29 files changed, 252 insertions, 59 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d42d6a75..ffda8a1b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,20 +13,33 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 - Plugins:
     - Add an [Isso](https://posativ.org/isso/) plugin to enable user comments on permalinks
     - Allow defining init functions, e.g. for performing checks and error processing
+    - Add a Piwik plugin for analytics.
+    - Markdown: add warning notice regarding HTML rendering
+- Meta tag to *not* send the referrer to external resources.
 
 ### Changed
 - Cleanup `{loop}` declarations in templates
 - Release archives now have the same structure as GitHub-generated archives:
     - archives contain a `Shaarli` directory, itself containing sources + dependencies
     - the tarball is now gzipped
+- Plugins:
+    - Markdown: Parsedown library is now imported through Composer
 - Minor code cleanup: PHPDoc, spelling, unused variables, etc.
+- Docker: explicitly set the maximum file upload size to 10 MiB
+- Tools: hide Firefox Social button when not in HTTPS
+- Firefox Social: show Shaarli's title when shaaring using Firefox Social 
 
 ### Fixed
 - Fix the server `<self>` value in Atom/RSS feeds
 - Plugins:
     - Tools: only display parameter description when it exists
     - archive.org: do not propose archival of private notes
+    - Markdown: 
+        - render links properly in code blocks
+        - bug regarding the `nomarkdown` tag
+    - W3C compliance
 - Use absolute URL for hashtags in RSS and ATOM feeds
+- Docker: specify the location of the favicon
 
 ### Security
 - Allow whitelisting trusted IPs, else continue banning clients upon login failure
diff --git a/application/.htaccess b/application/.htaccess
index b584d98c..f601c1ee 100644
--- a/application/.htaccess
+++ b/application/.htaccess
@@ -1,2 +1,13 @@
-Allow from none
-Deny from all
+<IfModule version_module>
+  <IfVersion >= 2.4>
+     Require all denied
+  </IfVersion>
+  <IfVersion < 2.4>
+     Allow from none
+     Deny from all
+  </IfVersion>
+</IfModule>
+
+<IfModule !version_module>
+    Require all denied
+</IfModule>
diff --git a/cache/.htaccess b/cache/.htaccess
index b584d98c..f601c1ee 100644
--- a/cache/.htaccess
+++ b/cache/.htaccess
@@ -1,2 +1,13 @@
-Allow from none
-Deny from all
+<IfModule version_module>
+  <IfVersion >= 2.4>
+     Require all denied
+  </IfVersion>
+  <IfVersion < 2.4>
+     Allow from none
+     Deny from all
+  </IfVersion>
+</IfModule>
+
+<IfModule !version_module>
+    Require all denied
+</IfModule>
diff --git a/data/.htaccess b/data/.htaccess
index b584d98c..f601c1ee 100644
--- a/data/.htaccess
+++ b/data/.htaccess
@@ -1,2 +1,13 @@
-Allow from none
-Deny from all
+<IfModule version_module>
+  <IfVersion >= 2.4>
+     Require all denied
+  </IfVersion>
+  <IfVersion < 2.4>
+     Allow from none
+     Deny from all
+  </IfVersion>
+</IfModule>
+
+<IfModule !version_module>
+    Require all denied
+</IfModule>
diff --git a/docker/.htaccess b/docker/.htaccess
index b584d98c..f601c1ee 100644
--- a/docker/.htaccess
+++ b/docker/.htaccess
@@ -1,2 +1,13 @@
-Allow from none
-Deny from all
+<IfModule version_module>
+  <IfVersion >= 2.4>
+     Require all denied
+  </IfVersion>
+  <IfVersion < 2.4>
+     Allow from none
+     Deny from all
+  </IfVersion>
+</IfModule>
+
+<IfModule !version_module>
+    Require all denied
+</IfModule>
diff --git a/docker/development/Dockerfile b/docker/development/Dockerfile
index 0c19b085..d9ef8da7 100644
--- a/docker/development/Dockerfile
+++ b/docker/development/Dockerfile
@@ -15,6 +15,8 @@ RUN apt-get update \
        nano \
     && apt-get clean
 
+RUN sed -i 's/post_max_size.*/post_max_size = 10M/' /etc/php5/fpm/php.ini
+RUN sed -i 's/upload_max_filesize.*/upload_max_filesize = 10M/' /etc/php5/fpm/php.ini
 COPY nginx.conf /etc/nginx/nginx.conf
 COPY supervised.conf /etc/supervisor/conf.d/supervised.conf
 
diff --git a/docker/development/nginx.conf b/docker/development/nginx.conf
index cda09b56..ac0c6c61 100644
--- a/docker/development/nginx.conf
+++ b/docker/development/nginx.conf
@@ -11,6 +11,8 @@ http {
     default_type       application/octet-stream;
     keepalive_timeout  20;
 
+    client_max_body_size 10m;
+
     index index.html index.php;
 
     server {
@@ -49,6 +51,11 @@ http {
             add_header Cache-Control "public, must-revalidate, proxy-revalidate";
         }
 
+        location = /favicon.ico {
+            # serve the Shaarli favicon from its custom location
+            alias /var/www/shaarli/images/favicon.ico;
+        }
+
         location ~ (index)\.php$ {
             # filter and proxy PHP requests to PHP-FPM
             fastcgi_pass   unix:/var/run/php5-fpm.sock;
diff --git a/docker/production/Dockerfile b/docker/production/Dockerfile
index d93ed262..d0509115 100644
--- a/docker/production/Dockerfile
+++ b/docker/production/Dockerfile
@@ -14,6 +14,8 @@ RUN apt-get update \
        supervisor \
     && apt-get clean
 
+RUN sed -i 's/post_max_size.*/post_max_size = 10M/' /etc/php5/fpm/php.ini
+RUN sed -i 's/upload_max_filesize.*/upload_max_filesize = 10M/' /etc/php5/fpm/php.ini
 COPY nginx.conf /etc/nginx/nginx.conf
 COPY supervised.conf /etc/supervisor/conf.d/supervised.conf
 
diff --git a/docker/production/nginx.conf b/docker/production/nginx.conf
index e23c4587..5ffa02d0 100644
--- a/docker/production/nginx.conf
+++ b/docker/production/nginx.conf
@@ -11,6 +11,8 @@ http {
     default_type       application/octet-stream;
     keepalive_timeout  20;
 
+    client_max_body_size 10m;
+
     index index.html index.php;
 
     server {
@@ -41,6 +43,11 @@ http {
             add_header Cache-Control "public, must-revalidate, proxy-revalidate";
         }
 
+        location = /favicon.ico {
+            # serve the Shaarli favicon from its custom location
+            alias /var/www/shaarli/images/favicon.ico;
+        }
+
         location ~ (index)\.php$ {
             # filter and proxy PHP requests to PHP-FPM
             fastcgi_pass   unix:/var/run/php5-fpm.sock;
diff --git a/docker/production/stable/Dockerfile b/docker/production/stable/Dockerfile
index a509fda6..fc9588b0 100644
--- a/docker/production/stable/Dockerfile
+++ b/docker/production/stable/Dockerfile
@@ -14,6 +14,8 @@ RUN apt-get update \
        supervisor \
     && apt-get clean
 
+RUN sed -i 's/post_max_size.*/post_max_size = 10M/' /etc/php5/fpm/php.ini
+RUN sed -i 's/upload_max_filesize.*/upload_max_filesize = 10M/' /etc/php5/fpm/php.ini
 COPY nginx.conf /etc/nginx/nginx.conf
 COPY supervised.conf /etc/supervisor/conf.d/supervised.conf
 
diff --git a/docker/production/stable/nginx.conf b/docker/production/stable/nginx.conf
index e23c4587..5ffa02d0 100644
--- a/docker/production/stable/nginx.conf
+++ b/docker/production/stable/nginx.conf
@@ -11,6 +11,8 @@ http {
     default_type       application/octet-stream;
     keepalive_timeout  20;
 
+    client_max_body_size 10m;
+
     index index.html index.php;
 
     server {
@@ -41,6 +43,11 @@ http {
             add_header Cache-Control "public, must-revalidate, proxy-revalidate";
         }
 
+        location = /favicon.ico {
+            # serve the Shaarli favicon from its custom location
+            alias /var/www/shaarli/images/favicon.ico;
+        }
+
         location ~ (index)\.php$ {
             # filter and proxy PHP requests to PHP-FPM
             fastcgi_pass   unix:/var/run/php5-fpm.sock;
diff --git a/inc/shaarli.css b/inc/shaarli.css
index 5808320c..a24d4b7c 100644
--- a/inc/shaarli.css
+++ b/inc/shaarli.css
@@ -37,6 +37,10 @@ em {
     font-style: italic;
 }
 
+strong {
+    font-weight: bold;
+}
+
 /* Buttons */
 .bigbutton {
     background-color: #c0c0c0;
@@ -1168,8 +1172,13 @@ ul.errors {
 }
 
 #pluginsadmin a {
+    color: #486D08;
+}
+
+#pluginsadmin a.arrow {
     color: black;
 }
+
 /* 404 page */
 .error-container {
 
diff --git a/index.php b/index.php
index 84282b8d..5366cb0e 100644
--- a/index.php
+++ b/index.php
@@ -1078,6 +1078,7 @@ function renderPage($conf, $pluginManager)
     {
         $data = array(
             'pageabsaddr' => index_url($_SERVER),
+            'sslenabled' => !empty($_SERVER['HTTPS'])
         );
         $pluginManager->executeHooks('render_tools', $data);
 
diff --git a/pagecache/.htaccess b/pagecache/.htaccess
index b584d98c..f601c1ee 100644
--- a/pagecache/.htaccess
+++ b/pagecache/.htaccess
@@ -1,2 +1,13 @@
-Allow from none
-Deny from all
+<IfModule version_module>
+  <IfVersion >= 2.4>
+     Require all denied
+  </IfVersion>
+  <IfVersion < 2.4>
+     Allow from none
+     Deny from all
+  </IfVersion>
+</IfModule>
+
+<IfModule !version_module>
+    Require all denied
+</IfModule>
diff --git a/plugins/archiveorg/archiveorg.html b/plugins/archiveorg/archiveorg.html
index 576bd46e..0781fe35 100644
--- a/plugins/archiveorg/archiveorg.html
+++ b/plugins/archiveorg/archiveorg.html
@@ -1 +1 @@
-<span><a href="https://web.archive.org/web/%s"><img class="linklist-plugin-icon" src="plugins/archiveorg/internetarchive.png" title="View on archive.org" /></a></span>
+<span><a href="https://web.archive.org/web/%s"><img class="linklist-plugin-icon" src="plugins/archiveorg/internetarchive.png" title="View on archive.org" alt="archive.org" /></a></span>
diff --git a/plugins/markdown/README.md b/plugins/markdown/README.md
index 4f021871..aafcf066 100644
--- a/plugins/markdown/README.md
+++ b/plugins/markdown/README.md
@@ -20,26 +20,52 @@ The directory structure should look like:
      |--- markdown.css
      |--- markdown.meta
      |--- markdown.php
-     |--- Parsedown.php
      |--- README.md
 ```
 
 To enable the plugin, just check it in the plugin administration page.
 
-You can also add `markdown` to your list of enabled plugins in `data/config.php`
-(`ENABLED_PLUGINS` array).
+You can also add `markdown` to your list of enabled plugins in `data/config.json.php`
+(`general.enabled_plugins` list).
 
 This should look like:
 
 ```
-$GLOBALS['config']['ENABLED_PLUGINS'] = array('qrcode', 'any_other_plugin', 'markdown')
+"general": {
+  "enabled_plugins": [
+    "markdown",
+    [...]
+  ],
+}
 ```
 
+Parsedown parsing library is imported using Composer. If you installed Shaarli using `git`,
+or the `master` branch, run
+
+    composer update --no-dev --prefer-dist
+
 ### No Markdown tag
 
-If the tag `.nomarkdown` is set for a shaare, it won't be converted to Markdown syntax.
+If the tag `nomarkdown` is set for a shaare, it won't be converted to Markdown syntax.
  
-> Note: it's a private tag (leading dot), so it won't be displayed to visitors.
+> Note: this is a special tag, so it won't be displayed in link list.
+
+### HTML rendering
+
+Markdown support HTML tags. For example:
+
+    > <strong>strong</strong><strike>strike</strike>
+   
+Will render as:
+
+> <strong>strong</strong><strike>strike</strike>
+
+If you want to shaare HTML code, it is necessary to use inline code or code blocks.
+  
+**If your shaared descriptions containing HTML tags before enabling the markdown plugin, 
+enabling it might break your page.**
+
+> Note: HTML tags such as script, iframe, etc. are disabled for security reasons.
 
 ### Known issue
 
diff --git a/plugins/markdown/markdown.meta b/plugins/markdown/markdown.meta
index e3904ed8..8df2ed0b 100644
--- a/plugins/markdown/markdown.meta
+++ b/plugins/markdown/markdown.meta
@@ -1 +1,4 @@
-description="Render shaare description with Markdown syntax."
+description="Render shaare description with Markdown syntax.<br><strong>Warning</strong>:
+If your shaared descriptions containing HTML tags before enabling the markdown plugin,
+enabling it might break your page.
+See the <a href=\"https://github.com/shaarli/Shaarli/tree/master/plugins/markdown#html-rendering\">README</a>."
diff --git a/plugins/markdown/markdown.php b/plugins/markdown/markdown.php
index a764b6fa..0cf6e6e2 100644
--- a/plugins/markdown/markdown.php
+++ b/plugins/markdown/markdown.php
@@ -22,7 +22,7 @@ function hook_markdown_render_linklist($data)
 {
     foreach ($data['links'] as &$value) {
         if (!empty($value['tags']) && noMarkdownTag($value['tags'])) {
-            $value['taglist'] = stripNoMarkdownTag($value['taglist']);
+            $value = stripNoMarkdownTag($value);
             continue;
         }
         $value['description'] = process_markdown($value['description']);
@@ -41,7 +41,7 @@ function hook_markdown_render_feed($data)
 {
     foreach ($data['links'] as &$value) {
         if (!empty($value['tags']) && noMarkdownTag($value['tags'])) {
-            $value['tags'] = stripNoMarkdownTag($value['tags']);
+            $value = stripNoMarkdownTag($value);
             continue;
         }
         $value['description'] = process_markdown($value['description']);
@@ -63,6 +63,7 @@ function hook_markdown_render_daily($data)
     foreach ($data['cols'] as &$value) {
         foreach ($value as &$value2) {
             if (!empty($value2['tags']) && noMarkdownTag($value2['tags'])) {
+                $value2 = stripNoMarkdownTag($value2);
                 continue;
             }
             $value2['formatedDescription'] = process_markdown($value2['formatedDescription']);
@@ -81,20 +82,30 @@ function hook_markdown_render_daily($data)
  */
 function noMarkdownTag($tags)
 {
-    return strpos($tags, NO_MD_TAG) !== false;
+    return preg_match('/(^|\s)'. NO_MD_TAG .'(\s|$)/', $tags);
 }
 
 /**
  * Remove the no-markdown meta tag so it won't be displayed.
  *
- * @param string $tags Tag list.
+ * @param array $link Link data.
  *
- * @return string tag list without no markdown tag.
+ * @return array Updated link without no markdown tag.
  */
-function stripNoMarkdownTag($tags)
+function stripNoMarkdownTag($link)
 {
-    unset($tags[array_search(NO_MD_TAG, $tags)]);
-    return array_values($tags);
+    if (! empty($link['taglist'])) {
+        $offset = array_search(NO_MD_TAG, $link['taglist']);
+        if ($offset !== false) {
+            unset($link['taglist'][$offset]);
+        }
+    }
+
+    if (!empty($link['tags'])) {
+        str_replace(NO_MD_TAG, '', $link['tags']);
+    }
+
+    return $link;
 }
 
 /**
diff --git a/plugins/qrcode/qrcode.html b/plugins/qrcode/qrcode.html
index cebc5644..dc214ed1 100644
--- a/plugins/qrcode/qrcode.html
+++ b/plugins/qrcode/qrcode.html
@@ -1,5 +1,5 @@
 <div class="linkqrcode">
     <a href="http://qrfree.kaywa.com/?l=1&amp;s=8&amp;d=%s" onclick="showQrCode(this); return false;" class="qrcode" data-permalink="%s">
-        <img src="%s/qrcode/qrcode.png" class="linklist-plugin-icon" title="QR-Code">
+        <img src="%s/qrcode/qrcode.png" class="linklist-plugin-icon" title="QR-Code" alt="QRCode">
     </a>
 </div>
diff --git a/plugins/readityourself/readityourself.html b/plugins/readityourself/readityourself.html
index e8c5f784..5e200715 100644
--- a/plugins/readityourself/readityourself.html
+++ b/plugins/readityourself/readityourself.html
@@ -1 +1 @@
-<span><a href="%s?url=%s"><img class="linklist-plugin-icon" src="%s/readityourself/book-open.png" title="Read with Readityourself" /></a></span>
+<span><a href="%s?url=%s"><img class="linklist-plugin-icon" src="%s/readityourself/book-open.png" title="Read with Readityourself" alt="readityourself" /></a></span>
diff --git a/plugins/wallabag/wallabag.html b/plugins/wallabag/wallabag.html
index c7b1d044..e861536d 100644
--- a/plugins/wallabag/wallabag.html
+++ b/plugins/wallabag/wallabag.html
@@ -1 +1 @@
-<span><a href="%s%s" target="_blank"><img class="linklist-plugin-icon" src="%s/wallabag/wallabag.png" title="Save to wallabag" /></a></span>
+<span><a href="%s%s" target="_blank"><img class="linklist-plugin-icon" src="%s/wallabag/wallabag.png" title="Save to wallabag" alt="wallabag" /></a></span>
diff --git a/tests/.htaccess b/tests/.htaccess
index b584d98c..f601c1ee 100644
--- a/tests/.htaccess
+++ b/tests/.htaccess
@@ -1,2 +1,13 @@
-Allow from none
-Deny from all
+<IfModule version_module>
+  <IfVersion >= 2.4>
+     Require all denied
+  </IfVersion>
+  <IfVersion < 2.4>
+     Allow from none
+     Deny from all
+  </IfVersion>
+</IfModule>
+
+<IfModule !version_module>
+    Require all denied
+</IfModule>
diff --git a/tests/plugins/PluginMarkdownTest.php b/tests/plugins/PluginMarkdownTest.php
index 12bdda24..17ef2280 100644
--- a/tests/plugins/PluginMarkdownTest.php
+++ b/tests/plugins/PluginMarkdownTest.php
@@ -8,8 +8,8 @@ require_once 'application/Utils.php';
 require_once 'plugins/markdown/markdown.php';
 
 /**
- * Class PlugQrcodeTest
- * Unit test for the QR-Code plugin
+ * Class PluginMarkdownTest
+ * Unit test for the Markdown plugin
  */
 class PluginMarkdownTest extends PHPUnit_Framework_TestCase
 {
@@ -130,8 +130,11 @@ class PluginMarkdownTest extends PHPUnit_Framework_TestCase
             ))
         );
 
-        $data = hook_markdown_render_linklist($data);
-        $this->assertEquals($str, $data['links'][0]['description']);
+        $processed = hook_markdown_render_linklist($data);
+        $this->assertEquals($str, $processed['links'][0]['description']);
+
+        $processed = hook_markdown_render_feed($data);
+        $this->assertEquals($str, $processed['links'][0]['description']);
 
         $data = array(
             // Columns data
@@ -153,6 +156,24 @@ class PluginMarkdownTest extends PHPUnit_Framework_TestCase
     }
 
     /**
+     * Test that a close value to nomarkdown is not understand as nomarkdown (previous value `.nomarkdown`).
+     */
+    function testNoMarkdownNotExcactlyMatching()
+    {
+        $str = 'All _work_ and `no play` makes Jack a *dull* boy.';
+        $data = array(
+            'links' => array(array(
+                'description' => $str,
+                'tags' => '.' . NO_MD_TAG,
+                'taglist' => array('.'. NO_MD_TAG),
+            ))
+        );
+
+        $data = hook_markdown_render_feed($data);
+        $this->assertContains('<em>', $data['links'][0]['description']);
+    }
+
+    /**
      * Test hashtag links processed with markdown.
      */
     function testMarkdownHashtagLinks()
diff --git a/tmp/.htaccess b/tmp/.htaccess
index b584d98c..f601c1ee 100644
--- a/tmp/.htaccess
+++ b/tmp/.htaccess
@@ -1,2 +1,13 @@
-Allow from none
-Deny from all
+<IfModule version_module>
+  <IfVersion >= 2.4>
+     Require all denied
+  </IfVersion>
+  <IfVersion < 2.4>
+     Allow from none
+     Deny from all
+  </IfVersion>
+</IfModule>
+
+<IfModule !version_module>
+    Require all denied
+</IfModule>
diff --git a/tpl/editlink.html b/tpl/editlink.html
index 441b5302..9e7621db 100644
--- a/tpl/editlink.html
+++ b/tpl/editlink.html
@@ -8,13 +8,15 @@
 {elseif="$link.description==''"}onload="document.linkform.lf_description.focus();"
 {else}onload="document.linkform.lf_tags.focus();"{/if} >
 <div id="pageheader">
-        {if="$source !== 'firefoxsocialapi'"}
-        {include="page.header"}
-        {/if}
-        <div id="editlinkform">
-            <form method="post" name="linkform">
-                <input type="hidden" name="lf_linkdate" value="{$link.linkdate}">
-                <label for="lf_url"><i>URL</i></label><br><input type="text" name="lf_url" id="lf_url" value="{$link.url}" class="lf_input"><br>
+    {if="$source !== 'firefoxsocialapi'"}
+    {include="page.header"}
+    {else}
+    <div id="shaarli_title"><a href="{$titleLink}">{$shaarlititle}</a></div>
+    {/if}
+    <div id="editlinkform">
+        <form method="post" name="linkform">
+            <input type="hidden" name="lf_linkdate" value="{$link.linkdate}">
+            <label for="lf_url"><i>URL</i></label><br><input type="text" name="lf_url" id="lf_url" value="{$link.url}" class="lf_input"><br>
             <label for="lf_title"><i>Title</i></label><br><input type="text" name="lf_title" id="lf_title" value="{$link.title}" class="lf_input"><br>
             <label for="lf_description"><i>Description</i></label><br><textarea name="lf_description" id="lf_description" rows="4" cols="25">{$link.description}</textarea><br>
             <label for="lf_tags"><i>Tags</i></label><br>
@@ -25,20 +27,20 @@
                 {$value}
             {/loop}
 
-                {if="($link_is_new && $default_private_links) || $link.private == true"}
+            {if="($link_is_new && $default_private_links) || $link.private == true"}
             <input type="checkbox" checked="checked" name="lf_private" id="lf_private">
             &nbsp;<label for="lf_private"><i>Private</i></label><br>
             {else}
             <input type="checkbox"  name="lf_private" id="lf_private">
             &nbsp;<label for="lf_private"><i>Private</i></label><br>
             {/if}
-                <input type="submit" value="Save" name="save_edit" class="bigbutton">
-                <input type="submit" value="Cancel" name="cancel_edit" class="bigbutton">
-                {if="!$link_is_new"}<input type="submit" value="Delete" name="delete_link" class="bigbutton delete" onClick="return confirmDeleteLink();">{/if}
-                <input type="hidden" name="token" value="{$token}">
-                {if="$http_referer"}<input type="hidden" name="returnurl" value="{$http_referer}">{/if}
-            </form>
-        </div>
+            <input type="submit" value="Save" name="save_edit" class="bigbutton">
+            <input type="submit" value="Cancel" name="cancel_edit" class="bigbutton">
+            {if="!$link_is_new"}<input type="submit" value="Delete" name="delete_link" class="bigbutton delete" onClick="return confirmDeleteLink();">{/if}
+            <input type="hidden" name="token" value="{$token}">
+            {if="$http_referer"}<input type="hidden" name="returnurl" value="{$http_referer}">{/if}
+        </form>
+    </div>
 </div>
 {if="$source !== 'firefoxsocialapi'"}
 {include="page.footer"}
diff --git a/tpl/feed.atom.html b/tpl/feed.atom.html
index 40fd421a..aead0459 100644
--- a/tpl/feed.atom.html
+++ b/tpl/feed.atom.html
@@ -30,9 +30,7 @@
         <published>{$value.pub_iso_date}</published>
         <updated>{$value.up_iso_date}</updated>
       {/if}
-      <content type="html" xml:lang="{$language}">
-        <![CDATA[{$value.description}]]>
-      </content>
+      <content type="html" xml:lang="{$language}"><![CDATA[{$value.description}]]></content>
       {loop="$value.taglist"}
         <category scheme="{$index_url}?searchtags=" term="{$value|strtolower}" label="{$value}" />
       {/loop}
diff --git a/tpl/includes.html b/tpl/includes.html
index f94ce1be..7b2997ce 100644
--- a/tpl/includes.html
+++ b/tpl/includes.html
@@ -2,6 +2,7 @@
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
 <meta name="format-detection" content="telephone=no" />
 <meta name="viewport" content="width=device-width,initial-scale=1.0" />
+<meta name="referrer" content="same-origin">
 <link rel="alternate" type="application/rss+xml" href="{$feedurl}?do=rss{$searchcrits}#" title="RSS Feed" />
 <link rel="alternate" type="application/atom+xml" href="{$feedurl}?do=atom{$searchcrits}#" title="ATOM Feed" />
 <link href="images/favicon.ico#" rel="shortcut icon" type="image/x-icon" />
@@ -11,4 +12,4 @@
 {loop="$plugins_includes.css_files"}
 <link type="text/css" rel="stylesheet" href="{$value}#"/>
 {/loop}
-<link rel="search" type="application/opensearchdescription+xml" href="?do=opensearch#" title="Shaarli search - {$shaarlititle|htmlspecialchars}"/>
\ No newline at end of file
+<link rel="search" type="application/opensearchdescription+xml" href="?do=opensearch#" title="Shaarli search - {$shaarlititle|htmlspecialchars}"/>
diff --git a/tpl/pluginsadmin.html b/tpl/pluginsadmin.html
index 672f4993..ead1734e 100644
--- a/tpl/pluginsadmin.html
+++ b/tpl/pluginsadmin.html
@@ -38,11 +38,11 @@
               <tr data-line="{$key}" data-order="{$counter}">
                 <td class="center"><input type="checkbox" name="{$key}" id="{$key}" checked="checked"></td>
                 <td class="center">
-                  <a href="#"
+                  <a href="#" class="arrow"
                      onclick="return orderUp(this.parentNode.parentNode.getAttribute('data-order'));">
                     ▲
                   </a>
-                  <a href="#"
+                  <a href="#" class="arrow"
                      onclick="return orderDown(this.parentNode.parentNode.getAttribute('data-order'));">
                     ▼
                   </a>
diff --git a/tpl/tools.html b/tpl/tools.html
index 8e285f44..e06d239d 100644
--- a/tpl/tools.html
+++ b/tpl/tools.html
@@ -50,12 +50,15 @@
                                 &nbsp;&nbsp;&nbsp;&nbsp;Then click "✚Add Note" button anytime to start composing a private Note (text post) to your Shaarli.
                         </span>
                 </a><br><br>
+
+                {if="$sslenabled"}
                 <a class="smallbutton" onclick="activateFirefoxSocial(this)">
                         <b>✚Add to Firefox social</b>
                 </a>
                 <a href="#">
                         <span>&#x21D0; Click on this button to add Shaarli to the "Share this page" button in Firefox.</span>
                 </a><br><br>
+                {/if}
 
                 {loop="$tools_plugin"}
             {$value}
@@ -64,6 +67,7 @@
                 <div class="clear"></div>
 
                 <script>
+                        {if="$sslenabled"}
                         function activateFirefoxSocial(node) {
                                 var loc = location.href;
                                 var baseURL = loc.substring(0, loc.lastIndexOf("/"));
@@ -87,7 +91,7 @@
                                 var activate = new CustomEvent("ActivateSocialFeature");
                                 node.dispatchEvent(activate);
                         }
-
+                        {/if}
                         function alertBookmarklet() {
                                 alert('Drag this link to your bookmarks toolbar, or right-click it and choose Bookmark This Link...');
                                 return false;