15 files changed, 814 insertions, 3 deletions

diff --git a/apps/contacts/ajax/addcard.php b/apps/contacts/ajax/addcard.php
index 140d6a48095..f15a1685840 100644
--- a/apps/contacts/ajax/addcard.php
+++ b/apps/contacts/ajax/addcard.php
@@ -77,7 +77,7 @@ foreach( $add as $propname){
 		ksort($value); // NOTE: Important, otherwise the compound value will be set in the order the fields appear in the form!
 		$value = OC_VObject::escapeSemicolons($value);
 	}
-	$vcard->addProperty($propname, $value); //, $prop_parameters);
+	$vcard->addProperty($propname, strip_tags($value)); //, $prop_parameters);
 	$line = count($vcard->children) - 1;
 	foreach ($prop_parameters as $key=>$element) {
 		if(is_array($element) && strtoupper($key) == 'TYPE') { 
diff --git a/apps/contacts/ajax/addcontact.php b/apps/contacts/ajax/addcontact.php
new file mode 100644
index 00000000000..c39d75eff88
--- /dev/null
+++ b/apps/contacts/ajax/addcontact.php
@@ -0,0 +1,62 @@
+<?php
+/**
+ * ownCloud - Addressbook
+ *
+ * @author Thomas Tanghus
+ * @copyright 2012 Thomas Tanghus <thomas@tanghus.net>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU AFFERO GENERAL PUBLIC LICENSE for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public
+ * License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+// Init owncloud
+require_once('../../../lib/base.php');
+function bailOut($msg) {
+	OC_JSON::error(array('data' => array('message' => $msg)));
+	OC_Log::write('contacts','ajax/addcontact.php: '.$msg, OC_Log::DEBUG);
+	exit();
+}
+function debug($msg) {
+	OC_Log::write('contacts','ajax/addcontact.php: '.$msg, OC_Log::DEBUG);
+}
+foreach ($_POST as $key=>$element) {
+	debug('_POST: '.$key.'=>'.$element);
+}
+
+// Check if we are a user
+OC_JSON::checkLoggedIn();
+OC_JSON::checkAppEnabled('contacts');
+$l=new OC_L10N('contacts');
+
+$aid = $_POST['aid'];
+$addressbook = OC_Contacts_App::getAddressbook( $aid );
+
+$fn = trim($_POST['fn']);
+$n = trim($_POST['n']);
+debug('N: '.$n);
+debug('FN: '.$fn);
+
+$vcard = new OC_VObject('VCARD');
+$vcard->setUID();
+$vcard->setString('FN',$fn);
+$vcard->setString('N',$n);
+
+$id = OC_Contacts_VCard::add($aid,$vcard->serialize());
+if(!$id) {
+	OC_JSON::error(array('data' => array('message' => $l->t('There was an error adding the contact.'))));
+	OC_Log::write('contacts','ajax/addcontact.php: Recieved non-positive ID on adding card: '.$id, OC_Log::ERROR);
+	exit();
+}
+
+OC_JSON::success(array('data' => array( 'id' => $id )));
diff --git a/apps/contacts/ajax/addproperty.php b/apps/contacts/ajax/addproperty.php
index c90af217c87..23f0a9379b2 100644
--- a/apps/contacts/ajax/addproperty.php
+++ b/apps/contacts/ajax/addproperty.php
@@ -67,8 +67,32 @@ foreach($current as $item) {
 
 if(is_array($value)) {
 	ksort($value);  // NOTE: Important, otherwise the compound value will be set in the order the fields appear in the form!
+} else {
+	$value = strip_tags($value);
 }
 
+switch($name) {
+	case 'BDAY':
+		$date = New DateTime($value);
+		$value = $date->format(DateTime::ATOM);
+	case 'FN':
+		if(!$value) {
+			// create a method thats returns an alternative for FN.
+			//$value = getOtherValue();
+		}
+	case 'N':
+	case 'ORG':
+	case 'NICKNAME':
+		break;
+	case 'EMAIL':
+		$value = strtolower($value);
+		break;
+	case 'TEL':
+	case 'ADR': // should I delete the property if empty or throw an error?
+		break;
+}
+
+
 $property = $vcard->addProperty($name, $value); //, $parameters);
 
 $line = count($vcard->children) - 1;
diff --git a/apps/contacts/ajax/contactdetails.php b/apps/contacts/ajax/contactdetails.php
new file mode 100644
index 00000000000..f7ac25ea515
--- /dev/null
+++ b/apps/contacts/ajax/contactdetails.php
@@ -0,0 +1,76 @@
+<?php
+/**
+ * ownCloud - Addressbook
+ *
+ * @author Thomas Tanghus
+ * @copyright 2012 Thomas Tanghus <thomas@tanghus.net>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU AFFERO GENERAL PUBLIC LICENSE for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public
+ * License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+// Init owncloud
+require_once('../../../lib/base.php');
+function bailOut($msg) {
+	OC_JSON::error(array('data' => array('message' => $msg)));
+	OC_Log::write('contacts','ajax/contactdetails.php: '.$msg, OC_Log::DEBUG);
+	exit();
+}
+function debug($msg) {
+	OC_Log::write('contacts','ajax/contactdetails.php: '.$msg, OC_Log::DEBUG);
+}
+
+// Check if we are a user
+OC_JSON::checkLoggedIn();
+OC_JSON::checkAppEnabled('contacts');
+$l=new OC_L10N('contacts');
+
+$id = isset($_GET['id'])?$_GET['id']:null;
+if(is_null($id)) {
+	bailOut($l->t('Missing ID'));
+}
+$vcard = OC_Contacts_App::getContactVCard( $id );
+if(is_null($vcard)) {
+	bailOut($l->t('Error parsing VCard for ID: "'.$id.'"'));
+}
+$details = OC_Contacts_VCard::structureContact($vcard);
+
+// Some Google exported files have no FN field.
+if(!isset($details['FN'])) {
+	$fn = '';
+	if(isset($details['N'])) {
+		$details['FN'] = array(implode(' ', $details['N'][0]['value']));
+	} elseif(isset($details['EMAIL'])) {
+		$details['FN'] = array('value' => $details['EMAIL'][0]['value']);
+	} else {
+		$details['FN'] = array('value' => $l->t('Unknown'));
+	}
+}
+
+// Make up for not supporting the 'N' field in earlier version.
+if(!isset($details['N'])) {
+	$details['N'] = array();
+	$details['N'][0] = array($details['FN'][0]['value'],'','','','');
+}
+
+// Don't wanna transfer the photo in a json string.
+if(isset($details['PHOTO'])) {
+	$details['PHOTO'] = true;
+	//unset($details['PHOTO']);
+} else {
+	$details['PHOTO'] = false;
+}
+$details['id'] = $id;
+
+OC_JSON::success(array('data' => $details));
\ No newline at end of file
diff --git a/apps/contacts/ajax/createaddressbook.php b/apps/contacts/ajax/createaddressbook.php
index edcf794f497..3d766b6a60a 100644
--- a/apps/contacts/ajax/createaddressbook.php
+++ b/apps/contacts/ajax/createaddressbook.php
@@ -15,7 +15,7 @@ OC_JSON::checkLoggedIn();
 OC_JSON::checkAppEnabled('contacts');
 
 $userid = OC_User::getUser();
-$bookid = OC_Contacts_Addressbook::add($userid, $_POST['name'], null);
+$bookid = OC_Contacts_Addressbook::add($userid, strip_tags($_POST['name']), null);
 if(!$bookid) {
 	OC_JSON::error(array('data' => array('message' => $l->t('Error adding addressbook.'))));
 	OC_Log::write('contacts','ajax/createaddressbook.php: Error adding addressbook: '.$_POST['name'], OC_Log::ERROR);
diff --git a/apps/contacts/ajax/cropphoto.php b/apps/contacts/ajax/cropphoto.php
new file mode 100644
index 00000000000..878fb5610c6
--- /dev/null
+++ b/apps/contacts/ajax/cropphoto.php
@@ -0,0 +1,38 @@
+<?php
+/**
+ * ownCloud - Addressbook
+ *
+ * @author Thomas Tanghus
+ * @copyright 2012 Thomas Tanghus <thomas@tanghus.net>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU AFFERO GENERAL PUBLIC LICENSE for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public
+ * License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+// Init owncloud
+require_once('../../../lib/base.php');
+
+// Check if we are a user
+OC_JSON::checkLoggedIn();
+OC_JSON::checkAppEnabled('contacts');
+
+$tmp_path = $_GET['tmp_path'];
+$id = $_GET['id'];
+OC_Log::write('contacts','ajax/cropphoto.php: tmp_path: '.$tmp_path.', exists: '.file_exists($tmp_path), OC_Log::DEBUG);
+$tmpl = new OC_TEMPLATE("contacts", "part.cropphoto");
+$tmpl->assign('tmp_path', $tmp_path);
+$tmpl->assign('id', $id);
+$page = $tmpl->fetchPage();
+
+OC_JSON::success(array('data' => array( 'page' => $page )));
diff --git a/apps/contacts/ajax/editaddress.php b/apps/contacts/ajax/editaddress.php
new file mode 100644
index 00000000000..4e6456f6045
--- /dev/null
+++ b/apps/contacts/ajax/editaddress.php
@@ -0,0 +1,31 @@
+<?php
+/**
+ * Copyright (c) 2011 Thomas Tanghus <thomas@tanghus.net>
+ * This file is licensed under the Affero General Public License version 3 or
+ * later.
+ * See the COPYING-README file.
+ */
+
+require_once('../../../lib/base.php');
+OC_JSON::checkLoggedIn();
+OC_JSON::checkAppEnabled('contacts');
+
+$id = $_GET['id'];
+$checksum = isset($_GET['checksum'])?$_GET['checksum']:'';
+$vcard = OC_Contacts_App::getContactVCard($id);
+$adr_types = OC_Contacts_App::getTypesOfProperty('ADR');
+
+$tmpl = new OC_TEMPLATE("contacts", "part.edit_address_dialog");
+if($checksum) {
+	$line = OC_Contacts_App::getPropertyLineByChecksum($vcard, $checksum);
+	$element = $vcard->children[$line];
+	$adr = OC_Contacts_VCard::structureProperty($element);
+	$tmpl->assign('adr',$adr);
+}
+
+$tmpl->assign('id',$id);
+$tmpl->assign('adr_types',$adr_types);
+
+$tmpl->printpage();
+
+?>
diff --git a/apps/contacts/ajax/editname.php b/apps/contacts/ajax/editname.php
new file mode 100644
index 00000000000..31bdd125675
--- /dev/null
+++ b/apps/contacts/ajax/editname.php
@@ -0,0 +1,41 @@
+<?php
+/**
+ * Copyright (c) 2011 Thomas Tanghus <thomas@tanghus.net>
+ * This file is licensed under the Affero General Public License version 3 or
+ * later.
+ * See the COPYING-README file.
+ */
+
+require_once('../../../lib/base.php');
+OC_JSON::checkLoggedIn();
+OC_JSON::checkAppEnabled('contacts');
+function bailOut($msg) {
+	OC_JSON::error(array('data' => array('message' => $msg)));
+	OC_Log::write('contacts','ajax/editname.php: '.$msg, OC_Log::DEBUG);
+	exit();
+}
+function debug($msg) {
+	OC_Log::write('contacts','ajax/editname.php: '.$msg, OC_Log::DEBUG);
+}
+
+$tmpl = new OC_TEMPLATE("contacts", "part.edit_name_dialog");
+
+$id = isset($_GET['id'])?$_GET['id']:'';
+if($id) {
+	$vcard = OC_Contacts_App::getContactVCard($id);
+	$name = array('', '', '', '', '');
+	if($vcard->__isset('N')) {
+		$property = $vcard->__get('N');
+		if($property) {
+			$name = OC_Contacts_VCard::structureProperty($property);
+		}
+	}
+	$tmpl->assign('name',$name);
+	$tmpl->assign('id',$id);
+} else {
+	$addressbooks = OC_Contacts_Addressbook::active(OC_User::getUser());
+	$tmpl->assign('addressbooks', $addressbooks);
+}
+$tmpl->printpage();
+
+?>
diff --git a/apps/contacts/ajax/importdialog.php b/apps/contacts/ajax/importdialog.php
new file mode 100644
index 00000000000..17b4cebdbd1
--- /dev/null
+++ b/apps/contacts/ajax/importdialog.php
@@ -0,0 +1,17 @@
+<?php
+/**
+ * Copyright (c) 2012 Georg Ehrke <ownclouddev at georgswebsite dot de>
+ * This file is licensed under the Affero General Public License version 3 or
+ * later.
+ * See the COPYING-README file.
+ */
+
+require_once('../../../lib/base.php');
+OC_JSON::checkLoggedIn();
+OC_Util::checkAppEnabled('contacts');
+$l10n = new OC_L10N('contacts');
+$tmpl = new OC_Template('contacts', 'part.import');
+$tmpl->assign('path', $_POST['path']);
+$tmpl->assign('filename', $_POST['filename']);
+$tmpl->printpage();
+?>
diff --git a/apps/contacts/ajax/loadphoto.php b/apps/contacts/ajax/loadphoto.php
new file mode 100644
index 00000000000..d9f7e737b55
--- /dev/null
+++ b/apps/contacts/ajax/loadphoto.php
@@ -0,0 +1,53 @@
+<?php
+/**
+ * ownCloud - Addressbook
+ *
+ * @author Thomas Tanghus
+ * @copyright 2012 Thomas Tanghus <thomas@tanghus.net>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU AFFERO GENERAL PUBLIC LICENSE for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public
+ * License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * TODO: Translatable strings.
+ *       Remember to delete tmp file at some point.
+ */
+// Init owncloud
+require_once('../../../lib/base.php');
+// Check if we are a user
+OC_JSON::checkLoggedIn();
+OC_JSON::checkAppEnabled('contacts');
+$l=new OC_L10N('contacts');
+
+// foreach ($_POST as $key=>$element) {
+// 	OC_Log::write('contacts','ajax/savecrop.php: '.$key.'=>'.$element, OC_Log::DEBUG);
+// }
+
+function bailOut($msg) {
+	OC_JSON::error(array('data' => array('message' => $msg)));
+	OC_Log::write('contacts','ajax/savecrop.php: '.$msg, OC_Log::DEBUG);
+	exit();
+}
+
+$image = null;
+
+$id = isset($_GET['id']) ? $_GET['id'] : '';
+
+if($id == '') {
+	bailOut('Missing contact id.');
+}
+
+$tmpl = new OC_TEMPLATE("contacts", "part.contactphoto");
+$tmpl->assign('id', $id);
+$page = $tmpl->fetchPage();
+OC_JSON::success(array('data' => array('page'=>$page)));
+?>
diff --git a/apps/contacts/ajax/newcontact.php b/apps/contacts/ajax/newcontact.php
new file mode 100644
index 00000000000..fcfd12ca80d
--- /dev/null
+++ b/apps/contacts/ajax/newcontact.php
@@ -0,0 +1,62 @@
+<?php
+/**
+ * ownCloud - Addressbook
+ *
+ * @author Thomas Tanghus
+ * @copyright 2012 Thomas Tanghus <thomas@tanghus.net>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU AFFERO GENERAL PUBLIC LICENSE for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public
+ * License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+// Init owncloud
+require_once('../../../lib/base.php');
+function bailOut($msg) {
+	OC_JSON::error(array('data' => array('message' => $msg)));
+	OC_Log::write('contacts','ajax/newcontact.php: '.$msg, OC_Log::DEBUG);
+	exit();
+}
+function debug($msg) {
+	OC_Log::write('contacts','ajax/newcontact.php: '.$msg, OC_Log::DEBUG);
+}
+foreach ($_POST as $key=>$element) {
+	debug('_POST: '.$key.'=>'.$element);
+}
+
+// Check if we are a user
+OC_JSON::checkLoggedIn();
+OC_JSON::checkAppEnabled('contacts');
+
+$addressbooks = OC_Contacts_Addressbook::all(OC_USER::getUser());
+
+$upload_max_filesize = OC_Helper::computerFileSize(ini_get('upload_max_filesize'));
+$post_max_size = OC_Helper::computerFileSize(ini_get('post_max_size'));
+$maxUploadFilesize = min($upload_max_filesize, $post_max_size);
+
+$freeSpace=OC_Filesystem::free_space('/');
+$freeSpace=max($freeSpace,0);
+$maxUploadFilesize = min($maxUploadFilesize ,$freeSpace);
+$adr_types = OC_Contacts_App::getTypesOfProperty('ADR');
+$phone_types = OC_Contacts_App::getTypesOfProperty('TEL');
+
+$tmpl = new OC_Template('contacts','part.contact');
+$tmpl->assign('uploadMaxFilesize', $maxUploadFilesize);
+$tmpl->assign('uploadMaxHumanFilesize', OC_Helper::humanFileSize($maxUploadFilesize));
+$tmpl->assign('adr_types',$adr_types);
+$tmpl->assign('phone_types',$phone_types);
+$tmpl->assign('addressbooks',$addressbooks);
+$tmpl->assign('id','');
+$page = $tmpl->fetchPage();
+
+OC_JSON::success(array('data' => array( 'page' => $page )));
diff --git a/apps/contacts/ajax/savecrop.php b/apps/contacts/ajax/savecrop.php
new file mode 100644
index 00000000000..7b7384723cd
--- /dev/null
+++ b/apps/contacts/ajax/savecrop.php
@@ -0,0 +1,136 @@
+<?php
+/**
+ * ownCloud - Addressbook
+ *
+ * @author Thomas Tanghus
+ * @copyright 2012 Thomas Tanghus <thomas@tanghus.net>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU AFFERO GENERAL PUBLIC LICENSE for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public
+ * License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * TODO: Translatable strings.
+ *       Remember to delete tmp file at some point.
+ */
+// Init owncloud
+require_once('../../../lib/base.php');
+OC_Log::write('contacts','ajax/savecrop.php: Huzzah!!!', OC_Log::DEBUG);
+
+// Check if we are a user
+OC_JSON::checkLoggedIn();
+OC_JSON::checkAppEnabled('contacts');
+$l=new OC_L10N('contacts');
+
+// foreach ($_POST as $key=>$element) {
+// 	OC_Log::write('contacts','ajax/savecrop.php: '.$key.'=>'.$element, OC_Log::DEBUG);
+// }
+
+// Firefox and Konqueror tries to download application/json for me.  --Arthur
+OC_JSON::setContentTypeHeader('text/plain');
+
+function bailOut($msg) {
+	OC_JSON::error(array('data' => array('message' => $msg)));
+	OC_Log::write('contacts','ajax/savecrop.php: '.$msg, OC_Log::DEBUG);
+	exit();
+}
+
+$image = null;
+
+$x1 = (isset($_POST['x1']) && $_POST['x1']) ? $_POST['x1'] : -1;
+//$x2 = isset($_POST['x2']) ? $_POST['x2'] : -1;
+$y1 = (isset($_POST['y1']) && $_POST['y1']) ? $_POST['y1'] : -1;
+//$y2 = isset($_POST['y2']) ? $_POST['y2'] : -1;
+$w = (isset($_POST['w']) && $_POST['w']) ? $_POST['w'] : -1;
+$h = (isset($_POST['h']) && $_POST['h']) ? $_POST['h'] : -1;
+$tmp_path = isset($_POST['tmp_path']) ? $_POST['tmp_path'] : '';
+$id = isset($_POST['id']) ? $_POST['id'] : '';
+
+if(in_array(-1, array($x1, $y1, $w, $h))) {
+	bailOut('Wrong crop dimensions: '.implode(', ', array($x1, $y1, $w, $h)));
+}
+
+if($tmp_path == '') {
+	bailOut('Missing path to temporary file.');
+}
+
+if($id == '') {
+	bailOut('Missing contact id.');
+}
+
+OC_Log::write('contacts','savecrop.php: files: '.$tmp_path.'  exists: '.file_exists($tmp_path), OC_Log::DEBUG);
+
+if(file_exists($tmp_path)) {
+	$image = new OC_Image();
+	if($image->loadFromFile($tmp_path)) {
+		if($image->crop($x1, $y1, $w, $h)) {
+			if($image->resize(200)) {
+				$tmpfname = tempnam("/tmp", "occCropped"); // create a new file because of caching issues.
+				if($image->save($tmpfname)) {
+					unlink($tmp_path);
+					$card = OC_Contacts_App::getContactVCard($id);
+					if(!$card) {
+						unlink($tmpfname);
+						bailOut('Error getting contact object.');
+					}
+					if($card->__isset('PHOTO')) {
+						OC_Log::write('contacts','savecrop.php: files: PHOTO property exists.', OC_Log::DEBUG);
+						$property = $card->__get('PHOTO');
+						if(!$property) {
+							unlink($tmpfname);
+							bailOut('Error getting PHOTO property.');
+						}
+						$property->setValue($image->__toString());
+						$property->parameters[] = new Sabre_VObject_Parameter('ENCODING', 'b');
+						$property->parameters[] = new Sabre_VObject_Parameter('TYPE', $image->mimeType());
+						$card->__set('PHOTO', $property);
+					} else {
+						OC_Log::write('contacts','savecrop.php: files: Adding PHOTO property.', OC_Log::DEBUG);
+						$card->addProperty('PHOTO', $image->__toString(), array('ENCODING' => 'b', 'TYPE' => $image->mimeType()));
+					}
+					if(!OC_Contacts_VCard::edit($id,$card->serialize())) {
+						bailOut('Error saving contact.');
+					}
+					unlink($tmpfname);
+					//$result=array( "status" => "success", 'mime'=>$image->mimeType(), 'tmp'=>$tmp_path);
+					$tmpl = new OC_TEMPLATE("contacts", "part.contactphoto");
+					$tmpl->assign('tmp_path', $tmpfname);
+					$tmpl->assign('mime', $image->mimeType());
+					$tmpl->assign('id', $id);
+					$tmpl->assign('width', $image->width());
+					$tmpl->assign('height', $image->height());
+					$page = $tmpl->fetchPage();
+					OC_JSON::success(array('data' => array('page'=>$page, 'tmp'=>$tmpfname)));
+					exit();
+				} else {
+					if(file_exists($tmpfname)) {
+						unlink($tmpfname);
+					}
+					bailOut('Error saving temporary image');
+				}
+			} else {
+				bailOut('Error resizing image');
+			}
+		} else {
+			bailOut('Error cropping image');
+		}
+	} else {
+		bailOut('Error creating temporary image');
+	}
+} else {
+	bailOut('Error finding image: '.$tmp_path);
+}
+
+if($tmp_path != '' && file_exists($tmp_path)) {
+	unlink($tmp_path);
+}
+
+?>
diff --git a/apps/contacts/ajax/saveproperty.php b/apps/contacts/ajax/saveproperty.php
new file mode 100644
index 00000000000..8f575c6b81e
--- /dev/null
+++ b/apps/contacts/ajax/saveproperty.php
@@ -0,0 +1,134 @@
+<?php
+/**
+ * ownCloud - Addressbook
+ *
+ * @author Thomas Tanghus
+ * @copyright 2012 Thomas Tanghus <thomas@tanghus.net>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU AFFERO GENERAL PUBLIC LICENSE for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public
+ * License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+// Init owncloud
+require_once('../../../lib/base.php');
+
+// Check if we are a user
+OC_JSON::checkLoggedIn();
+OC_JSON::checkAppEnabled('contacts');
+$l=new OC_L10N('contacts');
+
+function bailOut($msg) {
+	OC_JSON::error(array('data' => array('message' => $msg)));
+	OC_Log::write('contacts','ajax/saveproperty.php: '.$msg, OC_Log::DEBUG);
+	exit();
+}
+function debug($msg) {
+	OC_Log::write('contacts','ajax/saveproperty.php: '.$msg, OC_Log::DEBUG);
+}
+foreach ($_POST as $key=>$element) {
+	debug('_POST: '.$key.'=>'.$element);
+}
+
+$id = isset($_POST['id'])?$_POST['id']:null;
+$name = isset($_POST['name'])?$_POST['name']:null;
+$value = isset($_POST['value'])?$_POST['value']:null;
+$parameters = isset($_POST['parameters'])?$_POST['parameters']:null;
+$checksum = isset($_POST['checksum'])?$_POST['checksum']:null;
+// if(!is_null($parameters)) {
+// 	debug('parameters: '.count($parameters));
+// 	foreach($parameters as $key=>$val ) {
+// 		debug('parameter: '.$key.'=>'.implode('/',$val));
+// 	}
+// }
+
+if(is_array($value)){ // FIXME: How to strip_tags for compound values?
+	ksort($value); // NOTE: Important, otherwise the compound value will be set in the order the fields appear in the form!
+	$value = OC_VObject::escapeSemicolons($value);
+} else {
+	$value = trim(strip_tags($value));
+}
+if(!$id) {
+	bailOut($l->t('id is not set.'));
+}
+if(!$checksum) {
+	bailOut($l->t('checksum is not set.'));
+}
+if(!$name) {
+	bailOut($l->t('element name is not set.'));
+}
+
+$vcard = OC_Contacts_App::getContactVCard( $id );
+$line = OC_Contacts_App::getPropertyLineByChecksum($vcard, $checksum);
+if(is_null($line)) {
+	bailOut($l->t('Information about vCard is incorrect. Please reload the page.'.$checksum.' "'.$line.'"'));
+}
+$element = $vcard->children[$line]->name;
+
+if($element != $name) {
+	bailOut($l->t('Something went FUBAR. ').$name.' != '.$element);
+}
+
+switch($element) {
+	case 'BDAY':
+		$date = New DateTime($value);
+		//$vcard->setDateTime('BDAY', $date, Sabre_VObject_Element_DateTime::DATE);
+		$value = $date->format(DateTime::ATOM);
+	case 'FN':
+		if(!$value) {
+			// create a method thats returns an alternative for FN.
+			//$value = getOtherValue();
+		}
+	case 'N':
+	case 'ORG':
+	case 'NICKNAME':
+		debug('Setting string:'.$name.' '.$value);
+		$vcard->setString($name, $value);
+		break;
+	case 'EMAIL':
+		$value = strtolower($value);
+	case 'TEL':
+	case 'ADR': // should I delete the property if empty or throw an error?
+		debug('Setting element: (EMAIL/TEL/ADR)'.$element);
+		if(!$value) {
+			unset($vcard->children[$line]); // Should never happen...
+		} else {
+			$vcard->children[$line]->setValue($value);
+			$vcard->children[$line]->parameters = array();
+			if(!is_null($parameters)) {
+				debug('Setting parameters: '.$parameters);
+				foreach($parameters as $key => $parameter) {
+					debug('Adding parameter: '.$key);
+					foreach($parameter as $val) {
+						debug('Adding parameter: '.$key.'=>'.$val);
+						$vcard->children[$line]->add(new Sabre_VObject_Parameter($key, strtoupper($val)));
+					}
+				}
+			}
+		}
+		break;
+}
+// Do checksum and be happy
+$checksum = md5($vcard->children[$line]->serialize());
+debug('New checksum: '.$checksum);
+
+if(!OC_Contacts_VCard::edit($id,$vcard->serialize())) {
+	OC_JSON::error(array('data' => array('message' => $l->t('Error updating contact property.'))));
+	OC_Log::write('contacts','ajax/setproperty.php: Error updating contact property: '.$value, OC_Log::ERROR);
+	exit();
+}
+
+//$adr_types = OC_Contacts_App::getTypesOfProperty('ADR');
+//$phone_types = OC_Contacts_App::getTypesOfProperty('TEL');
+
+OC_JSON::success(array('data' => array( 'line' => $line, 'checksum' => $checksum, 'oldchecksum' => $_POST['checksum'] )));
diff --git a/apps/contacts/ajax/setproperty.php b/apps/contacts/ajax/setproperty.php
index cf3fe582247..f9e2a8e8647 100644
--- a/apps/contacts/ajax/setproperty.php
+++ b/apps/contacts/ajax/setproperty.php
@@ -37,9 +37,13 @@ $line = OC_Contacts_App::getPropertyLineByChecksum($vcard, $checksum);
 $value = $_POST['value'];
 if(is_array($value)){
 	ksort($value);  // NOTE: Important, otherwise the compound value will be set in the order the fields appear in the form!
+	foreach(array_keys($value) as $key) {
+		OC_Log::write('contacts','ajax/setproperty.php: setting: '.$key.': '.$value[$key], OC_Log::DEBUG);
+	}
+	$value = OC_VObject::escapeSemicolons($value);
 }
 OC_Log::write('contacts','ajax/setproperty.php: setting: '.$vcard->children[$line]->name.': '.$value, OC_Log::DEBUG);
-$vcard->children[$line]->setValue($value);
+$vcard->children[$line]->setValue(strip_tags($value));
 
 // Add parameters
 $postparameters = isset($_POST['parameters'])?$_POST['parameters']:array();
diff --git a/apps/contacts/ajax/uploadphoto.php b/apps/contacts/ajax/uploadphoto.php
new file mode 100644
index 00000000000..62cd32f5dbb
--- /dev/null
+++ b/apps/contacts/ajax/uploadphoto.php
@@ -0,0 +1,133 @@
+<?php
+/**
+ * ownCloud - Addressbook
+ *
+ * @author Thomas Tanghus
+ * @copyright 2012 Thomas Tanghus <thomas@tanghus.net>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU AFFERO GENERAL PUBLIC LICENSE for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public
+ * License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+// Init owncloud
+require_once('../../../lib/base.php');
+
+// Check if we are a user
+// Firefox and Konqueror tries to download application/json for me.  --Arthur
+OC_JSON::setContentTypeHeader('text/plain');
+OC_JSON::checkLoggedIn();
+OC_JSON::checkAppEnabled('contacts');
+function bailOut($msg) {
+	OC_JSON::error(array('data' => array('message' => $msg)));
+	OC_Log::write('contacts','ajax/uploadphoto.php: '.$msg, OC_Log::DEBUG);
+	exit();
+}
+function debug($msg) {
+	OC_Log::write('contacts','ajax/uploadphoto.php: '.$msg, OC_Log::DEBUG);
+}
+
+// foreach ($_SERVER as $key=>$element) {
+// 	debug('$_SERVER: '.$key.'=>'.$element);
+// }
+// foreach ($_GET as $key=>$element) {
+// 	debug('_GET: '.$key.'=>'.$element);
+// }
+// foreach ($_POST as $key=>$element) {
+// 	debug('_POST: '.$key.'=>'.$element);
+// }
+// foreach ($_FILES as $key=>$element) {
+// 	debug('_FILES: '.$key.'=>'.$element);
+// }
+
+// If it is a Drag'n'Drop transfer it's handled here.
+$fn = (isset($_SERVER['HTTP_X_FILE_NAME']) ? $_SERVER['HTTP_X_FILE_NAME'] : false);
+if ($fn) {
+	// AJAX call
+	if (!isset($_GET['id'])) {
+		OC_Log::write('contacts','ajax/uploadphoto.php: No contact ID was submitted.', OC_Log::DEBUG);
+		OC_JSON::error(array('data' => array( 'message' => 'No contact ID was submitted.' )));
+		exit();
+	}
+	$id = $_GET['id'];
+	$tmpfname = tempnam('/tmp', 'occOrig');
+	file_put_contents($tmpfname, file_get_contents('php://input'));
+	debug($tmpfname.' uploaded');
+	$image = new OC_Image();
+	if($image->loadFromFile($tmpfname)) {
+		if($image->width() > 400 || $image->height() > 400) {
+			$image->resize(400); // Prettier resizing than with browser and saves bandwidth.
+		}
+		if(!$image->fixOrientation()) { // No fatal error so we don't bail out.
+			debug('Couldn\'t save correct image orientation: '.$tmpfname);
+		}
+		if($image->save($tmpfname)) {
+			OC_JSON::success(array('data' => array('mime'=>$_SERVER['CONTENT_TYPE'], 'name'=>$fn, 'id'=>$id, 'tmp'=>$tmpfname)));
+			exit();
+		} else {
+			bailOut('Couldn\'t save temporary image: '.$tmpfname);
+		}
+	} else {
+		bailOut('Couldn\'t load temporary image: '.$file['tmp_name']);
+	}
+}
+
+
+if (!isset($_POST['id'])) {
+	OC_Log::write('contacts','ajax/uploadphoto.php: No contact ID was submitted.', OC_Log::DEBUG);
+	OC_JSON::error(array('data' => array( 'message' => 'No contact ID was submitted.' )));
+	exit();
+}
+if (!isset($_FILES['imagefile'])) {
+	OC_Log::write('contacts','ajax/uploadphoto.php: No file was uploaded. Unknown error.', OC_Log::DEBUG);
+	OC_JSON::error(array('data' => array( 'message' => 'No file was uploaded. Unknown error' )));
+	exit();
+}
+$error = $_FILES['imagefile']['error'];
+if($error !== UPLOAD_ERR_OK) {
+	$l=new OC_L10N('contacts');
+	$errors = array(
+		0=>$l->t("There is no error, the file uploaded with success"),
+		1=>$l->t("The uploaded file exceeds the upload_max_filesize directive in php.ini").ini_get('upload_max_filesize'),
+		2=>$l->t("The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form"),
+		3=>$l->t("The uploaded file was only partially uploaded"),
+		4=>$l->t("No file was uploaded"),
+		6=>$l->t("Missing a temporary folder")
+	);
+	bailOut($errors[$error]);
+}
+$file=$_FILES['imagefile'];
+
+$tmpfname = tempnam("/tmp", "occOrig");
+if(file_exists($file['tmp_name'])) {
+	$image = new OC_Image();
+	if($image->loadFromFile($file['tmp_name'])) {
+		if($image->width() > 400 || $image->height() > 400) {
+			$image->resize(400); // Prettier resizing than with browser and saves bandwidth.
+		}
+		if(!$image->fixOrientation()) { // No fatal error so we don't bail out.
+			debug('Couldn\'t save correct image orientation: '.$tmpfname);
+		}
+		if($image->save($tmpfname)) {
+			OC_JSON::success(array('data' => array('mime'=>$file['type'],'size'=>$file['size'],'name'=>$file['name'], 'id'=>$_POST['id'], 'tmp'=>$tmpfname)));
+			exit();
+		} else {
+			bailOut('Couldn\'t save temporary image: '.$tmpfname);
+		}
+	} else {
+		bailOut('Couldn\'t load temporary image: '.$file['tmp_name']);
+	}
+} else {
+	bailOut('Temporary file: \''.$file['tmp_name'].'\' has gone AWOL?');
+}
+
+?>