,scrollTop:e.parentNode.scrollTop}),e=e.parentNode;return t}function r(){var t=e.style.height,n=o(e),r=document.documentElement&&document.documentElement.scrollTop;e.style.height="auto";var i=e.scrollHeight+l;return 0===e.scrollHeight?void(e.style.height=t):(e.style.height=i+"px",s=e.clientWidth,n.forEach(function(e){e.node.scrollTop=e.scrollTop}),void(r&&(document.documentElement.scrollTop=r)))}function a(){r();var t=window.getComputedStyle(e,null),o=Math.round(parseFloat(t.height)),i=Math.round(parseFloat(e.style.height));if(o!==i?"visible"!==t.overflowY&&n("visible"):"hidden"!==t.overflowY&&n("hidden"),u!==o){u=o;var a=d("autosize:resized");e.dispatchEvent(a)}}if(e&&e.nodeName&&"TEXTAREA"===e.nodeName&&!i.has(e)){var l=null,s=e.clientWidth,u=null,c=function(){e.clientWidth!==s&&a()},p=function(t){window.removeEventListener("resize",c,!1),e.removeEventListener("input",a,!1),e.removeEventListener("keyup",a,!1),e.removeEventListener("autosize:destroy",p,!1),e.removeEventListener("autosize:update",a,!1),i["delete"](e),Object.keys(t).forEach(function(n){e.style[n]=t[n]})}.bind(e,{height:e.style.height,resize:e.style.resize,overflowY:e.style.overflowY,overflowX:e.style.overflowX,wordWrap:e.style.wordWrap});e.addEventListener("autosize:destroy",p,!1),"onpropertychange"in e&&"oninput"in e&&e.addEventListener("keyup",a,!1),window.addEventListener("resize",c,!1),e.addEventListener("input",a,!1),e.addEventListener("autosize:update",a,!1),i.add(e),e.style.overflowX="hidden",e.style.wordWrap="break-word",t()}}function o(e){if(e&&e.nodeName&&"TEXTAREA"===e.nodeName){var t=d("autosize:destroy");e.dispatchEvent(t)}}function r(e){if(e&&e.nodeName&&"TEXTAREA"===e.nodeName){var t=d("autosize:update");e.dispatchEvent(t)}}var i="function"==typeof Set?new Set:function(){var e=[];return{has:function(t){return Boolean(e.indexOf(t)>-1)},add:function(t){e.push(t)},"delete":function(t){e.splice(e.indexOf(t),1)}}}(),d=function(e){return new Event(e)};try{new Event("test")}catch(a){d=function(e){var t=document.createEvent("Event");return t.initEvent(e,!0,!1),t}}var l=null;"undefined"==typeof window||"function"!=typeof window.getComputedStyle?(l=function(e){return e},l.destroy=function(e){return e},l.update=function(e){return e}):(l=function(e,t){return e&&Array.prototype.forEach.call(e.length?e:[e],function(e){return n(e,t)}),e},l.destroy=function(e){return e&&Array.prototype.forEach.call(e.length?e:[e],o),e},l.update=function(e){return e&&Array.prototype.forEach.call(e.length?e:[e],r),e}),t.exports=l});

view/theme/frio/frameworks/autosize/changelog.md

@@ -0,0 +1,79 @@
+## Changelog
+
+##### v.3.0.17 - 2016-7-25
+* Fixed Chromium issue where getComputedStyle pixel value did not exactly match the style pixel value.  Fixes #306.
+* Removed undocumented argument, minor refactoring, more comments.
+
+##### v.3.0.16 - 2016-7-13
+* Fixed issue with overflowing parent elements. Fixes #298.
+
+##### v.3.0.15 - 2016-1-26
+* Used newer Event constructor, when available. Fixes #280.
+
+##### v.3.0.14 - 2015-11-11
+* Fixed memory leak on destroy. Merged #271, fixes #270.
+* Fixed bug in old versions of Firefox (1-5), fixes #246.
+
+##### v.3.0.13 - 2015-09-26
+* Fixed scroll-bar jumpiness in iOS. Merged #261, fixes #207.
+* Fixed reflowing of initial text in Chrome and Safari.
+
+##### v.3.0.12 - 2015-09-14
+* Merged changes were discarded when building new dist files.  Merged #255, Fixes #257 for real this time.
+
+##### v.3.0.11 - 2015-09-14
+* Fixed regression from 3.0.10 that caused an error with ES5 browsers.  Merged #255, Fixes #257.
+
+##### v.3.0.10 - 2015-09-10
+* Removed data attribute as a way of tracking which elements autosize has been assigned to. fixes #254, fixes #200.
+
+##### v.3.0.9 - 2015-09-02
+* Fixed issue with assigning autosize to detached nodes. Merged #253, Fixes #234.
+
+##### v.3.0.8 - 2015-06-29
+* Fixed the `autosize:resized` event not being triggered when the overflow changes. Fixes #244.
+
+##### v.3.0.7 - 2015-06-29
+* Fixed jumpy behavior in Windows 8.1 mobile. Fixes #239.
+
+##### v.3.0.6 - 2015-05-19
+* Renamed 'dest' folder to 'dist' to follow common conventions.
+
+##### v.3.0.5 - 2015-05-18
+* Do nothing in Node.js environment.
+
+##### v.3.0.4 - 2015-05-05
+* Added options object for indicating if the script should set the overflowX and overflowY.  The default behavior lets the script control the overflows, which will normalize the appearance between browsers.  Fixes #220.
+
+##### v.3.0.3 - 2015-04-23
+* Avoided adjusting the height for hidden textarea elements.  Fixes #155.
+
+##### v.3.0.2 - 2015-04-23
+* Reworked to respect max-height of any unit-type.  Fixes #191.
+
+##### v.3.0.1 - 2015-04-23
+* Fixed the destroy event so that it removes its own event handler. Fixes #218.
+
+##### v.3.0.0 - 2015-04-15
+* Added new methods for updating and destroying:
+
+	* autosize.update(elements)
+	* autosize.destroy(elements)
+
+* Renamed custom events as to not use jQuery's custom events namespace:
+
+	* autosize.resized renamed to autosize:resized
+	* autosize.update renamed to autosize:update
+	* autosize.destroy renamed to autosize:destroy
+
+##### v.2.0.1 - 2015-04-15
+* Version bump for NPM publishing purposes
+
+##### v.2.0.0 - 2015-02-25
+
+* Smaller, simplier code-base
+* New API.  Example usage: `autosize(document.querySelectorAll(textarea));`
+* Dropped jQuery dependency
+* Dropped IE7-IE8 support
+* Dropped optional parameters
+* Closes #98, closes #106, closes #123, fixes #129, fixes #132, fixes #139, closes #140, closes #166, closes #168, closes #192, closes #193, closes #197

view/theme/frio/frameworks/autosize/readme.md

@@ -0,0 +1,35 @@
+## Summary
+
+Autosize is a small, stand-alone script to automatically adjust textarea height to fit text.
+
+#### Demo
+
+Full documentation and a demo can be found at [jacklmoore.com/autosize](http://jacklmoore.com/autosize)
+
+#### Install via NPM
+```bash
+npm install autosize
+```
+
+#### Browser compatibility
+
+Chrome | Firefox | IE | Safari | iOS Safari | Android | Opera Mini | Windows Phone IE
+------ | --------|----|--------|------------|---------|------------|------------------
+yes    | yes     | 9  | yes    | yes        | 4       | ?          | 8.1
+
+#### Usage
+
+The autosize function accepts a single textarea element, or an array or array-like object (such as a NodeList or jQuery collection) of textarea elements.
+
+```javascript
+// from a NodeList
+autosize(document.querySelectorAll('textarea'));
+
+// from a single Node
+autosize(document.querySelector('textarea'));
+
+// from a jQuery collection
+autosize($('textarea'));
+```
+
+Released under the [MIT License](http://www.opensource.org/licenses/mit-license.php)

view/theme/frio/js/filebrowser.js

@@ -135,11 +135,13 @@ var FileBrowser = {
 				this.dataset.filename,
 				embed,
 				FileBrowser.id,
-				this.dataset.img
+				this.dataset.img,
 			]);
 
 			// close model
 			$('#modal').modal('hide');
+			// update autosize for this textarea
+			autosize.update($(".text-autosize"));
 //			if (id!=="") {
 //				commentExpand(FileBrowser.id);
 //				//$("#comment-edit-text-558").empty();

view/theme/frio/js/textedit.js

@@ -93,6 +93,8 @@ function commentOpenUI(obj, id) {
 			$("#comment-edit-text-" + id).attr('tabindex','9');
 			$("#comment-edit-submit-" + id).attr('tabindex','10');
 			$("#comment-edit-submit-wrapper-" + id).show();
+			// initiale autosize for this comment
+			autosize($("#comment-edit-text-" + id + ".text-autosize"));
 		}
 	};
 
@@ -109,6 +111,8 @@ function commentCloseUI(obj, id) {
 			$("#comment-edit-text-" + id).removeAttr('tabindex');
 			$("#comment-edit-submit-" + id).removeAttr('tabindex');
 			$("#comment-edit-submit-wrapper-" + id).hide();
+			// destroy the automatic textarea resizing
+			autosize.destroy($("#comment-edit-text-" + id + ".text-autosize"));
 		}
 	};
 
@@ -120,6 +124,8 @@ function jotTextOpenUI(obj) {
 	if(obj.value == aStr.share) {
 		obj.value = '';
 		$(".modal-body #profile-jot-text").addClass("profile-jot-text-full").removeClass("profile-jot-text-empty");
+		// initiale autosize for the jot
+		autosize($(".modal-body #profile-jot-text"));
 	}
 }
 
@@ -129,6 +135,8 @@ function jotTextCloseUI(obj) {
 	if(obj.value === '') {
 	obj.value = aStr.share;
 		$(".modal-body #profile-jot-text").removeClass("profile-jot-text-full").addClass("profile-jot-text-empty");
+		// destroy the automatic textarea resizing
+		autosize.destroy($(".modal-body #profile-jot-text"));
 	}
 }
 

view/theme/frio/php/default.php

@@ -17,7 +17,7 @@
 <html>
 <head>
 	<title><?php if(x($page,'title')) echo $page['title'] ?></title>
-	<meta request="<?php echo $_REQUEST['pagename'] ?> ">
+	<meta request="<?php echo htmlspecialchars($_REQUEST['pagename']) ?> ">
 	<script>var baseurl="<?php echo $a->get_baseurl() ?>";</script>
 	<script>var frio="<?php echo "view/theme/frio"; ?>";</script>
 	<?php $baseurl = $a->get_baseurl(); ?>

view/theme/frio/php/standard.php

@@ -11,7 +11,7 @@
 <head>
 	<title><?php if(x($page,'title')) echo $page['title'] ?></title>
 	<meta name="viewport" content="initial-scale=1.0">
-	<meta request="<?php echo $_REQUEST['pagename'] ?> ">
+	<meta request="<?php echo htmlspecialchars($_REQUEST['pagename']) ?> ">
 	<script>var baseurl="<?php echo $a->get_baseurl() ?>";</script>
 	<script>var frio="<?php echo "view/theme/frio"; ?>";</script>
 	<?php $baseurl = $a->get_baseurl(); ?>

view/theme/frio/templates/comment_item.tpl

@@ -18,7 +18,7 @@
 		</div>
 		<div class="comment-edit-photo-end"></div>-->
 		<div class="bb form-group">
-			<textarea id="comment-edit-text-{{$id}}" class="comment-edit-text-empty form-control" name="body" onFocus="commentOpenUI(this,{{$id}});" onBlur="commentCloseUI(this,{{$id}});">{{$comment}}</textarea>
+			<textarea id="comment-edit-text-{{$id}}" class="comment-edit-text-empty form-control text-autosize" name="body" onFocus="commentOpenUI(this,{{$id}});" onBlur="commentCloseUI(this,{{$id}});">{{$comment}}</textarea>
 		</div>
 		{{if $qcomment}}
 			<select id="qcomment-select-{{$id}}" name="qcomment-{{$id}}" class="qcomment" onchange="qCommentInsert(this,{{$id}});" >

view/theme/frio/templates/contacts-head.tpl

@@ -1,5 +1,5 @@
 
-<script>
+<script language="javascript" type="text/javascript">
 $(document).ready(function() {
 	// Add contact_filter autocompletion to the search field
 	$("#contacts-search").contact_filter(baseurl + '/acl', 'r', true);
@@ -17,6 +17,8 @@ $(document).ready(function() {
 			$("ul.textcomplete-dropdown").removeClass("show");
 		}
 	});
+	// initiale autosize for the textareas
+	autosize($("textarea.text-autosize"));
 
 });
 </script>

view/theme/frio/templates/event_form.tpl

@@ -62,7 +62,7 @@
 			{{* The textarea for the event description *}}
 			<div class="form-group">
 				<div id="event-desc-text"><b>{{$d_text}}</b></div>
-				<textarea id="comment-edit-text-desc" class="form-control" name="desc" >{{$d_orig}}</textarea>
+				<textarea id="comment-edit-text-desc" class="form-control text-autosize" name="desc" >{{$d_orig}}</textarea>
 				<ul id="event-desc-text-edit-bb" class="comment-edit-bb comment-icon-list nav nav-pills hidden-xs pull-left">
 					{{* commented out because it isn't implemented yet
 					<li>
@@ -109,7 +109,7 @@
 			{{* The textarea for the event location *}}
 			<div class="form-group">
 				<div id="event-location-text"><b>{{$l_text}}</b></div>
-				<textarea id="comment-edit-text-loc" class="form-control" name="location">{{$l_orig}}</textarea>
+				<textarea id="comment-edit-text-loc" class="form-control text-autosize" name="location">{{$l_orig}}</textarea>
 				<ul id="comment-tools-loc" class="comment-edit-bb comment-icon-list nav nav-pills hidden-xs pull-left">
 					{{* commented out because it isn't implemented yet
 					<li>
@@ -168,11 +168,14 @@
 	</div>
 </div>
 
-<script>
+<script language="javascript" type="text/javascript">
 	$(document).ready( function() {
 		// disable finish date input if it isn't available
 		enableDisableFinishDate();
 		// load bbcode autocomplete for the description textarea
 		$('#comment-edit-text-desc, #comment-edit-text-loc').bbco_autocomplete('bbcode');
+
+		// initiale autosize for the textareas
+		autosize($("textarea.text-autosize"));
 	});
 </script>

view/theme/frio/templates/event_head.tpl

@@ -3,7 +3,7 @@
 <script language="javascript" type="text/javascript"
 	  src="{{$baseurl}}/library/fullcalendar/fullcalendar.min.js"></script>
 
-<script>
+<script language="javascript" type="text/javascript">
 	// loads the event into a modal
 	function showEvent(eventid) {
 			addToModal('{{$baseurl}}{{$module_url}}/?id='+eventid);

view/theme/frio/templates/field_textarea.tpl

@@ -1,7 +1,7 @@
 
 	<div class="form-group field textarea">
 		<label for="id_{{$field.0}}">{{$field.1}}</label>
-		<textarea class="form-control" name="{{$field.0}}" id="id_{{$field.0}}" {{if $field.4}}{{$field.4}}{{/if}} aria-describedby="{{$field.0}}_tip">{{$field.2}}</textarea>
+		<textarea class="form-control text-autosize" name="{{$field.0}}" id="id_{{$field.0}}" {{if $field.4}}{{$field.4}}{{/if}} aria-describedby="{{$field.0}}_tip">{{$field.2}}</textarea>
 		<span id="{{$field.0}}_tip" class="help-block" role="tooltip">{{$field.3}}</span>
 		<div class="clear"></div>
 	</div>

view/theme/frio/templates/head.tpl

@@ -76,6 +76,7 @@
 <script type="text/javascript" src="view/theme/frio/frameworks/flexMenu/flexmenu.custom.js"></script>
 <script type="text/javascript" src="view/theme/frio/frameworks/jsmart/jsmart.custom.js"></script>
 <script type="text/javascript" src="view/theme/frio/frameworks/jquery-scrollspy/jquery-scrollspy.js"></script>
+<script type="text/javascript" src="view/theme/frio/frameworks/autosize/autosize.min.js"></script>
 
 {{* own js files *}}
 <script type="text/javascript" src="view/theme/frio/js/theme.js"></script>
@@ -83,7 +84,7 @@
 <script type="text/javascript" src="view/theme/frio/js/hovercard.js"></script>
 <script type="text/javascript" src="view/theme/frio/js/textedit.js"></script>
 
-<script>
+<script language="javascript" type="text/javascript">
 	window.showMore = "{{$showmore}}";
 	window.showFewer = "{{$showfewer}}";
 </script>

view/theme/frio/templates/jot.tpl

@@ -63,7 +63,7 @@
 
 					{{* The jot text field in which the post text is inserted *}}
 					<div id="jot-text-wrap">
-					<textarea rows="2" cols="64" class="profile-jot-text form-control" id="profile-jot-text" name="body" onFocus="jotTextOpenUI(this);" onBlur="jotTextCloseUI(this);" style="min-width:100%; max-width:100%;">{{if $content}}{{$content}}{{else}}{{$share}}{{/if}}</textarea>
+					<textarea rows="2" cols="64" class="profile-jot-text form-control text-autosize" id="profile-jot-text" name="body" onFocus="jotTextOpenUI(this);" onBlur="jotTextCloseUI(this);" style="min-width:100%; max-width:100%;">{{if $content}}{{$content}}{{else}}{{$share}}{{/if}}</textarea>
 					</div>
 
 					<ul id="profile-jot-submit-wrapper" class="jothidden nav nav-pills">
@@ -119,7 +119,7 @@ can load different content into the jot moadl (e.g. the item edit jot)
 </div>
 
 
-<script>
+<script language="javascript" type="text/javascript">
 	$('iframe').load(function() {
 		this.style.height = this.contentWindow.document.body.offsetHeight + 'px';
 	});

view/theme/frio/templates/profile_edit.tpl

@@ -328,4 +328,10 @@
 	</form>
 </div>
 
-<script type="text/javascript">Fill_Country('{{$country_name.2}}');Fill_States('{{$region.2}}');</script>
+<script language="javascript" type="text/javascript">
+	Fill_Country('{{$country_name.2}}');
+	Fill_States('{{$region.2}}');
+
+	// initiale autosize for the textareas
+	autosize($("textarea.text-autosize"));
+</script>

view/theme/frio/templates/prv_message.tpl

@@ -28,7 +28,7 @@
 	{{* The message input field which contains the message text *}}
 	<div id="prvmail-message-label" class="form-group">
 		<label for="prvmail-text">{{$yourmessage}}</label>
-		<textarea rows="8" cols="72" class="prvmail-text form-control" id="comment-edit-text-input" name="body" tabindex="12">{{$text}}</textarea>
+		<textarea rows="8" cols="72" class="prvmail-text form-control text-autosize" id="comment-edit-text-input" name="body" tabindex="12">{{$text}}</textarea>
 	</div>
 
 	<ul id="prvmail-text-edit-bb" class="comment-edit-bb comment-icon-list nav nav-pills hidden-xs pull-left">
@@ -84,3 +84,10 @@
 
 </form>
 </div>
+
+<script language="javascript" type="text/javascript">
+	$(document).ready( function() {
+		// initiale autosize for the textareas
+		autosize($("textarea.text-autosize"));
+	});
+</script>