18 files changed, 145 insertions, 31 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d42d6a75..5eeb521a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,6 +20,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
     - archives contain a `Shaarli` directory, itself containing sources + dependencies
     - the tarball is now gzipped
 - Minor code cleanup: PHPDoc, spelling, unused variables, etc.
+- Docker: explicitly set the maximum file upload size to 10 MiB
 
 ### Fixed
 - Fix the server `<self>` value in Atom/RSS feeds
@@ -27,6 +28,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
     - Tools: only display parameter description when it exists
     - archive.org: do not propose archival of private notes
 - Use absolute URL for hashtags in RSS and ATOM feeds
+- Docker: specify the location of the favicon
 
 ### Security
 - Allow whitelisting trusted IPs, else continue banning clients upon login failure
diff --git a/application/.htaccess b/application/.htaccess
index b584d98c..f601c1ee 100644
--- a/application/.htaccess
+++ b/application/.htaccess
@@ -1,2 +1,13 @@
-Allow from none
-Deny from all
+<IfModule version_module>
+  <IfVersion >= 2.4>
+     Require all denied
+  </IfVersion>
+  <IfVersion < 2.4>
+     Allow from none
+     Deny from all
+  </IfVersion>
+</IfModule>
+
+<IfModule !version_module>
+    Require all denied
+</IfModule>
diff --git a/cache/.htaccess b/cache/.htaccess
index b584d98c..f601c1ee 100644
--- a/cache/.htaccess
+++ b/cache/.htaccess
@@ -1,2 +1,13 @@
-Allow from none
-Deny from all
+<IfModule version_module>
+  <IfVersion >= 2.4>
+     Require all denied
+  </IfVersion>
+  <IfVersion < 2.4>
+     Allow from none
+     Deny from all
+  </IfVersion>
+</IfModule>
+
+<IfModule !version_module>
+    Require all denied
+</IfModule>
diff --git a/data/.htaccess b/data/.htaccess
index b584d98c..f601c1ee 100644
--- a/data/.htaccess
+++ b/data/.htaccess
@@ -1,2 +1,13 @@
-Allow from none
-Deny from all
+<IfModule version_module>
+  <IfVersion >= 2.4>
+     Require all denied
+  </IfVersion>
+  <IfVersion < 2.4>
+     Allow from none
+     Deny from all
+  </IfVersion>
+</IfModule>
+
+<IfModule !version_module>
+    Require all denied
+</IfModule>
diff --git a/docker/.htaccess b/docker/.htaccess
index b584d98c..f601c1ee 100644
--- a/docker/.htaccess
+++ b/docker/.htaccess
@@ -1,2 +1,13 @@
-Allow from none
-Deny from all
+<IfModule version_module>
+  <IfVersion >= 2.4>
+     Require all denied
+  </IfVersion>
+  <IfVersion < 2.4>
+     Allow from none
+     Deny from all
+  </IfVersion>
+</IfModule>
+
+<IfModule !version_module>
+    Require all denied
+</IfModule>
diff --git a/docker/development/Dockerfile b/docker/development/Dockerfile
index 0c19b085..d9ef8da7 100644
--- a/docker/development/Dockerfile
+++ b/docker/development/Dockerfile
@@ -15,6 +15,8 @@ RUN apt-get update \
        nano \
     && apt-get clean
 
+RUN sed -i 's/post_max_size.*/post_max_size = 10M/' /etc/php5/fpm/php.ini
+RUN sed -i 's/upload_max_filesize.*/upload_max_filesize = 10M/' /etc/php5/fpm/php.ini
 COPY nginx.conf /etc/nginx/nginx.conf
 COPY supervised.conf /etc/supervisor/conf.d/supervised.conf
 
diff --git a/docker/development/nginx.conf b/docker/development/nginx.conf
index cda09b56..ac0c6c61 100644
--- a/docker/development/nginx.conf
+++ b/docker/development/nginx.conf
@@ -11,6 +11,8 @@ http {
     default_type       application/octet-stream;
     keepalive_timeout  20;
 
+    client_max_body_size 10m;
+
     index index.html index.php;
 
     server {
@@ -49,6 +51,11 @@ http {
             add_header Cache-Control "public, must-revalidate, proxy-revalidate";
         }
 
+        location = /favicon.ico {
+            # serve the Shaarli favicon from its custom location
+            alias /var/www/shaarli/images/favicon.ico;
+        }
+
         location ~ (index)\.php$ {
             # filter and proxy PHP requests to PHP-FPM
             fastcgi_pass   unix:/var/run/php5-fpm.sock;
diff --git a/docker/production/Dockerfile b/docker/production/Dockerfile
index d93ed262..d0509115 100644
--- a/docker/production/Dockerfile
+++ b/docker/production/Dockerfile
@@ -14,6 +14,8 @@ RUN apt-get update \
        supervisor \
     && apt-get clean
 
+RUN sed -i 's/post_max_size.*/post_max_size = 10M/' /etc/php5/fpm/php.ini
+RUN sed -i 's/upload_max_filesize.*/upload_max_filesize = 10M/' /etc/php5/fpm/php.ini
 COPY nginx.conf /etc/nginx/nginx.conf
 COPY supervised.conf /etc/supervisor/conf.d/supervised.conf
 
diff --git a/docker/production/nginx.conf b/docker/production/nginx.conf
index e23c4587..5ffa02d0 100644
--- a/docker/production/nginx.conf
+++ b/docker/production/nginx.conf
@@ -11,6 +11,8 @@ http {
     default_type       application/octet-stream;
     keepalive_timeout  20;
 
+    client_max_body_size 10m;
+
     index index.html index.php;
 
     server {
@@ -41,6 +43,11 @@ http {
             add_header Cache-Control "public, must-revalidate, proxy-revalidate";
         }
 
+        location = /favicon.ico {
+            # serve the Shaarli favicon from its custom location
+            alias /var/www/shaarli/images/favicon.ico;
+        }
+
         location ~ (index)\.php$ {
             # filter and proxy PHP requests to PHP-FPM
             fastcgi_pass   unix:/var/run/php5-fpm.sock;
diff --git a/docker/production/stable/Dockerfile b/docker/production/stable/Dockerfile
index a509fda6..fc9588b0 100644
--- a/docker/production/stable/Dockerfile
+++ b/docker/production/stable/Dockerfile
@@ -14,6 +14,8 @@ RUN apt-get update \
        supervisor \
     && apt-get clean
 
+RUN sed -i 's/post_max_size.*/post_max_size = 10M/' /etc/php5/fpm/php.ini
+RUN sed -i 's/upload_max_filesize.*/upload_max_filesize = 10M/' /etc/php5/fpm/php.ini
 COPY nginx.conf /etc/nginx/nginx.conf
 COPY supervised.conf /etc/supervisor/conf.d/supervised.conf
 
diff --git a/docker/production/stable/nginx.conf b/docker/production/stable/nginx.conf
index e23c4587..5ffa02d0 100644
--- a/docker/production/stable/nginx.conf
+++ b/docker/production/stable/nginx.conf
@@ -11,6 +11,8 @@ http {
     default_type       application/octet-stream;
     keepalive_timeout  20;
 
+    client_max_body_size 10m;
+
     index index.html index.php;
 
     server {
@@ -41,6 +43,11 @@ http {
             add_header Cache-Control "public, must-revalidate, proxy-revalidate";
         }
 
+        location = /favicon.ico {
+            # serve the Shaarli favicon from its custom location
+            alias /var/www/shaarli/images/favicon.ico;
+        }
+
         location ~ (index)\.php$ {
             # filter and proxy PHP requests to PHP-FPM
             fastcgi_pass   unix:/var/run/php5-fpm.sock;
diff --git a/index.php b/index.php
index 84282b8d..5366cb0e 100644
--- a/index.php
+++ b/index.php
@@ -1078,6 +1078,7 @@ function renderPage($conf, $pluginManager)
     {
         $data = array(
             'pageabsaddr' => index_url($_SERVER),
+            'sslenabled' => !empty($_SERVER['HTTPS'])
         );
         $pluginManager->executeHooks('render_tools', $data);
 
diff --git a/pagecache/.htaccess b/pagecache/.htaccess
index b584d98c..f601c1ee 100644
--- a/pagecache/.htaccess
+++ b/pagecache/.htaccess
@@ -1,2 +1,13 @@
-Allow from none
-Deny from all
+<IfModule version_module>
+  <IfVersion >= 2.4>
+     Require all denied
+  </IfVersion>
+  <IfVersion < 2.4>
+     Allow from none
+     Deny from all
+  </IfVersion>
+</IfModule>
+
+<IfModule !version_module>
+    Require all denied
+</IfModule>
diff --git a/tests/.htaccess b/tests/.htaccess
index b584d98c..f601c1ee 100644
--- a/tests/.htaccess
+++ b/tests/.htaccess
@@ -1,2 +1,13 @@
-Allow from none
-Deny from all
+<IfModule version_module>
+  <IfVersion >= 2.4>
+     Require all denied
+  </IfVersion>
+  <IfVersion < 2.4>
+     Allow from none
+     Deny from all
+  </IfVersion>
+</IfModule>
+
+<IfModule !version_module>
+    Require all denied
+</IfModule>
diff --git a/tmp/.htaccess b/tmp/.htaccess
index b584d98c..f601c1ee 100644
--- a/tmp/.htaccess
+++ b/tmp/.htaccess
@@ -1,2 +1,13 @@
-Allow from none
-Deny from all
+<IfModule version_module>
+  <IfVersion >= 2.4>
+     Require all denied
+  </IfVersion>
+  <IfVersion < 2.4>
+     Allow from none
+     Deny from all
+  </IfVersion>
+</IfModule>
+
+<IfModule !version_module>
+    Require all denied
+</IfModule>
diff --git a/tpl/editlink.html b/tpl/editlink.html
index 441b5302..9e7621db 100644
--- a/tpl/editlink.html
+++ b/tpl/editlink.html
@@ -8,13 +8,15 @@
 {elseif="$link.description==''"}onload="document.linkform.lf_description.focus();"
 {else}onload="document.linkform.lf_tags.focus();"{/if} >
 <div id="pageheader">
-        {if="$source !== 'firefoxsocialapi'"}
-        {include="page.header"}
-        {/if}
-        <div id="editlinkform">
-            <form method="post" name="linkform">
-                <input type="hidden" name="lf_linkdate" value="{$link.linkdate}">
-                <label for="lf_url"><i>URL</i></label><br><input type="text" name="lf_url" id="lf_url" value="{$link.url}" class="lf_input"><br>
+    {if="$source !== 'firefoxsocialapi'"}
+    {include="page.header"}
+    {else}
+    <div id="shaarli_title"><a href="{$titleLink}">{$shaarlititle}</a></div>
+    {/if}
+    <div id="editlinkform">
+        <form method="post" name="linkform">
+            <input type="hidden" name="lf_linkdate" value="{$link.linkdate}">
+            <label for="lf_url"><i>URL</i></label><br><input type="text" name="lf_url" id="lf_url" value="{$link.url}" class="lf_input"><br>
             <label for="lf_title"><i>Title</i></label><br><input type="text" name="lf_title" id="lf_title" value="{$link.title}" class="lf_input"><br>
             <label for="lf_description"><i>Description</i></label><br><textarea name="lf_description" id="lf_description" rows="4" cols="25">{$link.description}</textarea><br>
             <label for="lf_tags"><i>Tags</i></label><br>
@@ -25,20 +27,20 @@
                 {$value}
             {/loop}
 
-                {if="($link_is_new && $default_private_links) || $link.private == true"}
+            {if="($link_is_new && $default_private_links) || $link.private == true"}
             <input type="checkbox" checked="checked" name="lf_private" id="lf_private">
             &nbsp;<label for="lf_private"><i>Private</i></label><br>
             {else}
             <input type="checkbox"  name="lf_private" id="lf_private">
             &nbsp;<label for="lf_private"><i>Private</i></label><br>
             {/if}
-                <input type="submit" value="Save" name="save_edit" class="bigbutton">
-                <input type="submit" value="Cancel" name="cancel_edit" class="bigbutton">
-                {if="!$link_is_new"}<input type="submit" value="Delete" name="delete_link" class="bigbutton delete" onClick="return confirmDeleteLink();">{/if}
-                <input type="hidden" name="token" value="{$token}">
-                {if="$http_referer"}<input type="hidden" name="returnurl" value="{$http_referer}">{/if}
-            </form>
-        </div>
+            <input type="submit" value="Save" name="save_edit" class="bigbutton">
+            <input type="submit" value="Cancel" name="cancel_edit" class="bigbutton">
+            {if="!$link_is_new"}<input type="submit" value="Delete" name="delete_link" class="bigbutton delete" onClick="return confirmDeleteLink();">{/if}
+            <input type="hidden" name="token" value="{$token}">
+            {if="$http_referer"}<input type="hidden" name="returnurl" value="{$http_referer}">{/if}
+        </form>
+    </div>
 </div>
 {if="$source !== 'firefoxsocialapi'"}
 {include="page.footer"}
diff --git a/tpl/includes.html b/tpl/includes.html
index f94ce1be..7b2997ce 100644
--- a/tpl/includes.html
+++ b/tpl/includes.html
@@ -2,6 +2,7 @@
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
 <meta name="format-detection" content="telephone=no" />
 <meta name="viewport" content="width=device-width,initial-scale=1.0" />
+<meta name="referrer" content="same-origin">
 <link rel="alternate" type="application/rss+xml" href="{$feedurl}?do=rss{$searchcrits}#" title="RSS Feed" />
 <link rel="alternate" type="application/atom+xml" href="{$feedurl}?do=atom{$searchcrits}#" title="ATOM Feed" />
 <link href="images/favicon.ico#" rel="shortcut icon" type="image/x-icon" />
@@ -11,4 +12,4 @@
 {loop="$plugins_includes.css_files"}
 <link type="text/css" rel="stylesheet" href="{$value}#"/>
 {/loop}
-<link rel="search" type="application/opensearchdescription+xml" href="?do=opensearch#" title="Shaarli search - {$shaarlititle|htmlspecialchars}"/>
\ No newline at end of file
+<link rel="search" type="application/opensearchdescription+xml" href="?do=opensearch#" title="Shaarli search - {$shaarlititle|htmlspecialchars}"/>
diff --git a/tpl/tools.html b/tpl/tools.html
index 8e285f44..e06d239d 100644
--- a/tpl/tools.html
+++ b/tpl/tools.html
@@ -50,12 +50,15 @@
                                 &nbsp;&nbsp;&nbsp;&nbsp;Then click "✚Add Note" button anytime to start composing a private Note (text post) to your Shaarli.
                         </span>
                 </a><br><br>
+
+                {if="$sslenabled"}
                 <a class="smallbutton" onclick="activateFirefoxSocial(this)">
                         <b>✚Add to Firefox social</b>
                 </a>
                 <a href="#">
                         <span>&#x21D0; Click on this button to add Shaarli to the "Share this page" button in Firefox.</span>
                 </a><br><br>
+                {/if}
 
                 {loop="$tools_plugin"}
             {$value}
@@ -64,6 +67,7 @@
                 <div class="clear"></div>
 
                 <script>
+                        {if="$sslenabled"}
                         function activateFirefoxSocial(node) {
                                 var loc = location.href;
                                 var baseURL = loc.substring(0, loc.lastIndexOf("/"));
@@ -87,7 +91,7 @@
                                 var activate = new CustomEvent("ActivateSocialFeature");
                                 node.dispatchEvent(activate);
                         }
-
+                        {/if}
                         function alertBookmarklet() {
                                 alert('Drag this link to your bookmarks toolbar, or right-click it and choose Bookmark This Link...');
                                 return false;