Merge branch '0.9.x' into adminpanel

Conflicts:
	classes/User.php

18 files changed, 607 insertions, 150 deletions

diff --git a/actions/apigroupismember.php b/actions/apigroupismember.php
index a822d18dd..08348e97b 100644
--- a/actions/apigroupismember.php
+++ b/actions/apigroupismember.php
@@ -92,7 +92,7 @@ class ApiGroupIsMemberAction extends ApiBareAuthAction
         }
 
         if (empty($this->group)) {
-            $this->clientError('Group not found!', 404, $this->format);
+            $this->clientError(_('Group not found!'), 404, $this->format);
             return false;
         }
 
diff --git a/actions/apigroupjoin.php b/actions/apigroupjoin.php
index ffda3986f..b531d9501 100644
--- a/actions/apigroupjoin.php
+++ b/actions/apigroupjoin.php
@@ -101,7 +101,7 @@ class ApiGroupJoinAction extends ApiAuthAction
         }
 
         if (empty($this->group)) {
-            $this->clientError('Group not found!', 404, $this->format);
+            $this->clientError(_('Group not found!'), 404, $this->format);
             return false;
         }
 
diff --git a/actions/apigroupleave.php b/actions/apigroupleave.php
index 8665ea1aa..514a3a557 100644
--- a/actions/apigroupleave.php
+++ b/actions/apigroupleave.php
@@ -101,7 +101,7 @@ class ApiGroupLeaveAction extends ApiAuthAction
         }
 
         if (empty($this->group)) {
-            $this->clientError('Group not found!', 404, $this->format);
+            $this->clientError(_('Group not found!'), 404, $this->format);
             return false;
         }
 
diff --git a/actions/apigroupmembership.php b/actions/apigroupmembership.php
index d221a6418..dd2843161 100644
--- a/actions/apigroupmembership.php
+++ b/actions/apigroupmembership.php
@@ -87,6 +87,11 @@ class ApiGroupMembershipAction extends ApiPrivateAuthAction
     {
         parent::handle($args);
 
+        if (empty($this->group)) {
+            $this->clientError(_('Group not found!'), 404, $this->format);
+            return false;
+        }
+
         // XXX: RSS and Atom
 
         switch($this->format) {
diff --git a/actions/apigroupshow.php b/actions/apigroupshow.php
index b745ff92f..f9b960747 100644
--- a/actions/apigroupshow.php
+++ b/actions/apigroupshow.php
@@ -87,7 +87,7 @@ class ApiGroupShowAction extends ApiPrivateAuthAction
 
         if (empty($this->group)) {
             $this->clientError(
-                'Group not found!',
+                _('Group not found!'),
                 404,
                 $this->format
             );
diff --git a/actions/apitimelinegroup.php b/actions/apitimelinegroup.php
index f25f6ba51..de13e7eb9 100644
--- a/actions/apitimelinegroup.php
+++ b/actions/apitimelinegroup.php
@@ -69,7 +69,6 @@ class ApiTimelineGroupAction extends ApiPrivateAuthAction
         parent::prepare($args);
 
         $this->group   = $this->getTargetGroup($this->arg('id'));
-        $this->notices = $this->getNotices();
 
         return true;
     }
@@ -87,6 +86,13 @@ class ApiTimelineGroupAction extends ApiPrivateAuthAction
     function handle($args)
     {
         parent::handle($args);
+
+        if (empty($this->group)) {
+            $this->clientError(_('Group not found!'), 404, $this->format);
+            return false;
+        }
+
+        $this->notices = $this->getNotices();
         $this->showTimeline();
     }
 
diff --git a/actions/block.php b/actions/block.php
index b125d2d8b..71a34e087 100644
--- a/actions/block.php
+++ b/actions/block.php
@@ -42,9 +42,11 @@ if (!defined('STATUSNET') && !defined('LACONICA')) {
  * @license  http://www.fsf.org/licensing/licenses/agpl.html AGPLv3
  * @link     http://status.net/
  */
-class BlockAction extends Action
+
+class BlockAction extends ProfileFormAction
 {
     var $profile = null;
+
     /**
      * Take arguments for running
      *
@@ -52,28 +54,22 @@ class BlockAction extends Action
      *
      * @return boolean success flag
      */
+
     function prepare($args)
     {
-        parent::prepare($args);
-        if (!common_logged_in()) {
-            $this->clientError(_('Not logged in.'));
-            return false;
-        }
-        $token = $this->trimmed('token');
-        if (!$token || $token != common_session_token()) {
-            $this->clientError(_('There was a problem with your session token. Try again, please.'));
-            return;
-        }
-        $id = $this->trimmed('blockto');
-        if (!$id) {
-            $this->clientError(_('No profile specified.'));
+        if (!parent::prepare($args)) {
             return false;
         }
-        $this->profile = Profile::staticGet('id', $id);
-        if (!$this->profile) {
-            $this->clientError(_('No profile with that ID.'));
+
+        $cur = common_current_user();
+
+        assert(!empty($cur)); // checked by parent
+
+        if ($cur->hasBlocked($this->profile)) {
+            $this->clientError(_("You already blocked that user."));
             return false;
         }
+
         return true;
     }
 
@@ -86,18 +82,16 @@ class BlockAction extends Action
      *
      * @return void
      */
+
     function handle($args)
     {
-        parent::handle($args);
         if ($_SERVER['REQUEST_METHOD'] == 'POST') {
             if ($this->arg('no')) {
-                $cur = common_current_user();
-                $other = Profile::staticGet('id', $this->arg('blockto'));
-                common_redirect(common_local_url('showstream', array('nickname' => $other->nickname)),
-                                303);
+                $this->returnToArgs();
             } elseif ($this->arg('yes')) {
-                $this->blockProfile();
-            } elseif ($this->arg('blockto')) {
+                $this->handlePost();
+                $this->returnToArgs();
+            } else {
                 $this->showPage();
             }
         }
@@ -138,7 +132,7 @@ class BlockAction extends Action
                          'unable to subscribe to you in the future, and '.
                          'you will not be notified of any @-replies from them.'));
         $this->element('input', array('id' => 'blockto-' . $id,
-                                      'name' => 'blockto',
+                                      'name' => 'profileid',
                                       'type' => 'hidden',
                                       'value' => $id));
         foreach ($this->args as $k => $v) {
@@ -157,36 +151,17 @@ class BlockAction extends Action
      *
      * @return void
      */
-    function blockProfile()
+
+    function handlePost()
     {
         $cur = common_current_user();
 
-        if ($cur->hasBlocked($this->profile)) {
-            $this->clientError(_('You have already blocked this user.'));
-            return;
-        }
         $result = $cur->block($this->profile);
+
         if (!$result) {
             $this->serverError(_('Failed to save block information.'));
             return;
         }
-
-        // Now, gotta figure where we go back to
-        foreach ($this->args as $k => $v) {
-            if ($k == 'returnto-action') {
-                $action = $v;
-            } elseif (substr($k, 0, 9) == 'returnto-') {
-                $args[substr($k, 9)] = $v;
-            }
-        }
-
-        if ($action) {
-            common_redirect(common_local_url($action, $args), 303);
-        } else {
-            common_redirect(common_local_url('subscribers',
-                                             array('nickname' => $cur->nickname)),
-                            303);
-        }
     }
 }
 
diff --git a/actions/deleteuser.php b/actions/deleteuser.php
new file mode 100644
index 000000000..32b703aa7
--- /dev/null
+++ b/actions/deleteuser.php
@@ -0,0 +1,164 @@
+<?php
+/**
+ * StatusNet, the distributed open-source microblogging tool
+ *
+ * Action class to delete a user
+ *
+ * PHP version 5
+ *
+ * LICENCE: This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @category  Action
+ * @package   StatusNet
+ * @author    Evan Prodromou <evan@status.net>
+ * @copyright 2009 StatusNet, Inc.
+ * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link      http://status.net/
+ */
+
+if (!defined('STATUSNET') && !defined('LACONICA')) {
+    exit(1);
+}
+
+/**
+ * Delete a user
+ *
+ * @category Action
+ * @package  StatusNet
+ * @author   Evan Prodromou <evan@status.net>
+ * @license  http://www.fsf.org/licensing/licenses/agpl.html AGPLv3
+ * @link     http://status.net/
+ */
+
+class DeleteuserAction extends ProfileFormAction
+{
+    var $user = null;
+
+    /**
+     * Take arguments for running
+     *
+     * @param array $args $_REQUEST args
+     *
+     * @return boolean success flag
+     */
+
+    function prepare($args)
+    {
+        if (!parent::prepare($args)) {
+            return false;
+        }
+
+        $cur = common_current_user();
+
+        assert(!empty($cur)); // checked by parent
+
+        if (!$cur->hasRight(Right::DELETEUSER)) {
+            $this->clientError(_("You cannot delete users."));
+            return false;
+        }
+
+        $this->user = User::staticGet('id', $this->profile->id);
+
+        if (empty($this->user)) {
+            $this->clientError(_("You can only delete local users."));
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * Handle request
+     *
+     * Shows a page with list of favorite notices
+     *
+     * @param array $args $_REQUEST args; handled in prepare()
+     *
+     * @return void
+     */
+
+    function handle($args)
+    {
+        if ($_SERVER['REQUEST_METHOD'] == 'POST') {
+            if ($this->arg('no')) {
+                $this->returnToArgs();
+            } elseif ($this->arg('yes')) {
+                $this->handlePost();
+                $this->returnToArgs();
+            } else {
+                $this->showPage();
+            }
+        }
+    }
+
+    function showContent() {
+        $this->areYouSureForm();
+    }
+
+    function title() {
+        return _('Delete user');
+    }
+
+    function showNoticeForm() {
+        // nop
+    }
+
+    /**
+     * Confirm with user.
+     *
+     * Shows a confirmation form.
+     *
+     * @return void
+     */
+    function areYouSureForm()
+    {
+        $id = $this->profile->id;
+        $this->elementStart('form', array('id' => 'deleteuser-' . $id,
+                                           'method' => 'post',
+                                           'class' => 'form_settings form_entity_block',
+                                           'action' => common_local_url('deleteuser')));
+        $this->elementStart('fieldset');
+        $this->hidden('token', common_session_token());
+        $this->element('legend', _('Delete user'));
+        $this->element('p', null,
+                       _('Are you sure you want to delete this user? '.
+                         'This will clear all data about the user from the '.
+                         'database, without a backup.'));
+        $this->element('input', array('id' => 'deleteuserto-' . $id,
+                                      'name' => 'profileid',
+                                      'type' => 'hidden',
+                                      'value' => $id));
+        foreach ($this->args as $k => $v) {
+            if (substr($k, 0, 9) == 'returnto-') {
+                $this->hidden($k, $v);
+            }
+        }
+        $this->submit('form_action-no', _('No'), 'submit form_action-primary', 'no', _("Do not block this user"));
+        $this->submit('form_action-yes', _('Yes'), 'submit form_action-secondary', 'yes', _('Delete this user'));
+        $this->elementEnd('fieldset');
+        $this->elementEnd('form');
+    }
+
+    /**
+     * Actually delete a user.
+     *
+     * @return void
+     */
+
+    function handlePost()
+    {
+        $this->user->delete();
+    }
+}
+
diff --git a/actions/noticesearch.php b/actions/noticesearch.php
index 1e5a69180..76c877ff2 100644
--- a/actions/noticesearch.php
+++ b/actions/noticesearch.php
@@ -121,7 +121,7 @@ class NoticesearchAction extends SearchAction
                 $message = sprintf(_('Be the first to [post on this topic](%%%%action.newnotice%%%%?status_textarea=%s)!'), urlencode($q));
             }
             else {
-                $message = sprintf(_('Why not [register an account](%%%%action.register%%%%) and be the first to  [post on this topic](%%%%action.newnotice%%%%?status_textarea=%s)!'), urlencode($q));
+                $message = sprintf(_('Why not [register an account](%%%%action.register%%%%) and be the first to [post on this topic](%%%%action.newnotice%%%%?status_textarea=%s)!'), urlencode($q));
             }
 
             $this->elementStart('div', 'guide');
diff --git a/actions/othersettings.php b/actions/othersettings.php
index d32a2d651..0de7cd908 100644
--- a/actions/othersettings.php
+++ b/actions/othersettings.php
@@ -96,28 +96,28 @@ class OthersettingsAction extends AccountSettingsAction
                                           common_local_url('othersettings')));
         $this->elementStart('fieldset');
         $this->hidden('token', common_session_token());
+        $this->elementStart('ul', 'form_data');
 
-        $services=array();
-        global $_shorteners;
-        if($_shorteners){
-            foreach($_shorteners as $name=>$value)
-            {
-                $services[$name]=$name;
-                if(!empty($value['info']['freeService'])){
-                    // I18N
-                    $services[$name].=' (free service)';
-                }
+        $shorteners = array();
+        Event::handle('GetUrlShorteners', array(&$shorteners));
+        $services = array();
+        foreach($shorteners as $name=>$value)
+        {
+            $services[$name]=$name;
+            if($value['freeService']){
+                $services[$name].=_(' (free service)');
             }
         }
-        asort($services);
-        $services['']='None';
-
-        $this->elementStart('ul', 'form_data');
-        $this->elementStart('li');
-        $this->dropdown('urlshorteningservice', _('Shorten URLs with'),
-                        $services, _('Automatic shortening service to use.'),
-                        false, $user->urlshorteningservice);
-        $this->elementEnd('li');
+        if($services)
+        {
+            asort($services);
+
+            $this->elementStart('li');
+            $this->dropdown('urlshorteningservice', _('Shorten URLs with'),
+                            $services, _('Automatic shortening service to use.'),
+                            false, $user->urlshorteningservice);
+            $this->elementEnd('li');
+        }
         $this->elementStart('li');
         $this->checkbox('viewdesigns', _('View profile designs'),
                         $user->viewdesigns, _('Show or hide profile designs.'));
diff --git a/actions/passwordsettings.php b/actions/passwordsettings.php
index 9e79501e2..11d7bf785 100644
--- a/actions/passwordsettings.php
+++ b/actions/passwordsettings.php
@@ -170,7 +170,7 @@ class PasswordsettingsAction extends AccountSettingsAction
         }
 
         $success = false;
-        if(! Event::handle('StartChangePassword', array($user->nickname, $oldpassword, $newpassword))){
+        if(! Event::handle('StartChangePassword', array($user, $oldpassword, $newpassword))){
             //no handler changed the password, so change the password internally
             $original = clone($user);
 
@@ -186,7 +186,7 @@ class PasswordsettingsAction extends AccountSettingsAction
                 $this->serverError(_('Can\'t save new password.'));
                 return;
             }
-            Event::handle('EndChangePassword', array($nickname));
+            Event::handle('EndChangePassword', array($user));
         }
 
         $this->showForm(_('Password saved.'), true);
diff --git a/actions/sandbox.php b/actions/sandbox.php
new file mode 100644
index 000000000..5b034ff07
--- /dev/null
+++ b/actions/sandbox.php
@@ -0,0 +1,89 @@
+<?php
+/**
+ * StatusNet, the distributed open-source microblogging tool
+ *
+ * Action class to sandbox an abusive user
+ *
+ * PHP version 5
+ *
+ * LICENCE: This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @category  Action
+ * @package   StatusNet
+ * @author    Evan Prodromou <evan@status.net>
+ * @copyright 2009 StatusNet, Inc.
+ * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link      http://status.net/
+ */
+
+if (!defined('STATUSNET')) {
+    exit(1);
+}
+
+/**
+ * Sandbox a user.
+ *
+ * @category Action
+ * @package  StatusNet
+ * @author   Evan Prodromou <evan@status.net>
+ * @license  http://www.fsf.org/licensing/licenses/agpl.html AGPLv3
+ * @link     http://status.net/
+ */
+
+class SandboxAction extends ProfileFormAction
+{
+    /**
+     * Check parameters
+     *
+     * @param array $args action arguments (URL, GET, POST)
+     *
+     * @return boolean success flag
+     */
+
+    function prepare($args)
+    {
+        if (!parent::prepare($args)) {
+            return false;
+        }
+
+        $cur = common_current_user();
+
+        assert(!empty($cur)); // checked by parent
+
+        if (!$cur->hasRight(Right::SANDBOXUSER)) {
+            $this->clientError(_("You cannot sandbox users on this site."));
+            return false;
+        }
+
+        assert(!empty($this->profile)); // checked by parent
+
+        if ($this->profile->isSandboxed()) {
+            $this->clientError(_("User is already sandboxed."));
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * Sandbox a user.
+     *
+     * @return void
+     */
+
+    function handlePost()
+    {
+        $this->profile->sandbox();
+    }
+}
diff --git a/actions/silence.php b/actions/silence.php
new file mode 100644
index 000000000..206e5ba87
--- /dev/null
+++ b/actions/silence.php
@@ -0,0 +1,89 @@
+<?php
+/**
+ * StatusNet, the distributed open-source microblogging tool
+ *
+ * Action class to silence an abusive user
+ *
+ * PHP version 5
+ *
+ * LICENCE: This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @category  Action
+ * @package   StatusNet
+ * @author    Evan Prodromou <evan@status.net>
+ * @copyright 2009 StatusNet, Inc.
+ * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link      http://status.net/
+ */
+
+if (!defined('STATUSNET')) {
+    exit(1);
+}
+
+/**
+ * Silence a user.
+ *
+ * @category Action
+ * @package  StatusNet
+ * @author   Evan Prodromou <evan@status.net>
+ * @license  http://www.fsf.org/licensing/licenses/agpl.html AGPLv3
+ * @link     http://status.net/
+ */
+
+class SilenceAction extends ProfileFormAction
+{
+    /**
+     * Check parameters
+     *
+     * @param array $args action arguments (URL, GET, POST)
+     *
+     * @return boolean success flag
+     */
+
+    function prepare($args)
+    {
+        if (!parent::prepare($args)) {
+            return false;
+        }
+
+        $cur = common_current_user();
+
+        assert(!empty($cur)); // checked by parent
+
+        if (!$cur->hasRight(Right::SILENCEUSER)) {
+            $this->clientError(_("You cannot silence users on this site."));
+            return false;
+        }
+
+        assert(!empty($this->profile)); // checked by parent
+
+        if ($this->profile->isSilenced()) {
+            $this->clientError(_("User is already silenced."));
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * Silence a user.
+     *
+     * @return void
+     */
+
+    function handlePost()
+    {
+        $this->profile->silence();
+    }
+}
diff --git a/actions/unblock.php b/actions/unblock.php
index dc28d5d54..c60458cd3 100644
--- a/actions/unblock.php
+++ b/actions/unblock.php
@@ -42,57 +42,25 @@ if (!defined('STATUSNET') && !defined('LACONICA')) {
  * @license  http://www.fsf.org/licensing/licenses/agpl.html AGPLv3
  * @link     http://status.net/
  */
-class UnblockAction extends Action
-{
-    var $profile = null;
 
-    /**
-     * Take arguments for running
-     *
-     * @param array $args $_REQUEST args
-     *
-     * @return boolean success flag
-     */
+class UnblockAction extends ProfileFormAction
+{
     function prepare($args)
     {
-        parent::prepare($args);
-        if (!common_logged_in()) {
-            $this->clientError(_('Not logged in.'));
-            return false;
-        }
-        $token = $this->trimmed('token');
-        if (!$token || $token != common_session_token()) {
-            $this->clientError(_('There was a problem with your session token. Try again, please.'));
-            return;
-        }
-        $id = $this->trimmed('unblockto');
-        if (!$id) {
-            $this->clientError(_('No profile specified.'));
+        if (!parent::prepare($args)) {
             return false;
         }
-        $this->profile = Profile::staticGet('id', $id);
-        if (!$this->profile) {
-            $this->clientError(_('No profile with that ID.'));
+
+        $cur = common_current_user();
+
+        assert(!empty($cur)); // checked by parent
+
+        if (!$cur->hasBlocked($this->profile)) {
+            $this->clientError(_("You haven't blocked that user."));
             return false;
         }
-        return true;
-    }
 
-    /**
-     * Handle request
-     *
-     * Shows a page with list of favorite notices
-     *
-     * @param array $args $_REQUEST args; handled in prepare()
-     *
-     * @return void
-     */
-    function handle($args)
-    {
-        parent::handle($args);
-        if ($_SERVER['REQUEST_METHOD'] == 'POST') {
-            $this->unblockProfile();
-        }
+        return true;
     }
 
     /**
@@ -100,7 +68,8 @@ class UnblockAction extends Action
      *
      * @return void
      */
-    function unblockProfile()
+
+    function handlePost()
     {
         $cur    = common_current_user();
         $result = $cur->unblock($this->profile);
@@ -108,20 +77,5 @@ class UnblockAction extends Action
             $this->serverError(_('Error removing the block.'));
             return;
         }
-        foreach ($this->args as $k => $v) {
-            if ($k == 'returnto-action') {
-                $action = $v;
-            } else if (substr($k, 0, 9) == 'returnto-') {
-                $args[substr($k, 9)] = $v;
-            }
-        }
-        if ($action) {
-            common_redirect(common_local_url($action, $args), 303);
-        } else {
-            common_redirect(common_local_url('subscribers',
-                                             array('nickname' => $cur->nickname)),
-                            303);
-        }
     }
 }
-
diff --git a/actions/unsandbox.php b/actions/unsandbox.php
new file mode 100644
index 000000000..22f4d8e76
--- /dev/null
+++ b/actions/unsandbox.php
@@ -0,0 +1,89 @@
+<?php
+/**
+ * StatusNet, the distributed open-source microblogging tool
+ *
+ * Action class to unsandbox a user
+ *
+ * PHP version 5
+ *
+ * LICENCE: This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @category  Action
+ * @package   StatusNet
+ * @author    Evan Prodromou <evan@status.net>
+ * @copyright 2009 StatusNet, Inc.
+ * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link      http://status.net/
+ */
+
+if (!defined('STATUSNET')) {
+    exit(1);
+}
+
+/**
+ * Unsandbox a user.
+ *
+ * @category Action
+ * @package  StatusNet
+ * @author   Evan Prodromou <evan@status.net>
+ * @license  http://www.fsf.org/licensing/licenses/agpl.html AGPLv3
+ * @link     http://status.net/
+ */
+
+class UnsandboxAction extends ProfileFormAction
+{
+    /**
+     * Check parameters
+     *
+     * @param array $args action arguments (URL, GET, POST)
+     *
+     * @return boolean success flag
+     */
+
+    function prepare($args)
+    {
+        if (!parent::prepare($args)) {
+            return false;
+        }
+
+        $cur = common_current_user();
+
+        assert(!empty($cur)); // checked by parent
+
+        if (!$cur->hasRight(Right::SANDBOXUSER)) {
+            $this->clientError(_("You cannot sandbox users on this site."));
+            return false;
+        }
+
+        assert(!empty($this->profile)); // checked by parent
+
+        if (!$this->profile->isSandboxed()) {
+            $this->clientError(_("User is not sandboxed."));
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * Unsandbox a user.
+     *
+     * @return void
+     */
+
+    function handlePost()
+    {
+        $this->profile->unsandbox();
+    }
+}
diff --git a/actions/unsilence.php b/actions/unsilence.php
new file mode 100644
index 000000000..9ff1b828b
--- /dev/null
+++ b/actions/unsilence.php
@@ -0,0 +1,89 @@
+<?php
+/**
+ * StatusNet, the distributed open-source microblogging tool
+ *
+ * Action class to unsilence a user
+ *
+ * PHP version 5
+ *
+ * LICENCE: This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @category  Action
+ * @package   StatusNet
+ * @author    Evan Prodromou <evan@status.net>
+ * @copyright 2009 StatusNet, Inc.
+ * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
+ * @link      http://status.net/
+ */
+
+if (!defined('STATUSNET')) {
+    exit(1);
+}
+
+/**
+ * Silence a user.
+ *
+ * @category Action
+ * @package  StatusNet
+ * @author   Evan Prodromou <evan@status.net>
+ * @license  http://www.fsf.org/licensing/licenses/agpl.html AGPLv3
+ * @link     http://status.net/
+ */
+
+class UnsilenceAction extends ProfileFormAction
+{
+    /**
+     * Check parameters
+     *
+     * @param array $args action arguments (URL, GET, POST)
+     *
+     * @return boolean success flag
+     */
+
+    function prepare($args)
+    {
+        if (!parent::prepare($args)) {
+            return false;
+        }
+
+        $cur = common_current_user();
+
+        assert(!empty($cur)); // checked by parent
+
+        if (!$cur->hasRight(Right::SILENCEUSER)) {
+            $this->clientError(_("You cannot silence users on this site."));
+            return false;
+        }
+
+        assert(!empty($this->profile)); // checked by parent
+
+        if (!$this->profile->isSilenced()) {
+            $this->clientError(_("User is not silenced."));
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * Silence a user.
+     *
+     * @return void
+     */
+
+    function handlePost()
+    {
+        $this->profile->unsilence();
+    }
+}
diff --git a/actions/userbyid.php b/actions/userbyid.php
index 802bcb081..86a61f20b 100644
--- a/actions/userbyid.php
+++ b/actions/userbyid.php
@@ -74,8 +74,11 @@ class UserbyidAction extends Action
             $this->clientError(_('No such user.'));
         }
 
-        // support redirecting to FOAF rdf/xml if the agent prefers it
-        $page_prefs = 'application/rdf+xml,text/html,application/xhtml+xml,application/xml;q=0.3,text/xml;q=0.2';
+        // Support redirecting to FOAF rdf/xml if the agent prefers it...
+        // Internet Explorer doesn't specify "text/html" and does list "*/*"
+        // at least through version 8. We need to list text/html up front to
+        // ensure that only user-agents who specifically ask for RDF get it.
+        $page_prefs = 'text/html,application/xhtml+xml,application/rdf+xml,application/xml;q=0.3,text/xml;q=0.2';
         $httpaccept = isset($_SERVER['HTTP_ACCEPT'])
                       ? $_SERVER['HTTP_ACCEPT'] : null;
         $type       = common_negotiate_type(common_accept_to_prefs($httpaccept),
diff --git a/actions/xrds.php b/actions/xrds.php
index 8f09557d1..534182e3e 100644
--- a/actions/xrds.php
+++ b/actions/xrds.php
@@ -97,27 +97,23 @@ class XrdsAction extends Action
         $xrdsOutputter->element('Type', null, 'xri://$xrds*simple');
         $xrdsOutputter->showXrdsService(OAUTH_ENDPOINT_REQUEST,
                             common_local_url('requesttoken'),
-                            array(OAUTH_AUTH_HEADER, OAUTH_POST_BODY, OAUTH_HMAC_SHA1));
-        $xrdsOutputter->showXrdsService( OAUTH_ENDPOINT_AUTHORIZE,
-                            common_local_url('userauthorization'),
                             array(OAUTH_AUTH_HEADER, OAUTH_POST_BODY, OAUTH_HMAC_SHA1),
                             null,
-                            $this->user->getIdentifierURI());
+                            $this->user->uri);
+        $xrdsOutputter->showXrdsService( OAUTH_ENDPOINT_AUTHORIZE,
+                            common_local_url('userauthorization'),
+                            array(OAUTH_AUTH_HEADER, OAUTH_POST_BODY, OAUTH_HMAC_SHA1));
         $xrdsOutputter->showXrdsService(OAUTH_ENDPOINT_ACCESS,
                             common_local_url('accesstoken'),
-                            array(OAUTH_AUTH_HEADER, OAUTH_POST_BODY, OAUTH_HMAC_SHA1),
-                            null,
-                            $this->user->getIdentifierURI());
+                            array(OAUTH_AUTH_HEADER, OAUTH_POST_BODY, OAUTH_HMAC_SHA1));
         $xrdsOutputter->showXrdsService(OAUTH_ENDPOINT_RESOURCE,
                             null,
-                            array(OAUTH_AUTH_HEADER, OAUTH_POST_BODY, OAUTH_HMAC_SHA1),
-                            null,
-                            $this->user->getIdentifierURI());
+                            array(OAUTH_AUTH_HEADER, OAUTH_POST_BODY, OAUTH_HMAC_SHA1));
         $xrdsOutputter->elementEnd('XRD');
         
         //omb
         $xrdsOutputter->elementStart('XRD', array('xmlns' => 'xri://$xrd*($v*2.0)',
-                                          'xml:id' => 'oauth',
+                                          'xml:id' => 'omb',
                                           'xmlns:simple' => 'http://xrds-simple.net/core/1.0',
                                           'version' => '2.0'));
         $xrdsOutputter->element('Type', null, 'xri://$xrds*simple');
@@ -127,10 +123,10 @@ class XrdsAction extends Action
                             common_local_url('updateprofile'));
         $xrdsOutputter->elementEnd('XRD');
         
+        Event::handle('EndUserXRDS', array($this,&$xrdsOutputter));
+
         //misc
         $xrdsOutputter->elementStart('XRD', array('xmlns' => 'xri://$xrd*($v*2.0)',
-                                          'xml:id' => 'oauth',
-                                          'xmlns:simple' => 'http://xrds-simple.net/core/1.0',
                                           'version' => '2.0'));
         $xrdsOutputter->showXrdsService(OAUTH_DISCOVERY,
                             '#oauth');
@@ -138,8 +134,6 @@ class XrdsAction extends Action
                             '#omb');
         $xrdsOutputter->elementEnd('XRD');
 
-        Event::handle('EndUserXRDS', array($this,&$xrdsOutputter));
-
         $xrdsOutputter->endXRDS();
         
     }