6 files changed, 55 insertions, 11 deletions

diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
index 7dfb332..3ff6fd9 100644
--- a/RELEASE_NOTES.md
+++ b/RELEASE_NOTES.md
@@ -1,5 +1,11 @@
 # Release Notes
 
+## UNRELEASED
+
+Quoted posts are now shown.
+
+Fixed memory leak (contributed by dandelions).
+
 ## 2.84
 
 Implemented more scopes to match other ActivityPub implementations (public, unlisted, followers-only and direct message) (contributed by byte).
diff --git a/activitypub.c b/activitypub.c
index 0368ac8..2c0fa2e 100644
--- a/activitypub.c
+++ b/activitypub.c
@@ -2686,6 +2686,20 @@ int process_input_message(snac *snac, const xs_dict *msg, const xs_dict *req)
 
                 timeline_request(snac, &in_reply_to, &wrk, 0);
 
+                const char *quoted_id = xs_or(xs_dict_get(object, "quoteUri"), xs_dict_get(object, "quoteUrl"));
+
+                if (xs_is_string(quoted_id) && xs_match(quoted_id, "https://*|http://*")) { /** **/
+                    xs *quoted_post = NULL;
+                    int status;
+
+                    if (valid_status(status = activitypub_request(snac, quoted_id, &quoted_post))) {
+                        /* got quoted post */
+                        object_add(quoted_id, quoted_post);
+                    }
+
+                    snac_debug(snac, 1, xs_fmt("retrieving quoted post %s %d", quoted_id, status));
+                }
+
                 if (timeline_add(snac, id, object)) {
                     snac_log(snac, xs_fmt("new '%s' %s %s", utype, actor, id));
                     do_notify = 1;
@@ -2792,6 +2806,9 @@ int process_input_message(snac *snac, const xs_dict *msg, const xs_dict *req)
             if (valid_status(object_get(object, &a_msg))) {
                 const char *who = get_atto(a_msg);
 
+                /* got the admired object: instance is [back] online */
+                instance_failure(object, 2);
+
                 if (who && !is_muted(snac, who)) {
                     /* bring the actor */
                     xs *who_o = NULL;
diff --git a/html.c b/html.c
index 454c8be..18038ff 100644
--- a/html.c
+++ b/html.c
@@ -1695,7 +1695,7 @@ xs_html *html_top_controls(snac *user)
                     xs_html_text(L("Languages you usually post in:")),
                     xs_html_sctag("br", NULL),
                     xs_html_sctag("input",
-                        xs_html_attr("type", "next"),
+                        xs_html_attr("type", "text"),
                         xs_html_attr("name", "post_langs"),
                         xs_html_attr("value", post_langs),
                         xs_html_attr("placeholder", L("en fr es de_AT")))),
@@ -2394,6 +2394,23 @@ xs_html *html_entry(snac *user, xs_dict *msg, int read_only,
         /* c contains sanitized HTML */
         xs_html_add(snac_content,
             xs_html_raw(c));
+
+        /* quoted post */
+        const char *quoted_id = xs_or(xs_dict_get(msg, "quoteUri"), xs_dict_get(msg, "quoteUrl"));
+
+        if (xs_is_string(quoted_id) && xs_match(quoted_id, "https://*|http://*")) { /** **/
+            xs *quoted_post = NULL;
+
+            if (valid_status(object_get(quoted_id, &quoted_post))) {
+                xs_html_add(snac_content,
+                    xs_html_tag("blockquote",
+                        xs_html_attr("class", "snac-quoted-post"),
+                        html_entry(user, quoted_post, 1, 1, NULL, 1)));
+            }
+            else
+            if (user)
+                enqueue_object_request(user, quoted_id, 0);
+        }
     }
 
     if (strcmp(type, "Question") == 0) { /** question content **/
@@ -3221,7 +3238,7 @@ xs_str *html_timeline(snac *user, const xs_list *list, int read_only,
             continue;
         }
         /* hide non-public posts viewed from outside */
-        if (read_only && scope != SCOPE_PUBLIC){
+        if (read_only && (scope != SCOPE_PUBLIC && scope != SCOPE_UNLISTED)) {
             continue;
         }
 
@@ -3650,9 +3667,13 @@ xs_str *html_notifications(snac *user, int skip, int show)
 
         if (valid_status(actor_get(actor_id, &actor)))
             a_name = actor_name(actor, proxy);
-        else
+        else {
             a_name = xs_dup(actor_id);
 
+            /* actor not here: request it */
+            enqueue_actor_refresh(user, actor_id, 0);
+        }
+
         xs *label_sanitized = sanitize(type);
         const char *label = label_sanitized;
 
diff --git a/po/de_DE.po b/po/de_DE.po
index 147f7ac..bb6876c 100644
--- a/po/de_DE.po
+++ b/po/de_DE.po
@@ -782,20 +782,20 @@ msgstr "en fr es de_DE"
 
 #: html.c:460
 msgid "Visibility: "
-msgstr ""
+msgstr "Sichtbarkeit"
 
 #: html.c:468
 msgid "Public"
-msgstr ""
+msgstr "Öffentlich"
 
 #: html.c:477
 msgid "Unlisted"
-msgstr ""
+msgstr "Ungelistete"
 
 #: html.c:486
 msgid "Followers-only"
-msgstr ""
+msgstr "Nur Follower"
 
 #: html.c:495
 msgid "Direct Message"
-msgstr ""
+msgstr "Direktnachricht"
diff --git a/snac.h b/snac.h
index 4c3100a..91dfa27 100644
--- a/snac.h
+++ b/snac.h
@@ -1,7 +1,7 @@
 /* snac - A simple, minimalistic ActivityPub instance */
 /* copyright (c) 2022 - 2025 grunfink et al. / MIT license */
 
-#define VERSION "2.84"
+#define VERSION "2.85-dev"
 
 #define USER_AGENT "snac/" VERSION
 
diff --git a/webfinger.c b/webfinger.c
index 12ec42c..1ce5e76 100644
--- a/webfinger.c
+++ b/webfinger.c
@@ -76,9 +76,9 @@ int webfinger_request_signed(snac *snac, const char *qs, xs_str **actor, xs_str
         xs *url = xs_fmt("%s:/" "/%s/.well-known/webfinger?resource=%s", proto, host, resource);
 
         if (snac == NULL)
-            xs_http_request("GET", url, headers, NULL, 0, &status, &payload, &p_size, 0);
+            xs_free(xs_http_request("GET", url, headers, NULL, 0, &status, &payload, &p_size, 0));
         else
-            http_signed_request(snac, "GET", url, headers, NULL, 0, &status, &payload, &p_size, 0);
+            xs_free(http_signed_request(snac, "GET", url, headers, NULL, 0, &status, &payload, &p_size, 0));
     }
 
     if (obj == NULL && valid_status(status) && payload) {