Merge branch 'master' into oc_error

author: Georg Ehrke <dev@georgswebsite.de> 2012-06-22 21:37:03 +0200
committer: Georg Ehrke <dev@georgswebsite.de> 2012-06-22 21:37:03 +0200
commit: 243f910ae4c1125566703ee53d5b4e31f13ea95b (patch)
tree: 5eec0c402a069bbca9433190e2dcd7e6d9d5928d
parent: 4d312f78497d0134ad2315863db69747be5dd108 (diff)
parent: f4b937c6fe325b1ad8bceb7ceba69a9a8a068bcd (diff)
download: nextcloud-server-243f910ae4c1125566703ee53d5b4e31f13ea95b.tar.gz
nextcloud-server-243f910ae4c1125566703ee53d5b4e31f13ea95b.zip
84 files changed, 764 insertions, 529 deletions
diff --git a/apps/bookmarks/ajax/addBookmark.php b/apps/bookmarks/ajax/addBookmark.php
index a2eb506f85e..d66aab58960 100644
--- a/apps/bookmarks/ajax/addBookmark.php
+++ b/apps/bookmarks/ajax/addBookmark.php
@@ -30,6 +30,6 @@ $RUNTIME_NOSETUPFS=true;
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('bookmarks');
 
-require_once(OC::$APPSROOT . '/apps/bookmarks/bookmarksHelper.php');
-$id = addBookmark($_POST['url'], $_POST['title'], $_POST['tags']);
+require_once(OC_App::getAppPath('bookmarks').'/bookmarksHelper.php');
+$id = addBookmark($_GET['url'], $_GET['title'], $_GET['tags']);
 OCP\JSON::success(array('data' => $id));
 \ No newline at end of file
diff --git a/apps/bookmarks/ajax/editBookmark.php b/apps/bookmarks/ajax/editBookmark.php
index fcec2e1cedb..439b680dc20 100644
--- a/apps/bookmarks/ajax/editBookmark.php
+++ b/apps/bookmarks/ajax/editBookmark.php
@@ -40,18 +40,26 @@ if( $CONFIG_DBTYPE == 'sqlite' or $CONFIG_DBTYPE == 'sqlite3' ){
 }
 
 $bookmark_id = (int)$_POST["id"];
+$user_id = OCP\USER::getUser();
 
 $query = OCP\DB::prepare("
 	UPDATE *PREFIX*bookmarks
 	SET url = ?, title =?, lastmodified = $_ut
-	WHERE id = $bookmark_id
+	WHERE id = ?
+	AND user_id = ?
 	");
 
 $params=array(
 	htmlspecialchars_decode($_POST["url"]),
 	htmlspecialchars_decode($_POST["title"]),
+	$bookmark_id,
+	$user_id,
 	);
-$query->execute($params);
+
+$result = $query->execute($params);
+
+# Abort the operation if bookmark couldn't be set (probably because the user is not allowed to edit this bookmark)
+if ($result->numRows() == 0) exit();
 
 # Remove old tags and insert new ones.
 $query = OCP\DB::prepare("
@@ -66,7 +74,7 @@ $query = OCP\DB::prepare("
 	(bookmark_id, tag)
 	VALUES (?, ?)
 	");
-	
+
 $tags = explode(' ', urldecode($_POST["tags"]));
 foreach ($tags as $tag) {
 	if(empty($tag)) {
diff --git a/apps/bookmarks/templates/list.php b/apps/bookmarks/templates/list.php
index fdd2b19f79a..4b84b438900 100644
--- a/apps/bookmarks/templates/list.php
+++ b/apps/bookmarks/templates/list.php
@@ -7,7 +7,7 @@
  * See the COPYING-README file.
  */
 ?>
-<input type="hidden" id="bookmarkFilterTag" value="<?php if(isset($_GET['tag'])) echo htmlentities($_GET['tag'],ENT_COMPAT,'utf-8'); ?>" />
+<input type="hidden" id="bookmarkFilterTag" value="<?php if(isset($_GET['tag'])) echo OCP\Util::sanitizeHTML($_GET['tag']); ?>" />
 <div id="controls">
 	<input type="hidden" id="bookmark_add_id" value="0" />
 	<input type="text" id="bookmark_add_url" placeholder="<?php echo $l->t('Address'); ?>" class="bookmarks_input" />
@@ -20,7 +20,7 @@
 <div id="firstrun" style="display: none;">
 	<?php
 		echo $l->t('You have no bookmarks');
-		require_once(OC::$APPSROOT . '/apps/bookmarks/templates/bookmarklet.php');
+		require_once(OC_App::getAppPath('bookmarks') .'/templates/bookmarklet.php');
 		createBookmarklet(); 
 	?>
 </div>
diff --git a/apps/calendar/ajax/calendar/new.php b/apps/calendar/ajax/calendar/new.php
index 278c8e5520b..e77d4ebff03 100644
--- a/apps/calendar/ajax/calendar/new.php
+++ b/apps/calendar/ajax/calendar/new.php
@@ -31,7 +31,13 @@ OC_Calendar_Calendar::setCalendarActive($calendarid, 1);
 $calendar = OC_Calendar_Calendar::find($calendarid);
 $tmpl = new OCP\Template('calendar', 'part.choosecalendar.rowfields');
 $tmpl->assign('calendar', $calendar);
+if(OC_Calendar_Share::allUsersSharedwith($calendarid, OC_Calendar_Share::CALENDAR) == array()){
+	$shared = false;
+}else{
+	$shared = true;
+}
+$tmpl->assign('shared', $shared);
 OCP\JSON::success(array(
 	'page' => $tmpl->fetchPage(),
 	'eventSource' => OC_Calendar_Calendar::getEventSourceInfo($calendar),
-));
-\ No newline at end of file
+));
diff --git a/apps/calendar/ajax/calendar/update.php b/apps/calendar/ajax/calendar/update.php
index 5cf63d396f7..a2c898c8075 100644
--- a/apps/calendar/ajax/calendar/update.php
+++ b/apps/calendar/ajax/calendar/update.php
@@ -36,7 +36,13 @@ OC_Calendar_Calendar::setCalendarActive($calendarid, $_POST['active']);
 $calendar = OC_Calendar_App::getCalendar($calendarid);
 $tmpl = new OCP\Template('calendar', 'part.choosecalendar.rowfields');
 $tmpl->assign('calendar', $calendar);
+if(OC_Calendar_Share::allUsersSharedwith($calendarid, OC_Calendar_Share::CALENDAR) == array()){
+	$shared = false;
+}else{
+	$shared = true;
+}
+$tmpl->assign('shared', $shared);
 OCP\JSON::success(array(
 	'page' => $tmpl->fetchPage(),
 	'eventSource' => OC_Calendar_Calendar::getEventSourceInfo($calendar),
-));
-\ No newline at end of file
+));
diff --git a/apps/calendar/ajax/event/edit.form.php b/apps/calendar/ajax/event/edit.form.php
index 6e5709a18db..26a0cc2a60a 100644
--- a/apps/calendar/ajax/event/edit.form.php
+++ b/apps/calendar/ajax/event/edit.form.php
@@ -27,6 +27,14 @@ $vevent = $object->VEVENT;
 $dtstart = $vevent->DTSTART;
 $dtend = OC_Calendar_Object::getDTEndFromVEvent($vevent);
 switch($dtstart->getDateType()) {
+	case Sabre_VObject_Property_DateTime::UTC:
+		$timeOffset = OC_Calendar_App::$tz*60;
+		$newDT      = $dtstart->getDateTime(); 
+		$newDT->add(new DateInterval("PT" . $timeOffset . "M"));
+		$dtstart->setDateTime($newDT); 
+		$newDT      = $dtend->getDateTime(); 
+		$newDT->add(new DateInterval("PT" . $timeOffset . "M"));
+		$dtend->setDateTime($newDT); 
 	case Sabre_VObject_Property_DateTime::LOCALTZ:
 	case Sabre_VObject_Property_DateTime::LOCAL:
 		$startdate = $dtstart->getDateTime()->format('d-m-Y');
diff --git a/apps/calendar/ajax/events.php b/apps/calendar/ajax/events.php
index 7178358c7b5..ae55cbc02db 100644
--- a/apps/calendar/ajax/events.php
+++ b/apps/calendar/ajax/events.php
@@ -22,7 +22,7 @@ $calendar_id = (is_null($calendar_id)?strip_tags($_GET['calendar_id']):$calendar
 
 $start = (version_compare(PHP_VERSION, '5.3.0', '>='))?DateTime::createFromFormat('U', $_GET['start']):new DateTime('@' . $_GET['start']);
 $end = (version_compare(PHP_VERSION, '5.3.0', '>='))?DateTime::createFromFormat('U', $_GET['end']):new DateTime('@' . $_GET['end']);
-$events = OC_Calendar_App::getrequestedEvents($calendar_id, $start, $end);
+$events = OC_Calendar_App::getrequestedEvents($_GET['calendar_id'], $start, $end);
 $output = array();
 foreach($events as $event){
 	$output = array_merge($output, OC_Calendar_App::generateEventOutput($event, $start, $end));
diff --git a/apps/calendar/appinfo/remote.php b/apps/calendar/appinfo/remote.php
index 3bd8737ee97..7ab546245f6 100644
--- a/apps/calendar/appinfo/remote.php
+++ b/apps/calendar/appinfo/remote.php
@@ -7,8 +7,8 @@
  */
 OCP\App::checkAppEnabled('calendar');
 
-if(substr($_SERVER["REQUEST_URI"],0,strlen(OC::$APPSWEBROOT . '/apps/calendar/caldav.php')) == OC::$APPSWEBROOT . '/apps/calendar/caldav.php'){
-	$baseuri = OC::$APPSWEBROOT . '/apps/calendar/caldav.php';
+if(substr($_SERVER["REQUEST_URI"],0,strlen(OC_App::getAppWebPath('calendar').'/caldav.php')) == OC_App::getAppWebPath('calendar'). '/caldav.php'){
+	$baseuri = OC_App::getAppWebPath('calendar').'/caldav.php';
 }
 
 // only need authentication apps
diff --git a/apps/calendar/js/calendar.js b/apps/calendar/js/calendar.js
index 3b1be59381b..e17f88e38be 100644
--- a/apps/calendar/js/calendar.js
+++ b/apps/calendar/js/calendar.js
@@ -207,8 +207,7 @@ Calendar={
 			}
 		},
 		showCalDAVUrl:function(username, calname){
-			$('#caldav_url').val(totalurl + '/' + username + '/' + calname);
-			$('#caldav_url').val(encodeURI($('#caldav_url').val()));
+			$('#caldav_url').val(totalurl + '/' + username + '/' + decodeURIComponent(calname));
 			$('#caldav_url').show();
 			$("#caldav_url_close").show();
 		},
@@ -706,10 +705,12 @@ function ListView(element, calendar) {
 		if (delta) {
 			if (delta < 0){
 				addDays(t.start, -7);
+				addDays(t.end, -7);
 				if (!opt('weekends')) {
 					skipWeekend(t.start, delta < 0 ? -1 : 1);
 				}
 			}else{
+				addDays(t.start, 7);
 				addDays(t.end, 7);
 				if (!opt('weekends')) {
 					skipWeekend(t.end, delta < 0 ? -1 : 1);
diff --git a/apps/calendar/lib/app.php b/apps/calendar/lib/app.php
index 167382a5e7d..8e13b13b8a3 100644
--- a/apps/calendar/lib/app.php
+++ b/apps/calendar/lib/app.php
@@ -338,6 +338,9 @@ class OC_Calendar_App{
 			$singleevents = OC_Calendar_Share::allSharedwithuser(OCP\USER::getUser(), OC_Calendar_Share::EVENT, 1, ($_GET['calendar_id'] == 'shared_rw')?'rw':'r');
 			foreach($singleevents as $singleevent){
 				$event = OC_Calendar_Object::find($singleevent['eventid']);
+				if(!array_key_exists('summary', $event)){
+					$event['summary'] = self::$l10n->t('unnamed');
+				}
 				$event['summary'] .= ' (' . self::$l10n->t('by') .  ' ' . OC_Calendar_Object::getowner($event['id']) . ')';
 				$events[] =  $event;
 			}
diff --git a/apps/calendar/lib/calendar.php b/apps/calendar/lib/calendar.php
index b725898858d..1bfab5cd645 100644
--- a/apps/calendar/lib/calendar.php
+++ b/apps/calendar/lib/calendar.php
@@ -206,7 +206,7 @@ class OC_Calendar_Calendar{
 		$stmt->execute(array($id));
 
 		OCP\Util::emitHook('OC_Calendar', 'deleteCalendar', $id);
-		if(count(self::allCalendars()) == 0) {
+		if(count(self::allCalendars(OCP\USER::getUser())) == 0) {
 			self::addCalendar(OCP\USER::getUser(),'Default calendar');
 		}
 
diff --git a/apps/calendar/lib/search.php b/apps/calendar/lib/search.php
index 6526b4223ac..560330f65e9 100644
--- a/apps/calendar/lib/search.php
+++ b/apps/calendar/lib/search.php
@@ -17,6 +17,9 @@ class OC_Search_Provider_Calendar extends OC_Search_Provider{
 		foreach($calendars as $calendar){
 			$objects = OC_Calendar_Object::all($calendar['id']);
 			foreach($objects as $object){
+				if($object['objecttype']!='VEVENT') {
+					continue;
+				}
 				if(substr_count(strtolower($object['summary']), strtolower($query)) > 0){
 					$calendardata = OC_VObject::parse($object['calendardata']);
 					$vevent = $calendardata->VEVENT;
@@ -37,7 +40,7 @@ class OC_Search_Provider_Calendar extends OC_Search_Provider{
 						$info = $l->t('Date') . ': ' . $start_dt->format('d.m.y H:i') . ' - ' . $end_dt->format('d.m.y H:i');
 					}
 					$link = OCP\Util::linkTo('calendar', 'index.php').'?showevent='.urlencode($object['id']);
-					$results[]=new OC_Search_Result($object['summary'],$info, $link,$l->t('Cal.'));//$name,$text,$link,$type
+					$results[]=new OC_Search_Result($object['summary'],$info, $link,(string)$l->t('Cal.'));//$name,$text,$link,$type
 				}
 			}
 		}
diff --git a/apps/calendar/templates/part.choosecalendar.rowfields.php b/apps/calendar/templates/part.choosecalendar.rowfields.php
index 965523f847a..4492ce731c9 100644
--- a/apps/calendar/templates/part.choosecalendar.rowfields.php
+++ b/apps/calendar/templates/part.choosecalendar.rowfields.php
@@ -1,8 +1,21 @@
-<?php
-echo '<td width="20px"><input id="active_' . $_['calendar']['id'] . '" type="checkbox" onClick="Calendar.UI.Calendar.activation(this,' . $_['calendar']['id'] . ')"' . ($_['calendar']['active'] ? ' checked="checked"' : '') . '></td>';
-echo '<td  id="' . OCP\USER::getUser() . '_' . $_['calendar']['id'] . '"><label for="active_' . $_['calendar']['id'] . '">' . $_['calendar']['displayname'] . '</label></td>';
-echo '<td width="20px"><a href="#" onclick="Calendar.UI.Share.dropdown(\'' . OCP\USER::getUser() . '\', \'' . $_['calendar']['id'] . '\');" title="' . $l->t("Share Calendar") . '" class="action"><img  class="svg action" src="' . ((!$_['shared']) ? OCP\Util::imagePath('core', 'actions/share.svg') : OCP\Util::imagePath('core', 'actions/shared.svg')) . '"></a></td>';
-echo '<td width="20px"><a href="#" onclick="Calendar.UI.showCalDAVUrl(\'' . OCP\USER::getUser() . '\', \'' . $_['calendar']['uri'] . '\');" title="' . $l->t("CalDav Link") . '" class="action"><img  class="svg action" src="'.OCP\Util::imagePath('core', 'actions/public.svg').'"></a></td>';
-echo '<td width="20px"><a href="?app=calendar&getfile=export.php?calid=' . $_['calendar']['id'] . '" title="' . $l->t('Download') . '" class="action"><img class="svg action" src="'.OCP\Util::imagePath('core', 'actions/download.svg').'"></a></td>';
-echo '<td width="20px"><a  href="#" title="' . $l->t('Edit') . '" class="action" onclick="Calendar.UI.Calendar.edit(this, ' . $_['calendar']['id'] . ');"><img class="svg action" src="'.OCP\Util::imagePath('core', 'actions/rename.svg').'"></a></td>';
-echo '<td width="20px"><a href="#" onclick="Calendar.UI.Calendar.deleteCalendar(\'' . $_['calendar']['id'] . '\');" title="' . $l->t('Delete') . '" class="action"><img  class="svg action" src="'.OCP\Util::imagePath('core', 'actions/delete.svg').'"></a></td>';
+<td width="20px">
+  <input type="checkbox" id="active_<?php echo $_['calendar']['id'] ?>" onclick="Calendar.UI.Calendar.activation(this,<?php echo $_['calendar']['id'] ?>)"<?php echo $_['calendar']['active'] ? ' checked="checked"' : '' ?>>
+</td>
+<td id="<?php echo OCP\USER::getUser() ?>_<?php echo $_['calendar']['id'] ?>">
+  <label for="active_<?php echo $_['calendar']['id'] ?>"><?php echo $_['calendar']['displayname'] ?></label>
+</td>
+<td width="20px">
+  <a href="#" onclick="Calendar.UI.Share.dropdown('<?php echo OCP\USER::getUser() ?>', <?php echo $_['calendar']['id'] ?>);" title="<?php echo $l->t('Share Calendar') ?>" class="action"><img class="svg action" src="<?php echo (!$_['shared']) ? OCP\Util::imagePath('core', 'actions/share.svg') : OCP\Util::imagePath('core', 'actions/shared.svg') ?>"></a>
+</td>
+<td width="20px">
+  <a href="#" onclick="Calendar.UI.showCalDAVUrl('<?php echo OCP\USER::getUser() ?>', '<?php echo rawurlencode(html_entity_decode($_['calendar']['uri'], ENT_QUOTES, 'UTF-8')) ?>');" title="<?php echo $l->t('CalDav Link') ?>" class="action"><img class="svg action" src="<?php echo OCP\Util::imagePath('core', 'actions/public.svg') ?>"></a>
+</td>
+<td width="20px">
+  <a href="?app=calendar&amp;getfile=export.php?calid=<?php echo $_['calendar']['id'] ?>" title="<?php echo $l->t('Download') ?>" class="action"><img class="svg action" src="<?php echo OCP\Util::imagePath('core', 'actions/download.svg') ?>"></a>
+</td>
+<td width="20px">
+  <a href="#" onclick="Calendar.UI.Calendar.edit(this, <?php echo $_['calendar']['id'] ?>);" title="<?php echo $l->t('Edit') ?>" class="action"><img class="svg action" src="<?php echo OCP\Util::imagePath('core', 'actions/rename.svg') ?>"></a>
+</td>
+<td width="20px">
+  <a href="#" onclick="Calendar.UI.Calendar.deleteCalendar(<?php echo $_['calendar']['id'] ?>);" title="<?php echo $l->t('Delete') ?>" class="action"><img class="svg action" src="<?php echo OCP\Util::imagePath('core', 'actions/delete.svg') ?>"></a>
+</td>
diff --git a/apps/contacts/appinfo/remote.php b/apps/contacts/appinfo/remote.php
index ef50e4ad39f..5add3bc6889 100644
--- a/apps/contacts/appinfo/remote.php
+++ b/apps/contacts/appinfo/remote.php
@@ -22,8 +22,8 @@
 
 OCP\App::checkAppEnabled('contacts');
 
-if(substr($_SERVER["REQUEST_URI"],0,strlen(OC::$APPSWEBROOT . '/apps/contacts/carddav.php')) == OC::$APPSWEBROOT . '/apps/contacts/carddav.php'){
-	$baseuri = OC::$APPSWEBROOT . '/apps/contacts/carddav.php';
+if(substr($_SERVER["REQUEST_URI"],0,strlen(OC_App::getAppWebPath('contacts').'/carddav.php')) == OC_App::getAppWebPath('contacts').'/carddav.php'){
+	$baseuri = OC_App::getAppWebPath('contacts').'/carddav.php';
 }
 
 // only need authentication apps
diff --git a/apps/contacts/js/contacts.js b/apps/contacts/js/contacts.js
index 8ab2a3fbb88..6f5602c2112 100644
--- a/apps/contacts/js/contacts.js
+++ b/apps/contacts/js/contacts.js
@@ -77,7 +77,7 @@ Contacts={
 			}
 		},
 		showCardDAVUrl:function(username, bookname){
-			$('#carddav_url').val(totalurl + '/' + username + '/' + bookname);
+			$('#carddav_url').val(totalurl + '/' + username + '/' + decodeURIComponent(bookname));
 			$('#carddav_url').show();
 			$('#carddav_url_close').show();
 		},
@@ -256,12 +256,14 @@ Contacts={
 					}
 				} else {
 					newid = id;
+					bookid = bookid?bookid:$('#contacts li[data-id="'+newid+'"]').data('bookid');
 				}
 				var localLoadContact = function(newid, bookid) {
 					if($('.contacts li').length > 0) {
-						firstitem.addClass('active');
+						$('#contacts li[data-id="'+newid+'"]').addClass('active');
 						$.getJSON(OC.filePath('contacts', 'ajax', 'contactdetails.php'),{'id':newid},function(jsondata){
 							if(jsondata.status == 'success'){
+								$('#contacts h3[data-id="'+bookid+'"]').trigger('click');
 								Contacts.UI.Card.loadContact(jsondata.data, bookid);
 							} else {
 								OC.dialogs.alert(jsondata.data.message, t('contacts', 'Error'));
@@ -1503,7 +1505,7 @@ Contacts={
 		},
 		Contacts:{
 			// Reload the contacts list.
-			update:function(){
+			update:function(id){
 				$.getJSON(OC.filePath('contacts', 'ajax', 'contacts.php'),{},function(jsondata){
 					if(jsondata.status == 'success'){
 						$('#contacts').html(jsondata.data.page).ready(function() {
@@ -1518,7 +1520,7 @@ Contacts={
 								})}, 100);
 							setTimeout(Contacts.UI.Contacts.lazyupdate, 500);*/
 						});
-						Contacts.UI.Card.update();
+						Contacts.UI.Card.update(id);
 					}
 					else{
 						OC.dialogs.alert(jsondata.data.message, t('contacts', 'Error'));
@@ -1707,5 +1709,5 @@ $(document).ready(function(){
 	$('#contacts_propertymenu_dropdown a').keydown(propertyMenuItem);
 
 	Contacts.UI.loadHandlers();
-	Contacts.UI.Contacts.update();
+	Contacts.UI.Contacts.update(id);
 });
diff --git a/apps/contacts/lib/search.php b/apps/contacts/lib/search.php
index 19330fa9be1..5d9ca97e761 100644
--- a/apps/contacts/lib/search.php
+++ b/apps/contacts/lib/search.php
@@ -11,8 +11,8 @@ class OC_Search_Provider_Contacts extends OC_Search_Provider{
 			$vcards = OC_Contacts_VCard::all($addressbook['id']);
 			foreach($vcards as $vcard){
 				if(substr_count(strtolower($vcard['fullname']), strtolower($query)) > 0){
-					$link = OCP\Util::linkTo('contacts', 'index.php').'?id='.urlencode($vcard['id']);
-					$results[]=new OC_Search_Result($vcard['fullname'],'', $link,$l->t('Contact'));//$name,$text,$link,$type
+					$link = OCP\Util::linkTo('contacts', 'index.php').'&id='.urlencode($vcard['id']);
+					$results[]=new OC_Search_Result($vcard['fullname'],'', $link,(string)$l->t('Contact'));//$name,$text,$link,$type
 				}
 			}
 		}
diff --git a/apps/contacts/templates/index.php b/apps/contacts/templates/index.php
index d16356d4a56..0d4219c9f2d 100644
--- a/apps/contacts/templates/index.php
+++ b/apps/contacts/templates/index.php
@@ -1,6 +1,7 @@
 <script type='text/javascript'>
 	var totalurl = '<?php echo OCP\Util::linkToRemote('carddav'); ?>addressbooks';
 	var categories = <?php echo json_encode($_['categories']); ?>;
+	var id = '<?php echo $_['id']; ?>';
 	var lang = '<?php echo OCP\Config::getUserValue(OCP\USER::getUser(), 'core', 'lang', 'en'); ?>';
 </script>
 <div id="leftcontent">
diff --git a/apps/contacts/templates/part.chooseaddressbook.rowfields.php b/apps/contacts/templates/part.chooseaddressbook.rowfields.php
index 780920ea3c2..2988bb44c5f 100644
--- a/apps/contacts/templates/part.chooseaddressbook.rowfields.php
+++ b/apps/contacts/templates/part.chooseaddressbook.rowfields.php
@@ -2,10 +2,10 @@
 	<input id="active_<?php echo $_['addressbook']["id"]; ?>" type="checkbox" onClick="Contacts.UI.Addressbooks.activation(this, <?php echo $_['addressbook']["id"]; ?>)" <?php echo (OC_Contacts_Addressbook::isActive($_['addressbook']["id"]) ? ' checked="checked"' : ''); ?>>
 </td>
 <td>
-	<label for="active_<?php echo $_['addressbook']["id"]; ?>"><?php echo htmlspecialchars($_['addressbook']["displayname"]); ?></label>
+	<label for="active_<?php echo $_['addressbook']["id"]; ?>"><?php echo $_['addressbook']["displayname"]; ?></label>
 </td>
 <td width="20px">
-	<a onclick="Contacts.UI.showCardDAVUrl('<?php echo OCP\USER::getUser(); ?>', '<?php echo rawurlencode($_['addressbook']["uri"]); ?>');" title="<?php echo $l->t("CardDav Link"); ?>" class="svg action globe"></a>
+	<a onclick="Contacts.UI.showCardDAVUrl('<?php echo OCP\USER::getUser(); ?>', '<?php echo rawurlencode(html_entity_decode($_['addressbook']['uri'], ENT_QUOTES, 'UTF-8')); ?>');" title="<?php echo $l->t("CardDav Link"); ?>" class="svg action globe"></a>
 </td>
 <td width="20px">
 	<a href="<?php echo OCP\Util::linkTo('contacts', 'export.php'); ?>?bookid=<?php echo $_['addressbook']["id"]; ?>" title="<?php echo $l->t("Download"); ?>" class="svg action download"></a>
diff --git a/apps/contacts/templates/part.contacts.php b/apps/contacts/templates/part.contacts.php
index f0b14c8e5f2..c33c5832e82 100644
--- a/apps/contacts/templates/part.contacts.php
+++ b/apps/contacts/templates/part.contacts.php
@@ -3,7 +3,7 @@ foreach($_['books'] as $id => $addressbook) {
 	echo '<h3 class="addressbook" data-id="'.$id.'">'.$addressbook['displayname'].'</h3>';
 	echo '<ul class="contacts hidden" data-id="'.$id.'">';
 	foreach($addressbook['contacts'] as $contact) {
-		echo '<li role="button" data-bookid="'.$contact['addressbookid'].'" data-id="'.$contact['id'].'"><a href="index.php?id='.$contact['id'].'" style="background: url('.link_to('contacts','thumbnail.php').'?id='.$contact['id'].') no-repeat scroll 0 0 transparent;">'.$contact['displayname'].'</a></li>';
+		echo '<li role="button" data-bookid="'.$contact['addressbookid'].'" data-id="'.$contact['id'].'"><a href="'.link_to('contacts','index.php').'&id='.$contact['id'].'" style="background: url('.link_to('contacts','thumbnail.php').'?id='.$contact['id'].') no-repeat scroll 0 0 transparent;">'.$contact['displayname'].'</a></li>';
 	}
 	echo '</ul>';
 }
diff --git a/apps/contacts/thumbnail.php b/apps/contacts/thumbnail.php
index da4e930f3e5..8378507163e 100644
--- a/apps/contacts/thumbnail.php
+++ b/apps/contacts/thumbnail.php
@@ -23,6 +23,7 @@
 OCP\JSON::checkLoggedIn();
 //OCP\User::checkLoggedIn();
 OCP\App::checkAppEnabled('contacts');
+session_close_write();
 
 function getStandardImage(){
 	//OCP\Response::setExpiresHeader('P10D');
diff --git a/apps/files/templates/part.breadcrumb.php b/apps/files/templates/part.breadcrumb.php
index 43fe2d1fa95..22d9bb4490d 100644
--- a/apps/files/templates/part.breadcrumb.php
+++ b/apps/files/templates/part.breadcrumb.php
@@ -1,6 +1,6 @@
 	<?php for($i=0; $i<count($_["breadcrumb"]); $i++):
         $crumb = $_["breadcrumb"][$i]; ?>
 		<div class="crumb <?php if($i == count($_["breadcrumb"])-1) echo 'last';?> svg" data-dir='<?php echo $crumb["dir"];?>' style='background-image:url("<?php echo OCP\image_path('core','breadcrumb.png');?>")'>
-    		<a href="<?php echo $_['baseURL'].$crumb["dir"]; ?>"><?php echo htmlentities($crumb["name"],ENT_COMPAT,'utf-8'); ?></a>
+    		<a href="<?php echo $_['baseURL'].$crumb["dir"]; ?>"><?php echo OCP\Util::sanitizeHTML($crumb["name"]); ?></a>
 		</div>
 	<?php endfor;?>
diff --git a/apps/files_encryption/lib/crypt.php b/apps/files_encryption/lib/crypt.php
index 4c0ffa978ed..849e88ee0b2 100644
--- a/apps/files_encryption/lib/crypt.php
+++ b/apps/files_encryption/lib/crypt.php
@@ -44,18 +44,16 @@ class OC_Crypt {
 	}
 
 	public static function init($login,$password) {
-		$view1=new OC_FilesystemView('/');
-		if(!$view1->file_exists('/'.$login)){
-			$view1->mkdir('/'.$login);
+		$view=new OC_FilesystemView('/');
+		if(!$view->file_exists('/'.$login)){
+			$view->mkdir('/'.$login);
 		}
 
-		$view=new OC_FilesystemView('/'.$login);
-
 		OC_FileProxy::$enabled=false;
-		if(!$view->file_exists('/encryption.key')){// does key exist?
+		if(!$view->file_exists('/'.$login.'/encryption.key')){// does key exist?
 			OC_Crypt::createkey($login,$password);
 		}
-		$key=$view->file_get_contents('/encryption.key');
+		$key=$view->file_get_contents('/'.$login.'/encryption.key');
 		OC_FileProxy::$enabled=true;
 		$_SESSION['enckey']=OC_Crypt::decrypt($key, $password);
 	}
@@ -206,12 +204,16 @@ class OC_Crypt {
 	/**
 	 * decrypt data in 8192b sized blocks
 	 */
-	public static function blockDecrypt($data, $key=''){
+	public static function blockDecrypt($data, $key='',$maxLength=0){
 		$result='';
 		while(strlen($data)){
 			$result.=self::decrypt(substr($data,0,8192),$key);
 			$data=substr($data,8192);
 		}
-		return rtrim($result, "\0");
+		if($maxLength>0){
+			return substr($result,0,$maxLength);
+		}else{
+			return rtrim($result, "\0");
+		}
 	}
 }
diff --git a/apps/files_encryption/lib/cryptstream.php b/apps/files_encryption/lib/cryptstream.php
index 64fec381ded..e0020537563 100644
--- a/apps/files_encryption/lib/cryptstream.php
+++ b/apps/files_encryption/lib/cryptstream.php
@@ -35,6 +35,7 @@ class OC_CryptStream{
 	private $meta=array();//header/meta for source stream
 	private $count;
 	private $writeCache;
+	private $size;
 	private static $rootView;
 
 	public function stream_open($path, $mode, $options, &$opened_path){
@@ -45,8 +46,14 @@ class OC_CryptStream{
 		if(dirname($path)=='streams' and isset(self::$sourceStreams[basename($path)])){
 			$this->source=self::$sourceStreams[basename($path)]['stream'];
 			$this->path=self::$sourceStreams[basename($path)]['path'];
+			$this->size=self::$sourceStreams[basename($path)]['size'];
 		}else{
 			$this->path=$path;
+			if($mode=='w' or $mode=='w+' or $mode=='wb' or $mode=='wb+'){
+				$this->size=0;
+			}else{
+				$this->size=self::$rootView->filesize($path,$mode);
+			}
 			OC_FileProxy::$enabled=false;//disable fileproxies so we can open the source file
 			$this->source=self::$rootView->fopen($path,$mode);
 			OC_FileProxy::$enabled=true;
@@ -77,14 +84,16 @@ class OC_CryptStream{
 			OCP\Util::writeLog('files_encryption','php bug 21641 no longer holds, decryption will not work',OCP\Util::FATAL);
 			die();
 		}
+		$pos=ftell($this->source);
 		$data=fread($this->source,8192);
 		if(strlen($data)){
 			$result=OC_Crypt::decrypt($data);
 		}else{
 			$result='';
 		}
-		if($this->stream_eof()){
-			$result=rtrim($result, "\0");
+		$length=$this->size-$pos;
+		if($length<8192){
+			$result=substr($result,0,$length);
 		}
 		return $result;
 	}
@@ -106,8 +115,9 @@ class OC_CryptStream{
 			$data=substr($block,0,$currentPos%8192).$data;
 			fseek($this->source,-($currentPos%8192),SEEK_CUR);
 		}
-		while(strlen($data)>0){
-			if(strlen($data)<8192){
+		$currentPos=ftell($this->source);
+		while($remainingLength=strlen($data)>0){
+			if($remainingLength<8192){
 				$this->writeCache=$data;
 				$data='';
 			}else{
@@ -116,6 +126,7 @@ class OC_CryptStream{
 				$data=substr($data,8192);
 			}
 		}
+		$this->size=max($this->size,$currentPos+$length);
 		return $length;
 	}
 
@@ -159,7 +170,7 @@ class OC_CryptStream{
 	public function stream_close(){
 		$this->flush();
 		if($this->meta['mode']!='r' and $this->meta['mode']!='rb'){
-			OC_FileCache::put($this->path,array('encrypted'=>true),'');
+			OC_FileCache::put($this->path,array('encrypted'=>true,'size'=>$this->size),'');
 		}
 		return fclose($this->source);
 	}
diff --git a/apps/files_encryption/lib/proxy.php b/apps/files_encryption/lib/proxy.php
index b9e719448a3..f25e4a662f6 100644
--- a/apps/files_encryption/lib/proxy.php
+++ b/apps/files_encryption/lib/proxy.php
@@ -66,15 +66,17 @@ class OC_FileProxy_Encryption extends OC_FileProxy{
 	public function preFile_put_contents($path,&$data){
 		if(self::shouldEncrypt($path)){
 			if (!is_resource($data)) {//stream put contents should have been converter to fopen
+				$size=strlen($data);
 				$data=OC_Crypt::blockEncrypt($data);
-				OC_FileCache::put($path,array('encrypted'=>true),'');
+				OC_FileCache::put($path,array('encrypted'=>true,'size'=>$size),'');
 			}
 		}
 	}
 	
 	public function postFile_get_contents($path,$data){
 		if(self::isEncrypted($path)){
-			$data=OC_Crypt::blockDecrypt($data);
+			$cached=OC_FileCache_Cached::get($path,'');
+			$data=OC_Crypt::blockDecrypt($data,'',$cached['size']);
 		}
 		return $data;
 	}
@@ -108,4 +110,21 @@ class OC_FileProxy_Encryption extends OC_FileProxy{
 		}
 		return $mime;
 	}
+
+	public function postStat($path,$data){
+		if(self::isEncrypted($path)){
+			$cached=OC_FileCache_Cached::get($path,'');
+			$data['size']=$cached['size'];
+		}
+		return $data;
+	}
+
+	public function postFileSize($path,$size){
+		if(self::isEncrypted($path)){
+			$cached=OC_FileCache_Cached::get($path,'');
+			return  $cached['size'];
+		}else{
+			return $size;
+		}
+	}
 }
diff --git a/apps/files_encryption/tests/encryption.php b/apps/files_encryption/tests/encryption.php
index 70aa1daf4c3..286770a69f5 100644
--- a/apps/files_encryption/tests/encryption.php
+++ b/apps/files_encryption/tests/encryption.php
@@ -66,7 +66,7 @@ class Test_Encryption extends UnitTestCase {
 		$this->assertEqual($decrypted,$source);
 
 		$encrypted=OC_Crypt::blockEncrypt($source,$key);
-		$decrypted=OC_Crypt::blockDecrypt($encrypted,$key);
+		$decrypted=OC_Crypt::blockDecrypt($encrypted,$key,strlen($source));
 		$this->assertEqual($decrypted,$source);
 	}
 }
diff --git a/apps/files_encryption/tests/proxy.php b/apps/files_encryption/tests/proxy.php
index 5616e2091a9..fcfc4cfb9f0 100644
--- a/apps/files_encryption/tests/proxy.php
+++ b/apps/files_encryption/tests/proxy.php
@@ -8,10 +8,12 @@
 
 class Test_CryptProxy extends UnitTestCase {
 	private $oldConfig;
+	private $oldKey;
 	
 	public function setUp(){
 		$this->oldConfig=OCP\Config::getAppValue('files_encryption','enable_encryption','true');
 		OCP\Config::setAppValue('files_encryption','enable_encryption','true');
+		$this->oldKey=isset($_SESSION['enckey'])?$_SESSION['enckey']:null;
 	
 		
 		//set testing key
@@ -36,6 +38,9 @@ class Test_CryptProxy extends UnitTestCase {
 
 	public function tearDown(){
 		OCP\Config::setAppValue('files_encryption','enable_encryption',$this->oldConfig);
+		if(!is_null($this->oldKey)){
+			$_SESSION['enckey']=$this->oldKey;
+		}
 	}
 
 	public function testSimple(){
@@ -50,6 +55,7 @@ class Test_CryptProxy extends UnitTestCase {
 		
 		$fromFile=OC_Filesystem::file_get_contents('/file');
 		$this->assertNotEqual($original,$stored);
+		$this->assertEqual(strlen($original),strlen($fromFile));
 		$this->assertEqual($original,$fromFile);
 
 	}
@@ -88,6 +94,20 @@ class Test_CryptProxy extends UnitTestCase {
 
 		$fromFile=OC_Filesystem::file_get_contents('/file');
 		$this->assertNotEqual($original,$stored);
+		$this->assertEqual(strlen($original),strlen($fromFile));
 		$this->assertEqual($original,$fromFile);
+
+		$file=__DIR__.'/zeros';
+		$original=file_get_contents($file);
+
+		OC_Filesystem::file_put_contents('/file',$original);
+
+		OC_FileProxy::$enabled=false;
+		$stored=OC_Filesystem::file_get_contents('/file');
+		OC_FileProxy::$enabled=true;
+
+		$fromFile=OC_Filesystem::file_get_contents('/file');
+		$this->assertNotEqual($original,$stored);
+		$this->assertEqual(strlen($original),strlen($fromFile));
 	}
 }
diff --git a/apps/files_encryption/tests/stream.php b/apps/files_encryption/tests/stream.php
index 4ffeb6210a9..d95ea792f72 100644
--- a/apps/files_encryption/tests/stream.php
+++ b/apps/files_encryption/tests/stream.php
@@ -10,23 +10,23 @@ class Test_CryptStream extends UnitTestCase {
 	private $tmpFiles=array();
 	
 	function testStream(){
-		$stream=$this->getStream('test1','w');
+		$stream=$this->getStream('test1','w',strlen('foobar'));
 		fwrite($stream,'foobar');
 		fclose($stream);
 
-		$stream=$this->getStream('test1','r');
+		$stream=$this->getStream('test1','r',strlen('foobar'));
 		$data=fread($stream,6);
 		fclose($stream);
 		$this->assertEqual('foobar',$data);
 
 		$file=OC::$SERVERROOT.'/3rdparty/MDB2.php';
 		$source=fopen($file,'r');
-		$target=$this->getStream('test2','w');
+		$target=$this->getStream('test2','w',0);
 		OCP\Files::streamCopy($source,$target);
 		fclose($target);
 		fclose($source);
 
-		$stream=$this->getStream('test2','r');
+		$stream=$this->getStream('test2','r',filesize($file));
 		$data=stream_get_contents($stream);
 		$original=file_get_contents($file);
 		$this->assertEqual(strlen($original),strlen($data));
@@ -37,9 +37,10 @@ class Test_CryptStream extends UnitTestCase {
 	 * get a cryptstream to a temporary file
 	 * @param string $id
 	 * @param string $mode
+	 * @param int size
 	 * @return resource
 	 */
-	function getStream($id,$mode){
+	function getStream($id,$mode,$size){
 		if($id===''){
 			$id=uniqid();
 		}
@@ -50,7 +51,7 @@ class Test_CryptStream extends UnitTestCase {
 			$file=$this->tmpFiles[$id];
 		}
 		$stream=fopen($file,$mode);
-		OC_CryptStream::$sourceStreams[$id]=array('path'=>'dummy'.$id,'stream'=>$stream);
+		OC_CryptStream::$sourceStreams[$id]=array('path'=>'dummy'.$id,'stream'=>$stream,'size'=>$size);
 		return fopen('crypt://streams/'.$id,$mode);
 	}
 
@@ -58,11 +59,24 @@ class Test_CryptStream extends UnitTestCase {
 		$file=__DIR__.'/binary';
 		$source=file_get_contents($file);
 
-		$stream=$this->getStream('test','w');
+		$stream=$this->getStream('test','w',strlen($source));
 		fwrite($stream,$source);
 		fclose($stream);
 
-		$stream=$this->getStream('test','r');
+		$stream=$this->getStream('test','r',strlen($source));
+		$data=stream_get_contents($stream);
+		fclose($stream);
+		$this->assertEqual(strlen($data),strlen($source));
+		$this->assertEqual($source,$data);
+
+		$file=__DIR__.'/zeros';
+		$source=file_get_contents($file);
+
+		$stream=$this->getStream('test2','w',strlen($source));
+		fwrite($stream,$source);
+		fclose($stream);
+
+		$stream=$this->getStream('test2','r',strlen($source));
 		$data=stream_get_contents($stream);
 		fclose($stream);
 		$this->assertEqual(strlen($data),strlen($source));
diff --git a/apps/files_encryption/tests/zeros b/apps/files_encryption/tests/zeros
new file mode 100644
index 00000000000..ff982acf423
--- /dev/null
+++ b/apps/files_encryption/tests/zeros
diff --git a/apps/files_external/js/google.js b/apps/files_external/js/google.js
index 0d65cfda011..84c74c57421 100644
--- a/apps/files_external/js/google.js
+++ b/apps/files_external/js/google.js
@@ -11,7 +11,7 @@ $(document).ready(function() {
 				window.location.href.replace(/[?&]+([^=&]+)=([^&]*)/gi, function(m, key, value) {
 					params[key] = value;
 				});
-				if (params['oauth_token'].length > 1 && decodeURIComponent(params['oauth_token']) == $(token).val() && params['oauth_verifier'].length > 1) {
+				if (params['oauth_token'] !== undefined && params['oauth_verifier'] !== undefined && decodeURIComponent(params['oauth_token']) == $(token).val()) {
 					var tr = $(this);
 					$.post(OC.filePath('files_external', 'ajax', 'google.php'), { step: 2, oauth_verifier: params['oauth_verifier'], request_token: $(token).val(), request_token_secret: $(token_secret).val() }, function(result) {
 						if (result && result.status == 'success') {
diff --git a/apps/files_external/lib/config.php b/apps/files_external/lib/config.php
index 870c13b5aed..5b9e00a3783 100755
--- a/apps/files_external/lib/config.php
+++ b/apps/files_external/lib/config.php
@@ -157,12 +157,17 @@ class OC_Mount_Config {
 	*/
 	public static function removeMountPoint($mountPoint, $mountType, $applicable, $isPersonal = false) {
 		// Verify that the mount point applies for the current user
-		if ($isPersonal && $applicable != OCP\User::getUser()) {
-			return false;
+		if ($isPersonal) {
+			if ($applicable != OCP\User::getUser()) {
+				return false;
+			}
+			$mountPoint = '/'.$applicable.'/files/'.ltrim($mountPoint, '/');
+		} else {
+			$mountPoint = '/$user/files/'.ltrim($mountPoint, '/');
 		}
 		$mountPoints = self::readData($isPersonal);
 		// Remove mount point
-		unset($mountPoints[$mountType][$applicable]['/$user/files/'.$mountPoint]);
+		unset($mountPoints[$mountType][$applicable][$mountPoint]);
 		// Unset parent arrays if empty
 		if (empty($mountPoints[$mountType][$applicable])) {
 			unset($mountPoints[$mountType][$applicable]);
diff --git a/apps/files_imageviewer/css/jquery.fancybox-1.3.4.css b/apps/files_imageviewer/css/jquery.fancybox-1.3.4.css
index 5fdf7af14cb..6e982805a44 100644
--- a/apps/files_imageviewer/css/jquery.fancybox-1.3.4.css
+++ b/apps/files_imageviewer/css/jquery.fancybox-1.3.4.css
@@ -35,7 +35,7 @@
 	left: 0;
 	width: 40px;
 	height: 480px;
-	background-image: url('%appswebroot%/apps/files_imageviewer/img/fancybox.png');
+	background-image: url('%appswebroot%/files_imageviewer/img/fancybox.png');
 }
 
 #fancybox-overlay {
@@ -99,7 +99,7 @@
 	right: -15px;
 	width: 30px;
 	height: 30px;
-	background: transparent url('%appswebroot%/apps/files_imageviewer/img/fancybox.png') -40px 0px;
+	background: transparent url('%appswebroot%/files_imageviewer/img/fancybox.png') -40px 0px;
 	cursor: pointer;
 	z-index: 1103;
 	display: none;
@@ -137,7 +137,7 @@
 	width: 35%;
 	cursor: pointer;
 	outline: none;
-	background: transparent url('%appswebroot%/apps/files_imageviewer/img/blank.gif');
+	background: transparent url('%appswebroot%/files_imageviewer/img/blank.gif');
 	z-index: 1102;
 	display: none;
 }
@@ -163,12 +163,12 @@
 }
 
 #fancybox-left-ico {
-	background-image: url('%appswebroot%/apps/files_imageviewer/img/fancybox.png');
+	background-image: url('%appswebroot%/files_imageviewer/img/fancybox.png');
 	background-position: -40px -30px;
 }
 
 #fancybox-right-ico {
-	background-image: url('%appswebroot%/apps/files_imageviewer/img/fancybox.png');
+	background-image: url('%appswebroot%/files_imageviewer/img/fancybox.png');
 	background-position: -40px -60px;
 }
 
@@ -199,13 +199,13 @@
 	top: -20px;
 	left: 0;
 	width: 100%;
-	background-image: url('%appswebroot%/apps/files_imageviewer/img/fancybox-x.png');
+	background-image: url('%appswebroot%/files_imageviewer/img/fancybox-x.png');
 }
 
 #fancybox-bg-ne {
 	top: -20px;
 	right: -20px;
-	background-image: url('%appswebroot%/apps/files_imageviewer/img/fancybox.png');
+	background-image: url('%appswebroot%/files_imageviewer/img/fancybox.png');
 	background-position: -40px -162px;
 }
 
@@ -213,14 +213,14 @@
 	top: 0;
 	right: -20px;
 	height: 100%;
-	background-image: url('%appswebroot%/apps/files_imageviewer/img/fancybox-y.png');
+	background-image: url('%appswebroot%/files_imageviewer/img/fancybox-y.png');
 	background-position: -20px 0px;
 }
 
 #fancybox-bg-se {
 	bottom: -20px;
 	right: -20px;
-	background-image: url('%appswebroot%/apps/files_imageviewer/img/fancybox.png');
+	background-image: url('%appswebroot%/files_imageviewer/img/fancybox.png');
 	background-position: -40px -182px; 
 }
 
@@ -228,14 +228,14 @@
 	bottom: -20px;
 	left: 0;
 	width: 100%;
-	background-image: url('%appswebroot%/apps/files_imageviewer/img/fancybox-x.png');
+	background-image: url('%appswebroot%/files_imageviewer/img/fancybox-x.png');
 	background-position: 0px -20px;
 }
 
 #fancybox-bg-sw {
 	bottom: -20px;
 	left: -20px;
-	background-image: url('%appswebroot%/apps/files_imageviewer/img/fancybox.png');
+	background-image: url('%appswebroot%/files_imageviewer/img/fancybox.png');
 	background-position: -40px -142px;
 }
 
@@ -243,13 +243,13 @@
 	top: 0;
 	left: -20px;
 	height: 100%;
-	background-image: url('%appswebroot%/apps/files_imageviewer/img/fancybox-y.png');
+	background-image: url('%appswebroot%/files_imageviewer/img/fancybox-y.png');
 }
 
 #fancybox-bg-nw {
 	top: -20px;
 	left: -20px;
-	background-image: url('%appswebroot%/apps/files_imageviewer/img/fancybox.png');
+	background-image: url('%appswebroot%/files_imageviewer/img/fancybox.png');
 	background-position: -40px -122px;
 }
 
@@ -282,7 +282,7 @@
 
 #fancybox-title-over {
 	padding: 10px;
-	background-image: url('%appswebroot%/apps/files_imageviewer/img/fancy_title_over.png');
+	background-image: url('%appswebroot%/files_imageviewer/img/fancy_title_over.png');
 	display: block;
 }
 
@@ -306,7 +306,7 @@
 
 #fancybox-title-float-left {
 	padding: 0 0 0 15px;
-	background: url('%appswebroot%/apps/files_imageviewer/img/fancybox.png') -40px -90px no-repeat;
+	background: url('%appswebroot%/files_imageviewer/img/fancybox.png') -40px -90px no-repeat;
 }
 
 #fancybox-title-float-main {
@@ -314,25 +314,25 @@
 	line-height: 29px;
 	font-weight: bold;
 	padding: 0 0 3px 0;
-	background: url('%appswebroot%/apps/files_imageviewer/img/fancybox-x.png') 0px -40px;
+	background: url('%appswebroot%/files_imageviewer/img/fancybox-x.png') 0px -40px;
 }
 
 #fancybox-title-float-right {
 	padding: 0 0 0 15px;
-	background: url('%appswebroot%/apps/files_imageviewer/img/fancybox.png') -55px -90px no-repeat;
+	background: url('%appswebroot%/files_imageviewer/img/fancybox.png') -55px -90px no-repeat;
 }
 
 /* IE6 */
 
-.fancybox-ie6 #fancybox-close { background: transparent; filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/apps/files_imageviewer/img/fancy_close.png', sizingMethod='scale'); }
+.fancybox-ie6 #fancybox-close { background: transparent; filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/files_imageviewer/img/fancy_close.png', sizingMethod='scale'); }
 
-.fancybox-ie6 #fancybox-left-ico { background: transparent; filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/apps/files_imageviewer/img/fancy_nav_left.png', sizingMethod='scale'); }
-.fancybox-ie6 #fancybox-right-ico { background: transparent; filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/apps/files_imageviewer/img/fancy_nav_right.png', sizingMethod='scale'); }
+.fancybox-ie6 #fancybox-left-ico { background: transparent; filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/files_imageviewer/img/fancy_nav_left.png', sizingMethod='scale'); }
+.fancybox-ie6 #fancybox-right-ico { background: transparent; filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/files_imageviewer/img/fancy_nav_right.png', sizingMethod='scale'); }
 
-.fancybox-ie6 #fancybox-title-over { background: transparent; filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/apps/files_imageviewer/img/fancy_title_over.png', sizingMethod='scale'); zoom: 1; }
-.fancybox-ie6 #fancybox-title-float-left { background: transparent; filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/apps/files_imageviewer/img/fancy_title_left.png', sizingMethod='scale'); }
-.fancybox-ie6 #fancybox-title-float-main { background: transparent; filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/apps/files_imageviewer/img/fancy_title_main.png', sizingMethod='scale'); }
-.fancybox-ie6 #fancybox-title-float-right { background: transparent; filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/apps/files_imageviewer/img/fancy_title_right.png', sizingMethod='scale'); }
+.fancybox-ie6 #fancybox-title-over { background: transparent; filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/files_imageviewer/img/fancy_title_over.png', sizingMethod='scale'); zoom: 1; }
+.fancybox-ie6 #fancybox-title-float-left { background: transparent; filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/files_imageviewer/img/fancy_title_left.png', sizingMethod='scale'); }
+.fancybox-ie6 #fancybox-title-float-main { background: transparent; filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/files_imageviewer/img/fancy_title_main.png', sizingMethod='scale'); }
+.fancybox-ie6 #fancybox-title-float-right { background: transparent; filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/files_imageviewer/img/fancy_title_right.png', sizingMethod='scale'); }
 
 .fancybox-ie6 #fancybox-bg-w, .fancybox-ie6 #fancybox-bg-e, .fancybox-ie6 #fancybox-left, .fancybox-ie6 #fancybox-right, #fancybox-hide-sel-frame {
 	height: expression(this.parentNode.clientHeight + "px");
@@ -343,17 +343,17 @@
 	top: expression( (-20 + (document.documentElement.clientHeight ? document.documentElement.clientHeight/2 : document.body.clientHeight/2 ) + ( ignoreMe = document.documentElement.scrollTop ? document.documentElement.scrollTop : document.body.scrollTop )) + 'px');
 }
 
-#fancybox-loading.fancybox-ie6 div	{ background: transparent; filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/apps/files_imageviewer/img/fancy_loading.png', sizingMethod='scale'); }
+#fancybox-loading.fancybox-ie6 div	{ background: transparent; filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/files_imageviewer/img/fancy_loading.png', sizingMethod='scale'); }
 
 /* IE6, IE7, IE8 */
 
 .fancybox-ie .fancybox-bg { background: transparent !important; }
 
-.fancybox-ie #fancybox-bg-n { filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/apps/files_imageviewer/img/fancy_shadow_n.png', sizingMethod='scale'); }
-.fancybox-ie #fancybox-bg-ne { filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/apps/files_imageviewer/img/fancy_shadow_ne.png', sizingMethod='scale'); }
-.fancybox-ie #fancybox-bg-e { filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/apps/files_imageviewer/img/fancy_shadow_e.png', sizingMethod='scale'); }
-.fancybox-ie #fancybox-bg-se { filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/apps/files_imageviewer/img/fancy_shadow_se.png', sizingMethod='scale'); }
-.fancybox-ie #fancybox-bg-s { filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/apps/files_imageviewer/img/fancy_shadow_s.png', sizingMethod='scale'); }
-.fancybox-ie #fancybox-bg-sw { filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/apps/files_imageviewer/img/fancy_shadow_sw.png', sizingMethod='scale'); }
-.fancybox-ie #fancybox-bg-w { filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/apps/files_imageviewer/img/fancy_shadow_w.png', sizingMethod='scale'); }
-.fancybox-ie #fancybox-bg-nw { filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/apps/files_imageviewer/img/fancy_shadow_nw.png', sizingMethod='scale'); }
+.fancybox-ie #fancybox-bg-n { filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/files_imageviewer/img/fancy_shadow_n.png', sizingMethod='scale'); }
+.fancybox-ie #fancybox-bg-ne { filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/files_imageviewer/img/fancy_shadow_ne.png', sizingMethod='scale'); }
+.fancybox-ie #fancybox-bg-e { filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/files_imageviewer/img/fancy_shadow_e.png', sizingMethod='scale'); }
+.fancybox-ie #fancybox-bg-se { filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/files_imageviewer/img/fancy_shadow_se.png', sizingMethod='scale'); }
+.fancybox-ie #fancybox-bg-s { filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/files_imageviewer/img/fancy_shadow_s.png', sizingMethod='scale'); }
+.fancybox-ie #fancybox-bg-sw { filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/files_imageviewer/img/fancy_shadow_sw.png', sizingMethod='scale'); }
+.fancybox-ie #fancybox-bg-w { filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/files_imageviewer/img/fancy_shadow_w.png', sizingMethod='scale'); }
+.fancybox-ie #fancybox-bg-nw { filter: progid:DXImageTransform.Microsoft.AlphaImageLoader(src='%appswebroot%/files_imageviewer/img/fancy_shadow_nw.png', sizingMethod='scale'); }
diff --git a/apps/files_pdfviewer/js/pdfjs/viewer.js b/apps/files_pdfviewer/js/pdfjs/viewer.js
index 8a568e6a749..f49257d7929 100644
--- a/apps/files_pdfviewer/js/pdfjs/viewer.js
+++ b/apps/files_pdfviewer/js/pdfjs/viewer.js
@@ -1871,70 +1871,4 @@ window.addEventListener('DOMMouseScroll', function(evt) {
   }
 }, false);
 
-window.addEventListener('keydown', function keydown(evt) {
-  var handled = false;
-  var cmd = (evt.ctrlKey ? 1 : 0) |
-            (evt.altKey ? 2 : 0) |
-            (evt.shiftKey ? 4 : 0) |
-            (evt.metaKey ? 8 : 0);
-
-  // First, handle the key bindings that are independent whether an input
-  // control is selected or not.
-  if (cmd == 1 || cmd == 8) { // either CTRL or META key.
-    switch (evt.keyCode) {
-      case 61: // FF/Mac '='
-      case 107: // FF '+' and '='
-      case 187: // Chrome '+'
-        PDFView.zoomIn();
-        handled = true;
-        break;
-      case 109: // FF '-'
-      case 189: // Chrome '-'
-        PDFView.zoomOut();
-        handled = true;
-        break;
-      case 48: // '0'
-        PDFView.parseScale(kDefaultScale, true);
-        handled = true;
-        break;
-    }
-  }
 
-  if (handled) {
-    evt.preventDefault();
-    return;
-  }
-
-  // Some shortcuts should not get handled if a control/input element
-  // is selected.
-  var curElement = document.activeElement;
-  if (curElement && curElement.tagName == 'INPUT')
-    return;
-  var controlsElement = document.getElementById('controls');
-  while (curElement) {
-    if (curElement === controlsElement)
-      return; // ignoring if the 'controls' element is focused
-    curElement = curElement.parentNode;
-  }
-
-  if (cmd == 0) { // no control key pressed at all.
-    switch (evt.keyCode) {
-      case 37: // left arrow
-      case 75: // 'k'
-      case 80: // 'p'
-        PDFView.page--;
-        handled = true;
-        break;
-      case 39: // right arrow
-      case 74: // 'j'
-      case 78: // 'n'
-        PDFView.page++;
-        handled = true;
-        break;
-    }
-  }
-
-  if (handled) {
-    evt.preventDefault();
-  }
-});
diff --git a/apps/files_sharing/get.php b/apps/files_sharing/get.php
index 1ab8c6a257f..40a90a1530c 100644
--- a/apps/files_sharing/get.php
+++ b/apps/files_sharing/get.php
@@ -77,7 +77,7 @@ if (isset($_GET['token']) && $source = OC_Share::getSource($_GET['token'])) {
 		header("Content-Length: " . OC_Filesystem::filesize($source));
 		//download the file
 		@ob_clean();
-		OCP\Util::emitHook('OC_Share', 'public-download', array('source'=>$source, 'token'=>$token);
+		OCP\Util::emitHook('OC_Share', 'public-download', array('source'=>$source, 'token'=>$token));
 		OC_Filesystem::readfile($source);
 	}
 } else {
diff --git a/apps/files_sharing/sharedstorage.php b/apps/files_sharing/sharedstorage.php
index 62c86ee18e4..fed1b834fa3 100644
--- a/apps/files_sharing/sharedstorage.php
+++ b/apps/files_sharing/sharedstorage.php
@@ -25,7 +25,7 @@ require_once( 'lib_share.php' );
 /**
  * Convert target path to source path and pass the function call to the correct storage provider
  */
-class OC_Filestorage_Shared extends OC_Filestorage {
+class OC_Filestorage_Shared extends OC_Filestorage_Common {
 	
 	private $datadir;
 	private $sourcePaths = array();
@@ -492,7 +492,7 @@ class OC_Filestorage_Shared extends OC_Filestorage {
 		return $this->searchInDir($query);
 	}
 
-	private function searchInDir($query, $path = "") {
+	protected function searchInDir($query, $path = "") {
 		$files = array();
 		if ($dh = $this->opendir($path)) {
 			while (($filename = readdir($dh)) !== false) {
diff --git a/apps/files_texteditor/css/DroidSansMono/stylesheet.css b/apps/files_texteditor/css/DroidSansMono/stylesheet.css
index 5bf9122ed7d..4d814b262d3 100644
--- a/apps/files_texteditor/css/DroidSansMono/stylesheet.css
+++ b/apps/files_texteditor/css/DroidSansMono/stylesheet.css
@@ -4,11 +4,11 @@
 
 @font-face {
     font-family: 'Droid Sans Mono';
-    src: url('%appswebroot%/apps/files_texteditor/css/DroidSansMono/DroidSansMono-webfont.eot');
-    src: url('%appswebroot%/apps/files_texteditor/css/DroidSansMono/DroidSansMono-webfont.eot?#iefix') format('embedded-opentype'),
-         url('%appswebroot%/apps/files_texteditor/css/DroidSansMono/DroidSansMono-webfont.woff') format('woff'),
-         url('%appswebroot%/apps/files_texteditor/css/DroidSansMono/DroidSansMono-webfont.ttf') format('truetype'),
-         url('%appswebroot%/apps/files_texteditor/css/DroidSansMono/DroidSansMono-webfont.svg#DroidSansMonoRegular') format('svg');
+    src: url('%appswebroot%/files_texteditor/css/DroidSansMono/DroidSansMono-webfont.eot');
+    src: url('%appswebroot%/files_texteditor/css/DroidSansMono/DroidSansMono-webfont.eot?#iefix') format('embedded-opentype'),
+         url('%appswebroot%/files_texteditor/css/DroidSansMono/DroidSansMono-webfont.woff') format('woff'),
+         url('%appswebroot%/files_texteditor/css/DroidSansMono/DroidSansMono-webfont.ttf') format('truetype'),
+         url('%appswebroot%/files_texteditor/css/DroidSansMono/DroidSansMono-webfont.svg#DroidSansMonoRegular') format('svg');
     font-weight: normal;
     font-style: normal;
 
diff --git a/apps/files_texteditor/css/style.css b/apps/files_texteditor/css/style.css
index d91a91d18d0..82c57b88bbd 100644
--- a/apps/files_texteditor/css/style.css
+++ b/apps/files_texteditor/css/style.css
@@ -1,16 +1,8 @@
 #editor{
 	position: fixed;
 	display: block;
-	top: 6.5em;
-	left: 12.5em;
-}
-#editorwrapper{
-	position: absolute;
-	height: 0;
-	width: 0;
-	top: 41px;
-	left: 160px;
-	display: none;
+	top: 6.8em;
+	left: 13.5em;
 }
 #editor_save{
 	margin-left: 7px;
diff --git a/apps/files_texteditor/js/editor.js b/apps/files_texteditor/js/editor.js
index 70bb74a9101..9d168c1c4f6 100644
--- a/apps/files_texteditor/js/editor.js
+++ b/apps/files_texteditor/js/editor.js
@@ -67,7 +67,7 @@ function setSyntaxMode(ext){
 function showControls(filename,writeperms){
 	// Loads the control bar at the top.
 	// Load the new toolbar.
-	var editorbarhtml = '<div id="editorcontrols" style="display: none;"><div class="crumb svg last" id="breadcrumb_file" style="background-image:url(&quot;'+OC.imagePath('core','breadcrumb.png')+'&quot;)"><p>'+filename.replace(/</, "&lt;").replace(/>/, "&gt;")+'</p></div>';
+	var editorbarhtml = '<div id="editorcontrols" style="display: none;"><div class="crumb svg last" id="breadcrumb_file" style="background-image:url(&quot;'+OC.imagePath('core','breadcrumb.png')+'&quot;)"><p>'+filename+'</p></div>';
 	if(writeperms=="true"){
 		editorbarhtml += '<button id="editor_save">'+t('files_texteditor','Save')+'</button><div class="separator"></div>';
 	}
diff --git a/apps/files_versions/js/settings-personal.js b/apps/files_versions/js/settings-personal.js
index d9456f3f2af..6ea8c1a950f 100644
--- a/apps/files_versions/js/settings-personal.js
+++ b/apps/files_versions/js/settings-personal.js
@@ -1,51 +1,39 @@
-// $(document).ready(function(){
-// 	$('#versions').change( function(){
-// 		OC.msg.startSaving('#calendar .msg')
-// 		// Serialize the data
-// 		var post = $( '#timezone' ).serialize();
-// 		$.post( OC.filePath('calendar', 'ajax/settings', 'settimezone.php'), post, function(data){
-// 			//OC.msg.finishedSaving('#calendar .msg', data);
-// 		});
-// 		return false;
-// 	});
-// });
+// TODO: allow the button to be clicked only once
 
-$(document).ready(function(){
+$( document ).ready(function(){
 	//
-	$('#expireAllBtn').click(function(){
+	$( '#expireAllBtn' ).click( 
 		
-		// Prevent page from reloading
-		event.preventDefault();
+		function( event ) {
 		
-		// Show loading gif
-		$('.expireAllLoading').show();
-	
-		$.getJSON(
-			OC.filePath('files_versions','ajax','expireAll.php'),
-			function(result){
-				if (result.status == 'success') {
-					$('.expireAllLoading').hide();
-					$('#expireAllBtn').html('Expiration successful');
-				} else {
-					
-					// Cancel loading
-					$('#expireAllBtn').html('Expiration failed');
-					
-					// Show Dialog
-					OC.dialogs.alert(
-						'Something went wrong, your files may not have been expired', 
-						'An error has occurred', 
-						function(){ 
-							$('#expireAllBtn').html(t('files_versions', 'Expire all versions')+'<img style="display: none;" class="loading" src="'+OC.filePath('core','img','loading.gif')+'" />'); 
-						}
-						
-					);
-					
-				}
- 			}
+			// Prevent page from reloading
+			event.preventDefault();
 			
-		);
-
-	});
-	
+			// Show loading gif
+			$('.expireAllLoading').show();
+		
+			$.getJSON(
+				OC.filePath('files_versions','ajax','expireAll.php'),
+				function(result){
+					if (result.status == 'success') {
+						$('.expireAllLoading').hide();
+						$('#expireAllBtn').html('Expiration successful');
+					} else {
+						
+						// Cancel loading
+						$('#expireAllBtn').html('Expiration failed');
+						
+						// Show Dialog
+						OC.dialogs.alert(
+							'Something went wrong, your files may not have been expired', 
+							'An error has occurred', 
+							function(){ 
+								$('#expireAllBtn').html(t('files_versions', 'Expire all versions')+'<img style="display: none;" class="loading" src="'+OC.filePath('core','img','loading.gif')+'" />'); 
+							}	
+						);		
+					}
+				}	
+			);
+		}
+	);
 });
 \ No newline at end of file
diff --git a/apps/files_versions/versions.php b/apps/files_versions/versions.php
index 7522538caf2..9c0829ff1de 100644
--- a/apps/files_versions/versions.php
+++ b/apps/files_versions/versions.php
@@ -261,10 +261,8 @@ class Storage {
                 
         }
 
-
-        
         /**
-         * expire old versions of a file.
+         * @brief Erase a file's versions which exceed the set quota
          */
         public static function expire($filename) {
                 if(\OCP\Config::getSystemValue('files_versions', Storage::DEFAULTENABLED)=='true') {
@@ -298,90 +296,16 @@ class Storage {
         }
 
         /**
-         * @brief erase all old versions of all user files
-         * @return 
+         * @brief Erase all old versions of all user files
+         * @return true/false
          */
         public static function expireAll() {
-	
-		function deleteAll( $directory, $empty = false ) {
 		
-			// strip leading slash
-			if( substr( $directory, 0, 1 ) == "/" ) {
-			
-				$directory = substr( $directory, 1 );
-				
-			}
-			
-			// strip trailing slash
-			if( substr( $directory, -1) == "/" ) {
-			
-				$directory = substr( $directory, 0, -1 );
-				
-			}
-
-			$view = new \OC_FilesystemView('');
-			
-			if ( !$view->file_exists( $directory ) || !$view->is_dir( $directory ) ) {
-			
-				return false;
-				
-			} elseif( !$view->is_readable( $directory ) ) {
-			
-				return false;
-				
-			} else {
-			
-				$foldername = \OCP\Config::getSystemValue('datadirectory') .'/' . \OCP\USER::getUser() .'/' . $directory; // have to set an absolute path for use with PHP's opendir as OC version doesn't work
-				
-				$directoryHandle = $view->opendir( \OCP\USER::getUser() . '/' . $directory );
-				
-				while ( $contents = readdir( $directoryHandle ) ) {
-				
-					if ( $contents != '.' && $contents != '..') {
-						
-						$path = $directory . "/" . $contents;
-					
-						if ( $view->is_dir( $path ) ) {
-							
-							deleteAll( $path );
-						
-						} else {
-							
-							$view->unlink( \OCP\USER::getUser() .'/' . $path ); // TODO: make unlink use same system path as is_dir
-						
-						}
-					}
-				
-				}
-			
-				//$view->closedir( $directoryHandle ); // TODO: implement closedir in OC_FSV
-
-				if ( $empty == false ) {
-				
-					if ( !$view->rmdir( $directory ) ) {
-					
-						return false;
-						
-					}
-					
- 				}
-			
-				return true;
-			}
-			
-		}
+		$view = new \OC_FilesystemView('');
 		
 		$dir = \OCP\Config::getSystemValue('files_versionsfolder', Storage::DEFAULTFOLDER);
 		
-		if ( deleteAll( $dir, true ) ) {
-		
-			return true;
-			
-		} else {
-			
-			return false;
-			
-		}
+		return $view->deleteAll( $dir, true );
 	
         }
 
diff --git a/apps/gallery/ajax/thumbnail.php b/apps/gallery/ajax/thumbnail.php
index 4fc9eba992d..5bf1d420dc4 100644
--- a/apps/gallery/ajax/thumbnail.php
+++ b/apps/gallery/ajax/thumbnail.php
@@ -23,6 +23,7 @@
  
 OCP\JSON::checkLoggedIn();
 OCP\JSON::checkAppEnabled('gallery');
+session_write_close();
 require_once('apps/gallery/lib/managers.php');
 
 
diff --git a/apps/gallery/appinfo/update.php b/apps/gallery/appinfo/update.php
index a0997ab5e86..c1d22127428 100644
--- a/apps/gallery/appinfo/update.php
+++ b/apps/gallery/appinfo/update.php
@@ -7,5 +7,5 @@ if (version_compare($currentVersion, '0.5.0', '<')) {
 	$stmt = OCP\DB::prepare('DROP TABLE IF EXISTS *PREFIX*gallery_albums');
 	$stmt->execute();
 
-	\OC_DB::createDbFromStructure(OC::$APPSROOT.'/apps/'.$appid.'/appinfo/database.xml');
+	\OC_DB::createDbFromStructure(OC_App::getAppPath($appid).'/appinfo/database.xml');
 }
diff --git a/apps/gallery/css/sharing.css b/apps/gallery/css/sharing.css
index d061fc3e6c1..4712369cc84 100644
--- a/apps/gallery/css/sharing.css
+++ b/apps/gallery/css/sharing.css
@@ -5,4 +5,4 @@ div.gallery_box:hover { color: black; }
 div.gallery_box h1 {font-size: 17px; font-weight: normal;}
 div#breadcrumb { border: 0; width: 70%; margin: 0 auto; padding: 25px 0; font-family: Verdana; text-align: center;}
 span.breadcrumbelement { margin: 10px; margin-right: 0; cursor: pointer;}
-span.inside { background-image: url('%appswebroot%/apps/gallery/img/breadcrumb.png'); padding-left: 20px; background-position: left; background-repeat: no-repeat;}
+span.inside { background-image: url('%appswebroot%/gallery/img/breadcrumb.png'); padding-left: 20px; background-position: left; background-repeat: no-repeat;}
diff --git a/apps/gallery/lib/tiles.php b/apps/gallery/lib/tiles.php
index 2ff4fa5647b..011168471f0 100644
--- a/apps/gallery/lib/tiles.php
+++ b/apps/gallery/lib/tiles.php
@@ -141,7 +141,7 @@ class TileStack extends TileBase {
 	}
 
 	public function get() {
-		$r = '<div class="title gallery_div">'.$this->stack_name.'</div>';
+		$r = '<div class="title gallery_div">'. \OCP\Util::sanitizeHTML($this->stack_name).'</div>';
 		for ($i = 0; $i < count($this->tiles_array); $i++) {
 			$top = rand(-5, 5);
 			$left = rand(-5, 5);
@@ -168,7 +168,7 @@ class TileStack extends TileBase {
 	}
 	
 	public function getOnClickAction() {
-		return 'javascript:openNewGal(\''.$this->stack_name.'\');';
+		return 'javascript:openNewGal(\''.\OCP\Util::sanitizeHTML($this->stack_name).'\');';
 	}
 
 	private $tiles_array;
diff --git a/apps/gallery/templates/index.php b/apps/gallery/templates/index.php
index 1890552fc0c..c3b4a178545 100644
--- a/apps/gallery/templates/index.php
+++ b/apps/gallery/templates/index.php
@@ -1,6 +1,6 @@
 <script type="text/javascript">
 
-var root = "<?php echo $_['root']; ?>";
+var root = "<?php echo OCP\Util::sanitizeHTML($_['root']); ?>";
 
 $(document).ready(function() {
 		$("a[rel=images]").fancybox({
@@ -26,6 +26,7 @@ $(document).ready(function() {
 </div>
 <div id="gallerycontent">
 <?php
+session_write_close();
 
 echo $_['tl']->get();
 
diff --git a/apps/media/js/player.js b/apps/media/js/player.js
index ad406830833..867ea802363 100644
--- a/apps/media/js/player.js
+++ b/apps/media/js/player.js
@@ -40,7 +40,7 @@ var PlayList={
 					PlayList.init(items[index].type,null); // init calls load that calls play
 				}else{
 					PlayList.player.jPlayer("setMedia", items[PlayList.current]);
-					$(".jp-current-song").text(items[PlayList.current].name);
+					$(".jp-current-song").html(items[PlayList.current].name);
 					items[index].playcount++;
 					PlayList.player.jPlayer("play",time);
 					if(index>0){
diff --git a/apps/media/remote.php b/apps/media/remote.php
index 01add42b315..0535077cef1 100644
--- a/apps/media/remote.php
+++ b/apps/media/remote.php
@@ -5,7 +5,7 @@ $RUNTIME_APPTYPES=array('filesystem','authentication');
 OC_App::loadApps($RUNTIME_APPTYPES);
 
 if($path_info == '/ampache' || $path_info == '/ampache/'){
-	require_once(OC::$APPSROOT . '/apps/media/index.php');
+	require_once(OC_App::getAppPath('media').'/index.php');
 }else{
-	require_once(OC::$APPSROOT . '/apps/media/server/xml.server.php');
+	require_once(OC_App::getAppPath('media').'/server/xml.server.php');
 }
diff --git a/apps/media/server/xml.server.php b/apps/media/server/xml.server.php
index 6cb6c91ca06..796da130a47 100644
--- a/apps/media/server/xml.server.php
+++ b/apps/media/server/xml.server.php
@@ -22,8 +22,8 @@
 */
 
 OCP\App::checkAppEnabled('media');
- require_once(OC::$APPSROOT . '/apps/media/lib_collection.php');
- require_once(OC::$APPSROOT . '/apps/media/lib_ampache.php');
+ require_once(OC_App::getAppPath('media').'/lib_collection.php');
+ require_once(OC_App::getAppPath('media').'/lib_ampache.php');
 
 $arguments=$_POST;
 if(!isset($_POST['action']) and isset($_GET['action'])){
diff --git a/apps/tasks/css/style.css b/apps/tasks/css/style.css
index 23aac4e9ca7..80b6e777b5d 100644
--- a/apps/tasks/css/style.css
+++ b/apps/tasks/css/style.css
@@ -33,7 +33,7 @@
 .task .completed {position:absolute;left:3em;top:0.3em;}
 
 .task .summary{padding-left:4em;height:2em;}
-.task .summary input{position:relative;left:5px;top:0.5em;}
+.task .summary input{position:absolute;left:5em;top:0;}
 .task.done .summary{text-decoration:line-through;}
 
 .task .tag{border-radius:0.4em;display:inline-block;opacity:0.2;margin:0 0.2em;border:1px solid transparent;padding:0 0.4em;cursor:pointer;}
@@ -58,3 +58,5 @@
 .task .due{position:absolute;right:0.3em;}
 .task .due .date{width:6em;}
 .task .due .time{width:6em;}
+
+.task_delete{position:absolute;bottom:2px;right:5px}
diff --git a/apps/tasks/js/tasks.js b/apps/tasks/js/tasks.js
index 6547b80981c..bc92965bb0b 100644
--- a/apps/tasks/js/tasks.js
+++ b/apps/tasks/js/tasks.js
@@ -97,8 +97,10 @@ OC.Tasks = {
 				due.find('.time').timepicker('setTime', date.getHours()+':'+date.getMinutes());
 			}
 		}
+		var delete_action = task_container.find('.task_delete').click(OC.Tasks.deleteClickHandler);
 		$('<div>')
 			.addClass('more')
+			.append(delete_action)
 			.append(description)
 			.append(due)
 			.appendTo(task_container);
@@ -273,6 +275,19 @@ OC.Tasks = {
 		$task.find('div.location').show();
 		$task.find('input.location').hide();
 	},
+	deleteClickHandler:function(event){
+		var $task = $(this).closest('.task'),
+			task = $task.data('task');
+		$.post(OC.filePath('tasks', 'ajax', 'delete.php'),{'id':task.id},function(jsondata){
+			if(jsondata.status == 'success'){
+				$task.remove();
+			}
+			else{
+				alert(jsondata.data.message);
+			}
+		});
+		return false;
+	},
 	complete_task:function() {
 		var $task = $(this).closest('.task'),
 			task = $task.data('task'),
@@ -441,21 +456,6 @@ $(document).ready(function(){
 		});
 	});
 
-	$('#tasks_delete').live('click',function(){
-		var id = $('#task_details').data('id');
-		$.post('ajax/delete.php',{'id':id},function(jsondata){
-			if(jsondata.status == 'success'){
-				$('#tasks [data-id="'+jsondata.data.id+'"]').remove();
-				$('#task_details').data('id','');
-				$('#task_details').html('');
-			}
-			else{
-				alert(jsondata.data.message);
-			}
-		});
-		return false;
-	});
-
 	$('#tasks_addtask').click(function(){
 		var input = $('#tasks_newtask').val();
 		$.post(OC.filePath('tasks', 'ajax', 'addtask.php'),{text:input},function(jsondata){
diff --git a/apps/tasks/templates/tasks.php b/apps/tasks/templates/tasks.php
index ab6138b613f..8c0c89e4970 100644
--- a/apps/tasks/templates/tasks.php
+++ b/apps/tasks/templates/tasks.php
@@ -2,7 +2,7 @@
 	<input type="text" id="tasks_newtask">
 	<input type="button" id="tasks_addtask" value="<?php echo $l->t('Add Task'); ?>">
 	<input type="button" id="tasks_order_due" value="<?php echo $l->t('Order Due'); ?>">
-	<input type="button" id="tasks_order_category" value="<?php echo $l->t('Order Category'); ?>">
+	<input type="button" id="tasks_order_category" value="<?php echo $l->t('Order List'); ?>">
 	<input type="button" id="tasks_order_complete" value="<?php echo $l->t('Order Complete'); ?>">
 	<input type="button" id="tasks_order_location" value="<?php echo $l->t('Order Location'); ?>">
 	<input type="button" id="tasks_order_prio" value="<?php echo $l->t('Order Priority'); ?>">
@@ -25,6 +25,9 @@
 	<span class="task_less">
 		<img title="<?php echo $l->t('Less') ?>" src="<?php echo OCP\image_path('core', 'actions/triangle-n.svg') ?>" class="svg"><?php echo $l->t('Less') ?>
 	</span>
+	<span class="task_delete">
+		<img title="<?php echo $l->t('Delete') ?>" src="<?php echo OCP\image_path('core', 'actions/delete.svg') ?>" class="svg"><?php echo $l->t('Delete') ?>
+	</span>
 </p>
 <script type='text/javascript'>
 var categories = <?php echo json_encode($_['categories']); ?>;
diff --git a/apps/user_ldap/user_ldap.php b/apps/user_ldap/user_ldap.php
index 9281aebe81d..85b3d88973c 100644
--- a/apps/user_ldap/user_ldap.php
+++ b/apps/user_ldap/user_ldap.php
@@ -124,9 +124,19 @@ class OC_USER_LDAP extends OC_User_Backend {
 	 * @return boolean
 	 */
 	public function userExists($uid){
-		return in_array($uid, $this->getUsers());
-	}
+		//getting dn, if false the user does not exist. If dn, he may be mapped only, requires more checking.
+		$dn = OC_LDAP::username2dn($uid);
+		if(!$dn) {
+			return false;
+		}
 
-}
+		//if user really still exists, we will be able to read his cn
+		$cn = OC_LDAP::readAttribute($dn, 'cn');
+		if(!$cn || empty($cn)) {
+			return false;
+		}
+
+		return true;
+	}
 
-?>
+}
+\ No newline at end of file
diff --git a/apps/user_webfinger/webfinger.php b/apps/user_webfinger/webfinger.php
index 39ab4ba6ba5..6b64a7e2860 100644
--- a/apps/user_webfinger/webfinger.php
+++ b/apps/user_webfinger/webfinger.php
@@ -52,7 +52,7 @@ echo "{\"links\":[";
 $apps = OC_Appconfig::getApps();
 foreach($apps as $app) {
 	if(OCP\App::isEnabled($app)) {
-		if(is_file(OC::$APPSROOT . '/apps/' . $app . '/appinfo/webfinger.php')) {
+		if(is_file(OC_App::getAppPath($app). '/appinfo/webfinger.php')) {
 			require($app . '/appinfo/webfinger.php');
 		}
 	}
diff --git a/config/config.sample.php b/config/config.sample.php
index bb13b1f8ea3..c4cb719796b 100644
--- a/config/config.sample.php
+++ b/config/config.sample.php
@@ -86,15 +86,23 @@ $CONFIG = array(
 /* Loglevel to start logging at. 0=DEBUG, 1=INFO, 2=WARN, 3=ERROR (default is WARN) */
 "loglevel" => "",
 
-/* Set this to false to disable the check for writable apps dir.
- * If the apps dir is not writable, you can't download&install extra apps
- * in the admin apps menu.
- */
-"writable_appsdir" => true,
-
 /* The directory where the user data is stored, default to data in the owncloud
  * directory. The sqlite database is also stored here, when sqlite is used.
  */
-// "datadirectory" => ""
+// "datadirectory" => "",
+
+"apps_paths" => array(
+
+/* Set an array of path for your apps directories
+ key 'path' is for the fs path an the key 'url' is for the http path to your
+ applications paths. 'writable' indicate if the user can install apps in this folder.
+ You must have at least 1 app folder writable or you must set the parameter : appstoreenabled to false
+*/
+	array(
+		'path'=> '/var/www/owncloud/apps',
+		'url' => '/apps',
+		'writable' => true,
+  ),
+ ),
 );
-?>
+
diff --git a/core/js/js.js b/core/js/js.js
index 89a20a529f3..7a53bb75ef5 100644
--- a/core/js/js.js
+++ b/core/js/js.js
@@ -31,7 +31,7 @@ t.cache={};
 
 OC={
 	webroot:oc_webroot,
-	appswebroot:oc_appswebroot,
+	appswebroots:oc_appswebroots,
 	currentUser:(typeof oc_current_user!=='undefined')?oc_current_user:false,
 	coreApps:['', 'admin','log','search','settings','core','3rdparty'],
 	/**
@@ -63,12 +63,9 @@ OC={
 				link+= file;
 			}
 		}else if(file.substring(file.length-3) != 'php' && !isCore){
-			link=OC.appswebroot;
-			link+='/';
-			link+='apps/';
-			link+=app+'/';
+			link=OC.appswebroots[app];
 			if(type){
-				link+=type+'/';
+				link+= '/'+type+'/';
 			}
 			link+=file;
 		}else{
diff --git a/core/templates/layout.guest.php b/core/templates/layout.guest.php
index 55cc8008d9a..4cdbfd16e52 100644
--- a/core/templates/layout.guest.php
+++ b/core/templates/layout.guest.php
@@ -12,7 +12,7 @@
 		<?php endforeach; ?>
 		<script type="text/javascript">
 			var oc_webroot = '<?php echo OC::$WEBROOT; ?>';
-			var oc_appswebroot = '<?php echo OC::$APPSWEBROOT; ?>';
+			var oc_appswebroots = <?php echo $_['apps_paths'] ?>;
 		</script>
 		<?php if (!empty(OC_Util::$core_scripts)): ?>
 		<script type="text/javascript" src="<?php echo OC_Helper::linkToRemote('core.js', false) ?>"></script>
diff --git a/core/templates/layout.user.php b/core/templates/layout.user.php
index 500ac9beda3..d6911fd1e18 100644
--- a/core/templates/layout.user.php
+++ b/core/templates/layout.user.php
@@ -12,7 +12,7 @@
 		<?php endforeach; ?>
 		<script type="text/javascript">
 			var oc_webroot = '<?php echo OC::$WEBROOT; ?>';
-			var oc_appswebroot = '<?php echo OC::$APPSWEBROOT; ?>';
+			var oc_appswebroots = <?php echo $_['apps_paths'] ?>;
 			var oc_current_user = '<?php echo OC_User::getUser() ?>';
 		</script>
 		<?php if (!empty(OC_Util::$core_scripts)): ?>
@@ -47,7 +47,7 @@
 			<a href="<?php echo link_to('', 'index.php'); ?>" title="" id="owncloud"><img class="svg" src="<?php echo image_path('', 'logo-wide.svg'); ?>" alt="ownCloud" /></a>
 			<a class="header-right header-action" id="logout" href="<?php echo link_to('', 'index.php'); ?>?logout=true"><img class="svg" alt="<?php echo $l->t('Log out');?>" title="<?php echo $l->t('Log out');?>" src="<?php echo image_path('', 'actions/logout.svg'); ?>" /></a>
 			<form class="searchbox header-right" action="#" method="post">
-				<input id="searchbox" class="svg" type="search" name="query" value="<?php if(isset($_POST['query'])){echo htmlentities($_POST['query']);};?>" autocomplete="off" />
+				<input id="searchbox" class="svg" type="search" name="query" value="<?php if(isset($_POST['query'])){echo OC_Util::sanitizeHTML($_POST['query']);};?>" autocomplete="off" />
 			</form>
 		</div></header>
 
diff --git a/core/templates/login.php b/core/templates/login.php
index a40bf5c330a..985cf90c2a2 100644
--- a/core/templates/login.php
+++ b/core/templates/login.php
@@ -7,7 +7,7 @@
 		<?php endif; ?>
 		<p class="infield">
 			<label for="user" class="infield"><?php echo $l->t( 'Username' ); ?></label>
-			<input type="text" name="user" id="user" value="<?php echo !empty($_POST['user'])?htmlentities($_POST['user'],ENT_COMPAT,'utf-8').'"':'" autofocus'; ?> autocomplete="off" required />
+			<input type="text" name="user" id="user" value="<?php echo !empty($_POST['user'])?OC_Util::sanitizeHTML($_POST['user'],ENT_COMPAT,'utf-8').'"':'" autofocus'; ?> autocomplete="off" required />
 		</p>
 		<p class="infield">
 			<label for="password" class="infield"><?php echo $l->t( 'Password' ); ?></label>
diff --git a/lib/app.php b/lib/app.php
index c08e977b032..486704a2229 100755
--- a/lib/app.php
+++ b/lib/app.php
@@ -83,7 +83,7 @@ class OC_App{
 	 * @param string app
 	 */
 	public static function loadApp($app){
-		if(is_file(OC::$APPSROOT.'/apps/'.$app.'/appinfo/app.php')){
+		if(is_file(self::getAppPath($app).'/appinfo/app.php')){
 			require_once( $app.'/appinfo/app.php' );
 		}
 	}
@@ -143,6 +143,8 @@ class OC_App{
 	 * get all enabled apps
 	 */
 	public static function getEnabledApps(){
+		if(!OC_Config::getValue('installed', false))
+			return array();
 		$apps=array('files');
 		$query = OC_DB::prepare( 'SELECT appid FROM *PREFIX*appconfig WHERE configkey = \'enabled\' AND configvalue=\'yes\'' );
 		$result=$query->execute();
@@ -328,10 +330,55 @@ class OC_App{
 	}
 
 	/**
+	* Get the path where to install apps
+  */
+	public static function getInstallPath() {
+		if(OC_Config::getValue('appstoreenabled', true)==false) {
+			return false;
+		}
+
+		foreach(OC::$APPSROOTS as $dir) {
+			if(isset($dir['writable']) && $dir['writable']===true)
+				return $dir['path'];
+		}
+
+		OC_Log::write('core','No application directories are marked as writable.',OC_Log::ERROR);
+		return null;
+	}
+
+
+	protected static function findAppInDirectories($appid) {
+		foreach(OC::$APPSROOTS as $dir) {
+			if(file_exists($dir['path'].'/'.$appid)) {
+				return $dir;
+			}
+		}
+	}
+	/**
+	* Get the directory for the given app.
+	* If the app is defined in multiple directory, the first one is taken. (false if not found)
+	*/
+	public static function getAppPath($appid) {
+		if( ($dir = self::findAppInDirectories($appid)) != false) {
+			return $dir['path'].'/'.$appid;
+		}
+	}
+
+	/**
+	* Get the path for the given app on the access
+	* If the app is defined in multiple directory, the first one is taken. (false if not found)
+	*/
+	public static function getAppWebPath($appid) {
+		if( ($dir = self::findAppInDirectories($appid)) != false) {
+			return OC::$WEBROOT.$dir['url'].'/'.$appid;
+		}
+	}
+
+	/**
 	 * get the last version of the app, either from appinfo/version or from appinfo/info.xml
 	 */
 	public static function getAppVersion($appid){
-		$file=OC::$APPSROOT.'/apps/'.$appid.'/appinfo/version';
+		$file= self::getAppPath($appid).'/appinfo/version';
 		$version=@file_get_contents($file);
 		if($version){
 			return $version;
@@ -354,7 +401,7 @@ class OC_App{
 			if(isset(self::$appInfo[$appid])){
 				return self::$appInfo[$appid];
 			}
-			$file=OC::$APPSROOT.'/apps/'.$appid.'/appinfo/info.xml';
+			$file= self::getAppPath($appid).'/appinfo/info.xml';
 		}
 		$data=array();
 		$content=@file_get_contents($file);
@@ -467,10 +514,12 @@ class OC_App{
 	 */
 	public static function getAllApps(){
 		$apps=array();
-		$dh=opendir(OC::$APPSROOT.'/apps');
-		while($file=readdir($dh)){
-			if($file[0]!='.' and is_file(OC::$APPSROOT.'/apps/'.$file.'/appinfo/app.php')){
-				$apps[]=$file;
+		foreach(OC::$APPSROOTS as $apps_dir) {
+			$dh=opendir($apps_dir['path']);
+			while($file=readdir($dh)){
+				if($file[0]!='.' and is_file($apps_dir['path'].'/'.$file.'/appinfo/app.php')){
+					$apps[]=$file;
+				}
 			}
 		}
 		return $apps;
@@ -536,24 +585,24 @@ class OC_App{
 	 * @param string appid
 	 */
 	public static function updateApp($appid){
-		if(file_exists(OC::$APPSROOT.'/apps/'.$appid.'/appinfo/database.xml')){
-			OC_DB::updateDbFromStructure(OC::$APPSROOT.'/apps/'.$appid.'/appinfo/database.xml');
+		if(file_exists(self::getAppPath($appid).'/appinfo/database.xml')){
+			OC_DB::updateDbFromStructure(self::getAppPath($appid).'/appinfo/database.xml');
 		}
 		if(!self::isEnabled($appid)){
 			return;
 		}
-		if(file_exists(OC::$APPSROOT.'/apps/'.$appid.'/appinfo/update.php')){
+		if(file_exists(self::getAppPath($appid).'/appinfo/update.php')){
 			self::loadApp($appid);
-			include OC::$APPSROOT.'/apps/'.$appid.'/appinfo/update.php';
+			include self::getAppPath($appid).'/appinfo/update.php';
 		}
 
 		//set remote/public handelers
 		$appData=self::getAppInfo($appid);
 		foreach($appData['remote'] as $name=>$path){
-			OCP\CONFIG::setAppValue('core', 'remote_'.$name, '/apps/'.$appid.'/'.$path);
+			OCP\CONFIG::setAppValue('core', 'remote_'.$name, $path);
 		}
 		foreach($appData['public'] as $name=>$path){
-			OCP\CONFIG::setAppValue('core', 'public_'.$name, '/apps/'.$appid.'/'.$path);
+			OCP\CONFIG::setAppValue('core', 'public_'.$name, $appid.'/'.$path);
 		}
 
 		self::setAppTypes($appid);
diff --git a/lib/base.php b/lib/base.php
index b6ca19568fe..870550f267d 100644
--- a/lib/base.php
+++ b/lib/base.php
@@ -51,13 +51,9 @@ class OC{
 	 */
 	public static $THIRDPARTYWEBROOT = '';
 	/**
-	 * The installation path of the apps folder on the server (e.g. /srv/http/owncloud)
+	 * The installation path array of the apps folder on the server (e.g. /srv/http/owncloud) 'path' and web path in 'url'
 	 */
-	public static $APPSROOT = '';
-	/**
-	 * the root path of the apps folder for http requests (e.g. owncloud)
-	 */
-	public static $APPSWEBROOT = '';
+	public static $APPSROOTS = array();
 	/*
 	 * requested app
 	 */
@@ -75,7 +71,11 @@ class OC{
 	 */
 	public static function autoload($className){
 		if(array_key_exists($className,OC::$CLASSPATH)){
-			require_once OC::$CLASSPATH[$className];
+			/** @TODO: Remove this when necessary
+			 Remove "apps/" from inclusion path for smooth migration to mutli app dir
+			*/
+			$path = preg_replace('/apps\//','', OC::$CLASSPATH[$className]);
+			require_once $path;
 		}
 		elseif(strpos($className,'OC_')===0){
 			require_once strtolower(str_replace('_','/',substr($className,3)) . '.php');
@@ -132,29 +132,34 @@ class OC{
 			echo("3rdparty directory not found! Please put the ownCloud 3rdparty folder in the ownCloud folder or the folder above. You can also configure the location in the config.php file.");
 			exit;
 		}
-
 		// search the apps folder
-		if(OC_Config::getValue('appsroot', '')<>''){
-			OC::$APPSROOT=OC_Config::getValue('appsroot', '');
-			OC::$APPSWEBROOT=OC_Config::getValue('appsurl', '');
+		$config_paths = OC_Config::getValue('apps_paths', array());
+		if(! empty($config_paths)){
+			foreach($config_paths as $paths) {
+				if( isset($paths['url']) && isset($paths['path']))
+					OC::$APPSROOTS[] = $paths;	
+			}
 		}elseif(file_exists(OC::$SERVERROOT.'/apps')){
-			OC::$APPSROOT=OC::$SERVERROOT;
-			OC::$APPSWEBROOT=OC::$WEBROOT;
+			OC::$APPSROOTS[] = array('path'=> OC::$SERVERROOT.'/apps', 'url' => '/apps/', 'writable' => true);
 		}elseif(file_exists(OC::$SERVERROOT.'/../apps')){
+			OC::$APPSROOTS[] = array('path'=> rtrim(dirname(OC::$SERVERROOT), '/').'/apps', 'url' => '/apps/', 'writable' => true);
 			OC::$APPSROOT=rtrim(dirname(OC::$SERVERROOT), '/');
-			OC::$APPSWEBROOT=rtrim(dirname(OC::$WEBROOT), '/');
-		}else{
+		}
+
+		if(empty(OC::$APPSROOTS)){
 			echo("apps directory not found! Please put the ownCloud apps folder in the ownCloud folder or the folder above. You can also configure the location in the config.php file.");
 			exit;
 		}
+		$paths = array();
+		foreach( OC::$APPSROOTS as $path)
+			$paths[] = $path['path'];
 
 		// set the right include path
 		set_include_path(
 			OC::$SERVERROOT.'/lib'.PATH_SEPARATOR.
 			OC::$SERVERROOT.'/config'.PATH_SEPARATOR.
 			OC::$THIRDPARTYROOT.'/3rdparty'.PATH_SEPARATOR.
-			OC::$APPSROOT.PATH_SEPARATOR.
-			OC::$APPSROOT.'/apps'.PATH_SEPARATOR.
+			implode($paths,PATH_SEPARATOR).PATH_SEPARATOR.
 			get_include_path().PATH_SEPARATOR.
 			OC::$SERVERROOT
 		);
@@ -232,24 +237,25 @@ class OC{
 	}
 
 	public static function loadapp(){
-		if(file_exists(OC::$APPSROOT . '/apps/' . OC::$REQUESTEDAPP . '/index.php')){
-			require_once(OC::$APPSROOT . '/apps/' . OC::$REQUESTEDAPP . '/index.php');
+		if(file_exists(OC_App::getAppPath(OC::$REQUESTEDAPP) . '/index.php')){
+			require_once(OC_App::getAppPath(OC::$REQUESTEDAPP) . '/index.php');
 		}else{
 			trigger_error('The requested App was not found.', E_USER_ERROR);//load default app instead?
 		}
 	}
 
 	public static function loadfile(){
-		if(file_exists(OC::$APPSROOT . '/apps/' . OC::$REQUESTEDAPP . '/' . OC::$REQUESTEDFILE)){
+		if(file_exists(OC_App::getAppPath(OC::$REQUESTEDAPP) . '/' . OC::$REQUESTEDFILE)){
 			if(substr(OC::$REQUESTEDFILE, -3) == 'css'){
-				$file = 'apps/' . OC::$REQUESTEDAPP . '/' . OC::$REQUESTEDFILE;
+				$file = OC_App::getAppWebPath(OC::$REQUESTEDAPP). '/' . OC::$REQUESTEDFILE;
 				$minimizer = new OC_Minimizer_CSS();
-				$minimizer->output(array(array(OC::$APPSROOT, OC::$APPSWEBROOT, $file)), $file);
+				$minimizer->output(array(array(OC_App::getAppPath(OC::$REQUESTEDAPP), OC_App::getAppWebPath(OC::$REQUESTEDAPP), OC::$REQUESTEDFILE)),$file);
 				exit;
 			}elseif(substr(OC::$REQUESTEDFILE, -3) == 'php'){
-				require_once(OC::$APPSROOT . '/apps/' . OC::$REQUESTEDAPP . '/' . OC::$REQUESTEDFILE);
+				require_once(OC_App::getAppPath(OC::$REQUESTEDAPP). '/' . OC::$REQUESTEDFILE);
 			}
 		}else{
+			die();
 			header('HTTP/1.0 404 Not Found');
 			exit;
 		}
@@ -391,8 +397,8 @@ class OC{
 			$_GET['getfile'] = $file;
 		}
 		if(!is_null(self::$REQUESTEDFILE)){
-			$subdir = OC::$APPSROOT . '/apps/' . self::$REQUESTEDAPP . '/' . self::$REQUESTEDFILE;
-			$parent = OC::$APPSROOT . '/apps/' . self::$REQUESTEDAPP;
+			$subdir = OC_App::getAppPath(OC::$REQUESTEDAPP) . '/' . self::$REQUESTEDFILE;
+			$parent = OC_App::getAppPath(OC::$REQUESTEDAPP);
 			if(!OC_Helper::issubdirectory($subdir, $parent)){
 				self::$REQUESTEDFILE = null;
 				header('HTTP/1.0 404 Not Found');
diff --git a/lib/cache/apc.php b/lib/cache/apc.php
index f814afbe494..b1ce87f5267 100644
--- a/lib/cache/apc.php
+++ b/lib/cache/apc.php
@@ -44,3 +44,11 @@ class OC_Cache_APC {
 		}
 	}
 }
+if(!function_exists('apc_exists')) {
+	function apc_exists($keys)
+	{
+		$result;
+		apc_fetch($keys, $result);
+		return $result;
+	}
+}
diff --git a/lib/config.php b/lib/config.php
index 9279549b1bb..65f9fdc06ba 100644
--- a/lib/config.php
+++ b/lib/config.php
@@ -152,23 +152,12 @@ class OC_Config{
 	 *
 	 * Saves the config to the config file.
 	 *
-	 * Known flaws: Strings are not escaped properly
 	 */
 	public static function writeData(){
 		// Create a php file ...
-		$content = "<?php\n\$CONFIG = array(\n";
-
-		foreach( self::$cache as $key => $value ){
-			if( is_bool( $value )){
-				$value = $value ? 'true' : 'false';
-				$content .= "\"$key\" => $value,\n";
-			}
-			else{
-				$value = str_replace( "'", "\\'", $value );
-				$content .= "\"$key\" => '$value',\n";
-			}
-		}
-		$content .= ");\n?>\n";
+		$content = "<?php\n\$CONFIG = ";
+		$content .= var_export(self::$cache, true);
+		$content .= ";\n?>\n";
 
 		$filename = OC::$SERVERROOT."/config/config.php";
 		// Write the file
diff --git a/lib/connector/sabre/auth.php b/lib/connector/sabre/auth.php
index 1c7a84f0f2a..ee680391626 100644
--- a/lib/connector/sabre/auth.php
+++ b/lib/connector/sabre/auth.php
@@ -33,7 +33,7 @@ class OC_Connector_Sabre_Auth extends Sabre_DAV_Auth_Backend_AbstractBasic {
 	protected function validateUserPass($username, $password){
 		OC_Util::setUpFS();//login hooks may need early access to the filesystem
 		if(OC_User::login($username,$password)){
-			OC_Util::setUpFS();
+			OC_Util::setUpFS($username);
 			return true;
 		}
 		else{
diff --git a/lib/filecache.php b/lib/filecache.php
index 9963a5a3baf..e3bcc7d0000 100644
--- a/lib/filecache.php
+++ b/lib/filecache.php
@@ -68,14 +68,14 @@ class OC_FileCache{
 		$path=$root.$path;
 		$parent=self::getParentId($path);
 		$id=self::getId($path,'');
+		if(isset(OC_FileCache_Cached::$savedData[$path])){
+			$data=array_merge(OC_FileCache_Cached::$savedData[$path],$data);
+			unset(OC_FileCache_Cached::$savedData[$path]);
+		}
 		if($id!=-1){
 			self::update($id,$data);
 			return;
 		}
-		if(isset(OC_FileCache_Cached::$savedData[$path])){
-			$data=array_merge($data,OC_FileCache_Cached::$savedData[$path]);
-			unset(OC_FileCache_Cached::$savedData[$path]);
-		}
 		if(!isset($data['size']) or !isset($data['mtime'])){//save incomplete data for the next time we write it
 			OC_FileCache_Cached::$savedData[$path]=$data;
 			return;
diff --git a/lib/filestorage/common.php b/lib/filestorage/common.php
index f2a5775fd19..ba78fca80e5 100644
--- a/lib/filestorage/common.php
+++ b/lib/filestorage/common.php
@@ -20,6 +20,18 @@
 * License along with this library.  If not, see <http://www.gnu.org/licenses/>.
 */
 
+/**
+ * Storage backend class for providing common filesystem operation methods 
+ * which are not storage-backend specific.
+ *
+ * OC_Filestorage_Common is never used directly; it is extended by all other
+ * storage backends, where its methods may be overridden, and additional 
+ * (backend-specific) methods are defined.
+ *
+ * Some OC_Filestorage_Common methods call functions which are first defined
+ * in classes which extend it, e.g. $this->stat() .
+ */
+
 abstract class OC_Filestorage_Common extends OC_Filestorage {
 
 	public function __construct($parameters){}
@@ -87,6 +99,79 @@ abstract class OC_Filestorage_Common extends OC_Filestorage {
 		return $count>0;
 	}
 // 	abstract public function fopen($path,$mode);
+
+	/**
+	 * @brief Deletes all files and folders recursively within a directory
+	 * @param $directory The directory whose contents will be deleted
+	 * @param $empty Flag indicating whether directory will be emptied
+	 * @returns true/false
+	 *
+	 * @note By default the directory specified by $directory will be 
+	 * deleted together with its contents. To avoid this set $empty to true
+	 */
+	public function deleteAll( $directory, $empty = false ) {
+	
+		// strip leading slash
+		if( substr( $directory, 0, 1 ) == "/" ) {
+		
+			$directory = substr( $directory, 1 );
+			
+		}
+		
+		// strip trailing slash
+		if( substr( $directory, -1) == "/" ) {
+		
+			$directory = substr( $directory, 0, -1 );
+			
+		}
+		
+		if ( !$this->file_exists( \OCP\USER::getUser() . '/' . $directory ) || !$this->is_dir( \OCP\USER::getUser() . '/' . $directory ) ) {
+		
+			return false;
+			
+		} elseif( !$this->is_readable( \OCP\USER::getUser() . '/' . $directory ) ) {
+		
+			return false;
+			
+		} else {
+			
+			$directoryHandle = $this->opendir( \OCP\USER::getUser() . '/' . $directory );
+			
+			while ( $contents = readdir( $directoryHandle ) ) {
+			
+				if ( $contents != '.' && $contents != '..') {
+					
+					$path = $directory . "/" . $contents;
+				
+					if ( $this->is_dir( $path ) ) {
+						
+						deleteAll( $path );
+					
+					} else {
+						
+						$this->unlink( \OCP\USER::getUser() .'/' . $path ); // TODO: make unlink use same system path as is_dir
+					
+					}
+				}
+			
+			}
+		
+			//$this->closedir( $directoryHandle ); // TODO: implement closedir in OC_FSV
+
+			if ( $empty == false ) {
+			
+				if ( !$this->rmdir( $directory ) ) {
+				
+					return false;
+					
+				}
+				
+			}
+		
+			return true;
+		}
+		
+	}
 	public function getMimeType($path){
 		if(!$this->file_exists($path)){
 			return false;
diff --git a/lib/filestorage/local.php b/lib/filestorage/local.php
index 44a2ab0f634..b2eba051515 100644
--- a/lib/filestorage/local.php
+++ b/lib/filestorage/local.php
@@ -2,7 +2,7 @@
 /**
  * for local filestore, we only have to map the paths
  */
-class OC_Filestorage_Local extends OC_Filestorage{
+class OC_Filestorage_Local extends OC_Filestorage_Common{
 	protected $datadir;
 	private static $mimetypes=null;
 	public function __construct($arguments){
@@ -172,7 +172,7 @@ class OC_Filestorage_Local extends OC_Filestorage{
 			return $this->datadir.$path;
 	}
 
-	private function searchInDir($query,$dir=''){
+	protected function searchInDir($query,$dir=''){
 		$files=array();
 		foreach (scandir($this->datadir.$dir) as $item) {
 			if ($item == '.' || $item == '..') continue;
diff --git a/lib/filesystemview.php b/lib/filesystemview.php
index da622bcf920..99e08c50e75 100644
--- a/lib/filesystemview.php
+++ b/lib/filesystemview.php
@@ -252,6 +252,9 @@ class OC_FilesystemView {
 	public function unlink($path){
 		return $this->basicOperation('unlink',$path,array('delete'));
 	}
+	public function deleteAll( $directory, $empty = false ) {
+		return $this->basicOperation( 'deleteAll', $directory, array('delete'), $empty );
+	}
 	public function rename($path1,$path2){
 		$absolutePath1=$this->getAbsolutePath($path1);
 		$absolutePath2=$this->getAbsolutePath($path2);
diff --git a/lib/helper.php b/lib/helper.php
index 480c3fe930e..37914b73e17 100644
--- a/lib/helper.php
+++ b/lib/helper.php
@@ -40,7 +40,7 @@ class OC_Helper {
 		if( $app != '' ){
 			$app .= '/';
 			// Check if the app is in the app folder
-			if( file_exists( OC::$APPSROOT . '/apps/'. $app.$file )){
+			if( file_exists( OC_App::getAppPath($app).'/'.$file )){
 				if(substr($file, -3) == 'php' || substr($file, -3) == 'css'){	
 					if(substr($app, -1, 1) == '/'){
 						$app = substr($app, 0, strlen($app) - 1);
@@ -48,7 +48,7 @@ class OC_Helper {
 					$urlLinkTo =  OC::$WEBROOT . '/?app=' . $app;
 					$urlLinkTo .= ($file!='index.php')?'&getfile=' . urlencode($file):'';
 				}else{
-					$urlLinkTo =  OC::$APPSWEBROOT . '/apps/' . $app . $file;
+					$urlLinkTo =  OC_App::getAppWebPath($app) . $file;
 				}
 			}
 			else{
@@ -150,8 +150,8 @@ class OC_Helper {
 		// Check if the app is in the app folder
 		if( file_exists( OC::$SERVERROOT."/themes/$theme/apps/$app/img/$image" )){
 			return OC::$WEBROOT."/themes/$theme/apps/$app/img/$image";
-		}elseif( file_exists( OC::$APPSROOT."/apps/$app/img/$image" )){
-			return OC::$APPSWEBROOT."/apps/$app/img/$image";
+		}elseif( file_exists(OC_App::getAppPath($app)."/img/$image" )){
+			return OC_App::getAppWebPath($app)."/img/$image";
 		}elseif( !empty( $app ) and file_exists( OC::$SERVERROOT."/themes/$theme/$app/img/$image" )){
 			return OC::$WEBROOT."/themes/$theme/$app/img/$image";
 		}elseif( !empty( $app ) and file_exists( OC::$SERVERROOT."/$app/img/$image" )){
diff --git a/lib/installer.php b/lib/installer.php
index 34c6f8c7bb9..c0903f93d51 100644
--- a/lib/installer.php
+++ b/lib/installer.php
@@ -126,8 +126,6 @@ class OC_Installer{
 			return false;
 		}
 		$info=OC_App::getAppInfo($extractDir.'/appinfo/info.xml',true);
-		$basedir=OC::$APPSROOT.'/apps/'.$info['id'];
-
                 // check the code for not allowed calls
                 if(!OC_Installer::checkCode($info['id'],$extractDir)){
 			OC_Log::write('core','App can\'t be installed because of not allowed code in the App',OC_Log::ERROR);
@@ -153,6 +151,7 @@ class OC_Installer{
 			return false;
 		}
 
+		$basedir=OC_App::getInstallPath().'/'.$info['id'];
 		//check if the destination directory already exists
 		if(is_dir($basedir)){
 			OC_Log::write('core','App directory already exists',OC_Log::WARN);
@@ -197,10 +196,10 @@ class OC_Installer{
 
 		//set remote/public handelers
 		foreach($info['remote'] as $name=>$path){
-			OCP\CONFIG::setAppValue('core', 'remote_'.$name, '/apps/'.$info['id'].'/'.$path);
+			OCP\CONFIG::setAppValue('core', 'remote_'.$name, $app.'/'.$path);
 		}
 		foreach($info['public'] as $name=>$path){
-			OCP\CONFIG::setAppValue('core', 'public_'.$name, '/apps/'.$info['id'].'/'.$path);
+			OCP\CONFIG::setAppValue('core', 'public_'.$name, $app.'/'.$path);
 		}
 
 		OC_App::setAppTypes($info['id']);
@@ -287,22 +286,24 @@ class OC_Installer{
 	 * This function installs all apps found in the 'apps' directory that should be enabled by default;
 	 */
 	public static function installShippedApps(){
-		$dir = opendir( OC::$APPSROOT."/apps" );
-		while( false !== ( $filename = readdir( $dir ))){
-			if( substr( $filename, 0, 1 ) != '.' and is_dir(OC::$APPSROOT."/apps/$filename") ){
-				if( file_exists( OC::$APPSROOT."/apps/$filename/appinfo/app.php" )){
-					if(!OC_Installer::isInstalled($filename)){
-						$info=OC_App::getAppInfo($filename);
-						$enabled = isset($info['default_enable']);
-						if( $enabled ){
-							OC_Installer::installShippedApp($filename);
-							OC_Appconfig::setValue($filename,'enabled','yes');
+		foreach(OC::$APPSROOTS as $app_dir) {
+			$dir = opendir( $app_dir['path'] );
+			while( false !== ( $filename = readdir( $dir ))){
+				if( substr( $filename, 0, 1 ) != '.' and is_dir($app_dir['path']."/$filename") ){
+					if( file_exists( $app_dir['path']."/$filename/appinfo/app.php" )){
+						if(!OC_Installer::isInstalled($filename)){
+							$info=OC_App::getAppInfo($filename);
+							$enabled = isset($info['default_enable']);
+							if( $enabled ){
+								OC_Installer::installShippedApp($filename);
+								OC_Appconfig::setValue($filename,'enabled','yes');
+							}
 						}
 					}
 				}
 			}
+			closedir( $dir );
 		}
-		closedir( $dir );
 	}
 
 	/**
@@ -312,23 +313,23 @@ class OC_Installer{
 	 */
 	public static function installShippedApp($app){
 		//install the database
-		if(is_file(OC::$APPSROOT."/apps/$app/appinfo/database.xml")){
-			OC_DB::createDbFromStructure(OC::$APPSROOT."/apps/$app/appinfo/database.xml");
+		if(is_file(OC_App::getAppPath($app)."/appinfo/database.xml")){
+			OC_DB::createDbFromStructure(OC_App::getAppPath($app)."/appinfo/database.xml");
 		}
 
 		//run appinfo/install.php
-		if(is_file(OC::$APPSROOT."/apps/$app/appinfo/install.php")){
-			include(OC::$APPSROOT."/apps/$app/appinfo/install.php");
+		if(is_file(OC_App::getAppPath($app)."/appinfo/install.php")){
+			include(OC_App::getAppPath($app)."/appinfo/install.php");
 		}
 		$info=OC_App::getAppInfo($app);
 		OC_Appconfig::setValue($app,'installed_version',OC_App::getAppVersion($app));
 		
 		//set remote/public handelers
 		foreach($info['remote'] as $name=>$path){
-			OCP\CONFIG::setAppValue('core', 'remote_'.$name, '/apps/'.$app.'/'.$path);
+			OCP\CONFIG::setAppValue('core', 'remote_'.$name, $app.'/'.$path);
 		}
 		foreach($info['public'] as $name=>$path){
-			OCP\CONFIG::setAppValue('core', 'public_'.$name, '/apps/'.$app.'/'.$path);
+			OCP\CONFIG::setAppValue('core', 'public_'.$name, $app.'/'.$path);
 		}
 		
 		OC_App::setAppTypes($info['id']);
diff --git a/lib/json.php b/lib/json.php
index dfc0a7b894e..4eab4fce9f6 100644
--- a/lib/json.php
+++ b/lib/json.php
@@ -82,6 +82,15 @@ class OC_JSON{
 	}
 
 	/**
+	 * Convert OC_L10N_String to string, for use in json encodings
+	 */
+	protected static function to_string(&$value){
+		if ($value instanceof OC_L10N_String) {
+			$value = (string)$value;
+		}
+	}
+
+	/**
 	* Encode and print $data in json format
 	*/
 	public static function encodedPrint($data,$setContentType=true){
@@ -89,6 +98,7 @@ class OC_JSON{
 			if($setContentType){
 				self::setContentTypeHeader();
 			}
+			array_walk_recursive($data, array('OC_JSON', 'to_string'));
 			echo json_encode($data);
 		}
 	}
diff --git a/lib/l10n.php b/lib/l10n.php
index 0f01e927ff9..4acbc5dcebc 100644
--- a/lib/l10n.php
+++ b/lib/l10n.php
@@ -289,8 +289,8 @@ class OC_L10N{
 		$i18ndir = OC::$SERVERROOT.'/core/l10n/';
 		if($app != ''){
 			// Check if the app is in the app folder
-			if(file_exists(OC::$APPSROOT.'/apps/'.$app.'/l10n/')){
-				$i18ndir = OC::$APPSROOT.'/apps/'.$app.'/l10n/';
+			if(file_exists(OC_App::getAppPath($app).'/l10n/')){
+				$i18ndir = OC_App::getAppPath($app).'/l10n/';
 			}
 			else{
 				$i18ndir = OC::$SERVERROOT.'/'.$app.'/l10n/';
diff --git a/lib/mimetypes.fixlist.php b/lib/mimetypes.fixlist.php
index a40fbd9e228..13e3f16b369 100644
--- a/lib/mimetypes.fixlist.php
+++ b/lib/mimetypes.fixlist.php
@@ -17,5 +17,6 @@ return array(
 	'xlsx'=>'application/msexcel',
 	'ppt'=>'application/mspowerpoint',
 	'pptx'=>'application/mspowerpoint',
-	'sgf' => 'application/sgf'
+	'sgf' => 'application/sgf',
+	'cdr' => 'application/coreldraw'
 );
diff --git a/lib/minimizer/css.php b/lib/minimizer/css.php
index da502bfa9e8..f8e84482bb1 100644
--- a/lib/minimizer/css.php
+++ b/lib/minimizer/css.php
@@ -8,14 +8,21 @@ class OC_Minimizer_CSS extends OC_Minimizer
 
 	public function minimizeFiles($files) {
 		$css_out = '';
-		$appswebroot = (string) OC::$APPSWEBROOT;
 		$webroot = (string) OC::$WEBROOT;
 		foreach($files as $file_info) {
 			$file = $file_info[0] . '/' . $file_info[2];
 			$css_out .= '/* ' . $file . ' */' . "\n";
 			$css = file_get_contents($file);
-			if (strpos($file, OC::$APPSROOT) == 0) {
-				$css = str_replace('%appswebroot%', $appswebroot, $css);
+
+			$in_root = false;
+			foreach(OC::$APPSROOTS as $app_root) {
+				if(strpos($file, $app_root['path']) === 0) {
+					$in_root = $webroot.$app_root['url'];
+					break;
+				}
+			}
+			if ($in_root !== false) {
+				$css = str_replace('%appswebroot%', $in_root, $css);
 				$css = str_replace('%webroot%', $webroot, $css);
 			}
 			$remote = $file_info[1];
diff --git a/lib/ocsclient.php b/lib/ocsclient.php
index 2888569ad13..951d761d7e6 100644
--- a/lib/ocsclient.php
+++ b/lib/ocsclient.php
@@ -57,6 +57,9 @@ class OC_OCSClient{
 	 * This function returns a list of all the application categories on the OCS server
 	 */
 	public static function getCategories(){
+		if(OC_Config::getValue('appstoreenabled', true)==false){
+			return NULL;
+		}
 		$url=OC_OCSClient::getAppStoreURL().'/content/categories';
 	
 		$xml=@file_get_contents($url);
@@ -130,6 +133,9 @@ class OC_OCSClient{
 	 * This function returns an  applications from the OCS server
 	 */
 	public static function getApplication($id){
+		if(OC_Config::getValue('appstoreenabled', true)==false){
+			return NULL;
+		}
 		$url=OC_OCSClient::getAppStoreURL().'/content/data/'.urlencode($id);
 
 		$xml=@file_get_contents($url);
@@ -157,31 +163,34 @@ class OC_OCSClient{
 		return $app;
 	}
 
-        /**
-         * @brief Get the download url for an application from the OCS server
-         * @returns array with application data
-         *
-         * This function returns an download url for an applications from the OCS server
-         */
-        public static function getApplicationDownload($id,$item){
-                $url=OC_OCSClient::getAppStoreURL().'/content/download/'.urlencode($id).'/'.urlencode($item);
-
-                $xml=@file_get_contents($url);
-                if($xml==FALSE){
-                        OC_Log::write('core','Unable to parse OCS content',OC_Log::FATAL);
-                        return NULL;
-                }
-                $data=simplexml_load_string($xml);
-
-                $tmp=$data->data->content;
-                $app=array();
-                if(isset($tmp->downloadlink)) { 
-	 		$app['downloadlink']=$tmp->downloadlink;
+	/**
+		* @brief Get the download url for an application from the OCS server
+		* @returns array with application data
+		*
+		* This function returns an download url for an applications from the OCS server
+		*/
+	public static function getApplicationDownload($id,$item){
+		if(OC_Config::getValue('appstoreenabled', true)==false){
+			return NULL;
+		}
+		$url=OC_OCSClient::getAppStoreURL().'/content/download/'.urlencode($id).'/'.urlencode($item);
+
+		$xml=@file_get_contents($url);
+		if($xml==FALSE){
+			OC_Log::write('core','Unable to parse OCS content',OC_Log::FATAL);
+			return NULL;
+		}
+		$data=simplexml_load_string($xml);
+
+		$tmp=$data->data->content;
+		$app=array();
+		if(isset($tmp->downloadlink)) { 
+			$app['downloadlink']=$tmp->downloadlink;
 		}else{
 	 		$app['downloadlink']='';
 		}
-                return $app;
-        }
+		return $app;
+	}
 
 
 	/**
diff --git a/lib/template.php b/lib/template.php
index 8fb0133b289..3b48c27b9b4 100644
--- a/lib/template.php
+++ b/lib/template.php
@@ -242,10 +242,10 @@ class OC_Template{
 		// Check if it is a app template or not.
 		if( $app != "" ){
 			// Check if the app is in the app folder or in the root
-			if( file_exists( OC::$APPSROOT."/apps/$app/templates/" )){
+			if( file_exists(OC_App::getAppPath($app)."/templates/" )){
 				// Check if the template is overwritten by the selected theme
 				if ($this->checkPathForTemplate(OC::$SERVERROOT."/themes/$theme/apps/$app/templates/", $name, $fext)) {
-				}elseif ($this->checkPathForTemplate(OC::$APPSROOT."/apps/$app/templates/", $name, $fext)) {
+				}elseif ($this->checkPathForTemplate(OC_App::getAppPath($app)."/templates/", $name, $fext)) {
 				}
 			}else{
 				// Check if the template is overwritten by the selected theme
diff --git a/lib/templatelayout.php b/lib/templatelayout.php
index 1f82e82be74..d33a87e9e4c 100644
--- a/lib/templatelayout.php
+++ b/lib/templatelayout.php
@@ -9,6 +9,7 @@
 class OC_TemplateLayout extends OC_Template {
 	public function __construct( $renderas ){
 		// Decide which page we show
+
 		if( $renderas == 'user' ){
 			parent::__construct( 'core', 'layout.user' );
 			$this->assign('searchurl',OC_Helper::linkTo( 'search', 'index.php' ), false);
@@ -32,6 +33,12 @@ class OC_TemplateLayout extends OC_Template {
 			parent::__construct( 'core', 'layout.guest' );
 		}
 
+		$apps_paths = array();
+		foreach(OC_App::getEnabledApps() as $app){
+			$apps_paths[$app] = OC_App::getAppWebPath($app);
+    }
+		$this->assign( 'apps_paths', str_replace('\\/', '/',json_encode($apps_paths)),false ); // Ugly unescape slashes waiting for better solution
+
 		// Add the js files
 		$jsfiles = self::findJavascriptFiles(OC_Util::$scripts);
 		$this->assign('jsfiles', array(), false);
@@ -44,19 +51,29 @@ class OC_TemplateLayout extends OC_Template {
 
 		// Add the css files
 		$cssfiles = self::findStylesheetFiles(OC_Util::$styles);
+
 		$this->assign('cssfiles', array());
 		foreach($cssfiles as $info) {
 			$root = $info[0];
 			$web = $info[1];
 			$file = $info[2];
 			$paths = explode('/', $file);
-			if($root == OC::$APPSROOT && $paths[0] == 'apps'){
-				$app = $paths[1];
+
+			$in_root = false;
+			foreach(OC::$APPSROOTS as $app_root) {
+				if($root == $app_root['path']) {
+					$in_root = true;
+          break;
+				}
+			}
+
+			if($in_root ) {
+				$app = $paths[0];
 				unset($paths[0]);
-				unset($paths[1]);
 				$path = implode('/', $paths);
 				$this->append( 'cssfiles', OC_Helper::linkTo($app, $path));
-			}else{
+			}
+			else {
 				$this->append( 'cssfiles', $web.'/'.$file);
 			}
 		}
@@ -89,10 +106,6 @@ class OC_TemplateLayout extends OC_Template {
 			// is it in 3rdparty?
 			if(self::appendIfExist($files, OC::$THIRDPARTYROOT, OC::$THIRDPARTYWEBROOT, $style.'.css')) {
 
-			// or in apps?
-			}elseif(self::appendIfExist($files, OC::$APPSROOT, OC::$APPSWEBROOT, "apps/$style$fext.css" )) {
-			}elseif(self::appendIfExist($files, OC::$APPSROOT, OC::$APPSWEBROOT, "apps/$style.css" )) {
-
 			// or in the owncloud root?
 			}elseif(self::appendIfExist($files, OC::$SERVERROOT, OC::$WEBROOT, "$style$fext.css" )) {
 			}elseif(self::appendIfExist($files, OC::$SERVERROOT, OC::$WEBROOT, "$style.css" )) {
@@ -102,8 +115,17 @@ class OC_TemplateLayout extends OC_Template {
 			}elseif(self::appendIfExist($files, OC::$SERVERROOT, OC::$WEBROOT, "core/$style.css" )) {
 
 			}else{
-				echo('css file not found: style:'.$style.' formfactor:'.$fext.' webroot:'.OC::$WEBROOT.' serverroot:'.OC::$SERVERROOT);
-				die();
+				$append = false;
+				// or in apps?
+				foreach( OC::$APPSROOTS as $apps_dir)
+				{
+					if(self::appendIfExist($files, $apps_dir['path'], $apps_dir['url'], "$style$fext.css")) { $append =true; break; }
+					elseif(self::appendIfExist($files, $apps_dir['path'], $apps_dir['url'], "$style.css")) { $append =true; break; }
+				}
+				if(! $append) {
+					echo('css file not found: style:'.$script.' formfactor:'.$fext.' webroot:'.OC::$WEBROOT.' serverroot:'.OC::$SERVERROOT);
+					die();
+				}
 			}
 		}
 		// Add the theme css files. you can override the default values here
@@ -139,10 +161,6 @@ class OC_TemplateLayout extends OC_Template {
 			}elseif(self::appendIfExist($files, OC::$SERVERROOT, OC::$WEBROOT, "themes/$theme/apps/$script$fext.js" )) {
 			}elseif(self::appendIfExist($files, OC::$SERVERROOT, OC::$WEBROOT, "themes/$theme/apps/$script.js" )) {
 
-			// Is it part of an app?
-			}elseif(self::appendIfExist($files, OC::$APPSROOT, OC::$APPSWEBROOT, "apps/$script$fext.js" )) {
-			}elseif(self::appendIfExist($files, OC::$APPSROOT, OC::$APPSWEBROOT, "apps/$script.js" )) {
-
 			// Is it in the owncloud root but overwritten by the theme?
 			}elseif(self::appendIfExist($files, OC::$SERVERROOT, OC::$WEBROOT, "themes/$theme/$script$fext.js" )) {
 			}elseif(self::appendIfExist($files, OC::$SERVERROOT, OC::$WEBROOT, "themes/$theme/$script.js" )) {
@@ -160,9 +178,16 @@ class OC_TemplateLayout extends OC_Template {
 			}elseif(self::appendIfExist($files, OC::$SERVERROOT, OC::$WEBROOT, "core/$script.js" )) {
 
 			}else{
-				echo('js file not found: script:'.$script.' formfactor:'.$fext.' webroot:'.OC::$WEBROOT.' serverroot:'.OC::$SERVERROOT);
-				die();
-
+				// Is it part of an app?
+				$append = false;
+				foreach( OC::$APPSROOTS as $apps_dir) {
+					if(self::appendIfExist($files, $apps_dir['path'], OC::$WEBROOT.$apps_dir['url'], "$script$fext.js")) { $append =true; break; }
+					elseif(self::appendIfExist($files, $apps_dir['path'], OC::$WEBROOT.$apps_dir['url'], "$script.js")) { $append =true; break; }
+				}
+				if(! $append) {
+					echo('js file not found: script:'.$script.' formfactor:'.$fext.' webroot:'.OC::$WEBROOT.' serverroot:'.OC::$SERVERROOT);
+					die();
+				}
 			}
 		}
 		return $files;
diff --git a/lib/util.php b/lib/util.php
index 7792f96d445..0d9f4129442 100755
--- a/lib/util.php
+++ b/lib/util.php
@@ -200,9 +200,12 @@ class OC_Util {
 			$errors[]=array('error'=>"Can't write into config directory 'config'",'hint'=>"You can usually fix this by giving the webserver user write access to the config directory in owncloud");
 		}
 
-		// Check if apps folder is writable.
-		if(OC_Config::getValue('writable_appsdir', true) && !is_writable(OC::$SERVERROOT."/apps/")) {
-			$errors[]=array('error'=>"Can't write into apps directory 'apps'",'hint'=>"You can usually fix this by giving the webserver user write access to the config directory in owncloud");
+		// Check if there is a writable install folder.
+		if(OC_Config::getValue('appstoreenabled', true)) {
+			if( OC_App::getInstallPath() === null  || !is_writable(OC_App::getInstallPath())) {
+				$errors[]=array('error'=>"Can't write into apps directory",'hint'=>"You can usually fix this by giving the webserver user write access to the apps directory 
+				in owncloud or disabling the appstore in the config file.");
+			}
 		}
 
 		$CONFIG_DATADIRECTORY = OC_Config::getValue( "datadirectory", OC::$SERVERROOT."/data" );
@@ -420,18 +423,58 @@ class OC_Util {
 		}
 	}
 	
-	/**
-	 * @brief Public function to sanitize HTML
-	 *
-	 * This function is used to sanitize HTML and should be applied on any string or array of strings before displaying it on a web page.
+	/**
+	 * @brief Public function to sanitize HTML
+	 *
+	 * This function is used to sanitize HTML and should be applied on any
+	 * string or array of strings before displaying it on a web page.
 	 * 
 	 * @param string or array of strings
-	 * @return array with sanitized strings or a single sinitized string, depends on the input parameter.
+	 * @return array with sanitized strings or a single sanitized string, depends on the input parameter.
 	 */
-	public static function sanitizeHTML( &$value ){
-		if (is_array($value) || is_object($value)) array_walk_recursive($value,'OC_Util::sanitizeHTML');
-		else $value = htmlentities($value, ENT_QUOTES, 'UTF-8'); //Specify encoding for PHP<5.4
+	public static function sanitizeHTML( &$value ){
+		if (is_array($value) || is_object($value)) array_walk_recursive($value,'OC_Util::sanitizeHTML');
+		else $value = htmlentities($value, ENT_QUOTES, 'UTF-8'); //Specify encoding for PHP<5.4
 		return $value;
 	}
 
+
+        /**
+         * Check if the htaccess file is working by creating a test file in the data directory and trying to access via http
+         */
+        public static function ishtaccessworking() {
+
+		// testdata
+		$filename='/htaccesstest.txt';
+		$testcontent='testcontent';
+
+		// creating a test file
+                $testfile = OC_Config::getValue( "datadirectory", OC::$SERVERROOT."/data" ).'/'.$filename;
+                $fp = @fopen($testfile, 'w');
+                @fwrite($fp, $testcontent);
+                @fclose($fp);
+
+		// accessing the file via http
+                $url = OC_Helper::serverProtocol(). '://'  . OC_Helper::serverHost() . OC::$WEBROOT.'/data'.$filename;
+                $fp = @fopen($url, 'r');
+                $content=@fread($fp, 2048);
+                @fclose($fp);
+
+		// cleanup
+		@unlink($testfile);
+
+		// does it work ?
+		if($content==$testcontent) {
+			return(false);
+		}else{
+			return(true);
+
+		}
+
+        }
+
+
+
+
+
 }
diff --git a/public.php b/public.php
index f974e1c50d2..19c02a7a027 100644
--- a/public.php
+++ b/public.php
@@ -8,8 +8,8 @@ if(is_null($file)){
 	exit;
 }
 
-$parts=explode('/',$file);
-$app=$parts[2];
+$parts=explode('/',$file,2);
+$app=$parts[0];
 OC_App::loadApp($app);
 
-require_once(OC::$APPSROOT . $file);
+require_once(OC_App::getAppPath($app) .'/'. $parts[1]);
diff --git a/remote.php b/remote.php
index 0c5804221bb..ef610f36947 100644
--- a/remote.php
+++ b/remote.php
@@ -20,10 +20,16 @@ if(is_null($file)){
 	OC_Response::setStatus(OC_Response::STATUS_NOT_FOUND);
 	exit;
 }
-
-$parts=explode('/',$file);
-$app=$parts[2];
-OC_App::loadApp($app);
-
-$baseuri = OC::$WEBROOT . '/remote.php/'.$service.'/';
-require_once(OC::$APPSROOT . $file);
+if(count(explode('/',$file)) == 3) {
+	$parts=explode('/',$file);
+	$app=$parts[2];
+	OC_App::loadApp($app);
+	$baseuri = OC::$WEBROOT . '/remote.php/'.$service.'/';
+	require_once( OC::$SERVERROOT.$file);
+} else {
+	$parts=explode('/', $file, 4);
+	$app=$parts[2];
+	OC_App::loadApp($app);
+	$baseuri = OC::$WEBROOT . '/remote.php/'.$service.'/';
+	require_once(OC_App::getAppPath($app) .'/'. $parts[3]);
+}
diff --git a/search/js/result.js b/search/js/result.js
index 1087f9684b2..27a2383e2c3 100644
--- a/search/js/result.js
+++ b/search/js/result.js
@@ -41,23 +41,13 @@ OC.search.showResults=function(results){
 		for(var name in types){
 			var type=types[name];
 			if(type.length>0){
-				var row=$('#searchresults tr.template').clone();
-				row.removeClass('template');
-				row.addClass('result');
-				row.children('td.type').text(name);
-				row.find('td.result a').attr('href',type[0].link);
-				row.find('td.result div.name').text(type[0].name);
-				row.find('td.result div.text').text(type[0].text);
-				row.data('index',index);
-				index++;
-				if(OC.search.customResults[name]){//give plugins the ability to customize the entries in here
-					OC.search.customResults[name](row,type[0]);
-				}
-				$('#searchresults tbody').append(row);
-				for(var i=1;i<type.length;i++){
+				for(var i=0;i<type.length;i++){
 					var row=$('#searchresults tr.template').clone();
 					row.removeClass('template');
 					row.addClass('result');
+					if (index == 0){
+						row.children('td.type').text(name);
+					}
 					row.find('td.result a').attr('href',type[i].link);
 					row.find('td.result div.name').text(type[i].name);
 					row.find('td.result div.text').text(type[i].text);
diff --git a/settings/admin.php b/settings/admin.php
index a997bad4e3c..8369ee64e06 100644..100755
--- a/settings/admin.php
+++ b/settings/admin.php
@@ -15,6 +15,7 @@ OC_App::setActiveNavigationEntry( "admin" );
 
 $tmpl = new OC_Template( 'settings', 'admin', 'user');
 $forms=OC_App::getForms('admin');
+$htaccessworking=OC_Util::ishtaccessworking();
 
 $entries=OC_Log_Owncloud::getEntries(3);
 function compareEntries($a,$b){
@@ -24,6 +25,7 @@ usort($entries, 'compareEntries');
 
 $tmpl->assign('loglevel',OC_Config::getValue( "loglevel", 2 ));
 $tmpl->assign('entries',$entries);
+$tmpl->assign('htaccessworking',$htaccessworking);
 $tmpl->assign('forms',array());
 foreach($forms as $form){
 	$tmpl->append('forms',$form);
diff --git a/settings/ajax/togglegroups.php b/settings/ajax/togglegroups.php
index f76e22f51d2..7773c1049c3 100644
--- a/settings/ajax/togglegroups.php
+++ b/settings/ajax/togglegroups.php
@@ -10,7 +10,7 @@ $error = "add user to";
 $action = "add";
 
 $username = $_POST["username"];
-$group = htmlentities($_POST["group"]);
+$group = OC_Util::sanitizeHTML($_POST["group"]);
 
 if(!OC_Group::groupExists($group)){
 	OC_Group::createGroup($group);
diff --git a/settings/css/settings.css b/settings/css/settings.css
index df1e3cfd3c2..80e96df5e66 100644
--- a/settings/css/settings.css
+++ b/settings/css/settings.css
@@ -48,5 +48,8 @@ li.active { color:#000; }
 small.externalapp { color:#FFF; background-color:#BBB; font-weight:bold; font-size:6pt; padding:4px; border-radius: 4px;}
 span.version { margin-left:3em; color:#ddd; }
 
-/* LOF */
+/* LOG */
 #log { white-space:normal; }
+
+/* ADMIN */
+span.securitywarning {color:#C33; font-weight:bold; }
diff --git a/settings/js/log.js b/settings/js/log.js
index 6063c7d9a9f..fe2e92f7a86 100644
--- a/settings/js/log.js
+++ b/settings/js/log.js
@@ -39,7 +39,7 @@ OC.Log={
 			row.append(appTd);
 			
 			var messageTd=$('<td/>');
-			messageTd.text(entry.message);
+			messageTd.html(entry.message);
 			row.append(messageTd);
 			
 			var timeTd=$('<td/>');
diff --git a/settings/templates/admin.php b/settings/templates/admin.php
index 38c6042c82a..a9f727d6764 100644..100755
--- a/settings/templates/admin.php
+++ b/settings/templates/admin.php
@@ -6,6 +6,21 @@
 $levels=array('Debug','Info','Warning','Error','Fatal');
 ?>
 
+<?php
+
+if(!$_['htaccessworking']) {
+?>
+<fieldset class="personalblock">
+	<legend><strong><?php echo $l->t('Security Warning');?></strong></legend>
+
+	<span class="securitywarning">Your data directory and your files are probably accessible from the internet. The .htaccess file that ownCloud provides is not working. We strongly suggest that you configure your webserver in a way that the data directory is no longer accessible or you move the data directory outside the webserver document root.</span>
+	
+</fieldset>	
+<?php	
+}
+?>
+
+
 <?php foreach($_['forms'] as $form){
 	echo $form;
 };?>
author	Georg Ehrke <dev@georgswebsite.de>	2012-06-22 21:37:03 +0200
committer	Georg Ehrke <dev@georgswebsite.de>	2012-06-22 21:37:03 +0200
commit	243f910ae4c1125566703ee53d5b4e31f13ea95b (patch)
tree	5eec0c402a069bbca9433190e2dcd7e6d9d5928d
parent	4d312f78497d0134ad2315863db69747be5dd108 (diff)
parent	f4b937c6fe325b1ad8bceb7ceba69a9a8a068bcd (diff)
download	nextcloud-server-243f910ae4c1125566703ee53d5b4e31f13ea95b.tar.gz nextcloud-server-243f910ae4c1125566703ee53d5b4e31f13ea95b.zip