6 files changed, 42 insertions, 9 deletions

diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
index 7dfb332..410376e 100644
--- a/RELEASE_NOTES.md
+++ b/RELEASE_NOTES.md
@@ -1,5 +1,9 @@
 # Release Notes
 
+## UNRELEASED
+
+Quoted posts are now shown.
+
 ## 2.84
 
 Implemented more scopes to match other ActivityPub implementations (public, unlisted, followers-only and direct message) (contributed by byte).
diff --git a/activitypub.c b/activitypub.c
index 0368ac8..bb6f460 100644
--- a/activitypub.c
+++ b/activitypub.c
@@ -2686,6 +2686,19 @@ int process_input_message(snac *snac, const xs_dict *msg, const xs_dict *req)
 
                 timeline_request(snac, &in_reply_to, &wrk, 0);
 
+                const char *quoted_id = xs_dict_get(object, "quoteUri");
+                if (xs_is_string(quoted_id) && xs_match(quoted_id, "https://*|http://*")) { /** **/
+                    xs *quoted_post = NULL;
+                    int status;
+
+                    if (valid_status(status = activitypub_request(snac, quoted_id, &quoted_post))) {
+                        /* got quoted post */
+                        object_add(quoted_id, quoted_post);
+                    }
+
+                    snac_debug(snac, 1, xs_fmt("retrieving quoted post %s %d", quoted_id, status));
+                }
+
                 if (timeline_add(snac, id, object)) {
                     snac_log(snac, xs_fmt("new '%s' %s %s", utype, actor, id));
                     do_notify = 1;
diff --git a/html.c b/html.c
index e482b53..bcafba4 100644
--- a/html.c
+++ b/html.c
@@ -2394,6 +2394,22 @@ xs_html *html_entry(snac *user, xs_dict *msg, int read_only,
         /* c contains sanitized HTML */
         xs_html_add(snac_content,
             xs_html_raw(c));
+
+        /* quoted post */
+        const char *quoted_id = xs_dict_get(msg, "quoteUri");
+        if (xs_is_string(quoted_id) && xs_match(quoted_id, "https://*|http://*")) { /** **/
+            xs *quoted_post = NULL;
+
+            if (valid_status(object_get(quoted_id, &quoted_post))) {
+                xs_html_add(snac_content,
+                    xs_html_tag("blockquote",
+                        xs_html_attr("class", "snac-quoted-post"),
+                        html_entry(user, quoted_post, 1, 1, NULL, 1)));
+            }
+            else
+            if (user)
+                enqueue_object_request(user, quoted_id, 0);
+        }
     }
 
     if (strcmp(type, "Question") == 0) { /** question content **/
@@ -3221,7 +3237,7 @@ xs_str *html_timeline(snac *user, const xs_list *list, int read_only,
             continue;
         }
         /* hide non-public posts viewed from outside */
-        if (read_only && scope != SCOPE_PUBLIC){
+        if (read_only && (scope != SCOPE_PUBLIC && scope != SCOPE_UNLISTED)) {
             continue;
         }
 
diff --git a/po/de_DE.po b/po/de_DE.po
index 147f7ac..bb6876c 100644
--- a/po/de_DE.po
+++ b/po/de_DE.po
@@ -782,20 +782,20 @@ msgstr "en fr es de_DE"
 
 #: html.c:460
 msgid "Visibility: "
-msgstr ""
+msgstr "Sichtbarkeit"
 
 #: html.c:468
 msgid "Public"
-msgstr ""
+msgstr "Öffentlich"
 
 #: html.c:477
 msgid "Unlisted"
-msgstr ""
+msgstr "Ungelistete"
 
 #: html.c:486
 msgid "Followers-only"
-msgstr ""
+msgstr "Nur Follower"
 
 #: html.c:495
 msgid "Direct Message"
-msgstr ""
+msgstr "Direktnachricht"
diff --git a/snac.h b/snac.h
index 4c3100a..91dfa27 100644
--- a/snac.h
+++ b/snac.h
@@ -1,7 +1,7 @@
 /* snac - A simple, minimalistic ActivityPub instance */
 /* copyright (c) 2022 - 2025 grunfink et al. / MIT license */
 
-#define VERSION "2.84"
+#define VERSION "2.85-dev"
 
 #define USER_AGENT "snac/" VERSION
 
diff --git a/webfinger.c b/webfinger.c
index 12ec42c..1ce5e76 100644
--- a/webfinger.c
+++ b/webfinger.c
@@ -76,9 +76,9 @@ int webfinger_request_signed(snac *snac, const char *qs, xs_str **actor, xs_str
         xs *url = xs_fmt("%s:/" "/%s/.well-known/webfinger?resource=%s", proto, host, resource);
 
         if (snac == NULL)
-            xs_http_request("GET", url, headers, NULL, 0, &status, &payload, &p_size, 0);
+            xs_free(xs_http_request("GET", url, headers, NULL, 0, &status, &payload, &p_size, 0));
         else
-            http_signed_request(snac, "GET", url, headers, NULL, 0, &status, &payload, &p_size, 0);
+            xs_free(http_signed_request(snac, "GET", url, headers, NULL, 0, &status, &payload, &p_size, 0));
     }
 
     if (obj == NULL && valid_status(status) && payload) {