take over some changes from 5.1.x

CHANGELOG

@@ -116,6 +116,18 @@
 - add document list which can be exported as an archive
 - search results can be exported
 
+--------------------------------------------------------------------------------
+                     Changes in version 5.1.13
+--------------------------------------------------------------------------------
+- make use of backup dir, do not allow backup if backup dir is not set
+- the referer parameter in op/op.Settings.php is turned into an url before used
+  for redirect
+- Import from filesystem can read a file with metadata
+- drop folder chooser can be put multiple times on a page
+- add section in README.Install.md on how to secure the configuration
+- fix php error when removing a version of a document
+- major rework of ViewFolder page, most parts of the page are now loaded by ajax
+
 --------------------------------------------------------------------------------
                      Changes in version 5.1.12
 --------------------------------------------------------------------------------
@@ -145,10 +157,10 @@
 --------------------------------------------------------------------------------
 - fix for CVE-2019-12744 (Remote Command Execution through unvalidated
   file upload), add .htaccess file to data directory, better documentation
-       for installing seeddms
+  for installing seeddms
 - fix for CVE-2019-12745 (Persistent or Stored XSS in UsrMgr) and
   CVE-2019-12801 (Persistent or Stored XSS in GroupMgr), propperly escape
-       strings used in Select2 js library used by UsrMgr and GroupMgr
+  strings used in Select2 js library used by UsrMgr and GroupMgr
 - do not show attributes in search results in extra column anymore
 - fix setting language during login (Closes #437)
 - fix indexing documents even if no preIndexDocument hook is set (Closes #437)

inc/inc.ClassAccessOperation.php

@@ -27,7 +27,7 @@ class SeedDMS_AccessOperation {
 	 * @var object $dms reference to dms
 	 * @access protected
 	 */
-	protected $dms;
+	private $dms;
 
 	/**
 	 * @var object $user user requesting the access
@@ -63,7 +63,7 @@ class SeedDMS_AccessOperation {
 	 * even if is disallowed in the settings.
 	 */
 	function mayEditVersion($document, $vno=0) { /* {{{ */
-		if(get_class($document) == $this->dms->getClassname('document')) {
+		if($this->obj->isType('document')) {
 			if($vno)
 				$version = $document->getContentByVersion($vno);
 			else
@@ -87,7 +87,7 @@ class SeedDMS_AccessOperation {
 	 * even if is disallowed in the settings.
 	 */
 	function mayRemoveVersion($document) { /* {{{ */
-		if(get_class($document) == $this->dms->getClassname('document')) {
+		if($this->obj->isType('document')) {
 			$versions = $document->getContent();
 			if ((($this->settings->_enableVersionDeletion && ($document->getAccessMode($this->user) == M_ALL)) || $this->user->isAdmin() ) && (count($versions) > 1)) {
 				return true;
@@ -107,7 +107,7 @@ class SeedDMS_AccessOperation {
 	 * even if is disallowed in the settings.
 	 */
 	function mayOverrideStatus($document) { /* {{{ */
-		if(get_class($document) == $this->dms->getClassname('document')) {
+		if($this->obj->isType('document')) {
 			if($latestContent = $document->getLatestContent()) {
 				$status = $latestContent->getStatus();
 				if ((($this->settings->_enableVersionModification && ($document->getAccessMode($this->user) == M_ALL)) || $this->user->isAdmin()) && ($status["status"]==S_DRAFT || $status["status"]==S_RELEASED || $status["status"]==S_REJECTED || $status["status"]==S_OBSOLETE || $status["status"]==S_NEEDS_CORRECTION)) {
@@ -130,7 +130,7 @@ class SeedDMS_AccessOperation {
 	 * explicitly allows it.
 	 */
 	function maySetReviewersApprovers($document) { /* {{{ */
-		if(get_class($document) == $this->dms->getClassname('document')) {
+		if($this->obj->isType('document')) {
 			if($latestContent = $document->getLatestContent()) {
 				$status = $latestContent->getStatus();
 				$reviewstatus = $latestContent->getReviewStatus();
@@ -163,7 +163,7 @@ class SeedDMS_AccessOperation {
 	 * settings.
 	 */
 	function maySetRecipients($document) { /* {{{ */
-		if(get_class($document) == $this->dms->getClassname('document')) {
+		if($this->obj->isType('document')) {
 			if($latestContent = $document->getLatestContent()) {
 				$status = $latestContent->getStatus();
 				if (($this->settings->_enableVersionModification && ($document->getAccessMode($this->user) >= M_READWRITE)) || $this->user->isAdmin()) {
@@ -184,7 +184,7 @@ class SeedDMS_AccessOperation {
 	 * settings.
 	 */
 	function maySetRevisors($document) { /* {{{ */
-		if(get_class($document) == $this->dms->getClassname('document')) {
+		if($this->obj->isType('document')) {
 			if($latestContent = $document->getLatestContent()) {
 				$status = $latestContent->getStatus();
 				if ((($this->settings->_enableVersionModification && ($document->getAccessMode($this->user) >= M_READWRITE)) || $this->user->isAdmin()) && ($status["status"]==S_RELEASED || $status["status"]==S_IN_REVISION)) {
@@ -205,7 +205,7 @@ class SeedDMS_AccessOperation {
 	 * settings.
 	 */
 	function maySetWorkflow($document) { /* {{{ */
-		if(get_class($document) == $this->dms->getClassname('document')) {
+		if($this->obj->isType('document')) {
 			if($latestContent = $document->getLatestContent()) {
 				$workflow = $latestContent->getWorkflow();
 				if ((($this->settings->_enableVersionModification && ($document->getAccessMode($this->user) == M_ALL)) || $this->user->isAdmin()) && (!$workflow || ($workflow->getInitState()->getID() == $latestContent->getWorkflowState()->getID()))) {
@@ -223,7 +223,7 @@ class SeedDMS_AccessOperation {
 	 * expiration date is only allowed if the document has not been obsoleted.
 	 */
 	function maySetExpires($document) { /* {{{ */
-		if(get_class($document) == $this->dms->getClassname('document')) {
+		if($this->obj->isType('document')) {
 			if($latestContent = $document->getLatestContent()) {
 				$status = $latestContent->getStatus();
 				if ((($document->getAccessMode($this->user) >= M_READWRITE) || $this->user->isAdmin()) && ($status["status"]!=S_OBSOLETE)) {
@@ -244,7 +244,7 @@ class SeedDMS_AccessOperation {
 	 * disallowed in the settings.
 	 */
 	function mayEditComment($document) { /* {{{ */
-		if(get_class($document) == $this->dms->getClassname('document')) {
+		if($this->obj->isType('document')) {
 			if($document->isLocked()) {
 				$lockingUser = $document->getLockingUser();
 				if (($lockingUser->getID() != $this->user->getID()) && ($document->getAccessMode($this->user) != M_ALL)) {
@@ -271,7 +271,7 @@ class SeedDMS_AccessOperation {
 	 * disallowed in the settings.
 	 */
 	function mayEditAttributes($document) { /* {{{ */
-		if(get_class($document) == $this->dms->getClassname('document')) {
+		if($this->obj->isType('document')) {
 			if($latestContent = $document->getLatestContent()) {
 				$status = $latestContent->getStatus();
 				$workflow = $latestContent->getWorkflow();
@@ -291,7 +291,7 @@ class SeedDMS_AccessOperation {
 	 * account here.
 	 */
 	function mayReview($document) { /* {{{ */
-		if(get_class($document) == $this->dms->getClassname('document')) {
+		if($this->obj->isType('document')) {
 			if($latestContent = $document->getLatestContent()) {
 				$status = $latestContent->getStatus();
 				if ($document->getAccessMode($this->user) >= M_READ && $status["status"]==S_DRAFT_REV) {
@@ -309,7 +309,7 @@ class SeedDMS_AccessOperation {
 	 * review and if it is allowed in the settings
 	 */
 	function mayUpdateReview($document, $updateUser) { /* {{{ */
-		if(get_class($document) == 'SeedDMS_Core_Document') {
+		if($this->obj->isType('document')) {
 			if($this->settings->_enableUpdateRevApp && ($updateUser == $this->user) && $document->getAccessMode($this->user) >= M_READ && !$document->hasExpired()) {
 				return true;
 			}
@@ -324,7 +324,7 @@ class SeedDMS_AccessOperation {
 	 * approval and if it is allowed in the settings
 	 */
 	function mayUpdateApproval($document, $updateUser) { /* {{{ */
-		if(get_class($document) == 'SeedDMS_Core_Document') {
+		if($this->obj->isType('document')) {
 			if($this->settings->_enableUpdateRevApp && ($updateUser == $this->user) && $document->getAccessMode($this->user) >= M_READ && !$document->hasExpired()) {
 				return true;
 			}
@@ -342,7 +342,7 @@ class SeedDMS_AccessOperation {
 	 * account here.
 	 */
 	function mayApprove($document) { /* {{{ */
-		if(get_class($document) == $this->dms->getClassname('document')) {
+		if($this->obj->isType('document')) {
 			if($latestContent = $document->getLatestContent()) {
 				$status = $latestContent->getStatus();
 				if ($document->getAccessMode($this->user) >= M_READ && $status["status"]==S_DRAFT_APP) {
@@ -361,7 +361,7 @@ class SeedDMS_AccessOperation {
 	 * account here.
 	 */
 	function mayReceipt($document) { /* {{{ */
-		if(get_class($document) == $this->dms->getClassname('document')) {
+		if($this->obj->isType('document')) {
 			if($latestContent = $document->getLatestContent()) {
 				$status = $latestContent->getStatus();
 				if ($document->getAccessMode($this->user) >= M_READ && $status["status"]==S_RELEASED) {
@@ -379,7 +379,7 @@ class SeedDMS_AccessOperation {
 	 * review and if it is allowed in the settings
 	 */
 	function mayUpdateReceipt($document, $updateUser) { /* {{{ */
-		if(get_class($document) == 'SeedDMS_Core_Document') {
+		if($this->obj->isType('document')) {
 			if($this->settings->_enableUpdateReceipt && ($updateUser == $this->user) && $document->getAccessMode($this->user) >= M_READ && !$document->hasExpired()) {
 				return true;
 			}
@@ -395,7 +395,7 @@ class SeedDMS_AccessOperation {
 	 * account here.
 	 */
 	function mayRevise($document) { /* {{{ */
-		if(get_class($document) == $this->dms->getClassname('document')) {
+		if($this->obj->isType('document')) {
 			if($latestContent = $document->getLatestContent()) {
 				$status = $latestContent->getStatus();
 				if ($document->getAccessMode($this->user) >= M_READ && $status["status"]!=S_OBSOLETE) {

inc/inc.ClassViewCommon.php

@@ -43,6 +43,7 @@ class SeedDMS_View_Common {
 	}
 
 	public function __invoke($get=array()) {
+		$this->callHook('preRun', isset($get['action']) ? $get['action'] : 'show');
 		if(isset($get['action']) && $get['action']) {
 			if(method_exists($this, $get['action'])) {
 				$this->{$get['action']}();
@@ -51,6 +52,7 @@ class SeedDMS_View_Common {
 			}
 		} else
 			$this->show();
+		$this->callHook('postRun', isset($get['action']) ? $get['action'] : 'show');
 	}
 
 	public function setParams($params) {
@@ -97,10 +99,17 @@ class SeedDMS_View_Common {
 	 * function returns
 	 */
 	public function callHook($hook) { /* {{{ */
+		$tmps = array();
 		$tmp = explode('_', get_class($this));
+		$tmps[] = $tmp[2];
+		$tmp = explode('_', get_parent_class($this));
+		$tmps[] = $tmp[2];
+		/* Run array_unique() in case the parent class has the same suffix */
+		$tmps = array_unique($tmps);
 		$ret = null;
-		if(isset($GLOBALS['SEEDDMS_HOOKS']['view'][lcfirst($tmp[2])])) {
+		foreach($tmps as $tmp)
-			foreach($GLOBALS['SEEDDMS_HOOKS']['view'][lcfirst($tmp[2])] as $hookObj) {
+		if(isset($GLOBALS['SEEDDMS_HOOKS']['view'][lcfirst($tmp)])) {
+			foreach($GLOBALS['SEEDDMS_HOOKS']['view'][lcfirst($tmp)] as $hookObj) {
 				if (method_exists($hookObj, $hook)) {
 					switch(func_num_args()) {
 						case 1:
@@ -252,12 +261,12 @@ class SeedDMS_View_Common {
 		return $tag;
 	} /* }}} */
 
-	public function jsTranslations($keys) {
+	public function jsTranslations($keys) { /* {{{ */
 		echo "var trans = {\n";
 		foreach($keys as $key) {
 			echo "	'".$key."': '".str_replace("'", "\\\'", getMLText($key))."',\n";
 		}
 		echo "};\n";
-	}
+	} /* }}} */
 }
 ?>

inc/inc.Extension.php

@@ -32,12 +32,14 @@ foreach($EXT_CONF as $extname=>$extconf) {
 		}
 	}
 	if(!isset($extconf['disable']) || $extconf['disable'] == false) {
-		$classfile = $settings->_rootDir."/ext/".$extname."/".$extconf['class']['file'];
+		if(isset($extconf['class']) && isset($extconf['class']['file']) && isset($extconf['class']['name'])) {
-		if(file_exists($classfile)) {
+			$classfile = $settings->_rootDir."/ext/".$extname."/".$extconf['class']['file'];
-			include($classfile);
+			if(file_exists($classfile)) {
-			$obj = new $extconf['class']['name'];
+				include($classfile);
-			if(method_exists($obj, 'init'))
+				$obj = new $extconf['class']['name'];
-				$obj->init(isset($settings->_extensions[$extname]) ? $settings->_extensions[$extname] : null);
+				if(method_exists($obj, 'init'))
+					$obj->init(isset($settings->_extensions[$extname]) ? $settings->_extensions[$extname] : null);
+			}
 		}
 		if(isset($extconf['language']['file'])) {
 			$langfile = $settings->_rootDir."/ext/".$extname."/".$extconf['language']['file'];

op/op.CreateDump.php

@@ -31,13 +31,12 @@ if (!$user->isAdmin()) {
 	UI::exitError(getMLText("admin_tools"),getMLText("access_denied"));
 }
 
-if($settings->_backupDir && file_exists($settings->_backupDir))
+if (!$settings->_backupDir) {
-	$basedir = $settings->_backupDir;
+	UI::exitError(getMLText("admin_tools"),getMLText("no_backup_dir"));
-else
+}
-	$basedir = $settings->_contentDir;
 
 $v = new SeedDMS_Version;
-$dump_name = $basedir.date('Y-m-d\TH-i-s')."_".$v->_number.".sql";
+$dump_name = addDirSep($settings->_backupDir).date('Y-m-d\TH-i-s')."_".$v->_number.".sql";
 if(!$dms->createDump($dump_name))
 	UI::exitError(getMLText("admin_tools"),getMLText("error_occured"));
 

op/op.CreateFolderArchive.php

@@ -167,14 +167,14 @@ if (!is_object($folder)) {
 	UI::exitError(getMLText("admin_tools"),getMLText("invalid_folder_id"));
 }
 
+if (!$settings->_backupDir) {
+	UI::exitError(getMLText("admin_tools"),getMLText("no_backup_dir"));
+}
+
 $human_readable = (isset($_GET["human_readable"]) && $_GET["human_readable"]==1 ? true : false);
 
-if($settings->_backupDir && file_exists($settings->_backupDir))
+if ($human_readable)$ark_name = addDirSep($settings->_backupDir).time()."_".$folderid."_HR.tar";
-	$basedir = $settings->_backupDir;
+else $ark_name = addDirSep($settings->_backupDir).time()."_".$folderid.".tar";
-else
-	$basedir = $settings->_contentDir;
-if ($human_readable)$ark_name = $basedir.time()."_".$folderid."_HR.tar";
-else $ark_name = $basedir.time()."_".$folderid.".tar";
 
 $ark = fopen($ark_name,"w");
 

op/op.Download.php

@@ -119,16 +119,12 @@ elseif (isset($_GET["arkname"])) { /* {{{ */
 		UI::exitError(getMLText("admin_tools"),getMLText("unknown_id"));
 	}
 
-	if($settings->_backupDir && file_exists($settings->_backupDir))
+	$backupdir = addDirSep($settings->_backupDir);
-		$basedir = $settings->_backupDir;
+	if (!file_exists($backupdir.$filename) ) {
-	else
-		$basedir = $settings->_contentDir;
-
-	if (!file_exists($basedir.$filename) ) {
 		UI::exitError(getMLText("admin_tools"),getMLText("missing_file"));
 	}
 
-	$controller->setParam('basedir', $basedir);
+	$controller->setParam('basedir', $backupdir);
 	$controller->setParam('file', $filename);
 	$controller->archive();
 } /* }}} */
@@ -192,16 +188,16 @@ elseif (isset($_GET["dumpname"])) { /* {{{ */
 		UI::exitError(getMLText("admin_tools"),getMLText("unknown_id"));
 	}
 
-	if($settings->_backupDir && file_exists($settings->_backupDir))
+	$backupdir = addDirSep($settings->_backupDir);
-		$basedir = $settings->_backupDir;
+	if (!$backupdir) {
-	else
+		UI::exitError(getMLText("admin_tools"),getMLText("no_backup_dir"));
-		$basedir = $settings->_contentDir;
+	}
 
-	if (!file_exists($basedir.$filename) ) {
+	if (!file_exists($backupdir.$filename) ) {
 		UI::exitError(getMLText("admin_tools"),getMLText("missing_file"));
 	}
 
-	$controller->setParam('basedir', $basedir);
+	$controller->setParam('basedir', $backupdir);
 	$controller->setParam('file', $filename);
 	$controller->sqldump();
 } /* }}} */

out/out.DocumentChooser.php

@@ -29,19 +29,33 @@ require_once("inc/inc.DBInit.php");
 require_once("inc/inc.ClassUI.php");
 require_once("inc/inc.Authentication.php");
 
-$folderid = intval($_GET["folderid"]);
+if(isset($_GET['action']) && $_GET['action'] == 'subtree') {
-$form = preg_replace('/[^A-Za-z0-9_]+/', '', $_GET["form"]);
+	if (!isset($_GET["node"]) || !is_numeric($_GET["node"]) || intval($_GET["node"])<1) {
+		$nodeid = $settings->_rootFolderID;
+	} else {
+		$nodeid = intval($_GET["node"]);
+	}
 
-if(isset($_GET['partialtree'])) {
+	$node = $dms->getFolder($nodeid);
-	$partialtree = intval($_GET['partialtree']);
+	if (!is_object($node)) {
+		UI::exitError(getMLText("folder_title", array("foldername" => getMLText("invalid_folder_id"))), getMLText("invalid_folder_id"));
+	}
 } else {
-	$partialtree = 0;
+	$folderid = intval($_GET["folderid"]);
+	$folder = $dms->getFolder($folderid);
+	$form = preg_replace('/[^A-Za-z0-9_]+/', '', $_GET["form"]);
 }
-$folder = $dms->getFolder($folderid);
 
 $tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME']));
-$view = UI::factory($theme, $tmp[1], array('dms'=>$dms, 'user'=>$user, 'folder'=>$folder, 'form'=>$form, 'partialtree'=>$partialtree));
+$view = UI::factory($theme, $tmp[1], array('dms'=>$dms, 'user'=>$user));
 if($view) {
+	if(isset($_GET['action']) && $_GET['action'] == 'subtree') {
+		$view->setParam('node', $node);
+		$view->setParam('orderby', $settings->_sortFoldersDefault);
+	} else {
+		$view->setParam('folder', $folder);
+		$view->setParam('form', $form);
+	}
 	$view($_GET);
 	exit;
 }

views/bootstrap/class.BackupTools.php

@@ -75,124 +75,128 @@ class SeedDMS_View_BackupTools extends SeedDMS_Bootstrap_Style {
 
 		// archive creation ////////////////////////////////////////////////////////////
 
-		$this->contentHeading(getMLText("archive_creation"));
+		if($this->params['hasbackupdir']) {
-		print "<p>".getMLText("archive_creation_warning")."</p>\n";
+			$this->contentHeading(getMLText("archive_creation"));
-		$this->contentContainerStart();
+			print "<p>".getMLText("archive_creation_warning")."</p>\n";
-		if($accessop->check_controller_access('CreateFolderArchive', array('action'=>'run'))) {
+			$this->contentContainerStart();
-			print "<form action=\"../op/op.CreateFolderArchive.php\" name=\"form2\">";
+			if($accessop->check_controller_access('CreateFolderArchive', array('action'=>'run'))) {
-			$this->printFolderChooserHtml("form2",M_READWRITE);
+				print "<form action=\"../op/op.CreateFolderArchive.php\" name=\"form2\">";
-			print "<label class=\"checkbox\"><input type=\"checkbox\" name=\"human_readable\" value=\"1\">".getMLText("human_readable")."</label>";
+				$this->printFolderChooserHtml("form2",M_READWRITE);
-			print "<input type='submit' class='btn' name='' value='".getMLText("archive_creation")."'/>";
+				print "<label class=\"checkbox\"><input type=\"checkbox\" name=\"human_readable\" value=\"1\">".getMLText("human_readable")."</label>";
-			print "</form>\n";
+				print "<input type='submit' class='btn' name='' value='".getMLText("archive_creation")."'/>";
-		}
+				print "</form>\n";
-
-		// list backup files
-
-		$handle = opendir($backupdir);
-		$entries = array();
-		while ($e = readdir($handle)){
-			if (is_dir($backupdir.$e)) continue;
-			if (strpos($e,".tar.gz")==FALSE) continue;
-			$entries[] = $e;
-		}
-		closedir($handle);
-
-		sort($entries);
-		$entries = array_reverse($entries);
-
-		if($entries) {
-			$this->contentSubHeading(getMLText("backup_list"));
-			print "<table class=\"table-condensed\">\n";
-			print "<thead>\n<tr>\n";
-			print "<th></th>\n";
-			print "<th>".getMLText("folder")."</th>\n";
-			print "<th>".getMLText("creation_date")."</th>\n";
-			print "<th>".getMLText("file_size")."</th>\n";
-			print "<th></th>\n";
-			print "</tr>\n</thead>\n<tbody>\n";
-
-			foreach ($entries as $entry){
-
-				$folderid=substr($entry,strpos($entry,"_")+1);
-				$folder=$dms->getFolder((int)$folderid);
-						
-				print "<tr>\n";
-				print "<td>";
-				if($accessop->check_controller_access('Download', array('action'=>'archive')))
-					print "<a href=\"../op/op.Download.php?arkname=".$entry."\">".$entry."</a>";
-				else
-					print $entry;
-				print "</td>\n";
-				if (is_object($folder)) print "<td>".htmlspecialchars($folder->getName())."</td>\n";
-				else print "<td>".getMLText("unknown_id")."</td>\n";
-				print "<td>".getLongReadableDate(filectime($backupdir.$entry))."</td>\n";
-				print "<td>".SeedDMS_Core_File::format_filesize(filesize($backupdir.$entry))."</td>\n";
-				print "<td>";
-				if($accessop->check_controller_access('RemoveArchive', array('action'=>'run')))
-					print "<a href=\"out.RemoveArchive.php?arkname=".$entry."\" class=\"btn btn-mini\"><i class=\"icon-remove\"></i> ".getMLText("backup_remove")."</a>";
-				print "</td>\n";	
-				print "</tr>\n";
 			}
-			print "</table>\n";
-		}
 
-		$this->contentContainerEnd();
+			// list backup files
 
-		// dump creation ///////////////////////////////////////////////////////////////
+			$handle = opendir($backupdir);
+			$entries = array();
+			while ($e = readdir($handle)){
+				if (is_dir($backupdir.$e)) continue;
+				if (strpos($e,".tar.gz")==FALSE) continue;
+				$entries[] = $e;
+			}
+			closedir($handle);
 
-		$this->contentHeading(getMLText("dump_creation"));
+			sort($entries);
-		print "<p>".getMLText("dump_creation_warning")."</p>\n";
+			$entries = array_reverse($entries);
-		$this->contentContainerStart();
 
-		if($accessop->check_controller_access('CreateDump', array('action'=>'run'))) {
+			if($entries) {
+				$this->contentSubHeading(getMLText("backup_list"));
+				print "<table class=\"table-condensed\">\n";
+				print "<thead>\n<tr>\n";
+				print "<th></th>\n";
+				print "<th>".getMLText("folder")."</th>\n";
+				print "<th>".getMLText("creation_date")."</th>\n";
+				print "<th>".getMLText("file_size")."</th>\n";
+				print "<th></th>\n";
+				print "</tr>\n</thead>\n<tbody>\n";
+
+				foreach ($entries as $entry){
+
+					$folderid=substr($entry,strpos($entry,"_")+1);
+					$folder=$dms->getFolder((int)$folderid);
+							
+					print "<tr>\n";
+					print "<td>";
+					if($accessop->check_controller_access('Download', array('action'=>'archive')))
+						print "<a href=\"../op/op.Download.php?arkname=".$entry."\">".$entry."</a>";
+					else
+						print $entry;
+					print "</td>\n";
+					if (is_object($folder)) print "<td>".htmlspecialchars($folder->getName())."</td>\n";
+					else print "<td>".getMLText("unknown_id")."</td>\n";
+					print "<td>".getLongReadableDate(filectime($backupdir.$entry))."</td>\n";
+					print "<td>".SeedDMS_Core_File::format_filesize(filesize($backupdir.$entry))."</td>\n";
+					print "<td>";
+					if($accessop->check_controller_access('RemoveArchive', array('action'=>'run')))
+						print "<a href=\"out.RemoveArchive.php?arkname=".$entry."\" class=\"btn btn-mini\"><i class=\"icon-remove\"></i> ".getMLText("backup_remove")."</a>";
+					print "</td>\n";	
+					print "</tr>\n";
+				}
+				print "</table>\n";
+			}
+
+			$this->contentContainerEnd();
+
+			// dump creation ///////////////////////////////////////////////////////////////
+
+			$this->contentHeading(getMLText("dump_creation"));
+			print "<p>".getMLText("dump_creation_warning")."</p>\n";
+			$this->contentContainerStart();
+
+			if($accessop->check_controller_access('CreateDump', array('action'=>'run'))) {
 			print "<form action=\"../op/op.CreateDump.php\" name=\"form4\">";
 			print "<input type='submit' class='btn' name='' value='".getMLText("dump_creation")."'/>";
 			print "</form>\n";
-		}
-
-		// list backup files
-		$handle = opendir($backupdir);
-		$entries = array();
-		while ($e = readdir($handle)){
-			if (is_dir($backupdir.$e)) continue;
-			if (strpos($e,".sql.gz")==FALSE) continue;
-			$entries[] = $e;
-		}
-		closedir($handle);
-
-		sort($entries);
-		$entries = array_reverse($entries);
-
-		if($entries) {
-			$this->contentSubHeading(getMLText("dump_list"));
-			print "<table class=\"table-condensed\">\n";
-			print "<thead>\n<tr>\n";
-			print "<th></th>\n";
-			print "<th>".getMLText("creation_date")."</th>\n";
-			print "<th>".getMLText("file_size")."</th>\n";
-			print "<th></th>\n";
-			print "</tr>\n</thead>\n<tbody>\n";
-
-			foreach ($entries as $entry){
-				print "<tr>\n";
-				print "<td>";
-				if($accessop->check_controller_access('Download', array('action'=>'sqldump')))
-					print "<a href=\"../op/op.Download.php?dumpname=".$entry."\">".$entry."</a>";
-				else
-					print $entry;
-				print "</td>\n";
-				print "<td>".getLongReadableDate(filectime($backupdir.$entry))."</td>\n";
-				print "<td>".SeedDMS_Core_File::format_filesize(filesize($backupdir.$entry))."</td>\n";
-				print "<td>";
-				if($accessop->check_controller_access('RemoveDump', array('action'=>'run')))
-					print "<a href=\"out.RemoveDump.php?dumpname=".$entry."\" class=\"btn btn-mini\"><i class=\"icon-remove\"></i> ".getMLText("dump_remove")."</a>";
-				print "</td>\n";	
-				print "</tr>\n";
 			}
-			print "</table>\n";
-		}
 
-		$this->contentContainerEnd();
+			// list backup files
+			$handle = opendir($backupdir);
+			$entries = array();
+			while ($e = readdir($handle)){
+				if (is_dir($backupdir.$e)) continue;
+				if (strpos($e,".sql.gz")==FALSE) continue;
+				$entries[] = $e;
+			}
+			closedir($handle);
+
+			sort($entries);
+			$entries = array_reverse($entries);
+
+			if($entries) {
+				$this->contentSubHeading(getMLText("dump_list"));
+				print "<table class=\"table-condensed\">\n";
+				print "<thead>\n<tr>\n";
+				print "<th></th>\n";
+				print "<th>".getMLText("creation_date")."</th>\n";
+				print "<th>".getMLText("file_size")."</th>\n";
+				print "<th></th>\n";
+				print "</tr>\n</thead>\n<tbody>\n";
+
+				foreach ($entries as $entry){
+					print "<tr>\n";
+					print "<td>";
+					if($accessop->check_controller_access('Download', array('action'=>'sqldump')))
+						print "<a href=\"../op/op.Download.php?dumpname=".$entry."\">".$entry."</a>";
+					else
+						print $entry;
+					print "</td>\n";
+					print "<td>".getLongReadableDate(filectime($backupdir.$entry))."</td>\n";
+					print "<td>".SeedDMS_Core_File::format_filesize(filesize($backupdir.$entry))."</td>\n";
+					print "<td>";
+					if($accessop->check_controller_access('RemoveDump', array('action'=>'run')))
+						print "<a href=\"out.RemoveDump.php?dumpname=".$entry."\" class=\"btn btn-mini\"><i class=\"icon-remove\"></i> ".getMLText("dump_remove")."</a>";
+					print "</td>\n";	
+					print "</tr>\n";
+				}
+				print "</table>\n";
+			}
+
+			$this->contentContainerEnd();
+		} else {
+			$this->warningMsg(getMLText('no_backup_dir'));
+		}
 
 		// files deletion //////////////////////////////////////////////////////////////
 		/*

views/bootstrap/class.Bootstrap.php

@@ -168,6 +168,7 @@ background-image: linear-gradient(to bottom, #882222, #111111);;
 		echo '<script src="../styles/'.$this->theme.'/application.js"></script>'."\n";
 		if($this->params['enablemenutasks'] && isset($this->params['user']) && $this->params['user']) {
 			$this->addFooterJS('checkTasks();');
+			$this->addFooterJS('updateDropFolder();');
 		}
 		if($this->footerjs) {
 			$jscode = "$(document).ready(function () {\n";
@@ -198,6 +199,7 @@ background-image: linear-gradient(to bottom, #882222, #111111);;
 		header('Content-Type: application/javascript');
 		echo "var seeddms_absbaseprefix=\"".$this->params['absbaseprefix']."\";\n";
 		echo "var seeddms_webroot=\"".$this->params['settings']->_httpRoot."\";\n";
+		echo "var seeddms_folder=1;\n";
 	} /* }}} */
 
 	function footerjs() { /* {{{ */
@@ -431,7 +433,7 @@ background-image: linear-gradient(to bottom, #882222, #111111);;
 			if($this->params['dropfolderdir'] && $this->params['enabledropfolderlist']) {
 				echo "   <div id=\"menu-dropfolder\">";
 				echo "     <div class=\"ajax\" data-no-spinner=\"true\" data-view=\"DropFolderChooser\" data-action=\"menuList\"";
-				if ($folder!=null && is_object($folder) && !strcasecmp(get_class($folder), $dms->getClassname('folder')))
+				if ($folder!=null && is_object($folder) && $folder->isType('folder'))
 					echo " data-query=\"folderid=".$folder->getID()."\"";
 				echo "></div>";
 				echo "   </div>";
@@ -458,7 +460,7 @@ background-image: linear-gradient(to bottom, #882222, #111111);;
 			}
 			echo "   </ul>\n";
 			echo "     <form action=\"../out/out.Search.php\" class=\"form-inline navbar-search pull-left\" autocomplete=\"off\">";
-			if ($folder!=null && is_object($folder) && !strcasecmp(get_class($folder), $dms->getClassname('folder'))) {
+			if ($folder!=null && is_object($folder) && $folder->isType('folder')) {
 				echo "      <input type=\"hidden\" name=\"folderid\" value=\"".$folder->getID()."\" />";
 			}
 			echo "      <input type=\"hidden\" name=\"navBar\" value=\"1\" />";
@@ -563,7 +565,7 @@ background-image: linear-gradient(to bottom, #882222, #111111);;
 
 	private function folderNavigationBar($folder) { /* {{{ */
 		$dms = $this->params['dms'];
-		if (!is_object($folder) || strcasecmp(get_class($folder), $dms->getClassname('folder'))) {
+		if (!is_object($folder) || !$folder->isType('folder')) {
 			echo "<ul class=\"nav\">\n";
 			echo "</ul>\n";
 			return;
@@ -1190,7 +1192,7 @@ $(document).ready(function() {
 			<div class="input-append">
 				<input type="text" class="form-control" readonly>
 				<span class="btn btn-default btn-file">
-					'.getMLText("browse").'&hellip; <input id="'.$id.'" type="file" name="'.$varname.'"'.($multiple ? " multiple" : "").($accept ? ' accept="'.$accept.'"' : "").'">
+					'.getMLText("browse").'&hellip; <input id="'.$id.'" type="file" name="'.$varname.'"'.($multiple ? " multiple" : "").($accept ? ' accept="'.$accept.'"' : "").'>
 				</span>
 			</div>
 		</div>
@@ -1580,7 +1582,7 @@ $(document).ready(function() {
 		$content =  "<div class=\"input-append\">\n";
 		$content .= "<input readonly type=\"text\" id=\"dropfolderfile".$formName."\" name=\"dropfolderfile".$formName."\" value=\"".$dropfolderfile."\">";
 		$content .= "<button type=\"button\" class=\"btn\" id=\"clearfilename".$formName."\"><i class=\"icon-remove\"></i></button>";
-		$content .= "<a data-target=\"#dropfolderChooser\" href=\"../out/out.DropFolderChooser.php?form=form1&dropfolderfile=".urlencode($dropfolderfile)."&showfolders=".$showfolders."\" role=\"button\" class=\"btn\" data-toggle=\"modal\">".($showfolders ? getMLText("choose_target_folder"): getMLText("choose_target_file"))."…</a>\n";
+		$content .= "<a data-target=\"#dropfolderChooser\" href=\"../out/out.DropFolderChooser.php?form=".$formName."&dropfolderfile=".urlencode($dropfolderfile)."&showfolders=".$showfolders."\" role=\"button\" class=\"btn\" data-toggle=\"modal\">".($showfolders ? getMLText("choose_target_folder"): getMLText("choose_target_file"))."…</a>\n";
 		$content .= "</div>\n";
 		$content .= '
 <div class="modal hide" id="dropfolderChooser" tabindex="-1" role="dialog" aria-labelledby="dropfolderChooserLabel" aria-hidden="true">
@@ -1603,13 +1605,15 @@ $(document).ready(function() {
 ?>
 /* Set up a callback which is called when a folder in the tree is selected */
 modalDropfolderChooser = $('#dropfolderChooser');
-function fileSelected(name) {
+function fileSelected(name, form) {
-	$('#dropfolderfile<?php echo $formName ?>').val(name);
+//	$('#dropfolderfile<?php echo $formName ?>').val(name);
+	$('#dropfolderfile'+form).val(name);
 	modalDropfolderChooser.modal('hide');
 }
 <?php if($showfolders) { ?>
-function folderSelected(name) {
+function folderSelected(name, form) {
-	$('#dropfolderfile<?php echo $formName ?>').val(name);
+//	$('#dropfolderfile<?php echo $formName ?>').val(name);
+	$('#dropfolderfile'+form).val(name);
 	modalDropfolderChooser.modal('hide');
 }
 <?php } ?>
@@ -1728,7 +1732,8 @@ $(document).ready(function() {
 	} /* }}} */
 
 	function printNewTreeNavigationHtml($folderid=0, $accessmode=M_READ, $showdocs=0, $formid='form1', $expandtree=0, $orderby='') { /* {{{ */
-		echo "<div id=\"jqtree".$formid."\" style=\"margin-left: 10px;\" data-url=\"../op/op.Ajax.php?command=subtree&showdocs=".$showdocs."&orderby=".$orderby."\"></div>\n";
+		//echo "<div id=\"jqtree".$formid."\" style=\"margin-left: 10px;\" data-url=\"../op/op.Ajax.php?command=subtree&showdocs=".$showdocs."&orderby=".$orderby."\"></div>\n";
+		echo "<div id=\"jqtree".$formid."\" style=\"margin-left: 10px;\" data-url=\"".$_SERVER['SCRIPT_NAME']."?action=subtree\"></div>\n";
 	} /* }}} */
 
 	/**
@@ -1750,9 +1755,9 @@ $(document).ready(function() {
 			if($path || $expandtree>=$level) {
 				if($path)
 					$pathfolder = array_shift($path);
+				$children = array();
 				$subfolders = $folder->getSubFolders(isset($orderby[0]) ? $orderby[0] : '', $orderdir);
 				$subfolders = SeedDMS_Core_DMS::filterAccess($subfolders, $user, $accessmode);
-				$children = array();
 				foreach($subfolders as $subfolder) {
 					$node = array('label'=>$subfolder->getName(), 'id'=>$subfolder->getID(), 'load_on_demand'=>($subfolder->hasSubFolders() || ($subfolder->hasDocuments() && $showdocs)) ? true : false, 'is_folder'=>true);
 					if($expandtree>=$level || $pathfolder->getID() == $subfolder->getID()) {
@@ -1793,18 +1798,8 @@ $(document).ready(function() {
 			}
 			$node = array('label'=>$folder->getName(), 'id'=>$folder->getID(), 'load_on_demand'=>false, 'is_folder'=>true);
 			if(!$folder->hasSubFolders()) {
-				$node['load_on_demand'] = false;
+				$node['load_on_demand'] = true;
 				$node['children'] = array();
-				if($showdocs) {
-					$documents = $folder->getDocuments($orderby);
-					$documents = SeedDMS_Core_DMS::filterAccess($documents, $this->params['user'], $accessmode);
-					if($this->hasHook('filterTreeDocuments'))
-						$documents = $this->callHook('filterTreeDocuments', $folder, $documents);
-					foreach($documents as $document) {
-						$node2 = array('label'=>$document->getName(), 'id'=>$document->getID(), 'load_on_demand'=>false, 'is_folder'=>false);
-						$node['children'][] = $node2;
-					}
-				}
 			} else {
 				$node['children'] = jqtree($this, $path, $folder, $this->params['user'], $accessmode, $showdocs, $expandtree, $orderby, 0);
 				if($showdocs) {
@@ -1828,14 +1823,15 @@ $(document).ready(function() {
 			
 		} else {
 			$root = $this->params['dms']->getFolder($this->params['rootfolderid']);
-			$tree = array(array('label'=>$root->getName(), 'id'=>$root->getID(), 'load_on_demand'=>true, 'is_folder'=>true));
+			$tree = array(array('label'=>$root->getName(), 'id'=>$root->getID(), 'load_on_demand'=>false, 'is_folder'=>true));
 		}
-
 ?>
 var data = <?php echo json_encode($tree); ?>;
 $(function() {
-	$('#jqtree<?php echo $formid ?>').tree({
+	const $tree = $('#jqtree<?php echo $formid ?>');
+	$tree.tree({
 //		saveState: true,
+		selectable: false,
 		data: data,
 		saveState: 'jqtree<?php echo $formid; ?>',
 		openedIcon: $('<i class="icon-minus-sign"></i>'),
@@ -1859,17 +1855,19 @@ $(function() {
 	// Unfold node for currently selected folder
 	$('#jqtree<?php echo $formid ?>').tree('openNode', $('#jqtree<?php echo $formid ?>').tree('getNodeById', <?php echo $folderid ?>), false);
   $('#jqtree<?php echo $formid ?>').on(
-		'tree.select',
+		'tree.click',
 		function(event) {
 			var node = event.node;
+			if(!node)
+				return;
 			$('#jqtree<?php echo $formid ?>').tree('openNode', node);
 //			event.preventDefault();
 			if(node.is_folder) {
 				if(typeof node.fetched == 'undefined') {
 					node.fetched = true;
 					$(this).tree('loadDataFromUrl', node, function () {
-						$(this).tree('openNode', node);}
+						$(this).tree('openNode', node);
-					);
+					});
 				}
 				folderSelected<?php echo $formid ?>(node.id, node.name);
 			} else
@@ -1904,6 +1902,39 @@ $(function() {
 <?php
 	} /* }}} */
 
+	/**
+	 * Return json data for sub tree of navigation tree
+	 */
+	function printNewTreeNavigationSubtree($folderid, $showdocs=0, $orderby='') { /* {{{ */
+		$dms = $this->params['dms'];
+		$user = $this->params['user'];
+
+		$folder = $dms->getFolder($folderid);
+		if (!is_object($folder)) return '';
+		
+		$subfolders = $folder->getSubFolders($orderby);
+		$subfolders = SeedDMS_Core_DMS::filterAccess($subfolders, $user, M_READ);
+		$tree = array();
+		foreach($subfolders as $subfolder) {
+			$loadondemand = $subfolder->hasSubFolders() || ($subfolder->hasDocuments() && $showdocs);
+			$level = array('label'=>$subfolder->getName(), 'id'=>$subfolder->getID(), 'load_on_demand'=>$loadondemand, 'is_folder'=>true);
+			if(!$subfolder->hasSubFolders())
+				$level['children'] = array();
+			$tree[] = $level;
+		}
+		if($showdocs) {
+			$documents = $folder->getDocuments($orderby);
+			$documents = SeedDMS_Core_DMS::filterAccess($documents, $user, M_READ);
+			foreach($documents as $document) {
+				$level = array('label'=>$document->getName(), 'id'=>$document->getID(), 'load_on_demand'=>false, 'is_folder'=>false);
+				$tree[] = $level;
+			}
+		}
+
+		header('Content-Type: application/json');
+		echo json_encode($tree);
+	} /* }}} */
+
 	function printTreeNavigation($folderid, $showtree){ /* {{{ */
 		if ($showtree==1){
 			$this->contentHeading("<a href=\"../out/out.ViewFolder.php?folderid=". $folderid."&showtree=0\"><i class=\"icon-minus-sign\"></i></a>", true);