16 files changed, 392 insertions, 70 deletions

diff --git a/README.md b/README.md
index 2d484f8..26d9fa1 100644
--- a/README.md
+++ b/README.md
@@ -100,6 +100,7 @@ This will:
 - [How to install & run your own ActivityPub server on FreeBSD using snac, nginx, lets'encrypt (by gyptazy)](https://gyptazy.com/blog/install-snac2-on-freebsd-an-activitypub-instance-for-the-fediverse/).
 - [How to install snac on OpenBSD without relayd (by @antics@mastodon.nu)](https://chai.guru/pub/openbsd/snac.html).
 - [Setting up Snac in OpenBSD (by Yonle)](https://wiki.ircnow.org/index.php?n=Openbsd.Snac).
+- [How to run your own social network with snac (by Giacomo Tesio)](https://encrypted.tesio.it/2024/12/18/how-to-run-your-own-social-network.html). Includes information on how to run snac as a CGI.
 
 ## Incredibly awesome CSS themes for snac
 
diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
index 073985b..5a1315f 100644
--- a/RELEASE_NOTES.md
+++ b/RELEASE_NOTES.md
@@ -1,5 +1,27 @@
 # Release Notes
 
+## UNRELEASED
+
+Fixed regression in link verification code (contributed by nowster).
+
+Added ipv6 support for the https frontend connection (contributed by hb9hnt).
+
+New "Like by URL" operation (contributed by dheadshot).
+
+Some search fixes regarding repeated matches.
+
+The `export_csv` cmdline operation now exports the CSV files inside a user's `export/` subdirectory instead of the current directory.
+
+All CSV files to be imported must now be stored inside a user's `import/` subdirectory instead of the current directory.
+
+Mastodon API: more timeline paging tunings (contributed by nowster).
+
+The command-line operation `note` new reads the `LANG` environment variable to set the post's language.
+
+Fixed support for `Audio` objects.
+
+Made xmpp and mailto URLs clickable.
+
 ## 2.67
 
 The search box also accepts post URLs; the post is requested and, if it's found, can be interacted with (liked, boosted, replied to, etc.).
diff --git a/TODO.md b/TODO.md
index 0f2cbd0..ff32e73 100644
--- a/TODO.md
+++ b/TODO.md
@@ -8,8 +8,6 @@ Editing / Updating a post does not index newly added hashtags.
 
 Wrong level of message visibility when using the Mastodon API: https://codeberg.org/grunfink/snac2/issues/200#issuecomment-2351042
 
-Unfollowing lemmy groups gets rejected with an http status of 400.
-
 Unfollowing guppe groups seems to work (http status of 200), but messages continue to arrive as if it didn't.
 
 Important: deleting a follower should do more that just delete the object, see https://codeberg.org/grunfink/snac2/issues/43#issuecomment-956721
@@ -363,3 +361,7 @@ Add a pidfile (2.64, 2024-11-17T10:21:29+0100).
 Implement Proxying for Media Links to Enhance User Privacy (see https://codeberg.org/grunfink/snac2/issues/219 for more information) (2024-11-18T20:36:39+0100).
 
 Consider showing only posts by the account owner (not full trees) (see https://codeberg.org/grunfink/snac2/issues/217 for more information) (2024-11-18T20:36:39+0100).
+
+Unfollowing lemmy groups gets rejected with an http status of 400 (it seems to work now; 2024-12-28T16:50:16+0100).
+
+CSV import/export does not work with OpenBSD security on; document it or fix it (2025-01-04T19:35:09+0100).
diff --git a/activitypub.c b/activitypub.c
index 34cc32f..ea4d8ea 100644
--- a/activitypub.c
+++ b/activitypub.c
@@ -10,6 +10,7 @@
 #include "xs_time.h"
 #include "xs_set.h"
 #include "xs_match.h"
+#include "xs_unicode.h"
 
 #include "snac.h"
 
@@ -178,6 +179,11 @@ const char *get_atto(const xs_dict *msg)
             }
         }
     }
+    else
+    if (xs_type(actor) == XSTYPE_DICT) {
+        /* bandwagon.fm returns this */
+        actor = xs_dict_get(actor, "id");
+    }
 
     return actor;
 }
@@ -701,6 +707,32 @@ int is_msg_for_me(snac *snac, const xs_dict *c_msg)
         }
     }
 
+    /* does this message contain a tag we are following? */
+    const xs_list *fw_tags = xs_dict_get(snac->config, "followed_hashtags");
+    if (pub_msg && xs_type(fw_tags) == XSTYPE_LIST) {
+        const xs_list *tags_in_msg = xs_dict_get(msg, "tag");
+        if (xs_type(tags_in_msg) == XSTYPE_LIST) {
+            const xs_dict *te;
+
+            /* iterate the tags in the message */
+            xs_list_foreach(tags_in_msg, te) {
+                if (xs_type(te) == XSTYPE_DICT) {
+                    const char *type = xs_dict_get(te, "type");
+                    const char *name = xs_dict_get(te, "name");
+
+                    if (xs_type(type) == XSTYPE_STRING && xs_type(name) == XSTYPE_STRING) {
+                        if (strcmp(type, "Hashtag") == 0) {
+                            xs *lc_name = xs_utf8_to_lower(name);
+
+                            if (xs_list_in(fw_tags, lc_name) != -1)
+                                return 7;
+                        }
+                    }
+                }
+            }
+        }
+    }
+
     return 0;
 }
 
@@ -1390,7 +1422,8 @@ xs_dict *msg_follow(snac *snac, const char *q)
 
 
 xs_dict *msg_note(snac *snac, const xs_str *content, const xs_val *rcpts,
-                  const xs_str *in_reply_to, const xs_list *attach, int priv)
+                  const xs_str *in_reply_to, const xs_list *attach,
+                  int priv, const char *lang_str)
 /* creates a 'Note' message */
 {
     xs *ntid = tid(0);
@@ -1552,6 +1585,20 @@ xs_dict *msg_note(snac *snac, const xs_str *content, const xs_val *rcpts,
     if (xs_list_len(atls))
         msg = xs_dict_append(msg, "attachment", atls);
 
+    /* set language content map */
+    if (xs_type(lang_str) == XSTYPE_STRING) {
+        /* split at the first _ */
+        xs *l0 = xs_split(lang_str, "_");
+        const char *lang = xs_list_get(l0, 0);
+
+        if (xs_type(lang) == XSTYPE_STRING && strlen(lang) == 2) {
+            /* a valid ISO language id */
+            xs *cmap = xs_dict_new();
+            cmap = xs_dict_set(cmap, lang, xs_dict_get(msg, "content"));
+            msg = xs_dict_set(msg, "contentMap", cmap);
+        }
+    }
+
     return msg;
 }
 
@@ -1593,7 +1640,7 @@ xs_dict *msg_question(snac *user, const char *content, xs_list *attach,
                       const xs_list *opts, int multiple, int end_secs)
 /* creates a Question message */
 {
-    xs_dict *msg = msg_note(user, content, NULL, NULL, attach, 0);
+    xs_dict *msg = msg_note(user, content, NULL, NULL, attach, 0, NULL);
     int max      = 8;
     xs_set seen;
 
@@ -2386,22 +2433,28 @@ void process_user_queue_item(snac *snac, xs_dict *q_item)
         xs *rcpts = recipient_list(snac, msg, 1);
         xs_set inboxes;
         const xs_str *actor;
-        int c;
 
         xs_set_init(&inboxes);
 
+        /* add this shared inbox first */
+        xs *this_shared_inbox = xs_fmt("%s/shared-inbox", srv_baseurl);
+        xs_set_add(&inboxes, this_shared_inbox);
+        enqueue_output(snac, msg, this_shared_inbox, 0, 0);
+
         /* iterate the recipients */
-        c = 0;
-        while (xs_list_next(rcpts, &actor, &c)) {
-            xs *inbox = get_actor_inbox(actor, 1);
-
-            if (inbox != NULL) {
-                /* add to the set and, if it's not there, send message */
-                if (xs_set_add(&inboxes, inbox) == 1)
-                    enqueue_output(snac, msg, inbox, 0, 0);
+        xs_list_foreach(rcpts, actor) {
+            /* local users were served by this_shared_inbox */
+            if (!xs_startswith(actor, srv_baseurl)) {
+                xs *inbox = get_actor_inbox(actor, 1);
+
+                if (inbox != NULL) {
+                    /* add to the set and, if it's not there, send message */
+                    if (xs_set_add(&inboxes, inbox) == 1)
+                        enqueue_output(snac, msg, inbox, 0, 0);
+                }
+                else
+                    snac_log(snac, xs_fmt("cannot find inbox for %s", actor));
             }
-            else
-                snac_log(snac, xs_fmt("cannot find inbox for %s", actor));
         }
 
         /* if it's a public note or question, send to the collected inboxes */
@@ -2410,8 +2463,7 @@ void process_user_queue_item(snac *snac, xs_dict *q_item)
                 xs *shibx = inbox_list();
                 const xs_str *inbox;
 
-                c = 0;
-                while (xs_list_next(shibx, &inbox, &c)) {
+                xs_list_foreach(shibx, inbox) {
                     if (xs_set_add(&inboxes, inbox) == 1)
                         enqueue_output(snac, msg, inbox, 0, 0);
                 }
diff --git a/data.c b/data.c
index eb4c9d5..0fd3528 100644
--- a/data.c
+++ b/data.c
@@ -136,6 +136,18 @@ int srv_open(const char *basedir, int auto_upgrade)
         srv_proxy_token_seed = xs_hex_enc(rnd, sizeof(rnd));
     }
 
+    /* ensure user directories include important subdirectories */
+    xs *users = user_list();
+    const char *uid;
+
+    xs_list_foreach(users, uid) {
+        xs *impdir = xs_fmt("%s/user/%s/import", srv_basedir, uid);
+        xs *expdir = xs_fmt("%s/user/%s/export", srv_basedir, uid);
+
+        mkdirx(impdir);
+        mkdirx(expdir);
+    }
+
     return ret;
 }
 
@@ -2705,6 +2717,11 @@ xs_list *content_search(snac *user, const char *regex,
         if (id == NULL || is_hidden(user, id))
             continue;
 
+        /* recalculate the md5 id to be sure it's not repeated
+           (it may have been searched by the "url" field instead of "id") */
+        xs *new_md5 = xs_md5_hex(id, strlen(id));
+        md5 = new_md5;
+
         /* test for the post URL */
         if (strcmp(id, regex) == 0) {
             if (xs_set_add(&seen, md5) == 1)
diff --git a/doc/snac.1 b/doc/snac.1
index efba67e..999c594 100644
--- a/doc/snac.1
+++ b/doc/snac.1
@@ -270,7 +270,9 @@ user url that also contains a rel="me" attribute. These links are specially
 marked as verified in the user's public timeline and also via the Mastodon API.
 .It Cm export_csv Ar basedir Ar uid
 Exports some account data as Mastodon-compatible CSV files. After executing
-this command, the following files will be written to the current directory:
+this command, the following files will be written to the
+.Pa export/
+subdirectory inside the user directory:
 .Pa bookmarks.csv ,
 .Pa blocked_accounts.csv ,
 .Pa lists.csv , and
@@ -286,7 +288,9 @@ Starts a migration from this account to the one set as an alias (see
 section 'Migrating from snac to Mastodon').
 .It Cm import_csv Ar basedir Ar uid
 Imports CSV data files from a Mastodon export. This command expects the
-following files to be in the current directory:
+following files to be inside the
+.Pa import/
+subdirectory of a user's directory inside the server base directory:
 .Pa bookmarks.csv ,
 .Pa blocked_accounts.csv ,
 .Pa lists.csv , and
@@ -314,10 +318,15 @@ for a job to be assigned), input or output (processing I/O packets)
 or stopped (not running, only to be seen while starting or stopping
 the server).
 .It Cm import_list Ar basedir Ar uid Ar file
-Imports a Mastodon list in CSV format. This option can be used to
-import "Mastodon Follow Packs".
+Imports a Mastodon list in CSV format. The file must be stored inside the
+.Pa import/
+subdirectory of a user's directory inside the server base directory.
+This option can be used to import "Mastodon Follow Packs".
 .It Cm import_block_list Ar basedir Ar uid Ar file
-Imports a Mastodon list of accounts to be blocked in CSV format.
+Imports a Mastodon list of accounts to be blocked in CSV format. The
+file must be stored inside the
+.Pa import/
+subdirectory of a user's directory inside the server base directory.
 .El
 .Ss Migrating an account to/from Mastodon
 See 
diff --git a/doc/snac.5 b/doc/snac.5
index 0168430..be7bfd7 100644
--- a/doc/snac.5
+++ b/doc/snac.5
@@ -209,6 +209,12 @@ web interface.
 .It Pa history/
 This directory contains generated HTML files. They may be snapshots of the
 local timeline in previous months or other cached data.
+.It Pa export/
+This directory will contain exported data in Mastodon-compatible CSV format
+after executing the 'export_csv' command-line operation.
+.It Pa import/
+Mastodon-compatible CSV files must be copied into this directory to use
+any of the importing functions.
 .It Pa server.pid
 This file stores the server PID in a single text line.
 .El
diff --git a/doc/snac.8 b/doc/snac.8
index f5e4bd5..f94d53f 100644
--- a/doc/snac.8
+++ b/doc/snac.8
@@ -421,7 +421,9 @@ server, first export your data to CSV by running:
 snac export_csv $SNAC_BASEDIR origin
 .Ed
 .Pp
-You'll find the following CSV files in the current directory:
+You'll find the following CSV files in the
+.Pa export/
+subdirectory inside the user directory:
 .Pa bookmarks.csv ,
 .Pa blocked_accounts.csv ,
 .Pa lists.csv , and
@@ -480,6 +482,7 @@ Also, please take note that the
 account you migrated from is not disabled nor changed in any way, so can still
 use it as it no migration was done. This behaviour may or may not match what other
 ActivityPub implementations do.
+.Pp
 .Ss Migrating from Mastodon to snac
 Since version 2.61, you can migrate accounts on other ActivityPub instances to your
 .Nm
@@ -508,7 +511,9 @@ directory:
 .Pa lists.csv , and
 .Pa following_accounts.csv .
 .Pp
-2. From the directory where those files are stored, run
+2. Copy all those files to the
+.Pa import/
+subdirectory of the user's directory inside the server base directory, and run
 .Bd -literal -offset indent
 snac import_csv $SNAC_BASEDIR destination
 .Ed
@@ -518,7 +523,9 @@ of all the ActivityPub servers involved (webfinger, accounts, posts, etc.). Some
 may be transient and retried later. Also, if
 .Nm
 complains that it can't find any of these files, please check that they are really
-stored in the current directory and that their names match exactly. Some of them may be
+stored in the
+.Pa import/
+subdirectory and that their names match exactly. Some of them may be
 empty (for example, if you didn't create any list) and that's fine.
 .Pp
 3. Again on your
diff --git a/format.c b/format.c
index 12783ae..41e4162 100644
--- a/format.c
+++ b/format.c
@@ -7,6 +7,7 @@
 #include "xs_html.h"
 #include "xs_json.h"
 #include "xs_time.h"
+#include "xs_match.h"
 
 #include "snac.h"
 
@@ -93,7 +94,8 @@ static xs_str *format_line(const char *line, xs_list **attach)
             "\\*\\*?\\*?[^\\*]+\\*?\\*?\\*"     "|"
             "!\\[[^]]+\\]\\([^\\)]+\\)"         "|"
             "\\[[^]]+\\]\\([^\\)]+\\)"          "|"
-            "[a-z]+:/" "/[^[:space:]]+"
+            "[a-z]+:/" "/[^[:space:]]+"         "|"
+            "(mailto|xmpp):[^@[:space:]]+@[^[:space:]]+"
         ")");
     int n = 0;
 
@@ -230,6 +232,15 @@ static xs_str *format_line(const char *line, xs_list **attach)
                 }
             }
             else
+            if (xs_match(v, "mailto*|xmpp*")) {
+                xs *u  = xs_replace_i(xs_replace(v, "#", "#"), "@", "@");
+
+                xs *v2 = xs_strip_chars_i(xs_dup(u), ".,)");
+
+                xs *s1 = xs_fmt("<a href=\"%s\" target=\"_blank\">%s</a>", v2, u);
+                s = xs_str_cat(s, s1);
+            }
+            else
                 s = xs_str_cat(s, v);
         }
         else
diff --git a/html.c b/html.c
index 2c0a823..cd8279e 100644
--- a/html.c
+++ b/html.c
@@ -934,7 +934,7 @@ static xs_html *html_user_body(snac *user, int read_only)
                     }
                 }
                 else
-                if (xs_startswith(v, "gemini:/")) {
+                if (xs_startswith(v, "gemini:/") || xs_startswith(v, "xmpp:")) {
                     value = xs_html_tag("a",
                         xs_html_attr("rel", "me"),
                         xs_html_attr("href", v),
@@ -1034,6 +1034,23 @@ xs_html *html_top_controls(snac *snac)
                     xs_html_attr("value",   L("Boost"))),
                 xs_html_text(" "),
                 xs_html_text(L("(by URL)"))),
+            xs_html_tag("p", NULL),
+            xs_html_tag("form",
+                xs_html_attr("autocomplete", "off"),
+                xs_html_attr("method",       "post"),
+                xs_html_attr("action",       ops_action),
+                xs_html_sctag("input",
+                    xs_html_attr("type",     "text"),
+                    xs_html_attr("name",     "id"),
+                    xs_html_attr("required", "required"),
+                    xs_html_attr("placeholder", "https:/" "/fedi.example.com/bob/...")),
+                xs_html_text(" "),
+                xs_html_sctag("input",
+                    xs_html_attr("type",    "submit"),
+                    xs_html_attr("name",    "action"),
+                    xs_html_attr("value",   L("Like"))),
+                xs_html_text(" "),
+                xs_html_text(L("(by URL)"))),
             xs_html_tag("p", NULL)));
 
     /** user settings **/
@@ -2917,6 +2934,8 @@ int html_get_handler(const xs_dict *req, const char *q_path,
     int proxy = 0;
     const char *v;
 
+    const xs_dict *q_vars = xs_dict_get(req, "q_vars");
+
     xs *l = xs_split_n(q_path, "/", 2);
     v = xs_list_get(l, 1);
 
@@ -2925,6 +2944,23 @@ int html_get_handler(const xs_dict *req, const char *q_path,
         return HTTP_STATUS_NOT_FOUND;
     }
 
+    if (strcmp(v, "share-bridge") == 0) {
+        /* temporary redirect for a post */
+        const char *login = xs_dict_get(q_vars, "login");
+        const char *content = xs_dict_get(q_vars, "content");
+
+        if (xs_type(login) == XSTYPE_STRING && xs_type(content) == XSTYPE_STRING) {
+            xs *b64 = xs_base64_enc(content, strlen(content));
+
+            srv_log(xs_fmt("share-bridge for user '%s'", login));
+
+            *body = xs_fmt("%s/%s/share?content=%s", srv_baseurl, login, b64);
+            return HTTP_STATUS_SEE_OTHER;
+        }
+        else
+            return HTTP_STATUS_NOT_FOUND;
+    }
+
     uid = xs_dup(v);
 
     /* rss extension? */
@@ -2959,7 +2995,6 @@ int html_get_handler(const xs_dict *req, const char *q_path,
     int def_show = xs_number_get(xs_dict_get(srv_config, "max_timeline_entries"));
     int show = def_show;
 
-    const xs_dict *q_vars = xs_dict_get(req, "q_vars");
     if ((v = xs_dict_get(q_vars, "skip")) != NULL)
         skip = atoi(v), cache = 0, save = 0;
     if ((v = xs_dict_get(q_vars, "show")) != NULL)
@@ -3045,32 +3080,30 @@ int html_get_handler(const xs_dict *req, const char *q_path,
                     q = url_acct;
                 }
                 else {
-                    /* if it's not already here, try to bring it to the user's timeline */
-                    xs *md5 = xs_md5_hex(q, strlen(q));
-
-                    if (!timeline_here(&snac, md5)) {
-                        xs *object = NULL;
-                        int status;
+                    /* bring it to the user's timeline */
+                    xs *object = NULL;
+                    int status;
 
-                        status = activitypub_request(&snac, q, &object);
-                        snac_debug(&snac, 1, xs_fmt("Request searched URL %s %d", q, status));
+                    status = activitypub_request(&snac, q, &object);
+                    snac_debug(&snac, 1, xs_fmt("Request searched URL %s %d", q, status));
 
-                        if (valid_status(status)) {
-                            /* got it; also request the actor */
-                            const char *attr_to = get_atto(object);
+                    if (valid_status(status)) {
+                        /* got it; also request the actor */
+                        const char *attr_to = get_atto(object);
 
-                            if (!xs_is_null(attr_to)) {
-                                status = actor_request(&snac, attr_to, &actor_obj);
+                        if (!xs_is_null(attr_to)) {
+                            status = actor_request(&snac, attr_to, &actor_obj);
 
-                                snac_debug(&snac, 1, xs_fmt("Request author %s of %s %d", attr_to, q, status));
+                            if (valid_status(status)) {
+                                /* reset the query string to be the real id */
+                                url_acct = xs_dup(xs_dict_get(object, "id"));
+                                q = url_acct;
 
-                                if (valid_status(status)) {
-                                    /* add the actor */
-                                    actor_add(attr_to, actor_obj);
+                                /* add the post to the timeline */
+                                xs *md5 = xs_md5_hex(q, strlen(q));
 
-                                    /* add the post to the timeline */
+                                if (!timeline_here(&snac, md5))
                                     timeline_add(&snac, q, object);
-                                }
                             }
                         }
                     }
@@ -3473,6 +3506,30 @@ int html_get_handler(const xs_dict *req, const char *q_path,
         }
     }
     else
+    if (strcmp(p_path, "share") == 0) { /** direct post **/
+        if (!login(&snac, req)) {
+            *body  = xs_dup(uid);
+            status = HTTP_STATUS_UNAUTHORIZED;
+        }
+        else {
+            const char *b64 = xs_dict_get(q_vars, "content");
+            int sz;
+            xs *content = xs_base64_dec(b64, &sz);
+            xs *msg = msg_note(&snac, content, NULL, NULL, NULL, 0, NULL);
+            xs *c_msg = msg_create(&snac, msg);
+
+            timeline_add(&snac, xs_dict_get(msg, "id"), msg);
+
+            enqueue_message(&snac, c_msg);
+
+            snac_debug(&snac, 1, xs_fmt("web action 'share' received"));
+
+            *body   = xs_fmt("%s/admin", snac.actor);
+            *b_size = strlen(*body);
+            status  = HTTP_STATUS_SEE_OTHER;
+        }
+    }
+    else
         status = HTTP_STATUS_NOT_FOUND;
 
     user_free(&snac);
@@ -3604,7 +3661,7 @@ int html_post_handler(const xs_dict *req, const char *q_path,
                 enqueue_close_question(&snac, xs_dict_get(msg, "id"), end_secs);
             }
             else
-                msg = msg_note(&snac, content_2, to, in_reply_to, attach_list, priv);
+                msg = msg_note(&snac, content_2, to, in_reply_to, attach_list, priv, NULL);
 
             if (sensitive != NULL) {
                 msg = xs_dict_set(msg, "sensitive", xs_stock(XSTYPE_TRUE));
@@ -4038,7 +4095,7 @@ int html_post_handler(const xs_dict *req, const char *q_path,
         int c = 0;
 
         while (xs_list_next(ls, &v, &c)) {
-            xs *msg = msg_note(&snac, "", actor, irt, NULL, 1);
+            xs *msg = msg_note(&snac, "", actor, irt, NULL, 1, NULL);
 
             /* set the option */
             msg = xs_dict_append(msg, "name", v);
diff --git a/httpd.c b/httpd.c
index 11e4d17..804ff1b 100644
--- a/httpd.c
+++ b/httpd.c
@@ -164,6 +164,24 @@ static xs_str *greeting_html(void)
 }
 
 
+const char *share_page = ""
+"<!DOCTYPE html>\n"
+"<html>\n"
+"<head>\n"
+"<title>%s - snac</title>\n"
+"<meta content=\"width=device-width, initial-scale=1, minimum-scale=1, user-scalable=no\" name=\"viewport\">\n"
+"<link rel=\"stylesheet\" type=\"text/css\" href=\"%s/style.css\"/>\n"
+"<style>:root {color-scheme: light dark}</style>\n"
+"</head>\n"
+"<body><h1>%s link share</h1>\n"
+"<form method=\"get\" action=\"%s/share-bridge\">\n"
+"<textarea name=\"content\" rows=\"6\" wrap=\"virtual\" required=\"required\" style=\"width: 50em\">%s</textarea>\n"
+"<p>Login: <input type=\"text\" name=\"login\" autocapitalize=\"off\" required=\"required\"></p>\n"
+"<input type=\"submit\" value=\"OK\">\n"
+"</form><p>%s</p></body></html>\n"
+"";
+
+
 int server_get_handler(xs_dict *req, const char *q_path,
                        char **body, int *b_size, char **ctype)
 /* basic server services */
@@ -257,6 +275,49 @@ int server_get_handler(xs_dict *req, const char *q_path,
         *body  = xs_str_new("User-agent: *\n"
                             "Disallow: /\n");
     }
+    else
+    if (strcmp(q_path, "/style.css") == 0) {
+        FILE *f;
+        xs *css_fn = xs_fmt("%s/style.css", srv_basedir);
+
+        if ((f = fopen(css_fn, "r")) != NULL) {
+            *body = xs_readall(f);
+            fclose(f);
+
+            status = HTTP_STATUS_OK;
+            *ctype = "text/css";
+        }
+    }
+    else
+    if (strcmp(q_path, "/share") == 0) {
+        const xs_dict *q_vars = xs_dict_get(req, "q_vars");
+        const char *url  = xs_dict_get(q_vars, "url");
+        const char *text = xs_dict_get(q_vars, "text");
+        xs *s = NULL;
+
+        if (xs_type(text) == XSTYPE_STRING) {
+            if (xs_type(url) == XSTYPE_STRING)
+                s = xs_fmt("%s:\n\n%s\n", text, url);
+            else
+                s = xs_fmt("%s\n", text);
+        }
+        else
+        if (xs_type(url) == XSTYPE_STRING)
+            s = xs_fmt("%s\n", url);
+        else
+            s = xs_str_new(NULL);
+
+        status = HTTP_STATUS_OK;
+        *ctype = "text/html";
+        *body  = xs_fmt(share_page,
+            xs_dict_get(srv_config, "host"),
+            srv_baseurl,
+            xs_dict_get(srv_config, "host"),
+            srv_baseurl,
+            s,
+            USER_AGENT
+        );
+    }
 
     if (status != 0)
         srv_debug(1, xs_fmt("server_get_handler serving '%s' %d", q_path, status));
diff --git a/main.c b/main.c
index 76a7961..7a86fbd 100644
--- a/main.c
+++ b/main.c
@@ -667,7 +667,7 @@ int main(int argc, char *argv[])
         else
             content = xs_dup(url);
 
-        msg = msg_note(&snac, content, NULL, NULL, attl, 0);
+        msg = msg_note(&snac, content, NULL, NULL, attl, 0, getenv("LANG"));
 
         c_msg = msg_create(&snac, msg);
 
diff --git a/mastoapi.c b/mastoapi.c
index 09e18a1..62108ad 100644
--- a/mastoapi.c
+++ b/mastoapi.c
@@ -1348,7 +1348,7 @@ xs_list *mastoapi_timeline(snac *user, const xs_dict *args, const char *index_fn
     if (limit == 0)
         limit = 20;
 
-    if (min_id == NULL && index_desc_first(f, md5, 0)) {
+    if (index_desc_first(f, md5, 0)) {
         do {
             xs *msg = NULL;
 
@@ -1366,6 +1366,11 @@ xs_list *mastoapi_timeline(snac *user, const xs_dict *args, const char *index_fn
                     break;
             }
 
+            if (min_id) {
+                if (strcmp(md5, MID_TO_MD5(min_id)) == 0)
+                    break;
+            }
+
             /* get the entry */
             if (user) {
                 if (!valid_status(timeline_get_by_md5(user, md5, &msg)))
@@ -1435,8 +1440,14 @@ xs_list *mastoapi_timeline(snac *user, const xs_dict *args, const char *index_fn
                 out = xs_list_append(out, st);
                 cnt++;
             }
+            if (min_id) {
+                while (cnt > limit) {
+                    out = xs_list_del(out, 0);
+                    cnt--;
+                }
+            }
 
-        } while (cnt < limit && index_desc_next(f, md5));
+        } while ((min_id || (cnt < limit)) && index_desc_next(f, md5));
     }
 
     int more = index_desc_next(f, md5);
@@ -2589,6 +2600,7 @@ int mastoapi_post_handler(const xs_dict *req, const char *q_path,
             const char *visibility = xs_dict_get(args, "visibility");
             const char *summary    = xs_dict_get(args, "spoiler_text");
             const char *media_ids  = xs_dict_get(args, "media_ids");
+            const char *language   = xs_dict_get(args, "language");
 
             if (xs_is_null(media_ids))
                 media_ids = xs_dict_get(args, "media_ids[]");
@@ -2639,7 +2651,7 @@ int mastoapi_post_handler(const xs_dict *req, const char *q_path,
 
             /* prepare the message */
             xs *msg = msg_note(&snac, content, NULL, irt, attach_list,
-                        strcmp(visibility, "public") == 0 ? 0 : 1);
+                        strcmp(visibility, "public") == 0 ? 0 : 1, language);
 
             if (!xs_is_null(summary) && *summary) {
                 msg = xs_dict_set(msg, "sensitive", xs_stock(XSTYPE_TRUE));
@@ -2989,7 +3001,7 @@ int mastoapi_post_handler(const xs_dict *req, const char *q_path,
                                 if (o) {
                                     const char *name = xs_dict_get(o, "name");
 
-                                    xs *msg = msg_note(&snac, "", atto, (char *)id, NULL, 1);
+                                    xs *msg = msg_note(&snac, "", atto, (char *)id, NULL, 1, NULL);
                                     msg = xs_dict_append(msg, "name", name);
 
                                     xs *c_msg = msg_create(&snac, msg);
diff --git a/snac.h b/snac.h
index 96916d1..ec3ee5c 100644
--- a/snac.h
+++ b/snac.h
@@ -1,7 +1,7 @@
 /* snac - A simple, minimalistic ActivityPub instance */
 /* copyright (c) 2022 - 2024 grunfink et al. / MIT license */
 
-#define VERSION "2.67"
+#define VERSION "2.68-dev"
 
 #define USER_AGENT "snac/" VERSION
 
@@ -32,7 +32,7 @@ extern int dbglevel;
 
 #define L(s) (s)
 
-#define POSTLIKE_OBJECT_TYPE "Note|Question|Page|Article|Video|Event"
+#define POSTLIKE_OBJECT_TYPE "Note|Question|Page|Article|Video|Audio|Event"
 
 int mkdirx(const char *pathname);
 
@@ -316,7 +316,8 @@ xs_dict *msg_create(snac *snac, const xs_dict *object);
 xs_dict *msg_follow(snac *snac, const char *actor);
 
 xs_dict *msg_note(snac *snac, const xs_str *content, const xs_val *rcpts,
-                  const xs_str *in_reply_to, const xs_list *attach, int priv);
+                  const xs_str *in_reply_to, const xs_list *attach,
+                  int priv, const char *lang);
 
 xs_dict *msg_undo(snac *snac, const xs_val *object);
 xs_dict *msg_delete(snac *snac, const char *id);
diff --git a/utils.c b/utils.c
index df3b55d..0740d4d 100644
--- a/utils.c
+++ b/utils.c
@@ -446,7 +446,8 @@ int deluser(snac *user)
 void verify_links(snac *user)
 /* verifies a user's links */
 {
-    const xs_dict *p = xs_dict_get(user->config, "metadata");
+    xs *metadata = NULL;
+    const xs_dict *md = xs_dict_get(user->config, "metadata");
     const char *k, *v;
     int changed = 0;
 
@@ -454,8 +455,30 @@ void verify_links(snac *user)
     headers = xs_dict_append(headers, "accept", "text/html");
     headers = xs_dict_append(headers, "user-agent", USER_AGENT " (link verify)");
 
+    if (xs_type(md) == XSTYPE_DICT)
+        metadata = xs_dup(md);
+    else
+    if (xs_type(md) == XSTYPE_STRING) {
+        /* convert to dict for easier iteration */
+        metadata = xs_dict_new();
+        xs *l = xs_split(md, "\n");
+        const char *ll;
+
+        xs_list_foreach(l, ll) {
+            xs *kv = xs_split_n(ll, "=", 1);
+            const char *k = xs_list_get(kv, 0);
+            const char *v = xs_list_get(kv, 1);
+
+            if (k && v) {
+                xs *kk = xs_strip_i(xs_dup(k));
+                xs *vv = xs_strip_i(xs_dup(v));
+                metadata = xs_dict_set(metadata, kk, vv);
+            }
+        }
+    }
+
     int c = 0;
-    while (p && xs_dict_next(p, &k, &v, &c)) {
+    while (metadata && xs_dict_next(metadata, &k, &v, &c)) {
         /* not an https link? skip */
         if (!xs_startswith(v, "https:/" "/"))
             continue;
@@ -571,9 +594,9 @@ void export_csv(snac *user)
 /* exports user data to current directory in a way that pleases Mastodon */
 {
     FILE *f;
-    const char *fn;
+    xs *fn = NULL;
 
-    fn = "bookmarks.csv";
+    fn = xs_fmt("%s/export/bookmarks.csv", user->basedir);
     if ((f = fopen(fn, "w")) != NULL) {
         snac_log(user, xs_fmt("Creating %s...", fn));
 
@@ -596,7 +619,8 @@ void export_csv(snac *user)
     else
         snac_log(user, xs_fmt("Cannot create file %s", fn));
 
-    fn = "blocked_accounts.csv";
+    xs_free(fn);
+    fn = xs_fmt("%s/export/blocked_accounts.csv", user->basedir);
     if ((f = fopen(fn, "w")) != NULL) {
         snac_log(user, xs_fmt("Creating %s...", fn));
 
@@ -615,7 +639,8 @@ void export_csv(snac *user)
     else
         snac_log(user, xs_fmt("Cannot create file %s", fn));
 
-    fn = "lists.csv";
+    xs_free(fn);
+    fn = xs_fmt("%s/export/lists.csv", user->basedir);
     if ((f = fopen(fn, "w")) != NULL) {
         snac_log(user, xs_fmt("Creating %s...", fn));
 
@@ -647,7 +672,8 @@ void export_csv(snac *user)
     else
         snac_log(user, xs_fmt("Cannot create file %s", fn));
 
-    fn = "following_accounts.csv";
+    xs_free(fn);
+    fn = xs_fmt("%s/export/following_accounts.csv", user->basedir);
     if ((f = fopen(fn, "w")) != NULL) {
         snac_log(user, xs_fmt("Creating %s...", fn));
 
@@ -670,10 +696,12 @@ void export_csv(snac *user)
 }
 
 
-void import_blocked_accounts_csv(snac *user, const char *fn)
+void import_blocked_accounts_csv(snac *user, const char *ifn)
 /* imports a Mastodon CSV file of blocked accounts */
 {
     FILE *f;
+    xs *l = xs_split(ifn, "/");
+    xs *fn = xs_fmt("%s/import/%s", user->basedir, xs_list_get(l, -1));
 
     if ((f = fopen(fn, "r")) != NULL) {
         snac_log(user, xs_fmt("Importing from %s...", fn));
@@ -705,10 +733,12 @@ void import_blocked_accounts_csv(snac *user, const char *fn)
 }
 
 
-void import_following_accounts_csv(snac *user, const char *fn)
+void import_following_accounts_csv(snac *user, const char *ifn)
 /* imports a Mastodon CSV file of accounts to follow */
 {
     FILE *f;
+    xs *l = xs_split(ifn, "/");
+    xs *fn = xs_fmt("%s/import/%s", user->basedir, xs_list_get(l, -1));
 
     if ((f = fopen(fn, "r")) != NULL) {
         snac_log(user, xs_fmt("Importing from %s...", fn));
@@ -764,10 +794,12 @@ void import_following_accounts_csv(snac *user, const char *fn)
 }
 
 
-void import_list_csv(snac *user, const char *fn)
+void import_list_csv(snac *user, const char *ifn)
 /* imports a Mastodon CSV file list */
 {
     FILE *f;
+    xs *l = xs_split(ifn, "/");
+    xs *fn = xs_fmt("%s/import/%s", user->basedir, xs_list_get(l, -1));
 
     if ((f = fopen(fn, "r")) != NULL) {
         snac_log(user, xs_fmt("Importing from %s...", fn));
@@ -825,7 +857,6 @@ void import_csv(snac *user)
 /* import CSV files from Mastodon */
 {
     FILE *f;
-    const char *fn;
 
     import_blocked_accounts_csv(user, "blocked_accounts.csv");
 
@@ -833,7 +864,7 @@ void import_csv(snac *user)
 
     import_list_csv(user, "lists.csv");
 
-    fn = "bookmarks.csv";
+    xs *fn = xs_fmt("%s/import/bookmarks.csv", user->basedir);
     if ((f = fopen(fn, "r")) != NULL) {
         snac_log(user, xs_fmt("Importing from %s...", fn));
 
diff --git a/xs_socket.h b/xs_socket.h
index 1bd053a..fb67b9d 100644
--- a/xs_socket.h
+++ b/xs_socket.h
@@ -54,7 +54,39 @@ int xs_socket_server(const char *addr, const char *serv)
 /* opens a server socket by service name (or port as string) */
 {
     int rs = -1;
-    struct sockaddr_in host;
+#ifndef WITHOUT_GETADDRINFO
+    struct addrinfo *res;
+    struct addrinfo hints;
+    int status;
+
+    memset(&hints, '\0', sizeof(hints));
+
+    hints.ai_family     = AF_UNSPEC;
+    hints.ai_socktype   = SOCK_STREAM;
+
+    if (getaddrinfo(addr, serv, &hints, &res) != 0) {
+        goto end;
+    }
+
+    rs = socket(res->ai_family, res->ai_socktype, res->ai_protocol);
+
+    /* reuse addr */
+    int i = 1;
+    setsockopt(rs, SOL_SOCKET, SO_REUSEADDR, (char *)&i, sizeof(i));
+
+    status = bind(rs, res->ai_addr, res->ai_addrlen);
+    if (status == -1) {
+        fprintf(stderr, "Error binding with status %d\n", status);
+        close(rs);
+        rs = -1;
+    }
+    else {
+
+      listen(rs, SOMAXCONN);
+    }
+
+#else /* WITHOUT_GETADDRINFO */
+   struct sockaddr_in host;
 
     memset(&host, '\0', sizeof(host));
 
@@ -89,6 +121,7 @@ int xs_socket_server(const char *addr, const char *serv)
             listen(rs, SOMAXCONN);
     }
 
+#endif  /* WITHOUT_GETADDRINFO */
 end:
     return rs;
 }