Merge branch 'seeddms-5.1.x' into seeddms-6.0.x

.gitignore

@@ -1,3 +1,4 @@
 *.tar.gz
 SeedDMS_*/*.tgz
 ext/*
+webapp/*

CHANGELOG

@@ -226,6 +226,9 @@
 - attributes of document version may be edited if enableVersionModification is true
   even if the document has been released, obsoleted or has been expired
 - reviews and approvals can be removed by admin
+- links are all created absolute based on _httpRoot instead of relative to
+  the current page. This fixes a potential security hole cased by malformed
+  links.
 
 --------------------------------------------------------------------------------
                      Changes in version 5.1.22

inc/inc.ClassViewCommon.php

@@ -263,7 +263,7 @@ class SeedDMS_View_Common {
 	 * @param string|array $name name of view or list of view names
 	 * @return boolean true if access is allowed otherwise false
 	 */
-	protected function check_access($name='') { /* {{{ */
+	protected function check_view_access($name='') { /* {{{ */
 		if(!$name)
 			$name = $this;
 		if(!isset($this->params['accessobject']))
@@ -288,8 +288,8 @@ class SeedDMS_View_Common {
 	 * @param array $urlparams list of url parameters
 	 * @return string $url
 	 */
-	protected function html_url($view='', $urlparams) { /* {{{ */
+	protected function html_url($view, $urlparams=array()) { /* {{{ */
-		$url = "../out/out.".$view.".php";
+		$url = $this->params['settings']->_httpRoot."out/out.".$view.".php";
 		if($urlparams)
 			$url .= "?".http_build_query($urlparams);
 		return $url;
@@ -309,7 +309,7 @@ class SeedDMS_View_Common {
 	 */
 	protected function html_link($view='', $urlparams=array(), $linkparams=array(), $link, $hsc=true, $nocheck=false, $wrap=array()) { /* {{{ */
 		if(!$nocheck)
-			if(!$this->check_access($view))
+			if(!$this->check_view_access($view))
 				return '';
 		$url = $this->html_url($view, $urlparams);
 		$tag = "<a href=\"".$url."\"";

views/bootstrap/class.ViewDocument.php

@@ -619,17 +619,17 @@ $(document).ready( function() {
 		$items = array();
 		if ($file_exists){
 			if($islatest && $accessobject->mayEditVersion($latestContent->getDocument())) {
-				$items[] = array('link'=>$this->params['settings']->_httpRoot."out/out.EditOnline.php?documentid=".$latestContent->getDocument()->getId()."&version=".$latestContent->getVersion(), 'icon'=>'edit', 'label'=>'edit_version');
+				$items[] = array('link'=>$this->html_url('EditOnline', array('documentid'=>$latestContent->getDocument()->getId(), 'version'=>$latestContent->getVersion())), 'icon'=>'edit', 'label'=>'edit_version');
 			}
 		}
 		/* Only admin has the right to remove version in any case or a regular
 		 * user if enableVersionDeletion is on
 		 */
 		if($accessobject->mayRemoveVersion($latestContent->getDocument())) {
-			$items[] = array('link'=>$this->params['settings']->_httpRoot."out/out.RemoveVersion.php?documentid=".$latestContent->getDocument()->getId()."&version=".$latestContent->getVersion(), 'icon'=>'remove', 'label'=>'rm_version');
+			$items[] = array('link'=>$this->html_url('RemoveVersion', array('documentid'=>$latestContent->getDocument()->getId(),'version'=>$latestContent->getVersion())), 'icon'=>'remove', 'label'=>'rm_version');
 		}
 		if($islatest && $accessobject->mayOverrideStatus($latestContent->getDocument())) {
-			$items[] = array('link'=>$this->params['settings']->_httpRoot."out/out.OverrideContentStatus.php?documentid=".$latestContent->getDocument()->getId()."&version=".$latestContent->getVersion(), 'icon'=>'align-justify', 'label'=>'change_status');
+			$items[] = array('link'=>$this->html_url('OverrideContentStatus', array('documentid'=>$latestContent->getDocument()->getId(),'version'=>$latestContent->getVersion())), 'icon'=>'align-justify', 'label'=>'change_status');
 		}
 		if($islatest && $enablereceiptworkflow && $accessobject->check_controller_access('SetRecipients'))
 			if($accessobject->maySetRecipients($latestContent->getDocument())) {
@@ -642,13 +642,13 @@ $(document).ready( function() {
 		if($workflowmode == 'traditional' || $workflowmode == 'traditional_only_approval') {
 			// Allow changing reviewers/approvals only if not reviewed
 			if($accessobject->maySetReviewersApprovers($latestContent->getDocument())) {
-				$items[] = array('link'=>$this->params['settings']->_httpRoot."out/out.SetReviewersApprovers.php?documentid=".$latestContent->getDocument()->getId()."&version=".$latestContent->getVersion(), 'icon'=>'edit', 'label'=>'change_assignments');
+				$items[] = array('link'=>$this->html_url('SetReviewersApprovers', array('documentid'=>$latestContent->getDocument()->getId(),'version'=>$latestContent->getVersion())), 'icon'=>'edit', 'label'=>'change_assignments');
 			}
 		} elseif($workflowmode == 'advanced') {
 			if($accessobject->maySetWorkflow($latestContent->getDocument())) {
 				$workflow = $latestContent->getWorkflow();
 				if(!$workflow) {
-					$items[] = array('link'=>$this->params['settings']->_httpRoot."out/out.SetWorkflow.php?documentid=".$latestContent->getDocument()->getId()."&version=".$latestContent->getVersion(), 'icon'=>'random', 'label'=>'set_workflow');
+					$items[] = array('link'=>$this->html_url('SetWorkflow', array('documentid'=>$latestContent->getDocument()->getId(),'version'=>$latestContent->getVersion())), 'icon'=>'random', 'label'=>'set_workflow');
 				}
 			}
 		}
@@ -659,14 +659,14 @@ $(document).ready( function() {
 			}
 		if($accessobject->check_view_access('EditComment'))
 			if($accessobject->mayEditComment($latestContent->getDocument())) {
-				$items[] = array('link'=>"out.EditComment.php?documentid=".$latestContent->getDocument()->getId()."&version=".$latestContent->getVersion(), 'icon'=>'comment', 'label'=>'edit_comment');
+				$items[] = array('link'=>$this->html_url('EditComment', array('documentid'=>$latestContent->getDocument()->getId(),'version'=>$latestContent->getVersion())), 'icon'=>'comment', 'label'=>'edit_comment');
 			}
 		if($accessobject->check_view_access('EditAttributes'))
 			if($accessobject->mayEditAttributes($latestContent->getDocument())) {
-				$items[] = array('link'=>"out.EditAttributes.php?documentid=".$latestContent->getDocument()->getId()."&version=".$latestContent->getVersion(), 'icon'=>'edit', 'label'=>'edit_attributes');
+				$items[] = array('link'=>$this->html_url('EditAttributes', array('documentid'=>$latestContent->getDocument()->getId(),'version'=>$latestContent->getVersion())), 'icon'=>'edit', 'label'=>'edit_attributes');
 			}
 		if(!$islatest)
-			$items[] = array('link'=>"out.DocumentVersionDetail.php?documentid=".$latestContent->getDocument()->getId()."&version=".$latestContent->getVersion(), 'icon'=>'info', 'label'=>'details');
+			$items[] = array('link'=>$this->html_url('DocumentVersionDetail', array('documentid'=>$latestContent->getDocument()->getId(),'version'=>$latestContent->getVersion())), 'icon'=>'info', 'label'=>'details');
 
 		if($newitems = $this->callHook('extraVersionActions', $latestContent))
 			$items = array_merge($items, $newitems);
@@ -1014,7 +1014,7 @@ $(document).ready( function() {
 						}
 					}
 					if($enableremoverevapp && $user->isAdmin() && ($r['status'] == 1 || $r['status'] == -1))
-						echo '<li><a href="'.$this->params['settings']->_httpRoot.'out/out.RemoveReviewLog.php?documentid='.$document->getID().'&version='.$latestContent->getVersion().'&reviewid='.$r['reviewID'].'" title="'.getMLText('remove_review_log').'"><i class="fa fa-remove"></i></a></li>';
+						echo '<li><a href="'.$this->html_url('RemoveReviewLog', array('documentid'=>$document->getID(), 'version'=>$latestContent->getVersion(), 'reviewid'=>$r['reviewID'])).'" title="'.getMLText('remove_review_log').'"><i class="fa fa-remove"></i></a></li>';
 	
 					print "</ul></td>\n";	
 					print "</tr>\n";
@@ -1120,7 +1120,7 @@ $(document).ready( function() {
 						}
 					}
 					if($enableremoverevapp && $user->isAdmin() && ($a['status'] == 1 || $a['status'] == -1))
-						echo '<li><a href="'.$this->params['settings']->_httpRoot.'out/out.RemoveApprovalLog.php?documentid='.$document->getID().'&version='.$latestContent->getVersion().'&approveid='.$a['approveID'].'" title="'.getMLText('remove_approval_log').'"><i class="fa fa-remove"></i></a></li>';
+						echo '<li><a href="'.$this->html_url('RemoveApprovalLog', array('documentid'=>$document->getID(), 'version'=>$latestContent->getVersion(), 'approveid'=>$a['approveID'])).'" title="'.getMLText('remove_approval_log').'"><i class="fa fa-remove"></i></a></li>';
 
 					print "</ul>";
 					print "</td>\n";
@@ -1175,9 +1175,9 @@ $(document).ready( function() {
 			$this->contentContainerStart();
 			if($user->isAdmin()) {
 				if(!$workflowstate || SeedDMS_Core_DMS::checkIfEqual($workflow->getInitState(), $workflowstate)) {
-					print "<form action=\"".$this->params['settings']->_httpRoot."out/out.RemoveWorkflowFromDocument.php\" method=\"get\"><input type=\"hidden\" name=\"documentid\" value=\"".$latestContent->getDocument()->getId()."\" /><input type=\"hidden\" name=\"version\" value=\"".$latestContent->getVersion()."\" /><button type=\"submit\" class=\"btn btn-danger\"><i class=\"fa fa-remove\"></i> ".getMLText('rm_workflow')."</button></form>";
+					print "<form action=\"".$this->html_url("RemoveWorkflowFromDocument")."\" method=\"get\"><input type=\"hidden\" name=\"documentid\" value=\"".$latestContent->getDocument()->getId()."\" /><input type=\"hidden\" name=\"version\" value=\"".$latestContent->getVersion()."\" /><button type=\"submit\" class=\"btn btn-danger\"><i class=\"fa fa-remove\"></i> ".getMLText('rm_workflow')."</button></form>";
 				} else {
-					print "<form action=\"".$this->params['settings']->_httpRoot."out/out.RewindWorkflow.php\" method=\"get\"><input type=\"hidden\" name=\"documentid\" value=\"".$latestContent->getDocument()->getId()."\" /><input type=\"hidden\" name=\"version\" value=\"".$latestContent->getVersion()."\" /><button type=\"submit\" class=\"btn btn-danger\"><i class=\"fa fa-refresh\"></i> ".getMLText('rewind_workflow')."</button></form>";
+					print "<form action=\"".$this->html_url("RewindWorkflow")."\" method=\"get\"><input type=\"hidden\" name=\"documentid\" value=\"".$latestContent->getDocument()->getId()."\" /><input type=\"hidden\" name=\"version\" value=\"".$latestContent->getVersion()."\" /><button type=\"submit\" class=\"btn btn-danger\"><i class=\"fa fa-refresh\"></i> ".getMLText('rewind_workflow')."</button></form>";
 				}
 			}
 
@@ -1277,7 +1277,7 @@ $(document).ready( function() {
 				echo "<td>";
 				if($latestContent->triggerWorkflowTransitionIsAllowed($user, $transition)) {
 					$action = $transition->getAction();
-					print "<form action=\"".$this->params['settings']->_httpRoot."out/out.TriggerWorkflow.php\" method=\"get\"><input type=\"hidden\" name=\"documentid\" value=\"".$latestContent->getDocument()->getId()."\" /><input type=\"hidden\" name=\"version\" value=\"".$latestContent->getVersion()."\" /><input type=\"hidden\" name=\"transition\" value=\"".$transition->getID()."\" /><input type=\"submit\" class=\"btn btn-primary\" value=\"".getMLText('action_'.strtolower($action->getName()), array(), htmlspecialchars($action->getName()))."\" /></form>";
+					print "<form action=\"".$this->html_url("TriggerWorkflow")."\" method=\"get\"><input type=\"hidden\" name=\"documentid\" value=\"".$latestContent->getDocument()->getId()."\" /><input type=\"hidden\" name=\"version\" value=\"".$latestContent->getVersion()."\" /><input type=\"hidden\" name=\"transition\" value=\"".$transition->getID()."\" /><input type=\"submit\" class=\"btn btn-primary\" value=\"".getMLText('action_'.strtolower($action->getName()), array(), htmlspecialchars($action->getName()))."\" /></form>";
 					$allowedtransitions[] = $transition;
 				}
 				echo "</td>";
@@ -1296,7 +1296,7 @@ $(document).ready( function() {
 					}
 				}
 				if($subworkflows) {
-					echo "<form class=\"form-inline\" action=\"".$this->params['settings']->_httpRoot."out/out.RunSubWorkflow.php\" method=\"get\"><input type=\"hidden\" name=\"documentid\" value=\"".$latestContent->getDocument()->getId()."\" /><input type=\"hidden\" name=\"version\" value=\"".$latestContent->getVersion()."\" />";
+					echo "<form class=\"form-inline\" action=\"".$this->html_url("RunSubWorkflow")."\" method=\"get\"><input type=\"hidden\" name=\"documentid\" value=\"".$latestContent->getDocument()->getId()."\" /><input type=\"hidden\" name=\"version\" value=\"".$latestContent->getVersion()."\" />";
 					echo "<select name=\"subworkflow\" class=\"form-control\">";
 					foreach($subworkflows as $subworkflow) {
 						echo "<option value=\"".$subworkflow->getID()."\">".htmlspecialchars($subworkflow->getName())."</option>";
@@ -1328,7 +1328,7 @@ $(document).ready( function() {
 						/* If the init state has not been left, return is always possible */
 						if($workflow->getInitState()->getID() == $latestContent->getWorkflowState()->getID()) {
 							echo "Initial state of sub workflow has not been left. Return to parent workflow is possible<br />";
-							echo "<form action=\"".$this->params['settings']->_httpRoot."out/out.ReturnFromSubWorkflow.php\" method=\"get\"><input type=\"hidden\" name=\"documentid\" value=\"".$latestContent->getDocument()->getId()."\" /><input type=\"hidden\" name=\"version\" value=\"".$latestContent->getVersion()."\" />";
+							echo "<form action=\"".$this->html_url("ReturnFromSubWorkflow")."\" method=\"get\"><input type=\"hidden\" name=\"documentid\" value=\"".$latestContent->getDocument()->getId()."\" /><input type=\"hidden\" name=\"version\" value=\"".$latestContent->getVersion()."\" />";
 							echo "<input type=\"submit\" class=\"btn btn-primary\" value=\"".getMLText('return_from_subworkflow')."\" />";
 							echo "</form>";
 						} else {
@@ -1343,7 +1343,7 @@ $(document).ready( function() {
 								foreach($transitions as $transition) {
 									if($latestContent->triggerWorkflowTransitionIsAllowed($user, $transition)) {
 										echo "Triggering transition is allowed<br />";
-										echo "<form action=\"".$this->params['settings']->_httpRoot."out/out.ReturnFromSubWorkflow.php\" method=\"get\"><input type=\"hidden\" name=\"documentid\" value=\"".$latestContent->getDocument()->getId()."\" /><input type=\"hidden\" name=\"version\" value=\"".$latestContent->getVersion()."\" /><input type=\"hidden\" name=\"transition\" value=\"".$transition->getID()."\" />";
+										echo "<form action=\"".$this->html_url("ReturnFromSubWorkflow")."\" method=\"get\"><input type=\"hidden\" name=\"documentid\" value=\"".$latestContent->getDocument()->getId()."\" /><input type=\"hidden\" name=\"version\" value=\"".$latestContent->getVersion()."\" /><input type=\"hidden\" name=\"transition\" value=\"".$transition->getID()."\" />";
 										echo "<input type=\"submit\" class=\"btn btn-primary\" value=\"".getMLText('return_from_subworkflow')."\" />";
 										echo "</form>";
 
@@ -1723,8 +1723,8 @@ $(document).ready( function() {
 				} else print "<li><img class=\"mimeicon\" src=\"images/icons/".$this->getMimeIcon($file->getFileType())."\" title=\"".htmlspecialchars($file->getMimeType())."\">";
 				echo "</ul><ul class=\"unstyled actions\">";
 				if (($document->getAccessMode($user) == M_ALL)||($file->getUserID()==$user->getID())) {
-					print "<li><a href=\"out.RemoveDocumentFile.php?documentid=".$documentid."&fileid=".$file->getID()."\"><i class=\"fa fa-remove\"></i>".getMLText("delete")."</a></li>";
+					print $this->html_link('RemoveDocumentFile', array('documentid'=>$document->getID(), 'fileid'=>$file->getID()), array(), '<i class="fa fa-remove"></i>'.getMLText("delete"), false, true, array('<li>', '</li>'));
-					print "<li><a href=\"out.EditDocumentFile.php?documentid=".$documentid."&fileid=".$file->getID()."\"><i class=\"fa fa-edit\"></i>".getMLText("edit")."</a></li>";
+					print $this->html_link('EditDocumentFile', array('documentid'=>$document->getID(), 'fileid'=>$file->getID()), array(), '<i class="fa fa-edit"></i>'.getMLText("edit"), false, true, array('<li>', '</li>'));
 				}
 				print "</ul></td>";		
 				
@@ -1739,7 +1739,7 @@ $(document).ready( function() {
 			if ($document->getAccessMode($user) >= M_READWRITE){
 				if(0){
 ?>
-			<div id="_draganddrophandler" class="droptarget well alert" data-droptarget="attachment_<?= $document->getID(); ?>" data-target="<?= $document->getID(); ?>" data-uploadformtoken="<?= createFormKey(''); ?>"><?php printMLText('drop_files_here'); ?><a href="<?= $this->params['settings']->_httpRoot ?>out/out.AddFile.php?documentid=<?= $documentid ?>"> <?= getMLText("add") ?></a></div>
+			<div id="_draganddrophandler" class="droptarget well alert" data-droptarget="attachment_<?= $document->getID(); ?>" data-target="<?= $document->getID(); ?>" data-uploadformtoken="<?= createFormKey(''); ?>"><?php printMLText('drop_files_here'); echo $this->html_link("AddFile", array('documentid'=>$document->getID()), array(), getMLText('add')); ?></div>
 <?php
 				}
 				print $this->html_link('AddFile', array('documentid'=>$documentid), array('class'=>'btn btn-primary'), getMLText("add"), false, true)."\n";

views/bootstrap/images/favicon.svg

@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   width="46.396889mm"
+   height="46.396889mm"
+   viewBox="0 0 46.396889 46.396888"
+   version="1.1"
+   id="svg2387">
+  <defs
+     id="defs2381" />
+  <metadata
+     id="metadata2384">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title></dc:title>
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     id="layer1"
+     transform="translate(-48.520586,-109.36103)">
+    <rect
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#000e7c;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:0;stroke-linecap:butt;stroke-linejoin:bevel;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       id="rect1143-3-6-4"
+       width="17.821022"
+       height="17.821022"
+       x="50.185322"
+       y="110.70477"
+       ry="3.1053059" />
+    <rect
+       ry="3.1053059"
+       y="127.37463"
+       x="67.362831"
+       height="17.821022"
+       width="17.821022"
+       id="use2251"
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#f57800;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:0;stroke-linecap:butt;stroke-linejoin:bevel;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       transform="rotate(7)" />
+    <rect
+       ry="3.1053059"
+       y="105.35081"
+       x="82.280334"
+       height="17.821022"
+       width="17.821022"
+       id="use2255"
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:0.9;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#f57800;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:0;stroke-linecap:butt;stroke-linejoin:bevel;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       transform="rotate(3.5)" />
+    <rect
+       ry="3.1053059"
+       y="117.91738"
+       x="100.07223"
+       height="17.821022"
+       width="17.821022"
+       id="use2257"
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:0.9;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#f57800;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:0;stroke-linecap:butt;stroke-linejoin:bevel;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       transform="rotate(10.5)" />
+  </g>
+</svg>

views/bootstrap/images/seeddms-logo.svg

@@ -0,0 +1,110 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   width="46.396889mm"
+   height="46.396889mm"
+   viewBox="0 0 46.396889 46.396888"
+   version="1.1"
+   id="svg2387"
+   inkscape:version="1.0.1 (3bc2e813f5, 2020-09-07)"
+   sodipodi:docname="seeddms-favicon-final.svg"
+   inkscape:export-filename="/tmp/favicon.png"
+   inkscape:export-xdpi="17.640476"
+   inkscape:export-ydpi="17.640476">
+  <defs
+     id="defs2381" />
+  <sodipodi:namedview
+     id="base"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageopacity="0.0"
+     inkscape:pageshadow="2"
+     inkscape:zoom="1.2215976"
+     inkscape:cx="-19.788292"
+     inkscape:cy="24.95827"
+     inkscape:document-units="mm"
+     inkscape:current-layer="layer1"
+     showgrid="false"
+     fit-margin-top="1"
+     fit-margin-left="1"
+     fit-margin-right="1"
+     fit-margin-bottom="1"
+     inkscape:window-width="1920"
+     inkscape:window-height="1023"
+     inkscape:window-x="0"
+     inkscape:window-y="33"
+     inkscape:window-maximized="1"
+     inkscape:document-rotation="0" />
+  <metadata
+     id="metadata2384">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title></dc:title>
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     inkscape:label="Ebene 1"
+     inkscape:groupmode="layer"
+     id="layer1"
+     transform="translate(-48.520586,-109.36103)">
+    <rect
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#000e7c;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:0;stroke-linecap:butt;stroke-linejoin:bevel;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       id="rect1143-3-6-4"
+       width="17.821022"
+       height="17.821022"
+       x="50.185322"
+       y="110.70477"
+       inkscape:tile-cx="-545.75183"
+       inkscape:tile-cy="425.55311"
+       inkscape:tile-w="17.821023"
+       inkscape:tile-h="17.821023"
+       inkscape:tile-x0="-554.66234"
+       inkscape:tile-y0="416.6426"
+       ry="3.1053059" />
+    <rect
+       ry="3.1053059"
+       inkscape:tile-y0="416.6426"
+       inkscape:tile-x0="-554.66234"
+       y="127.37463"
+       x="67.362831"
+       height="17.821022"
+       width="17.821022"
+       id="use2251"
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#f57800;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:0;stroke-linecap:butt;stroke-linejoin:bevel;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       transform="rotate(7)" />
+    <rect
+       ry="3.1053059"
+       inkscape:tile-y0="416.6426"
+       inkscape:tile-x0="-554.66234"
+       y="105.35081"
+       x="82.280334"
+       height="17.821022"
+       width="17.821022"
+       id="use2255"
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:0.9;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#f57800;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:0;stroke-linecap:butt;stroke-linejoin:bevel;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       transform="rotate(3.5)" />
+    <rect
+       ry="3.1053059"
+       inkscape:tile-y0="416.6426"
+       inkscape:tile-x0="-554.66234"
+       y="117.91738"
+       x="100.07223"
+       height="17.821022"
+       width="17.821022"
+       id="use2257"
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:0.9;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#f57800;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:0;stroke-linecap:butt;stroke-linejoin:bevel;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       transform="rotate(10.5)" />
+  </g>
+</svg>

views/bootstrap/styles/application.css

@@ -0,0 +1,467 @@
+@media (min-width: 980px) { 
+	body { /* Add top padding for full-width layout */
+		padding-top: 60px;
+	}
+}
+#login_wrapper {
+	margin: auto auto;
+	width: 460px;
+}
+.navbar img {
+	height: 1.93rem;
+	float: left;
+	padding-top: 5px;
+	padding-right: 5px;
+}
+@media (max-width: 767px) { 
+	.navbar img {
+		padding-left: 10px;
+	}
+	#login_wrapper {
+		width: 100%;
+	}
+}
+img.mimeicon {
+  -moz-border-bottom-colors: none;
+  -moz-border-image: none;
+  -moz-border-left-colors: none;
+  -moz-border-right-colors: none;
+  -moz-border-top-colors: none;
+  border-color: #CCCCCC #AAAAAA #999999 #CCCCCC;
+  border-style: solid;
+  border-width: 1px 2px 2px 1px;
+	background-color: white;
+	max-width: 100%;
+	min-width: 60px;
+}
+
+span.list-details {
+	font-size: 85%;
+	font-style: italic;
+	color: #666;
+}
+
+.list-action a {
+	text-decoration: none;
+	color: #333;
+	padding: 2px;
+	cursor: pointer;
+	font-size: 110%;
+}
+
+ul.action-list li a {
+	padding-top: 4px;
+	padding-bottom: 4px;
+}
+
+#admin-tools i {
+	font-size: 300%;
+	line-height: 110%;
+/*	min-height: 100px; */
+}
+
+#admin-tools a {
+	margin-bottom: 10px;
+}
+
+ul.unstyled li a:hover > i {
+	text-decoration: none;
+	padding-left: 0px;
+}
+ul.unstyled li a > i {
+	color: #000;
+	margin-right: 5px;
+}
+ul.unstyled li a.btn > i {
+	font-size: 200%;
+}
+
+ul.tree, ul.tree ul {
+	margin-left: 20px;
+}
+
+ul.jqtree-tree li.jqtree-selected > .jqtree-element,
+ul.jqtree-tree li.jqtree-selected > .jqtree-element:hover {
+    background-color: #fff;
+    background: none;
+    text-shadow: none;
+		font-weight: bold;
+}
+
+legend > span {
+	float: right;
+}
+
+td.today {
+	background-color: rgb(255, 200, 0);
+}
+
+td.event {
+	background-color: rgb(0, 200, 255);
+}
+
+.wordbreak {
+	word-break: break-word;
+}
+
+.btn-file {
+	position: relative;
+	overflow: hidden;
+}
+.btn-file input[type=file] {
+	position: absolute;
+	top: 0;
+	right: 0;
+	min-width: 100%;
+	min-height: 100%;
+	font-size: 999px;
+	text-align: right;
+	filter: alpha(opacity=0);
+	opacity: 0;
+	background: red;
+	cursor: inherit;
+	display: block;
+}
+input[readonly] {
+	background-color: white !important;
+	cursor: text !important;
+}
+
+div.mandatories {
+	font-size: 90%;
+	font-style: italic;
+	color: #888;
+}
+div.mandatories span {
+	font-weight: bold;
+}
+
+div.statusbar {
+	font-size: 80%;
+}
+div.statusbar div.filename {
+	display: inline-block;
+}
+div.statusbar div.filesize {
+	display: inline-block;
+	float: right;
+}
+div.statusbar div.progress {
+	margin-bottom: 10px;
+}
+div.statusbar a.btn {
+	margin-bottom: 10px;
+}
+
+#database .chosen-container,
+#fulltext .chosen-container {
+	width: 95% !important;
+}
+
+.chosen-container-multi .chosen-choices {
+	border: 1px solid #cccccc;
+	border-radius: 4px;
+	box-shadow: inset 0 1px 1px rgba(0, 0, 0, 0.075);
+	transition: border linear 0.2s, box-shadow linear 0.2s;
+	padding: 2px 6px;
+	height: 20px;
+}
+
+div.help h1 {
+	font-size: 24px;
+}
+
+div.help h2 {
+	font-size: 18px;
+}
+
+div.help h3 {
+	font-size: 16px;
+}
+
+#dropfolderChooser {
+	width: 60%;
+	left: 20%;
+	margin-left: auto;
+	margin-right: auto;
+}
+
+div.splash {
+	display: none;
+}
+
+div.clipboard-container {
+	position: fixed;
+	left: 10px;
+	top: 40px;
+	width: 29.8%;
+	min-width: 200px;
+	background: white;
+	border: 1px solid #d4d4d4;
+	border-radius: 5px;
+	padding: 10px;
+	max-height: 400px;
+	margin: 10px;
+	overflow-y: auto;
+	overflow-x: hidden;
+	z-index: 1;
+}
+div.clipboard-container legend {
+	display: none;
+}
+
+div.statusbar-container {
+	display: none;
+	position: fixed;
+	right:10px;
+	top:60px;
+	width:300px;
+	padding:10px;
+	background-color: white;
+	border: 1px solid #E0E0E0;
+	border-radius: 4px;
+	z-index: 10;
+	overflow-y: scroll;
+	max-height: calc(100% - 100px);
+}
+div.statusbar-container::-webkit-scrollbar {
+	width: 5px;
+}
+div.statusbar-container::-webkit-scrollbar-track {
+	-webkit-box-shadow: inset 0 0 6px rgba(0,0,0,0.3);
+	border-radius: 10px;
+}
+
+div.statusbar-container::-webkit-scrollbar-thumb {
+	border-radius: 10px;
+	-webkit-box-shadow: inset 0 0 6px rgba(0,0,0,0.5);
+}
+
+div.statusbar-container h1 {
+	font-size: 21px;
+	line-height: 40px;
+	color: #333333;
+	font-weight: normal;
+}
+
+ul.jqtree-tree li.jqtree_common > .jqtree-element:hover {
+    background-color: #E0E0E0;
+}
+
+span.datepicker {
+	padding: 0px;
+}
+span.datepicker input {
+	max-width: 100px;
+}
+/* Sidenav for Docs
+ * -------------------------------------------------- */
+
+.bs-docs-sidenav {
+	width: 100%;
+	margin: 0px 0 30px 0;
+	padding: 0;
+	background-color: #fff;
+	-webkit-border-radius: 6px;
+	-moz-border-radius: 6px;
+	border-radius: 6px;
+	-webkit-box-shadow: 0 1px 4px rgba(0,0,0,.065);
+	-moz-box-shadow: 0 1px 4px rgba(0,0,0,.065);
+	box-shadow: 0 1px 4px rgba(0,0,0,.065);
+}
+.bs-docs-sidenav > li > a {
+	display: block;
+	width: 190px \9;
+	margin: 0 0 -1px;
+	padding: 8px 14px;
+	border: 1px solid #e5e5e5;
+}
+.bs-docs-sidenav > li:first-child > a {
+	-webkit-border-radius: 6px 6px 0 0;
+	-moz-border-radius: 6px 6px 0 0;
+	border-radius: 6px 6px 0 0;
+}
+.bs-docs-sidenav > li:last-child > a {
+	-webkit-border-radius: 0 0 6px 6px;
+	-moz-border-radius: 0 0 6px 6px;
+	border-radius: 0 0 6px 6px;
+}
+.bs-docs-sidenav > .active > a {
+	position: relative;
+	z-index: 2;
+	padding: 9px 15px;
+	border: 0;
+	text-shadow: 0 1px 0 rgba(0,0,0,.15);
+	-webkit-box-shadow: inset 1px 0 0 rgba(0,0,0,.1), inset -1px 0 0 rgba(0,0,0,.1);
+	-moz-box-shadow: inset 1px 0 0 rgba(0,0,0,.1), inset -1px 0 0 rgba(0,0,0,.1);
+	box-shadow: inset 1px 0 0 rgba(0,0,0,.1), inset -1px 0 0 rgba(0,0,0,.1);
+}
+/* Chevrons */
+.bs-docs-sidenav .badge-right {
+	float: right;
+	margin-top: 2px;
+	margin-right: -6px;
+}
+.bs-docs-sidenav > li > a:hover {
+	background-color: #f5f5f5;
+}
+.bs-docs-sidenav a:hover .icon-chevron-right {
+	opacity: .5;
+}
+.bs-docs-sidenav .active .icon-chevron-right,
+.bs-docs-sidenav .active a:hover .icon-chevron-right {
+	background-image: url(../img/glyphicons-halflings-white.png);
+	opacity: 1;
+}
+.bs-docs-sidenav.affix {
+	top: 100px;
+}
+.bs-docs-sidenav.affix-bottom {
+	position: absolute;
+	top: auto;
+	bottom: 270px;
+}
+
+i.success {color: #00b000;}
+i.enabled {color: #00b000;}
+i.error {color: #b00000;}
+i.disabled {color: #b00000;}
+i.warning {color: #ff9900;}
+i.initstate {color: #ff9900;}
+i.released {color: #00b000;}
+i.rejected {color: #b00000;}
+i.in-workflow {color: #11479e;}
+i.workflow-action {color: #91479e;}
+i.selected {border: 1px solid #d4d4d4;padding:3px;border-radius:3px;background-color:#fafafa;background-image: linear-gradient(to bottom, #ffffff, #f2f2f2);}
+
+span.editable:after {
+	font: normal normal normal 14px/1 FontAwesome;
+	content: " \f044";
+}
+
+span.openpopupbox {
+	cursor: pointer;
+}
+
+div.popupbox {
+	margin-top: 5px;
+	background-color: #fff;
+	border-radius: 4px;
+	color: black;
+	text-align: left;
+	text-shadow: none;
+	border: 1px solid #ccc;
+	padding: 25px 15px 15px 15px;
+	display: none;
+	position: absolute;
+	min-width: 230px;
+	z-index: 10;
+}
+
+div.popupbox dt {
+	font-weight: normal;
+	font-size: 80%;
+}
+
+div.popupbox dd {
+	margin-left: 0px;
+	margin-bottom: 5px;
+}
+
+div.popupbox span.closepopupbox {
+	position: absolute;
+	right: 5px;
+	top: 0px;
+}
+
+ul.qq-upload-list {
+	/*
+	background-color: #fff;
+	border-radius: 4px;
+	border: 1px solid #cccccc;
+	*/
+}
+
+ul.qq-upload-list li {
+	display: inline-block;
+	margin: 5px 5px 5px 0;
+	padding: 5px;
+	background-color: #fff;
+	border: 1px solid #cccccc;
+	border-radius: 4px;
+}
+
+ul.qq-upload-list li img {
+	display: block;
+}
+
+ul.qq-upload-list li span {
+	display: block;
+}
+
+.qq-upload-button {
+	display: inline-block;
+}
+
+.qq-upload-drop-area {
+	display: inline-block;
+	width: 200px;
+	height: 22px;
+	padding: 3px;
+	background-color: #fff;
+	border: 1px solid #cccccc;
+	border-radius: 4px;
+}
+.qq-hide, .qq-uploader dialog {
+	display: none;
+}
+
+@media (min-width: 1200px) {
+	.modal-wide {
+		width: 800px;
+		margin-left: -400px;
+	}
+}
+
+@media (max-width: 480px) { 
+    .nav-tabs > li {
+        float:none;
+    }
+    .nav-tabs > li > a {
+        margin-right: 0;
+    }
+
+    .nav-tabs {
+        border-bottom: 0;
+    }
+
+    .nav-tabs > li > a {
+        border: 1px solid #ddd;
+        -webkit-border-radius: 0;
+            -moz-border-radius: 0;
+                border-radius: 0;
+    }
+
+    .nav-tabs > li:first-child > a {
+  -webkit-border-top-right-radius: 4px;
+          border-top-right-radius: 4px;
+  -webkit-border-top-left-radius: 4px;
+          border-top-left-radius: 4px;
+  -moz-border-radius-topright: 4px;
+  -moz-border-radius-topleft: 4px;
+    }
+
+    .nav-tabs > li:last-child > a {
+  -webkit-border-bottom-right-radius: 4px;
+          border-bottom-right-radius: 4px;
+  -webkit-border-bottom-left-radius: 4px;
+          border-bottom-left-radius: 4px;
+  -moz-border-radius-bottomright: 4px;
+  -moz-border-radius-bottomleft: 4px;
+    }
+
+    .nav-tabs > li > a:hover {
+  z-index: 2;
+  border-color: #ddd;
+    }
+}