CSS QoL

add option to also hide fav activity from public
add option for users to make their favorites private
2026-08-06 23:55:51 +02:00 · 2026-08-06 23:00:12 +02:00 · 2026-08-06 22:40:53 +02:00 · 2026-08-06 22:24:04 +02:00 · 2026-08-06 21:48:05 +02:00 · 2026-07-28 22:30:04 +02:00
54 changed files with 1794 additions and 606 deletions
--- a/.env.example
+++ b/.env.example
@@ -1,9 +1,9 @@
 POSTGRES_USER=f0ckm
 POSTGRES_DB=f0ckm
 POSTGRES_PASSWORD=f0ckm
-# --- Nginx & Let's Encrypt Configuration (Optional) ---
-# Set to 'f0ckm-nginx' to enable the Nginx & Let's Encrypt proxy stack
-# COMPOSE_PROFILES=f0ckm-nginx
+# --- Nginx & Tor Profiles (Optional) ---
+# Set to 'f0ckm-nginx' for Nginx, 'tor' for Tor hidden service, or 'f0ckm-nginx,tor' for both
+# COMPOSE_PROFILES=tor
 #
 # VIRTUAL_HOST=yourdomain.com
 # LETSENCRYPT_HOST=yourdomain.com
--- a/.gitignore
+++ b/.gitignore
@@ -18,3 +18,4 @@ public/tag_cache
 config.json
 bundle.css
 public/s/fonts/impact.woff
+f0ck-svelte/*
--- a/README.md
+++ b/README.md
@@ -78,3 +78,23 @@ now visit http://localhost:1337 in your browser, you can develop without needing
 ## NGINX

 uncomment in .env # COMPOSE_PROFILES=f0ckm-nginx to enable nginx proxy with automatic lets encrypt.
+
+## Tor Hidden Service (.onion)
+
+Tor is bundled in `docker-compose.yml` and preconfigured as long as COMPOSE_PROFILES=f0ckm-tor is set with a hidden service pointing to the application (`f0ckm:1337`).
+
+When running `docker compose up -d`, Tor automatically generates a `.onion` address for your node. You can find your onion address by running:
+
+```bash
+cat ./f0ckm-data/tor/f0ckm_hs/hostname
+```
+
+### Automatic Onion-Location Header
+
+To advertise your `.onion` address to Tor Browser users visiting your clearnet site, add your `.onion` address to `config.json`:
+
+```json
+"main": {
+  "onion": "http://yourgeneratedaddress.onion"
+}
+```
--- a/config/tor/torrc
+++ b/config/tor/torrc
@@ -0,0 +1,9 @@
+# Tor configuration for f0ckm
+
+# Enable SOCKS proxy for internal container & external connections
+SocksPort 0.0.0.0:9050
+
+# Tor Hidden Service (v3 Onion Service) configuration
+# Tor will automatically generate private keys and hostnames in /var/lib/tor/f0ckm_hs/
+HiddenServiceDir /var/lib/tor/f0ckm_hs/
+HiddenServicePort 80 f0ckm:1337
--- a/config_example.json
+++ b/config_example.json
@@ -5,6 +5,7 @@
      "domain": "example.com",
      "regex": "example\\.com"
    },
+    "onion": "http://your-onion-address.onion",
    "socks": "socks5://127.0.0.1:9050",
    "mail": "admin@example.com",
    "maxfilesize": 104857600,
@@ -53,12 +54,15 @@
      "amoled"
    ],
    "theme": "amoled",
+    "default_font": "",
    "default_layout": "legacy",
    "custom_favicon": "/s/img/favicon.gif",
    "custom_brand_image": [],
    "custom_navbar_brand_text": "",
    "show_koepfe": false,
+    "hide_sidebar_default": true,
    "koepfe": [],
+    "enable_tor_hs": true,
    "enable_global_chat": true,
    "enable_danmaku": true,
    "private_messages": true,
@@ -130,6 +134,8 @@
    "open_registration_require_mail_andor_token": false,
    "private_society": false,
    "private_society_gate": "cloudflare",
+    "private_society_gate_location": "Frankfurt",
+    "private_society_gate_template": "_gate_template",
    "public_nsfw": false,
    "paths": {
      "images": "/b",
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -49,9 +49,14 @@ services:
  tor:
    image: dockurr/tor
    container_name: tor
+    profiles:
+      - tor
    ports:
-      - "9050:9050"
-      - "8118:8118"
+      - "127.0.0.1:9050:9050"
+      - "127.0.0.1:8118:8118"
+    volumes:
+      - ./config/tor:/etc/tor:ro
+      - ./f0ckm-data/tor:/var/lib/tor:Z
    networks:
      - f0ckm-net
    restart: always
@@ -99,6 +104,8 @@ services:
    container_name: f0ckm-nginx
    profiles:
      - f0ckm-nginx
+    environment:
+      - ENABLE_IPV6=true
    ports:
      - "80:80"
      - "443:443"
--- a/migrations/add_favorites_private.sql
+++ b/migrations/add_favorites_private.sql
@@ -0,0 +1,5 @@
+-- Add favorites_private column to user_options table
+ALTER TABLE user_options
+    ADD COLUMN IF NOT EXISTS favorites_private boolean DEFAULT false;
+
+COMMENT ON COLUMN public.user_options.favorites_private IS 'When true, only the owner and administrators can view the user''s favorites list';
--- a/migrations/add_hide_fav_badge.sql
+++ b/migrations/add_hide_fav_badge.sql
@@ -0,0 +1,5 @@
+-- Add hide_fav_badge column to user_options table
+ALTER TABLE user_options
+    ADD COLUMN IF NOT EXISTS hide_fav_badge boolean DEFAULT false;
+
+COMMENT ON COLUMN public.user_options.favorites_private IS 'When true, the user''s favorite badge on item pages displays as a ghost icon without linking to their profile';
--- a/migrations/f0ckm_schema.sql
+++ b/migrations/f0ckm_schema.sql
@@ -1498,7 +1498,9 @@ CREATE TABLE public.user_options (
    receive_user_notifications boolean DEFAULT true,
    do_not_disturb boolean DEFAULT false,
    comment_display_mode integer DEFAULT 1,
-    force_comment_display_mode integer DEFAULT 0
+    force_comment_display_mode integer DEFAULT 0,
+    favorites_private boolean DEFAULT false,
+    hide_fav_badge boolean DEFAULT false
 );


--- a/public/s/css/f0ckm.css
+++ b/public/s/css/f0ckm.css
--- a/public/s/css/meme-creator.css
+++ b/public/s/css/meme-creator.css
@@ -13,8 +13,9 @@
 /* Meme Creator Styles */

 .meme-creator-container {
+    box-sizing: border-box !important;
    padding: 20px;
-    max-width: 1200px;
+    max-width: 1100px;
    width: 100%;
    margin: 0 auto;
    position: relative;
@@ -111,6 +112,7 @@

 .canvas-wrapper {
    flex: 1;
+    max-width: 650px;
    min-width: 0; /* Allow shrinking */
    background: #000;
    border: 2px solid var(--nav-bg, #2b2b2b);
@@ -238,22 +240,49 @@ canvas#memeCanvas {
    color: var(--white, #fff);
 }

-/* Mobile Stacking - Simple 2-Row Layout */
+/* Mobile Stacking - Clean Flexbox Column Layout */
@media (max-width: 950px) {
    .meme-editor-layout {
-        display: grid !important;
-        grid-template-columns: 1fr !important;
-        grid-template-rows: 0.6fr auto !important;
+        display: flex !important;
+        flex-direction: column !important;
+        align-items: center !important;
        gap: 20px;
    }
    .meme-controls {
+        box-sizing: border-box !important;
        width: 100% !important;
-        grid-row: 2;
+        max-width: 500px !important;
        overflow: visible !important;
    }
    .canvas-wrapper {
+        box-sizing: border-box !important;
        width: 100% !important;
-        grid-row: 1;
+        max-width: 650px !important;
+        margin-bottom: 10px;
+        overflow: visible !important;
+        height: auto !important;
+    }
+}
+
+/* Stack early when sidebar is open (sidebar is 300px, so 950 + 300 = 1250px)
+   This prevents the canvas from shrinking too much when the sidebar takes space. */
+@media (max-width: 1250px) {
+    body:not(.sidebar-right-hidden) .meme-editor-layout {
+        display: flex !important;
+        flex-direction: column !important;
+        align-items: center !important;
+        gap: 20px;
+    }
+    body:not(.sidebar-right-hidden) .meme-controls {
+        box-sizing: border-box !important;
+        width: 100% !important;
+        max-width: 500px !important;
+        overflow: visible !important;
+    }
+    body:not(.sidebar-right-hidden) .canvas-wrapper {
+        box-sizing: border-box !important;
+        width: 100% !important;
+        max-width: 650px !important;
        margin-bottom: 10px;
        overflow: visible !important;
        height: auto !important;
@@ -294,20 +323,19 @@ canvas#memeCanvas {

 /* Sidebar space reservation for meme pages */
 .meme-layout-wrapper {
+    box-sizing: border-box !important;
    width: 100%;
-    transition: padding-right 0.3s ease-in-out;
 }

-@media (min-width: 1200px) {
+@media (min-width: 1000px) {
    /* Reserve space for the fixed sidebar so content doesn't flow behind it */
-    .meme-layout-wrapper {
+    body:not(.sidebar-right-hidden) .meme-layout-wrapper {
        padding-right: 300px;
    }
-
-    /* Collapse reserved space when sidebar is hidden */
-    body.sidebar-right-hidden .meme-layout-wrapper {
-        padding-right: 0;
-    }
 }

+/* Collapse reserved space when sidebar is hidden */
+body.sidebar-right-hidden .meme-layout-wrapper {
+    padding-right: 0 !important;
+}

--- a/public/s/img/ghost_fav.svg
+++ b/public/s/img/ghost_fav.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100" width="100" height="100">
+  <rect width="100" height="100" fill="#242526"/>
+  <path d="M50 22 C37 22 28 32 28 45 L28 72 L35 66 L42 72 L50 66 L58 72 L65 66 L72 72 L72 45 C72 32 63 22 50 22 Z" fill="#666666" opacity="0.6"/>
+  <text x="50" y="58" font-family="system-ui, -apple-system, sans-serif" font-weight="bold" font-size="36" fill="#ffffff" text-anchor="middle">?</text>
+</svg>
--- a/public/s/js/admin.js
+++ b/public/s/js/admin.js
@@ -155,7 +155,13 @@
      postid,
      existingTags: tags,
      anchorEl: anchor,
-      onSubmit: async (tag) => post("/api/v2/tags/" + postid, { tagname: tag }),
+      onSubmit: async (tag) => {
+        const res = await post("/api/v2/tags/" + postid, { tagname: tag });
+        if (res.success && window.invalidateItemCache) {
+          window.invalidateItemCache(postid);
+        }
+        return res;
+      },
      renderTags
    });
  };
--- a/public/s/js/comments.js
+++ b/public/s/js/comments.js
@@ -54,7 +54,7 @@ class CommentSystem {
                document.body.classList.remove('sidebar-left-hidden');
                const layout = this.container.closest('.item-layout-container');
                if (layout) layout.classList.remove('sidebar-hidden');
-            } else if (isHidden) {
+            } else if (isHidden && (window.innerWidth >= 1000 || !document.body.classList.contains('layout-modern'))) {
                this.container.classList.add('faded-out');
                this.container.style.display = 'none';
                document.body.classList.add('sidebar-left-hidden');
@@ -120,24 +120,49 @@ class CommentSystem {
        if (!document.body.classList.contains('layout-legacy') && !document.body.classList.contains('legacy-view')) return;

        const updateBtn = () => {
-            if (!this.initialLoadDone) return;
-            
            const btn = document.querySelector('.scroll-to-bottom');
            if (!btn) return;

            const container = document.getElementById('comments-container');
            if (!container) return;

-            const rect = container.getBoundingClientRect();
-            // Detect if we are at the bottom of the comments section
-            // We also require window.scrollY > 50 to prevent flickering to 'scroll to top' 
-            // when the page first loads and images haven't fully pushed the container down yet.
-            const isAtBottom = (rect.bottom < window.innerHeight + 100) && (window.scrollY > 50);
+            const currentlyAtBottom = btn.classList.contains('is-at-bottom');
+            let isAtBottom = currentlyAtBottom;

-            if (isAtBottom) {
+            // Base the bottom state primarily on whether the input box / end-of-thread marker is visible
+            const bottomElement = container.querySelector('.main-input') || container.querySelector('.lock-notice') || container.querySelector('.login-placeholder');
+            
+            if (bottomElement) {
+                const bottomRect = bottomElement.getBoundingClientRect();
+                if (currentlyAtBottom) {
+                    // We are pointing UP. Switch to DOWN if we scroll significantly UP away from bottomElement
+                    if (bottomRect.top > window.innerHeight + 250) {
+                        isAtBottom = false;
+                    }
+                } else {
+                    // We are pointing DOWN. Switch to UP if bottomElement enters viewport or we scroll past it
+                    if (bottomRect.top <= window.innerHeight + 50) {
+                        isAtBottom = true;
+                    }
+                }
+            } else {
+                // Fallback to container rect if no bottom element
+                const rect = container.getBoundingClientRect();
+                if (currentlyAtBottom) {
+                    if (rect.bottom > window.innerHeight + 250) {
+                        isAtBottom = false;
+                    }
+                } else {
+                    if (rect.bottom <= window.innerHeight + 50) {
+                        isAtBottom = true;
+                    }
+                }
+            }
+
+            if (isAtBottom && !currentlyAtBottom) {
                btn.classList.add('is-at-bottom');
                btn.setAttribute('title', 'Scroll to top');
-            } else {
+            } else if (!isAtBottom && currentlyAtBottom) {
                btn.classList.remove('is-at-bottom');
                btn.setAttribute('title', 'Scroll to bottom');
            }
@@ -571,7 +596,7 @@ class CommentSystem {
                if (cached) cached.content = fullContent;
            }

-            contentEl.dataset.raw = this.escapeHtml(fullContent);
+            contentEl.dataset.raw = fullContent;
            contentEl.innerHTML = this.renderCommentContent(fullContent, commentId);
            CommentSystem.autoplayConvertedGifs(contentEl);
            CommentSystem.playEmojiVideos(contentEl);
@@ -597,6 +622,7 @@ class CommentSystem {

        const contentEl = el.querySelector('.comment-content');
        if (contentEl) {
+            contentEl.dataset.raw = data.content;
            contentEl.innerHTML = this.renderCommentContent(data.content, data.comment_id);
            CommentSystem.autoplayConvertedGifs(contentEl);
            CommentSystem.playEmojiVideos(contentEl);
@@ -677,7 +703,6 @@ class CommentSystem {
                this.render(comments, this.user, initialIsSubscribed);
                this.initialLoadDone = true;
                this.restoreState(state);
-                if (this.scrollHandler) this.scrollHandler();
                this._loadDanmaku(comments);

                if (scrollToId) {
@@ -748,7 +773,6 @@ class CommentSystem {
                    this.reconcile(data.comments, data.user_id, data.is_subscribed);
                    this.initialLoadDone = true;
                    this.restoreState(state);
-                    if (this.scrollHandler) this.scrollHandler();

                    if (scrollToId) {
                        this.preservingScroll = false;
@@ -778,7 +802,6 @@ class CommentSystem {
                this.render(data.comments, data.user_id, data.is_subscribed);
                this.initialLoadDone = true;
                this.restoreState(state);
-                if (this.scrollHandler) this.scrollHandler();
                this._loadDanmaku(data.comments);

                if (scrollToId) {
@@ -835,26 +858,14 @@ class CommentSystem {
     * border-right) is fully restored after the effect completes.
     *
     * @param {Element} el       - The .comment element to animate.
-     * @param {boolean} entering - True to also add 'comment-entering' (own post);
-     *                             false for 'new-item-fade' only (live others).
+     * @param {boolean} entering - Unused (kept for compatibility).
     */
    static _animateNewComment(el, entering = false) {
        if (!el) return;
-
-        const classes = entering
-            ? ['comment-entering', 'new-item-fade']
-            : ['new-item-fade'];
-
-        // Reset in case the element already has a stale animation
-        classes.forEach(c => el.classList.remove(c));
-        void el.offsetWidth; // force reflow so re-adding the class restarts the animation
-
-        classes.forEach(c => el.classList.add(c));
-
-        const cleanup = () => {
-            classes.forEach(c => el.classList.remove(c));
-        };
-        el.addEventListener('animationend', cleanup, { once: true });
+        el.classList.add('new-item-fade');
+        setTimeout(() => {
+            el.classList.remove('new-item-fade');
+        }, 2500);
    }


@@ -870,7 +881,6 @@ class CommentSystem {
            if (el) {
                // Remove highlight from any previously highlighted or newly-posted comment
                document.querySelectorAll('.comment-highlighted').forEach(c => c.classList.remove('comment-highlighted'));
-                document.querySelectorAll('.comment-entering').forEach(c => c.classList.remove('comment-entering'));
                document.querySelectorAll('.new-item-fade').forEach(c => c.classList.remove('new-item-fade'));

                // Always smooth-scroll so there's no jarring jump
@@ -1016,7 +1026,7 @@ class CommentSystem {
        preview.dataset.id = targetId;

        // Remove temporary animation/highlight classes
-        preview.classList.remove('new-item-fade', 'comment-highlighted', 'comment-entering');
+        preview.classList.remove('new-item-fade', 'comment-highlighted');

        // Remove input forms or action buttons
        const actions = preview.querySelector('.comment-actions');
@@ -1150,12 +1160,13 @@ class CommentSystem {
            const author = openerEl.dataset.display || openerEl.dataset.username || 'System';
            const contentEl = body.querySelector('.comment-content');
            if (contentEl) {
-                const LINE_MAX = 200;
-                const rawText = (contentEl.dataset.raw || '').trim();
-                // Preserve all lines but cap any single line exceeding LINE_MAX chars
-                const lines = rawText.split('\n').map(line =>
-                    line.length > LINE_MAX ? line.substring(0, LINE_MAX) + '\u2026' : line
-                );
+                let rawText = (contentEl.dataset.raw || '').trim();
+                if (rawText.includes('&gt;') || rawText.includes('&lt;') || rawText.includes('&amp;')) {
+                    const txt = document.createElement('textarea');
+                    txt.innerHTML = rawText;
+                    rawText = txt.value;
+                }
+                const lines = rawText.split('\n');
                const quote = `>>${id} \n>${author}\n${lines.map(line => `>${line}`).join('\n')}\n`;

                if (isNew) {
@@ -1610,18 +1621,26 @@ class CommentSystem {
        syncLevel(roots, list, false);
    }

-    // Maximum characters to fully render in the item view per comment
-    static get ITEM_VIEW_MAX_CHARS() { return 2000; }
+    // Maximum characters & lines to fully render in the item view per comment
+    static get ITEM_VIEW_MAX_CHARS() { return 500; }
+    static get ITEM_VIEW_MAX_LINES() { return 6; }

    renderCommentContent(content, commentId = null, bypassTruncation = false) {
        if (!content) return '';

-        // Truncate extremely long comments before any processing
+        // Truncate long comments before any processing
        let truncated = false;
-        if (!bypassTruncation && content.length > CommentSystem.ITEM_VIEW_MAX_CHARS) {
-            content = content.substring(0, CommentSystem.ITEM_VIEW_MAX_CHARS) + '\u2026';
+        if (!bypassTruncation) {
+            const lines = content.split('\n');
+            if (lines.length > CommentSystem.ITEM_VIEW_MAX_LINES) {
+                content = lines.slice(0, CommentSystem.ITEM_VIEW_MAX_LINES).join('\n');
                truncated = true;
            }
+            if (content.length > CommentSystem.ITEM_VIEW_MAX_CHARS) {
+                content = content.substring(0, CommentSystem.ITEM_VIEW_MAX_CHARS);
+                truncated = true;
+            }
+        }

        if (typeof marked === 'undefined') {
            console.warn('Marked.js not loaded, falling back to plain text');
@@ -1769,9 +1788,10 @@ class CommentSystem {
                if (trimmed.startsWith('>') && !trimmed.match(/^>>\d+/)) {
                    const quoteContent = line.substring(line.indexOf('>') + 1);
                    const quoteEmojis = window.f0ckSession?.quote_emojis === true;
+                    const escapedQuote = quoteContent.replace(/>/g, '&gt;');
                    const renderedContent = quoteEmojis
-                        ? quoteContent.replace(/:([a-z0-9_]+):/g, (m, n) => this.renderEmoji(m, n))
-                        : quoteContent;
+                        ? escapedQuote.replace(/:([a-z0-9_]+):/g, (m, n) => this.renderEmoji(m, n))
+                        : escapedQuote;
                    return `<span class="greentext">&gt;${renderedContent}</span>`;
                }

@@ -2177,7 +2197,7 @@ class CommentSystem {
        if (!unsafe) return '';
        const div = document.createElement('div');
        div.textContent = unsafe;
-        return div.innerHTML;
+        return div.innerHTML.replace(/"/g, '&quot;').replace(/'/g, '&#39;');
    }

    renderCommentAttachments(files, content = '') {
@@ -3314,9 +3334,15 @@ class CommentSystem {
                    params.append('has_poll', '1');
                }

+                const csrfToken = window.f0ckSession?.csrf_token || '';
+                if (csrfToken) params.append('csrf_token', csrfToken);
+
                const res = await fetch('/api/comments', {
                    method: 'POST',
-                    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                    headers: {
+                        'Content-Type': 'application/x-www-form-urlencoded',
+                        ...(csrfToken ? { 'X-CSRF-Token': csrfToken } : {})
+                    },
                    body: params
                });

@@ -3582,9 +3608,9 @@ class CommentSystem {
    // element whenever the raw content exceeds ITEM_VIEW_MAX_CHARS. Called after every
    // optimistic DOM insert to guarantee the button regardless of rendering path.
    _ensureTruncationButton(commentEl, rawContent) {
-        console.log('[ensureBtn] called, rawContent.length:', rawContent?.length, 'threshold:', CommentSystem.ITEM_VIEW_MAX_CHARS);
-        if (!rawContent || rawContent.length <= CommentSystem.ITEM_VIEW_MAX_CHARS) {
-            console.log('[ensureBtn] below threshold, skipping');
+        if (!rawContent) return;
+        const lineCount = rawContent.split('\n').length;
+        if (rawContent.length <= CommentSystem.ITEM_VIEW_MAX_CHARS && lineCount <= CommentSystem.ITEM_VIEW_MAX_LINES) {
            return;
        }
        const contentEl = commentEl.querySelector('.comment-content');
@@ -3786,6 +3812,14 @@ class CommentSystem {
    toggleComments() {
        if (!this.container) return;

+        if (document.body.classList.contains('layout-modern')) {
+            if (window.innerWidth < 1000) return;
+            if (typeof window.toggleSidebarLeft === 'function') {
+                window.toggleSidebarLeft();
+                return;
+            }
+        }
+
        const layout = this.container.closest('.item-layout-container');
        const sidebar = this.container.closest('.item-sidebar-left');
        const siblings = sidebar ? [
@@ -4430,20 +4464,71 @@ class CommentSystem {
                    }, { passive: true });
                };

-                // Helper: reliable touch handling for tab buttons on mobile
-                const addTabTouch = (btn, cb) => {
+                // Helper: reliable touch handling for tab buttons on mobile (supports hold-to-action)
+                let lastHoldTime = 0;
+                const addTabTouch = (btn, cb, onHold) => {
                    let ts = null;
+                    let holdTimer = null;
+                    let holdFired = false;
                    btn.addEventListener('touchstart', (e) => {
+                        holdFired = false;
                        ts = { x: e.touches[0].clientX, y: e.touches[0].clientY };
+                        if (onHold) {
+                            holdTimer = setTimeout(() => {
+                                holdFired = true;
+                                lastHoldTime = Date.now();
+                                try { navigator.vibrate?.(40); } catch(err) {}
+                                onHold();
+                            }, 500);
+                        }
                        e.stopPropagation();
                    }, { passive: true });
+
+                    btn.addEventListener('touchmove', (e) => {
+                        if (!ts) return;
+                        const dx = Math.abs(e.touches[0].clientX - ts.x);
+                        const dy = Math.abs(e.touches[0].clientY - ts.y);
+                        if (dx > 10 || dy > 10) {
+                            clearTimeout(holdTimer);
+                            ts = null;
+                        }
+                    }, { passive: true });
+
                    btn.addEventListener('touchend', (e) => {
+                        clearTimeout(holdTimer);
+                        if (holdFired) {
+                            e.preventDefault();
+                            e.stopPropagation();
+                            holdFired = false;
+                            ts = null;
+                            return;
+                        }
                        if (!ts) return;
                        const dx = Math.abs(e.changedTouches[0].clientX - ts.x);
                        const dy = Math.abs(e.changedTouches[0].clientY - ts.y);
                        ts = null;
                        if (dx < 10 && dy < 10) { e.preventDefault(); cb(); }
                    });
+
+                    btn.addEventListener('touchcancel', () => {
+                        clearTimeout(holdTimer);
+                        holdFired = false;
+                        ts = null;
+                    });
+                };
+
+                const toggleFavDefault = (tabEl) => {
+                    const KEY = 'f0ck_emoji_default_tab';
+                    const isDefault = localStorage.getItem(KEY) === '__favs__';
+                    if (isDefault) {
+                        localStorage.removeItem(KEY);
+                        tabEl.classList.remove('ep-tab-default');
+                        window._showEmojiToast?.('Favorites unset as default tab');
+                    } else {
+                        localStorage.setItem(KEY, '__favs__');
+                        tabEl.classList.add('ep-tab-default');
+                        window._showEmojiToast?.('Favorites set as default tab');
+                    }
                };

                // Build tab buttons — Favorites first
@@ -4455,23 +4540,13 @@ class CommentSystem {
                favTab.innerHTML = '<i class="fa-solid fa-star" style="color:var(--emoji-fav-color,#f5c518);font-size:1.1em;"></i>';
                favTab.addEventListener('mousedown', e => e.preventDefault());
                favTab.addEventListener('click', () => showTab('__favs__'));
-                addTabTouch(favTab, () => showTab('__favs__'));
+                addTabTouch(favTab, () => showTab('__favs__'), () => toggleFavDefault(favTab));
                // Right-click on fav tab → set/unset as default
                favTab.addEventListener('contextmenu', (e) => {
                    e.preventDefault();
                    e.stopPropagation();
-                    if (navigator.maxTouchPoints > 0) return;
-                    const KEY = 'f0ck_emoji_default_tab';
-                    const isDefault = localStorage.getItem(KEY) === '__favs__';
-                    if (isDefault) {
-                        localStorage.removeItem(KEY);
-                        favTab.classList.remove('ep-tab-default');
-                        window._showEmojiToast?.('Favorites unset as default tab');
-                    } else {
-                        localStorage.setItem(KEY, '__favs__');
-                        favTab.classList.add('ep-tab-default');
-                        window._showEmojiToast?.('Favorites set as default tab');
-                    }
+                    if (Date.now() - lastHoldTime < 1000) return;
+                    toggleFavDefault(favTab);
                });
                // Mark as default if already set
                if (localStorage.getItem('f0ck_emoji_default_tab') === '__favs__') {
--- a/public/s/js/f0ck_upload_init.js
+++ b/public/s/js/f0ck_upload_init.js
@@ -46,11 +46,19 @@
        return;
    }

+    // Mark internal drags to prevent them from triggering the dropzone
+    window.addEventListener('dragstart', (e) => {
+        if (e.dataTransfer) {
+            e.dataTransfer.setData('application/x-f0ck-internal', 'true');
+        }
+    });
+
    // Global Drag Events
    window.addEventListener('dragenter', (e) => {
        e.preventDefault();
        if (window.location.pathname === '/upload') return;
-        if (e.dataTransfer.types.includes('Files')) {
+        if (e.dataTransfer && e.dataTransfer.types.includes('application/x-f0ck-internal')) return;
+        if (e.dataTransfer && e.dataTransfer.types.includes('Files')) {
            dragCounter++;
            dropOverlay.classList.add('active');
        }
@@ -59,10 +67,17 @@
    window.addEventListener('dragover', (e) => {
        e.preventDefault();
        if (window.location.pathname === '/upload') return;
+        if (e.dataTransfer && e.dataTransfer.types.includes('application/x-f0ck-internal')) {
+            // Change dropEffect to none to indicate this dropzone doesn't accept internal elements
+            e.dataTransfer.dropEffect = 'none';
+        }
    });

    window.addEventListener('dragleave', (e) => {
        if (window.location.pathname === '/upload') return;
+        // dragleave doesn't always have reliable dataTransfer.types, but if it does, check it
+        if (e.dataTransfer && e.dataTransfer.types.includes('application/x-f0ck-internal')) return;
+        
        dragCounter--;
        if (dragCounter <= 0) {
            dragCounter = 0;
@@ -72,6 +87,8 @@

    window.addEventListener('drop', (e) => {
        if (window.location.pathname === '/upload') return;
+        if (e.dataTransfer && e.dataTransfer.types.includes('application/x-f0ck-internal')) return;
+        
        e.preventDefault();
        dragCounter = 0;
        dropOverlay.classList.remove('active');
--- a/public/s/js/f0ckm.js
+++ b/public/s/js/f0ckm.js
@@ -2301,15 +2301,55 @@ window.cancelAnimFrame = (function () {
    let hiddenValue = localStorage.getItem('sidebarRightHidden');
    let hidden;
    if (hiddenValue === null) {
-      hidden = false; // Default to visible on all devices
+      hidden = (window.f0ckSession && window.f0ckSession.hide_sidebar_default) ? true : false; // Default based on config
      localStorage.setItem('sidebarRightHidden', hidden);
    } else {
      hidden = hiddenValue === 'true';
    }
    document.body.classList.toggle('sidebar-right-hidden', hidden);
+
+    // Always force-hide on very small screens regardless of saved preference
+    if (window.innerWidth <= 599) {
+      document.body.classList.add('sidebar-right-hidden');
+    }
  };
  window.initSidebarRightToggle();

+  // Auto-hide sidebar on very small screens (≤599px), restore on wider
+  (() => {
+    const mq = window.matchMedia('(max-width: 599px)');
+    const applyBreakpoint = (e) => {
+      // Freeze transitions so the class change is instant (no sliding during resize)
+      const sidebar = document.querySelector('.global-sidebar-right, .item-sidebar-right, .index-sidebar-right');
+      const wrappers = document.querySelectorAll('.index-layout-wrapper, .item-layout-container, .pagination-container-fluid, .pagewrapper');
+      if (sidebar) sidebar.style.setProperty('transition', 'none', 'important');
+      wrappers.forEach(w => w.style.setProperty('transition', 'none', 'important'));
+
+      if (e.matches) {
+        // Entering narrow: force-hide without touching localStorage
+        document.body.classList.add('sidebar-right-hidden');
+      } else {
+        // Leaving narrow: restore from saved preference
+        const saved = localStorage.getItem('sidebarRightHidden');
+        const hidden = saved === 'true';
+        document.body.classList.toggle('sidebar-right-hidden', hidden);
+      }
+
+      // Force reflow then restore transitions
+      if (sidebar) void sidebar.offsetWidth;
+      requestAnimationFrame(() => {
+        if (sidebar) sidebar.style.removeProperty('transition');
+        wrappers.forEach(w => {
+          w.style.removeProperty('transition');
+          w.style.removeProperty('padding-right');
+          w.style.removeProperty('right');
+        });
+      });
+    };
+    mq.addEventListener('change', applyBreakpoint);
+    applyBreakpoint(mq); // run once on init
+  })();
+
  const loadPageAjax = async (url, replace = true, options = {}) => {
    if (isNavigating) return;

@@ -2603,6 +2643,10 @@ window.cancelAnimFrame = (function () {
      if (isFav) ajaxUrl += `&fav=true`;
      if (mime) ajaxUrl += `&mime=${encodeURIComponent(mime)}`;

+      // Preserve tagger filter from URL query string
+      const taggerMatch = urlObj.searchParams.get('tagger');
+      if (taggerMatch) ajaxUrl += `&tagger=${encodeURIComponent(taggerMatch)}`;
+
      const isRandom = document.cookie.includes('random_mode=1') || url.includes('random=1') || window.location.search.includes('random=1');
      if (isRandom) ajaxUrl += `&random=1`;
      const isStrict = window.f0ckSession?.strict_mode || (localStorage.getItem('search_strict') === 'true');
@@ -3144,6 +3188,9 @@ window.cancelAnimFrame = (function () {
      window.location.href = url; // Fallback
    } finally {
      isNavigating = false;
+      if (replace && document.activeElement && document.activeElement !== document.body) {
+          document.activeElement.blur();
+      }
      if (navbar) navbar.classList.remove("pbwork");
      if (window.updateStrictLinks && window.f0ckSession) window.updateStrictLinks(window.f0ckSession.strict_mode);
    }
@@ -3324,10 +3371,15 @@ window.cancelAnimFrame = (function () {
    const itemid = numericSegments.pop();

    // Extract context from Target URL first
-    let tag = null, user = null, isFavs = false, mime = null, hall = null, userHall = null, userHallOwner = null;
+    let tag = null, user = null, isFavs = false, mime = null, hall = null, userHall = null, userHallOwner = null, tagger = null;
    const tagMatch = url.match(/\/tag\/([^/?]+)/);
    if (tagMatch) tag = decodeURIComponent(tagMatch[1]);

+    // Tagger filter from query string
+    const taggerUrlObj = new URL(url, window.location.origin);
+    const taggerParam = taggerUrlObj.searchParams.get('tagger');
+    if (taggerParam) tagger = decodeURIComponent(taggerParam);
+
    // User hall: /user/:owner/hall/:slug/:id
    const userHallMatch = url.match(/\/user\/([^/]+)\/hall\/([^/]+)/);
    if (userHallMatch) {
@@ -3365,6 +3417,10 @@ window.cancelAnimFrame = (function () {
        const wTagMatch = window.location.href.match(/\/tag\/([^/?]+)/);
        if (wTagMatch) tag = decodeURIComponent(wTagMatch[1]);
      }
+      if (!tagger) {
+        const wTaggerParam = new URL(window.location.href).searchParams.get('tagger');
+        if (wTaggerParam) tagger = decodeURIComponent(wTaggerParam);
+      }
      if (!user && !userHall) {
        const wUserMatch = window.location.href.match(/\/user\/([^/?]+)/);
        if (wUserMatch && !window.location.href.match(/\/user\/[^/]+\/hall\//) ) {
@@ -3400,6 +3456,7 @@ window.cancelAnimFrame = (function () {
      } else if (user) {
        params.append('user', user);
      }
+      if (tagger) params.append('tagger', tagger);
      if (isFavs) params.append('fav', 'true');

      const isStrict = window.f0ckSession?.strict_mode || (localStorage.getItem('search_strict') === 'true');
@@ -3499,6 +3556,7 @@ window.cancelAnimFrame = (function () {
        else if (user)  { _pushUrl = `/user/${encodeURIComponent(user)}/${itemid}`; if (isFavs) _pushUrl = `/user/${encodeURIComponent(user)}/favs/${itemid}`; }
        else if (tag)   _pushUrl = `/tag/${encodeURIComponent(tag).replace(/%2C/g,',').replace(/%20/g,' ')}/${itemid}`;
        else if (hall)  _pushUrl = `/h/${encodeURIComponent(hall).replace(/%20/g,' ')}/${itemid}`;
+        if (tagger && tag) _pushUrl += `?tagger=${encodeURIComponent(tagger)}`;
        if (mime) _pushUrl = _pushUrl.replace(new RegExp(`/${itemid}$`), `/${mime}/${itemid}`);
        if (_hash) _pushUrl += _hash;

@@ -3701,6 +3759,8 @@ window.cancelAnimFrame = (function () {
      }
      else if (tag) pushUrl = `/tag/${encodeURIComponent(tag).replace(/%2C/g, ',').replace(/%20/g, ' ')}/${itemid}`;
      else if (hall) pushUrl = `/h/${encodeURIComponent(hall).replace(/%20/g, ' ')}/${itemid}`;
+      // Append tagger filter so item nav stays in tagger context
+      if (tagger && tag) pushUrl += `?tagger=${encodeURIComponent(tagger)}`;
      
      if (mime) {
          // If it already has itemid at the end, insert mime before it
@@ -4407,6 +4467,10 @@ window.cancelAnimFrame = (function () {
            if (window.renderTags) {
              window.renderTags(res.tags);
            }
+            // Evict the cached item HTML so navigating back fetches fresh content
+            if (window.invalidateItemCache) {
+              window.invalidateItemCache(postid);
+            }
          } else {
            revert();
            window.flashMessage('Error: ' + (res.msg || 'Failed to update rating'), 3000, 'error');
@@ -6257,8 +6321,10 @@ window.cancelAnimFrame = (function () {
        if (settled) return;
        settled = true;

-        // Freeze all transitions (override CSS !important) so the class toggle
-        // doesn't trigger an additional right-property animation.
+        // Freeze sidebar AND wrapper transitions so the class toggle
+        // doesn't trigger a second padding-right animation.
+        const wrappers = getSidebarWrappers();
+        wrappers.forEach(w => w.style.setProperty('transition', 'none', 'important'));
        sidebar.style.setProperty('transition', 'none', 'important');

        if (stateChanging) {
@@ -6276,6 +6342,11 @@ window.cancelAnimFrame = (function () {
        // Restore CSS-controlled transitions on the next frame
        requestAnimationFrame(() => {
          sidebar.style.removeProperty('transition');
+          wrappers.forEach(w => {
+            w.style.removeProperty('transition');
+            w.style.removeProperty('padding-right');
+            w.style.removeProperty('right');
+          });
          swipeRT.isDraggingSidebar = false;
        });
      };
@@ -6402,22 +6473,13 @@ window.cancelAnimFrame = (function () {
    const sidebar = document.querySelector('.global-sidebar-right, .item-sidebar-right, .index-sidebar-right');
    if (!sidebar) return;

-    mouseRT.active = true;
-    mouseRT.isDragging = false;
-    mouseRT.isCandidate = false;
-    mouseRT.xDown = e.clientX;
-    mouseRT.yDown = e.clientY;
-    mouseRT.xDiff = 0;
-    mouseRT.yDiff = 0;
-    mouseRT.timeDown = Date.now();
-    mouseRT.sidebarEl = sidebar;
-    mouseRT.sidebarWidth = sidebar.offsetWidth;
-
    const isHidden = document.body.classList.contains('sidebar-right-hidden');
+    let candidate = false;
+
    if (isHidden) {
      // Open zone: 80px from right edge
      if (e.clientX > window.innerWidth - 30) {
-        mouseRT.isCandidate = true;
+        candidate = true;
      }
    } else {
      // Close: only from the left-edge grab strip (first 16px of sidebar) OR the edgeZone overhang
@@ -6425,9 +6487,22 @@ window.cancelAnimFrame = (function () {
      const sidebarLeft = sidebar.getBoundingClientRect().left;
      const inGrabStrip = e.clientX >= sidebarLeft && e.clientX <= sidebarLeft + 16;
      if (inGrabStrip || e.target === dragZone) {
+        candidate = true;
+      }
+    }
+
+    if (!candidate) return;
+
+    mouseRT.active = true;
+    mouseRT.isDragging = false;
    mouseRT.isCandidate = true;
-      }
-    }
+    mouseRT.xDown = e.clientX;
+    mouseRT.yDown = e.clientY;
+    mouseRT.xDiff = 0;
+    mouseRT.yDiff = 0;
+    mouseRT.timeDown = Date.now();
+    mouseRT.sidebarEl = sidebar;
+    mouseRT.sidebarWidth = sidebar.offsetWidth;
  });

  document.addEventListener('mousemove', e => {
@@ -6447,6 +6522,8 @@ window.cancelAnimFrame = (function () {
        window.getSelection()?.removeAllRanges(); // clear any selection that formed before threshold
      } else if (absY > absX) {
        mouseRT.isCandidate = false; // Scrolling — bail
+        mouseRT.active = false;
+        return;
      }
    }

@@ -6507,6 +6584,10 @@ window.cancelAnimFrame = (function () {
    const settle = () => {
      if (settled) return;
      settled = true;
+      // Freeze sidebar AND wrapper transitions so the class toggle
+      // doesn't trigger a second padding-right animation.
+      const wrappers = getSidebarWrappers();
+      wrappers.forEach(w => w.style.setProperty('transition', 'none', 'important'));
      sidebar.style.setProperty('transition', 'none', 'important');

      if (stateChanging) {
@@ -6519,6 +6600,11 @@ window.cancelAnimFrame = (function () {
      sidebar.style.transform = '';
      requestAnimationFrame(() => {
        sidebar.style.removeProperty('transition');
+        wrappers.forEach(w => {
+          w.style.removeProperty('transition');
+          w.style.removeProperty('padding-right');
+          w.style.removeProperty('right');
+        });
      });
    };

@@ -6586,15 +6672,55 @@ window.cancelAnimFrame = (function () {
  });
  window.addEventListener('resize', syncEdgeZone, { passive: true });

-  // Touchend on edgeZone: instant tap-to-toggle (no 300ms synthetic click delay)
+  // Returns true if (clientX, clientY) is within the pill's hit area.
+  // The pill is #sidebar-drag-zone::after — 4×40px, centered on pointer:fine,
+  // right-aligned with padding-right:6px on pointer:coarse.
+  const isWithinPillArea = (clientX, clientY) => {
+    const rect = edgeZone.getBoundingClientRect();
+    const pillH = 40;
+    const hitPad = 12; // generous padding so it's easy to hit
+    // Vertical: pill is always centered in the drag zone
+    const pillCenterY = rect.top + rect.height / 2;
+    if (clientY < pillCenterY - pillH / 2 - hitPad || clientY > pillCenterY + pillH / 2 + hitPad) return false;
+    // Horizontal: right-aligned on touch, centered on mouse
+    const isCoarse = window.matchMedia('(pointer: coarse)').matches;
+    const pillCenterX = isCoarse ? rect.right - 6 - 2 : rect.left + rect.width / 2;
+    return clientX >= pillCenterX - 2 - hitPad && clientX <= pillCenterX + 2 + hitPad;
+  };
+
+  // Touchend: tap on the pill toggles sidebar; rest of drag zone only responds to swipe
  edgeZone.addEventListener('touchend', e => {
-    // Only if it was a clean tap (no significant swipe movement)
    if (Math.abs(swipeRT.xDiff || 0) < 15 && Math.abs(swipeRT.yDiff || 0) < 15) {
-      e.preventDefault();
-      edgeZone.dispatchEvent(new Event('click'));
+      e.preventDefault(); // always prevent 300ms synthetic click
+      const touch = e.changedTouches[0];
+      if (touch && isWithinPillArea(touch.clientX, touch.clientY)) {
+        window.toggleSidebarRight();
+      }
    }
  }, { passive: false });

+  // Helper: all layout wrappers that have padding-right animated by sidebar state
+  const getSidebarWrappers = () => {
+    // At ≤999px: sidebar is a pure overlay — only pagination tracks it.
+    if (window.innerWidth <= 599) {
+      return document.querySelectorAll('.pagination-container-fluid');
+    }
+    // At ≥600px: exclude pagewrapper when a dedicated layout wrapper is present.
+    // CSS already zeroes pagewrapper.padding-right via :has on those pages,
+    // so including it here causes double-padding (pagewrapper + index-layout-wrapper both
+    // get 300px snapped, making the grid 600px too narrow, then jumping back on settle).
+    const hasDedicatedWrapper = !!(
+      document.querySelector('.index-layout-wrapper') ||
+      document.querySelector('.item-layout-container') ||
+      document.querySelector('.meme-layout-wrapper') ||
+      document.querySelector('.messages-convo-page')
+    );
+    const sel = hasDedicatedWrapper
+      ? '.index-layout-wrapper, .meme-layout-wrapper, .messages-convo-page, .pagination-container-fluid'
+      : '.pagination-container-fluid, .pagewrapper';
+    return document.querySelectorAll(sel);
+  };
+
  // Smoothly toggle sidebar open/closed
  window.toggleSidebarRight = () => {
    const sidebar = document.querySelector('.global-sidebar-right, .item-sidebar-right, .index-sidebar-right');
@@ -6604,6 +6730,29 @@ window.cancelAnimFrame = (function () {
    const sidebarWidth = sidebar.offsetWidth || 300;
    const targetTranslate = isHidden ? -sidebarWidth : sidebarWidth;

+    // At ≤599px the sidebar is a pure overlay — never animate wrapper padding
+    const animateWrappers = window.innerWidth > 599;
+
+    // Grid/pagewrapper: snap instantly in both directions (no animated reflow).
+    // Pagination always animates — it tracks sidebar position with no reflow cost.
+    const wrappers = getSidebarWrappers();
+    if (animateWrappers) {
+      wrappers.forEach(w => {
+        const isPagination = w.classList.contains('pagination-container-fluid');
+        const isMessages = w.classList.contains('messages-convo-page');
+        
+        const prop = (isPagination || isMessages) ? 'right' : 'padding-right';
+        const targetVal = isHidden ? sidebarWidth + 'px' : '0px';
+        
+        // Lightweight layouts (pagination, messages) animate smoothly.
+        // Heavy/reflow-intensive layouts snap instantly to avoid reflow lag.
+        const shouldAnimate = (isPagination || isMessages);
+        w.style.setProperty('transition', shouldAnimate ? `${prop} 0.3s ease-in-out` : 'none', 'important');
+        w.style.setProperty(prop, targetVal, 'important');
+      });
+      void sidebar.offsetWidth; // settle layout before sidebar transform begins
+    }
+
    sidebar.style.setProperty('transition', 'transform 0.3s ease-in-out', 'important');
    sidebar.style.transform = `translateX(${targetTranslate}px)`;

@@ -6611,13 +6760,22 @@ window.cancelAnimFrame = (function () {
    const settle = () => {
      if (settled) return;
      settled = true;
+      // Freeze wrapper transitions so the class commit doesn't re-trigger them
+      wrappers.forEach(w => w.style.setProperty('transition', 'none', 'important'));
      sidebar.style.setProperty('transition', 'none', 'important');
      const toHidden = !isHidden;
      document.body.classList.toggle('sidebar-right-hidden', toHidden);
      localStorage.setItem('sidebarRightHidden', toHidden);
      void sidebar.offsetWidth;
      sidebar.style.transform = '';
-      requestAnimationFrame(() => sidebar.style.removeProperty('transition'));
+      requestAnimationFrame(() => {
+        sidebar.style.removeProperty('transition');
+        wrappers.forEach(w => {
+          w.style.removeProperty('transition');
+          w.style.removeProperty('padding-right');
+          w.style.removeProperty('right');
+        });
+      });
    };

    const onEnd = ev => {
@@ -6629,9 +6787,11 @@ window.cancelAnimFrame = (function () {
    setTimeout(settle, 350);
  };

-  // Click on edgeZone: smoothly toggle sidebar open/closed
-  edgeZone.addEventListener('click', () => {
+  // Click on edgeZone: only toggle when the click lands on the pill
+  edgeZone.addEventListener('click', (e) => {
+    if (isWithinPillArea(e.clientX, e.clientY)) {
      window.toggleSidebarRight();
+    }
  });
  // </mouse-sidebar-drag>

@@ -6651,7 +6811,9 @@ window.cancelAnimFrame = (function () {
    });

    const isLSActive = () =>
-      document.body.classList.contains('layout-modern') && !!document.querySelector('.item-sidebar-left');
+      document.body.classList.contains('layout-modern') &&
+      !!document.querySelector('.item-sidebar-left') &&
+      window.innerWidth >= 1000;

    // Prepare sidebar for drag — keeps it in the CSS grid so overflow:hidden clips translateX.
    // OPEN: removes sidebar-hidden/display:none, places sidebar at translateX(-sw), reflows twice.
@@ -6887,7 +7049,10 @@ window.cancelAnimFrame = (function () {
    // ── Edge zone & sync ────────────────────────────────────────────────────
    const syncLeftEdgeZone = () => {
      const { sb, layout } = getLS();
-      if (!sb || !layout || !document.body.classList.contains('layout-modern')) {
+      // The left drag zone only applies to the 3-column desktop grid (≥1000px).
+      // On mobile the sidebar becomes in-flow, so hide the zone to avoid it
+      // landing next to the right-sidebar drag zone on narrow screens.
+      if (!sb || !layout || !document.body.classList.contains('layout-modern') || window.innerWidth < 1000) {
        leftEdgeZone.style.display = 'none';
        leftEdgeZone.style.pointerEvents = 'none';
        return;
@@ -6907,6 +7072,7 @@ window.cancelAnimFrame = (function () {
    };

    window.toggleSidebarLeft = () => {
+      if (window.innerWidth < 1000) return;
      const { sb, layout } = getLS();
      if (!sb || !layout) return;
      const isHidden = layout.classList.contains('sidebar-hidden');
@@ -6944,6 +7110,19 @@ window.cancelAnimFrame = (function () {
  // Export loaders for external systems (like NotificationSystem)
  window.loadPageAjax = loadPageAjax;
  window.loadItemAjax = loadItemAjax;
+
+  // Invalidate all itemCacheMap entries that contain a given item ID.
+  // Call this after mutating an item (e.g. adding a tag) so the next
+  // AJAX navigation fetches fresh HTML instead of serving stale cache.
+  window.invalidateItemCache = (itemId) => {
+    if (!itemId) return;
+    const needle = `/${itemId}`;
+    for (const key of itemCacheMap.keys()) {
+      if (key.includes(needle)) {
+        itemCacheMap.delete(key);
+      }
+    }
+  };
  // Continued...

 const sbtForm = document.getElementById('sbtForm');
@@ -7388,30 +7567,49 @@ class NotificationSystem {

    // Helper: apply a display name change to all relevant DOM nodes
    this.applyDisplayNameUpdate = (display_name, user) => {
+      const isSelf = !user || (window.f0ckSession?.user && user.toLowerCase() === window.f0ckSession.user.toLowerCase());
+
      // Capture old value before overwriting — needed for thumb matching below
-      const oldDisplayName = window.f0ckSession?.display_name || null;
-      if (window.f0ckSession) window.f0ckSession.display_name = display_name || null;
+      const oldDisplayName = isSelf ? (window.f0ckSession?.display_name || null) : null;
+      if (isSelf && window.f0ckSession) {
+        window.f0ckSession.display_name = display_name || null;
+      }
      
      const userName = user || window.f0ckSession?.user;

-      // Update ALL nav-display-name instances (handles the profile page having a duplicate ID)
+      // Update navbar display name only if this update is for the logged-in user
+      if (isSelf) {
        document.querySelectorAll('#nav-display-name').forEach(nameSpan => {
-        // preserve the badges (Admin, Mod)
          for (let i = nameSpan.childNodes.length - 1; i >= 0; i--) {
            let node = nameSpan.childNodes[i];
            if (node.nodeType === Node.TEXT_NODE && node.nodeValue.trim().length > 0) {
-            // Match and preserve any non-breaking spaces at the start (from admin/mod badges)
              const match = node.nodeValue.match(new RegExp('^(\\s*)(.*)'));
              node.nodeValue = (match ? match[1] : '') + (display_name || userName || '');
              break;
            }
          }
        });
+      }

+      // Update profile header display name if currently viewing this user's profile
+      const profileBox = document.getElementById('live-profile-preview-box');
+      if (profileBox && profileBox.dataset.bannerUser && userName && profileBox.dataset.bannerUser.toLowerCase() === userName.toLowerCase()) {
+        const profileNameSpan = document.getElementById('profile-display-name');
+        if (profileNameSpan) {
+          for (let i = profileNameSpan.childNodes.length - 1; i >= 0; i--) {
+            let node = profileNameSpan.childNodes[i];
+            if (node.nodeType === Node.TEXT_NODE && node.nodeValue.trim().length > 0) {
+              const match = node.nodeValue.match(new RegExp('^(\\s*)(.*)'));
+              node.nodeValue = (match ? match[1] : '') + (display_name || userName || '');
+              break;
+            }
+          }
+        }
        const bracket = document.getElementById('username-bracket');
        if (bracket) {
          bracket.style.display = display_name ? 'inline' : 'none';
        }
+      }

      if (userName) {
        const lowerHref = `/user/${userName.toLowerCase()}`;
@@ -7437,6 +7635,7 @@ class NotificationSystem {

    // Helper: apply a username color change to relevant DOM nodes
    this.applyUsernameColorUpdate = (username_color, user) => {
+      const isSelf = !user || (window.f0ckSession?.user && user.toLowerCase() === window.f0ckSession.user.toLowerCase());
      const userName = user || window.f0ckSession?.user;
      if (!userName) return;

@@ -7483,22 +7682,21 @@ class NotificationSystem {
        }
      });

-      // Special case for settings page preview block
-      if (window.f0ckSession && userName === window.f0ckSession.user) {
-        const previewBlock = document.getElementById('live-profile-preview-box');
-        if (previewBlock) {
+      // Profile header display name color (if currently viewing this user's profile)
+      const profileBox = document.getElementById('live-profile-preview-box');
+      if (profileBox && profileBox.dataset.bannerUser && profileBox.dataset.bannerUser.toLowerCase() === userName.toLowerCase()) {
+        const profileNameSpan = document.getElementById('profile-display-name');
+        if (profileNameSpan) {
          if (username_color) {
-            previewBlock.style.setProperty('--author-accent', username_color);
-            previewBlock.style.setProperty('--author-border', username_color);
+            profileNameSpan.style.color = username_color;
          } else {
-            previewBlock.style.setProperty('--author-accent', 'var(--accent)');
-            previewBlock.style.setProperty('--author-border', 'var(--accent)');
+            profileNameSpan.style.removeProperty('color');
          }
        }
      }

-      // Handle the nav-display-name span elements (profile header and top navbar)
-      if (window.f0ckSession && userName === window.f0ckSession.user) {
+      // Navbar display name color (only for current user)
+      if (isSelf) {
        document.querySelectorAll('#nav-display-name').forEach(el => {
          if (username_color) {
            el.style.color = username_color;
@@ -7511,14 +7709,21 @@ class NotificationSystem {

    // Helper: apply an avatar update to relevant DOM nodes
    this.applyAvatarUpdate = (avatar_file, user) => {
+      const isSelf = !user || (window.f0ckSession?.user && user.toLowerCase() === window.f0ckSession.user.toLowerCase());
      const userName = user || window.f0ckSession?.user;
      if (!userName) return;

      const newSrc = avatar_file ? `/a/${avatar_file}?t=${Date.now()}` : '/a/default.png';

-      // Update Nav Avatar & profile header Avatar (only for current user)
-      if (window.f0ckSession && userName === window.f0ckSession.user) {
-        document.querySelectorAll('.nav-avatar-img, .profile_head_avatar img').forEach(img => img.src = newSrc);
+      // Update Nav Avatar only for current user
+      if (isSelf) {
+        document.querySelectorAll('.nav-avatar-img').forEach(img => img.src = newSrc);
+      }
+
+      // Update profile header avatar if currently viewing this user's profile
+      const profileBox = document.getElementById('live-profile-preview-box');
+      if (profileBox && profileBox.dataset.bannerUser && profileBox.dataset.bannerUser.toLowerCase() === userName.toLowerCase()) {
+        document.querySelectorAll('.profile_head_avatar img').forEach(img => img.src = newSrc);
      }

      // Update globally (comments, sidebar, polls, rank, infoboxes, favs)
@@ -8563,6 +8768,21 @@ class NotificationSystem {
    // Build DOM nodes imperatively (avoids Sanitizer stripping inline border-color)
    const fragment = document.createDocumentFragment();
    data.favs.forEach(fav => {
+      if (fav.hide_fav_badge) {
+        const a = document.createElement('a');
+        a.className = 'ghost-fav';
+        a.setAttribute('tooltip', 'Ghost Fav');
+        a.setAttribute('flow', 'up');
+        a.style.cursor = 'default';
+
+        const img = document.createElement('img');
+        img.src = '/s/img/ghost_fav.svg';
+        img.style.height = '32px';
+        img.style.width = '32px';
+
+        a.appendChild(img);
+        fragment.appendChild(a);
+      } else {
        const avatarUrl = fav.avatar_file
          ? `/a/${fav.avatar_file}`
          : (fav.avatar ? `/t/${fav.avatar}.webp` : '/a/default.png');
@@ -8580,6 +8800,7 @@ class NotificationSystem {

        a.appendChild(img);
        fragment.appendChild(a);
+      }
    });

    favsContainer.innerHTML = '';
@@ -9382,22 +9603,24 @@ document.addEventListener('DOMContentLoaded', () => {
    };
    window.startHoverPreview = startPreview;

-    document.addEventListener('mouseover', (e) => {
+    const handleEnter = (e) => {
        const thumb = e.target.closest('.thumb');
-        
-        // If we are hovering a thumb, and it's NOT the active one
        if (thumb && thumb !== activeThumb) {
             startPreview(thumb, 150);
        }
-    });
+    };
+    document.addEventListener('mouseover', handleEnter);
+    document.addEventListener('focusin', handleEnter);

-    document.addEventListener('mouseout', (e) => {
+    const handleLeave = (e) => {
        const thumb = e.target.closest('.thumb');
        if (thumb) {
-            if (e.relatedTarget && thumb.contains(e.relatedTarget)) return;
+            if (e.type === 'mouseout' && e.relatedTarget && thumb.contains(e.relatedTarget)) return;
            clearPreview();
        }
-    });
+    };
+    document.addEventListener('mouseout', handleLeave);
+    document.addEventListener('focusout', handleLeave);

    // Touch handling to support "tap to activate" behavior
    // 1. First tap: Activate (visuals + preview) AND prevent navigation
@@ -10188,14 +10411,21 @@ document.addEventListener('DOMContentLoaded', () => {
                    return;
                }
                // Only expand if the image is actually being clipped (not fully visible).
-                // Compare the image's rendered height to its natural height —
-                // if rendered >= natural, the image already fits fully in the box.
                const img = wrapper.querySelector('img#f0ck-image');
-                if (img && img.complete && img.naturalHeight > 0) {
+                if (img && img.complete && img.naturalHeight > 0 && img.naturalWidth > 0) {
                    const rendered = img.getBoundingClientRect();
-                    // Allow a 2px tolerance for subpixel rounding
+                    
+                    // Calculate the max height the image can take given the container width
+                    const expandedHeight = rendered.width * (img.naturalHeight / img.naturalWidth);
+                    
                    if (rendered.height + 2 >= img.naturalHeight) {
-                        // Fully visible — do nothing (no expand needed, no modal)
+                        // Image is unscaled or upscaled. No detail to gain by expanding.
+                        return;
+                    }
+                    
+                    if (rendered.height + 2 >= expandedHeight) {
+                        // Expanding inline will not increase display size because it is width-constrained.
+                        openImageModal(elfe.href);
                        return;
                    }
                }
@@ -11268,3 +11498,90 @@ document.addEventListener('click', (e) => {
    }
  }, true);
 })();
+
+// --- Grid Keyboard Accessibility ---
+document.addEventListener('keydown', (e) => {
+  const isTab = e.key === 'Tab';
+  const isArrow = ['ArrowUp', 'ArrowDown', 'ArrowLeft', 'ArrowRight'].includes(e.key);
+  if (!isTab && !isArrow) return;
+
+  const thumbs = Array.from(document.querySelectorAll('.posts .thumb'));
+  if (thumbs.length === 0) return;
+
+  if (isTab && document.activeElement === document.body) {
+    e.preventDefault();
+    thumbs[0].focus();
+    return;
+  }
+
+  const active = document.activeElement;
+  if (isArrow && active && active.classList.contains('thumb')) {
+    const activeRect = active.getBoundingClientRect();
+    const activeCenter = {
+      x: activeRect.left + activeRect.width / 2,
+      y: activeRect.top + activeRect.height / 2
+    };
+
+    let bestMatch = null;
+    let minDistance = Infinity;
+
+    thumbs.forEach(thumb => {
+      if (thumb === active) return;
+      
+      const rect = thumb.getBoundingClientRect();
+      if (rect.width === 0 && rect.height === 0) return;
+
+      const center = {
+        x: rect.left + rect.width / 2,
+        y: rect.top + rect.height / 2
+      };
+
+      const dxCenter = center.x - activeCenter.x;
+      const dyCenter = center.y - activeCenter.y;
+      const absDx = Math.abs(dxCenter);
+      const absDy = Math.abs(dyCenter);
+
+      let isCandidate = false;
+      let primaryDist = 0;
+      let secondaryGap = 0;
+
+      if (e.key === 'ArrowRight') {
+        // Must be to the right, and within a 60 degree cone
+        isCandidate = dxCenter > 0 && absDx >= absDy * 0.5;
+        primaryDist = absDx;
+        // Gap on the Y axis. If they overlap, gap is 0
+        secondaryGap = Math.max(0, Math.max(activeRect.top, rect.top) - Math.min(activeRect.bottom, rect.bottom));
+      } else if (e.key === 'ArrowLeft') {
+        isCandidate = dxCenter < 0 && absDx >= absDy * 0.5;
+        primaryDist = absDx;
+        secondaryGap = Math.max(0, Math.max(activeRect.top, rect.top) - Math.min(activeRect.bottom, rect.bottom));
+      } else if (e.key === 'ArrowDown') {
+        isCandidate = dyCenter > 0 && absDy >= absDx * 0.5;
+        primaryDist = absDy;
+        secondaryGap = Math.max(0, Math.max(activeRect.left, rect.left) - Math.min(activeRect.right, rect.right));
+      } else if (e.key === 'ArrowUp') {
+        isCandidate = dyCenter < 0 && absDy >= absDx * 0.5;
+        primaryDist = absDy;
+        secondaryGap = Math.max(0, Math.max(activeRect.left, rect.left) - Math.min(activeRect.right, rect.right));
+      }
+
+      if (isCandidate) {
+        // Massive penalty for gap to force it to pick overlapping items (same row/col)
+        // Tiny penalty for center misalignment so ties are broken cleanly
+        const centerMisalignment = (e.key === 'ArrowLeft' || e.key === 'ArrowRight') ? absDy : absDx;
+        const distance = primaryDist + (secondaryGap * 15) + (centerMisalignment * 0.1);
+        
+        if (distance < minDistance) {
+          minDistance = distance;
+          bestMatch = thumb;
+        }
+      }
+    });
+
+    if (bestMatch) {
+      e.preventDefault();
+      bestMatch.focus();
+      bestMatch.scrollIntoView({ behavior: 'smooth', block: 'nearest' });
+    }
+  }
+});
--- a/public/s/js/messages.js
+++ b/public/s/js/messages.js
@@ -1976,6 +1976,73 @@ if (window.__dmLoaded) {
            dmGridArea = document.createElement('div');
            dmGridArea.className = 'emoji-picker-grid';

+            // Helper: reliable touch handling for tab buttons on mobile (supports hold-to-action)
+            let lastDmHoldTime = 0;
+            const addDmTabTouch = (btn, cb, onHold) => {
+                let ts = null;
+                let holdTimer = null;
+                let holdFired = false;
+                btn.addEventListener('touchstart', (e) => {
+                    holdFired = false;
+                    ts = { x: e.touches[0].clientX, y: e.touches[0].clientY };
+                    if (onHold) {
+                        holdTimer = setTimeout(() => {
+                            holdFired = true;
+                            lastDmHoldTime = Date.now();
+                            try { navigator.vibrate?.(40); } catch(err) {}
+                            onHold();
+                        }, 500);
+                    }
+                    e.stopPropagation();
+                }, { passive: true });
+
+                btn.addEventListener('touchmove', (e) => {
+                    if (!ts) return;
+                    const dx = Math.abs(e.touches[0].clientX - ts.x);
+                    const dy = Math.abs(e.touches[0].clientY - ts.y);
+                    if (dx > 10 || dy > 10) {
+                        clearTimeout(holdTimer);
+                        ts = null;
+                    }
+                }, { passive: true });
+
+                btn.addEventListener('touchend', (e) => {
+                    clearTimeout(holdTimer);
+                    if (holdFired) {
+                        e.preventDefault();
+                        e.stopPropagation();
+                        holdFired = false;
+                        ts = null;
+                        return;
+                    }
+                    if (!ts) return;
+                    const dx = Math.abs(e.changedTouches[0].clientX - ts.x);
+                    const dy = Math.abs(e.changedTouches[0].clientY - ts.y);
+                    ts = null;
+                    if (dx < 10 && dy < 10) { e.preventDefault(); cb(); }
+                });
+
+                btn.addEventListener('touchcancel', () => {
+                    clearTimeout(holdTimer);
+                    holdFired = false;
+                    ts = null;
+                });
+            };
+
+            const toggleDmFavDefault = (tabEl) => {
+                const KEY = 'f0ck_emoji_default_tab';
+                const isDefault = localStorage.getItem(KEY) === '__favs__';
+                if (isDefault) {
+                    localStorage.removeItem(KEY);
+                    tabEl.classList.remove('ep-tab-default');
+                    window._showEmojiToast?.('Favorites unset as default tab');
+                } else {
+                    localStorage.setItem(KEY, '__favs__');
+                    tabEl.classList.add('ep-tab-default');
+                    window._showEmojiToast?.('Favorites set as default tab');
+                }
+            };
+
            // ── Favorites tab ──
            const favsTab = document.createElement('button');
            favsTab.className = 'ep-tab ep-tab-favs';
@@ -1985,22 +2052,13 @@ if (window.__dmLoaded) {
            favsTab.innerHTML = '<i class="fa-solid fa-star" style="font-size:14px;color:var(--emoji-fav-color,#f5c518);"></i>';
            favsTab.addEventListener('mousedown', e => e.preventDefault());
            favsTab.addEventListener('click', () => showDmTab('__favs__', packs));
+            addDmTabTouch(favsTab, () => showDmTab('__favs__', packs), () => toggleDmFavDefault(favsTab));
            // Right-click on fav tab → set/unset as default
            favsTab.addEventListener('contextmenu', (e) => {
                e.preventDefault();
                e.stopPropagation();
-                if (navigator.maxTouchPoints > 0) return;
-                const KEY = 'f0ck_emoji_default_tab';
-                const isDefault = localStorage.getItem(KEY) === '__favs__';
-                if (isDefault) {
-                    localStorage.removeItem(KEY);
-                    favsTab.classList.remove('ep-tab-default');
-                    window._showEmojiToast?.('Favorites unset as default tab');
-                } else {
-                    localStorage.setItem(KEY, '__favs__');
-                    favsTab.classList.add('ep-tab-default');
-                    window._showEmojiToast?.('Favorites set as default tab');
-                }
+                if (Date.now() - lastDmHoldTime < 1000) return;
+                toggleDmFavDefault(favsTab);
            });
            // Mark as default if already set
            if (localStorage.getItem('f0ck_emoji_default_tab') === '__favs__') {
@@ -2028,6 +2086,7 @@ if (window.__dmLoaded) {
                }
                tab.addEventListener('mousedown', e => e.preventDefault());
                tab.addEventListener('click', () => showDmTab(pack.id ?? null, packs));
+                addDmTabTouch(tab, () => showDmTab(pack.id ?? null, packs));
                dmTabBar.appendChild(tab);
            });

--- a/public/s/js/scroller.js
+++ b/public/s/js/scroller.js
@@ -1000,9 +1000,10 @@
            e.stopPropagation();
            const itemId = slide.dataset.id;
            try {
+              const csrfToken = window.f0ckSession?.csrf_token || window.scrollerCsrf || '';
              const resp = await fetch(`/api/v2/tags/${itemId}/${encodeURIComponent(tag)}`, {
                method: 'DELETE',
-                headers: { 'x-csrf-token': window.scrollerCsrf || '' }
+                headers: { ...(csrfToken ? { 'X-CSRF-Token': csrfToken } : {}) }
              });
              const data = await resp.json();
              if (data.success) pill.remove();
@@ -1157,10 +1158,14 @@
      if (nowFaved) flashFav(slide);
    }
    try {
+      const csrfToken = window.f0ckSession?.csrf_token || window.scrollerCsrf || '';
      const resp = await fetch('/api/v2/togglefav', {
        method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-        body: `postid=${id}`
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          ...(csrfToken ? { 'X-CSRF-Token': csrfToken } : {})
+        },
+        body: `postid=${id}${csrfToken ? `&csrf_token=${encodeURIComponent(csrfToken)}` : ''}`
      });
      const data = await resp.json();
      // Sync count to server truth (handles race conditions)
@@ -1582,9 +1587,10 @@
          e.stopPropagation();
          const itemId = slide.dataset.id;
          try {
+            const csrfToken = window.f0ckSession?.csrf_token || window.scrollerCsrf || '';
            const resp = await fetch(`/api/v2/tags/${itemId}/${encodeURIComponent(t)}`, {
              method: 'DELETE',
-              headers: { 'x-csrf-token': window.scrollerCsrf || '' }
+              headers: { ...(csrfToken ? { 'X-CSRF-Token': csrfToken } : {}) }
            });
            const data = await resp.json();
            if (data.success) pill.remove();
@@ -1688,7 +1694,7 @@
              avatar: '/a/default.png',
              stamp: p.time,
              timeago: timeAgo(p.time * 1000),
-              tags: `4chan, /${data.board}/`,
+              tags: ``,
              is_video: isVideo,
              is_image: isImage,
              is_audio: false,
@@ -1850,16 +1856,17 @@
    else if (item.external_board === 'gif') rating = 'nsfw';

    try {
+      const csrfToken = window.f0ckSession?.csrf_token || window.scrollerCsrf || '';
      const resp = await fetch('/api/v2/scroller/rehost', {
        method: 'POST',
        headers: { 
          'Content-Type': 'application/x-www-form-urlencoded',
-          'x-csrf-token': window.scrollerCsrf || ''
+          ...(csrfToken ? { 'X-CSRF-Token': csrfToken } : {})
        },
        body: new URLSearchParams({
          url: item.external_media_url || item.dest,
          rating: rating,
-          tags: '4chan',
+          tags: '',
          comment: `Rehosted from 4chan thread: ${applied.externalUrl || 'unknown'}`,
          ...(item.original_filename ? { original_filename: item.original_filename } : {})
        })
@@ -1966,9 +1973,10 @@
      showShareToast(info.toast);
    }

+    const csrfToken = window.f0ckSession?.csrf_token || window.scrollerCsrf || '';
    fetch(`/api/v2/tags/${id}/cycle-rating`, {
      method: 'PUT',
-      headers: { 'x-csrf-token': window.scrollerCsrf || '' }
+      headers: { ...(csrfToken ? { 'X-CSRF-Token': csrfToken } : {}) }
    })
      .then(r => r.json())
      .then(data => {
@@ -2119,7 +2127,12 @@
    const contentEl = commentEl.querySelector('.comment-content');
    if (!contentEl) return;

-    const raw = (contentEl.dataset.raw || '').replace(/<br\s*\/?>/gi, '\n').trim();
+    let raw = (contentEl.dataset.raw || '').replace(/<br\s*\/?>/gi, '\n').trim();
+    if (raw.includes('&gt;') || raw.includes('&lt;') || raw.includes('&amp;')) {
+      const txt = document.createElement('textarea');
+      txt.innerHTML = raw;
+      raw = txt.value;
+    }
    const lines = raw.split('\n');
    const quote = `>>${id}\n${lines.map(line => `>${line}`).join('\n')}\n`;

@@ -2787,11 +2800,16 @@
      if (!content || !commentsItemId || commentsPosting) return;
      commentsPosting = true; commentSendBtn.disabled = true;
      try {
+        const csrfToken = window.f0ckSession?.csrf_token || window.scrollerCsrf || '';
        let postBody = `item_id=${commentsItemId}&content=${encodeURIComponent(content)}`;
        if (replyToCommentId) postBody += `&parent_id=${replyToCommentId}`;
+        if (csrfToken) postBody += `&csrf_token=${encodeURIComponent(csrfToken)}`;
        const resp = await fetch('/api/comments', {
          method: 'POST',
-          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+          headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+            ...(csrfToken ? { 'X-CSRF-Token': csrfToken } : {})
+          },
          body: postBody
        });
        const data = await resp.json();
@@ -2899,10 +2917,14 @@
    if (addTagSendBtn) addTagSendBtn.disabled = true;
    closeSugg();
    try {
+      const csrfToken = window.f0ckSession?.csrf_token || window.scrollerCsrf || '';
      const resp = await fetch(`/api/v2/tags/${targetId}`, {
        method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-        body: `tagname=${encodeURIComponent(tag)}`
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          ...(csrfToken ? { 'X-CSRF-Token': csrfToken } : {})
+        },
+        body: `tagname=${encodeURIComponent(tag)}${csrfToken ? `&csrf_token=${encodeURIComponent(csrfToken)}` : ''}`
      });
      const data = await resp.json();
      if (data.success) {
@@ -3658,7 +3680,11 @@
      if (sMarkAll) {
        sMarkAll.addEventListener('click', async () => {
          try {
-            await fetch('/api/notifications/read', { method: 'POST' });
+            const csrfToken = window.f0ckSession?.csrf_token || window.scrollerCsrf || '';
+            await fetch('/api/notifications/read', {
+              method: 'POST',
+              headers: { ...(csrfToken ? { 'X-CSRF-Token': csrfToken } : {}) }
+            });
            updateScrollerNotifBadge(0);
            sCachedNotifs = sCachedNotifs.map(n => ({ ...n, is_read: true }));
            updateScrollerTabBadges(sCachedNotifs);
@@ -3673,7 +3699,12 @@
        if (!item) return;
        const nid = item.dataset.id;
        if (nid && item.classList.contains('unread')) {
-          fetch(`/api/notifications/${nid}/read`, { method: 'POST', keepalive: true }).catch(() => {});
+          const csrfToken = window.f0ckSession?.csrf_token || window.scrollerCsrf || '';
+          fetch(`/api/notifications/${nid}/read`, {
+            method: 'POST',
+            keepalive: true,
+            headers: { ...(csrfToken ? { 'X-CSRF-Token': csrfToken } : {}) }
+          }).catch(() => {});
          item.classList.remove('unread');
          // Update cache
          const cached = sCachedNotifs.find(n => String(n.id) === String(nid));
--- a/public/s/js/settings.js
+++ b/public/s/js/settings.js
@@ -1119,6 +1119,68 @@
        });
    }

+    const favsPrivateToggle = document.getElementById('favorites_private_toggle');
+    if (favsPrivateToggle) {
+        favsPrivateToggle.addEventListener('change', async () => {
+            const favorites_private = favsPrivateToggle.checked;
+            try {
+                const res = await fetch('/api/v2/settings/favorites_private', {
+                    method: 'PUT',
+                    headers: {
+                        'Content-Type': 'application/x-www-form-urlencoded',
+                        'X-CSRF-Token': window.f0ckSession ? window.f0ckSession.csrf_token : ''
+                    },
+                    body: new URLSearchParams({ favorites_private })
+                });
+                const data = await res.json();
+                if (data.success) {
+                    showStatus('Favorites privacy preference updated!', 'success');
+                    if (window.f0ckSession) {
+                        window.f0ckSession.favorites_private = favorites_private;
+                    }
+                } else {
+                    alert(data.msg || 'Error saving preference');
+                    favsPrivateToggle.checked = !favorites_private; // Revert
+                }
+            } catch (err) {
+                console.error('Update Favorites Privacy error:', err);
+                alert('Connection error');
+                favsPrivateToggle.checked = !favorites_private; // Revert
+            }
+        });
+    }
+
+    const hideFavBadgeToggle = document.getElementById('hide_fav_badge_toggle');
+    if (hideFavBadgeToggle) {
+        hideFavBadgeToggle.addEventListener('change', async function() {
+            const hide_fav_badge = hideFavBadgeToggle.checked;
+            try {
+                const res = await fetch('/api/v2/settings/hide_fav_badge', {
+                    method: 'PUT',
+                    headers: {
+                        'Content-Type': 'application/x-www-form-urlencoded',
+                        'X-CSRF-Token': window.f0ckSession ? window.f0ckSession.csrf_token : ''
+                    },
+                    body: new URLSearchParams({ hide_fav_badge })
+                });
+                const data = await res.json();
+                if (data.success) {
+                    showStatus('Hide favorite badge preference updated!', 'success');
+                    if (window.f0ckSession) {
+                        window.f0ckSession.hide_fav_badge = hide_fav_badge;
+                    }
+                } else {
+                    alert(data.msg || 'Error saving preference');
+                    hideFavBadgeToggle.checked = !hide_fav_badge;
+                }
+            } catch (err) {
+                console.error('Update Hide Fav Badge error:', err);
+                alert('Connection error');
+                hideFavBadgeToggle.checked = !hide_fav_badge;
+            }
+        });
+    }
+
    // New Dual Column Layout Toggle
    const layoutToggle = document.getElementById('use_new_layout_toggle');
    if (layoutToggle) {
--- a/public/s/js/sidebar-activity.js
+++ b/public/s/js/sidebar-activity.js
@@ -47,7 +47,7 @@
        if (!unsafe) return '';
        const div = document.createElement('div');
        div.textContent = unsafe;
-        return div.innerHTML;
+        return div.innerHTML.replace(/"/g, '&quot;').replace(/'/g, '&#39;');
    };

    const playSidebarEmojiVideos = (container) => {
@@ -153,12 +153,6 @@
    const renderCommentContent = (content, commentId = null, itemId = null) => {
        if (!content) return '';

-        // Truncate extremely long comments before any processing to keep the sidebar
-        // fast and the DOM lean, regardless of markdown / regex complexity.
-        if (content.length > SIDEBAR_CONTENT_TRUNCATE) {
-            content = content.substring(0, SIDEBAR_CONTENT_TRUNCATE) + '\u2026';
-        }
-
        if (typeof marked === 'undefined') {
            return escapeHtml(content)
                .replace(/:([a-z0-9_]+):/g, (m, n) => renderEmoji(m, n));
@@ -268,9 +262,10 @@
                    // Manual greentext handling — apply emoji if the user preference allows it
                    const quoteContent = line.substring(line.indexOf('>') + 1);
                    const quoteEmojis = window.f0ckSession?.quote_emojis === true;
+                    const escapedQuote = quoteContent.replace(/>/g, '&gt;');
                    const rendered = quoteEmojis
-                        ? quoteContent.replace(/:([a-z0-9_]+):/g, (m, n) => renderEmoji(m, n))
-                        : quoteContent;
+                        ? escapedQuote.replace(/:([a-z0-9_]+):/g, (m, n) => renderEmoji(m, n))
+                        : escapedQuote;
                    return `<span class="greentext">&gt;${rendered}</span>`;
                }

@@ -496,8 +491,8 @@
                || rawContent.split('\n').length > 2 
                || (c.files && c.files.length > 0);
        }
-        // Always force isLong if there are inline media tags that expand vertically
-        if (!isLong && (/\[(video|audio|youtube|img)\]|!\[|https?:\/\//i.test(rawContent) || displayContent.includes('<video') || displayContent.includes('<img'))) {
+        // Always force isLong if there are inline media tags that expand vertically or files are attached
+        if (!isLong && ((c.files && c.files.length > 0) || /\[(video|audio|youtube|img)\]|!\[|https?:\/\//i.test(rawContent) || displayContent.includes('<video') || displayContent.includes('<img'))) {
            isLong = true;
        }

@@ -587,7 +582,7 @@
            const isExpanded = container.classList.contains('expanded');
            const scrollHeight = inner.scrollHeight;
            const clientHeight = inner.clientHeight;
-            const hasUnloadedImages = Array.from(inner.querySelectorAll('img:not(.emoji), video')).some(
+            const hasUnloadedImages = Array.from(inner.querySelectorAll('img, video')).some(
                media => {
                    if (media.tagName === 'IMG') {
                        return (!media.complete || media.naturalHeight === 0) && media.dataset.error !== 'true';
@@ -639,8 +634,8 @@

    const attachMediaLoadListeners = (element) => {
        // Only target images and videos inside comment-content-inner.
-        // Avatars, emojis, and item preview thumbnails have fixed sizes and do not affect text overflow.
-        element.querySelectorAll('.comment-content-inner img:not(.emoji), .comment-content-inner video').forEach(media => {
+        // Avatars and item preview thumbnails have fixed sizes and do not affect text overflow.
+        element.querySelectorAll('.comment-content-inner img, .comment-content-inner video').forEach(media => {
            if (media.dataset.loadListenerBound) return;
            media.dataset.loadListenerBound = 'true';

--- a/public/s/js/user.js
+++ b/public/s/js/user.js
@@ -120,7 +120,13 @@
      postid,
      existingTags: tags,
      anchorEl: anchor,
-      onSubmit: async (tag) => post("/api/v2/tags/" + postid, { tagname: tag }),
+      onSubmit: async (tag) => {
+        const res = await post("/api/v2/tags/" + postid, { tagname: tag });
+        if (res.success && window.invalidateItemCache) {
+          window.invalidateItemCache(postid);
+        }
+        return res;
+      },
      renderTags
    });
  };
--- a/public/s/js/user_comments.js
+++ b/public/s/js/user_comments.js
@@ -306,7 +306,12 @@ if (!window.UserCommentSystem) {
                const trimmed = line.trimStart();
                if (trimmed.startsWith('>') && !trimmed.match(/^>>\d+/)) {
                    const quoteContent = line.substring(line.indexOf('>') + 1);
-                    return `<span class="greentext">&gt;${quoteContent}</span>`;
+                    const quoteEmojis = window.f0ckSession?.quote_emojis === true;
+                    const escapedQuote = quoteContent.replace(/>/g, '&gt;');
+                    const rendered = quoteEmojis
+                        ? escapedQuote.replace(/:([a-z0-9_]+):/g, (m, n) => this.renderEmoji(m, n))
+                        : escapedQuote;
+                    return `<span class="greentext">&gt;${rendered}</span>`;
                }
                
                // Per-line limit
@@ -450,7 +455,7 @@ if (!window.UserCommentSystem) {
        if (!unsafe) return '';
        const div = document.createElement('div');
        div.textContent = unsafe;
-        return div.innerHTML;
+        return div.innerHTML.replace(/"/g, '&quot;').replace(/'/g, '&#39;');
    }
 }
 }
--- a/public/s/js/v0ck.js
+++ b/public/s/js/v0ck.js
@@ -5,33 +5,33 @@ const tpl_player = (svg, size) => `<div class="v0ck_player_controls">
    <div class="v0ck_progress_filled"></div>
    <div class="v0ck_seek_marker"></div>
  </div>
-  <button class="v0ck_player_button v0ck_tplay v0ck_toggle" title="Play">
+  <button class="v0ck_player_button v0ck_tplay v0ck_toggle" title="Play" tabindex="-1">
    <svg style="width: 20px; height: 20px;">
      <use id="v0ck_svg_play" href="${svg}#play"></use>
      <use id="v0ck_svg_pause" class="v0ck_hidden" href="${svg}#pause"></use>
    </svg>
  </button>
  <div class="v0ck_volume_group">
-  <button class="v0ck_player_button v0ck_volume">
+  <button class="v0ck_player_button v0ck_volume" tabindex="-1">
    <svg style="width: 20px; height: 20px;">
      <use id="v0ck_svg_volume_full" href="${svg}#volume_full"></use>
      <use id="v0ck_svg_volume_mid" class="v0ck_hidden" href="${svg}#volume_mid"></use>
      <use id="v0ck_svg_volume_mute" class="v0ck_hidden" href="${svg}#volume_mute"></use>
    </svg>
  </button>
-  <input type="range" name="volume" min="0" max="1" step="0.01" value="1" />
+  <input type="range" name="volume" min="0" max="1" step="0.01" value="1" tabindex="-1" />
  </div>
-  <button class="v0ck_player_button v0ck_playtime">00:00 / 00:00</button>
+  <button class="v0ck_player_button v0ck_playtime" tabindex="-1">00:00 / 00:00</button>
  <span style="flex: 30"></span>
  
  <div class="v0ck_settings_container">
-      <button class="v0ck_player_button v0ck_settings_btn" title="Settings">
+      <button class="v0ck_player_button v0ck_settings_btn" title="Settings" tabindex="-1">
        <svg viewBox="0 0 24 24" style="width: 20px; height: 20px;">
            <path d="M19.14,12.94c0.04-0.3,0.06-0.61,0.06-0.94c0-0.32-0.02-0.64-0.06-0.94l2.03-1.58c0.18-0.14,0.23-0.41,0.12-0.61 l-1.92-3.32c-0.12-0.22-0.37-0.29-0.59-0.22l-2.39,0.96c-0.5-0.38-1.03-0.7-1.62-0.94L14.4,2.81c-0.04-0.24-0.24-0.41-0.48-0.41 h-3.84c-0.24,0-0.43,0.17-0.47,0.41L9.25,5.35C8.66,5.59,8.12,5.92,7.63,6.29L5.24,5.33c-0.22-0.08-0.47,0-0.59,0.22L2.74,8.87 C2.62,9.08,2.66,9.34,2.86,9.48l2.03,1.58C4.84,11.36,4.8,11.69,4.8,12s0.02,0.64,0.06,0.94l-2.03,1.58 c-0.18,0.14-0.23,0.41-0.12,0.61l1.92,3.32c0.12,0.22,0.37,0.29,0.59,0.22l2.39-0.96c0.5,0.38,1.03,0.7,1.62,0.94l0.36,2.54 c0.05,0.24,0.24,0.41,0.48,0.41h3.84c0.24,0,0.44-0.17,0.47-0.41l0.36-2.54c0.59-0.24,1.13-0.56,1.62-0.94l2.39,0.96 c0.22,0.08,0.47,0,0.59-0.22l1.92-3.32c0.12-0.22,0.07-0.47-0.12-0.61L19.14,12.94z M12,15.6c-1.98,0-3.6-1.62-3.6-3.6 s1.62-3.6,3.6-3.6s3.6,1.62,3.6,3.6S13.98,15.6,12,15.6z"/>
        </svg>
      </button>
      <div class="v0ck_settings_menu v0ck_hidden">
-          <button id="toggleswf" class="v0ck_menu_item" title="Flash Yank">SWF</button>
+          <button id="toggleswf" class="v0ck_menu_item" title="Flash Yank" tabindex="-1">SWF</button>
          <div class="v0ck_menu_item v0ck_bg_row">
              <span class="v0ck_switch_label">Background</span>
              <div id="togglebg" class="v0ck_cool_switch" title="Toggle Background"></div>
@@ -44,11 +44,11 @@ const tpl_player = (svg, size) => `<div class="v0ck_player_controls">
              <span class="v0ck_switch_label">Danmaku</span>
              <div id="toggledanmaku" class="v0ck_cool_switch" title="Toggle Danmaku comments"></div>
          </div>
-          <button id="v0ck_download" class="v0ck_menu_item" title="Download File">Download${size ? ` (${size})` : ''}</button>
+          <button id="v0ck_download" class="v0ck_menu_item" title="Download File" tabindex="-1">Download${size ? ` (${size})` : ''}</button>
      </div>
  </div>

-  <button class="v0ck_player_button v0ck_toggle v0ck_fs_btn" title="Full Screen">
+  <button class="v0ck_player_button v0ck_toggle v0ck_fs_btn" title="Full Screen" tabindex="-1">
    <svg style="width: 20px; height: 20px;"><use id="v0ck_svg_fullscreen" href="${svg}#fullscreen"></use></svg>
  </button>
 </div>
--- a/src/inc/config.mjs
+++ b/src/inc/config.mjs
@@ -30,7 +30,7 @@ const resolvePath = (defaultRel) => {
        const absStorage = path.resolve(storage);
        if (defaultRel.startsWith('public/')) {
            const sub = defaultRel.replace('public/', '');
-            if (sub === 's/emojis' || sub === 's/koepfe') {
+            if (sub === 's/emojis' || sub === 's/koepfe' || sub === 's/fonts') {
                const storagePath = path.join(absStorage, sub.split('/').pop());
                if (fs.existsSync(storagePath)) return path.resolve(storagePath);
                return local;
@@ -51,6 +51,7 @@ config.paths = {
    s: path.join(base, 'public/s'),
    emojis: resolvePath('public/s/emojis'),
    koepfe: resolvePath('public/s/koepfe'),
+    fonts: resolvePath('public/s/fonts'),
    memes: resolvePath('public/memes'),
    e: resolvePath('e'),
    pending: resolvePath('pending'),
--- a/src/inc/lib.mjs
+++ b/src/inc/lib.mjs
@@ -132,6 +132,7 @@ export default new class {

    // Build suffix with query params
    let suffix = env.strict ? '?strict=1' : '';
+    if (env.tagger) suffix += (suffix ? '&' : '?') + `tagger=${encodeURIComponent(env.tagger)}`;

    // mainDisplay: decoded for human-readable display (e.g. div.location)
    // main: keeps percent-encoding for use in href attributes
@@ -459,4 +460,15 @@ export default new class {
    console.error(`[ERROR REF ${errId}] ${context}:`, err);
    return `Internal Error. Reference: ${errId}`;
  }
+
+  isOnionRequest(req) {
+    if (!req || !req.headers) return false;
+    const rawHost = req.headers['x-forwarded-host'] || req.headers['host'] || req.headers['x-forwarded-server'] || '';
+    if (!rawHost) return false;
+    const hostStr = Array.isArray(rawHost) ? rawHost[0] : String(rawHost);
+    const firstHost = hostStr.split(',')[0].trim();
+    const hostNoPort = firstHost.split(':')[0].trim().toLowerCase();
+    return hostNoPort.endsWith('.onion');
+  }
 };
+
--- a/src/inc/locales/de.json
+++ b/src/inc/locales/de.json
@@ -165,6 +165,10 @@
    "hide_item_ratings_hint": "Zeige keine SFW/NSFW-Bewertungsindikatoren bei Elementen auf der Hauptseite",
    "disable_swiping": "Wischen deaktivieren",
    "disable_swiping_hint": "Navigation per Wischen auf Mobilgeräten deaktivieren",
+    "favorites_private": "Private Favoriten",
+    "favorites_private_hint": "Nur du und Administratoren können deine Favoritenliste sehen.",
+    "hide_fav_badge": "Favoriten-Badge-Avatar verbergen",
+    "hide_fav_badge_hint": "Zeigt auf Beitragsseiten stattdessen ein Geist-Icon ohne Profilverlinkung an",
    "image_expand_on_click": "Bilder beim Klicken inline erweitern",
    "image_expand_on_click_hint": "Anstatt das Scroll-Zoom-Modal zu öffnen, wird ein Bild beim Klicken innerhalb der Seite auf volle Größe erweitert.",
    "enable_bg_blur": "Hintergrundunschärfe aktivieren",
@@ -535,6 +539,7 @@
    "subscribe_uploads_btn": "Benutzer für Uploads abonnieren",
    "no_uploads": "Keine Uploads gefunden",
    "no_favs": "Keine Favoriten",
+    "private_favorites": "private Favoriten",
    "back_to_profile": "Zurück zum Profil",
    "ban_modal_title": "Benutzer sperren",
    "ban_modal_reason": "Grund:",
--- a/src/inc/locales/en.json
+++ b/src/inc/locales/en.json
@@ -165,6 +165,10 @@
    "hide_item_ratings_hint": "Don't show SFW/NSFW rating indicators on main page items",
    "disable_swiping": "Disable Swiping",
    "disable_swiping_hint": "Disable swipe-to-navigate on mobile devices",
+    "favorites_private": "Private Favorites",
+    "favorites_private_hint": "Only you and administrators can view your favorites list.",
+    "hide_fav_badge": "Hide Favorite Badge Avatar",
+    "hide_fav_badge_hint": "Display as a ghost icon on post detail pages without linking to your profile",
    "image_expand_on_click": "Expand images inline on click",
    "image_expand_on_click_hint": "Instead of opening the scroll zoom modal, clicking an image will expand it to full size within the page.",
    "enable_bg_blur": "Enable Background blur",
@@ -539,6 +543,7 @@
    "subscribe_uploads_btn": "Subscribe user to uploads",
    "no_uploads": "no uploads found",
    "no_favs": "no favorites",
+    "private_favorites": "private favorites",
    "back_to_profile": "Back to Profile",
    "ban_modal_title": "Ban User",
    "ban_modal_reason": "Reason:",
--- a/src/inc/locales/nl.json
+++ b/src/inc/locales/nl.json
@@ -165,6 +165,10 @@
    "hide_item_ratings_hint": "Toon geen SFW/NSFW beoordelingsindicatoren op hoofdpagina items",
    "disable_swiping": "Swipen uitschakelen",
    "disable_swiping_hint": "Swipe-to-navigate uitschakelen op mobiele apparaten",
+    "favorites_private": "Privé favorieten",
+    "favorites_private_hint": "Alleen jij en beheerders kunnen je favorietenlijst bekijken.",
+    "hide_fav_badge": "Favoriet-badge avatar verbergen",
+    "hide_fav_badge_hint": "Toon als een spook-icoon op berichtpagina's zonder koppeling naar je profiel",
    "image_expand_on_click": "Afbeeldingen inline vergroten bij klikken",
    "image_expand_on_click_hint": "In plaats van de scroll-zoom-modal te openen, wordt een afbeelding bij klikken vergroot tot volledige grootte binnen de pagina.",
    "enable_bg_blur": "Achtergrondvervaging inschakelen",
@@ -535,6 +539,7 @@
    "subscribe_uploads_btn": "Gebruiker abonneren op uploads",
    "no_uploads": "geen uploads gevonden",
    "no_favs": "geen favorieten",
+    "private_favorites": "privé favorieten",
    "back_to_profile": "Terug naar Profiel",
    "ban_modal_title": "Gebruiker Bannen",
    "ban_modal_reason": "Reden:",
--- a/src/inc/locales/zange.json
+++ b/src/inc/locales/zange.json
@@ -165,6 +165,10 @@
    "hide_item_ratings_hint": "Zeige keine SFW/NSFW-Bewertungsindikatoren bei Elementen auf der Hauptseite",
    "disable_swiping": "Wischen deaktivieren",
    "disable_swiping_hint": "Deaktivieren der Wisch-Navigation auf Mobilgeräten",
+    "favorites_private": "Private Favoriten",
+    "favorites_private_hint": "Nur du und Administratoren können deine Favoritenliste sehen.",
+    "hide_fav_badge": "Herzi-Badge-Avatar versteckeln",
+    "hide_fav_badge_hint": "Zeigt auf Beitragsseiten 1 geiles Geist-Icon an vong Anonymität her",
    "image_expand_on_click": "Bildli beim Klickle inline uffblähe",
    "image_expand_on_click_hint": "Anstatt dat Scroll-Zoom-Moped aufzumache, wird n Bild beim Klickle uff volle Größ im Bereich uffgepumpt.",
    "enable_bg_blur": "Hintergrundunschärfe aktivieren",
@@ -536,6 +540,7 @@
    "subscribe_uploads_btn": "Benutzer für Aufladierungen abonnieren",
    "no_uploads": "keine Aufladierungen gefunden",
    "no_favs": "keine Favoriten",
+    "private_favorites": "private Favoriten",
    "back_to_profile": "Zurück zum Profil",
    "ban_modal_title": "Benutzer sperren",
    "ban_modal_reason": "Grund:",
--- a/src/inc/routeinc/f0cklib.mjs
+++ b/src/inc/routeinc/f0cklib.mjs
@@ -18,7 +18,7 @@ const flashMimes = Object.entries(cfg.mimes || {}).filter(([, ext]) => ext === '
 const COUNT_CACHE_TTL_MS = 90_000;
 const countCache = new Map(); // key → { total, expiresAt }

-function buildCountCacheKey({ modequery, tag, user, hall, mime, fav, session, excludedTags, newerThan, minXd, userHallObj }) {
+function buildCountCacheKey({ modequery, tag, user, hall, mime, fav, session, excludedTags, newerThan, minXd, userHallObj, tagger }) {
  return JSON.stringify([
    modequery,
    tag ?? '',
@@ -30,7 +30,8 @@ function buildCountCacheKey({ modequery, tag, user, hall, mime, fav, session, ex
    excludedTags.slice().sort().join(','),
    newerThan ?? '',
    minXd,
-    userHallObj?.id ?? ''
+    userHallObj?.id ?? '',
+    tagger ?? ''
  ]);
 }

@@ -135,8 +136,60 @@ const xdScoreMeta = (score) => {
  return                      { tier: 5, label: 'xDDDDD+' };
 };

+async function checkFavoritesAccess(rawUser, { session, user_id, is_admin } = {}) {
+  if (!rawUser) return { isPrivate: false, isAllowed: true };
+  const decodedUser = decodeURI(rawUser);
+  const targetUserRows = await db`
+    select u.id, u."user", u.admin, uo.favorites_private
+    from "user" u
+    left join user_options uo on uo.user_id = u.id
+    where u."user" ilike ${decodedUser} or u.login ilike ${decodedUser}
+    limit 1
+  `;
+  if (!targetUserRows.length || !targetUserRows[0].favorites_private) {
+    return { isPrivate: false, isAllowed: true };
+  }
+
+  const targetUser = targetUserRows[0];
+
+  let reqUserId = user_id;
+  let reqIsAdmin = is_admin;
+
+  if (typeof session === 'object' && session !== null) {
+    if (reqUserId === undefined) reqUserId = session.id;
+    if (reqIsAdmin === undefined) reqIsAdmin = !!session.admin;
+  }
+
+  let isAllowed = false;
+  if (reqUserId) {
+    if (+reqUserId === +targetUser.id) {
+      isAllowed = true;
+    } else if (reqIsAdmin === true) {
+      isAllowed = true;
+    } else if (reqIsAdmin === undefined) {
+      const reqUserRows = await db`select admin from "user" where id = ${+reqUserId} limit 1`;
+      if (reqUserRows.length > 0 && reqUserRows[0].admin) {
+        isAllowed = true;
+      }
+    }
+  }
+
+  return { isPrivate: true, isAllowed };
+}
+
 export default {
-  getf0cks: async ({ user: rawUser, tag: rawTag, hall: rawHall, mime: rawMime, page, mode, ratings, fav, session, limit, strict, newer, exclude, user_id, random, userHall: rawUserHall, userHallOwner: rawUserHallOwner, minXdScore } = {}) => {
+  getf0cks: async ({ user: rawUser, tag: rawTag, hall: rawHall, mime: rawMime, page, mode, ratings, fav, session, limit, strict, newer, exclude, user_id, is_admin, random, userHall: rawUserHall, userHallOwner: rawUserHallOwner, minXdScore, tagger: rawTagger } = {}) => {
+    if (fav && rawUser) {
+      const { isPrivate, isAllowed } = await checkFavoritesAccess(rawUser, { session, user_id, is_admin });
+      if (isPrivate && !isAllowed) {
+        return {
+          success: false,
+          is_private: true,
+          message: "private favorites"
+        };
+      }
+    }
+
    const user = rawUser ? lib.escapeLike(decodeURI(rawUser)) : null;

    // --- title: prefix — search items.title instead of the tags table ---
@@ -189,7 +242,8 @@ export default {
    const strictParams = ((strict || (tag && tag.includes(','))) && tag) ? tag.split(',').map(t => lib.slugify(t)).filter(t => t) : [];
    const isStrict = strictParams.length > 0;

-    const tmp = { user, tag: isTitleSearch ? _decodedTag : tag, hall: hallObj || hall, mime, page: actPage, mode: mode, view_mode: fav ? 'favs' : 'uploads', strict: strict, userHall: userHallObj || userHallSlug, userHallOwner };
+    const tagger = rawTagger ? lib.escapeLike(rawTagger) : null;
+    const tmp = { user, tag: isTitleSearch ? _decodedTag : tag, hall: hallObj || hall, mime, page: actPage, mode: mode, view_mode: fav ? 'favs' : 'uploads', strict: strict, userHall: userHallObj || userHallSlug, userHallOwner, tagger };
    // Multi-rating support: if `ratings` array provided, build an OR-based SQL fragment
    const multiRatingSQL = (Array.isArray(ratings) && ratings.length > 0) ? lib.getMultiRatingMode(ratings) : null;
    const baseMode = multiRatingSQL ?? lib.getMode(mode ?? 0);
@@ -200,6 +254,21 @@ export default {
    if (isTitleSearch && titleQuery) {
      // Title search: match items.title ILIKE '%query%'
      titleFilter = db`and items.title ILIKE ${'%' + titleQuery + '%'} and items.title IS NOT NULL`;
+    } else if (tagger && tag) {
+      // Tagger+tag filter: items where the specific user applied this specific tag
+      const terms = tag.split(',').map(t => t.trim()).filter(Boolean);
+      if (terms.length > 0) {
+        const conditions = terms.map(term => {
+          return db`and items.id in (
+            select ta.item_id from tags_assign ta
+            join tags t on t.id = ta.tag_id
+            join "user" u on u.id = ta.user_id
+            where t.normalized like '%' || slugify(${term}) || '%'
+            and u.user ilike ${tagger}
+          )`;
+        });
+        tagFilter = db`${conditions}`;
+      }
    } else if (tag) {
      const terms = tag.split(',').map(t => t.trim()).filter(Boolean);
      if (terms.length > 0) {
@@ -233,7 +302,7 @@ export default {
      userHallFilter = db`and items.id in (select uha.item_id from user_halls_assign uha where uha.hall_id = ${userHallObj.id})`;
    }

-    const cacheKey = buildCountCacheKey({ modequery, tag, user, hall, mime, fav, session, excludedTags, newerThan, minXd, userHallObj });
+    const cacheKey = buildCountCacheKey({ modequery, tag, user, hall, mime, fav, session, excludedTags, newerThan, minXd, userHallObj, tagger });
    let total = getCachedCount(cacheKey);

    if (total === null) {
@@ -252,7 +321,6 @@ export default {
          ${hallFilter}
          ${userHallFilter}
          ${!session && getGlobalfilter() ? db`and not exists (select 1 from tags_assign where item_id = items.id and (${db.unsafe(getGlobalfilter())}))` : db``}
-          ${!session && cfg.websrv.public_untagged === false ? db`and exists (select 1 from tags_assign where item_id = items.id)` : db``}
          ${excludedTags.length > 0 ? db`and not exists (select 1 from tags_assign where item_id = items.id and tag_id = any(${excludedTags}::int[]))` : db``}
          ${newerThan ? db`and items.id > ${newerThan}` : db``}
          ${xdFilter}
@@ -295,7 +363,6 @@ export default {
        ${hallFilter}
        ${userHallFilter}
        ${!session && getGlobalfilter() ? db`and not exists (select 1 from tags_assign where item_id = items.id and (${db.unsafe(getGlobalfilter())}))` : db``}
-        ${!session && cfg.websrv.public_untagged === false ? db`and exists (select 1 from tags_assign where item_id = items.id)` : db``}
        ${excludedTags.length > 0 ? db`and not exists (select 1 from tags_assign where item_id = items.id and tag_id = any(${excludedTags}::int[]))` : db``}
        ${newerThan ? db`and items.id > ${newerThan}` : db``}
        ${xdFilter}
@@ -374,7 +441,7 @@ export default {
    for (let i = Math.max(1, act_page - range); i <= Math.min(act_page + range, pages); i++)
      cheat.push(i);

-    const link = lib.genLink({ user, tag, hall: hallObj ? hallObj.slug : hall, mime, type: fav ? 'favs' : 'uploads', path: 'p/', strict: strict });
+    const link = lib.genLink({ user, tag, hall: hallObj ? hallObj.slug : hall, mime, type: fav ? 'favs' : 'uploads', path: 'p/', strict: strict, tagger });

    // Override link for title searches — pagination must use the /tag/title:... prefix
    if (isTitleSearch && titleQuery) {
@@ -413,7 +480,18 @@ export default {
      view_mode: fav ? 'favs' : 'uploads'
    };
  },
-  getf0ck: async ({ user: rawUser, tag: rawTag, hall: rawHall, mime: rawMime, itemid: rawItemid, mode, ratings, session, strict, exclude, user_id, fav, random, userHall: rawUserHall, userHallOwner: rawUserHallOwner, lang } = {}) => {
+  getf0ck: async ({ user: rawUser, tag: rawTag, hall: rawHall, mime: rawMime, itemid: rawItemid, mode, ratings, session, strict, exclude, user_id, is_admin, fav, random, userHall: rawUserHall, userHallOwner: rawUserHallOwner, lang } = {}) => {
+    if (fav && rawUser) {
+      const { isPrivate, isAllowed } = await checkFavoritesAccess(rawUser, { session, user_id, is_admin });
+      if (isPrivate && !isAllowed) {
+        return {
+          success: false,
+          is_private: true,
+          message: "private favorites"
+        };
+      }
+    }
+
    const user = rawUser ? lib.escapeLike(decodeURI(rawUser)) : null;

    // --- title: prefix — search items.title instead of the tags table ---
@@ -518,7 +596,6 @@ export default {
            ${!fav && user ? db`and items.username ilike ${user}` : db``}
            ${mimeSQL}
            ${!session && getGlobalfilter() ? db`and not exists (select 1 from tags_assign where item_id = items.id and (${db.unsafe(getGlobalfilter())}))` : db``}
-            ${!session && cfg.websrv.public_untagged === false ? db`and exists (select 1 from tags_assign where item_id = items.id)` : db``}
            ${excludedTags.length > 0 ? db`and not exists (select 1 from tags_assign where item_id = items.id and tag_id = any(${excludedTags}::int[]))` : db``}
        `;
    };
@@ -555,7 +632,6 @@ export default {
        items.id = ${itemid} and
        items.active = true
        ${!session && getGlobalfilter() ? db`and not exists (select 1 from tags_assign where item_id = items.id and (${db.unsafe(getGlobalfilter())}))` : db``}
-        ${!session && cfg.websrv.public_untagged === false ? db`and exists (select 1 from tags_assign where item_id = items.id)` : db``}
      limit 1
    `;

@@ -573,7 +649,7 @@ export default {

    if (!actitem) {
      // Item not found or filtered out - check if it exists but was filtered (for OG meta tags)
-      if (!session && (getGlobalfilter() || cfg.websrv.public_untagged === false)) {
+      if (!session && getGlobalfilter()) {
        const unfilteredItem = await db`
          select id from items where id = ${itemid} and active = true limit 1
        `;
@@ -692,7 +768,7 @@ export default {
      link.suffix = '';
    }
    const favorites = await db`
-      select "user".user, "user_options".avatar, "user_options".avatar_file, "user_options".username_color, "user_options".display_name
+      select "user".user, "user_options".avatar, "user_options".avatar_file, "user_options".username_color, "user_options".display_name, "user_options".hide_fav_badge
      from "favorites"
      left join "user" on "user".id = "favorites".user_id
      left join "user_options" on "user_options".user_id = "favorites".user_id
@@ -871,7 +947,14 @@ export default {
      tmp
    };
    return data;
-  }, getRandom: async ({ user: rawUser, tag: rawTag, hall: rawHall, mime: rawMime, mode, ratings, fav, session, strict, exclude, userHall: rawUserHall, userHallOwner: rawUserHallOwner } = {}) => {
+  },
+  getRandom: async ({ user: rawUser, tag: rawTag, hall: rawHall, mime: rawMime, mode, ratings, fav, session, strict, exclude, user_id, is_admin, userHall: rawUserHall, userHallOwner: rawUserHallOwner } = {}) => {
+    if (fav && rawUser) {
+      const { isPrivate, isAllowed } = await checkFavoritesAccess(rawUser, { session, user_id, is_admin });
+      if (isPrivate && !isAllowed) {
+        return null;
+      }
+    }
    const user = rawUser ? lib.escapeLike(decodeURI(rawUser)) : null;
    const hall = rawHall || null;

@@ -929,7 +1012,6 @@ export default {
          AND items.title IS NOT NULL
          ${mimeSQL}
          ${!session && getGlobalfilter() ? db`and not exists (select 1 from tags_assign where item_id = items.id and (${db.unsafe(getGlobalfilter())}))` : db``}
-          ${!session && cfg.websrv.public_untagged === false ? db`and exists (select 1 from tags_assign where item_id = items.id)` : db``}
          ${excludedTags.length > 0 ? db`and not exists (select 1 from tags_assign where item_id = items.id and tag_id = any(${excludedTags}::int[]))` : db``}
        ORDER BY random()
        LIMIT 1
@@ -950,7 +1032,6 @@ export default {
          and items.active = true
          ${mimeSQL}
          ${!session && getGlobalfilter() ? db`and not exists (select 1 from tags_assign where item_id = items.id and (${db.unsafe(getGlobalfilter())}))` : db``}
-          ${!session && cfg.websrv.public_untagged === false ? db`and exists (select 1 from tags_assign where item_id = items.id)` : db``}
        group by items.id
        order by random()
        limit 1
@@ -993,7 +1074,6 @@ export default {
          ${hall ? db`and items.id in (select item_id from halls_assign ha join halls h on h.id = ha.hall_id where h.slug = ${hall})` : db``}
          ${mimeSQL}
          ${!session && getGlobalfilter() ? db`and not exists (select 1 from tags_assign where item_id = items.id and (${db.unsafe(getGlobalfilter())}))` : db``}
-          ${!session && cfg.websrv.public_untagged === false ? db`and exists (select 1 from tags_assign where item_id = items.id)` : db``}
          ${excludedTags.length > 0 ? db`and not exists (select 1 from tags_assign where item_id = items.id and tag_id = any(${excludedTags}::int[]))` : db``}
        group by items.id, tags.tag
        order by random()
@@ -1013,7 +1093,6 @@ export default {
          and items.active = true
          ${mimeSQL}
          ${!session && getGlobalfilter() ? db`and not exists (select 1 from tags_assign where item_id = items.id and (${db.unsafe(getGlobalfilter())}))` : db``}
-          ${!session && cfg.websrv.public_untagged === false ? db`and exists (select 1 from tags_assign where item_id = items.id)` : db``}
          ${excludedTags.length > 0 ? db`and not exists (select 1 from tags_assign where item_id = items.id and tag_id = any(${excludedTags}::int[]))` : db``}
        order by random()
        limit 1
@@ -1029,8 +1108,6 @@ export default {
          and uha.hall_id = ${userHallId}
          and items.active = true
          ${mimeSQL}
-          ${!session && getGlobalfilter() ? db`and not exists (select 1 from tags_assign where item_id = items.id and (${db.unsafe(getGlobalfilter())}))` : db``}
-          ${!session && cfg.websrv.public_untagged === false ? db`and exists (select 1 from tags_assign where item_id = items.id)` : db``}
          ${excludedTags.length > 0 ? db`and not exists (select 1 from tags_assign where item_id = items.id and tag_id = any(${excludedTags}::int[]))` : db``}
        order by random()
        limit 1
@@ -1058,7 +1135,6 @@ export default {
        WHERE items.active = true
          ${mimeSQL}
          ${checkFilter ? db`AND filter_ta.tag_id IS NULL` : db``}
-          ${!session && cfg.websrv.public_untagged === false ? db`AND EXISTS (SELECT 1 FROM tags_assign WHERE item_id = items.id)` : db``}
          ${excludedTags.length > 0 ? db`AND NOT EXISTS (SELECT 1 FROM tags_assign WHERE item_id = items.id AND tag_id = ANY(${excludedTags}::int[]))` : db``}
          ${!useTagIdOpt ? db`AND ${db.unsafe(globalModeQuery)}` : db``}
        ORDER BY random()
--- a/src/inc/routes/admin.mjs
+++ b/src/inc/routes/admin.mjs
@@ -1428,8 +1428,8 @@ export default (router, tpl) => {
      const userId = newUser[0].id;

      await db`
-        INSERT INTO user_options (user_id, mode, theme, fullscreen, avatar, avatar_file, use_new_layout, disable_autoplay, disable_swiping)
-        VALUES (${userId}, 3, 'amoled', 0, NULL, 'default.png', ${getDefaultLayout() === 'modern'}, ${cfg.websrv.enable_autoplay === false}, ${cfg.websrv.enable_swiping === false})
+        INSERT INTO user_options (user_id, mode, theme, fullscreen, avatar, avatar_file, use_new_layout, disable_autoplay, disable_swiping, use_alternative_infobox)
+        VALUES (${userId}, 3, 'amoled', 0, NULL, 'default.png', ${getDefaultLayout() === 'modern'}, ${cfg.websrv.enable_autoplay === false}, ${cfg.websrv.enable_swiping === false}, ${cfg.websrv.user_alternative_infobox !== false})
      `;

      await audit.log(req.session.id, 'admin_create_user', 'user', userId, {
--- a/src/inc/routes/ajax.mjs
+++ b/src/inc/routes/ajax.mjs
@@ -218,18 +218,33 @@ export default (router, tpl) => {
            mime: query.mime || (req.cookies.mime || null),
            mode: query.mode !== undefined ? +query.mode : req.mode,
            ratings: ratingsArr,
-            session: !!req.session,
-            exclude: req.session ? (req.session.excluded_tags || []) : [],
+            session: req.session,
            user_id: req.session?.id,
+            is_admin: req.session?.admin,
+            exclude: req.session ? (req.session.excluded_tags || []) : [],
            fav: query.fav === 'true',
            random: isRandom,
            strict: query.strict === '1' || query.strict === 'true' || req.session?.strict_mode,
            explicitStrict: query.strict === '1' || query.strict === 'true',
            newer: query.newer || null,
-            minXdScore: req.session?.min_xd_score || 0
+            minXdScore: req.session?.min_xd_score || 0,
+            tagger: query.tagger || null
        });

        if (!data.success) {
+            if (data.is_private) {
+                const { t: tErr } = createI18n(req.session?.language || req.lang || 'en');
+                const privateHtml = `<div class="private-favs-msg" style="padding: 30px; text-align: center; color: var(--text-muted); font-size: 1.1em;">${tErr('profile.private_favorites')}</div>`;
+                return res.reply({
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({
+                        success: false,
+                        is_private: true,
+                        html: privateHtml,
+                        hasMore: false
+                    })
+                });
+            }
            return res.reply({
                headers: { 'Content-Type': 'application/json' },
                body: JSON.stringify({
--- a/src/inc/routes/apiv2/index.mjs
+++ b/src/inc/routes/apiv2/index.mjs
@@ -1066,7 +1066,7 @@ export default router => {
      }

      const favs = await db`
-        select "user".user, "user_options".avatar, "user_options".avatar_file, "user_options".display_name, "user_options".username_color
+        select "user".user, "user_options".avatar, "user_options".avatar_file, "user_options".display_name, "user_options".username_color, "user_options".hide_fav_badge
        from "favorites"
        left join "user" on "user".id = "favorites".user_id
        left join "user_options" on "user_options".user_id = "favorites".user_id
--- a/src/inc/routes/apiv2/settings.mjs
+++ b/src/inc/routes/apiv2/settings.mjs
@@ -315,6 +315,44 @@ export default router => {
      }
    });

+    // Update Favorites Privacy preference
+    group.put(/\/favorites_private/, lib.loggedin, async (req, res) => {
+      const favorites_private = req.post.favorites_private === true || req.post.favorites_private === 'true';
+
+      try {
+        await db`
+          update user_options 
+          set favorites_private = ${favorites_private}
+          where user_id = ${+req.session.id}
+        `;
+        // Sync session immediately
+        if (req.session) req.session.favorites_private = favorites_private;
+        return res.json({ success: true, favorites_private }, 200);
+      } catch (e) {
+        console.error('Update Favorites Privacy pref error:', e);
+        return res.json({ success: false, msg: 'Error updating preference' }, 500);
+      }
+    });
+
+    // Update Hide Fav Badge preference
+    group.put(/\/hide_fav_badge/, lib.loggedin, async (req, res) => {
+      const hide_fav_badge = req.post.hide_fav_badge === true || req.post.hide_fav_badge === 'true';
+
+      try {
+        await db`
+          update user_options 
+          set hide_fav_badge = ${hide_fav_badge}
+          where user_id = ${+req.session.id}
+        `;
+        // Sync session immediately
+        if (req.session) req.session.hide_fav_badge = hide_fav_badge;
+        return res.json({ success: true, hide_fav_badge }, 200);
+      } catch (e) {
+        console.error('Update Hide Fav Badge pref error:', e);
+        return res.json({ success: false, msg: 'Error updating preference' }, 500);
+      }
+    });
+
    // Update Username Color preference
    group.put(/\/username_color/, lib.loggedin, async (req, res) => {
      const { color } = req.post;
@@ -486,7 +524,7 @@ export default router => {
      // F-023 Security: Validate font against actual files on disk
      // The font value is rendered into CSS url() in header.html, so it must be a real filename
      if (font) {
-        const fontsDir = path.join(path.resolve(), 'public/s/fonts');
+        const fontsDir = cfg.paths.fonts;
        try {
          const available = (await fs.readdir(fontsDir)).filter(f => /\.(ttf|otf|woff2?)$/i.test(f));
          if (!available.includes(font)) {
--- a/src/inc/routes/apiv2/tags.mjs
+++ b/src/inc/routes/apiv2/tags.mjs
@@ -25,7 +25,8 @@ export default router => {

    group.post(/$/, lib.loggedin, async (req, res) => {
      // assign and/or create tag
-      if (!req.params.postid || !req.post.tagname) {
+      const rawTagname = req.post?.tagname || req.body?.tagname;
+      if (!req.params.postid || !rawTagname) {
        return res.json({
          success: false,
          msg: 'missing postid or tag'
@@ -33,7 +34,7 @@ export default router => {
      }

      const postid = +req.params.postid;
-      const tagname = req.post.tagname?.trim();
+      const tagname = rawTagname.trim();
      const protectedTags = ['sfw', 'nsfw', 'nsfl'];

      if (protectedTags.includes(tagname.toLowerCase())) {
--- a/src/inc/routes/apiv2/upload.mjs
+++ b/src/inc/routes/apiv2/upload.mjs
@@ -336,7 +336,16 @@ export default router => {
                    }
                }

-                const url = inputUrl.trim();
+                let url = inputUrl.trim();
+                try {
+                    const parsed = new URL(url);
+                    if (parsed.searchParams.has('igsh')) {
+                        parsed.searchParams.delete('igsh');
+                        url = parsed.toString();
+                    }
+                } catch (e) {
+                    // Ignore malformed URL, keep original string
+                }
                const ytRegex = /(?:youtube\.com\/\S*(?:(?:\/e(?:mbed))?\/|watch\/?\?(?:\S*?&?v\=))|youtu\.be\/)([a-zA-Z0-9_-]{6,11})/i;
                const ytMatch = url.match(ytRegex);

--- a/src/inc/routes/comments.mjs
+++ b/src/inc/routes/comments.mjs
@@ -972,15 +972,6 @@ export default (router, tpl) => {

    // Recent Activity Page
    router.get(/\/activity\/?/, async (req, res) => {
-        if (!req.session && cfg.main.hide_comments_from_public) {
-            if (req.url.qs?.json === 'true' || req.headers['x-requested-with'] === 'XMLHttpRequest') {
-                return res.reply({
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({ success: true, comments: [], page: 1, hasMore: false, require_login: true })
-                });
-            }
-            return res.reply({ code: 403, body: "Forbidden" });
-        }
        try {
            const page = +(req.url.qs?.page || 1);
            const limit = Math.min(+(req.url.qs?.limit || 50), 50);
--- a/src/inc/routes/index.mjs
+++ b/src/inc/routes/index.mjs
@@ -99,8 +99,9 @@ export default (router, tpl) => {
          ratings: ratingsArr,
          mime: mime,
          fav: true,
-          session: !!req.session,
+          session: req.session,
          user_id: req.session?.id,
+          is_admin: req.session?.admin,
          random: isRandom
        });
        if (favs && 'items' in favs) {
@@ -236,20 +237,36 @@ export default (router, tpl) => {
      fav: req.params.mode == 'favs',
      mode: req.mode,
      ratings: (() => { const r = req.cookies.ratings; return r ? decodeURIComponent(r).split(/[|,]/).filter(x => ['sfw','nsfw','nsfl','untagged'].includes(x)) : null; })(),
-      session: !!req.session,
+      session: req.session,
      user_id: req.session?.id,
+      is_admin: req.session?.admin,
      exclude: req.session ? (req.session.excluded_tags || []) : [],
      url: decodeURIComponent(req.url.pathname || req.url),
      strict: !!(req.query?.strict || req.url.qs?.strict || req.session?.strict_mode),
      explicitStrict: !!(req.query?.strict || req.url.qs?.strict),
      random: req.cookies.random_mode === '1',
      minXdScore: req.params.itemid ? 0 : (req.url.qs?.min_xd !== undefined ? +req.url.qs.min_xd : (req.session?.min_xd_score || 0)),
-      lang: req.lang
+      lang: req.lang,
+      tagger: req.url.qs?.tagger || null
    });
    console.log(`[DEBUG] Checking strict mode: query=${req.query?.strict}, session=${req.session?.strict_mode}, effective=${!!(req.query?.strict || req.url.qs?.strict || req.session?.strict_mode)}`);
    console.log(`[${new Date().toISOString()}] [ROUTE] Data fetch complete in ${Date.now() - tRouteStart}ms`);

    if (!data.success) {
+      if (data.is_private) {
+        const { t: tErr } = createI18n(req.session?.language || req.lang || 'en');
+        return res.reply({
+          code: 403,
+          body: tpl.render('error', {
+            message: tErr('profile.private_favorites'),
+            domain: cfg.main.url.domain,
+            tmp: null,
+            session: req.session ? { ...req.session } : false,
+            error_filter_hint: null,
+            error_filter_hint_link: null
+          }, req)
+        });
+      }
      // For index/grid views with zero items (empty DB), render an empty grid instead of error
      if (mode !== 'item') {
        data.items = [];
--- a/src/inc/routes/notifications.mjs
+++ b/src/inc/routes/notifications.mjs
@@ -142,9 +142,8 @@ db.listen('activity', async (payload) => {
            data.username = 'System';
        }

-        // Broadcast to ALL connected clients (except guests if comments are hidden)
+        // Broadcast to ALL connected clients
        for (const client of clients) {
-            if (!client.userId && cfg.main.hide_comments_from_public) continue;
            client.send({ type: 'activity', data });
        }
    } catch (e) {
--- a/src/inc/routes/register.mjs
+++ b/src/inc/routes/register.mjs
@@ -48,7 +48,7 @@ export default (router, tpl) => {
                return res.writeHead(200, { 'Content-Type': 'application/json' }).end(JSON.stringify({ success: false, msg: errorMsg }));
            }
            return res.reply({
-                body: tpl.render("register", { theme: req.cookies.theme ?? (cfg.websrv.theme || "f0ck"), error: errorMsg, registration_open: getRegistrationOpen() })
+                body: tpl.render("register", { theme: req.cookies?.theme ?? (cfg.websrv.theme || "f0ck"), error: errorMsg, registration_open: getRegistrationOpen() }, req)
            });
        }

@@ -58,7 +58,7 @@ export default (router, tpl) => {
                return res.writeHead(200, { 'Content-Type': 'application/json' }).end(JSON.stringify({ success: false, msg }));
            }
            return res.reply({
-                body: tpl.render("register", { theme: req.cookies.theme ?? (cfg.websrv.theme || "f0ck"), error: msg, registration_open: getRegistrationOpen() })
+                body: tpl.render("register", { theme: req.cookies?.theme ?? (cfg.websrv.theme || "f0ck"), error: msg, registration_open: getRegistrationOpen() }, req)
            });
        };

@@ -67,7 +67,7 @@ export default (router, tpl) => {
                return res.writeHead(200, { 'Content-Type': 'application/json' }).end(JSON.stringify({ success: true, msg }));
            }
            return res.reply({
-                body: tpl.render("register", { theme: req.cookies.theme ?? (cfg.websrv.theme || "f0ck"), success: msg, registration_open: getRegistrationOpen() })
+                body: tpl.render("register", { theme: req.cookies?.theme ?? (cfg.websrv.theme || "f0ck"), success: msg, registration_open: getRegistrationOpen() }, req)
            });
        };

@@ -88,8 +88,9 @@ export default (router, tpl) => {
            return renderError("Passwords do not match.");
        }

-        // reCAPTCHA verification
-        if (cfg.recaptcha?.enabled && cfg.recaptcha?.secret_key) {
+        // reCAPTCHA verification (bypassed for .onion requests as Google reCAPTCHA cannot validate .onion domains)
+        const isOnion = lib.isOnionRequest(req);
+        if (!isOnion && cfg.recaptcha?.enabled && cfg.recaptcha?.secret_key) {
            const rcToken = req.post['g-recaptcha-response'];
            if (!rcToken) return renderError("Please complete the reCAPTCHA.");
            try {
@@ -167,8 +168,8 @@ export default (router, tpl) => {
            const avatarFile = 'default.png';

            await db`
-                insert into user_options (user_id, mode, theme, fullscreen, avatar, avatar_file, use_new_layout, disable_autoplay, disable_swiping)
-                values (${userId}, 3, 'amoled', 0, ${avatarId}, ${avatarFile}, ${getDefaultLayout() === 'modern'}, ${cfg.websrv.enable_autoplay === false}, ${cfg.websrv.enable_swiping === false})
+                insert into user_options (user_id, mode, theme, fullscreen, avatar, avatar_file, use_new_layout, disable_autoplay, disable_swiping, use_alternative_infobox)
+                values (${userId}, 3, 'amoled', 0, ${avatarId}, ${avatarFile}, ${getDefaultLayout() === 'modern'}, ${cfg.websrv.enable_autoplay === false}, ${cfg.websrv.enable_swiping === false}, ${cfg.websrv.user_alternative_infobox !== false})
            `;
        } catch (err) {
            console.error(`[REGISTER] DB Error during user creation:`, err);
--- a/src/inc/routes/static.mjs
+++ b/src/inc/routes/static.mjs
@@ -23,6 +23,11 @@ export default (router, tpl) => {
    route: /^\/s\/koepfe\//
  });

+  router.static({
+    dir: cfg.paths.fonts,
+    route: /^\/s\/fonts\//
+  });
+
  router.static({
    dir: path.join(path.resolve(), 'node_modules/@ruffle-rs/ruffle'),
    route: /^\/s\/ruffle\//
--- a/src/inc/routes/toptags.mjs
+++ b/src/inc/routes/toptags.mjs
@@ -95,7 +95,7 @@ export default (router, tpl) => {
    if (req.headers['x-requested-with'] === 'XMLHttpRequest' || query.ajax) {
      return res.json({
        success: true,
-        html: tpl.render('tag-cards', { toptags: tags, session: (req.session && req.session.user) ? { ...req.session } : false }, req),
+        html: tpl.render('tag-cards', { toptags: tags, user: req.session?.user ? { user: req.session.user } : null, session: (req.session && req.session.user) ? { ...req.session } : false }, req),
        currentPage: page,
        hasMore: tags.length === TAGS_PER_PAGE
      });
@@ -128,6 +128,7 @@ export default (router, tpl) => {
      phrase,
      tmp: null,
      hidePagination: true,
+      user: req.session?.user ? { user: req.session.user } : null,
      session: (req.session && req.session.user) ? { ...req.session } : false,
      page_meta: {
        title: 'Tags',
--- a/src/inc/routes/user_tags.mjs
+++ b/src/inc/routes/user_tags.mjs
@@ -120,7 +120,7 @@ export default (router, tpl) => {

      return res.json({
        success: true,
-        html: tpl.render('tag-cards', { toptags: tags, session: (req.session && req.session.user) ? { ...req.session } : false }, req),
+        html: tpl.render('tag-cards', { toptags: tags, user: { user: userName }, session: (req.session && req.session.user) ? { ...req.session } : false }, req),
        currentPage: page,
        pagination: paginationHtml,
        hasMore: tags.length === TAGS_PER_PAGE
--- a/src/index.mjs
+++ b/src/index.mjs
@@ -49,7 +49,7 @@ const gateOptions = {
  },
  cloudflare_status: {
    status:      'ok',
-    location:    'Frankfurt',
+    location:    cfg.websrv.private_society_gate_location || 'Frankfurt',
    name:        'Cloudflare',
    status_text: 'Working',
  },
@@ -79,11 +79,13 @@ const nginx502Fallback = `<html>
 </html>`;

 // Login + Register modal injected before </body>
-// This string is built at startup so it can reference cfg.recaptcha values.
+// Dynamic function so reCAPTCHA can be bypassed for .onion requests
 const _rcEnabled = !!(cfg.recaptcha && cfg.recaptcha.enabled && cfg.recaptcha.site_key);
 const _rcSiteKey = (cfg.recaptcha && cfg.recaptcha.site_key) || '';

-const gateLoginInjection = `
+function getGateLoginInjection(req) {
+  const rcEnabled = _rcEnabled && !lib.isOnionRequest(req);
+  return `
 <div id="hot-corner" style="position:fixed;bottom:0;left:0;width:20px;height:20px;z-index:9999;"></div>

 <div id="gate-modal" style="display:none;position:fixed;inset:0;background:rgba(0,0,0,0.45);z-index:10000;align-items:center;justify-content:center;">
@@ -123,7 +125,7 @@ const gateLoginInjection = `
        <input type="text" name="token" placeholder="Invite token" autocomplete="off"
          style="background:white;color:black;border:1px solid #bbb;padding:7px 10px;width:100%;box-sizing:border-box;font-size:14px;font-family:inherit;" />
        <input type="text" name="email_confirm_field" style="display:none !important;" tabindex="-1" autocomplete="off" />
-        ${_rcEnabled ? '<div id="gate-recaptcha" style="margin:4px 0;transform-origin:left top;"></div>' : ''}
+        ${rcEnabled ? '<div id="gate-recaptcha" style="margin:4px 0;transform-origin:left top;"></div>' : ''}
        <button type="submit" id="gate-register-btn" style="background:#0051c3;color:white;border:none;padding:9px;font-weight:600;font-size:14px;cursor:pointer;font-family:inherit;"
          onmouseover="this.style.background='#003681'" onmouseout="if(!this.disabled)this.style.background='#0051c3'">Create account</button>
        <p style="text-align:center;font-size:0.85em;margin:6px 0 0;color:#555;">
@@ -264,8 +266,9 @@ const gateLoginInjection = `
    if (_sb.length > 12) _sb = _sb.slice(-12);
  });
 </script>
-${_rcEnabled ? '<script src="https://www.google.com/recaptcha/api.js?onload=onRecaptchaGateReady&render=explicit" async defer><\/script>' : ''}
+${rcEnabled ? '<script src="https://www.google.com/recaptcha/api.js?onload=onRecaptchaGateReady&render=explicit" async defer><\/script>' : ''}
 `;
+}


 // Text injected into the "What can I do?" section
@@ -282,11 +285,40 @@ try {
 }

 // Called on every gated request — produces a fresh page with unique Ray ID + timestamp
-// Accepts an optional request object to inject the visitor's real IP into the footer reveal.
+// Accepts an optional request object to inject the visitor's real IP into the footer reveal and dynamic host into page text/title.
 function buildGatePage(req) {
  if (!_cfRender) return nginx502Fallback;

-  let html = _cfRender({ ...gateOptions, what_can_i_do: gateSignInButton });
+  let reqHost = null;
+  if (req && req.headers) {
+    const rawHost = req.headers['x-forwarded-host'] || req.headers['host'];
+    if (rawHost) {
+      const firstHost = rawHost.split(',')[0].trim();
+      let extracted = '';
+      if (firstHost.startsWith('[')) {
+        const closeBracket = firstHost.indexOf(']');
+        extracted = closeBracket !== -1 ? firstHost.substring(1, closeBracket) : firstHost;
+      } else {
+        extracted = firstHost.split(':')[0].trim();
+      }
+      const isLocalHost = ['localhost', '127.0.0.1', '::1', 'f0ckm', '0.0.0.0', 'localhost.localdomain'].includes(extracted.toLowerCase());
+      if (extracted && !isLocalHost) {
+        reqHost = extracted;
+      }
+    }
+  }
+  if (!reqHost) reqHost = cfg.main.url.domain;
+
+  const currentGateOptions = {
+    ...gateOptions,
+    host_status: {
+      ...gateOptions.host_status,
+      location: reqHost,
+    },
+    what_can_i_do: gateSignInButton,
+  };
+
+  let html = _cfRender(currentGateOptions);

  // Inject real visitor IP into the footer "Your IP: [Click to reveal]" span
  if (req) {
@@ -305,9 +337,9 @@ function buildGatePage(req) {
  // Patch the <title> to include the domain — matches real Cloudflare behaviour
  html = html.replace(
    '<title>502: Bad Gateway</title>',
-    `<title>${cfg.main.url.domain} | 502: Bad gateway</title>`
+    `<title>${reqHost} | 502: Bad gateway</title>`
  );
-  html = html.replace('</body>', gateLoginInjection + '\n</body>');
+  html = html.replace('</body>', getGateLoginInjection(req) + '\n</body>');
  return html;
 }

@@ -316,7 +348,14 @@ const nginx502 = (cfg.websrv.private_society && cfg.websrv.private_society_gate
  ? null
  : nginx502Fallback;

+// Custom gate template — resolved once at boot from config
+// Set private_society_gate: "custom" and private_society_gate_template: "your-template-name" (no .html)
+const _customGateTemplate = (cfg.websrv.private_society && cfg.websrv.private_society_gate === 'custom' && cfg.websrv.private_society_gate_template)
+  ? String(cfg.websrv.private_society_gate_template).replace(/\.html$/i, '')
+  : null;
+
 if (nginx502 === null) console.log('[BOOT] Private society gate: Cloudflare dynamic mode');
+if (_customGateTemplate)  console.log(`[BOOT] Private society gate: Custom template → views/${_customGateTemplate}.html (flummpress resolves extension)`);
 // ─────────────────────────────────────────────────────────────────────────────


@@ -456,6 +495,22 @@ process.on('uncaughtException', err => {
    res.setHeader('Permissions-Policy', 'geolocation=(), microphone=(), camera=()');
    // Encourage connection reuse — helps external tools like ShareX avoid repeated TCP/TLS handshakes
    res.setHeader('Connection', 'keep-alive');
+
+    // Block incoming requests to .onion if Tor Hidden Service is explicitly disabled in config
+    if (cfg.websrv?.enable_tor_hs === false && lib.isOnionRequest(req)) {
+      res.writeHead(503).end();
+      req.url.pathname = '/tor_hs_disabled_bypass';
+      return;
+    }
+
+    // Tor Onion-Location header: advertises .onion service counterpart to Tor Browser users when enabled
+    if (cfg.websrv?.enable_tor_hs !== false && cfg.main?.onion && !lib.isOnionRequest(req)) {
+      const p = req.url?.pathname || '/';
+      const s = req.url?.search || '';
+      const onionHost = cfg.main.onion.replace(/\/+$/, '');
+      res.setHeader('Onion-Location', `${onionHost}${p}${s}`);
+    }
+
    if (isSecure) {
      res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
    }
@@ -505,6 +560,45 @@ process.on('uncaughtException', err => {
    }
  });

+  // ─── Session cache ────────────────────────────────────────────────────────
+  // The session middleware runs in parallel with all other app.use() handlers
+  // (flummpress uses Promise.all). With many concurrent requests each doing a
+  // DB SELECT, the pool (max:50) drains and nginx sees 502s. Caching the
+  // session row for 5s and the upload-count for 30s eliminates the hot path.
+  const SESSION_CACHE_TTL    = 5_000;  // ms — short enough to pick up bans quickly
+  const UPLOAD_COUNT_CACHE_TTL = 30_000; // ms — upload window is 12h, stale for 30s is fine
+  const _sessionCache     = new Map(); // sha256(cookie) -> { data: row, exp: number }
+  const _uploadCountCache = new Map(); // username -> { count: number, exp: number }
+
+  const _scGet = (hash) => {
+    const e = _sessionCache.get(hash);
+    if (e && e.exp > Date.now()) return e.data;
+    _sessionCache.delete(hash);
+    return null;
+  };
+  const _scSet = (hash, data) => {
+    _sessionCache.set(hash, { data, exp: Date.now() + SESSION_CACHE_TTL });
+    if (_sessionCache.size > 2000) {
+      const now = Date.now();
+      for (const [k, v] of _sessionCache) if (v.exp <= now) _sessionCache.delete(k);
+    }
+  };
+  // Exposed so logout/ban routes can force-evict immediately
+  global._invalidateSessionCache = (hash) => _sessionCache.delete(hash);
+
+  const _ucGet = (username) => {
+    const e = _uploadCountCache.get(username);
+    if (e && e.exp > Date.now()) return e.count;
+    _uploadCountCache.delete(username);
+    return null;
+  };
+  const _ucSet = (username, count) => {
+    _uploadCountCache.set(username, { count, exp: Date.now() + UPLOAD_COUNT_CACHE_TTL });
+  };
+  // Allow upload handler to bust the cache after a successful upload
+  global._invalidateUploadCountCache = (username) => _uploadCountCache.delete(username);
+  // ──────────────────────────────────────────────────────────────────────────
+
  app.use(async (req, res) => {
    // This can be used to annoy people on discord sending links to your site lmao, shouldnt be used though since it sucks ass
 //     if (cfg.main.development && req.method === 'POST') console.error(`[BOOT] [DEBUG_POST] ${req.method} ${req.url.pathname}`);
@@ -571,14 +665,22 @@ process.on('uncaughtException', err => {
    req.fullscreen = req.cookies.fullscreen || 0;

    if (req.cookies.session) {
-      const user = await db`
-        select "user".id, "user".login, "user".user, "user".admin, "user".is_moderator, "user".banned, "user".ban_reason, "user".ban_expires, "user".force_password_change, "user_sessions".id as sess_id, "user_sessions".csrf_token, "user_options".mode, "user_options".theme, "user_options".fullscreen, "user_options".excluded_tags, "user_options".avatar, "user_options".avatar_file, "user_options".show_motd, "user_options".strict_mode, "user_options".show_background, "user_options".use_new_layout, "user_options".username_color, "user_options".font, "user_options".disable_autoplay, "user_options".disable_swiping, "user_options".description, "user_options".display_name, COALESCE("user_options".min_xd_score, 0) as min_xd_score, "user_options".ruffle_volume, "user_options".ruffle_background, "user_options".quote_emojis, "user_options".embed_youtube_in_comments, "user_options".hide_koepfe, "user_options".language, "user_options".use_alternative_infobox, "user_options".use_alternative_steuerung, "user_options".receive_system_notifications, "user_options".receive_user_notifications, "user_options".do_not_disturb, "user_options".comment_display_mode, "user_options".force_comment_display_mode
+      const _sessionHash = lib.sha256(req.cookies.session);
+      let _cachedRow = _scGet(_sessionHash);
+      let user;
+      if (_cachedRow) {
+        user = [_cachedRow];
+      } else {
+        user = await db`
+          select "user".id, "user".login, "user".user, "user".admin, "user".is_moderator, "user".banned, "user".ban_reason, "user".ban_expires, "user".force_password_change, "user_sessions".id as sess_id, "user_sessions".csrf_token, "user_options".mode, "user_options".theme, "user_options".fullscreen, "user_options".excluded_tags, "user_options".avatar, "user_options".avatar_file, "user_options".show_motd, "user_options".strict_mode, "user_options".show_background, "user_options".use_new_layout, "user_options".username_color, "user_options".font, "user_options".disable_autoplay, "user_options".disable_swiping, "user_options".favorites_private, "user_options".hide_fav_badge, "user_options".description, "user_options".display_name, COALESCE("user_options".min_xd_score, 0) as min_xd_score, "user_options".ruffle_volume, "user_options".ruffle_background, "user_options".quote_emojis, "user_options".embed_youtube_in_comments, "user_options".hide_koepfe, "user_options".language, "user_options".use_alternative_infobox, "user_options".use_alternative_steuerung, "user_options".receive_system_notifications, "user_options".receive_user_notifications, "user_options".do_not_disturb, "user_options".comment_display_mode, "user_options".force_comment_display_mode
          from "user_sessions"
          left join "user" on "user".id = "user_sessions".user_id
          left join "user_options" on "user_options".user_id = "user_sessions".user_id
-        where "user_sessions".session = ${lib.sha256(req.cookies.session)}
+          where "user_sessions".session = ${_sessionHash}
          limit 1
        `;
+        if (user.length > 0) _scSet(_sessionHash, user[0]);
+      }

      if (user.length === 0) {
        res.writeHead(307, { // delete session
@@ -651,8 +753,10 @@ process.on('uncaughtException', err => {
        req.session.pending_count = pending[0].c;
      }

-      // Calculate uploads remaining globally for the modal
+      // Calculate uploads remaining globally for the modal (cached 30s per user)
      if (!req.session.admin && !req.session.is_moderator) {
+          let cachedUploadCount = _ucGet(req.session.user);
+          if (cachedUploadCount === null) {
            const twelveHoursAgo = ~~(Date.now() / 1000) - (12 * 3600);
            const uploadCount = await db`
                SELECT count(*) as count
@@ -661,7 +765,10 @@ process.on('uncaughtException', err => {
                AND stamp > ${twelveHoursAgo}
                AND is_deleted = false
            `;
-          req.session.uploads_remaining = Math.max(0, cfg.main.upload_limit - parseInt(uploadCount[0].count));
+            cachedUploadCount = parseInt(uploadCount[0].count);
+            _ucSet(req.session.user, cachedUploadCount);
+          }
+          req.session.uploads_remaining = Math.max(0, cfg.main.upload_limit - cachedUploadCount);
      } else {
          req.session.uploads_remaining = undefined; // Unlimited for admins/mods
      }
@@ -749,18 +856,21 @@ process.on('uncaughtException', err => {
          req.url.pathname = '/private_society_bypass';
          return;
        }
-        // For page requests, return 502 Bad Gateway for all paths except homepage (which shows the gate)
-        if (req.url.pathname !== '/') {
+        // For page requests, serve the gate for all paths (custom template or fallback)
+        if (_customGateTemplate) {
+          res.writeHead(200, { 'Content-Type': 'text/html' }).end(tpl.render(_customGateTemplate, {}, req));
+        } else if (req.url.pathname !== '/') {
+          // Non-home paths: always show the static/cloudflare gate
          res.writeHead(200, { 'Content-Type': 'text/html' }).end(nginx502 ?? buildGatePage(req));
-          req.url.pathname = '/private_society_bypass';
-          return;
-        }
-        // Homepage: in cloudflare dynamic mode serve gate directly; otherwise fall through to template
-        if (nginx502 === null) {
+        } else if (nginx502 === null) {
+          // Homepage in cloudflare dynamic mode: serve the CF gate directly
          res.writeHead(200, { 'Content-Type': 'text/html' }).end(buildGatePage(req));
-          req.url.pathname = '/private_society_bypass';
+        } else {
+          // Homepage in plain nginx mode: fall through to index.html template
          return;
        }
+        req.url.pathname = '/private_society_bypass';
+        return;
      }
    }
  });
@@ -1240,6 +1350,7 @@ process.on('uncaughtException', err => {
    show_mime_picker: cfg.websrv.show_mime_picker !== false,
    private_society: cfg.websrv.private_society || false,
    private_society_gate: cfg.websrv.private_society_gate || '',
+    private_society_gate_location: cfg.websrv.private_society_gate_location || 'Frankfurt',
    show_content_warning: cfg.websrv.show_content_warning !== false,
    web_url_upload: !!cfg.websrv.web_url_upload,
    enable_youtube_upload: cfg.websrv.enable_youtube_upload !== false,
@@ -1248,6 +1359,7 @@ process.on('uncaughtException', err => {
    custom_favicon: cfg.websrv.custom_favicon || "",
    custom_brand_image: Array.isArray(cfg.websrv.custom_brand_image) ? cfg.websrv.custom_brand_image[0] : (cfg.websrv.custom_brand_image || ""),
    custom_navbar_brand_text: cfg.websrv.custom_navbar_brand_text || "",
+    default_font: cfg.websrv.default_font || "",
    site_description: cfg.websrv.description || "The webs dumpster",
    enable_nsfl: !!cfg.enable_nsfl,
    nsfl_tag_id: cfg.nsfl_tag_id || 3,
@@ -1267,6 +1379,7 @@ process.on('uncaughtException', err => {
    ts: Date.now(),
    get default_layout() { return getDefaultLayout(); },
    show_koepfe: !!cfg.websrv.show_koepfe,
+    hide_sidebar_default: !!cfg.websrv.hide_sidebar_default,
    allow_language_change: cfg.websrv.allow_language_change !== false,
    enable_xd_score: !!cfg.websrv.enable_xd_score,
    enable_dynamic_thumbs: !!cfg.websrv.enable_dynamic_thumbs,
@@ -1276,8 +1389,6 @@ process.on('uncaughtException', err => {
    enable_danmaku: cfg.websrv.enable_danmaku !== false,
    enable_item_title: cfg.websrv.enable_item_title !== false,
    enable_global_chat: !!cfg.websrv.enable_global_chat,
-    enable_sidebar: cfg.websrv.enable_sidebar !== false,
-    sidebar_closed_default: cfg.websrv.sidebar_closed_default === true,
    embed_youtube_in_comments: cfg.websrv.embed_youtube_in_comments !== false,
    get koepfe_json() {
      try {
@@ -1304,7 +1415,7 @@ process.on('uncaughtException', err => {

    get fonts() {
      try {
-        const fontsDir = path.join(path.resolve(), 'public/s/fonts');
+        const fontsDir = cfg.paths.fonts;
        if (!fs.existsSync(fontsDir)) return [];
        return fs.readdirSync(fontsDir).filter(f => /\.(ttf|otf|woff2?)$/i.test(f)).map(f => ({
          name: f.split('.').shift(),
@@ -1351,26 +1462,39 @@ process.on('uncaughtException', err => {
      }
    }

+    // Resolve per-request recaptcha preference (disabled for .onion requests or when passed false)
+    const effectiveReq = req || (data && data.req);
+    const defaultRecaptcha = !!(cfg.recaptcha && cfg.recaptcha.enabled && cfg.recaptcha.site_key);
+    let perRequestRecaptcha = defaultRecaptcha;
+
+    if (effectiveReq && lib.isOnionRequest(effectiveReq)) {
+      perRequestRecaptcha = false;
+    } else if (data && typeof data.recaptcha_enabled === 'boolean') {
+      perRequestRecaptcha = data.recaptcha_enabled;
+    }
+
    // Build data: globals first, then caller-supplied data, then per-request i18n last
    // so t/lang always reflect the user's language, not the site default.
-    // ALSO mutate globals.t and globals.lang: flummpress spreads this.#globals LAST
+    // ALSO mutate globals.t, globals.lang, globals.recaptcha_enabled: flummpress spreads this.#globals LAST
    // inside render(), so globals must carry the per-request values too.
    globals.t = perRequestT;
    globals.lang = perRequestLang;
+    globals.recaptcha_enabled = perRequestRecaptcha;

    // Resolve per-request infobox preference
-    // Guests check the new config flag, whereas users use their session pref or default to the user flag
-    const useAltInfobox = (req && req.session && typeof req.session.use_alternative_infobox === 'boolean') 
-      ? req.session.use_alternative_infobox 
-      : (req && !req.session
-        ? (cfg.websrv.guest_alternative_infobox === true)
+    // Guests always get false — the alternative infobox is a logged-in user preference only
+    const activeReq = req || effectiveReq;
+    const useAltInfobox = (activeReq && activeReq.session && typeof activeReq.session.use_alternative_infobox === 'boolean') 
+      ? activeReq.session.use_alternative_infobox 
+      : (activeReq && !activeReq.session
+        ? false
        : (data && typeof data.user_alternative_infobox === 'boolean'
          ? data.user_alternative_infobox
          : (cfg.websrv.user_alternative_infobox !== false)));

-    const useAltSteuerung = (req && req.session && typeof req.session.use_alternative_steuerung === 'boolean')
-      ? req.session.use_alternative_steuerung
-      : (req && !req.session
+    const useAltSteuerung = (activeReq && activeReq.session && typeof activeReq.session.use_alternative_steuerung === 'boolean')
+      ? activeReq.session.use_alternative_steuerung
+      : (activeReq && !activeReq.session
        ? false
        : (data && typeof data.user_alternative_steuerung === 'boolean'
          ? data.user_alternative_steuerung
@@ -1379,11 +1503,12 @@ process.on('uncaughtException', err => {
    data = Object.assign({}, globals, data || {}, {
      t: perRequestT,
      lang: perRequestLang,
+      recaptcha_enabled: perRequestRecaptcha,
      user_alternative_infobox: useAltInfobox,
      user_alternative_steuerung: useAltSteuerung,
      user_banner_enabled: cfg.websrv.user_banner_enabled !== false,
-      comment_display_mode: (req && req.session && typeof req.session.comment_display_mode === 'number')
-        ? req.session.comment_display_mode
+      comment_display_mode: (activeReq && activeReq.session && typeof activeReq.session.comment_display_mode === 'number')
+        ? activeReq.session.comment_display_mode
        : (data && typeof data.comment_display_mode === 'number'
          ? data.comment_display_mode
          : (cfg.websrv.default_comment_display_mode || 0))
@@ -1395,17 +1520,19 @@ process.on('uncaughtException', err => {
      data.custom_brand_image = brand[Math.floor(Math.random() * brand.length)];
    }

-    if (req) {
-      if (req.mode !== undefined) data.mode = req.mode;
-      data.theme = req.theme || req.cookies?.theme || cfg.websrv.theme || 'f0ck';
-      if (!data.url) data.url = req.url;
-      data.user_strict_bool = (req.session && req.session.strict_mode) ? true : false;
-      data.user_logged_in_bool = !!req.session;
-      data.csrf_token = req.session?.csrf_token || '';
-      data.max_file_size = lib.formatSize(cfg.main.maxfilesize * (req.session?.admin ? cfg.main.adminmultiplier : 1));
-      data.max_file_size_bytes = Math.floor(cfg.main.maxfilesize * (req.session?.admin ? cfg.main.adminmultiplier : 1));
+    if (activeReq) {
+      data.recaptcha_enabled = perRequestRecaptcha;
+      if (activeReq.mode !== undefined) data.mode = activeReq.mode;
+      data.theme = activeReq.theme || activeReq.cookies?.theme || cfg.websrv.theme || 'f0ck';
+      if (!data.url) data.url = activeReq.url;
+      data.user_strict_bool = (activeReq.session && activeReq.session.strict_mode) ? true : false;
+      data.user_logged_in_bool = !!activeReq.session;
+      data.csrf_token = activeReq.session?.csrf_token || '';
+      data.max_file_size = lib.formatSize(cfg.main.maxfilesize * (activeReq.session?.admin ? cfg.main.adminmultiplier : 1));
+      data.max_file_size_bytes = Math.floor(cfg.main.maxfilesize * (activeReq.session?.admin ? cfg.main.adminmultiplier : 1));
      data.web_url_upload = data.web_url_upload !== undefined ? data.web_url_upload : !!cfg.websrv.web_url_upload;
    } else {
+      data.recaptcha_enabled = perRequestRecaptcha;
      data.theme = data.theme || cfg.websrv.theme || 'f0ck';
      data.user_strict_bool = false;
      data.user_logged_in_bool = false;
--- a/views/_gate_template.html
+++ b/views/_gate_template.html
@@ -0,0 +1,35 @@
+<!doctype html>
+<html theme="@if(typeof theme !== 'undefined'){{ theme }}@else{{ default_theme || 'amoled' }}@endif">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>{{ domain }}</title>
+  <link rel="icon" type="image/gif" href="/s/img/favicon.gif" />
+  <link rel="stylesheet" id="injected-gate-styles" href="/s/css/f0ckm.css?v={{ ts }}">
+</head>
+<body class="{{ default_layout === 'legacy' ? 'layout-legacy' : 'layout-modern' }}">
+       
+  <div class="wrapper" style="text-align: center;">
+      <h2>Example Gate</h2>
+      <button type="button" onclick="openLoginGate();">Login</button>
+      
+      <div id="gate-container" style="display:none;">
+          @include(snippets/navbar)
+          @include(snippets/footer)
+      </div>
+  </div>
+
+  <script>
+    function openLoginGate() {
+      document.getElementById('gate-container').style.display = 'block';
+      const tryOpen = () => {
+        const m = document.getElementById('login-modal');
+        if (m) { m.style.display = 'flex'; }
+        else { setTimeout(tryOpen, 50); }
+      };
+      tryOpen();
+    }
+  </script>
+
+</body>
+</html>
--- a/views/admin/users.html
+++ b/views/admin/users.html
@@ -319,7 +319,7 @@
            ModAction.confirm('Verify User', 'Manually verify account for <strong>' + escHTML(userName) + '</strong>?', async () => {
                var res = await fetch('/api/v2/admin/users/activate', {
                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
+                    headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': window.f0ckSession?.csrf_token },
                    body: JSON.stringify({ user_id: id })
                });
                var data = await res.json();
@@ -339,7 +339,7 @@
            ModAction.confirm('Ban User', 'Reason for banning <strong>' + escHTML(userName) + '</strong>?', async (reason) => {
                var res = await fetch('/api/v2/admin/ban', {
                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
+                    headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': window.f0ckSession?.csrf_token },
                    body: JSON.stringify({ user_id: id, reason: reason, duration: 'permanent' })
                });
                var data = await res.json();
@@ -359,7 +359,7 @@
            ModAction.confirm('Unban User', 'Unban account for <strong>' + escHTML(userName) + '</strong>?', async () => {
                var res = await fetch('/api/v2/admin/unban', {
                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
+                    headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': window.f0ckSession?.csrf_token },
                    body: JSON.stringify({ user_id: id })
                });
                var data = await res.json();
@@ -379,7 +379,7 @@
            ModAction.confirm('Delete Uploads', 'Are you SURE you want to delete ALL uploads by <strong>' + escHTML(userName) + '</strong>? This cannot be undone.', async () => {
                var res = await fetch('/api/v2/admin/users/bulk-delete-items', {
                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
+                    headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': window.f0ckSession?.csrf_token },
                    body: JSON.stringify({ user_id: id, username: btn.dataset.username })
                });
                var data = await res.json();
@@ -398,7 +398,7 @@
            ModAction.confirm('Delete Comments', 'Are you SURE you want to delete ALL comments by <strong>' + escHTML(userName) + '</strong>? This will be permanent.', async () => {
                var res = await fetch('/api/v2/admin/users/bulk-delete-comments', {
                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
+                    headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': window.f0ckSession?.csrf_token },
                    body: JSON.stringify({ user_id: id, username: btn.dataset.username })
                });
                var data = await res.json();
@@ -422,7 +422,7 @@
            ModAction.confirm('Set Display Name', hint, async (newName) => {
                var res = await fetch('/api/v2/admin/users/set-display-name', {
                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
+                    headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': window.f0ckSession?.csrf_token },
                    body: JSON.stringify({ user_id: id, display_name: newName || '' })
                });
                var data = await res.json();
@@ -457,7 +457,7 @@
                ModAction.confirm('Unlock Layout', 'Unlock comment layout for <strong>' + escHTML(userName) + '</strong>? They will be able to change it again.', async () => {
                    var res = await fetch('/api/v2/admin/users/lock-layout', {
                        method: 'POST',
-                        headers: { 'Content-Type': 'application/json' },
+                        headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': window.f0ckSession?.csrf_token },
                        body: JSON.stringify({ user_id: id, lock: false })
                    });
                    var data = await res.json();
@@ -481,7 +481,7 @@
                    var mode = document.getElementById('force-mode-select').value;
                    var res = await fetch('/api/v2/admin/users/lock-layout', {
                        method: 'POST',
-                        headers: { 'Content-Type': 'application/json' },
+                        headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': window.f0ckSession?.csrf_token },
                        body: JSON.stringify({ user_id: id, lock: true, mode: mode })
                    });
                    var data = await res.json();
@@ -616,7 +616,7 @@
            try {
                var res = await fetch('/api/v2/admin/users/create', {
                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
+                    headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': window.f0ckSession?.csrf_token },
                    body: JSON.stringify({ username, email: email || null, password, role })
                });
                var data = await res.json();
@@ -662,7 +662,7 @@
                var role = selectEl.value;
                var res = await fetch('/api/v2/admin/users/set-role', {
                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
+                    headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': window.f0ckSession?.csrf_token },
                    body: JSON.stringify({ user_id: id, role })
                });
                var data = await res.json();
--- a/views/item-partial-legacy.html
+++ b/views/item-partial-legacy.html
@@ -197,7 +197,11 @@
                </span>
                <span class="badge" id="favs" @if(!item.favorites.length) hidden@endif>
                    @each(item.favorites as fav)
+                    @if(fav.hide_fav_badge)
+                    <a class="ghost-fav" tooltip="?" flow="up" style="cursor: default;"><img src="/s/img/ghost_fav.svg" style="height: 32px; width: 32px;" loading="lazy" /></a>
+                    @else
                    <a href="/user/{{ fav.user.toLowerCase() }}" tooltip="{!! fav.display_name || fav.user !!}" flow="up"><img src="@if(fav.avatar_file)/a/{{ fav.avatar_file }}@elseif(fav.avatar)/t/{{ fav.avatar }}.webp@else/a/default.png@endif" style="height: 32px; width: 32px@if(fav.username_color); border-color: {{ fav.username_color }}@endif" loading="lazy" /></a>
+                    @endif
                    @endeach
                </span>
                @if(enable_xd_score && item.xd_score > 0)
@@ -210,7 +214,6 @@
            </div>
        </div>

-        @if(session || !hide_comments_from_public)
        <div id="comments-container"
             data-item-id="{{ item.id }}"
             @if(session) data-user="{{ session.user }}" @endif
@@ -222,7 +225,6 @@
            </div>
            @endif
        </div>
-        @endif
        <button class="mobile-scroll-to-top" title="Back to top" aria-label="Scroll to top"><i class="fa-solid fa-chevron-up"></i></button>
        <script id="initial-subscription" type="application/json">{{ isSubscribed }}</script>

@@ -298,7 +300,7 @@
                @if(item.src.short)
                <tr>
                    <th>{{ t('info_modal.source') || 'Source' }}</th>
-                    <td><a href="{{ item.src.long }}" target="_blank">{{ item.src.short }}</a></td>
+                    <td><a href="{{ item.src.long }}" target="_blank" style="word-break: break-all;">{{ item.src.short }}</a></td>
                </tr>
                @endif
            </table>
--- a/views/item-partial-modern.html
+++ b/views/item-partial-modern.html
@@ -39,7 +39,6 @@
        @endif

        <div class="sidebar-tags-container">
-            <div style="margin-bottom: 8px; font-weight: bold; color: var(--white); font-size: 0.9em; text-transform: uppercase;"></div>
            <span class="badge badge-dark" id="tags" style="display: flex; flex-wrap: wrap; gap: 5px; background: transparent; padding: 0; text-align: left; white-space: normal;">
                @if(typeof item.tags !== "undefined")
                @each(item.tags as tag)
@@ -158,7 +157,11 @@
            </div>
                <span id="favs" @if(!item.favorites.length) hidden@endif style="margin-top: 5px;">
                    @each(item.favorites as fav)
+                    @if(fav.hide_fav_badge)
+                    <a class="ghost-fav" tooltip="?" flow="up" style="cursor: default;"><img src="/s/img/ghost_fav.svg" style="height: 32px; width: 32px;" loading="lazy" /></a>
+                    @else
                    <a href="/user/{{ fav.user.toLowerCase() }}" tooltip="{!! fav.display_name || fav.user !!}" flow="up"><img src="@if(fav.avatar_file)/a/{{ fav.avatar_file }}@elseif(fav.avatar)/t/{{ fav.avatar }}.webp@else/a/default.png@endif" style="height: 32px; width: 32px@if(fav.username_color); border-color: {{ fav.username_color }}@endif" loading="lazy" /></a>
+                    @endif
                    @endeach
                </span>

@@ -239,7 +242,7 @@
                @if(item.src.short)
                <tr>
                    <th>{{ t('info_modal.source') || 'Source' }}</th>
-                    <td><a href="{{ item.src.long }}" target="_blank">{{ item.src.short }}</a></td>
+                    <td><a href="{{ item.src.long }}" target="_blank" style="word-break: break-all;">{{ item.src.short }}</a></td>
                </tr>
                @endif
            </table>
--- a/views/meme-creator.html
+++ b/views/meme-creator.html
@@ -8,7 +8,7 @@
                .meme-title { font-family: 'Impact', 'VCR', sans-serif; }
                
                /* NUCLEAR VISIBILITY RESET: Override any and all parent constraints for this page */
-                @media (max-width: 950px) {
+                @media (max-width: 1250px) {
                    /* Target all possible shell triggers */
                    html, body, .pagewrapper, #main, .layout-modern react-wrapper, .layout-legacy react-wrapper { 
                        height: auto !important; 
--- a/views/settings.html
+++ b/views/settings.html
@@ -320,6 +320,20 @@
            </label>
            <small class="text-muted" style="margin-left: 25px;">{{ t('settings.disable_swiping_hint') }}</small>
          </div>
+          <div class="setting-item" style="margin-top: 15px;">
+            <label for="favorites_private_toggle" style="cursor: pointer; display: flex; align-items: center; gap: 10px;">
+              <input type="checkbox" id="favorites_private_toggle" @if(session.favorites_private===true) checked @endif>
+              <span>{{ t('settings.favorites_private') }}</span>
+            </label>
+            <small class="text-muted" style="margin-left: 25px;">{{ t('settings.favorites_private_hint') }}</small>
+            <div class="sub-setting-item" style="margin-left: 25px; margin-top: 10px;">
+              <label for="hide_fav_badge_toggle" style="cursor: pointer; display: flex; align-items: center; gap: 10px;">
+                <input type="checkbox" id="hide_fav_badge_toggle" @if(session.hide_fav_badge===true) checked @endif>
+                <span>{{ t('settings.hide_fav_badge') }}</span>
+              </label>
+              <small class="text-muted" style="margin-left: 25px;">{{ t('settings.hide_fav_badge_hint') }}</small>
+            </div>
+          </div>
          <div class="setting-item" style="margin-top: 15px;">
            <label for="show_background_toggle" style="cursor: pointer; display: flex; align-items: center; gap: 10px;">
              <input type="checkbox" id="show_background_toggle" @if(session.show_background !==false) checked @endif>
--- a/views/snippets/footer.html
+++ b/views/snippets/footer.html
@@ -102,7 +102,7 @@
@if(session)
@include(snippets/metadata-modal)
@endif
-@if(!private_society && enable_sidebar || session && enable_sidebar)
+@if(!private_society || session)
 <div class="global-sidebar-right">
  <div class="sidebar-activity">
    <div id="sidebar-activity-container" class="sidebar-comments-list">
@@ -127,7 +127,7 @@
@endif
@if(private_society && !session)
 <script>
-  window.f0ckSession = { logged_in: false, enable_xd_score: @if(enable_xd_score) true @else false @endif, default_theme: "{{ default_theme }}", show_content_warning: @if(show_content_warning) true @else false @endif, use_new_layout: @if(default_layout === 'legacy')false @else true @endif, comment_display_mode: {{ comment_display_mode }}, comment_max_length: {{ comment_max_length !== null && comment_max_length !== undefined ? comment_max_length : 'null' }}, development: @if(development) true @else false @endif, allow_comment_deletion: @if(allow_comment_deletion) true @else false @endif };
+  window.f0ckSession = { logged_in: false, enable_xd_score: @if(enable_xd_score) true @else false @endif, default_theme: "{{ default_theme }}", show_content_warning: @if(show_content_warning) true @else false @endif, use_new_layout: @if(default_layout === 'legacy')false @else true @endif, comment_display_mode: {{ comment_display_mode }}, comment_max_length: {{ comment_max_length !== null && comment_max_length !== undefined ? comment_max_length : 'null' }}, development: @if(development) true @else false @endif, allow_comment_deletion: @if(allow_comment_deletion) true @else false @endif, hide_sidebar_default: @if(hide_sidebar_default) true @else false @endif };
  window.f0ckDebug = window.f0ckSession.development ? console.log.bind(console) : () => {};
  (() => {
    const loginModal = document.getElementById('login-modal');
@@ -406,6 +406,7 @@
    dm_unencrypted: @if(dm_unencrypted) true @else false @endif,
    allow_comment_deletion: @if(allow_comment_deletion) true @else false @endif,
    enable_comment_polls: @if(enable_comment_polls) true @else false @endif,
+    hide_sidebar_default: @if(hide_sidebar_default) true @else false @endif,
    mode: {{ mode !== undefined ? mode : 0 }}
  };
  window.f0ckDebug = window.f0ckSession.development ? console.log.bind(console) : () => {};
@@ -591,9 +592,7 @@
  };
 </script>
 <script src="/s/js/f0ckm.js?v={{ ts }}"></script>
-@if(enable_sidebar)
 <script src="/s/js/sidebar-activity.js?v={{ ts }}"></script>
-@endif
 <script src="/s/js/flash_yank.js?v={{ ts }}"></script>
@if(show_koepfe && !(session && session.hide_koepfe))
 <script>window.f0ckKoepfe = {{ koepfe_json }};</script>
--- a/views/snippets/header.html
+++ b/views/snippets/header.html
@@ -8,6 +8,7 @@
  <meta name="mobile-web-app-capable" content="yes">
  <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
  <meta name="apple-mobile-web-app-title" content="{{ domain }}">
+  <script>(function(){var h=document.documentElement;if(localStorage.getItem('hideItemRatings')==='true')h.classList.add('hide-item-ratings-active');if(localStorage.getItem('blurNsfw')==='true')h.classList.add('blur-nsfw-active');if(localStorage.getItem('blurNsfl')==='true')h.classList.add('blur-nsfl-active');if(localStorage.getItem('blurSfw')==='true')h.classList.add('blur-sfw-active');if(localStorage.getItem('blurUntagged')==='true')h.classList.add('blur-untagged-active');if(localStorage.getItem('blurDetail')!=='false')h.classList.add('blur-detail-active');if(localStorage.getItem('imageExpandOnClick')!=='false')h.classList.add('image-expand-active');})();</script>
  <style>
    html { background-color: #000; color: #fff; }
    @if(session && session.font)
@@ -15,10 +16,18 @@
      font-family: 'CustomUserFont';
      src: url('/s/fonts/{{ session.font }}');
    }
+    @elseif(typeof default_font !== 'undefined' && default_font && default_font.length > 0)
+    {{ "@" }}font-face {
+      font-family: 'SiteDefaultFont';
+      src: url('/s/fonts/{{ default_font }}');
+    }
    @endif
    :root {
+      --favicon-url: url('@if(custom_favicon && custom_favicon.length > 0){{ custom_favicon }}@else/s/img/favicon.gif@endif');
      @if(session && session.font)
      --font: 'CustomUserFont', monospace !important;
+      @elseif(typeof default_font !== 'undefined' && default_font && default_font.length > 0)
+      --font: 'SiteDefaultFont', monospace !important;
      @endif
    }
    @if(session && session.font)
@@ -30,6 +39,15 @@
    .fas::before, .far::before, .fab::before, .fa::before {
      font-family: "Font Awesome 6 Free", "Font Awesome 6 Brands" !important;
    }
+    @elseif(typeof default_font !== 'undefined' && default_font && default_font.length > 0)
+    *:not(canvas):not(.meme-title):not(.force-impact):not(.fa-solid):not(.fa-regular):not(.fa-brands):not(.fa-light):not(.fa-thin):not(.fa-duotone):not([class*=" fa-"]):not([class^="fa-"]) {
+      font-family: 'SiteDefaultFont', monospace !important;
+    }
+    /* Explicitly protect FA pseudo-elements */
+    .fa-solid::before, .fa-regular::before, .fa-brands::before,
+    .fas::before, .far::before, .fab::before, .fa::before {
+      font-family: "Font Awesome 6 Free", "Font Awesome 6 Brands" !important;
+    }
    @endif
  </style>
  <link rel="preload" href="/s/vcr.ttf" as="font" type="font/ttf" crossorigin>
@@ -77,8 +95,8 @@
  @endif
 </head>

-<body class="@if(session)@if(session.use_new_layout)layout-modern@else layout-legacy @endif@else @if(default_layout === 'legacy')layout-legacy@else layout-modern@endif @endif @if(private_society && !session)private-gate-active@endif @if(!enable_sidebar)sidebar-right-hidden@endif">
-  <script>if(localStorage.getItem('sidebarRightHidden')==='true' || (localStorage.getItem('sidebarRightHidden')===null && {{ sidebar_closed_default ? 'true' : 'false' }}))document.body.classList.add('sidebar-right-hidden');if(localStorage.getItem('comments_hidden')==='true')document.body.classList.add('sidebar-left-hidden');(function(){var d=window.devicePixelRatio||1;console.log('[DPR] devicePixelRatio='+d);var t='dpr-1x';if(d>=1.55)t='dpr-high';else if(d>=1.39)t='dpr-150';else if(d>=1.26)t='dpr-130';else if(d>=1.20)t='dpr-120';else if(d>=1.05)t='dpr-110';document.documentElement.setAttribute('data-dpr',t);})();</script>
+<body class="@if(session)@if(session.use_new_layout)layout-modern@else layout-legacy @endif@else @if(default_layout === 'legacy')layout-legacy@else layout-modern@endif @endif @if(private_society && !session)private-gate-active@endif">
+  <script>var sRH = localStorage.getItem('sidebarRightHidden'); if(sRH==='true' || (sRH===null && @if(hide_sidebar_default) true @else false @endif)) document.body.classList.add('sidebar-right-hidden'); if(localStorage.getItem('comments_hidden')==='true')document.body.classList.add('sidebar-left-hidden');(function(){var d=window.devicePixelRatio||1;console.log('[DPR] devicePixelRatio='+d);var t='dpr-1x';if(d>=1.55)t='dpr-high';else if(d>=1.39)t='dpr-150';else if(d>=1.26)t='dpr-130';else if(d>=1.20)t='dpr-120';else if(d>=1.05)t='dpr-110';document.documentElement.setAttribute('data-dpr',t);})();</script>
  @if(!private_society || session)
  <canvas class="hidden-xs" id="bg"></canvas>
  @endif
--- a/views/tag-cards.html
+++ b/views/tag-cards.html
@@ -1,5 +1,5 @@
@each(toptags as toptag)
-<a href="/tag/{{ toptag.safe_tag }}" class="tag-card">
+<a href="/tag/{{ toptag.safe_tag }}@if(user && user.user)?tagger={!! encodeURIComponent(user.user) !!}@endif" class="tag-card">
    <div class="tag-card-image">
        <img src="/tag_image/{{ toptag.encoded_tag }}?m={{ session.mode }}" loading="lazy" alt="{!! toptag.tag !!}">
    </div>
--- a/views/user-partial.html
+++ b/views/user-partial.html
@@ -48,7 +48,7 @@
        <div class="profile_head_username">
            <div style="display: flex; justify-content: space-between; align-items: flex-start; gap: 10px;">
                <div style="flex: 1; min-width: 0; word-break: break-word; line-height: 1.2; align-self: flex-start; margin-top: 0; display: flex; align-items: center; gap: 5px;" id="profile-name-container">
-                    <span id="nav-display-name" @if(user.username_color) style="color: {{ user.username_color }}" @endif>@if(user.admin)&#9889;&nbsp;@elseif(user.is_moderator)&#128737;&nbsp;@endif{!! user.display_name || user.user !!}@if(user.is_ghost) <span class="badge badge-secondary" style="font-size: 0.5em; vertical-align: middle; background-color: #5bc0de; color: #fff; padding: 2px 5px; border-radius: 3px; margin-left: 5px;">LEGACY</span>@endif @if(user.banned) <span class="badge badge-danger" tooltip="{{ user.ban_duration }}" style="font-size: 0.5em; vertical-align: middle; background-color: #d9534f; color: #fff; padding: 2px 5px; border-radius: 3px; margin-left: 5px;">BANNED</span>@endif</span>@if(user.display_name) <span style="font-size: 0.65em; color: #666; font-weight: 400; margin-left: 5px; letter-spacing: 0.5px;" id="username-bracket">({!! user.user !!})</span>@endif
+                    <span id="profile-display-name" @if(user.username_color) style="color: {{ user.username_color }}" @endif>@if(user.admin)&#9889;&nbsp;@elseif(user.is_moderator)&#128737;&nbsp;@endif{!! user.display_name || user.user !!}@if(user.is_ghost) <span class="badge badge-secondary" style="font-size: 0.5em; vertical-align: middle; background-color: #5bc0de; color: #fff; padding: 2px 5px; border-radius: 3px; margin-left: 5px;">LEGACY</span>@endif @if(user.banned) <span class="badge badge-danger" tooltip="{{ user.ban_duration }}" style="font-size: 0.5em; vertical-align: middle; background-color: #d9534f; color: #fff; padding: 2px 5px; border-radius: 3px; margin-left: 5px;">BANNED</span>@endif</span>@if(user.display_name) <span style="font-size: 0.65em; color: #666; font-weight: 400; margin-left: 5px; letter-spacing: 0.5px;" id="username-bracket">({!! user.user !!})</span>@endif
                    @if(session && session.id === user.user_id)
                    <button id="inline-name-edit-btn" style="background: transparent; border:none; color: var(--text-muted); cursor: pointer; font-size: 0.7em; padding: 0;" title="Edit Name & Color">
                        <i class="fa-solid fa-pen"></i>
@@ -142,6 +142,14 @@
    </div>
    @if(!user.is_ghost)
    <div class="favs">
+        @if(favs && favs.is_private)
+        <div class="favs-header">
+            {{ t('profile.favs_label') }}
+        </div>
+        <div class="private-favs-msg" style="text-align: center;">
+            {{ t('profile.private_favorites') }}
+        </div>
+        @else
        <div class="favs-header">
            {{ t('profile.favs_label') }}: {{ count.favs }} <a href="@if(favs.link && favs.link.main){{ favs.link.main }}@else#@endif">{{ t('profile.view_all') }}</a>
        </div>
@@ -164,6 +172,7 @@
        @else
        {{ t('profile.no_favs') }}
        @endif
+        @endif
    </div>
    @endif
 </div>
@@ -509,18 +518,27 @@
                    nameContainer.style.display = 'flex';
                    nameEditContainer.style.display = 'none';
                    
-                    const nameSpan = document.getElementById('nav-display-name');
-                    if (nameSpan) {
-                        nameSpan.style.color = color;
-                        for (let i = nameSpan.childNodes.length - 1; i >= 0; i--) {
-                            let node = nameSpan.childNodes[i];
+                    const updateNameNode = (el, text) => {
+                        if (!el) return;
+                        for (let i = el.childNodes.length - 1; i >= 0; i--) {
+                            let node = el.childNodes[i];
                            if (node.nodeType === Node.TEXT_NODE && node.nodeValue.trim().length > 0) {
-                                // Match and preserve any non-breaking spaces at the start (from admin/mod badges)
-                                const match = node.nodeValue.match(new RegExp('^(\\\\s*)(.*)'));
-                                node.nodeValue = (match ? match[1] : '') + (displayName ? displayName : '{{ user.user }}');
+                                const match = node.nodeValue.match(new RegExp('^(\\s*)(.*)'));
+                                node.nodeValue = (match ? match[1] : '') + text;
                                break;
                            }
                        }
+                    };
+                    const targetName = displayName ? displayName : '{{ user.user }}';
+                    const profileSpan = document.getElementById('profile-display-name');
+                    if (profileSpan) {
+                        profileSpan.style.color = color;
+                        updateNameNode(profileSpan, targetName);
+                    }
+                    const navSpan = document.getElementById('nav-display-name');
+                    if (navSpan) {
+                        navSpan.style.color = color;
+                        updateNameNode(navSpan, targetName);
                    }
                    const bracket = document.getElementById('username-bracket');
                    if (bracket) {
Author	SHA1	Message	Date
Kibi Kelburton	c7414e4b21	CSS QoL	2026-08-06 23:55:51 +02:00
Kibi Kelburton	1262b15a5b	add option to also hide fav activity from public	2026-08-06 23:00:12 +02:00
Kibi Kelburton	2cd8bd91ff	add option for users to make their favorites private	2026-08-06 22:40:53 +02:00
Kibi Kelburton	7b186dcdb2	remove this since it can break v6 config	2026-08-06 22:24:04 +02:00
Kibi Kelburton	973753d231	fix nginx ipv6 and make tor only available to localhost	2026-08-06 21:48:05 +02:00
Kibi Kelburton	c30b3535ae	smoothies	2026-07-28 22:30:04 +02:00
Kibi Kelburton	eed8b993e1	truncate .	2026-07-28 22:06:31 +02:00
Kibi Kelburton	9c239769e6	quote truncation	2026-07-28 22:00:58 +02:00
Kibi Kelburton	6e07194b27	possible fix for weird ass username display bug	2026-07-28 16:42:18 +02:00
Kibi Kelburton	866a8003fe	fix comment quoting	2026-07-28 16:26:26 +02:00
Kibi Kelburton	5ab1a9614a	d	2026-07-28 07:47:49 +02:00
Kibi Kelburton	e45df6a769	d	2026-07-28 07:46:06 +02:00
Kibi Kelburton	99eb9735a1	show pill	2026-07-28 06:38:20 +02:00
Kibi Kelburton	b651621cee	foobarbaz	2026-07-28 06:30:50 +02:00
Kibi Kelburton	d3ce2e38f0	update readme	2026-07-28 03:34:57 +02:00
Kibi Kelburton	096786516e	503	2026-07-28 03:11:16 +02:00
Kibi Kelburton	ec895a285b	onion rules	2026-07-28 03:08:46 +02:00
Kibi Kelburton	20aaf183d8	less is more	2026-07-28 03:01:30 +02:00
Kibi Kelburton	25ab4ba949	adding tor switch and update readme	2026-07-27 12:32:08 +02:00
Kibi Kelburton	6a52445987	custom location for CF Gate and removing box-shadow	2026-07-27 12:28:06 +02:00
Kibi Kelburton	63c39ebe90	deactivate captcha for onion	2026-07-27 10:26:05 +02:00
Kibi Kelburton	0a21b6c8f8	positioning is kinda weird for notic-count	2026-07-27 00:44:00 +02:00
Kibi Kelburton	a7aabac956	update example gate	2026-07-27 00:22:13 +02:00
Kibi Kelburton	9f5510bc04	add custom gate template for private society	2026-07-27 00:12:51 +02:00
Kibi Kelburton	54e2e8871b	respect config settings	2026-07-26 23:24:28 +02:00
Kibi Kelburton	c99f3e11d8	fix invalid csrf token	2026-07-26 23:20:20 +02:00
Kibi Kelburton	d14feaf3eb	correctly display url in gate	2026-07-26 23:10:41 +02:00
Kibi Kelburton	5e35fd48d4	Revert "adding hardcoded meta for onion" This reverts commit `a07c21f22b`.	2026-07-26 23:07:27 +02:00
Kibi Kelburton	a07c21f22b	adding hardcoded meta for onion	2026-07-26 23:04:45 +02:00
Kibi Kelburton	65fb96f675	f	2026-07-26 22:38:10 +02:00
Kibi Kelburton	20a6ffcb04	break long text in info modal	2026-07-26 22:27:57 +02:00
Kibi Kelburton	8518e87c8d	fix pagination	2026-07-26 22:09:44 +02:00
Kibi Kelburton	a3148848f2	option to advertise onion url	2026-07-26 21:43:39 +02:00
Kibi Kelburton	abedf7a789	trying HS	2026-07-26 21:37:07 +02:00
Kibi Kelburton	e61e24dfe8	fix scroller tagging invalid csrf token	2026-07-26 21:20:00 +02:00
Kibi Kelburton	44af6ae061	mobile default tab selection	2026-07-26 20:45:16 +02:00
Kibi Kelburton	0739d72334	remove the fucking animations for new comments	2026-07-25 22:49:27 +02:00
Kibi Kelburton	848055446a	enabling ipv6 for f0ckm-nginx	2026-07-25 22:38:34 +02:00
Kibi Kelburton	88e6b6efb9	persist hide item ratings	2026-07-25 21:52:47 +02:00
Kibi Kelburton	eea70ed62e	fix quoting	2026-07-25 21:49:11 +02:00
Kibi Kelburton	b6c906636c	bggg	2026-07-23 21:40:13 +02:00
Kibi Kelburton	55b5a0ba9f	fuyo	2026-07-23 21:37:22 +02:00
Kibi Kelburton	5d60d80fc9	g	2026-07-23 21:35:36 +02:00
Kibi Kelburton	4dfb80b149	modern shit	2026-07-23 21:25:38 +02:00
Kibi Kelburton	b319f21cd4	favvv	2026-07-23 21:16:25 +02:00
Kibi Kelburton	28ed8d985c	f0ck95d love	2026-07-23 21:14:32 +02:00
Kibi Kelburton	0f5e795793	fuck no	2026-07-23 20:51:06 +02:00
Kibi Kelburton	78d14a1b56	daisuki	2026-07-23 20:46:40 +02:00
Kibi Kelburton	3f149531da	genki	2026-07-23 20:42:49 +02:00
Kibi Kelburton	7a4432277d	fix tags page	2026-07-19 23:19:47 +02:00
Kibi Kelburton	84eee7e13d	plastic surgery	2026-07-19 23:05:08 +02:00
Kibi Kelburton	2206b3eb86	fix modern layout	2026-07-19 23:01:28 +02:00
Kibi Kelburton	5529724982	sunshine daisy	2026-07-19 22:49:13 +02:00
Kibi Kelburton	9c6070afff	xd	2026-07-19 19:53:37 +02:00
Kibi Kelburton	5bfa336773	staleness sucks	2026-07-19 19:44:54 +02:00
Kibi Kelburton	517444f9ce	ignore svelte for prod	2026-07-19 19:43:21 +02:00
Kibi Kelburton	edb92ffa2a	vert align top context link	2026-07-19 19:42:32 +02:00
Kibi Kelburton	3344064030	tags	2026-07-19 07:37:13 +02:00
Kibi Kelburton	e998ba8fc7	chickendöner	2026-07-19 03:30:52 +02:00
Kibi Kelburton	6b087efab3	xd	2026-07-19 02:12:58 +02:00
Kibi Kelburton	6c9f019646	350	2026-07-19 02:11:05 +02:00
Kibi Kelburton	d35437373f	possible fix for 502	2026-07-19 00:15:36 +02:00
Kibi Kelburton	6efb67f2f5	fuck this auto tagging	2026-07-18 23:44:03 +02:00
Kibi Kelburton	fecb0f0b0c	tag depths	2026-07-18 23:33:25 +02:00
Kibi Kelburton	d89c610dcb	gfd	2026-07-18 23:09:28 +02:00
Kibi Kelburton	93c042251a	set default font via config	2026-07-18 22:16:56 +02:00
Kibi Kelburton	990de4b710	vertalign	2026-07-18 22:03:33 +02:00
Kibi Kelburton	2f9ad4d349	gfd	2026-07-18 17:21:04 +02:00
Kibi Kelburton	701bee7a9a	fdsa	2026-07-18 17:15:35 +02:00
Kibi Kelburton	4b7fba11ad	smaller font = better	2026-07-18 17:11:40 +02:00
Kibi Kelburton	6f8eb6f83f	g	2026-07-18 17:07:55 +02:00
Kibi Kelburton	d78b31633a	bbb	2026-07-18 16:52:01 +02:00
Kibi Kelburton	294cf2455a	hide sidebar yes no	2026-07-18 16:48:55 +02:00
Kibi Kelburton	663ba13d18	starto	2026-07-18 16:30:22 +02:00
Kibi Kelburton	84c3f1ccda	gfsd	2026-07-18 16:18:22 +02:00
Kibi Kelburton	4dc7f10ae2	kibort	2026-07-18 16:15:47 +02:00
Kibi Kelburton	3ff1edf8bf	I do love my keyboard	2026-07-18 16:11:06 +02:00
Kibi Kelburton	9ad6eaefec	gfsd	2026-07-18 16:01:44 +02:00
Kibi Kelburton	d4eb0e52d8	confusion	2026-07-18 15:58:59 +02:00
Kibi Kelburton	ce54ed460d	fugg :D	2026-07-18 15:40:12 +02:00
Kibi Kelburton	cddc763c44	consistency refe	2026-07-18 15:36:49 +02:00
Kibi Kelburton	61036558a0	Revert "awesome!!" This reverts commit `8f0e0d9b3a`.	2026-07-18 15:03:02 +02:00
Kibi Kelburton	3354baf09f	Revert "ff" This reverts commit `c3c485af79`.	2026-07-18 15:01:01 +02:00
Kibi Kelburton	c3c485af79	ff	2026-07-18 14:59:46 +02:00
Kibi Kelburton	8f0e0d9b3a	awesome!!	2026-07-18 14:45:46 +02:00
Kibi Kelburton	fefd3b6ca6	gdf	2026-07-18 14:37:40 +02:00
Kibi Kelburton	5818a0ff39	dragging!!	2026-07-18 14:34:18 +02:00
Kibi Kelburton	036a9d372d	im pathetic at this point	2026-07-18 14:27:04 +02:00
Kibi Kelburton	bef96160db	the most pathetic fix to exist yet	2026-07-18 14:24:21 +02:00
Kibi Kelburton	a99c17c16b	actually useful fix	2026-07-18 14:08:50 +02:00
Kibi Kelburton	469f699dd7	button fligger	2026-07-18 13:59:43 +02:00
Kibi Kelburton	d3f8c87317	stripping source identifier for IG	2026-07-18 13:54:04 +02:00
Kibi Kelburton	568555eab8	62%	2026-07-18 11:18:10 +02:00