Merge branch '0.9.x' into 1.0.x

Conflicts:
	EVENTS.txt
	lib/imqueuehandler.php
	lib/jabber.php
	lib/util.php
	plugins/Xmpp/Sharing_XMPP.php

15 files changed, 845 insertions, 64 deletions

diff --git a/actions/apioauthauthorize.php b/actions/apioauthauthorize.php
index eebc926ee..e7c6f3761 100644
--- a/actions/apioauthauthorize.php
+++ b/actions/apioauthauthorize.php
@@ -67,8 +67,6 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
     {
         parent::prepare($args);
 
-        common_debug("apioauthauthorize");
-
         $this->nickname    = $this->trimmed('nickname');
         $this->password    = $this->arg('password');
         $this->oauth_token = $this->arg('oauth_token');
@@ -99,24 +97,17 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
 
         } else {
 
-            // XXX: make better error messages
-
             if (empty($this->oauth_token)) {
-
-                common_debug("No request token found.");
-
-                $this->clientError(_('Bad request.'));
+                $this->clientError(_('No oauth_token parameter provided.'));
                 return;
             }
 
             if (empty($this->app)) {
-                common_debug('No app for that token.');
-                $this->clientError(_('Bad request.'));
+                $this->clientError(_('Invalid token.'));
                 return;
             }
 
             $name = $this->app->name;
-            common_debug("Requesting auth for app: " . $name);
 
             $this->showForm();
         }
@@ -124,8 +115,6 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
 
     function handlePost()
     {
-        common_debug("handlePost()");
-
         // check session token for CSRF protection.
 
         $token = $this->trimmed('token');
@@ -202,21 +191,15 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
             // A callback specified in the app setup overrides whatever
             // is passed in with the request.
 
-            common_debug("Req token is authorized - doing callback");
-
             if (!empty($this->app->callback_url)) {
                 $this->callback = $this->app->callback_url;
             }
 
             if (!empty($this->callback)) {
 
-                // XXX: Need better way to build this redirect url.
-
                 $target_url = $this->getCallback($this->callback,
                                                  array('oauth_token' => $this->oauth_token));
 
-                common_debug("Doing callback to $target_url");
-
                 common_redirect($target_url, 303);
             } else {
                 common_debug("callback was empty!");
@@ -236,9 +219,12 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
 
         } else if ($this->arg('deny')) {
 
+            $datastore = new ApiStatusNetOAuthDataStore();
+            $datastore->revoke_token($this->oauth_token, 0);
+
             $this->elementStart('p');
 
-            $this->raw(sprintf(_("The request token %s has been denied."),
+            $this->raw(sprintf(_("The request token %s has been denied and revoked."),
                                $this->oauth_token));
 
             $this->elementEnd('p');
@@ -303,13 +289,17 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
         $access = ($this->app->access_type & Oauth_application::$writeAccess) ?
           'access and update' : 'access';
 
-        $msg = _("The application <strong>%1$s</strong> by <strong>%2$s</strong> would like " .
-                 "the ability to <strong>%3$s</strong> your account data.");
+        $msg = _('The application <strong>%1$s</strong> by ' .
+                 '<strong>%2$s</strong> would like the ability ' .
+                 'to <strong>%3$s</strong> your %4$s account data. ' .
+                 'You should only give access to your %4$s account ' .
+                 'to third parties you trust.');
 
         $this->raw(sprintf($msg,
                            $this->app->name,
                            $this->app->organization,
-                           $access));
+                           $access,
+                           common_config('site', 'name')));
         $this->elementEnd('p');
         $this->elementEnd('li');
         $this->elementEnd('ul');
@@ -371,6 +361,31 @@ class ApiOauthAuthorizeAction extends ApiOauthAction
 
     function showLocalNav()
     {
+        // NOP
+    }
+
+    /**
+     * Show site notice.
+     *
+     * @return nothing
+     */
+
+    function showSiteNotice()
+    {
+        // NOP
+    }
+
+    /**
+     * Show notice form.
+     *
+     * Show the form for posting a new notice
+     *
+     * @return nothing
+     */
+
+    function showNoticeForm()
+    {
+        // NOP
     }
 
 }
diff --git a/actions/deleteapplication.php b/actions/deleteapplication.php
new file mode 100644
index 000000000..17526e111
--- /dev/null
+++ b/actions/deleteapplication.php
@@ -0,0 +1,176 @@
+<?php
+/**
+ * StatusNet, the distributed open-source microblogging tool
+ *
+ * Action class to delete an OAuth application
+ *
+ * PHP version 5
+ *
+ * LICENCE: This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @category  Action
+ * @package   StatusNet
+ * @author    Zach Copley <zach@status.net>
+ * @copyright 2010 StatusNet, Inc.
+ * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link      http://status.net/
+ */
+
+if (!defined('STATUSNET') && !defined('LACONICA')) {
+    exit(1);
+}
+
+/**
+ * Delete an OAuth appliction
+ *
+ * @category Action
+ * @package  StatusNet
+ * @author   Zach Copley <zach@status.net>
+ * @license  http://www.fsf.org/licensing/licenses/agpl.html AGPLv3
+ * @link     http://status.net/
+ */
+
+class DeleteapplicationAction extends Action
+{
+    var $app = null;
+
+    /**
+     * Take arguments for running
+     *
+     * @param array $args $_REQUEST args
+     *
+     * @return boolean success flag
+     */
+
+    function prepare($args)
+    {
+        if (!parent::prepare($args)) {
+            return false;
+        }
+
+        if (!common_logged_in()) {
+            $this->clientError(_('You must be logged in to delete an application.'));
+            return false;
+        }
+
+        $id        = (int)$this->arg('id');
+        $this->app = Oauth_application::staticGet('id', $id);
+
+        if (empty($this->app)) {
+            $this->clientError(_('Application not found.'));
+            return false;
+        }
+
+        $cur = common_current_user();
+
+        if ($cur->id != $this->app->owner) {
+            $this->clientError(_('You are not the owner of this application.'), 401);
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * Handle request
+     *
+     * Shows a page with list of favorite notices
+     *
+     * @param array $args $_REQUEST args; handled in prepare()
+     *
+     * @return void
+     */
+
+    function handle($args)
+    {
+        if ($_SERVER['REQUEST_METHOD'] == 'POST') {
+
+            // CSRF protection
+            $token = $this->trimmed('token');
+            if (!$token || $token != common_session_token()) {
+                $this->clientError(_('There was a problem with your session token.'));
+                return;
+            }
+
+            if ($this->arg('no')) {
+                common_redirect(common_local_url('showapplication',
+                                                 array('id' => $this->app->id)), 303);
+            } elseif ($this->arg('yes')) {
+                $this->handlePost();
+                common_redirect(common_local_url('oauthappssettings'), 303);
+            } else {
+                $this->showPage();
+            }
+        }
+    }
+
+    function showContent() {
+        $this->areYouSureForm();
+    }
+
+    function title() {
+        return _('Delete application');
+    }
+
+    function showNoticeForm() {
+        // nop
+    }
+
+    /**
+     * Confirm with user.
+     *
+     * Shows a confirmation form.
+     *
+     * @return void
+     */
+    function areYouSureForm()
+    {
+        $id = $this->app->id;
+        $this->elementStart('form', array('id' => 'deleteapplication-' . $id,
+                                          'method' => 'post',
+                                          'class' => 'form_settings form_entity_block',
+                                          'action' => common_local_url('deleteapplication',
+                                                                       array('id' => $this->app->id))));
+        $this->elementStart('fieldset');
+        $this->hidden('token', common_session_token());
+        $this->element('legend', _('Delete application'));
+        $this->element('p', null,
+                       _('Are you sure you want to delete this application? '.
+                         'This will clear all data about the application from the '.
+                         'database, including all existing user connections.'));
+        $this->submit('form_action-no',
+                      _('No'),
+                      'submit form_action-primary',
+                      'no',
+                      _("Do not delete this application"));
+        $this->submit('form_action-yes',
+                      _('Yes'),
+                      'submit form_action-secondary',
+                      'yes', _('Delete this application'));
+        $this->elementEnd('fieldset');
+        $this->elementEnd('form');
+    }
+
+    /**
+     * Actually delete the app
+     *
+     * @return void
+     */
+
+    function handlePost()
+    {
+        $this->app->delete();
+    }
+}
+
diff --git a/actions/doc.php b/actions/doc.php
index 25d363472..eaf4b7df2 100644
--- a/actions/doc.php
+++ b/actions/doc.php
@@ -54,6 +54,9 @@ class DocAction extends Action
         parent::prepare($args);
 
         $this->title  = $this->trimmed('title');
+        if (!preg_match('/^[a-zA-Z0-9_-]*$/', $this->title)) {
+            $this->title = 'help';
+        }
         $this->output = null;
 
         $this->loadDoc();
diff --git a/actions/editapplication.php b/actions/editapplication.php
index 9cc3e3cea..029b622e8 100644
--- a/actions/editapplication.php
+++ b/actions/editapplication.php
@@ -179,6 +179,9 @@ class EditApplicationAction extends OwnerDesignAction
         } elseif (mb_strlen($name) > 255) {
             $this->showForm(_('Name is too long (max 255 chars).'));
             return;
+        } else if ($this->nameExists($name)) {
+            $this->showForm(_('Name already in use. Try another one.'));
+            return;
         } elseif (empty($description)) {
             $this->showForm(_('Description is required.'));
             return;
@@ -260,5 +263,26 @@ class EditApplicationAction extends OwnerDesignAction
         common_redirect(common_local_url('oauthappssettings'), 303);
     }
 
+    /**
+     * Does the app name already exist?
+     *
+     * Checks the DB to see someone has already registered and app
+     * with the same name.
+     *
+     * @param string $name app name to check
+     *
+     * @return boolean true if the name already exists
+     */
+
+    function nameExists($name)
+    {
+        $newapp = Oauth_application::staticGet('name', $name);
+        if (!$newapp) {
+            return false;
+        } else {
+            return $newapp->id != $this->app->id;
+        }
+    }
+
 }
 
diff --git a/actions/geocode.php b/actions/geocode.php
index 9671d2c27..e883c6ce4 100644
--- a/actions/geocode.php
+++ b/actions/geocode.php
@@ -42,6 +42,10 @@ if (!defined('STATUSNET') && !defined('LACONICA')) {
  */
 class GeocodeAction extends Action
 {
+    var $lat = null;
+    var $lon = null;
+    var $location = null;
+
     function prepare($args)
     {
         parent::prepare($args);
@@ -52,12 +56,7 @@ class GeocodeAction extends Action
         }
         $this->lat = $this->trimmed('lat');
         $this->lon = $this->trimmed('lon');
-        $location = Location::fromLatLon($this->lat, $this->lon);
-        if ($location) {
-            $this->location = Location::fromId($location->location_id, $location->location_ns);
-            $this->lat = $this->location->lat;
-            $this->lon = $this->location->lon;
-        }
+        $this->location = Location::fromLatLon($this->lat, $this->lon);
         return true;
     }
 
@@ -95,4 +94,3 @@ class GeocodeAction extends Action
         return true;
     }
 }
-?>
diff --git a/actions/getfile.php b/actions/getfile.php
index cd327e410..9cbe8e1d9 100644
--- a/actions/getfile.php
+++ b/actions/getfile.php
@@ -71,7 +71,7 @@ class GetfileAction extends Action
         $filename = $this->trimmed('filename');
         $path = null;
 
-        if ($filename) {
+        if ($filename && File::validFilename($filename)) {
             $path = File::path($filename);
         }
 
diff --git a/actions/newapplication.php b/actions/newapplication.php
index c499fe7c7..ba1cca5c9 100644
--- a/actions/newapplication.php
+++ b/actions/newapplication.php
@@ -158,6 +158,9 @@ class NewApplicationAction extends OwnerDesignAction
         if (empty($name)) {
              $this->showForm(_('Name is required.'));
              return;
+        } else if ($this->nameExists($name)) {
+            $this->showForm(_('Name already in use. Try another one.'));
+            return;
         } elseif (mb_strlen($name) > 255) {
             $this->showForm(_('Name is too long (max 255 chars).'));
             return;
@@ -273,5 +276,22 @@ class NewApplicationAction extends OwnerDesignAction
 
     }
 
+    /**
+     * Does the app name already exist?
+     *
+     * Checks the DB to see someone has already registered and app
+     * with the same name.
+     *
+     * @param string $name app name to check
+     *
+     * @return boolean true if the name already exists
+     */
+
+    function nameExists($name)
+    {
+        $app = Oauth_application::staticGet('name', $name);
+        return ($app !== false);
+    }
+
 }
 
diff --git a/actions/oauthconnectionssettings.php b/actions/oauthconnectionssettings.php
index c2e8d441b..b1467f0d0 100644
--- a/actions/oauthconnectionssettings.php
+++ b/actions/oauthconnectionssettings.php
@@ -33,6 +33,7 @@ if (!defined('STATUSNET') && !defined('LACONICA')) {
 
 require_once INSTALLDIR . '/lib/connectsettingsaction.php';
 require_once INSTALLDIR . '/lib/applicationlist.php';
+require_once INSTALLDIR . '/lib/apioauthstore.php';
 
 /**
  * Show connected OAuth applications
@@ -71,11 +72,6 @@ class OauthconnectionssettingsAction extends ConnectSettingsAction
         return _('Connected applications');
     }
 
-    function isReadOnly($args)
-    {
-        return true;
-    }
-
     /**
      * Instructions for use
      *
@@ -153,6 +149,13 @@ class OauthconnectionssettingsAction extends ConnectSettingsAction
         }
     }
 
+    /**
+     * Revoke access to an authorized OAuth application
+     *
+     * @param int $appId the ID of the application
+     *
+     */
+
     function revokeAccess($appId)
     {
         $cur = common_current_user();
@@ -164,6 +167,8 @@ class OauthconnectionssettingsAction extends ConnectSettingsAction
             return false;
         }
 
+        // XXX: Transaction here?
+
         $appUser = Oauth_application_user::getByKeys($cur, $app);
 
         if (empty($appUser)) {
@@ -171,12 +176,13 @@ class OauthconnectionssettingsAction extends ConnectSettingsAction
             return false;
         }
 
-        $orig = clone($appUser);
-        $appUser->access_type = 0;  // No access
-        $result = $appUser->update();
+        $datastore = new ApiStatusNetOAuthDataStore();
+        $datastore->revoke_token($appUser->token, 1);
+
+        $result = $appUser->delete();
 
         if (!$result) {
-            common_log_db_error($orig, 'UPDATE', __FILE__);
+            common_log_db_error($orig, 'DELETE', __FILE__);
             $this->clientError(_('Unable to revoke access for app: ' . $app->id));
             return false;
         }
diff --git a/actions/public.php b/actions/public.php
index 982dfde15..50278bfce 100644
--- a/actions/public.php
+++ b/actions/public.php
@@ -131,12 +131,20 @@ class PublicAction extends Action
             return _('Public timeline');
         }
     }
-    
+
     function extraHead()
     {
         parent::extraHead();
         $this->element('meta', array('http-equiv' => 'X-XRDS-Location',
                                            'content' => common_local_url('publicxrds')));
+
+        $rsd = common_local_url('rsd');
+
+        // RSD, http://tales.phrasewise.com/rfc/rsd
+
+        $this->element('link', array('rel' => 'EditURI',
+                                     'type' => 'application/rsd+xml',
+                                     'href' => $rsd));
     }
 
     /**
diff --git a/actions/robotstxt.php b/actions/robotstxt.php
new file mode 100644
index 000000000..5131097c8
--- /dev/null
+++ b/actions/robotstxt.php
@@ -0,0 +1,100 @@
+<?php
+/**
+ * StatusNet - the distributed open-source microblogging tool
+ * Copyright (C) 2010, StatusNet, Inc.
+ *
+ * robots.txt generator
+ *
+ * PHP version 5
+ *
+ * @category Action
+ * @package  StatusNet
+ * @author   Evan Prodromou <evan@status.net>
+ * @license  http://www.fsf.org/licensing/licenses/agpl.html AGPLv3
+ * @link     http://status.net/
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+if (!defined('STATUSNET')) {
+    exit(1);
+}
+
+/**
+ * Prints out a static robots.txt
+ *
+ * @category Action
+ * @package  StatusNet
+ * @author   Evan Prodromou <evan@status.net>
+ * @license  http://www.fsf.org/licensing/licenses/agpl.html AGPLv3
+ * @link     http://status.net/
+ */
+
+class RobotstxtAction extends Action
+{
+    /**
+     * Handles requests
+     *
+     * Since this is a relatively static document, we
+     * don't do a prepare()
+     *
+     * @param array $args GET, POST, and URL params; unused.
+     *
+     * @return void
+     */
+
+    function handle($args)
+    {
+        if (Event::handle('StartRobotsTxt', array($this))) {
+
+            header('Content-Type: text/plain');
+
+            print "User-Agent: *\n";
+
+            if (common_config('site', 'private')) {
+
+                print "Disallow: /\n";
+
+            } else {
+
+                $disallow = common_config('robotstxt', 'disallow');
+
+                foreach ($disallow as $dir) {
+                    print "Disallow: /$dir/\n";
+                }
+
+                $crawldelay = common_config('robotstxt', 'crawldelay');
+
+                if (!empty($crawldelay)) {
+                    print "Crawl-delay: " . $crawldelay . "\n";
+                }
+            }
+
+            Event::handle('EndRobotsTxt', array($this));
+        }
+    }
+
+    /**
+     * Return true; this page doesn't touch the DB.
+     *
+     * @param array $args other arguments
+     *
+     * @return boolean is read only action?
+     */
+
+    function isReadOnly($args)
+    {
+        return true;
+    }
+}
diff --git a/actions/rsd.php b/actions/rsd.php
new file mode 100644
index 000000000..f88bf2e9a
--- /dev/null
+++ b/actions/rsd.php
@@ -0,0 +1,226 @@
+<?php
+/**
+ * StatusNet - the distributed open-source microblogging tool
+ * Copyright (C) 2008-2010, StatusNet, Inc.
+ *
+ * Really Simple Discovery (RSD) for API access
+ *
+ * PHP version 5
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @category API
+ * @package  StatusNet
+ * @author   Evan Prodromou <evan@status.net>
+ * @license  http://www.fsf.org/licensing/licenses/agpl.html AGPLv3
+ * @link     http://status.net/
+ *
+ */
+
+if (!defined('STATUSNET')) {
+    exit(1);
+}
+
+/**
+ * RSD action class
+ *
+ * Really Simple Discovery (RSD) is a simple (to a fault, maybe)
+ * discovery tool for blog APIs.
+ *
+ * http://tales.phrasewise.com/rfc/rsd
+ *
+ * Anil Dash suggested that RSD be used for services that implement
+ * the Twitter API:
+ *
+ * http://dashes.com/anil/2009/12/the-twitter-api-is-finished.html
+ *
+ * It's in use now for WordPress.com blogs:
+ *
+ * http://matt.wordpress.com/xmlrpc.php?rsd
+ *
+ * I (evan@status.net) have tried to stay faithful to the premise of
+ * RSD, while adding information useful to StatusNet client developers.
+ * In particular:
+ *
+ * - There is a link from each user's profile page to their personal
+ *   RSD feed. A personal rsd.xml includes a 'blogID' element that is
+ *   their username.
+ * - There is a link from the public root to '/rsd.xml', a public RSD
+ *   feed. It's identical to the personal rsd except it doesn't include
+ *   a blogId.
+ * - I've added a setting to the API to indicate that OAuth support is
+ *   available.
+ *
+ * @category API
+ * @package  StatusNet
+ * @author   Evan Prodromou <evan@status.net>
+ * @license  http://www.fsf.org/licensing/licenses/agpl.html AGPLv3
+ * @link     http://status.net/
+ */
+
+class RsdAction extends Action
+{
+    /**
+     * Optional attribute for the personal rsd.xml file.
+     */
+
+    var $user = null;
+
+    /**
+     * Prepare the action for use.
+     *
+     * Check for a nickname; redirect if non-canonical; if
+     * not provided, assume public rsd.xml.
+     *
+     * @param array $args GET, POST, and URI arguments.
+     *
+     * @return boolean success flag
+     */
+
+    function prepare($args)
+    {
+        parent::prepare($args);
+
+        // optional argument
+
+        $nickname_arg = $this->arg('nickname');
+
+        if (empty($nickname_arg)) {
+            $this->user = null;
+        } else {
+            $nickname = common_canonical_nickname($nickname_arg);
+
+            // Permanent redirect on non-canonical nickname
+
+            if ($nickname_arg != $nickname) {
+                common_redirect(common_local_url('rsd',
+                                                 array('nickname' => $nickname)),
+                                301);
+                return false;
+            }
+
+            $this->user = User::staticGet('nickname', $nickname);
+
+            if (empty($this->user)) {
+                $this->clientError(_('No such user.'), 404);
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    /**
+     * Action handler.
+     *
+     * Outputs the XML format for an RSD file. May include
+     * personal information if this is a personal file
+     * (based on whether $user attribute is set).
+     *
+     * @param array $args array of arguments
+     *
+     * @return nothing
+     */
+
+    function handle($args)
+    {
+        header('Content-Type: application/rsd+xml');
+
+        $this->startXML();
+
+        $rsdNS = 'http://archipelago.phrasewise.com/rsd';
+        $this->elementStart('rsd', array('version' => '1.0',
+                                         'xmlns' => $rsdNS));
+        $this->elementStart('service');
+        $this->element('engineName', null, _('StatusNet'));
+        $this->element('engineLink', null, 'http://status.net/');
+        $this->elementStart('apis');
+        if (Event::handle('StartRsdListApis', array($this, $this->user))) {
+
+            $blogID   = (empty($this->user)) ? '' : $this->user->nickname;
+            $apiAttrs = array('name' => 'Twitter',
+                              'preferred' => 'true',
+                              'apiLink' => $this->_apiRoot(),
+                              'blogID' => $blogID);
+
+            $this->elementStart('api', $apiAttrs);
+            $this->elementStart('settings');
+            $this->element('docs', null,
+                           'http://status.net/wiki/TwitterCompatibleAPI');
+            $this->element('setting', array('name' => 'OAuth'),
+                           'true');
+            $this->elementEnd('settings');
+            $this->elementEnd('api');
+            Event::handle('EndRsdListApis', array($this, $this->user));
+        }
+        $this->elementEnd('apis');
+        $this->elementEnd('service');
+        $this->elementEnd('rsd');
+
+        $this->endXML();
+
+        return true;
+    }
+
+    /**
+     * Returns last-modified date for use in caching
+     *
+     * Per-user rsd.xml is dated to last change of user
+     * (in case of nickname change); public has no date.
+     *
+     * @return string date of last change of this page
+     */
+
+    function lastModified()
+    {
+        if (!empty($this->user)) {
+            return $this->user->modified;
+        } else {
+            return null;
+        }
+    }
+
+    /**
+     * Flag to indicate if this action is read-only
+     *
+     * It is; it doesn't change the DB.
+     *
+     * @param array $args ignored
+     *
+     * @return boolean true
+     */
+
+    function isReadOnly($args)
+    {
+        return true;
+    }
+
+    /**
+     * Return current site's API root
+     *
+     * Varies based on URL parameters, like if fancy URLs are
+     * turned on.
+     *
+     * @return string API root URI for this site
+     */
+
+    private function _apiRoot()
+    {
+        if (common_config('site', 'fancy')) {
+            return common_path('api/', true);
+        } else {
+            return common_path('index.php/api/', true);
+        }
+    }
+}
diff --git a/actions/sessionsadminpanel.php b/actions/sessionsadminpanel.php
new file mode 100644
index 000000000..4386ef844
--- /dev/null
+++ b/actions/sessionsadminpanel.php
@@ -0,0 +1,201 @@
+<?php
+/**
+ * StatusNet, the distributed open-source microblogging tool
+ *
+ * Sessions administration panel
+ *
+ * PHP version 5
+ *
+ * LICENCE: This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @category  Settings
+ * @package   StatusNet
+ * @author    Zach Copley <zach@status.net>
+ * @copyright 2010 StatusNet, Inc.
+ * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link      http://status.net/
+ */
+
+if (!defined('STATUSNET')) {
+    exit(1);
+}
+
+/**
+ * Admin site sessions
+ *
+ * @category Admin
+ * @package  StatusNet
+ * @author   Zach Copley <zach@status.net>
+ * @license  http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link     http://status.net/
+ */
+
+class SessionsadminpanelAction extends AdminPanelAction
+{
+    /**
+     * Returns the page title
+     *
+     * @return string page title
+     */
+
+    function title()
+    {
+        return _('Sessions');
+    }
+
+    /**
+     * Instructions for using this form.
+     *
+     * @return string instructions
+     */
+
+    function getInstructions()
+    {
+        return _('Session settings for this StatusNet site.');
+    }
+
+    /**
+     * Show the site admin panel form
+     *
+     * @return void
+     */
+
+    function showForm()
+    {
+        $form = new SessionsAdminPanelForm($this);
+        $form->show();
+        return;
+    }
+
+    /**
+     * Save settings from the form
+     *
+     * @return void
+     */
+
+    function saveSettings()
+    {
+        static $booleans = array('sessions' => array('handle', 'debug'));
+
+        $values = array();
+
+        foreach ($booleans as $section => $parts) {
+            foreach ($parts as $setting) {
+                $values[$section][$setting] = ($this->boolean($setting)) ? 1 : 0;
+            }
+        }
+
+        // This throws an exception on validation errors
+
+        $this->validate($values);
+
+        // assert(all values are valid);
+
+        $config = new Config();
+
+        $config->query('BEGIN');
+
+        foreach ($booleans as $section => $parts) {
+            foreach ($parts as $setting) {
+                Config::save($section, $setting, $values[$section][$setting]);
+            }
+        }
+
+        $config->query('COMMIT');
+
+        return;
+    }
+
+    function validate(&$values)
+    {
+        // stub
+    }
+}
+
+class SessionsAdminPanelForm extends AdminForm
+{
+    /**
+     * ID of the form
+     *
+     * @return int ID of the form
+     */
+
+    function id()
+    {
+        return 'sessionsadminpanel';
+    }
+
+    /**
+     * class of the form
+     *
+     * @return string class of the form
+     */
+
+    function formClass()
+    {
+        return 'form_settings';
+    }
+
+    /**
+     * Action of the form
+     *
+     * @return string URL of the action
+     */
+
+    function action()
+    {
+        return common_local_url('sessionsadminpanel');
+    }
+
+    /**
+     * Data elements of the form
+     *
+     * @return void
+     */
+
+    function formData()
+    {
+        $this->out->elementStart('fieldset', array('id' => 'settings_user_sessions'));
+        $this->out->element('legend', null, _('Sessions'));
+
+        $this->out->elementStart('ul', 'form_data');
+
+        $this->li();
+        $this->out->checkbox('handle', _('Handle sessions'),
+                              (bool) $this->value('handle', 'sessions'),
+                              _('Whether to handle sessions ourselves.'));
+        $this->unli();
+
+        $this->li();
+        $this->out->checkbox('debug', _('Session debugging'),
+                              (bool) $this->value('debug', 'sessions'),
+                              _('Turn on debugging output for sessions.'));
+        $this->unli();
+
+        $this->out->elementEnd('ul');
+
+        $this->out->elementEnd('fieldset');
+    }
+
+    /**
+     * Action elements
+     *
+     * @return void
+     */
+
+    function formActions()
+    {
+        $this->out->submit('submit', _('Save'), 'submit', null, _('Save site settings'));
+    }
+}
diff --git a/actions/showapplication.php b/actions/showapplication.php
index a6ff425c7..020d62480 100644
--- a/actions/showapplication.php
+++ b/actions/showapplication.php
@@ -201,7 +201,7 @@ class ShowApplicationAction extends OwnerDesignAction
         $userCnt = $appUsers->count();
 
         $this->raw(sprintf(
-            _('created by %1$s - %2$s access by default - %3$d users'),
+            _('Created by %1$s - %2$s access by default - %3$d users'),
               $profile->getBestName(),
               $defaultAccess,
               $userCnt
@@ -222,18 +222,33 @@ class ShowApplicationAction extends OwnerDesignAction
 
         $this->elementStart('li', 'entity_reset_keysecret');
         $this->elementStart('form', array(
-            'id' => 'forma_reset_key',
+            'id' => 'form_reset_key',
             'class' => 'form_reset_key',
             'method' => 'POST',
             'action' => common_local_url('showapplication',
                                          array('id' => $this->application->id))));
-
         $this->elementStart('fieldset');
         $this->hidden('token', common_session_token());
         $this->submit('reset', _('Reset key & secret'));
         $this->elementEnd('fieldset');
         $this->elementEnd('form');
         $this->elementEnd('li');
+
+        $this->elementStart('li', 'entity_delete');
+        $this->elementStart('form', array(
+                                          'id' => 'form_delete_application',
+                                          'class' => 'form_delete_application',
+                                          'method' => 'POST',
+                                          'action' => common_local_url('deleteapplication',
+                                                                       array('id' => $this->application->id))));
+
+        $this->elementStart('fieldset');
+        $this->hidden('token', common_session_token());
+        $this->submit('delete', _('Delete'));
+        $this->elementEnd('fieldset');
+        $this->elementEnd('form');
+        $this->elementEnd('li');
+
         $this->elementEnd('ul');
         $this->elementEnd('div');
 
diff --git a/actions/showstream.php b/actions/showstream.php
index 4d09a2d4e..958676104 100644
--- a/actions/showstream.php
+++ b/actions/showstream.php
@@ -172,6 +172,15 @@ class ShowstreamAction extends ProfileAction
         $this->element('link', array('rel' => 'microsummary',
                                      'href' => common_local_url('microsummary',
                                                                 array('nickname' => $this->profile->nickname))));
+
+        $rsd = common_local_url('rsd',
+                                array('nickname' => $this->profile->nickname));
+
+        // RSD, http://tales.phrasewise.com/rfc/rsd
+        $this->element('link', array('rel' => 'EditURI',
+                                     'type' => 'application/rsd+xml',
+                                     'href' => $rsd));
+
     }
 
     function showProfile()
diff --git a/actions/useradminpanel.php b/actions/useradminpanel.php
index 5de2db5ff..6813222f5 100644
--- a/actions/useradminpanel.php
+++ b/actions/useradminpanel.php
@@ -96,7 +96,6 @@ class UseradminpanelAction extends AdminPanelAction
         );
 
         static $booleans = array(
-            'sessions' => array('handle', 'debug'),
             'invite' => array('enabled')
         );
 
@@ -261,26 +260,7 @@ class UserAdminPanelForm extends AdminForm
         $this->out->elementEnd('ul');
         $this->out->elementEnd('fieldset');
 
-        $this->out->elementStart('fieldset', array('id' => 'settings_user_sessions'));
-        $this->out->element('legend', null, _('Sessions'));
 
-        $this->out->elementStart('ul', 'form_data');
-
-        $this->li();
-        $this->out->checkbox('sessions-handle', _('Handle sessions'),
-                              (bool) $this->value('handle', 'sessions'),
-                              _('Whether to handle sessions ourselves.'));
-        $this->unli();
-
-        $this->li();
-        $this->out->checkbox('sessions-debug', _('Session debugging'),
-                              (bool) $this->value('debug', 'sessions'),
-                              _('Turn on debugging output for sessions.'));
-        $this->unli();
-
-        $this->out->elementEnd('ul');
-
-        $this->out->elementEnd('fieldset');
 
     }