30 files changed, 1083 insertions, 174 deletions
diff --git a/.gitattributes b/.gitattributes
index aaf6a39e..d753b1db 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -21,7 +21,6 @@ Dockerfile      text
 .gitattributes  export-ignore
 .gitignore      export-ignore
 .travis.yml     export-ignore
-composer.json   export-ignore
 doc/**/*.json   export-ignore
 doc/**/*.md     export-ignore
 docker/         export-ignore
diff --git a/application/HttpUtils.php b/application/HttpUtils.php
index 2e0792f9..27a39d3d 100644
--- a/application/HttpUtils.php
+++ b/application/HttpUtils.php
@@ -1,6 +1,7 @@
 <?php
 /**
 * GET an HTTP URL to retrieve its content
+ * Uses the cURL library or a fallback method 
 *
 * @param string $url      URL to get (http://...)
 * @param int    $timeout  network timeout (in seconds)
@@ -20,38 +21,177 @@
 *      echo 'There was an error: '.htmlspecialchars($headers[0]);
 *  }
 *
- * @see http://php.net/manual/en/function.file-get-contents.php
+ * @see https://secure.php.net/manual/en/ref.curl.php
- * @see http://php.net/manual/en/function.stream-context-create.php
+ * @see https://secure.php.net/manual/en/functions.anonymous.php
- * @see http://php.net/manual/en/function.get-headers.php
+ * @see https://secure.php.net/manual/en/function.preg-split.php
+ * @see https://secure.php.net/manual/en/function.explode.php
+ * @see http://stackoverflow.com/q/17641073
+ * @see http://stackoverflow.com/q/9183178
+ * @see http://stackoverflow.com/q/1462720
 */
 function get_http_response($url, $timeout = 30, $maxBytes = 4194304)
 {
    $urlObj = new Url($url);
    $cleanUrl = $urlObj->idnToAscii();
-    if (! filter_var($cleanUrl, FILTER_VALIDATE_URL) || ! $urlObj->isHttp()) {
+    if (!filter_var($cleanUrl, FILTER_VALIDATE_URL) || !$urlObj->isHttp()) {
        return array(array(0 => 'Invalid HTTP Url'), false);
    }
+    $userAgent =
+        'Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:45.0)'
+        . ' Gecko/20100101 Firefox/45.0';
+    $acceptLanguage =
+        substr(setlocale(LC_COLLATE, 0), 0, 2) . ',en-US;q=0.7,en;q=0.3';
+    $maxRedirs = 3;
+    if (!function_exists('curl_init')) {
+        return get_http_response_fallback(
+            $cleanUrl,
+            $timeout,
+            $maxBytes,
+            $userAgent,
+            $acceptLanguage,
+            $maxRedirs
+        );
+    }
+    $ch = curl_init($cleanUrl);
+    if ($ch === false) {
+        return array(array(0 => 'curl_init() error'), false);
+    }
+    // General cURL settings
+    curl_setopt($ch, CURLOPT_AUTOREFERER,       true);
+    curl_setopt($ch, CURLOPT_FOLLOWLOCATION,    true);
+    curl_setopt($ch, CURLOPT_HEADER,            true);
+    curl_setopt(
+        $ch,
+        CURLOPT_HTTPHEADER,
+        array('Accept-Language: ' . $acceptLanguage)
+    );
+    curl_setopt($ch, CURLOPT_MAXREDIRS,         $maxRedirs);
+    curl_setopt($ch, CURLOPT_RETURNTRANSFER,    true);
+    curl_setopt($ch, CURLOPT_TIMEOUT,           $timeout);
+    curl_setopt($ch, CURLOPT_USERAGENT,         $userAgent);
+    // Max download size management
+    curl_setopt($ch, CURLOPT_BUFFERSIZE,        1024);
+    curl_setopt($ch, CURLOPT_NOPROGRESS,        false);
+    curl_setopt($ch, CURLOPT_PROGRESSFUNCTION,
+        function($arg0, $arg1, $arg2, $arg3, $arg4 = 0) use ($maxBytes)
+        {
+            if (version_compare(phpversion(), '5.5', '<')) {
+                // PHP version lower than 5.5
+                // Callback has 4 arguments
+                $downloaded = $arg1;
+            } else {
+                // Callback has 5 arguments
+                $downloaded = $arg2;
+            }
+            // Non-zero return stops downloading
+            return ($downloaded > $maxBytes) ? 1 : 0;
+        }
+    );
+    $response = curl_exec($ch);
+    $errorNo = curl_errno($ch);
+    $errorStr = curl_error($ch);
+    $headSize = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
+    curl_close($ch);
+    if ($response === false) {
+        if ($errorNo == CURLE_COULDNT_RESOLVE_HOST) {
+            /*
+             * Workaround to match fallback method behaviour
+             * Removing this would require updating
+             * GetHttpUrlTest::testGetInvalidRemoteUrl()
+             */
+            return array(false, false);
+        }
+        return array(array(0 => 'curl_exec() error: ' . $errorStr), false);
+    }
+    // Formatting output like the fallback method
+    $rawHeaders = substr($response, 0, $headSize);
+    // Keep only headers from latest redirection
+    $rawHeadersArrayRedirs = explode("\r\n\r\n", trim($rawHeaders));
+    $rawHeadersLastRedir = end($rawHeadersArrayRedirs);
+    $content = substr($response, $headSize);
+    $headers = array();
+    foreach (preg_split('~[\r\n]+~', $rawHeadersLastRedir) as $line) {
+        if (empty($line) or ctype_space($line)) {
+            continue;
+        }
+        $splitLine = explode(': ', $line, 2);
+        if (count($splitLine) > 1) {
+            $key = $splitLine[0];
+            $value = $splitLine[1];
+            if (array_key_exists($key, $headers)) {
+                if (!is_array($headers[$key])) {
+                    $headers[$key] = array(0 => $headers[$key]);
+                }
+                $headers[$key][] = $value;
+            } else {
+                $headers[$key] = $value;
+            }
+        } else {
+            $headers[] = $splitLine[0];
+        }
+    }
+    return array($headers, $content);
+}
+/**
+ * GET an HTTP URL to retrieve its content (fallback method)
+ *
+ * @param string $cleanUrl       URL to get (http://... valid and in ASCII form)
+ * @param int    $timeout        network timeout (in seconds)
+ * @param int    $maxBytes       maximum downloaded bytes
+ * @param string $userAgent      "User-Agent" header
+ * @param string $acceptLanguage "Accept-Language" header
+ * @param int    $maxRedr        maximum amount of redirections followed
+ *
+ * @return array HTTP response headers, downloaded content
+ *
+ * Output format:
+ *  [0] = associative array containing HTTP response headers
+ *  [1] = URL content (downloaded data)
+ *
+ * @see http://php.net/manual/en/function.file-get-contents.php
+ * @see http://php.net/manual/en/function.stream-context-create.php
+ * @see http://php.net/manual/en/function.get-headers.php
+ */
+function get_http_response_fallback(
+    $cleanUrl,
+    $timeout,
+    $maxBytes,
+    $userAgent,
+    $acceptLanguage,
+    $maxRedr
+) {
    $options = array(
        'http' => array(
            'method' => 'GET',
            'timeout' => $timeout,
-            'user_agent' => 'Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:45.0)'
+            'user_agent' => $userAgent,
-                         .' Gecko/20100101 Firefox/45.0',
+            'header' => "Accept: */*\r\n"
-            'accept_language' => substr(setlocale(LC_COLLATE, 0), 0, 2) . ',en-US;q=0.7,en;q=0.3',
+                . 'Accept-Language: ' . $acceptLanguage
        )
    );
    stream_context_set_default($options);
-    list($headers, $finalUrl) = get_redirected_headers($cleanUrl);
+    list($headers, $finalUrl) = get_redirected_headers($cleanUrl, $maxRedr);
    if (! $headers || strpos($headers[0], '200 OK') === false) {
        $options['http']['request_fulluri'] = true;
        stream_context_set_default($options);
-        list($headers, $finalUrl) = get_redirected_headers($cleanUrl);
+        list($headers, $finalUrl) = get_redirected_headers($cleanUrl, $maxRedr);
    }
-    if (! $headers || strpos($headers[0], '200 OK') === false) {
+    if (! $headers) {
        return array($headers, false);
    }
diff --git a/application/Languages.php b/application/Languages.php
new file mode 100644
index 00000000..c8b0a25a
--- /dev/null
+++ b/application/Languages.php
@@ -0,0 +1,21 @@
+<?php
+/**
+ * Wrapper function for translation which match the API
+ * of gettext()/_() and ngettext().
+ *
+ * Not doing translation for now.
+ *
+ * @param string $text  Text to translate.
+ * @param string $nText The plural message ID.
+ * @param int    $nb    The number of items for plural forms.
+ *
+ * @return String Text translated.
+ */
+function t($text, $nText = '', $nb = 0) {
+    if (empty($nText)) {
+        return $text;
+    }
+    $actualForm = $nb > 1 ? $nText : $text;
+    return sprintf($actualForm, $nb);
+}
diff --git a/application/LinkDB.php b/application/LinkDB.php
index 929a6b0f..d80434bf 100644
--- a/application/LinkDB.php
+++ b/application/LinkDB.php
@@ -291,7 +291,7 @@ You use the community supported version of the original Shaarli project, by Seba
            // Remove private tags if the user is not logged in.
            if (! $this->_loggedIn) {
-                $link['tags'] = preg_replace('/(^| )\.[^($| )]+/', '', $link['tags']);
+                $link['tags'] = preg_replace('/(^|\s+)\.[^($|\s)]+\s*/', ' ', $link['tags']);
            }
            // Do not use the redirector for internal links (Shaarli note URL starting with a '?').
@@ -442,7 +442,7 @@ You use the community supported version of the original Shaarli project, by Seba
        $tags = array();
        $caseMapping = array();
        foreach ($this->_links as $link) {
-            foreach (explode(' ', $link['tags']) as $tag) {
+            foreach (preg_split('/\s+/', $link['tags'], 0, PREG_SPLIT_NO_EMPTY) as $tag) {
                if (empty($tag)) {
                    continue;
                }
diff --git a/application/NetscapeBookmarkUtils.php b/application/NetscapeBookmarkUtils.php
index fdbb0ad7..c3181254 100644
--- a/application/NetscapeBookmarkUtils.php
+++ b/application/NetscapeBookmarkUtils.php
@@ -51,4 +51,145 @@ class NetscapeBookmarkUtils
        return $bookmarkLinks;
    }
+    /**
+     * Generates an import status summary
+     *
+     * @param string $filename       name of the file to import
+     * @param int    $filesize       size of the file to import
+     * @param int    $importCount    how many links were imported
+     * @param int    $overwriteCount how many links were overwritten
+     * @param int    $skipCount      how many links were skipped
+     *
+     * @return string Summary of the bookmark import status
+     */
+    private static function importStatus(
+        $filename,
+        $filesize,
+        $importCount=0,
+        $overwriteCount=0,
+        $skipCount=0
+    )
+    {
+        $status = 'File '.$filename.' ('.$filesize.' bytes) ';
+        if ($importCount == 0 && $overwriteCount == 0 && $skipCount == 0) {
+            $status .= 'has an unknown file format. Nothing was imported.';
+        } else {
+            $status .= 'was successfully processed: '.$importCount.' links imported, ';
+            $status .= $overwriteCount.' links overwritten, ';
+            $status .= $skipCount.' links skipped.';
+        }
+        return $status;
+    }
+    /**
+     * Imports Web bookmarks from an uploaded Netscape bookmark dump
+     *
+     * @param array  $post      Server $_POST parameters
+     * @param array  $file      Server $_FILES parameters
+     * @param LinkDB $linkDb    Loaded LinkDB instance
+     * @param string $pagecache Page cache
+     *
+     * @return string Summary of the bookmark import status
+     */
+    public static function import($post, $files, $linkDb, $pagecache)
+    {
+        $filename = $files['filetoupload']['name'];
+        $filesize = $files['filetoupload']['size'];
+        $data = file_get_contents($files['filetoupload']['tmp_name']);
+        if (strpos($data, '<!DOCTYPE NETSCAPE-Bookmark-file-1>') === false) {
+            return self::importStatus($filename, $filesize);
+        }
+        // Overwrite existing links?
+        $overwrite = ! empty($post['overwrite']);
+        // Add tags to all imported links?
+        if (empty($post['default_tags'])) {
+            $defaultTags = array();
+        } else {
+            $defaultTags = preg_split(
+                '/[\s,]+/',
+                escape($post['default_tags'])
+            );
+        }
+        // links are imported as public by default
+        $defaultPrivacy = 0;
+        $parser = new NetscapeBookmarkParser(
+            true,                       // nested tag support
+            $defaultTags,               // additional user-specified tags
+            strval(1 - $defaultPrivacy) // defaultPub = 1 - defaultPrivacy
+        );
+        $bookmarks = $parser->parseString($data);
+        $importCount = 0;
+        $overwriteCount = 0;
+        $skipCount = 0;
+        foreach ($bookmarks as $bkm) {
+            $private = $defaultPrivacy;
+            if (empty($post['privacy']) || $post['privacy'] == 'default') {
+                // use value from the imported file
+                $private = $bkm['pub'] == '1' ? 0 : 1;
+            } else if ($post['privacy'] == 'private') {
+                // all imported links are private
+                $private = 1;
+            } else if ($post['privacy'] == 'public') {
+                // all imported links are public
+                $private = 0;
+            }                
+            $newLink = array(
+                'title' => $bkm['title'],
+                'url' => $bkm['uri'],
+                'description' => $bkm['note'],
+                'private' => $private,
+                'linkdate'=> '',
+                'tags' => $bkm['tags']
+            );
+            $existingLink = $linkDb->getLinkFromUrl($bkm['uri']);
+            if ($existingLink !== false) {
+                if ($overwrite === false) {
+                    // Do not overwrite an existing link
+                    $skipCount++;
+                    continue;
+                }
+                // Overwrite an existing link, keep its date
+                $newLink['linkdate'] = $existingLink['linkdate'];
+                $linkDb[$existingLink['linkdate']] = $newLink;
+                $importCount++;
+                $overwriteCount++;
+                continue;
+            }
+            // Add a new link
+            $newLinkDate = new DateTime('@'.strval($bkm['time']));
+            while (!empty($linkDb[$newLinkDate->format(LinkDB::LINK_DATE_FORMAT)])) {
+                // Ensure the date/time is not already used
+                // - this hack is necessary as the date/time acts as a primary key
+                // - apply 1 second increments until an unused index is found
+                // See https://github.com/shaarli/Shaarli/issues/351
+                $newLinkDate->add(new DateInterval('PT1S'));
+            }
+            $linkDbDate = $newLinkDate->format(LinkDB::LINK_DATE_FORMAT);
+            $newLink['linkdate'] = $linkDbDate;
+            $linkDb[$linkDbDate] = $newLink;
+            $importCount++;
+        }
+        $linkDb->savedb($pagecache);
+        return self::importStatus(
+            $filename,
+            $filesize,
+            $importCount,
+            $overwriteCount,
+            $skipCount
+        );
+    }
 }
diff --git a/application/PageBuilder.php b/application/PageBuilder.php
index 1ca0260a..42932f32 100644
--- a/application/PageBuilder.php
+++ b/application/PageBuilder.php
@@ -80,6 +80,7 @@ class PageBuilder
        if (!empty($GLOBALS['plugin_errors'])) {
            $this->tpl->assign('plugin_errors', $GLOBALS['plugin_errors']);
        }
+        $this->tpl->assign('token', getToken($this->conf));
        // To be removed with a proper theme configuration.
        $this->tpl->assign('conf', $this->conf);
    }
diff --git a/application/PluginManager.php b/application/PluginManager.php
index 07bc1da9..1e132a7f 100644
--- a/application/PluginManager.php
+++ b/application/PluginManager.php
@@ -214,4 +214,4 @@ class PluginFileNotFoundException extends Exception
    {
        $this->message = 'Plugin "'. $pluginName .'" files not found.';
    }
-}
-\ No newline at end of file
+}
diff --git a/application/Router.php b/application/Router.php
index 2c3934b0..caed4a28 100644
--- a/application/Router.php
+++ b/application/Router.php
@@ -138,4 +138,4 @@ class Router
        return self::$PAGE_LINKLIST;
    }
-}
-\ No newline at end of file
+}
diff --git a/application/Updater.php b/application/Updater.php
index fd45d17f..b6cbc56c 100644
--- a/application/Updater.php
+++ b/application/Updater.php
@@ -198,11 +198,11 @@ class Updater
     * Escape settings which have been manually escaped in every request in previous versions:
     *   - general.title
     *   - general.header_link
-     *   - extras.redirector
+     *   - redirector.url
     *
     * @return bool true if the update is successful, false otherwise.
     */
-    public function escapeUnescapedConfig()
+    public function updateMethodEscapeUnescapedConfig()
    {
        try {
            $this->conf->set('general.title', escape($this->conf->get('general.title')));
diff --git a/composer.json b/composer.json
index dc1b509e..89a7e446 100644
--- a/composer.json
+++ b/composer.json
@@ -9,15 +9,9 @@
        "wiki": "https://github.com/shaarli/Shaarli/wiki"
    },
    "keywords": ["bookmark", "link", "share", "web"],
-    "repositories": [
-        {
-            "type": "vcs",
-            "url": "https://github.com/shaarli/netscape-bookmark-parser"
-        }
-    ],
    "require": {
        "php": ">=5.3.4",
-        "kafene/netscape-bookmark-parser": "dev-shaarli-stable"
+        "shaarli/netscape-bookmark-parser": "1.*"
    },
    "require-dev": {
        "phpmd/phpmd" : "@stable",
diff --git a/index.php b/index.php
index 55b12adc..1f148d78 100644
--- a/index.php
+++ b/index.php
@@ -44,6 +44,10 @@ error_reporting(E_ALL^E_WARNING);
 //error_reporting(-1);
+// 3rd-party libraries
+require_once 'inc/rain.tpl.class.php';
+require_once __DIR__ . '/vendor/autoload.php';
 // Shaarli library
 require_once 'application/ApplicationUtils.php';
 require_once 'application/Cache.php';
@@ -53,6 +57,7 @@ require_once 'application/config/ConfigPlugin.php';
 require_once 'application/FeedBuilder.php';
 require_once 'application/FileUtils.php';
 require_once 'application/HttpUtils.php';
+require_once 'application/Languages.php';
 require_once 'application/LinkDB.php';
 require_once 'application/LinkFilter.php';
 require_once 'application/LinkUtils.php';
@@ -64,7 +69,6 @@ require_once 'application/Utils.php';
 require_once 'application/PluginManager.php';
 require_once 'application/Router.php';
 require_once 'application/Updater.php';
-require_once 'inc/rain.tpl.class.php';
 // Ensure the PHP version is supported
 try {
@@ -783,8 +787,6 @@ function renderPage($conf, $pluginManager)
    if ($targetPage == Router::$PAGE_LOGIN)
    {
        if ($conf->get('security.open_shaarli')) { header('Location: ?'); exit; }  // No need to login for open Shaarli
-        $token=''; if (ban_canLogin($conf)) $token=getToken($conf); // Do not waste token generation if not useful.
-        $PAGE->assign('token',$token);
        if (isset($_GET['username'])) {
            $PAGE->assign('username', escape($_GET['username']));
        }
@@ -1105,7 +1107,6 @@ function renderPage($conf, $pluginManager)
        }
        else // show the change password form.
        {
-            $PAGE->assign('token',getToken($conf));
            $PAGE->renderPage('changepassword');
            exit;
        }
@@ -1152,7 +1153,6 @@ function renderPage($conf, $pluginManager)
        }
        else // Show the configuration form.
        {
-            $PAGE->assign('token',getToken($conf));
            $PAGE->assign('title', $conf->get('general.title'));
            $PAGE->assign('redirector', $conf->get('redirector.url'));
            list($timezone_form, $timezone_js) = generateTimeZoneForm($conf->get('general.timezone'));
@@ -1172,7 +1172,6 @@ function renderPage($conf, $pluginManager)
    if ($targetPage == Router::$PAGE_CHANGETAG)
    {
        if (empty($_POST['fromtag']) || (empty($_POST['totag']) && isset($_POST['renametag']))) {
-            $PAGE->assign('token', getToken($conf));
            $PAGE->assign('tags', $LINKSDB->allTags());
            $PAGE->renderPage('changetag');
            exit;
@@ -1347,7 +1346,6 @@ function renderPage($conf, $pluginManager)
        $data = array(
            'link' => $link,
            'link_is_new' => false,
-            'token' => getToken($conf),
            'http_referer' => (isset($_SERVER['HTTP_REFERER']) ? escape($_SERVER['HTTP_REFERER']) : ''),
            'tags' => $LINKSDB->allTags(),
        );
@@ -1414,11 +1412,10 @@ function renderPage($conf, $pluginManager)
        $data = array(
            'link' => $link,
            'link_is_new' => $link_is_new,
-            'token' => getToken($conf), // XSRF protection.
            'http_referer' => (isset($_SERVER['HTTP_REFERER']) ? escape($_SERVER['HTTP_REFERER']) : ''),
            'source' => (isset($_GET['source']) ? $_GET['source'] : ''),
            'tags' => $LINKSDB->allTags(),
-            'default_private_links' => $conf->get('default_private_links', false),
+            'default_private_links' => $conf->get('privacy.default_private_links', false),
        );
        $pluginManager->executeHooks('render_editlink', $data);
@@ -1474,27 +1471,37 @@ function renderPage($conf, $pluginManager)
        exit;
    }
-    // -------- User is uploading a file for import
+    if ($targetPage == Router::$PAGE_IMPORT) {
-    if (isset($_SERVER['QUERY_STRING']) && startsWith($_SERVER['QUERY_STRING'], 'do=upload'))
+        // Upload a Netscape bookmark dump to import its contents
-    {
-        // If file is too big, some form field may be missing.
+        if (! isset($_POST['token']) || ! isset($_FILES['filetoupload'])) {
-        if (!isset($_POST['token']) || (!isset($_FILES)) || (isset($_FILES['filetoupload']['size']) && $_FILES['filetoupload']['size']==0))
+            // Show import dialog
-        {
+            $PAGE->assign('maxfilesize', getMaxFileSize());
-            $returnurl = ( empty($_SERVER['HTTP_REFERER']) ? '?' : $_SERVER['HTTP_REFERER'] );
+            $PAGE->renderPage('import');
-            echo '<script>alert("The file you are trying to upload is probably bigger than what this webserver can accept ('.getMaxFileSize().' bytes). Please upload in smaller chunks.");document.location=\''.escape($returnurl).'\';</script>';
            exit;
        }
-        if (!tokenOk($_POST['token'])) die('Wrong token.');
-        importFile($LINKSDB);
-        exit;
-    }
-    // -------- Show upload/import dialog:
+        // Import bookmarks from an uploaded file
-    if ($targetPage == Router::$PAGE_IMPORT)
+        if (isset($_FILES['filetoupload']['size']) && $_FILES['filetoupload']['size'] == 0) {
-    {
+            // The file is too big or some form field may be missing.
-        $PAGE->assign('token',getToken($conf));
+            echo '<script>alert("The file you are trying to upload is probably'
-        $PAGE->assign('maxfilesize',getMaxFileSize());
+                .' bigger than what this webserver can accept ('
-        $PAGE->renderPage('import');
+                .getMaxFileSize().' bytes).'
+                .' Please upload in smaller chunks.");document.location=\'?do='
+                .Router::$PAGE_IMPORT .'\';</script>';
+            exit;
+        }
+        if (! tokenOk($_POST['token'])) {
+            die('Wrong token.');
+        }
+        $status = NetscapeBookmarkUtils::import(
+            $_POST,
+            $_FILES,
+            $LINKSDB,
+            $conf->get('resource.page_cache')
+        );
+        echo '<script>alert("'.$status.'");document.location=\'?do='
+             .Router::$PAGE_IMPORT .'\';</script>';
        exit;
    }
@@ -1552,95 +1559,6 @@ function renderPage($conf, $pluginManager)
 }
 /**
- * Process the import file form.
- *
- * @param LinkDB        $LINKSDB Loaded LinkDB instance.
- * @param ConfigManager $conf    Configuration Manager instance.
- */
-function importFile($LINKSDB, $conf)
-{
-    if (!isLoggedIn()) { die('Not allowed.'); }
-    $filename=$_FILES['filetoupload']['name'];
-    $filesize=$_FILES['filetoupload']['size'];
-    $data=file_get_contents($_FILES['filetoupload']['tmp_name']);
-    $private = (empty($_POST['private']) ? 0 : 1); // Should the links be imported as private?
-    $overwrite = !empty($_POST['overwrite']) ; // Should the imported links overwrite existing ones?
-    $import_count=0;
-    // Sniff file type:
-    $type='unknown';
-    if (startsWith($data,'<!DOCTYPE NETSCAPE-Bookmark-file-1>')) $type='netscape'; // Netscape bookmark file (aka Firefox).
-    // Then import the bookmarks.
-    if ($type=='netscape')
-    {
-        // This is a standard Netscape-style bookmark file.
-        // This format is supported by all browsers (except IE, of course), also Delicious, Diigo and others.
-        foreach(explode('<DT>',$data) as $html) // explode is very fast
-        {
-            $link = array('linkdate'=>'','title'=>'','url'=>'','description'=>'','tags'=>'','private'=>0);
-            $d = explode('<DD>',$html);
-            if (startsWith($d[0], '<A '))
-            {
-                $link['description'] = (isset($d[1]) ? html_entity_decode(trim($d[1]),ENT_QUOTES,'UTF-8') : '');  // Get description (optional)
-                preg_match('!<A .*?>(.*?)</A>!i',$d[0],$matches); $link['title'] = (isset($matches[1]) ? trim($matches[1]) : '');  // Get title
-                $link['title'] = html_entity_decode($link['title'],ENT_QUOTES,'UTF-8');
-                preg_match_all('! ([A-Z_]+)=\"(.*?)"!i',$html,$matches,PREG_SET_ORDER);  // Get all other attributes
-                $raw_add_date=0;
-                foreach($matches as $m)
-                {
-                    $attr=$m[1]; $value=$m[2];
-                    if ($attr=='HREF') $link['url']=html_entity_decode($value,ENT_QUOTES,'UTF-8');
-                    elseif ($attr=='ADD_DATE')
-                    {
-                        $raw_add_date=intval($value);
-                        if ($raw_add_date>30000000000) $raw_add_date/=1000;     //If larger than year 2920, then was likely stored in milliseconds instead of seconds
-                    }
-                    elseif ($attr=='PRIVATE') $link['private']=($value=='0'?0:1);
-                    elseif ($attr=='TAGS') $link['tags']=html_entity_decode(str_replace(',',' ',$value),ENT_QUOTES,'UTF-8');
-                }
-                if ($link['url']!='')
-                {
-                    if ($private==1) $link['private']=1;
-                    $dblink = $LINKSDB->getLinkFromUrl($link['url']); // See if the link is already in database.
-                    if ($dblink==false)
-                    {  // Link not in database, let's import it...
-                       if (empty($raw_add_date)) $raw_add_date=time(); // In case of shitty bookmark file with no ADD_DATE
-                       // Make sure date/time is not already used by another link.
-                       // (Some bookmark files have several different links with the same ADD_DATE)
-                       // We increment date by 1 second until we find a date which is not used in DB.
-                       // (so that links that have the same date/time are more or less kept grouped by date, but do not conflict.)
-                       while (!empty($LINKSDB[date('Ymd_His',$raw_add_date)])) { $raw_add_date++; }// Yes, I know it's ugly.
-                       $link['linkdate']=date('Ymd_His',$raw_add_date);
-                       $LINKSDB[$link['linkdate']] = $link;
-                       $import_count++;
-                    }
-                    else // Link already present in database.
-                    {
-                        if ($overwrite)
-                        {   // If overwrite is required, we import link data, except date/time.
-                            $link['linkdate']=$dblink['linkdate'];
-                            $LINKSDB[$link['linkdate']] = $link;
-                            $import_count++;
-                        }
-                    }
-                }
-            }
-        }
-        $LINKSDB->savedb($conf->get('resource.page_cache'));
-        echo '<script>alert("File '.json_encode($filename).' ('.$filesize.' bytes) was successfully processed: '.$import_count.' links imported.");document.location=\'?\';</script>';
-    }
-    else
-    {
-        echo '<script>alert("File '.json_encode($filename).' ('.$filesize.' bytes) has an unknown file format. Nothing was imported.");document.location=\'?\';</script>';
-    }
-}
-/**
 * Template for the list of links (<div id="linklist">)
 * This function fills all the necessary fields in the $PAGE for the template 'linklist.html'
 *
@@ -1734,7 +1652,6 @@ function buildLinkList($PAGE,$LINKSDB, $conf, $pluginManager)
        'search_term' => $searchterm,
        'search_tags' => $searchtags,
        'redirector' => $conf->get('redirector.url'),  // Optional redirector URL.
-        'token' => $token,
        'links' => $linkDisp,
        'tags' => $LINKSDB->allTags(),
    );
diff --git a/plugins/addlink_toolbar/addlink_toolbar.php b/plugins/addlink_toolbar/addlink_toolbar.php
index ba3849cf..cfd74207 100644
--- a/plugins/addlink_toolbar/addlink_toolbar.php
+++ b/plugins/addlink_toolbar/addlink_toolbar.php
@@ -35,4 +35,4 @@ function hook_addlink_toolbar_render_includes($data)
    }
    return $data;
-}
-\ No newline at end of file
+}
diff --git a/plugins/playvideos/playvideos.php b/plugins/playvideos/playvideos.php
index 0a80aa58..7645b778 100644
--- a/plugins/playvideos/playvideos.php
+++ b/plugins/playvideos/playvideos.php
@@ -37,4 +37,4 @@ function hook_playvideos_render_footer($data)
    }
    return $data;
-}
-\ No newline at end of file
+}
diff --git a/plugins/wallabag/README.md b/plugins/wallabag/README.md
index 3f930564..ea21a519 100644
--- a/plugins/wallabag/README.md
+++ b/plugins/wallabag/README.md
@@ -4,19 +4,19 @@ For each link in your Shaarli, adds a button to save the target page in your [wa
 ### Installation
-Clone this repository inside your `tpl/plugins/` directory, or download the archive and unpack it there.  
+Clone this repository inside your `tpl/plugins/` directory, or download the archive and unpack it there.
 The directory structure should look like:
-```
+```bash
 └── tpl
    └── plugins
-        └── wallabag
+        └── wallabag
-            ├── README.md
+            ├── README.md
-            ├── wallabag.html
+            ├── wallabag.html
-            ├── wallabag.meta
+            ├── wallabag.meta
-            ├── wallabag.php
+            ├── wallabag.php
-            ├── wallabag.php
+            ├── wallabag.php
-            └── WallabagInstance.php
+            └── WallabagInstance.php
 ```
 To enable the plugin, you can either:
@@ -28,10 +28,10 @@ To enable the plugin, you can either:
 Go to the plugin administration page, and edit the following settings (with the plugin enabled).
-**WALLABAG_URL**: *Wallabag instance URL*  
+**WALLABAG_URL**: *Wallabag instance URL*
 Example value: `http://v2.wallabag.org`
-**WALLABAG_VERSION**: *Wallabag version*  
+**WALLABAG_VERSION**: *Wallabag version*
 Value: either `1` (for 1.x) or `2` (for 2.x)
-> Note: these settings can also be set in `data/config.json.php`, in the plugins section.
-\ No newline at end of file
+> Note: these settings can also be set in `data/config.json.php`, in the plugins section.
diff --git a/tests/LanguagesTest.php b/tests/LanguagesTest.php
new file mode 100644
index 00000000..79c136c8
--- /dev/null
+++ b/tests/LanguagesTest.php
@@ -0,0 +1,41 @@
+<?php
+require_once 'application/Languages.php';
+/**
+ * Class LanguagesTest.
+ */
+class LanguagesTest extends PHPUnit_Framework_TestCase
+{
+    /**
+     * Test t() with a simple non identified value.
+     */
+    public function testTranslateSingleNotID()
+    {
+        $text = 'abcdé 564 fgK';
+        $this->assertEquals($text, t($text));
+    }
+    /**
+     * Test t() with a non identified plural form.
+     */
+    public function testTranslatePluralNotID()
+    {
+        $text = '%s sandwich';
+        $nText = '%s sandwiches';
+        $this->assertEquals('0 sandwich', t($text, $nText));
+        $this->assertEquals('1 sandwich', t($text, $nText, 1));
+        $this->assertEquals('2 sandwiches', t($text, $nText, 2));
+    }
+    /**
+     * Test t() with a non identified invalid plural form.
+     */
+    public function testTranslatePluralNotIDInvalid()
+    {
+        $text = 'sandwich';
+        $nText = 'sandwiches';
+        $this->assertEquals('sandwich', t($text, $nText, 1));
+        $this->assertEquals('sandwiches', t($text, $nText, 2));
+    }
+}
diff --git a/tests/LinkDBTest.php b/tests/LinkDBTest.php
index 46956f20..31306069 100644
--- a/tests/LinkDBTest.php
+++ b/tests/LinkDBTest.php
@@ -317,6 +317,10 @@ class LinkDBTest extends PHPUnit_Framework_TestCase
                '-exclude' => 1,
                '.hidden' => 1,
                'hashtag' => 2,
+                'tag1' => 1,
+                'tag2' => 1,
+                'tag3' => 1,
+                'tag4' => 1,
            ),
            self::$privateLinkDB->allTags()
        );
diff --git a/tests/NetscapeBookmarkUtilsTest.php b/tests/NetscapeBookmarkUtils/BookmarkExportTest.php
index 41e6d84c..cc54ab9f 100644
--- a/tests/NetscapeBookmarkUtilsTest.php
+++ b/tests/NetscapeBookmarkUtils/BookmarkExportTest.php
@@ -3,9 +3,9 @@
 require_once 'application/NetscapeBookmarkUtils.php';
 /**
- * Netscape bookmark import and export
+ * Netscape bookmark export
 */
-class NetscapeBookmarkUtilsTest extends PHPUnit_Framework_TestCase
+class BookmarkExportTest extends PHPUnit_Framework_TestCase
 {
    /**
     * @var string datastore to test write operations
diff --git a/tests/NetscapeBookmarkUtils/BookmarkImportTest.php b/tests/NetscapeBookmarkUtils/BookmarkImportTest.php
new file mode 100644
index 00000000..f0ad500f
--- /dev/null
+++ b/tests/NetscapeBookmarkUtils/BookmarkImportTest.php
@@ -0,0 +1,546 @@
+<?php
+require_once 'application/NetscapeBookmarkUtils.php';
+/**
+ * Utility function to load a file's metadata in a $_FILES-like array
+ *
+ * @param string $filename Basename of the file
+ *
+ * @return array A $_FILES-like array
+ */
+function file2array($filename)
+{
+    return array(
+        'filetoupload' => array(
+            'name'     => $filename,
+            'tmp_name' => __DIR__ . '/input/' . $filename,
+            'size'     => filesize(__DIR__ . '/input/' . $filename)
+        )
+    );
+}
+/**
+ * Netscape bookmark import
+ */
+class BookmarkImportTest extends PHPUnit_Framework_TestCase
+{
+    /**
+     * @var string datastore to test write operations
+     */
+    protected static $testDatastore = 'sandbox/datastore.php';
+    /**
+     * @var LinkDB private LinkDB instance
+     */
+    protected $linkDb = null;
+    /**
+     * @var string Dummy page cache
+     */
+    protected $pagecache = 'tests';
+    /**
+     * Resets test data before each test
+     */
+    protected function setUp()
+    {
+        if (file_exists(self::$testDatastore)) {
+            unlink(self::$testDatastore);
+        }
+        // start with an empty datastore
+        file_put_contents(self::$testDatastore, '<?php /* S7QysKquBQA= */ ?>');
+        $this->linkDb = new LinkDB(self::$testDatastore, true, false);
+    }
+    /**
+     * Attempt to import bookmarks from an empty file
+     */
+    public function testImportEmptyData()
+    {
+        $files = file2array('empty.htm');
+        $this->assertEquals(
+            'File empty.htm (0 bytes) has an unknown file format.'
+            .' Nothing was imported.',
+            NetscapeBookmarkUtils::import(NULL, $files, NULL, NULL)
+        );
+        $this->assertEquals(0, count($this->linkDb));
+    }
+    /**
+     * Attempt to import bookmarks from a file with no Doctype
+     */
+    public function testImportNoDoctype()
+    {
+        $files = file2array('no_doctype.htm');
+        $this->assertEquals(
+            'File no_doctype.htm (350 bytes) has an unknown file format. Nothing was imported.',
+            NetscapeBookmarkUtils::import(NULL, $files, NULL, NULL)
+        );
+        $this->assertEquals(0, count($this->linkDb));
+    }
+    /**
+     * Ensure IE dumps are supported
+     */
+    public function testImportInternetExplorerEncoding()
+    {
+        $files = file2array('internet_explorer_encoding.htm');
+        $this->assertEquals(
+            'File internet_explorer_encoding.htm (356 bytes) was successfully processed:'
+            .' 1 links imported, 0 links overwritten, 0 links skipped.',
+            NetscapeBookmarkUtils::import(array(), $files, $this->linkDb, $this->pagecache)
+        );
+        $this->assertEquals(1, count($this->linkDb));
+        $this->assertEquals(0, count_private($this->linkDb));
+        $this->assertEquals(
+            array(
+                'linkdate' => '20160618_173944',
+                'title' => 'Hg Init a Mercurial tutorial by Joel Spolsky',
+                'url' => 'http://hginit.com/',
+                'description' => '',
+                'private' => 0,
+                'tags' => ''
+            ),
+            $this->linkDb->getLinkFromUrl('http://hginit.com/')
+        );
+    }
+    /**
+     * Import bookmarks nested in a folder hierarchy
+     */
+    public function testImportNested()
+    {
+        $files = file2array('netscape_nested.htm');
+        $this->assertEquals(
+            'File netscape_nested.htm (1337 bytes) was successfully processed:'
+            .' 8 links imported, 0 links overwritten, 0 links skipped.',
+            NetscapeBookmarkUtils::import(array(), $files, $this->linkDb, $this->pagecache)
+        );
+        $this->assertEquals(8, count($this->linkDb));
+        $this->assertEquals(2, count_private($this->linkDb));
+        $this->assertEquals(
+            array(
+                'linkdate' => '20160225_205541',
+                'title' => 'Nested 1',
+                'url' => 'http://nest.ed/1',
+                'description' => '',
+                'private' => 0,
+                'tags' => 'tag1 tag2'
+            ),
+            $this->linkDb->getLinkFromUrl('http://nest.ed/1')
+        );
+        $this->assertEquals(
+            array(
+                'linkdate' => '20160225_205542',
+                'title' => 'Nested 1-1',
+                'url' => 'http://nest.ed/1-1',
+                'description' => '',
+                'private' => 0,
+                'tags' => 'folder1 tag1 tag2'
+            ),
+            $this->linkDb->getLinkFromUrl('http://nest.ed/1-1')
+        );
+        $this->assertEquals(
+            array(
+                'linkdate' => '20160225_205547',
+                'title' => 'Nested 1-2',
+                'url' => 'http://nest.ed/1-2',
+                'description' => '',
+                'private' => 0,
+                'tags' => 'folder1 tag3 tag4'
+            ),
+            $this->linkDb->getLinkFromUrl('http://nest.ed/1-2')
+        );
+        $this->assertEquals(
+            array(
+                'linkdate' => '20160202_172222',
+                'title' => 'Nested 2-1',
+                'url' => 'http://nest.ed/2-1',
+                'description' => 'First link of the second section',
+                'private' => 1,
+                'tags' => 'folder2'
+            ),
+            $this->linkDb->getLinkFromUrl('http://nest.ed/2-1')
+        );
+        $this->assertEquals(
+            array(
+                'linkdate' => '20160119_200227',
+                'title' => 'Nested 2-2',
+                'url' => 'http://nest.ed/2-2',
+                'description' => 'Second link of the second section',
+                'private' => 1,
+                'tags' => 'folder2'
+            ),
+            $this->linkDb->getLinkFromUrl('http://nest.ed/2-2')
+        );
+        $this->assertEquals(
+            array(
+                'linkdate' => '20160202_172223',
+                'title' => 'Nested 3-1',
+                'url' => 'http://nest.ed/3-1',
+                'description' => '',
+                'private' => 0,
+                'tags' => 'folder3 folder3-1 tag3'
+            ),
+            $this->linkDb->getLinkFromUrl('http://nest.ed/3-1')
+        );
+        $this->assertEquals(
+            array(
+                'linkdate' => '20160119_200228',
+                'title' => 'Nested 3-2',
+                'url' => 'http://nest.ed/3-2',
+                'description' => '',
+                'private' => 0,
+                'tags' => 'folder3 folder3-1'
+            ),
+            $this->linkDb->getLinkFromUrl('http://nest.ed/3-2')
+        );
+        $this->assertEquals(
+            array(
+                'linkdate' => '20160229_081541',
+                'title' => 'Nested 2',
+                'url' => 'http://nest.ed/2',
+                'description' => '',
+                'private' => 0,
+                'tags' => 'tag4'
+            ),
+            $this->linkDb->getLinkFromUrl('http://nest.ed/2')
+        );
+    }
+    /**
+     * Import bookmarks with the default privacy setting (reuse from file)
+     *
+     * The $_POST array is not set.
+     */
+    public function testImportDefaultPrivacyNoPost()
+    {
+        $files = file2array('netscape_basic.htm');
+        $this->assertEquals(
+            'File netscape_basic.htm (482 bytes) was successfully processed:'
+            .' 2 links imported, 0 links overwritten, 0 links skipped.',
+            NetscapeBookmarkUtils::import(array(), $files, $this->linkDb, $this->pagecache)
+        );
+        $this->assertEquals(2, count($this->linkDb));
+        $this->assertEquals(1, count_private($this->linkDb));
+        $this->assertEquals(
+            array(
+                'linkdate' => '20001010_105536',
+                'title' => 'Secret stuff',
+                'url' => 'https://private.tld',
+                'description' => "Super-secret stuff you're not supposed to know about",
+                'private' => 1,
+                'tags' => 'private secret'
+            ),
+            $this->linkDb->getLinkFromUrl('https://private.tld')
+        );
+        $this->assertEquals(
+            array(
+                'linkdate' => '20160225_205548',
+                'title' => 'Public stuff',
+                'url' => 'http://public.tld',
+                'description' => '',
+                'private' => 0,
+                'tags' => 'public hello world'
+            ),
+            $this->linkDb->getLinkFromUrl('http://public.tld')
+        );
+    }
+    /**
+     * Import bookmarks with the default privacy setting (reuse from file)
+     */
+    public function testImportKeepPrivacy()
+    {
+        $post = array('privacy' => 'default');
+        $files = file2array('netscape_basic.htm');
+        $this->assertEquals(
+            'File netscape_basic.htm (482 bytes) was successfully processed:'
+            .' 2 links imported, 0 links overwritten, 0 links skipped.',
+            NetscapeBookmarkUtils::import($post, $files, $this->linkDb, $this->pagecache)
+        );
+        $this->assertEquals(2, count($this->linkDb));
+        $this->assertEquals(1, count_private($this->linkDb));
+        $this->assertEquals(
+            array(
+                'linkdate' => '20001010_105536',
+                'title' => 'Secret stuff',
+                'url' => 'https://private.tld',
+                'description' => "Super-secret stuff you're not supposed to know about",
+                'private' => 1,
+                'tags' => 'private secret'
+            ),
+            $this->linkDb->getLinkFromUrl('https://private.tld')
+        );
+        $this->assertEquals(
+            array(
+                'linkdate' => '20160225_205548',
+                'title' => 'Public stuff',
+                'url' => 'http://public.tld',
+                'description' => '',
+                'private' => 0,
+                'tags' => 'public hello world'
+            ),
+            $this->linkDb->getLinkFromUrl('http://public.tld')
+        );
+    }
+    /**
+     * Import links as public
+     */
+    public function testImportAsPublic()
+    {
+        $post = array('privacy' => 'public');
+        $files = file2array('netscape_basic.htm');
+        $this->assertEquals(
+            'File netscape_basic.htm (482 bytes) was successfully processed:'
+            .' 2 links imported, 0 links overwritten, 0 links skipped.',
+            NetscapeBookmarkUtils::import($post, $files, $this->linkDb, $this->pagecache)
+        );
+        $this->assertEquals(2, count($this->linkDb));
+        $this->assertEquals(0, count_private($this->linkDb));
+        $this->assertEquals(
+            0,
+            $this->linkDb['20001010_105536']['private']
+        );
+        $this->assertEquals(
+            0,
+            $this->linkDb['20160225_205548']['private']
+        );
+    }
+    /**
+     * Import links as private
+     */
+    public function testImportAsPrivate()
+    {
+        $post = array('privacy' => 'private');
+        $files = file2array('netscape_basic.htm');
+        $this->assertEquals(
+            'File netscape_basic.htm (482 bytes) was successfully processed:'
+            .' 2 links imported, 0 links overwritten, 0 links skipped.',
+            NetscapeBookmarkUtils::import($post, $files, $this->linkDb, $this->pagecache)
+        );
+        $this->assertEquals(2, count($this->linkDb));
+        $this->assertEquals(2, count_private($this->linkDb));
+        $this->assertEquals(
+            1,
+            $this->linkDb['20001010_105536']['private']
+        );
+        $this->assertEquals(
+            1,
+            $this->linkDb['20160225_205548']['private']
+        );
+    }
+    /**
+     * Overwrite private links so they become public
+     */
+    public function testOverwriteAsPublic()
+    {
+        $files = file2array('netscape_basic.htm');
+        // import links as private
+        $post = array('privacy' => 'private');
+        $this->assertEquals(
+            'File netscape_basic.htm (482 bytes) was successfully processed:'
+            .' 2 links imported, 0 links overwritten, 0 links skipped.',
+            NetscapeBookmarkUtils::import($post, $files, $this->linkDb, $this->pagecache)
+        );
+        $this->assertEquals(2, count($this->linkDb));
+        $this->assertEquals(2, count_private($this->linkDb));
+        $this->assertEquals(
+            1,
+            $this->linkDb['20001010_105536']['private']
+        );
+        $this->assertEquals(
+            1,
+            $this->linkDb['20160225_205548']['private']
+        );
+        // re-import as public, enable overwriting
+        $post = array(
+            'privacy' => 'public',
+            'overwrite' => 'true'
+        );
+        $this->assertEquals(
+            'File netscape_basic.htm (482 bytes) was successfully processed:'
+            .' 2 links imported, 2 links overwritten, 0 links skipped.',
+            NetscapeBookmarkUtils::import($post, $files, $this->linkDb, $this->pagecache)
+        );
+        $this->assertEquals(2, count($this->linkDb));
+        $this->assertEquals(0, count_private($this->linkDb));
+        $this->assertEquals(
+            0,
+            $this->linkDb['20001010_105536']['private']
+        );
+        $this->assertEquals(
+            0,
+            $this->linkDb['20160225_205548']['private']
+        );
+    }
+    /**
+     * Overwrite public links so they become private
+     */
+    public function testOverwriteAsPrivate()
+    {
+        $files = file2array('netscape_basic.htm');
+        // import links as public
+        $post = array('privacy' => 'public');
+        $this->assertEquals(
+            'File netscape_basic.htm (482 bytes) was successfully processed:'
+            .' 2 links imported, 0 links overwritten, 0 links skipped.',
+            NetscapeBookmarkUtils::import($post, $files, $this->linkDb, $this->pagecache)
+        );
+        $this->assertEquals(2, count($this->linkDb));
+        $this->assertEquals(0, count_private($this->linkDb));
+        $this->assertEquals(
+            0,
+            $this->linkDb['20001010_105536']['private']
+        );
+        $this->assertEquals(
+            0,
+            $this->linkDb['20160225_205548']['private']
+        );
+        // re-import as private, enable overwriting
+        $post = array(
+            'privacy' => 'private',
+            'overwrite' => 'true'
+        );
+        $this->assertEquals(
+            'File netscape_basic.htm (482 bytes) was successfully processed:'
+            .' 2 links imported, 2 links overwritten, 0 links skipped.',
+            NetscapeBookmarkUtils::import($post, $files, $this->linkDb, $this->pagecache)
+        );
+        $this->assertEquals(2, count($this->linkDb));
+        $this->assertEquals(2, count_private($this->linkDb));
+        $this->assertEquals(
+            1,
+            $this->linkDb['20001010_105536']['private']
+        );
+        $this->assertEquals(
+            1,
+            $this->linkDb['20160225_205548']['private']
+        );
+    }
+    /**
+     * Attept to import the same links twice without enabling overwriting
+     */
+    public function testSkipOverwrite()
+    {
+        $post = array('privacy' => 'public');
+        $files = file2array('netscape_basic.htm');
+        $this->assertEquals(
+            'File netscape_basic.htm (482 bytes) was successfully processed:'
+            .' 2 links imported, 0 links overwritten, 0 links skipped.',
+            NetscapeBookmarkUtils::import($post, $files, $this->linkDb, $this->pagecache)
+        );
+        $this->assertEquals(2, count($this->linkDb));
+        $this->assertEquals(0, count_private($this->linkDb));
+        // re-import as private, DO NOT enable overwriting
+        $post = array('privacy' => 'private');
+        $this->assertEquals(
+            'File netscape_basic.htm (482 bytes) was successfully processed:'
+            .' 0 links imported, 0 links overwritten, 2 links skipped.',
+            NetscapeBookmarkUtils::import($post, $files, $this->linkDb, $this->pagecache)
+        );
+        $this->assertEquals(2, count($this->linkDb));
+        $this->assertEquals(0, count_private($this->linkDb));
+    }
+    /**
+     * Add user-specified tags to all imported bookmarks
+     */
+    public function testSetDefaultTags()
+    {
+        $post = array(
+            'privacy' => 'public',
+            'default_tags' => 'tag1,tag2 tag3'
+        );
+        $files = file2array('netscape_basic.htm');
+        $this->assertEquals(
+            'File netscape_basic.htm (482 bytes) was successfully processed:'
+            .' 2 links imported, 0 links overwritten, 0 links skipped.',
+            NetscapeBookmarkUtils::import($post, $files, $this->linkDb, $this->pagecache)
+        );
+        $this->assertEquals(2, count($this->linkDb));
+        $this->assertEquals(0, count_private($this->linkDb));
+        $this->assertEquals(
+            'tag1 tag2 tag3 private secret',
+            $this->linkDb['20001010_105536']['tags']
+        );
+        $this->assertEquals(
+            'tag1 tag2 tag3 public hello world',
+            $this->linkDb['20160225_205548']['tags']
+        );
+    }
+    /**
+     * The user-specified tags contain characters to be escaped
+     */
+    public function testSanitizeDefaultTags()
+    {
+        $post = array(
+            'privacy' => 'public',
+            'default_tags' => 'tag1&,tag2 "tag3"'
+        );
+        $files = file2array('netscape_basic.htm');
+        $this->assertEquals(
+            'File netscape_basic.htm (482 bytes) was successfully processed:'
+            .' 2 links imported, 0 links overwritten, 0 links skipped.',
+            NetscapeBookmarkUtils::import($post, $files, $this->linkDb, $this->pagecache)
+        );
+        $this->assertEquals(2, count($this->linkDb));
+        $this->assertEquals(0, count_private($this->linkDb));
+        $this->assertEquals(
+            'tag1&amp; tag2 &quot;tag3&quot; private secret',
+            $this->linkDb['20001010_105536']['tags']
+        );
+        $this->assertEquals(
+            'tag1&amp; tag2 &quot;tag3&quot; public hello world',
+            $this->linkDb['20160225_205548']['tags']
+        );
+    }
+    /**
+     * Ensure each imported bookmark has a unique linkdate
+     *
+     * See https://github.com/shaarli/Shaarli/issues/351
+     */
+    public function testImportSameDate()
+    {
+        $files = file2array('same_date.htm');
+        $this->assertEquals(
+            'File same_date.htm (453 bytes) was successfully processed:'
+            .' 3 links imported, 0 links overwritten, 0 links skipped.',
+            NetscapeBookmarkUtils::import(array(), $files, $this->linkDb, $this->pagecache)
+        );
+        $this->assertEquals(3, count($this->linkDb));
+        $this->assertEquals(0, count_private($this->linkDb));
+        $this->assertEquals(
+            '20160225_205548',
+            $this->linkDb['20160225_205548']['linkdate']
+        );
+        $this->assertEquals(
+            '20160225_205549',
+            $this->linkDb['20160225_205549']['linkdate']
+        );
+        $this->assertEquals(
+            '20160225_205550',
+            $this->linkDb['20160225_205550']['linkdate']
+        );
+    }
+}
diff --git a/tests/NetscapeBookmarkUtils/input/empty.htm b/tests/NetscapeBookmarkUtils/input/empty.htm
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/tests/NetscapeBookmarkUtils/input/empty.htm
diff --git a/tests/NetscapeBookmarkUtils/input/internet_explorer_encoding.htm b/tests/NetscapeBookmarkUtils/input/internet_explorer_encoding.htm
new file mode 100644
index 00000000..18703cf6
--- /dev/null
+++ b/tests/NetscapeBookmarkUtils/input/internet_explorer_encoding.htm
@@ -0,0 +1,9 @@
+<!DOCTYPE NETSCAPE-Bookmark-file-1>
+<!-- This is an automatically generated file.
+It will be read and overwritten.
+Do Not Edit! -->
+<TITLE>Bookmarks</TITLE>
+<H1>Bookmarks</H1>
+<DL><p>
+    <DT><A HREF="http://hginit.com/" ADD_DATE="1466271584" LAST_VISIT="1466271584" LAST_MODIFIED="1466271584" >Hg Init a Mercurial tutorial by Joel Spolsky</A>
+</DL><p>
diff --git a/tests/NetscapeBookmarkUtils/input/netscape_basic.htm b/tests/NetscapeBookmarkUtils/input/netscape_basic.htm
new file mode 100644
index 00000000..affe0cf8
--- /dev/null
+++ b/tests/NetscapeBookmarkUtils/input/netscape_basic.htm
@@ -0,0 +1,11 @@
+<!DOCTYPE NETSCAPE-Bookmark-file-1>
+<!-- This is an automatically generated file.
+It will be read and overwritten.
+Do Not Edit! -->
+<TITLE>Bookmarks</TITLE>
+<H1>Bookmarks</H1>
+<DL><p>
+<DT><A HREF="https://private.tld" ADD_DATE="10/Oct/2000:13:55:36 +0300" PRIVATE="1" TAGS="private secret">Secret stuff</A>
+<DD>Super-secret stuff you're not supposed to know about
+<DT><A HREF="http://public.tld" ADD_DATE="1456433748" PRIVATE="0" TAGS="public hello world">Public stuff</A>
+</DL><p>
diff --git a/tests/NetscapeBookmarkUtils/input/netscape_nested.htm b/tests/NetscapeBookmarkUtils/input/netscape_nested.htm
new file mode 100644
index 00000000..b486fe18
--- /dev/null
+++ b/tests/NetscapeBookmarkUtils/input/netscape_nested.htm
@@ -0,0 +1,31 @@
+<!DOCTYPE NETSCAPE-Bookmark-file-1>
+<!-- This is an automatically generated file.
+It will be read and overwritten.
+Do Not Edit! -->
+<TITLE>Bookmarks</TITLE>
+<H1>Bookmarks</H1>
+<DL><p>
+  <DT><A HREF="http://nest.ed/1" ADD_DATE="1456433741" PRIVATE="0" TAGS="tag1,tag2">Nested 1</A>
+  <DT><H3 ADD_DATE="1456433722" LAST_MODIFIED="1456433739">Folder1</H3>
+  <DL><p>
+    <DT><A HREF="http://nest.ed/1-1" ADD_DATE="1456433742" PRIVATE="0" TAGS="tag1,tag2">Nested 1-1</A>
+    <DT><A HREF="http://nest.ed/1-2" ADD_DATE="1456433747" PRIVATE="0" TAGS="tag3,tag4">Nested 1-2</A>
+  </DL><p>
+  <DT><H3 ADD_DATE="1456433722">Folder2</H3>
+  <DD>This second folder contains wonderful links!
+  <DL><p>
+    <DT><A HREF="http://nest.ed/2-1" ADD_DATE="1454433742" PRIVATE="1">Nested 2-1</A>
+    <DD>First link of the second section
+    <DT><A HREF="http://nest.ed/2-2" ADD_DATE="1453233747" PRIVATE="1">Nested 2-2</A>
+    <DD>Second link of the second section
+  </DL><p>
+  <DT><H3>Folder3</H3>
+  <DL><p>
+    <DT><H3>Folder3-1</H3>
+    <DL><p>
+      <DT><A HREF="http://nest.ed/3-1" ADD_DATE="1454433742" PRIVATE="0" TAGS="tag3">Nested 3-1</A>
+      <DT><A HREF="http://nest.ed/3-2" ADD_DATE="1453233747" PRIVATE="0">Nested 3-2</A>
+    </DL><p>
+  </DL><p>
+  <DT><A HREF="http://nest.ed/2" ADD_DATE="1456733741" PRIVATE="0" TAGS="tag4">Nested 2</A>
+</DL><p>
diff --git a/tests/NetscapeBookmarkUtils/input/no_doctype.htm b/tests/NetscapeBookmarkUtils/input/no_doctype.htm
new file mode 100644
index 00000000..766d398b
--- /dev/null
+++ b/tests/NetscapeBookmarkUtils/input/no_doctype.htm
@@ -0,0 +1,7 @@
+<TITLE>Bookmarks</TITLE>
+<H1>Bookmarks</H1>
+<DL><p>
+<DT><A HREF="https://private.tld" ADD_DATE="10/Oct/2000:13:55:36 +0300" PRIVATE="1" TAGS="private secret">Secret stuff</A>
+<DD>Super-secret stuff you're not supposed to know about
+<DT><A HREF="http://public.tld" ADD_DATE="1456433748" PRIVATE="0" TAGS="public hello world">Public stuff</A>
+</DL><p>
diff --git a/tests/NetscapeBookmarkUtils/input/same_date.htm b/tests/NetscapeBookmarkUtils/input/same_date.htm
new file mode 100644
index 00000000..9d58a582
--- /dev/null
+++ b/tests/NetscapeBookmarkUtils/input/same_date.htm
@@ -0,0 +1,11 @@
+<!DOCTYPE NETSCAPE-Bookmark-file-1>
+<!-- This is an automatically generated file.
+It will be read and overwritten.
+Do Not Edit! -->
+<TITLE>Bookmarks</TITLE>
+<H1>Bookmarks</H1>
+<DL><p>
+<DT><A HREF="https://fir.st" ADD_DATE="1456433748" PRIVATE="0">Today's first link</A>
+<DT><A HREF="https://seco.nd" ADD_DATE="1456433748" PRIVATE="0">Today's second link</A>
+<DT><A HREF="https://thi.rd" ADD_DATE="1456433748" PRIVATE="0">Today's third link</A>
+</DL><p>
diff --git a/tests/PluginManagerTest.php b/tests/PluginManagerTest.php
index f4826e2e..ddf48185 100644
--- a/tests/PluginManagerTest.php
+++ b/tests/PluginManagerTest.php
@@ -92,4 +92,4 @@ class PluginManagerTest extends PHPUnit_Framework_TestCase
        $this->assertEquals('test plugin', $meta[self::$pluginName]['description']);
        $this->assertEquals($expectedParameters, $meta[self::$pluginName]['parameters']);
    }
-}
-\ No newline at end of file
+}
diff --git a/tests/Updater/UpdaterTest.php b/tests/Updater/UpdaterTest.php
index 6bdce08b..0d0ad922 100644
--- a/tests/Updater/UpdaterTest.php
+++ b/tests/Updater/UpdaterTest.php
@@ -263,4 +263,28 @@ $GLOBALS[\'privateLinkByDefault\'] = true;';
        $expected = filemtime($this->conf->getConfigFileExt());
        $this->assertEquals($expected, $filetime);
    }
+    /**
+     * Test escapeUnescapedConfig with valid data.
+     */
+    public function testEscapeConfig()
+    {
+        $sandbox = 'sandbox/config';
+        copy(self::$configFile .'.json.php', $sandbox .'.json.php');
+        $this->conf = new ConfigManager($sandbox);
+        $title = '<script>alert("title");</script>';
+        $headerLink = '<script>alert("header_link");</script>';
+        $redirectorUrl = '<script>alert("redirector");</script>';
+        $this->conf->set('general.title', $title);
+        $this->conf->set('general.header_link', $headerLink);
+        $this->conf->set('redirector.url', $redirectorUrl);
+        $updater = new Updater(array(), array(), $this->conf, true);
+        $done = $updater->updateMethodEscapeUnescapedConfig();
+        $this->assertTrue($done);
+        $this->conf->reload();
+        $this->assertEquals(escape($title), $this->conf->get('general.title'));
+        $this->assertEquals(escape($headerLink), $this->conf->get('general.header_link'));
+        $this->assertEquals(escape($redirectorUrl), $this->conf->get('redirector.url'));
+        unlink($sandbox .'.json.php');
+    }
 }
diff --git a/tests/utils/ReferenceLinkDB.php b/tests/utils/ReferenceLinkDB.php
index fe16baac..fcc7a4f9 100644
--- a/tests/utils/ReferenceLinkDB.php
+++ b/tests/utils/ReferenceLinkDB.php
@@ -75,7 +75,7 @@ class ReferenceLinkDB
            '',
            1,
            '20121206_182539',
-            'dev cartoon'
+            'dev cartoon tag1  tag2   tag3  tag4   '
        );
    }
diff --git a/tests/utils/config/configInvalid.json.php b/tests/utils/config/configInvalid.json.php
index 167f2168..e39d640a 100644
--- a/tests/utils/config/configInvalid.json.php
+++ b/tests/utils/config/configInvalid.json.php
@@ -2,4 +2,4 @@
 {
    bad: bad,
 }
-*/ ?>
-\ No newline at end of file
+*/ ?>
diff --git a/tpl/import.html b/tpl/import.html
index 6c4f9421..071e1160 100644
--- a/tpl/import.html
+++ b/tpl/import.html
@@ -3,19 +3,31 @@
 <head>{include="includes"}</head>
 <body onload="document.uploadform.filetoupload.focus();">
 <div id="pageheader">
-        {include="page.header"}
+  {include="page.header"}
-        <div id="uploaddiv">
+  <div id="uploaddiv">
-        Import Netscape HTML bookmarks (as exported from Firefox/Chrome/Opera/Delicious/Diigo...) (Max: {$maxfilesize} bytes).
+    Import Netscape HTML bookmarks (as exported from Firefox/Chrome/Opera/Delicious/Diigo...) (Max: {$maxfilesize} bytes).
-        <form method="POST" action="?do=upload" enctype="multipart/form-data" name="uploadform" id="uploadform">
+    <form method="POST" action="?do=import" enctype="multipart/form-data"
-            <input type="hidden" name="token" value="{$token}">
+          name="uploadform" id="uploadform">
-            <input type="file" name="filetoupload">
+      <input type="hidden" name="token" value="{$token}">
-            <input type="hidden" name="MAX_FILE_SIZE" value="{$maxfilesize}">
+      <input type="hidden" name="MAX_FILE_SIZE" value="{$maxfilesize}">
-            <input type="submit" name="import_file" value="Import" class="bigbutton"><br>
+      <input type="file" name="filetoupload">
-            <input type="checkbox" name="private" id="private"><label for="private">&nbsp;Import all links as private</label><br>
+      <input type="submit" name="import_file" value="Import" class="bigbutton"><br>
-            <input type="checkbox" name="overwrite" id="overwrite"><label for="overwrite">&nbsp;Overwrite existing links</label>
-        </form>
+      <label for="privacy">&nbsp;Visibility:</label><br>
-        </div>
+      <input type="radio" name="privacy" value="default" checked="true">
+      &nbsp;Use values from the imported file, default to public<br>
+      <input type="radio" name="privacy" value="private">
+      &nbsp;Import all bookmarks as private<br>
+      <input type="radio" name="privacy" value="public">
+      &nbsp;Import all bookmarks as public<br>
+      <input type="checkbox" name="overwrite" id="overwrite">
+      <label for="overwrite">&nbsp;Overwrite existing bookmarks</label><br>
+      <label for="default_tags">&nbsp;Add default tags</label>
+      <input type="text" name="default_tags" id="default_tags">
+    </form>
+  </div>
 </div>
 {include="page.footer"}
 </body>
-</html>
-\ No newline at end of file
+</html>
diff --git a/tpl/tools.html b/tpl/tools.html
index 9e45caad..8e285f44 100644
--- a/tpl/tools.html
+++ b/tpl/tools.html
@@ -9,7 +9,7 @@
                <br><br>
                <a href="?do=pluginadmin"><b>Plugin administration</b><span>: Enable, disable and configure plugins.</span></a>
    <br><br>
-                {if="$openshaarli"}<a href="?do=changepasswd"><b>Change password</b><span>: Change your password.</span></a>
+                {if="!$openshaarli"}<a href="?do=changepasswd"><b>Change password</b><span>: Change your password.</span></a>
    <br><br>{/if}
                <a href="?do=changetag"><b>Rename/delete tags</b><span>: Rename or delete a tag in all links</span></a>
    <br><br>