diff --git a/CHANGELOG b/CHANGELOG
index cfe92646c..a745ffe66 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,7 @@
 CHANGELOG Roundcube Webmail
 ===========================
 
+- Fix navigation in messages search results
 - Improved handling of some malformed values encoded with quoted-printable (#1488232)
 - Add possibility to do LDAP bind before searching for bind DN
 - Fix handling of empty <U> tags in HTML messages (#1488225)
diff --git a/program/include/rcube_mdb2.php b/program/include/rcube_mdb2.php
index 3b7a6129b..f1669677c 100644
--- a/program/include/rcube_mdb2.php
+++ b/program/include/rcube_mdb2.php
@@ -91,6 +91,8 @@ class rcube_mdb2
             $db_options['disable_smart_seqname'] = true;
             $db_options['seqname_format'] = '%s';
         }
+        $this->db_error     = false;
+        $this->db_error_msg = null;
 
         $dbh = MDB2::connect($dsn, $db_options);
 
@@ -145,6 +147,13 @@ class rcube_mdb2
         $this->db_handle    = $this->dsn_connect($dsn);
         $this->db_connected = !PEAR::isError($this->db_handle);
 
+        // use write-master when read-only fails
+        if (!$this->db_connected && $mode == 'r') {
+            $mode = 'w';
+            $this->db_handle    = $this->dsn_connect($this->db_dsnw);
+            $this->db_connected = !PEAR::isError($this->db_handle);
+        }
+
         if ($this->db_connected)
             $this->db_mode = $mode;
         else
diff --git a/program/js/app.js b/program/js/app.js
index 8ffcf93af..de7cb62b7 100644
--- a/program/js/app.js
+++ b/program/js/app.js
@@ -228,7 +228,8 @@ function rcube_webmail()
           this.enable_command('reply-list', this.env.list_post);
 
           if (this.env.action == 'show') {
-            this.http_request('pagenav', '_uid='+this.env.uid+'&_mbox='+urlencode(this.env.mailbox),
+            this.http_request('pagenav', '_uid='+this.env.uid+'&_mbox='+urlencode(this.env.mailbox)
+              + (this.env.search_request ? '&_search='+this.env.search_request : ''),
               this.display_message('', 'loading'));
           }
 
diff --git a/program/steps/mail/attachments.inc b/program/steps/mail/attachments.inc
index ffb164279..ed4a81186 100644
--- a/program/steps/mail/attachments.inc
+++ b/program/steps/mail/attachments.inc
@@ -25,9 +25,12 @@ if (!empty($_GET['_progress'])) {
 }
 
 $COMPOSE_ID = get_input_value('_id', RCUBE_INPUT_GPC);
-$_SESSION['compose'] = $_SESSION['compose_data_'.$COMPOSE_ID];
+$COMPOSE    = null;
 
-if (!$_SESSION['compose']) {
+if ($COMPOSE_ID && $_SESSION['compose_data_'.$COMPOSE_ID])
+  $COMPOSE =& $_SESSION['compose_data_'.$COMPOSE_ID];
+
+if (!$COMPOSE) {
   die("Invalid session var!");
 }
 
@@ -38,15 +41,15 @@ if ($RCMAIL->action=='remove-attachment')
   $id = 'undefined';
   if (preg_match('/^rcmfile(\w+)$/', $_POST['_file'], $regs))
     $id = $regs[1];
-  if ($attachment = $_SESSION['compose']['attachments'][$id])
+  if ($attachment = $COMPOSE['attachments'][$id])
     $attachment = $RCMAIL->plugins->exec_hook('attachment_delete', $attachment);
   if ($attachment['status']) {
-    if (is_array($_SESSION['compose']['attachments'][$id])) {
-      unset($_SESSION['compose']['attachments'][$id]);
+    if (is_array($COMPOSE['attachments'][$id])) {
+      unset($COMPOSE['attachments'][$id]);
       $OUTPUT->command('remove_from_attachment_list', "rcmfile$id");
     }
   }
-  
+
   $OUTPUT->send();
   exit;
 }
@@ -56,16 +59,16 @@ if ($RCMAIL->action=='display-attachment')
   $id = 'undefined';
   if (preg_match('/^rcmfile(\w+)$/', $_GET['_file'], $regs))
     $id = $regs[1];
-  if ($attachment = $_SESSION['compose']['attachments'][$id])
+  if ($attachment = $COMPOSE['attachments'][$id])
     $attachment = $RCMAIL->plugins->exec_hook('attachment_display', $attachment);
-    
+
   if ($attachment['status']) {
     if (empty($attachment['size']))
       $attachment['size'] = $attachment['data'] ? strlen($attachment['data']) : @filesize($attachment['path']);
 
     header('Content-Type: ' . $attachment['mimetype']);
     header('Content-Length: ' . $attachment['size']);
-    
+
     if ($attachment['data'])
       echo $attachment['data'];
     else if ($attachment['path'])
@@ -76,8 +79,8 @@ if ($RCMAIL->action=='display-attachment')
 
 // attachment upload action
 
-if (!is_array($_SESSION['compose']['attachments'])) {
-  $_SESSION['compose']['attachments'] = array();
+if (!is_array($COMPOSE['attachments'])) {
+  $COMPOSE['attachments'] = array();
 }
 
 // clear all stored output properties (like scripts and env vars)
@@ -107,9 +110,9 @@ if (is_array($_FILES['_attachments']['tmp_name'])) {
 
       // store new attachment in session
       unset($attachment['status'], $attachment['abort']);
-      $_SESSION['compose']['attachments'][$id] = $attachment;
+      $COMPOSE['attachments'][$id] = $attachment;
 
-      if (($icon = $_SESSION['compose']['deleteicon']) && is_file($icon)) {
+      if (($icon = $COMPOSE['deleteicon']) && is_file($icon)) {
         $button = html::img(array(
           'src' => $icon,
           'alt' => rcube_label('delete')
diff --git a/program/steps/mail/compose.inc b/program/steps/mail/compose.inc
index d98452afc..7eaad2573 100644
--- a/program/steps/mail/compose.inc
+++ b/program/steps/mail/compose.inc
@@ -346,10 +346,14 @@ foreach ($parts as $header) {
 
   // we have a set of recipients stored is session
   if ($header == 'to' && ($mailto_id = $COMPOSE['param']['mailto'])
-      && $COMPOSE[$mailto_id]
+      && $_SESSION['mailto'][$mailto_id]
   ) {
-    $fvalue = urldecode($COMPOSE[$mailto_id]);
+    $fvalue = urldecode($_SESSION['mailto'][$mailto_id]);
     $decode_header = false;
+
+    // make session to not grow up too much
+    unset($_SESSION['mailto'][$mailto_id]);
+    $COMPOSE['param']['to'] = $fvalue;
   }
   else if (!empty($_POST['_'.$header])) {
     $fvalue = get_input_value('_'.$header, RCUBE_INPUT_POST, TRUE);
diff --git a/program/steps/settings/save_prefs.inc b/program/steps/settings/save_prefs.inc
index d917e1157..f5f3e36d3 100644
--- a/program/steps/settings/save_prefs.inc
+++ b/program/steps/settings/save_prefs.inc
@@ -145,6 +145,8 @@ switch ($CURR_SECTION)
     // switch skin (if valid, otherwise unset the pref and fall back to default)
     if (!$OUTPUT->set_skin($a_user_prefs['skin']))
       unset($a_user_prefs['skin']);
+    else if ($RCMAIL->config->get('skin') != $a_user_prefs['skin'])
+      $OUTPUT->command('reload', 500);
 
     // force min size
     if ($a_user_prefs['pagesize'] < 1)