From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)

---
 program/js/app.js | 3155 +++++++++++++++++++++++++++++++++++++----------------------
 1 files changed, 1,962 insertions(+), 1,193 deletions(-)

diff --git a/program/js/app.js b/program/js/app.js
index 52b3f60..77ec9d9 100644
--- a/program/js/app.js
+++ b/program/js/app.js
@@ -3,9 +3,12 @@
  | Roundcube Webmail Client Script                                       |
  |                                                                       |
  | This file is part of the Roundcube Webmail client                     |
- | Copyright (C) 2005-2011, The Roundcube Dev Team                       |
- | Copyright (C) 2011, Kolab Systems AG                                  |
- | Licensed under the GNU GPL                                            |
+ | Copyright (C) 2005-2013, The Roundcube Dev Team                       |
+ | Copyright (C) 2011-2013, Kolab Systems AG                             |
+ |                                                                       |
+ | Licensed under the GNU General Public License version 3 or            |
+ | any later version with exceptions for skins & plugins.                |
+ | See the README file for a full license statement.                     |
  |                                                                       |
  +-----------------------------------------------------------------------+
  | Authors: Thomas Bruederli <roundcube@gmail.com>                       |
@@ -14,13 +17,10 @@
  +-----------------------------------------------------------------------+
  | Requires: jquery.js, common.js, list.js                               |
  +-----------------------------------------------------------------------+
-
-  $Id$
 */
 
 function rcube_webmail()
 {
-  this.env = {};
   this.labels = {};
   this.buttons = {};
   this.buttons_sel = {};
@@ -30,30 +30,37 @@
   this.command_handlers = {};
   this.onloads = [];
   this.messages = {};
+  this.group2expand = {};
+
+  // webmail client settings
+  this.dblclick_time = 500;
+  this.message_time = 4000;
+  this.identifier_expr = new RegExp('[^0-9a-z\-_]', 'gi');
+
+  // environment defaults
+  this.env = {
+    request_timeout: 180,  // seconds
+    draft_autosave: 0,     // seconds
+    comm_path: './',
+    blankpage: 'program/resources/blank.gif',
+    recipients_separator: ',',
+    recipients_delimiter: ', '
+  };
 
   // create protected reference to myself
   this.ref = 'rcmail';
   var ref = this;
 
-  // webmail client settings
-  this.dblclick_time = 500;
-  this.message_time = 2000;
-
-  this.identifier_expr = new RegExp('[^0-9a-z\-_]', 'gi');
-
-  // default environment vars
-  this.env.keep_alive = 60;        // seconds
-  this.env.request_timeout = 180;  // seconds
-  this.env.draft_autosave = 0;     // seconds
-  this.env.comm_path = './';
-  this.env.blankpage = 'program/blank.gif';
-
   // set jQuery ajax options
   $.ajaxSetup({
-    cache:false,
-    error:function(request, status, err){ ref.http_error(request, status, err); },
-    beforeSend:function(xmlhttp){ xmlhttp.setRequestHeader('X-Roundcube-Request', ref.env.request_token); }
+    cache: false,
+    timeout: this.env.request_timeout * 1000,
+    error: function(request, status, err){ ref.http_error(request, status, err); },
+    beforeSend: function(xmlhttp){ xmlhttp.setRequestHeader('X-Roundcube-Request', ref.env.request_token); }
   });
+
+  // unload fix
+  $(window).bind('beforeunload', function() { rcmail.unload = true; });
 
   // set environment variable(s)
   this.set_env = function(p, value)
@@ -77,13 +84,14 @@
   // add a button to the button list
   this.register_button = function(command, id, type, act, sel, over)
   {
-    if (!this.buttons[command])
-      this.buttons[command] = [];
-
     var button_prop = {id:id, type:type};
+
     if (act) button_prop.act = act;
     if (sel) button_prop.sel = sel;
     if (over) button_prop.over = over;
+
+    if (!this.buttons[command])
+      this.buttons[command] = [];
 
     this.buttons[command].push(button_prop);
 
@@ -128,22 +136,38 @@
   // initialize webmail client
   this.init = function()
   {
-    var p = this;
+    var n, p = this;
     this.task = this.env.task;
 
     // check browser
-    if (!bw.dom || !bw.xmlhttp_test()) {
+    if (!bw.dom || !bw.xmlhttp_test() || (bw.mz && bw.vendver < 1.9)) {
       this.goto_url('error', '_code=0x199');
       return;
     }
 
     // find all registered gui containers
-    for (var n in this.gui_containers)
+    for (n in this.gui_containers)
       this.gui_containers[n] = $('#'+this.gui_containers[n]);
 
     // find all registered gui objects
-    for (var n in this.gui_objects)
+    for (n in this.gui_objects)
       this.gui_objects[n] = rcube_find_object(this.gui_objects[n]);
+
+    // clickjacking protection
+    if (this.env.x_frame_options) {
+      try {
+        // bust frame if not allowed
+        if (this.env.x_frame_options == 'deny' && top.location.href != self.location.href)
+          top.location.href = self.location.href;
+        else if (top.location.hostname != self.location.hostname)
+          throw 1;
+      } catch (e) {
+        // possible clickjacking attack: disable all form elements
+        $('form').each(function(){ ref.lock_form(this, true); });
+        this.display_message("Blocked: possible clickjacking attack!", 'error');
+        return;
+      }
+    }
 
     // init registered buttons
     this.init_buttons();
@@ -155,10 +179,10 @@
     }
 
     // enable general commands
-    this.enable_command('logout', 'mail', 'addressbook', 'settings', 'save-pref', 'compose', 'undo', true);
+    this.enable_command('close', 'logout', 'mail', 'addressbook', 'settings', 'save-pref', 'compose', 'undo', 'about', 'switch-task', true);
 
     if (this.env.permaurl)
-      this.enable_command('permaurl', true);
+      this.enable_command('permaurl', 'extwin', true);
 
     switch (this.task) {
 
@@ -167,7 +191,6 @@
         this.enable_command('list', 'checkmail', 'add-contact', 'search', 'reset-search', 'collapse-folder', true);
 
         if (this.gui_objects.messagelist) {
-
           this.message_list = new rcube_list_widget(this.gui_objects.messagelist, {
             multiselect:true, multiexpand:true, draggable:true, keyboard:true,
             column_movable:this.env.col_movable, dblclick_time:this.dblclick_time
@@ -187,32 +210,31 @@
           this.gui_objects.messagelist.parentNode.onmousedown = function(e){ return p.click_on_list(e); };
 
           this.message_list.init();
-          this.enable_command('toggle_status', 'toggle_flag', 'menu-open', 'menu-save', true);
+          this.enable_command('toggle_status', 'toggle_flag', 'menu-open', 'menu-save', 'sort', true);
 
           // load messages
           this.command('list');
         }
 
         if (this.gui_objects.qsearchbox) {
-          if (this.env.search_text != null) {
+          if (this.env.search_text != null)
             this.gui_objects.qsearchbox.value = this.env.search_text;
-          }
-          $(this.gui_objects.qsearchbox).focusin(function() { rcmail.message_list.blur(); });
+          $(this.gui_objects.qsearchbox).focusin(function() { rcmail.message_list && rcmail.message_list.blur(); });
         }
 
-        if (!this.env.flag_for_deletion && this.env.trash_mailbox && this.env.mailbox != this.env.trash_mailbox)
-          this.set_alttext('delete', 'movemessagetotrash');
+        this.set_button_titles();
 
-        this.env.message_commands = ['show', 'reply', 'reply-all', 'reply-list', 'forward',
-          'moveto', 'copy', 'delete', 'open', 'mark', 'edit', 'viewsource', 'download',
-          'print', 'load-attachment', 'load-headers', 'forward-attachment'];
+        this.env.message_commands = ['show', 'reply', 'reply-all', 'reply-list',
+          'moveto', 'copy', 'delete', 'open', 'mark', 'edit', 'viewsource',
+          'print', 'load-attachment', 'show-headers', 'hide-headers', 'download',
+          'forward', 'forward-inline', 'forward-attachment'];
 
-        if (this.env.action=='show' || this.env.action=='preview') {
+        if (this.env.action == 'show' || this.env.action == 'preview') {
           this.enable_command(this.env.message_commands, this.env.uid);
           this.enable_command('reply-list', this.env.list_post);
 
           if (this.env.action == 'show') {
-            this.http_request('pagenav', '_uid='+this.env.uid+'&_mbox='+urlencode(this.env.mailbox),
+            this.http_request('pagenav', {_uid: this.env.uid, _mbox: this.env.mailbox, _search: this.env.search_request},
               this.display_message('', 'loading'));
           }
 
@@ -229,19 +251,21 @@
           }
         }
         else if (this.env.action == 'compose') {
-          this.env.compose_commands = ['send-attachment', 'remove-attachment', 'send', 'cancel', 'toggle-editor'];
+          this.env.address_group_stack = [];
+          this.env.compose_commands = ['send-attachment', 'remove-attachment', 'send', 'cancel', 'toggle-editor', 'list-adresses', 'pushgroup', 'search', 'reset-search', 'extwin'];
 
           if (this.env.drafts_mailbox)
             this.env.compose_commands.push('savedraft')
 
           this.enable_command(this.env.compose_commands, 'identities', true);
 
+          // add more commands (not enabled)
+          $.merge(this.env.compose_commands, ['add-recipient', 'firstpage', 'previouspage', 'nextpage', 'lastpage']);
+
           if (this.env.spellcheck) {
-            this.env.spellcheck.spelling_state_observer = function(s){ ref.set_spellcheck_state(s); };
+            this.env.spellcheck.spelling_state_observer = function(s) { ref.spellcheck_state(); };
             this.env.compose_commands.push('spellcheck')
-            this.set_spellcheck_state('ready');
-            if ($("input[name='_is_html']").val() == '1')
-              this.display_spellcheck_controls(false);
+            this.enable_command('spellcheck', true);
           }
 
           document.onmouseup = function(e){ return p.doc_mouse_up(e); };
@@ -252,7 +276,7 @@
         // show printing dialog
         else if (this.env.action == 'print' && this.env.uid)
           if (bw.safari)
-            window.setTimeout('window.print()', 10);
+            setTimeout('window.print()', 10);
           else
             window.print();
 
@@ -260,26 +284,50 @@
         if (this.gui_objects.mailboxlist) {
           this.env.unread_counts = {};
           this.gui_objects.folderlist = this.gui_objects.mailboxlist;
-          this.http_request('getunread', '');
+          this.http_request('getunread');
+        }
+
+        // init address book widget
+        if (this.gui_objects.contactslist) {
+          this.contact_list = new rcube_list_widget(this.gui_objects.contactslist,
+            { multiselect:true, draggable:false, keyboard:false });
+          this.contact_list.addEventListener('select', function(o){ ref.compose_recipient_select(o); });
+          this.contact_list.addEventListener('dblclick', function(o){ ref.compose_add_recipient('to'); });
+          this.contact_list.init();
+        }
+
+        if (this.gui_objects.addressbookslist) {
+          this.gui_objects.folderlist = this.gui_objects.addressbookslist;
+          this.enable_command('list-adresses', true);
         }
 
         // ask user to send MDN
         if (this.env.mdn_request && this.env.uid) {
-          var mdnurl = '_uid='+this.env.uid+'&_mbox='+urlencode(this.env.mailbox);
-          if (confirm(this.get_label('mdnrequest')))
-            this.http_post('sendmdn', mdnurl);
-          else
-            this.http_post('mark', mdnurl+'&_flag=mdnsent');
+          var postact = 'sendmdn',
+            postdata = {_uid: this.env.uid, _mbox: this.env.mailbox};
+          if (!confirm(this.get_label('mdnrequest'))) {
+            postdata._flag = 'mdnsent';
+            postact = 'mark';
+          }
+          this.http_post(postact, postdata);
         }
+
+        // detect browser capabilities
+        if (!this.is_framed() && !this.env.extwin)
+          this.browser_capabilities_check();
 
         break;
 
       case 'addressbook':
+        this.env.address_group_stack = [];
+
         if (this.gui_objects.folderlist)
           this.env.contactfolders = $.extend($.extend({}, this.env.address_sources), this.env.contactgroups);
 
-        if (this.gui_objects.contactslist) {
+        this.enable_command('add', 'import', this.env.writable_source);
+        this.enable_command('list', 'listgroup', 'pushgroup', 'popgroup', 'listsearch', 'advanced-search', true);
 
+        if (this.gui_objects.contactslist) {
           this.contact_list = new rcube_list_widget(this.gui_objects.contactslist,
             {multiselect:true, draggable:this.gui_objects.folderlist?true:false, keyboard:true});
           this.contact_list.row_init = function(row){ p.triggerEvent('insertrow', { cid:row.uid, row:row }); };
@@ -295,11 +343,11 @@
 
           this.gui_objects.contactslist.parentNode.onmousedown = function(e){ return p.click_on_list(e); };
           document.onmouseup = function(e){ return p.doc_mouse_up(e); };
-          if (this.gui_objects.qsearchbox) {
+          if (this.gui_objects.qsearchbox)
             $(this.gui_objects.qsearchbox).focusin(function() { rcmail.contact_list.blur(); });
-          }
 
           this.update_group_commands();
+          this.command('list');
         }
 
         this.set_page_buttons();
@@ -316,24 +364,14 @@
 
         if (this.gui_objects.editform) {
           this.enable_command('save', true);
-          if (this.env.action == 'add' || this.env.action == 'edit')
+          if (this.env.action == 'add' || this.env.action == 'edit' || this.env.action == 'search')
               this.init_contact_form();
         }
-        if (this.gui_objects.qsearchbox) {
+
+        if (this.gui_objects.qsearchbox)
           this.enable_command('search', 'reset-search', 'moveto', true);
-        }
 
-        if (this.contact_list && this.contact_list.rowcount > 0)
-          this.enable_command('export', true);
-
-        this.enable_command('add', 'import', this.env.writable_source);
-        this.enable_command('list', 'listgroup', 'listsearch', 'advanced-search', true);
-
-        // load contacts of selected source
-        if (!this.env.action)
-          this.command('list', this.env.source);
         break;
-
 
       case 'settings':
         this.enable_command('preferences', 'identities', 'save', 'folders', true);
@@ -342,15 +380,18 @@
           this.enable_command('add', this.env.identities_level < 2);
         }
         else if (this.env.action == 'edit-identity' || this.env.action == 'add-identity') {
-          this.enable_command('add', this.env.identities_level < 2);
-          this.enable_command('save', 'delete', 'edit', 'toggle-editor', true);
+          this.enable_command('save', 'edit', 'toggle-editor', true);
+          this.enable_command('delete', this.env.identities_level < 2);
+
+          if (this.env.action == 'add-identity')
+            $("input[type='text']").first().select();
         }
         else if (this.env.action == 'folders') {
           this.enable_command('subscribe', 'unsubscribe', 'create-folder', 'rename-folder', true);
         }
         else if (this.env.action == 'edit-folder' && this.gui_objects.editform) {
           this.enable_command('save', 'folder-size', true);
-          parent.rcmail.env.messagecount = this.env.messagecount;
+          parent.rcmail.env.exists = this.env.messagecount;
           parent.rcmail.enable_command('purge', this.env.messagecount);
           $("input[type='text']").first().select();
         }
@@ -385,20 +426,29 @@
           $('#rcmloginpwd').focus();
 
         // detect client timezone
-        $('#rcmlogintz').val(new Date().getTimezoneOffset() / -60);
+        if (window.jstz && !bw.ie6) {
+          var timezone = jstz.determine();
+          if (timezone.name())
+            $('#rcmlogintz').val(timezone.name());
+        }
+        else {
+          $('#rcmlogintz').val(new Date().getStdTimezoneOffset() / -60);
+        }
 
         // display 'loading' message on form submit, lock submit button
         $('form').submit(function () {
           $('input[type=submit]', this).prop('disabled', true);
+          rcmail.clear_messages();
           rcmail.display_message('', 'loading');
         });
 
         this.enable_command('login', true);
         break;
+    }
 
-      default:
-        break;
-      }
+    // unset contentframe variable if preview_pane is enabled
+    if (this.env.contentframe && !$('#' + this.env.contentframe).is(':visible'))
+      this.env.contentframe = null;
 
     // prevent from form submit with Enter key in file input fields
     if (bw.ie)
@@ -412,8 +462,29 @@
       this.display_message(this.pending_message[0], this.pending_message[1], this.pending_message[2]);
 
     // map implicit containers
-    if (this.gui_objects.folderlist)
+    if (this.gui_objects.folderlist) {
       this.gui_containers.foldertray = $(this.gui_objects.folderlist);
+
+      // init treelist widget
+      if (window.rcube_treelist_widget) {
+        this.treelist = new rcube_treelist_widget(this.gui_objects.folderlist, {
+          id_prefix: 'rcmli',
+          id_encode: this.html_identifier_encode,
+          id_decode: this.html_identifier_decode,
+          check_droptarget: function(node){ return !node.virtual && ref.check_droptarget(node.id) }
+        });
+        this.treelist.addEventListener('collapse', function(node){ ref.folder_collapsed(node) });
+        this.treelist.addEventListener('expand', function(node){ ref.folder_collapsed(node) });
+      }
+    }
+
+    // activate html5 file drop feature (if browser supports it and if configured)
+    if (this.gui_objects.filedrop && this.env.filedrop && ((window.XMLHttpRequest && XMLHttpRequest.prototype && XMLHttpRequest.prototype.sendAsBinary) || window.FormData)) {
+      $(document.body).bind('dragover dragleave drop', function(e){ return ref.document_drag_hover(e, e.type == 'dragover'); });
+      $(this.gui_objects.filedrop).addClass('droptarget')
+        .bind('dragover dragleave', function(e){ return ref.file_drag_hover(e, e.type == 'dragover'); })
+        .get(0).addEventListener('drop', function(e){ return ref.file_dropped(e); }, false);
+    }
 
     // trigger init event hook
     this.triggerEvent('init', { task:this.task, action:this.env.action });
@@ -427,7 +498,8 @@
         this.onloads[i]();
       }
 
-    // start keep-alive interval
+    // start keep-alive and refresh intervals
+    this.start_refresh();
     this.start_keepalive();
   };
 
@@ -442,13 +514,20 @@
   /*********************************************************/
 
   // execute a specific command on the web client
-  this.command = function(command, props, obj)
+  this.command = function(command, props, obj, event)
   {
+    var ret, uid, cid, url, flag;
+
     if (obj && obj.blur)
       obj.blur();
 
     if (this.busy)
       return false;
+
+    // let the browser handle this click (shift/ctrl usually opens the link in a new window/tab)
+    if ((obj && obj.href && String(obj.href).indexOf('#') < 0) && rcube_event.get_modifier(event)) {
+      return true;
+    }
 
     // command not supported or allowed
     if (!this.commands[command]) {
@@ -460,31 +539,33 @@
     }
 
     // check input before leaving compose step
-    if (this.task=='mail' && this.env.action=='compose' && $.inArray(command, this.env.compose_commands)<0) {
+    if (this.task == 'mail' && this.env.action == 'compose' && $.inArray(command, this.env.compose_commands)<0) {
       if (this.cmp_hash != this.compose_field_hash() && !confirm(this.get_label('notsentwarning')))
         return false;
     }
 
     // process external commands
     if (typeof this.command_handlers[command] === 'function') {
-      var ret = this.command_handlers[command](props, obj);
+      ret = this.command_handlers[command](props, obj);
       return ret !== undefined ? ret : (obj ? false : true);
     }
     else if (typeof this.command_handlers[command] === 'string') {
-      var ret = window[this.command_handlers[command]](props, obj);
+      ret = window[this.command_handlers[command]](props, obj);
       return ret !== undefined ? ret : (obj ? false : true);
     }
 
     // trigger plugin hooks
     this.triggerEvent('actionbefore', {props:props, action:command});
-    var ret = this.triggerEvent('before'+command, props);
+    ret = this.triggerEvent('before'+command, props);
     if (ret !== undefined) {
-      // abort if one the handlers returned false
+      // abort if one of the handlers returned false
       if (ret === false)
         return false;
       else
         props = ret;
     }
+
+    ret = undefined;
 
     // process internal command
     switch (command) {
@@ -502,11 +583,28 @@
         this.switch_task(command);
         break;
 
+      case 'about':
+        this.redirect('?_task=settings&_action=about', false);
+        break;
+
       case 'permaurl':
         if (obj && obj.href && obj.target)
           return true;
         else if (this.env.permaurl)
           parent.location.href = this.env.permaurl;
+        break;
+
+      case 'extwin':
+        if (this.env.action == 'compose') {
+          var prevstate = this.env.compose_extwin;
+          $("input[name='_action']", this.gui_objects.messageform).val('compose');
+          this.gui_objects.messageform.action = this.url('mail/compose', { _id: this.env.compose_id, _extwin: 1 });
+          this.gui_objects.messageform.target = this.open_window('', 1100);
+          this.gui_objects.messageform.submit();
+        }
+        else {
+          this.open_window(this.env.permaurl, 900);
+        }
         break;
 
       case 'menu-open':
@@ -515,37 +613,36 @@
         return false;
 
       case 'open':
-        var uid;
         if (uid = this.get_single_uid()) {
-          obj.href = '?_task='+this.env.task+'&_action=show&_mbox='+urlencode(this.env.mailbox)+'&_uid='+uid;
+          obj.href = this.url('show', {_mbox: this.env.mailbox, _uid: uid});
           return true;
         }
         break;
 
-      case 'list':
-        this.reset_qsearch();
-        if (this.task == 'mail') {
-          this.list_mailbox(props);
-
-          if (this.env.trash_mailbox && !this.env.flag_for_deletion)
-            this.set_alttext('delete', this.env.mailbox != this.env.trash_mailbox ? 'movemessagetotrash' : 'deletemessage');
-        }
-        else if (this.task == 'addressbook') {
-          this.list_contacts(props);
-        }
+      case 'close':
+        if (this.env.extwin)
+          window.close();
         break;
 
-      case 'load-headers':
-        this.load_headers(obj);
+      case 'list':
+        if (props && props != '')
+          this.reset_qsearch();
+        if (this.env.action == 'compose' && this.env.extwin)
+          window.close();
+        else if (this.task == 'mail') {
+          this.list_mailbox(props);
+          this.set_button_titles();
+        }
+        else if (this.task == 'addressbook')
+          this.list_contacts(props);
         break;
 
       case 'sort':
-        var sort_order, sort_col = props;
+        var sort_order = this.env.sort_order,
+          sort_col = !this.env.disabled_sort_col ? props : this.env.sort_col;
 
-        if (this.env.sort_col==sort_col)
-          sort_order = this.env.sort_order=='ASC' ? 'DESC' : 'ASC';
-        else
-          sort_order = 'ASC';
+        if (!this.env.disabled_sort_order)
+          sort_order = this.env.sort_col == sort_col && sort_order == 'ASC' ? 'DESC' : 'ASC';
 
         // set table header and update env
         this.set_list_sorting(sort_col, sort_order);
@@ -571,29 +668,29 @@
         break;
 
       case 'expunge':
-        if (this.env.messagecount)
+        if (this.env.exists)
           this.expunge_mailbox(this.env.mailbox);
         break;
 
       case 'purge':
       case 'empty-mailbox':
-        if (this.env.messagecount)
+        if (this.env.exists)
           this.purge_mailbox(this.env.mailbox);
         break;
 
       // common commands used in multiple tasks
       case 'show':
         if (this.task == 'mail') {
-          var uid = this.get_single_uid();
+          uid = this.get_single_uid();
           if (uid && (!this.env.uid || uid != this.env.uid)) {
             if (this.env.mailbox == this.env.drafts_mailbox)
-              this.goto_url('compose', '_draft_uid='+uid+'&_mbox='+urlencode(this.env.mailbox), true);
+              this.open_compose_step({ _draft_uid: uid, _mbox: this.env.mailbox });
             else
               this.show_message(uid);
           }
         }
         else if (this.task == 'addressbook') {
-          var cid = props ? props : this.get_single_cid();
+          cid = props ? props : this.get_single_cid();
           if (cid && !(this.env.action == 'show' && cid == this.env.cid))
             this.load_contact(cid, 'show');
         }
@@ -609,14 +706,14 @@
         break;
 
       case 'edit':
-        var cid;
-        if (this.task=='addressbook' && (cid = this.get_single_cid()))
+        if (this.task == 'addressbook' && (cid = this.get_single_cid()))
           this.load_contact(cid, 'edit');
-        else if (this.task=='settings' && props)
+        else if (this.task == 'settings' && props)
           this.load_identity(props, 'edit-identity');
-        else if (this.task=='mail' && (cid = this.get_single_uid())) {
-          var url = (this.env.mailbox == this.env.drafts_mailbox) ? '_draft_uid=' : '_uid=';
-          this.goto_url('compose', url+cid+'&_mbox='+urlencode(this.env.mailbox), true);
+        else if (this.task == 'mail' && (cid = this.get_single_uid())) {
+          url = { _mbox: this.env.mailbox };
+          url[this.env.mailbox == this.env.drafts_mailbox && props != 'new' ? '_draft_uid' : '_uid'] = cid;
+          this.open_compose_step(url);
         }
         break;
 
@@ -661,7 +758,7 @@
       case 'delete':
         // mail task
         if (this.task == 'mail')
-          this.delete_messages();
+          this.delete_messages(event);
         // addressbook task
         else if (this.task == 'addressbook')
           this.delete_contacts();
@@ -675,7 +772,7 @@
       case 'moveto':
         if (this.task == 'mail')
           this.move_messages(props);
-        else if (this.task == 'addressbook' && this.drag_active)
+        else if (this.task == 'addressbook')
           this.copy_contact(null, props);
         break;
 
@@ -693,15 +790,14 @@
         if (props && !props._row)
           break;
 
-        var uid, flag = 'read';
+        flag = 'read';
 
         if (props._row.uid) {
           uid = props._row.uid;
 
           // toggle read/unread
-          if (this.message_list.rows[uid].deleted) {
+          if (this.message_list.rows[uid].deleted)
             flag = 'undelete';
-          }
           else if (!this.message_list.rows[uid].unread)
             flag = 'unread';
         }
@@ -713,21 +809,21 @@
         if (props && !props._row)
           break;
 
-        var uid, flag = 'flagged';
+        flag = 'flagged';
 
         if (props._row.uid) {
           uid = props._row.uid;
           // toggle flagged/unflagged
           if (this.message_list.rows[uid].flagged)
             flag = 'unflagged';
-          }
+        }
         this.mark_message(flag, uid);
         break;
 
       case 'always-load':
         if (this.env.uid && this.env.sender) {
-          this.add_contact(urlencode(this.env.sender));
-          window.setTimeout(function(){ ref.command('load-images'); }, 300);
+          this.add_contact(this.env.sender);
+          setTimeout(function(){ ref.command('load-images'); }, 300);
           break;
         }
 
@@ -740,12 +836,10 @@
         var qstring = '_mbox='+urlencode(this.env.mailbox)+'&_uid='+this.env.uid+'&_part='+props.part;
 
         // open attachment in frame if it's of a supported mimetype
-        if (this.env.uid && props.mimetype && this.env.mimetypes && $.inArray(props.mimetype, this.env.mimetypes)>=0) {
-          if (props.mimetype == 'text/html')
-            qstring += '&_safe=1';
-          this.attachment_win = window.open(this.env.comm_path+'&_action=get&'+qstring+'&_frame=1', 'rcubemailattachment');
-          if (this.attachment_win) {
-            window.setTimeout(function(){ ref.attachment_win.focus(); }, 10);
+        if (this.env.uid && props.mimetype && this.env.mimetypes && $.inArray(props.mimetype, this.env.mimetypes) >= 0) {
+          var attachment_win = window.open(this.env.comm_path+'&_action=get&'+qstring+'&_frame=1', this.html_identifier('rcubemailattachment'+this.env.uid+props.part));
+          if (attachment_win) {
+            setTimeout(function(){ attachment_win.focus(); }, 10);
             break;
           }
         }
@@ -796,7 +890,7 @@
 
       case 'previousmessage':
         if (this.env.prev_uid)
-          this.show_message(this.env.prev_uid, false, this.env.action=='preview');
+          this.show_message(this.env.prev_uid, false, this.env.action == 'preview');
         break;
 
       case 'firstmessage':
@@ -804,153 +898,139 @@
           this.show_message(this.env.first_uid);
         break;
 
-      case 'checkmail':
-        this.check_for_recent(true);
-        break;
-
       case 'compose':
-        var url = this.url('mail/compose');
+        url = {};
 
         if (this.task == 'mail') {
-          url += '&_mbox='+urlencode(this.env.mailbox);
-
-          if (this.env.mailbox == this.env.drafts_mailbox) {
-            var uid;
-            if (uid = this.get_single_uid())
-              url += '&_draft_uid='+uid;
-          }
-          else if (props)
-             url += '&_to='+urlencode(props);
+          url._mbox = this.env.mailbox;
+          if (props)
+             url._to = props;
+          // also send search request so we can go back to search result after message is sent
+          if (this.env.search_request)
+            url._search = this.env.search_request;
         }
         // modify url if we're in addressbook
         else if (this.task == 'addressbook') {
           // switch to mail compose step directly
           if (props && props.indexOf('@') > 0) {
-            url = this.get_task_url('mail', url);
-            this.redirect(url + '&_to='+urlencode(props));
+            url._to = props;
+          }
+          else {
+            // use contact_id passed as command parameter
+            var n, len, a_cids = [];
+            if (props)
+              a_cids.push(props);
+            // get selected contacts
+            else if (this.contact_list) {
+              var selection = this.contact_list.get_selection();
+              for (n=0, len=selection.length; n<len; n++)
+                a_cids.push(selection[n]);
+            }
+
+            if (a_cids.length)
+              this.http_post('mailto', { _cid: a_cids.join(','), _source: this.env.source }, true);
+            else if (this.env.group)
+              this.http_post('mailto', { _gid: this.env.group, _source: this.env.source }, true);
+
             break;
           }
-
-          // use contact_id passed as command parameter
-          var n, len, a_cids = [];
-          if (props)
-            a_cids.push(props);
-          // get selected contacts
-          else if (this.contact_list) {
-            var selection = this.contact_list.get_selection();
-            for (n=0, len=selection.length; n<len; n++)
-              a_cids.push(selection[n]);
-          }
-
-          if (a_cids.length)
-            this.http_post('mailto', {_cid: a_cids.join(','), _source: this.env.source}, true);
-
-          break;
         }
+        else if (props)
+          url._to = props;
 
-        this.redirect(url);
+        this.open_compose_step(url);
         break;
 
       case 'spellcheck':
-        if (window.tinyMCE && tinyMCE.get(this.env.composebody)) {
-          tinyMCE.execCommand('mceSpellCheck', true);
+        if (this.spellcheck_state()) {
+          this.stop_spellchecking();
         }
-        else if (this.env.spellcheck && this.env.spellcheck.spellCheck && this.spellcheck_ready) {
-          this.env.spellcheck.spellCheck();
-          this.set_spellcheck_state('checking');
+        else {
+          if (window.tinyMCE && tinyMCE.get(this.env.composebody)) {
+            tinyMCE.execCommand('mceSpellCheck', true);
+          }
+          else if (this.env.spellcheck && this.env.spellcheck.spellCheck) {
+            this.env.spellcheck.spellCheck();
+          }
         }
+        this.spellcheck_state();
         break;
 
       case 'savedraft':
         // Reset the auto-save timer
-        self.clearTimeout(this.save_timer);
+        clearTimeout(this.save_timer);
 
-        if (!this.gui_objects.messageform)
+        // compose form did not change (and draft wasn't saved already)
+        if (this.env.draft_id && this.cmp_hash == this.compose_field_hash()) {
+          this.auto_save_start();
           break;
+        }
 
-        // if saving Drafts is disabled in main.inc.php
-        // or if compose form did not change
-        if (!this.env.drafts_mailbox || this.cmp_hash == this.compose_field_hash())
-          break;
-
-        var form = this.gui_objects.messageform,
-          msgid = this.set_busy(true, 'savingmessage');
-
-        form.target = "savetarget";
-        form._draft.value = '1';
-        form.action = this.add_url(form.action, '_unlock', msgid);
-        form.submit();
+        this.submit_messageform(true);
         break;
 
       case 'send':
-        if (!this.gui_objects.messageform)
-          break;
-
-        if (!this.check_compose_input())
+        if (!props.nocheck && !this.check_compose_input(command))
           break;
 
         // Reset the auto-save timer
-        self.clearTimeout(this.save_timer);
+        clearTimeout(this.save_timer);
 
-        // all checks passed, send message
-        var lang = this.spellcheck_lang(),
-          form = this.gui_objects.messageform,
-          msgid = this.set_busy(true, 'sendingmessage');
-
-        form.target = 'savetarget';
-        form._draft.value = '';
-        form.action = this.add_url(form.action, '_unlock', msgid);
-        form.action = this.add_url(form.action, '_lang', lang);
-        form.submit();
-
-        // clear timeout (sending could take longer)
-        clearTimeout(this.request_timer);
+        this.submit_messageform();
         break;
 
       case 'send-attachment':
         // Reset the auto-save timer
-        self.clearTimeout(this.save_timer);
+        clearTimeout(this.save_timer);
 
-        this.upload_file(props)
+        this.upload_file(props || this.gui_objects.uploadform);
         break;
 
       case 'insert-sig':
         this.change_identity($("[name='_from']")[0], true);
         break;
 
+      case 'list-adresses':
+        this.list_contacts(props);
+        this.enable_command('add-recipient', false);
+        break;
+
+      case 'add-recipient':
+        this.compose_add_recipient(props);
+        break;
+
       case 'reply-all':
       case 'reply-list':
       case 'reply':
-        var uid;
         if (uid = this.get_single_uid()) {
-          var url = '_reply_uid='+uid+'&_mbox='+urlencode(this.env.mailbox);
+          url = {_reply_uid: uid, _mbox: this.env.mailbox};
           if (command == 'reply-all')
-            // do reply-list, when list is detected and popup menu wasn't used 
-            url += '&_all=' + (!props && this.commands['reply-list'] ? 'list' : 'all');
+            // do reply-list, when list is detected and popup menu wasn't used
+            url._all = (!props && this.commands['reply-list'] ? 'list' : 'all');
           else if (command == 'reply-list')
-            url += '&_all=list';
+            url._all = 'list';
 
-          this.goto_url('compose', url, true);
+          this.open_compose_step(url);
         }
         break;
 
       case 'forward-attachment':
+      case 'forward-inline':
       case 'forward':
-        var uid, url;
-        if (uid = this.get_single_uid()) {
-          url = '_forward_uid='+uid+'&_mbox='+urlencode(this.env.mailbox);
-          if (command == 'forward-attachment' || (!props && this.env.forward_attachment))
-            url += '&_attachment=1';
-          this.goto_url('compose', url, true);
+        var uids = this.env.uid ? [this.env.uid] : (this.message_list ? this.message_list.get_selection() : []);
+        if (uids.length) {
+          url = { _forward_uid: this.uids_to_list(uids), _mbox: this.env.mailbox };
+          if (command == 'forward-attachment' || (!props && this.env.forward_attachment) || uids.length > 1)
+            url._attachment = 1;
+          this.open_compose_step(url);
         }
         break;
 
       case 'print':
-        var uid;
         if (uid = this.get_single_uid()) {
           ref.printwin = window.open(this.env.comm_path+'&_action=print&_uid='+uid+'&_mbox='+urlencode(this.env.mailbox)+(this.env.safemode ? '&_safe=1' : ''));
           if (this.printwin) {
-            window.setTimeout(function(){ ref.printwin.focus(); }, 20);
+            setTimeout(function(){ ref.printwin.focus(); }, 20);
             if (this.env.action != 'show')
               this.mark_message('read', uid);
           }
@@ -958,18 +1038,16 @@
         break;
 
       case 'viewsource':
-        var uid;
         if (uid = this.get_single_uid()) {
           ref.sourcewin = window.open(this.env.comm_path+'&_action=viewsource&_uid='+uid+'&_mbox='+urlencode(this.env.mailbox));
           if (this.sourcewin)
-            window.setTimeout(function(){ ref.sourcewin.focus(); }, 20);
+            setTimeout(function(){ ref.sourcewin.focus(); }, 20);
           }
         break;
 
       case 'download':
-        var uid;
         if (uid = this.get_single_uid())
-          this.goto_url('viewsource', '&_uid='+uid+'&_mbox='+urlencode(this.env.mailbox)+'&_save=1');
+          this.goto_url('viewsource', { _uid: uid, _mbox: this.env.mailbox, _save: 1 });
         break;
 
       // quicksearch
@@ -988,8 +1066,13 @@
         this.reset_qsearch();
         this.select_all_mode = false;
 
-        if (s && this.env.mailbox)
+        if (s && this.env.action == 'compose') {
+          if (this.contact_list)
+            this.list_contacts_clear();
+        }
+        else if (s && this.env.mailbox) {
           this.list_mailbox(this.env.mailbox, 1);
+        }
         else if (s && this.task == 'addressbook') {
           if (this.env.source == '') {
             for (n in this.env.address_sources) break;
@@ -1000,9 +1083,23 @@
         }
         break;
 
+      case 'pushgroup':
+        // add group ID to stack
+        this.env.address_group_stack.push(props.id);
+        if (obj && event)
+          rcube_event.cancel(event);
+
       case 'listgroup':
         this.reset_qsearch();
         this.list_contacts(props.source, props.id);
+        break;
+
+      case 'popgroup':
+        if (this.env.address_group_stack.length > 1) {
+          this.env.address_group_stack.pop();
+          this.reset_qsearch();
+          this.list_contacts(props.source, this.env.address_group_stack[this.env.address_group_stack.length-1]);
+        }
         break;
 
       case 'import':
@@ -1022,12 +1119,12 @@
 
       case 'export':
         if (this.contact_list.rowcount > 0) {
-          this.goto_url('export', { _source:this.env.source, _gid:this.env.group, _search:this.env.search_request });
+          this.goto_url('export', { _source: this.env.source, _gid: this.env.group, _search: this.env.search_request });
         }
         break;
 
       case 'upload-photo':
-        this.upload_contact_photo(props);
+        this.upload_contact_photo(props || this.gui_objects.uploadform);
         break;
 
       case 'delete-photo':
@@ -1048,24 +1145,26 @@
       // unified command call (command name == function name)
       default:
         var func = command.replace(/-/g, '_');
-        if (this[func] && typeof this[func] === 'function')
-          this[func](props);
+        if (this[func] && typeof this[func] === 'function') {
+          ret = this[func](props, obj);
+        }
         break;
     }
 
-    this.triggerEvent('after'+command, props);
+    if (this.triggerEvent('after'+command, props) === false)
+      ret = false;
     this.triggerEvent('actionafter', {props:props, action:command});
 
-    return obj ? false : true;
+    return ret === false ? false : obj ? false : true;
   };
 
   // set command(s) enabled or disabled
   this.enable_command = function()
   {
-    var args = Array.prototype.slice.call(arguments),
+    var i, n, args = Array.prototype.slice.call(arguments),
       enable = args.pop(), cmd;
 
-    for (var n=0; n<args.length; n++) {
+    for (n=0; n<args.length; n++) {
       cmd = args[n];
       // argument of type array
       if (typeof cmd === 'string') {
@@ -1074,7 +1173,7 @@
       }
       // push array elements into commands array
       else {
-        for (var i in cmd)
+        for (i in cmd)
           args.push(cmd[i]);
       }
     }
@@ -1099,14 +1198,6 @@
 
     if (this.gui_objects.editform)
       this.lock_form(this.gui_objects.editform, a);
-
-    // clear pending timer
-    if (this.request_timer)
-      clearTimeout(this.request_timer);
-
-    // set timer for requests
-    if (a && this.env.request_timeout)
-      this.request_timer = window.setTimeout(function(){ ref.request_timed_out(); }, this.env.request_timeout * 1000);
 
     return id;
   };
@@ -1146,19 +1237,12 @@
     return url.replace(/_task=[a-z]+/, '_task='+task);
   };
 
-  // called when a request timed out
-  this.request_timed_out = function()
-  {
-    this.set_busy(false);
-    this.display_message('Request timed out!', 'error');
-  };
-
   this.reload = function(delay)
   {
     if (this.is_framed())
       parent.rcmail.reload(delay);
     else if (delay)
-      window.setTimeout(function(){ rcmail.reload(); }, delay);
+      setTimeout(function(){ rcmail.reload(); }, delay);
     else if (window.location)
       location.href = this.env.comm_path + (this.env.action ? '&_action='+this.env.action : '');
   };
@@ -1180,8 +1264,8 @@
 
       return url.replace(/(\?.*)$/, urldata);
     }
-    else
-      return url + '?' + name + '=' + value;
+
+    return url + '?' + name + '=' + value;
   };
 
   this.is_framed = function()
@@ -1199,6 +1283,25 @@
       this.env[prop.env] = prop.value;
 
     this.http_post('save-pref', request);
+  };
+
+  this.html_identifier = function(str, encode)
+  {
+    return encode ? this.html_identifier_encode(str) : String(str).replace(this.identifier_expr, '_');
+  };
+
+  this.html_identifier_encode = function(str)
+  {
+    return Base64.encode(String(str)).replace(/=+$/, '').replace(/\+/g, '-').replace(/\//g, '_');
+  };
+
+  this.html_identifier_decode = function(str)
+  {
+    str = String(str).replace(/-/g, '+').replace(/_/g, '/');
+
+    while (str.length % 4) str += '=';
+
+    return Base64.decode(str);
   };
 
 
@@ -1242,28 +1345,9 @@
     if (this.preview_read_timer)
       clearTimeout(this.preview_read_timer);
 
-    // save folderlist and folders location/sizes for droptarget calculation in drag_move()
-    if (this.gui_objects.folderlist && model) {
-      this.initialBodyScrollTop = bw.ie ? 0 : window.pageYOffset;
-      this.initialListScrollTop = this.gui_objects.folderlist.parentNode.scrollTop;
-
-      var li, pos, list, height;
-      list = $(this.gui_objects.folderlist);
-      pos = list.offset();
-      this.env.folderlist_coords = { x1:pos.left, y1:pos.top, x2:pos.left + list.width(), y2:pos.top + list.height() };
-
-      this.env.folder_coords = [];
-      for (var k in model) {
-        if (li = this.get_folder_li(k)) {
-          // only visible folders
-          if (height = li.firstChild.offsetHeight) {
-            pos = $(li.firstChild).offset();
-            this.env.folder_coords[k] = { x1:pos.left, y1:pos.top,
-              x2:pos.left + li.firstChild.offsetWidth, y2:pos.top + height, on:0 };
-          }
-        }
-      }
-    }
+    // prepare treelist widget for dragging interactions
+    if (this.treelist)
+      this.treelist.drag_start();
   };
 
   this.drag_end = function(e)
@@ -1271,86 +1355,28 @@
     this.drag_active = false;
     this.env.last_folder_target = null;
 
-    if (this.folder_auto_timer) {
-      window.clearTimeout(this.folder_auto_timer);
-      this.folder_auto_timer = null;
-      this.folder_auto_expand = null;
-    }
-
-    // over the folders
-    if (this.gui_objects.folderlist && this.env.folder_coords) {
-      for (var k in this.env.folder_coords) {
-        if (this.env.folder_coords[k].on)
-          $(this.get_folder_li(k)).removeClass('droptarget');
-      }
-    }
+    if (this.treelist)
+      this.treelist.drag_end();
   };
 
   this.drag_move = function(e)
   {
-    if (this.gui_objects.folderlist && this.env.folder_coords) {
-      // offsets to compensate for scrolling while dragging a message
-      var boffset = bw.ie ? -document.documentElement.scrollTop : this.initialBodyScrollTop;
-      var moffset = this.initialListScrollTop-this.gui_objects.folderlist.parentNode.scrollTop;
-      var toffset = -moffset-boffset;
-      var li, div, pos, mouse, check, oldclass,
-        layerclass = 'draglayernormal';
+    if (this.gui_objects.folderlist) {
+      var drag_target, oldclass,
+        layerclass = 'draglayernormal',
+        mouse = rcube_event.get_mouse_pos(e);
 
       if (this.contact_list && this.contact_list.draglayer)
         oldclass = this.contact_list.draglayer.attr('class');
 
-      mouse = rcube_event.get_mouse_pos(e);
-      pos = this.env.folderlist_coords;
-      mouse.y += toffset;
-
-      // if mouse pointer is outside of folderlist
-      if (mouse.x < pos.x1 || mouse.x >= pos.x2 || mouse.y < pos.y1 || mouse.y >= pos.y2) {
-        if (this.env.last_folder_target) {
-          $(this.get_folder_li(this.env.last_folder_target)).removeClass('droptarget');
-          this.env.folder_coords[this.env.last_folder_target].on = 0;
-          this.env.last_folder_target = null;
-        }
-        if (layerclass != oldclass && this.contact_list && this.contact_list.draglayer)
-          this.contact_list.draglayer.attr('class', layerclass);
-        return;
+      // mouse intersects a valid drop target on the treelist
+      if (this.treelist && (drag_target = this.treelist.intersects(mouse, true))) {
+        this.env.last_folder_target = drag_target;
+        layerclass = 'draglayer' + (this.check_droptarget(drag_target) > 1 ? 'copy' : 'normal');
       }
-
-      // over the folders
-      for (var k in this.env.folder_coords) {
-        pos = this.env.folder_coords[k];
-        if (mouse.x >= pos.x1 && mouse.x < pos.x2 && mouse.y >= pos.y1 && mouse.y < pos.y2){
-         if ((check = this.check_droptarget(k))) {
-            li = this.get_folder_li(k);
-            div = $(li.getElementsByTagName('div')[0]);
-
-            // if the folder is collapsed, expand it after 1sec and restart the drag & drop process.
-            if (div.hasClass('collapsed')) {
-              if (this.folder_auto_timer)
-                window.clearTimeout(this.folder_auto_timer);
-
-              this.folder_auto_expand = k;
-              this.folder_auto_timer = window.setTimeout(function() {
-                  rcmail.command('collapse-folder', rcmail.folder_auto_expand);
-                  rcmail.drag_start(null);
-                }, 1000);
-            } else if (this.folder_auto_timer) {
-              window.clearTimeout(this.folder_auto_timer);
-              this.folder_auto_timer = null;
-              this.folder_auto_expand = null;
-            }
-
-            $(li).addClass('droptarget');
-            this.env.folder_coords[k].on = 1;
-            this.env.last_folder_target = k;
-            layerclass = 'draglayer' + (check > 1 ? 'copy' : 'normal');
-          } else { // Clear target, otherwise drag end will trigger move into last valid droptarget
-            this.env.last_folder_target = null;
-          }
-        }
-        else if (pos.on) {
-          $(this.get_folder_li(k)).removeClass('droptarget');
-          this.env.folder_coords[k].on = 0;
-        }
+      else {
+        // Clear target, otherwise drag end will trigger move into last valid droptarget
+        this.env.last_folder_target = null;
       }
 
       if (layerclass != oldclass && this.contact_list && this.contact_list.draglayer)
@@ -1358,74 +1384,62 @@
     }
   };
 
-  this.collapse_folder = function(id)
+  this.collapse_folder = function(name)
   {
-    var li = this.get_folder_li(id),
-      div = $(li.getElementsByTagName('div')[0]);
+    if (this.treelist)
+      this.treelist.toggle(name);
+  };
 
-    if (!div || (!div.hasClass('collapsed') && !div.hasClass('expanded')))
-      return;
+  this.folder_collapsed = function(node)
+  {
+    var prefname = this.env.task == 'addressbook' ? 'collapsed_abooks' : 'collapsed_folders';
 
-    var ul = $(li.getElementsByTagName('ul')[0]);
+    if (node.collapsed) {
+      this.env[prefname] = this.env[prefname] + '&'+urlencode(node.id)+'&';
 
-    if (div.hasClass('collapsed')) {
-      ul.show();
-      div.removeClass('collapsed').addClass('expanded');
-      var reg = new RegExp('&'+urlencode(id)+'&');
-      this.env.collapsed_folders = this.env.collapsed_folders.replace(reg, '');
+      // select the folder if one of its childs is currently selected
+      // don't select if it's virtual (#1488346)
+      if (this.env.mailbox && this.env.mailbox.indexOf(name + this.env.delimiter) == 0 && !node.virtual)
+        this.command('list', name);
     }
     else {
-      ul.hide();
-      div.removeClass('expanded').addClass('collapsed');
-      this.env.collapsed_folders = this.env.collapsed_folders+'&'+urlencode(id)+'&';
-
-      // select parent folder if one of its childs is currently selected
-      if (this.env.mailbox.indexOf(id + this.env.delimiter) == 0)
-        this.command('list', id);
+      var reg = new RegExp('&'+urlencode(node.id)+'&');
+      this.env[prefname] = this.env[prefname].replace(reg, '');
     }
 
-    // Work around a bug in IE6 and IE7, see #1485309
-    if (bw.ie6 || bw.ie7) {
-      var siblings = li.nextSibling ? li.nextSibling.getElementsByTagName('ul') : null;
-      if (siblings && siblings.length && (li = siblings[0]) && li.style && li.style.display != 'none') {
-        li.style.display = 'none';
-        li.style.display = '';
-      }
-    }
+    if (!this.drag_active) {
+      this.command('save-pref', { name: prefname, value: this.env[prefname] });
 
-    this.command('save-pref', { name: 'collapsed_folders', value: this.env.collapsed_folders });
-    this.set_unread_count_display(id, false);
+      if (this.env.unread_counts)
+        this.set_unread_count_display(node.id, false);
+    }
   };
 
   this.doc_mouse_up = function(e)
   {
-    var model, list, li, id;
+    var model, list, id;
 
-    if (list = this.message_list) {
-      if (!rcube_mouse_is_over(e, list.list.parentNode))
-        list.blur();
-      else
-        list.focus();
+    // ignore event if jquery UI dialog is open
+    if ($(rcube_event.get_target(e)).closest('.ui-dialog, .ui-widget-overlay').length)
+      return;
+
+    if (list = this.message_list)
       model = this.env.mailboxes;
-    }
-    else if (list = this.contact_list) {
-      if (!rcube_mouse_is_over(e, list.list.parentNode))
-        list.blur();
-      else
-        list.focus();
+    else if (list = this.contact_list)
       model = this.env.contactfolders;
-    }
-    else if (this.ksearch_value) {
+    else if (this.ksearch_value)
       this.ksearch_blur();
-    }
+
+    if (list && !rcube_mouse_is_over(e, list.list.parentNode))
+      list.blur();
 
     // handle mouse release when dragging
     if (this.drag_active && model && this.env.last_folder_target) {
       var target = model[this.env.last_folder_target];
 
-      $(this.get_folder_li(this.env.last_folder_target)).removeClass('droptarget');
       this.env.last_folder_target = null;
       list.draglayer.hide();
+      this.drag_end(e);
 
       if (!this.drag_menu(e, target))
         this.command('moveto', target);
@@ -1460,22 +1474,22 @@
     if (this.preview_read_timer)
       clearTimeout(this.preview_read_timer);
 
-    var selected = list.get_single_selection() != null;
+    var selected = list.get_single_selection();
 
-    this.enable_command(this.env.message_commands, selected);
+    this.enable_command(this.env.message_commands, selected != null);
     if (selected) {
       // Hide certain command buttons when Drafts folder is selected
       if (this.env.mailbox == this.env.drafts_mailbox)
-        this.enable_command('reply', 'reply-all', 'reply-list', 'forward', 'forward-attachment', false);
+        this.enable_command('reply', 'reply-all', 'reply-list', 'forward', 'forward-attachment', 'forward-inline', false);
       // Disable reply-list when List-Post header is not set
       else {
-        var msg = this.env.messages[list.get_single_selection()];
+        var msg = this.env.messages[selected];
         if (!msg.ml)
           this.enable_command('reply-list', false);
       }
     }
     // Multi-message commands
-    this.enable_command('delete', 'moveto', 'copy', 'mark', (list.selection.length > 0 ? true : false));
+    this.enable_command('delete', 'moveto', 'copy', 'mark', 'forward', 'forward-attachment', list.selection.length > 0);
 
     // reset all-pages-selection
     if (selected || (list.selection.length && list.selection.length != list.rowcount))
@@ -1483,7 +1497,7 @@
 
     // start timer for message preview (wait for double click)
     if (selected && this.env.contentframe && !list.multi_selecting && !this.dummy_select)
-      this.preview_timer = window.setTimeout(function(){ ref.msglist_get_preview(); }, 200);
+      this.preview_timer = setTimeout(function() { ref.msglist_get_preview(); }, this.dblclick_time);
     else if (this.env.contentframe)
       this.show_contentframe(false);
   };
@@ -1494,14 +1508,18 @@
     if (list.multi_selecting || !this.env.contentframe)
       return;
 
-    if (list.get_single_selection() && window.frames && window.frames[this.env.contentframe]) {
-      if (window.frames[this.env.contentframe].location.href.indexOf(this.env.blankpage)>=0) {
-        if (this.preview_timer)
-          clearTimeout(this.preview_timer);
-        if (this.preview_read_timer)
-          clearTimeout(this.preview_read_timer);
-        this.preview_timer = window.setTimeout(function(){ ref.msglist_get_preview(); }, 200);
-      }
+    if (list.get_single_selection())
+      return;
+
+    var win = this.get_frame_window(this.env.contentframe);
+
+    if (win && win.location.href.indexOf(this.env.blankpage) >= 0) {
+      if (this.preview_timer)
+        clearTimeout(this.preview_timer);
+      if (this.preview_read_timer)
+        clearTimeout(this.preview_read_timer);
+
+      this.preview_timer = setTimeout(function() { ref.msglist_get_preview(); }, this.dblclick_time);
     }
   };
 
@@ -1509,13 +1527,13 @@
   {
     if (this.preview_timer)
       clearTimeout(this.preview_timer);
-
     if (this.preview_read_timer)
       clearTimeout(this.preview_read_timer);
 
     var uid = list.get_single_selection();
+
     if (uid && this.env.mailbox == this.env.drafts_mailbox)
-      this.goto_url('compose', '_draft_uid='+uid+'&_mbox='+urlencode(this.env.mailbox), true);
+      this.open_compose_step({ _draft_uid: uid, _mbox: this.env.mailbox });
     else if (uid)
       this.show_message(uid, false, false);
   };
@@ -1548,6 +1566,7 @@
   {
     if (this.env.messages[row.uid])
       this.env.messages[row.uid].expanded = row.expanded;
+    $(row.obj)[row.expanded?'addClass':'removeClass']('expanded');
   };
 
   this.msglist_set_coltypes = function(list)
@@ -1559,7 +1578,7 @@
     for (i=0; i<cols.length; i++)
       if (cols[i].id && cols[i].id.match(/^rcm/)) {
         name = cols[i].id.replace(/^rcm/, '');
-        this.env.coltypes.push(name == 'to' ? 'from' : name);
+        this.env.coltypes.push(name);
       }
 
     if ((found = $.inArray('flag', this.env.coltypes)) >= 0)
@@ -1573,27 +1592,56 @@
 
   this.check_droptarget = function(id)
   {
-    var allow = false, copy = false;
-
     if (this.task == 'mail')
-      allow = (this.env.mailboxes[id] && this.env.mailboxes[id].id != this.env.mailbox && !this.env.mailboxes[id].virtual);
-    else if (this.task == 'settings')
-      allow = (id != this.env.mailbox);
-    else if (this.task == 'addressbook') {
+      return (this.env.mailboxes[id] && this.env.mailboxes[id].id != this.env.mailbox && !this.env.mailboxes[id].virtual) ? 1 : 0;
+
+    if (this.task == 'settings')
+      return id != this.env.mailbox ? 1 : 0;
+
+    if (this.task == 'addressbook') {
       if (id != this.env.source && this.env.contactfolders[id]) {
+        // droptarget is a group - contact add to group action
         if (this.env.contactfolders[id].type == 'group') {
           var target_abook = this.env.contactfolders[id].source;
-          allow = this.env.contactfolders[id].id != this.env.group && !this.env.contactfolders[target_abook].readonly;
-          copy = target_abook != this.env.source;
+          if (this.env.contactfolders[id].id != this.env.group && !this.env.contactfolders[target_abook].readonly) {
+            // search result may contain contacts from many sources
+            return (this.env.selection_sources.length > 1 || $.inArray(target_abook, this.env.selection_sources) == -1) ? 2 : 1;
+          }
         }
-        else {
-          allow = !this.env.contactfolders[id].readonly;
-          copy = true;
+        // droptarget is a (writable) addressbook - contact copy action
+        else if (!this.env.contactfolders[id].readonly) {
+          // search result may contain contacts from many sources
+          return (this.env.selection_sources.length > 1 || $.inArray(id, this.env.selection_sources) == -1) ? 2 : 0;
         }
       }
     }
 
-    return allow ? (copy ? 2 : 1) : 0;
+    return 0;
+  };
+
+  this.open_window = function(url, width)
+  {
+    var win = this.is_framed() ? parent.window : window,
+      page = $(win),
+      page_width = page.width(),
+      page_height = bw.mz ? $('body', win).height() : page.height(),
+      w = Math.min(width, page_width),
+      h = page_height, // always use same height
+      l = (win.screenLeft || win.screenX) + 20,
+      t = (win.screenTop || win.screenY) + 20,
+      wname = 'rcmextwin' + new Date().getTime(),
+      extwin = window.open(url + (url.match(/\?/) ? '&' : '?') + '_extwin=1', wname,
+        'width='+w+',height='+h+',top='+t+',left='+l+',resizable=yes,toolbar=no,status=no,location=no');
+
+    // write loading... message to empty windows
+    if (!url && extwin.document) {
+      extwin.document.write('<html><body>' + this.get_label('loading') + '</body></html>');
+    }
+
+    // focus window, delayed to bring to front
+    window.setTimeout(function() { extwin.focus(); }, 10);
+
+    return wname;
   };
 
 
@@ -1630,6 +1678,14 @@
     if (!row.depth && row.has_children && (expando = document.getElementById('rcmexpando'+row.uid))) {
       row.expando = expando;
       expando.onmousedown = function(e) { return self.expand_message_row(e, uid); };
+      if (bw.touch) {
+        expando.addEventListener('touchend', function(e) {
+          if (e.changedTouches.length == 1) {
+            self.expand_message_row(e, uid);
+            return rcube_event.cancel(e);
+          }
+        }, false);
+      }
     }
 
     this.triggerEvent('insertrow', { uid:uid, row:row });
@@ -1639,6 +1695,10 @@
   this.add_message_row = function(uid, cols, flags, attop)
   {
     if (!this.gui_objects.messagelist || !this.message_list)
+      return false;
+
+    // Prevent from adding messages from different folder (#1487752)
+    if (flags.mbox != this.env.mailbox && !flags.skip_mbox_check)
       return false;
 
     if (!this.env.messages[uid])
@@ -1662,26 +1722,21 @@
       flags: flags.extra_flags
     });
 
-    var c, html, tree = expando = '',
+    var c, n, col, html, css_class,
+      tree = '', expando = '',
       list = this.message_list,
       rows = list.rows,
-      tbody = this.gui_objects.messagelist.tBodies[0],
-      rowcount = tbody.rows.length,
-      even = rowcount%2,
       message = this.env.messages[uid],
-      css_class = 'message'
-        + (even ? ' even' : ' odd')
+      row_class = 'message'
         + (!flags.seen ? ' unread' : '')
         + (flags.deleted ? ' deleted' : '')
         + (flags.flagged ? ' flagged' : '')
         + (flags.unread_children && flags.seen && !this.env.autoexpand_threads ? ' unroot' : '')
         + (message.selected ? ' selected' : ''),
       // for performance use DOM instead of jQuery here
-      row = document.createElement('tr'),
-      col = document.createElement('td');
+      row = document.createElement('tr');
 
     row.id = 'rcmrow'+uid;
-    row.className = css_class;
 
     // message status icons
     css_class = 'msgicon';
@@ -1705,9 +1760,10 @@
 
     // threads
     if (this.env.threading) {
-      // This assumes that div width is hardcoded to 15px,
-      var width = message.depth * 15;
       if (message.depth) {
+        // This assumes that div width is hardcoded to 15px,
+        tree += '<span id="rcmtab' + uid + '" class="branch" style="width:' + (message.depth * 15) + 'px;">&nbsp;&nbsp;</span>';
+
         if ((rows[message.parent_uid] && rows[message.parent_uid].expanded === false)
           || ((this.env.autoexpand_threads == 0 || this.env.autoexpand_threads == 2) &&
             (!rows[message.parent_uid] || !rows[message.parent_uid].expanded))
@@ -1717,21 +1773,21 @@
         }
         else
           message.expanded = true;
+
+        row_class += ' thread expanded';
       }
       else if (message.has_children) {
         if (message.expanded === undefined && (this.env.autoexpand_threads == 1 || (this.env.autoexpand_threads == 2 && message.unread_children))) {
           message.expanded = true;
         }
-      }
 
-      if (width)
-        tree += '<span id="rcmtab' + uid + '" class="branch" style="width:' + width + 'px;">&nbsp;&nbsp;</span>';
-
-      if (message.has_children && !message.depth)
         expando = '<div id="rcmexpando' + uid + '" class="' + (message.expanded ? 'expanded' : 'collapsed') + '">&nbsp;&nbsp;</div>';
+        row_class += ' thread' + (message.expanded? ' expanded' : '');
+      }
     }
 
     tree += '<span id="msgicn'+uid+'" class="'+css_class+'">&nbsp;</span>';
+    row.className = row_class;
 
     // build subject link 
     if (!bw.ie && cols.subject) {
@@ -1742,7 +1798,7 @@
     }
 
     // add each submitted col
-    for (var n in this.env.coltypes) {
+    for (n in this.env.coltypes) {
       c = this.env.coltypes[n];
       col = document.createElement('td');
       col.className = String(c).toLowerCase();
@@ -1752,7 +1808,7 @@
         html = '<span id="flagicn'+uid+'" class="'+css_class+'">&nbsp;</span>';
       }
       else if (c == 'attachment') {
-        if (/application\/|multipart\/m/.test(flags.ctype))
+        if (/application\/|multipart\/(m|signed)/.test(flags.ctype))
           html = '<span class="attachment">&nbsp;</span>';
         else if (/multipart\/report/.test(flags.ctype))
           html = '<span class="report">&nbsp;</span>';
@@ -1773,8 +1829,11 @@
       else if (c == 'threads')
         html = expando;
       else if (c == 'subject') {
-        if (bw.ie)
+        if (bw.ie) {
           col.onmouseover = function() { rcube_webmail.long_subject_title_ie(this, message.depth+1); };
+          if (bw.ie8)
+            tree = '<span></span>' + tree; // #1487821
+        }
         html = tree + cols[c];
       }
       else if (c == 'priority') {
@@ -1786,7 +1845,8 @@
       else
         html = cols[c];
 
-      col.innerHTML = html;
+      if (html)
+        col.innerHTML = html;
 
       row.appendChild(col);
     }
@@ -1814,7 +1874,7 @@
 
   this.set_list_options = function(cols, sort_col, sort_order, threads)
   {
-    var update, add_url = '';
+    var update, post_data = {};
 
     if (sort_col === undefined)
       sort_col = this.env.sort_col;
@@ -1828,14 +1888,14 @@
 
     if (this.env.threading != threads) {
       update = 1;
-      add_url += '&_threads=' + threads;
+      post_data._threads = threads;
     }
 
     if (cols && cols.length) {
       // make sure new columns are added at the end of the list
       var i, idx, name, newcols = [], oldcols = this.env.coltypes;
       for (i=0; i<oldcols.length; i++) {
-        name = oldcols[i] == 'to' ? 'from' : oldcols[i];
+        name = oldcols[i];
         idx = $.inArray(name, cols);
         if (idx != -1) {
           newcols.push(name);
@@ -1848,26 +1908,26 @@
 
       if (newcols.join() != oldcols.join()) {
         update = 1;
-        add_url += '&_cols=' + newcols.join(',');
+        post_data._cols = newcols.join(',');
       }
     }
 
     if (update)
-      this.list_mailbox('', '', sort_col+'_'+sort_order, add_url);
+      this.list_mailbox('', '', sort_col+'_'+sort_order, post_data);
   };
 
-  // when user doble-clicks on a row
+  // when user double-clicks on a row
   this.show_message = function(id, safe, preview)
   {
     if (!id)
       return;
 
-    var target = window,
+    var win, target = window,
       action = preview ? 'preview': 'show',
       url = '&_action='+action+'&_uid='+id+'&_mbox='+urlencode(this.env.mailbox);
 
-    if (preview && this.env.contentframe && window.frames && window.frames[this.env.contentframe]) {
-      target = window.frames[this.env.contentframe];
+    if (preview && (win = this.get_frame_window(this.env.contentframe))) {
+      target = win;
       url += '&_framed=1';
     }
 
@@ -1878,14 +1938,24 @@
     if (this.env.search_request)
       url += '&_search='+this.env.search_request;
 
-    if (action == 'preview' && String(target.location.href).indexOf(url) >= 0)
+    // add browser capabilities, so we can properly handle attachments
+    url += '&_caps='+urlencode(this.browser_capabilities());
+
+    if (this.env.extwin)
+      url += '&_extwin=1';
+
+    if (preview && String(target.location.href).indexOf(url) >= 0) {
       this.show_contentframe(true);
+    }
     else {
-      this.location_href(this.env.comm_path+url, target, true);
+      if (!preview && this.env.message_extwin && !this.env.extwin)
+        this.open_window(this.env.comm_path+url, 1000);
+      else
+        this.location_href(this.env.comm_path+url, target, true);
 
       // mark as read and change mbox unread counter
-      if (action == 'preview' && this.message_list && this.message_list.rows[id] && this.message_list.rows[id].unread && this.env.preview_pane_mark_read >= 0) {
-        this.preview_read_timer = window.setTimeout(function() {
+      if (preview && this.message_list && this.message_list.rows[id] && this.message_list.rows[id].unread && this.env.preview_pane_mark_read >= 0) {
+        this.preview_read_timer = setTimeout(function() {
           ref.set_message(id, 'unread', false);
           ref.update_thread_root(id, 'read');
           if (ref.env.unread_counts[ref.env.mailbox]) {
@@ -1893,7 +1963,7 @@
             ref.set_unread_count(ref.env.mailbox, ref.env.unread_counts[ref.env.mailbox], ref.env.mailbox == 'INBOX');
           }
           if (ref.env.preview_pane_mark_read > 0)
-            ref.http_post('mark', '_uid='+id+'&_flag=read&_quiet=1');
+            ref.http_post('mark', {_uid: id, _flag: 'read', _quiet: 1});
         }, this.env.preview_pane_mark_read * 1000);
       }
     }
@@ -1901,18 +1971,35 @@
 
   this.show_contentframe = function(show)
   {
-    var frm, win;
-    if (this.env.contentframe && (frm = $('#'+this.env.contentframe)) && frm.length) {
-      if (!show && (win = window.frames[this.env.contentframe])) {
+    var frame, win, name = this.env.contentframe;
+
+    if (name && (frame = this.get_frame_element(name))) {
+      if (!show && (win = this.get_frame_window(name))) {
         if (win.location && win.location.href.indexOf(this.env.blankpage)<0)
           win.location.href = this.env.blankpage;
       }
       else if (!bw.safari && !bw.konq)
-        frm[show ? 'show' : 'hide']();
-      }
+        $(frame)[show ? 'show' : 'hide']();
+    }
 
     if (!show && this.busy)
       this.set_busy(false, null, this.env.frame_lock);
+  };
+
+  this.get_frame_element = function(id)
+  {
+    var frame;
+
+    if (id && (frame = document.getElementById(id)))
+      return frame;
+  };
+
+  this.get_frame_window = function(id)
+  {
+    var frame = this.get_frame_element(id);
+
+    if (frame && frame.name && window.frames)
+      return window.frames[frame.name];
   };
 
   this.lock_frame = function()
@@ -1936,48 +2023,52 @@
     if (page > 0 && page <= this.env.pagecount) {
       this.env.current_page = page;
 
-      if (this.task == 'mail')
-        this.list_mailbox(this.env.mailbox, page);
-      else if (this.task == 'addressbook')
+      if (this.task == 'addressbook' || this.contact_list)
         this.list_contacts(this.env.source, this.env.group, page);
+      else if (this.task == 'mail')
+        this.list_mailbox(this.env.mailbox, page);
     }
+  };
+
+  // sends request to check for recent messages
+  this.checkmail = function()
+  {
+    var lock = this.set_busy(true, 'checkingmail'),
+      params = this.check_recent_params();
+
+    this.http_request('check-recent', params, lock);
   };
 
   // list messages of a specific mailbox using filter
   this.filter_mailbox = function(filter)
   {
-    var search, lock = this.set_busy(true, 'searching');
-
-    if (this.gui_objects.qsearchbox)
-      search = this.gui_objects.qsearchbox.value;
+    var lock = this.set_busy(true, 'searching');
 
     this.clear_message_list();
 
     // reset vars
     this.env.current_page = 1;
-    this.http_request('search', '_filter='+filter
-        + (search ? '&_q='+urlencode(search) : '')
-        + (this.env.mailbox ? '&_mbox='+urlencode(this.env.mailbox) : ''), lock);
+    this.http_request('search', this.search_params(false, filter), lock);
   };
 
   // list messages of a specific mailbox
-  this.list_mailbox = function(mbox, page, sort, add_url)
+  this.list_mailbox = function(mbox, page, sort, url)
   {
-    var url = '', target = window;
+    var win, target = window;
+
+    if (typeof url != 'object')
+      url = {};
 
     if (!mbox)
       mbox = this.env.mailbox ? this.env.mailbox : 'INBOX';
 
-    if (add_url)
-      url += add_url;
-
     // add sort to url if set
     if (sort)
-      url += '&_sort=' + sort;
+      url._sort = sort;
 
     // also send search request to get the right messages
     if (this.env.search_request)
-      url += '&_search='+this.env.search_request;
+      url._search = this.env.search_request;
 
     // set page=1 if changeing to another mailbox
     if (this.env.mailbox != mbox) {
@@ -1990,9 +2081,10 @@
     this.clear_message_list();
 
     if (mbox != this.env.mailbox || (mbox == this.env.mailbox && !page && !sort))
-      url += '&_refresh=1';
+      url._refresh = 1;
 
-    this.select_folder(mbox);
+    this.select_folder(mbox, '', true);
+    this.unmark_folder(mbox, 'recent', '', true);
     this.env.mailbox = mbox;
 
     // load message list remotely
@@ -2001,15 +2093,18 @@
       return;
     }
 
-    if (this.env.contentframe && window.frames && window.frames[this.env.contentframe]) {
-      target = window.frames[this.env.contentframe];
-      url += '&_framed=1';
+    if (win = this.get_frame_window(this.env.contentframe)) {
+      target = win;
+      url._framed = 1;
     }
 
     // load message list to target frame/window
     if (mbox) {
       this.set_busy(true, 'loading');
-      this.location_href(this.env.comm_path+'&_mbox='+urlencode(mbox)+(page ? '&_page='+page : '')+url, target);
+      url._mbox = mbox;
+      if (page)
+        url._page = page;
+      this.location_href(url, target);
     }
   };
 
@@ -2024,15 +2119,20 @@
   };
 
   // send remote request to load message list
-  this.list_mailbox_remote = function(mbox, page, add_url)
+  this.list_mailbox_remote = function(mbox, page, post_data)
   {
     // clear message list first
     this.message_list.clear();
 
-    // send request to server
-    var url = '_mbox='+urlencode(mbox)+(page ? '&_page='+page : ''),
-      lock = this.set_busy(true, 'loading');
-    this.http_request('list', url+add_url, lock);
+    var lock = this.set_busy(true, 'loading');
+
+    if (typeof post_data != 'object')
+      post_data = {};
+    post_data._mbox = mbox;
+    if (page)
+      post_data._page = page;
+
+    this.http_request('list', post_data, lock);
   };
 
   // removes messages that doesn't exists from list selection array
@@ -2057,8 +2157,8 @@
 
     while (new_row) {
       if (new_row.nodeType == 1 && (r = this.message_list.rows[new_row.uid]) && r.unread_children) {
-	    this.message_list.expand_all(r);
-	    this.set_unread_children(r.uid);
+        this.message_list.expand_all(r);
+        this.set_unread_children(r.uid);
       }
       new_row = new_row.nextSibling;
     }
@@ -2091,8 +2191,12 @@
   };
 
   // Initializes threads indicators/expanders after list update
-  this.init_threads = function(roots)
+  this.init_threads = function(roots, mbox)
   {
+    // #1487752
+    if (mbox && mbox != this.env.mailbox)
+      return false;
+
     for (var n=0, len=roots.length; n<len; n++)
       this.add_tree_icons(roots[n]);
     this.expand_threads();
@@ -2239,38 +2343,38 @@
     row = row.obj.nextSibling;
     while (row) {
       if (row.nodeType == 1 && (r = rows[row.uid])) {
-	    if (!r.depth || r.depth <= depth)
-	      break;
+        if (!r.depth || r.depth <= depth)
+          break;
 
-	    r.depth--; // move left
+        r.depth--; // move left
         // reset width and clear the content of a tab, icons will be added later
-	    $('#rcmtab'+r.uid).width(r.depth * 15).html('');
+        $('#rcmtab'+r.uid).width(r.depth * 15).html('');
         if (!r.depth) { // a new root
-	      count++; // increase roots count
-	      r.parent_uid = 0;
-	      if (r.has_children) {
-	        // replace 'leaf' with 'collapsed'
-	        $('#rcmrow'+r.uid+' '+'.leaf:first')
+          count++; // increase roots count
+          r.parent_uid = 0;
+          if (r.has_children) {
+            // replace 'leaf' with 'collapsed'
+            $('#rcmrow'+r.uid+' '+'.leaf:first')
               .attr('id', 'rcmexpando' + r.uid)
-	          .attr('class', (r.obj.style.display != 'none' ? 'expanded' : 'collapsed'))
-    	      .bind('mousedown', {uid:r.uid, p:this},
-	            function(e) { return e.data.p.expand_message_row(e, e.data.uid); });
+              .attr('class', (r.obj.style.display != 'none' ? 'expanded' : 'collapsed'))
+              .bind('mousedown', {uid:r.uid, p:this},
+                function(e) { return e.data.p.expand_message_row(e, e.data.uid); });
 
-	        r.unread_children = 0;
-	        roots.push(r);
-	      }
-	      // show if it was hidden
-	      if (r.obj.style.display == 'none')
-	        $(r.obj).show();
-	    }
-	    else {
-	      if (r.depth == depth)
-	        r.parent_uid = parent;
-	      if (r.unread && roots.length)
-	        roots[roots.length-1].unread_children++;
-	    }
-	  }
-	  row = row.nextSibling;
+            r.unread_children = 0;
+            roots.push(r);
+          }
+          // show if it was hidden
+          if (r.obj.style.display == 'none')
+            $(r.obj).show();
+        }
+        else {
+          if (r.depth == depth)
+            r.parent_uid = parent;
+          if (r.unread && roots.length)
+            roots[roots.length-1].unread_children++;
+        }
+      }
+      row = row.nextSibling;
     }
 
     // update unread_children for roots
@@ -2289,13 +2393,13 @@
 
     while (row) {
       if (row.nodeType == 1 && (r = rows[row.uid])) {
-	    if (!r.depth && cnt)
-	      cnt--;
+        if (!r.depth && cnt)
+          cnt--;
 
         if (!cnt)
-	      this.message_list.remove_row(row.uid);
-	  }
-	  row = row.nextSibling;
+          this.message_list.remove_row(row.uid);
+      }
+      row = row.nextSibling;
     }
   };
 
@@ -2368,7 +2472,7 @@
   // set message row status, class and icon
   this.set_message = function(uid, flag, status)
   {
-    var row = this.message_list.rows[uid];
+    var row = this.message_list && this.message_list.rows[uid];
 
     if (!row)
       return false;
@@ -2417,27 +2521,18 @@
     if (mbox && typeof mbox === 'object')
       mbox = mbox.id;
 
-    // exit if current or no mailbox specified or if selection is empty
-    if (!mbox || mbox == this.env.mailbox || (!this.env.uid && (!this.message_list || !this.message_list.get_selection().length)))
+    // exit if current or no mailbox specified
+    if (!mbox || mbox == this.env.mailbox)
       return;
 
-    var a_uids = [],
-      lock = this.display_message(this.get_label('copyingmessage'), 'loading'),
-      add_url = '&_target_mbox='+urlencode(mbox)+'&_from='+(this.env.action ? this.env.action : '');
+    var post_data = this.selection_post_data({_target_mbox: mbox});
 
-    if (this.env.uid)
-      a_uids[0] = this.env.uid;
-    else {
-      var selection = this.message_list.get_selection();
-      for (var n in selection) {
-        a_uids.push(selection[n]);
-      }
-    }
-
-    add_url += '&_uid='+this.uids_to_list(a_uids);
+    // exit if selection is empty
+    if (!post_data._uid)
+      return;
 
     // send request to server
-    this.http_post('copy', '_mbox='+urlencode(this.env.mailbox)+add_url, lock);
+    this.http_post('copy', post_data, this.display_message(this.get_label('copyingmessage'), 'loading'));
   };
 
   // move selected messages to the specified mailbox
@@ -2446,32 +2541,34 @@
     if (mbox && typeof mbox === 'object')
       mbox = mbox.id;
 
-    // exit if current or no mailbox specified or if selection is empty
-    if (!mbox || mbox == this.env.mailbox || (!this.env.uid && (!this.message_list || !this.message_list.get_selection().length)))
+    // exit if current or no mailbox specified
+    if (!mbox || mbox == this.env.mailbox)
       return;
 
-    var lock = false,
-      add_url = '&_target_mbox='+urlencode(mbox)+'&_from='+(this.env.action ? this.env.action : '');
+    var lock = false, post_data = this.selection_post_data({_target_mbox: mbox});
+
+    // exit if selection is empty
+    if (!post_data._uid)
+      return;
 
     // show wait message
-    if (this.env.action == 'show') {
+    if (this.env.action == 'show')
       lock = this.set_busy(true, 'movingmessage');
-    }
     else
       this.show_contentframe(false);
 
     // Hide message command buttons until a message is selected
     this.enable_command(this.env.message_commands, false);
 
-    this._with_selected_messages('moveto', lock, add_url);
+    this._with_selected_messages('moveto', post_data, lock);
   };
 
   // delete selected messages from the current mailbox
-  this.delete_messages = function()
+  this.delete_messages = function(event)
   {
     var uid, i, len, trash = this.env.trash_mailbox,
       list = this.message_list,
-      selection = list ? $.merge([], list.get_selection()) : [];
+      selection = list ? list.get_selection() : [];
 
     // exit if no mailbox specified or if selection is empty
     if (!this.env.uid && !selection.length)
@@ -2481,7 +2578,7 @@
     for (i=0, len=selection.length; i<len; i++) {
       uid = selection[i];
       if (list.rows[uid].has_children && !list.rows[uid].expanded)
-        list.select_childs(uid);
+        list.select_children(uid);
     }
 
     // if config is set to flag for deletion
@@ -2490,13 +2587,15 @@
       return false;
     }
     // if there isn't a defined trash mailbox or we are in it
-    // @TODO: we should check if defined trash mailbox exists
     else if (!trash || this.env.mailbox == trash)
+      this.permanently_remove_messages();
+    // we're in Junk folder and delete_junk is enabled
+    else if (this.env.delete_junk && this.env.junk_mailbox && this.env.mailbox == this.env.junk_mailbox)
       this.permanently_remove_messages();
     // if there is a trash mailbox defined and we're not currently in it
     else {
       // if shift was pressed delete it immediately
-      if (list && list.modkey == SHIFT_KEY) {
+      if ((list && list.modkey == SHIFT_KEY) || (event && rcube_event.get_modifier(event) == SHIFT_KEY)) {
         if (confirm(this.get_label('deletemessagesconfirm')))
           this.permanently_remove_messages();
       }
@@ -2510,29 +2609,29 @@
   // delete the selected messages permanently
   this.permanently_remove_messages = function()
   {
-    // exit if no mailbox specified or if selection is empty
-    if (!this.env.uid && (!this.message_list || !this.message_list.get_selection().length))
+    var post_data = this.selection_post_data();
+
+    // exit if selection is empty
+    if (!post_data._uid)
       return;
 
     this.show_contentframe(false);
-    this._with_selected_messages('delete', false, '&_from='+(this.env.action ? this.env.action : ''));
+    this._with_selected_messages('delete', post_data);
   };
 
   // Send a specifc moveto/delete request with UIDs of all selected messages
   // @private
-  this._with_selected_messages = function(action, lock, add_url)
+  this._with_selected_messages = function(action, post_data, lock)
   {
-    var a_uids = [], count = 0, msg;
+    var count = 0, msg;
 
-    if (this.env.uid)
-      a_uids[0] = this.env.uid;
-    else {
+    // update the list (remove rows, clear selection)
+    if (this.message_list) {
       var n, id, root, roots = [],
         selection = this.message_list.get_selection();
 
       for (n=0, len=selection.length; n<len; n++) {
         id = selection[n];
-        a_uids.push(id);
 
         if (this.env.threading) {
           count += this.update_thread(id);
@@ -2552,20 +2651,14 @@
       }
     }
 
-    // also send search request to get the right messages
-    if (this.env.search_request)
-      add_url += '&_search='+this.env.search_request;
-
     if (this.env.display_next && this.env.next_uid)
-      add_url += '&_next_uid='+this.env.next_uid;
+      post_data._next_uid = this.env.next_uid;
 
     if (count < 0)
-      add_url += '&_count='+(count*-1);
-    else if (count > 0) 
-      // remove threads from the end of the list
+      post_data._count = (count*-1);
+    // remove threads from the end of the list
+    else if (count > 0)
       this.delete_excessive_thread_rows();
-
-    add_url += '&_uid='+this.uids_to_list(a_uids);
 
     if (!lock) {
       msg = action == 'moveto' ? 'movingmessage' : 'deletingmessage';
@@ -2573,40 +2666,62 @@
     }
 
     // send request to server
-    this.http_post(action, '_mbox='+urlencode(this.env.mailbox)+add_url, lock);
+    this.http_post(action, post_data, lock);
+  };
+
+  // build post data for message delete/move/copy/flag requests
+  this.selection_post_data = function(data)
+  {
+    if (typeof(data) != 'object')
+      data = {};
+
+    data._mbox = this.env.mailbox;
+
+    if (!data._uid) {
+      var uids = this.env.uid ? [this.env.uid] : this.message_list.get_selection();
+      data._uid = this.uids_to_list(uids);
+    }
+
+    if (this.env.action)
+      data._from = this.env.action;
+
+    // also send search request to get the right messages
+    if (this.env.search_request)
+      data._search = this.env.search_request;
+
+    return data;
   };
 
   // set a specific flag to one or more messages
   this.mark_message = function(flag, uid)
   {
     var a_uids = [], r_uids = [], len, n, id,
-      selection = this.message_list ? this.message_list.get_selection() : [];
+      list = this.message_list;
 
     if (uid)
       a_uids[0] = uid;
     else if (this.env.uid)
       a_uids[0] = this.env.uid;
-    else if (this.message_list) {
-      for (n=0, len=selection.length; n<len; n++) {
-          a_uids.push(selection[n]);
-      }
-    }
+    else if (list)
+      a_uids = list.get_selection();
 
-    if (!this.message_list)
+    if (!list)
       r_uids = a_uids;
-    else
+    else {
+      list.focus();
       for (n=0, len=a_uids.length; n<len; n++) {
         id = a_uids[n];
-        if ((flag=='read' && this.message_list.rows[id].unread) 
-            || (flag=='unread' && !this.message_list.rows[id].unread)
-            || (flag=='delete' && !this.message_list.rows[id].deleted)
-            || (flag=='undelete' && this.message_list.rows[id].deleted)
-            || (flag=='flagged' && !this.message_list.rows[id].flagged)
-            || (flag=='unflagged' && this.message_list.rows[id].flagged))
+        if ((flag == 'read' && list.rows[id].unread)
+            || (flag == 'unread' && !list.rows[id].unread)
+            || (flag == 'delete' && !list.rows[id].deleted)
+            || (flag == 'undelete' && list.rows[id].deleted)
+            || (flag == 'flagged' && !list.rows[id].flagged)
+            || (flag == 'unflagged' && list.rows[id].flagged))
         {
           r_uids.push(id);
         }
       }
+    }
 
     // nothing to do
     if (!r_uids.length && !this.select_all_mode)
@@ -2632,18 +2747,14 @@
   this.toggle_read_status = function(flag, a_uids)
   {
     var i, len = a_uids.length,
-      url = '_uid='+this.uids_to_list(a_uids)+'&_flag='+flag,
+      post_data = this.selection_post_data({_uid: this.uids_to_list(a_uids), _flag: flag}),
       lock = this.display_message(this.get_label('markingmessage'), 'loading');
 
     // mark all message rows as read/unread
     for (i=0; i<len; i++)
-      this.set_message(a_uids[i], 'unread', (flag=='unread' ? true : false));
+      this.set_message(a_uids[i], 'unread', (flag == 'unread' ? true : false));
 
-    // also send search request to get the right messages
-    if (this.env.search_request)
-      url += '&_search='+this.env.search_request;
-
-    this.http_post('mark', url, lock);
+    this.http_post('mark', post_data, lock);
 
     for (i=0; i<len; i++)
       this.update_thread_root(a_uids[i], flag);
@@ -2653,18 +2764,14 @@
   this.toggle_flagged_status = function(flag, a_uids)
   {
     var i, len = a_uids.length,
-      url = '_uid='+this.uids_to_list(a_uids)+'&_flag='+flag,
+      post_data = this.selection_post_data({_uid: this.uids_to_list(a_uids), _flag: flag}),
       lock = this.display_message(this.get_label('markingmessage'), 'loading');
 
     // mark all message rows as flagged/unflagged
     for (i=0; i<len; i++)
-      this.set_message(a_uids[i], 'flagged', (flag=='flagged' ? true : false));
+      this.set_message(a_uids[i], 'flagged', (flag == 'flagged' ? true : false));
 
-    // also send search request to get the right messages
-    if (this.env.search_request)
-      url += '&_search='+this.env.search_request;
-
-    this.http_post('mark', url, lock);
+    this.http_post('mark', post_data, lock);
   };
 
   // mark all message rows as deleted/undeleted
@@ -2701,25 +2808,21 @@
 
   this.flag_as_undeleted = function(a_uids)
   {
-    var i, len=a_uids.length,
-      url = '_uid='+this.uids_to_list(a_uids)+'&_flag=undelete',
+    var i, len = a_uids.length,
+      post_data = this.selection_post_data({_uid: this.uids_to_list(a_uids), _flag: 'undelete'}),
       lock = this.display_message(this.get_label('markingmessage'), 'loading');
 
     for (i=0; i<len; i++)
       this.set_message(a_uids[i], 'deleted', false);
 
-    // also send search request to get the right messages
-    if (this.env.search_request)
-      url += '&_search='+this.env.search_request;
-
-    this.http_post('mark', url, lock);
-    return true;
+    this.http_post('mark', post_data, lock);
   };
 
   this.flag_as_deleted = function(a_uids)
   {
-    var add_url = '',
-      r_uids = [],
+    var r_uids = [],
+      post_data = this.selection_post_data({_uid: this.uids_to_list(a_uids), _flag: 'delete'}),
+      lock = this.display_message(this.get_label('markingmessage'), 'loading'),
       rows = this.message_list ? this.message_list.rows : [],
       count = 0;
 
@@ -2729,12 +2832,12 @@
         if (rows[uid].unread)
           r_uids[r_uids.length] = uid;
 
-	    if (this.env.skip_deleted) {
-	      count += this.update_thread(uid);
+        if (this.env.skip_deleted) {
+          count += this.update_thread(uid);
           this.message_list.remove_row(uid, (this.env.display_next && i == this.message_list.selection.length-1));
-	    }
-	    else
-	      this.set_message(uid, 'deleted', true);
+        }
+        else
+          this.set_message(uid, 'deleted', true);
       }
     }
 
@@ -2743,30 +2846,20 @@
       if(!this.env.display_next)
         this.message_list.clear_selection();
       if (count < 0)
-        add_url += '&_count='+(count*-1);
+        post_data._count = (count*-1);
       else if (count > 0) 
         // remove threads from the end of the list
         this.delete_excessive_thread_rows();
     }
 
-    add_url = '&_from='+(this.env.action ? this.env.action : ''),
-      lock = this.display_message(this.get_label('markingmessage'), 'loading');
-
     // ??
     if (r_uids.length)
-      add_url += '&_ruid='+this.uids_to_list(r_uids);
+      post_data._ruid = this.uids_to_list(r_uids);
 
-    if (this.env.skip_deleted) {
-      if (this.env.display_next && this.env.next_uid)
-        add_url += '&_next_uid='+this.env.next_uid;
-    }
+    if (this.env.skip_deleted && this.env.display_next && this.env.next_uid)
+      post_data._next_uid = this.env.next_uid;
 
-    // also send search request to get the right messages
-    if (this.env.search_request)
-      add_url += '&_search='+this.env.search_request;
-
-    this.http_post('mark', '_uid='+this.uids_to_list(a_uids)+'&_flag=delete'+add_url, lock);
-    return true;
+    this.http_post('mark', post_data, lock);
   };
 
   // flag as read without mark request (called from backend)
@@ -2792,6 +2885,19 @@
     return this.select_all_mode ? '*' : uids.join(',');
   };
 
+  // Sets title of the delete button
+  this.set_button_titles = function()
+  {
+    var label = 'deletemessage';
+
+    if (!this.env.flag_for_deletion
+      && this.env.trash_mailbox && this.env.mailbox != this.env.trash_mailbox
+      && (!this.env.delete_junk || !this.env.junk_mailbox || this.env.mailbox != this.env.junk_mailbox)
+    )
+      label = 'movemessagetotrash';
+
+    this.set_alttext('delete', label);
+  };
 
   /*********************************************************/
   /*********       mailbox folders methods         *********/
@@ -2799,24 +2905,23 @@
 
   this.expunge_mailbox = function(mbox)
   {
-    var lock, url = '_mbox='+urlencode(mbox);
+    var lock, post_data = {_mbox: mbox};
 
     // lock interface if it's the active mailbox
     if (mbox == this.env.mailbox) {
       lock = this.set_busy(true, 'loading');
-      url += '&_reload=1';
+      post_data._reload = 1;
       if (this.env.search_request)
-        url += '&_search='+this.env.search_request;
+        post_data._search = this.env.search_request;
     }
 
     // send request to server
-    this.http_post('expunge', url, lock);
+    this.http_post('expunge', post_data, lock);
   };
 
   this.purge_mailbox = function(mbox)
   {
-    var lock = false,
-      url = '_mbox='+urlencode(mbox);
+    var lock, post_data = {_mbox: mbox};
 
     if (!confirm(this.get_label('purgefolderconfirm')))
       return false;
@@ -2824,17 +2929,17 @@
     // lock interface if it's the active mailbox
     if (mbox == this.env.mailbox) {
        lock = this.set_busy(true, 'loading');
-       url += '&_reload=1';
+       post_data._reload = 1;
      }
 
     // send request to server
-    this.http_post('purge', url, lock);
+    this.http_post('purge', post_data, lock);
   };
 
   // test if purge command is allowed
   this.purge_mailbox_test = function()
   {
-    return (this.env.messagecount && (this.env.mailbox == this.env.trash_mailbox || this.env.mailbox == this.env.junk_mailbox
+    return (this.env.exists && (this.env.mailbox == this.env.trash_mailbox || this.env.mailbox == this.env.junk_mailbox
       || this.env.mailbox.match('^' + RegExp.escape(this.env.trash_mailbox) + RegExp.escape(this.env.delimiter))
       || this.env.mailbox.match('^' + RegExp.escape(this.env.junk_mailbox) + RegExp.escape(this.env.delimiter))));
   };
@@ -2864,6 +2969,21 @@
   /*********        message compose methods        *********/
   /*********************************************************/
 
+  this.open_compose_step = function(p)
+  {
+    var url = this.url('mail/compose', p);
+
+    // open new compose window
+    if (this.env.compose_extwin && !this.env.extwin) {
+      this.open_window(url, 1150);
+    }
+    else {
+      this.redirect(url);
+      if (this.env.extwin)
+        window.resizeTo(Math.max(1150, $(window).width()), $(window).height()+24);
+    }
+  };
+
   // init message compose form: set focus and eventhandlers
   this.init_messageform = function()
   {
@@ -2876,7 +2996,13 @@
       input_message = $("[name='_message']").get(0),
       html_mode = $("input[name='_is_html']").val() == '1',
       ac_fields = ['cc', 'bcc', 'replyto', 'followupto'],
-      ac_props;
+      ac_props, opener_rc = this.opener();
+
+    // close compose step in opener
+    if (opener_rc && opener_rc.env.action == 'compose') {
+      setTimeout(function(){ opener.history.back(); }, 100);
+      this.env.opened_extwin = true;
+    }
 
     // configure parallel autocompletion
     if (this.env.autocomplete_threads > 0) {
@@ -2896,7 +3022,7 @@
       this.set_caret_pos(input_message, this.env.top_posting ? 0 : $(input_message).val().length);
       // add signature according to selected identity
       // if we have HTML editor, signature is added in callback
-      if (input_from.prop('type') == 'select-one' && $("input[name='_draft_saveid']").val() == '') {
+      if (input_from.prop('type') == 'select-one') {
         this.change_identity(input_from[0]);
       }
     }
@@ -2919,12 +3045,84 @@
 
   this.init_address_input_events = function(obj, props)
   {
+    this.env.recipients_delimiter = this.env.recipients_separator + ' ';
+
     obj[bw.ie || bw.safari || bw.chrome ? 'keydown' : 'keypress'](function(e) { return ref.ksearch_keydown(e, this, props); })
       .attr('autocomplete', 'off');
   };
 
+  this.submit_messageform = function(draft)
+  {
+    var form = this.gui_objects.messageform;
+
+    if (!form)
+      return;
+
+    // all checks passed, send message
+    var msgid = this.set_busy(true, draft ? 'savingmessage' : 'sendingmessage'),
+      lang = this.spellcheck_lang(),
+      files = [];
+
+    // send files list
+    $('li', this.gui_objects.attachmentlist).each(function() { files.push(this.id.replace(/^rcmfile/, '')); });
+    $('input[name="_attachments"]', form).val(files.join());
+
+    form.target = 'savetarget';
+    form._draft.value = draft ? '1' : '';
+    form.action = this.add_url(form.action, '_unlock', msgid);
+    form.action = this.add_url(form.action, '_lang', lang);
+
+    // register timer to notify about connection timeout
+    this.submit_timer = setTimeout(function(){
+      ref.set_busy(false, null, msgid);
+      ref.display_message(ref.get_label('requesttimedout'), 'error');
+    }, this.env.request_timeout * 1000);
+
+    form.submit();
+  };
+
+  this.compose_recipient_select = function(list)
+  {
+    var id, n, recipients = 0;
+    for (n=0; n < list.selection.length; n++) {
+      id = list.selection[n];
+      if (this.env.contactdata[id])
+        recipients++;
+    }
+    this.enable_command('add-recipient', recipients);
+  };
+
+  this.compose_add_recipient = function(field)
+  {
+    var recipients = [], input = $('#_'+field), delim = this.env.recipients_delimiter;
+
+    if (this.contact_list && this.contact_list.selection.length) {
+      for (var id, n=0; n < this.contact_list.selection.length; n++) {
+        id = this.contact_list.selection[n];
+        if (id && this.env.contactdata[id]) {
+          recipients.push(this.env.contactdata[id]);
+
+          // group is added, expand it
+          if (id.charAt(0) == 'E' && this.env.contactdata[id].indexOf('@') < 0 && input.length) {
+            var gid = id.substr(1);
+            this.group2expand[gid] = { name:this.env.contactdata[id], input:input.get(0) };
+            this.http_request('group-expand', {_source: this.env.source, _gid: gid}, false);
+          }
+        }
+      }
+    }
+
+    if (recipients.length && input.length) {
+      var oldval = input.val(), rx = new RegExp(RegExp.escape(delim) + '\\s*$');
+      if (oldval && !rx.test(oldval))
+        oldval += delim + ' ';
+      input.val(oldval + recipients.join(delim + ' ') + delim + ' ');
+      this.triggerEvent('add-recipient', { field:field, recipients:recipients });
+    }
+  };
+
   // checks the input fields before sending a message
-  this.check_compose_input = function()
+  this.check_compose_input = function(cmd)
   {
     // check input fields
     var ed, input_to = $("[name='_to']"),
@@ -2959,15 +3157,28 @@
 
     // display localized warning for missing subject
     if (input_subject.val() == '') {
-      var subject = prompt(this.get_label('nosubjectwarning'), this.get_label('nosubject'));
+      var myprompt = $('<div class="prompt">').html('<div class="message">' + this.get_label('nosubjectwarning') + '</div>').appendTo(document.body);
+      var prompt_value = $('<input>').attr('type', 'text').attr('size', 30).appendTo(myprompt).val(this.get_label('nosubject'));
 
-      // user hit cancel, so don't send
-      if (!subject && subject !== '') {
+      var buttons = {};
+      buttons[this.get_label('cancel')] = function(){
         input_subject.focus();
-        return false;
-      }
-      else
-        input_subject.val((subject ? subject : this.get_label('nosubject')));
+        $(this).dialog('close');
+      };
+      buttons[this.get_label('sendmessage')] = function(){
+        input_subject.val(prompt_value.val());
+        $(this).dialog('close');
+        ref.command(cmd, { nocheck:true });  // repeat command which triggered this
+      };
+
+      myprompt.dialog({
+        modal: true,
+        resizable: false,
+        buttons: buttons,
+        close: function(event, ui) { $(this).remove() }
+      });
+      prompt_value.select();
+      return false;
     }
 
     // Apply spellcheck changes if spell checker is active
@@ -2995,15 +3206,19 @@
 
   this.toggle_editor = function(props)
   {
+    this.stop_spellchecking();
+
     if (props.mode == 'html') {
-      this.display_spellcheck_controls(false);
       this.plain2html($('#'+props.id).val(), props.id);
       tinyMCE.execCommand('mceAddControl', false, props.id);
+
+      if (this.env.default_font)
+        setTimeout(function() {
+          $(tinyMCE.get(props.id).getBody()).css('font-family', rcmail.env.default_font);
+        }, 500);
     }
     else {
       var thisMCE = tinyMCE.get(props.id), existingHtml;
-      if (thisMCE.plugins.spellchecker && thisMCE.plugins.spellchecker.active)
-        thisMCE.execCommand('mceSpellCheck', false);
 
       if (existingHtml = thisMCE.getContent()) {
         if (!confirm(this.get_label('editorwarning'))) {
@@ -3012,7 +3227,6 @@
         this.html2plain(existingHtml, props.id);
       }
       tinyMCE.execCommand('mceRemoveControl', false, props.id);
-      this.display_spellcheck_controls(true);
     }
 
     return true;
@@ -3021,43 +3235,53 @@
   this.stop_spellchecking = function()
   {
     var ed;
+
     if (window.tinyMCE && (ed = tinyMCE.get(this.env.composebody))) {
-      if (ed.plugins.spellchecker && ed.plugins.spellchecker.active)
+      if (ed.plugins && ed.plugins.spellchecker && ed.plugins.spellchecker.active)
         ed.execCommand('mceSpellCheck');
     }
-    else if ((ed = this.env.spellcheck) && !this.spellcheck_ready) {
-      $(ed.spell_span).trigger('click');
-      this.set_spellcheck_state('ready');
+    else if (ed = this.env.spellcheck) {
+      if (ed.state && ed.state != 'ready' && ed.state != 'no_error_found')
+        $(ed.spell_span).trigger('click');
     }
+
+    this.spellcheck_state();
   };
 
-  this.display_spellcheck_controls = function(vis)
+  this.spellcheck_state = function()
   {
-    if (this.env.spellcheck) {
-      // stop spellchecking process
-      if (!vis)
-        this.stop_spellchecking();
+    var ed, active;
 
-      $(this.env.spellcheck.spell_container).css('visibility', vis ? 'visible' : 'hidden');
-    }
-  };
+    if (window.tinyMCE && (ed = tinyMCE.get(this.env.composebody)) && ed.plugins && ed.plugins.spellchecker)
+      active = ed.plugins.spellchecker.active;
+    else if ((ed = this.env.spellcheck) && ed.state)
+      active = ed.state != 'ready' && ed.state != 'no_error_found';
 
-  this.set_spellcheck_state = function(s)
-  {
-    this.spellcheck_ready = (s == 'ready' || s == 'no_error_found');
-    this.enable_command('spellcheck', this.spellcheck_ready);
+    if (rcmail.buttons.spellcheck)
+      $('#'+rcmail.buttons.spellcheck[0].id)[active ? 'addClass' : 'removeClass']('selected');
+
+    return active;
   };
 
   // get selected language
   this.spellcheck_lang = function()
   {
     var ed;
-    if (window.tinyMCE && (ed = tinyMCE.get(this.env.composebody)) && ed.plugins.spellchecker) {
+
+    if (window.tinyMCE && (ed = tinyMCE.get(this.env.composebody)) && ed.plugins && ed.plugins.spellchecker)
       return ed.plugins.spellchecker.selectedLang;
-    }
-    else if (this.env.spellcheck) {
+    else if (this.env.spellcheck)
       return GOOGIE_CUR_LANG;
-    }
+  };
+
+  this.spellcheck_lang_set = function(lang)
+  {
+    var ed;
+
+    if (window.tinyMCE && (ed = tinyMCE.get(this.env.composebody)) && ed.plugins)
+      ed.plugins.spellchecker.selectedLang = lang;
+    else if (this.env.spellcheck)
+      this.env.spellcheck.setCurrentLanguage(lang);
   };
 
   // resume spellchecking, highlight provided mispellings without new ajax request
@@ -3076,17 +3300,28 @@
       sp.prepare(false, true);
       sp.processData(data);
     }
+
+    this.spellcheck_state();
   }
 
   this.set_draft_id = function(id)
   {
+    var rc;
+
+    if (!this.env.draft_id && id && (rc = this.opener())) {
+      // refresh the drafts folder in opener window
+      if (rc.env.task == 'mail' && rc.env.action == '' && rc.env.mailbox == this.env.drafts_mailbox)
+        rc.command('checkmail');
+    }
+
+    this.env.draft_id = id;
     $("input[name='_draft_saveid']").val(id);
   };
 
   this.auto_save_start = function()
   {
     if (this.env.draft_autosave)
-      this.save_timer = self.setTimeout(function(){ ref.command("savedraft"); }, this.env.draft_autosave * 1000);
+      this.save_timer = setTimeout(function(){ ref.command("savedraft"); }, this.env.draft_autosave * 1000);
 
     // Unlock interface now that saving is complete
     this.busy = false;
@@ -3095,20 +3330,11 @@
   this.compose_field_hash = function(save)
   {
     // check input fields
-    var ed, str = '',
-      value_to = $("[name='_to']").val(),
-      value_cc = $("[name='_cc']").val(),
-      value_bcc = $("[name='_bcc']").val(),
-      value_subject = $("[name='_subject']").val();
+    var ed, i, val, str = '', hash_fields = ['to', 'cc', 'bcc', 'subject'];
 
-    if (value_to)
-      str += value_to+':';
-    if (value_cc)
-      str += value_cc+':';
-    if (value_bcc)
-      str += value_bcc+':';
-    if (value_subject)
-      str += value_subject+':';
+    for (i=0; i<hash_fields.length; i++)
+      if (val = $('[name="_' + hash_fields[i] + '"]').val())
+        str += val + ':';
 
     if (window.tinyMCE && (ed = tinyMCE.get(this.env.composebody)))
       str += ed.getContent();
@@ -3133,13 +3359,21 @@
     if (!show_sig)
       show_sig = this.env.show_sig;
 
+    // first function execution
+    if (!this.env.identities_initialized) {
+      this.env.identities_initialized = true;
+      if (this.env.show_sig_later)
+        this.env.show_sig = true;
+      if (this.env.opened_extwin)
+        return;
+    }
+
     var cursor_pos, p = -1,
       id = obj.options[obj.selectedIndex].value,
       input_message = $("[name='_message']"),
       message = input_message.val(),
       is_html = ($("input[name='_is_html']").val() == '1'),
-      sig = this.env.identity,
-      sig_separator = this.env.sig_above && (this.env.compose_mode == 'reply' || this.env.compose_mode == 'forward') ? '---' : '-- ';
+      sig = this.env.identity;
 
     // enable manual signature insert
     if (this.env.signatures && this.env.signatures[id]) {
@@ -3152,29 +3386,26 @@
     if (!is_html) {
       // remove the 'old' signature
       if (show_sig && sig && this.env.signatures && this.env.signatures[sig]) {
-
-        sig = this.env.signatures[sig].is_html ? this.env.signatures[sig].plain_text : this.env.signatures[sig].text;
+        sig = this.env.signatures[sig].text;
         sig = sig.replace(/\r\n/g, '\n');
 
-        if (!sig.match(/^--[ -]\n/m))
-          sig = sig_separator + '\n' + sig;
-
-        p = this.env.sig_above ? message.indexOf(sig) : message.lastIndexOf(sig);
+        p = this.env.top_posting ? message.indexOf(sig) : message.lastIndexOf(sig);
         if (p >= 0)
           message = message.substring(0, p) + message.substring(p+sig.length, message.length);
       }
       // add the new signature string
       if (show_sig && this.env.signatures && this.env.signatures[id]) {
-        sig = this.env.signatures[id]['is_html'] ? this.env.signatures[id]['plain_text'] : this.env.signatures[id]['text'];
+        sig = this.env.signatures[id].text;
         sig = sig.replace(/\r\n/g, '\n');
 
-        if (!sig.match(/^--[ -]\n/m))
-          sig = sig_separator + '\n' + sig;
-
-        if (this.env.sig_above) {
+        if (this.env.top_posting) {
           if (p >= 0) { // in place of removed signature
             message = message.substring(0, p) + sig + message.substring(p, message.length);
             cursor_pos = p - 1;
+          }
+          else if (!message) { // empty message
+            cursor_pos = 0;
+            message = '\n\n' + sig;
           }
           else if (pos = this.get_caret_pos(input_message.get(0))) { // at cursor position
             message = message.substring(0, pos) + '\n' + sig + '\n\n' + message.substring(pos, message.length);
@@ -3211,7 +3442,7 @@
         sigElem = doc.createElement('div');
         sigElem.setAttribute('id', '_rc_sig');
 
-        if (this.env.sig_above) {
+        if (this.env.top_posting) {
           // if no existing sig and top posting then insert at caret pos
           editor.getWin().focus(); // correct focus in IE & Chrome
 
@@ -3234,21 +3465,8 @@
         }
       }
 
-      if (this.env.signatures[id]) {
-        if (this.env.signatures[id].is_html) {
-          sig = this.env.signatures[id].text;
-          if (!this.env.signatures[id].plain_text.match(/^--[ -]\r?\n/m))
-            sig = sig_separator + '<br />' + sig;
-        }
-        else {
-          sig = this.env.signatures[id].text;
-          if (!sig.match(/^--[ -]\r?\n/m))
-            sig = sig_separator + '\n' + sig;
-          sig = '<pre>' + sig + '</pre>';
-        }
-
-        sigElem.innerHTML = sig;
-      }
+      if (this.env.signatures[id])
+        sigElem.innerHTML = this.env.signatures[id].html;
     }
 
     this.env.identity = id;
@@ -3261,20 +3479,26 @@
     if (!form)
       return false;
 
-    // get file input field, count files on capable browser
-    var i, size = 0, field = $('input[type=file]', form).get(0),
-      files = field.files ? field.files.length : field.value ? 1 : 0;
+    // count files and size on capable browser
+    var size = 0, numfiles = 0;
+
+    $('input[type=file]', form).each(function(i, field) {
+      var files = field.files ? field.files.length : (field.value ? 1 : 0);
+
+      // check file size
+      if (field.files) {
+        for (var i=0; i < files; i++)
+          size += field.files[i].size;
+      }
+
+      numfiles += files;
+    });
 
     // create hidden iframe and post upload form
-    if (files) {
-      // check file size
-      if (field.files && this.env.max_filesize && this.env.filesizeerror) {
-        for (i=0; i<files; i++)
-          size += field.files[i].size;
-        if (size && size > this.env.max_filesize) {
-          this.display_message(this.env.filesizeerror, 'error');
-          return;
-        }
+    if (numfiles) {
+      if (this.env.max_filesize && this.env.filesizeerror && size > this.env.max_filesize) {
+        this.display_message(this.env.filesizeerror, 'error');
+        return;
       }
 
       var frame_name = this.async_upload_form(form, 'upload', function(e) {
@@ -3299,14 +3523,10 @@
       });
 
       // display upload indicator and cancel button
-      var content = '<span>' + this.get_label('uploading' + (files > 1 ? 'many' : '')) + '</span>',
+      var content = '<span>' + this.get_label('uploading' + (numfiles > 1 ? 'many' : '')) + '</span>',
         ts = frame_name.replace(/^rcmupload/, '');
 
-      if (this.env.loadingicon)
-        content = '<img src="'+this.env.loadingicon+'" alt="" />'+content;
-      if (this.env.cancelicon)
-        content = '<a title="'+this.get_label('cancel')+'" onclick="return rcmail.cancel_attachment_upload(\''+ts+'\', \''+frame_name+'\');" href="#cancelupload"><img src="'+this.env.cancelicon+'" alt="" /></a>'+content;
-      this.add2attachment_list(ts, { name:'', html:content, complete:false });
+      this.add2attachment_list(ts, { name:'', html:content, classname:'uploading', frame:frame_name, complete:false });
 
       // upload progress support
       if (this.env.upload_progress_time) {
@@ -3326,7 +3546,14 @@
     if (!this.gui_objects.attachmentlist)
       return false;
 
-    var indicator, li = $('<li>').attr('id', name).html(att.html);
+    if (!att.complete && ref.env.loadingicon)
+      att.html = '<img src="'+ref.env.loadingicon+'" alt="" class="uploading" />' + att.html;
+
+    if (!att.complete && att.frame)
+      att.html = '<a title="'+this.get_label('cancel')+'" onclick="return rcmail.cancel_attachment_upload(\''+name+'\', \''+att.frame+'\');" href="#cancelupload" class="cancelupload">'
+        + (this.env.cancelicon ? '<img src="'+this.env.cancelicon+'" alt="" />' : this.get_label('cancel')) + '</a>' + att.html;
+
+    var indicator, li = $('<li>').attr('id', name).addClass(att.classname).html(att.html);
 
     // replace indicator's li
     if (upload_id && (indicator = document.getElementById(upload_id))) {
@@ -3346,16 +3573,8 @@
 
   this.remove_from_attachment_list = function(name)
   {
-    if (this.env.attachments[name])
-      delete this.env.attachments[name];
-
-    if (!this.gui_objects.attachmentlist)
-      return false;
-
-    var list = this.gui_objects.attachmentlist.getElementsByTagName("li");
-    for (i=0; i<list.length; i++)
-      if (list[i].id == name)
-        this.gui_objects.attachmentlist.removeChild(list[i]);
+    delete this.env.attachments[name];
+    $('#'+name).remove();
   };
 
   this.remove_attachment = function(name)
@@ -3378,7 +3597,7 @@
 
   this.upload_progress_start = function(action, name)
   {
-    window.setTimeout(function() { rcmail.http_request(action, {_progress: name}); },
+    setTimeout(function() { rcmail.http_request(action, {_progress: name}); },
       this.env.upload_progress_time * 1000);
   };
 
@@ -3399,7 +3618,7 @@
   this.add_contact = function(value)
   {
     if (value)
-      this.http_post('addcontact', '_address='+value);
+      this.http_post('addcontact', {_address: value});
 
     return true;
   };
@@ -3408,38 +3627,62 @@
   this.qsearch = function(value)
   {
     if (value != '') {
-      var n, r, addurl = '', mods_arr = [],
-        mods = this.env.search_mods,
-        mbox = this.env.mailbox,
-        lock = this.set_busy(true, 'searching');
+      var r, lock = this.set_busy(true, 'searching'),
+        url = this.search_params(value);
 
-      if (this.message_list) {
+      if (this.message_list)
         this.clear_message_list();
-        if (mods)
-          mods = mods[mbox] ? mods[mbox] : mods['*'];
-      } else if (this.contact_list) {
+      else if (this.contact_list)
         this.list_contacts_clear();
-      }
+
+      if (this.env.source)
+        url._source = this.env.source;
+      if (this.env.group)
+        url._gid = this.env.group;
+
+      // reset vars
+      this.env.current_page = 1;
+
+      var action = this.env.action == 'compose' && this.contact_list ? 'search-contacts' : 'search';
+      r = this.http_request(action, url, lock);
+
+      this.env.qsearch = {lock: lock, request: r};
+    }
+  };
+
+  // build URL params for search
+  this.search_params = function(search, filter)
+  {
+    var n, url = {}, mods_arr = [],
+      mods = this.env.search_mods,
+      mbox = this.env.mailbox;
+
+    if (!filter && this.gui_objects.search_filter)
+      filter = this.gui_objects.search_filter.value;
+
+    if (!search && this.gui_objects.qsearchbox)
+      search = this.gui_objects.qsearchbox.value;
+
+    if (filter)
+      url._filter = filter;
+
+    if (search) {
+      url._q = search;
+
+      if (mods && this.message_list)
+        mods = mods[mbox] ? mods[mbox] : mods['*'];
 
       if (mods) {
         for (n in mods)
           mods_arr.push(n);
-        addurl += '&_headers='+mods_arr.join(',');
+        url._headers = mods_arr.join(',');
       }
-
-      if (this.gui_objects.search_filter)
-        addurl += '&_filter=' + this.gui_objects.search_filter.value;
-
-      // reset vars
-      this.env.current_page = 1;
-      r = this.http_request('search', '_q='+urlencode(value)
-        + (mbox ? '&_mbox='+urlencode(mbox) : '')
-        + (this.env.source ? '&_source='+urlencode(this.env.source) : '')
-        + (this.env.group ? '&_gid='+urlencode(this.env.group) : '')
-        + (addurl ? addurl : ''), lock);
-
-      this.env.qsearch = {lock: lock, request: r};
     }
+
+    if (mbox)
+      url._mbox = mbox;
+
+    return url;
   };
 
   // reset quick-search form
@@ -3456,11 +3699,25 @@
     this.env.search_id = null;
   };
 
-  this.sent_successfully = function(type, msg)
+  this.sent_successfully = function(type, msg, target)
   {
     this.display_message(msg, type);
-    // before redirect we need to wait some time for Chrome (#1486177)
-    window.setTimeout(function(){ ref.list_mailbox(); }, 500);
+
+    if (this.env.extwin) {
+      var rc = this.opener();
+      this.lock_form(this.gui_objects.messageform);
+      if (rc) {
+        rc.display_message(msg, type);
+        // refresh the folder where sent message was saved
+        if (target && rc.env.task == 'mail' && rc.env.action == '' && rc.env.mailbox == target)
+          rc.command('checkmail');
+      }
+      setTimeout(function(){ window.close() }, 1000);
+    }
+    else {
+      // before redirect we need to wait some time for Chrome (#1486177)
+      setTimeout(function(){ ref.list_mailbox(); }, 500);
+    }
   };
 
 
@@ -3479,9 +3736,9 @@
       mod = rcube_event.get_modifier(e);
 
     switch (key) {
-      case 38:  // key up
-      case 40:  // key down
-        if (!this.ksearch_pane)
+      case 38:  // arrow up
+      case 40:  // arrow down
+        if (!this.ksearch_visible())
           break;
 
         var dir = key==38 ? 1 : 0;
@@ -3518,11 +3775,11 @@
       case 37:  // left
       case 39:  // right
         if (mod != SHIFT_KEY)
-	      return;
+          return;
     }
 
     // start timer
-    this.ksearch_timer = window.setTimeout(function(){ ref.ksearch_get_results(props); }, 200);
+    this.ksearch_timer = setTimeout(function(){ ref.ksearch_get_results(props); }, 200);
     this.ksearch_input = obj;
 
     return true;
@@ -3565,13 +3822,12 @@
 
     // insert all members of a group
     if (typeof this.env.contacts[id] === 'object' && this.env.contacts[id].id) {
-      insert += this.env.contacts[id].name + ', ';
-      this.group2expand = $.extend({}, this.env.contacts[id]);
-      this.group2expand.input = this.ksearch_input;
-      this.http_request('mail/group-expand', '_source='+urlencode(this.env.contacts[id].source)+'&_gid='+urlencode(this.env.contacts[id].id), false);
+      insert += this.env.contacts[id].name + this.env.recipients_delimiter;
+      this.group2expand[this.env.contacts[id].id] = $.extend({ input: this.ksearch_input }, this.env.contacts[id]);
+      this.http_request('mail/group-expand', {_source: this.env.contacts[id].source, _gid: this.env.contacts[id].id}, false);
     }
     else if (typeof this.env.contacts[id] === 'string') {
-      insert = this.env.contacts[id] + ', ';
+      insert = this.env.contacts[id] + this.env.recipients_delimiter;
       trigger = true;
     }
 
@@ -3588,10 +3844,10 @@
 
   this.replace_group_recipients = function(id, recipients)
   {
-    if (this.group2expand && this.group2expand.id == id) {
-      this.group2expand.input.value = this.group2expand.input.value.replace(this.group2expand.name, recipients);
-      this.triggerEvent('autocomplete_insert', { field:this.group2expand.input, insert:recipients });
-      this.group2expand = null;
+    if (this.group2expand[id]) {
+      this.group2expand[id].input.value = this.group2expand[id].input.value.replace(this.group2expand[id].name, recipients);
+      this.triggerEvent('autocomplete_insert', { field:this.group2expand[id].input, insert:recipients });
+      this.group2expand[id] = null;
     }
   };
 
@@ -3608,9 +3864,10 @@
 
     // get string from current cursor pos to last comma
     var cpos = this.get_caret_pos(this.ksearch_input),
-      p = inp_value.lastIndexOf(',', cpos-1),
+      p = inp_value.lastIndexOf(this.env.recipients_separator, cpos-1),
       q = inp_value.substring(p+1, cpos),
-      min = this.env.autocomplete_min_length;
+      min = this.env.autocomplete_min_length,
+      ac = this.ksearch_data;
 
     // trim query string
     q = $.trim(q);
@@ -3618,6 +3875,8 @@
     // Don't (re-)search if the last results are still active
     if (q == this.ksearch_value)
       return;
+
+    this.ksearch_destroy();
 
     if (q.length && q.length < min) {
       if (!this.ksearch_info) {
@@ -3629,31 +3888,32 @@
 
     var old_value = this.ksearch_value;
     this.ksearch_value = q;
-    this.ksearch_destroy();
 
     // ...string is empty
     if (!q.length)
       return;
 
-    // ...new search value contains old one and previous search result was empty
-    if (old_value && old_value.length && this.env.contacts && !this.env.contacts.length && q.indexOf(old_value) == 0)
+    // ...new search value contains old one and previous search was not finished or its result was empty
+    if (old_value && old_value.length && q.indexOf(old_value) == 0 && (!ac || ac.num <= 0) && this.env.contacts && !this.env.contacts.length)
       return;
 
     var i, lock, source, xhr, reqid = new Date().getTime(),
+      post_data = {_search: q, _id: reqid},
       threads = props && props.threads ? props.threads : 1,
       sources = props && props.sources ? props.sources : [],
       action = props && props.action ? props.action : 'mail/autocomplete';
 
-    this.ksearch_data = {id: reqid, sources: sources.slice(), action: action, locks: [], requests: []};
+    this.ksearch_data = {id: reqid, sources: sources.slice(), action: action,
+      locks: [], requests: [], num: sources.length};
 
     for (i=0; i<threads; i++) {
       source = this.ksearch_data.sources.shift();
-      if (threads > 1 && source === null)
+      if (threads > 1 && source === undefined)
         break;
 
+      post_data._source = source ? source : '';
       lock = this.display_message(this.get_label('searching'), 'loading');
-      xhr = this.http_post(action, '_search='+urlencode(q)+'&_id='+reqid
-        + (source ? '&_source='+urlencode(source) : ''), lock);
+      xhr = this.http_post(action, post_data, lock);
 
       this.ksearch_data.locks.push(lock);
       this.ksearch_data.requests.push(xhr);
@@ -3671,7 +3931,9 @@
       return;
 
     // display search results
-    var p, ul, li, text, init, s_val = this.ksearch_value,
+    var i, len, ul, li, text, init,
+      value = this.ksearch_value,
+      data = this.ksearch_data,
       maxlen = this.env.autocomplete_max ? this.env.autocomplete_max : 15;
 
     // create results pane if not present
@@ -3700,11 +3962,11 @@
     }
 
     // add each result line to list
-    if (results && results.length) {
-      for (i=0; i < results.length && maxlen > 0; i++) {
+    if (results && (len = results.length)) {
+      for (i=0; i < len && maxlen > 0; i++) {
         text = typeof results[i] === 'object' ? results[i].name : results[i];
         li = document.createElement('LI');
-        li.innerHTML = text.replace(new RegExp('('+RegExp.escape(s_val)+')', 'ig'), '##$1%%').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/##([^%]+)%%/g, '<b>$1</b>');
+        li.innerHTML = text.replace(new RegExp('('+RegExp.escape(value)+')', 'ig'), '##$1%%').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/##([^%]+)%%/g, '<b>$1</b>');
         li.onmouseover = function(){ ref.ksearch_select(this); };
         li.onmouseup = function(){ ref.ksearch_click(this) };
         li._rcm_id = this.env.contacts.length + i;
@@ -3722,24 +3984,29 @@
       }
     }
 
-    if (results && results.length)
+    if (len)
       this.env.contacts = this.env.contacts.concat(results);
 
     // run next parallel search
-    if (this.ksearch_data.id == reqid) {
-      if (maxlen > 0 && this.ksearch_data.sources.length) {
-        var lock, xhr, props = this.ksearch_data, source = props.sources.shift();
+    if (data.id == reqid) {
+      data.num--;
+      if (maxlen > 0 && data.sources.length) {
+        var lock, xhr, source = data.sources.shift(), post_data;
         if (source) {
+          post_data = {_search: value, _id: reqid, _source: source};
           lock = this.display_message(this.get_label('searching'), 'loading');
-          xhr = this.http_post(props.action, '_search='+urlencode(s_val)+'&_id='+reqid
-            +'&_source='+urlencode(source), lock);
+          xhr = this.http_post(data.action, post_data, lock);
 
           this.ksearch_data.locks.push(lock);
           this.ksearch_data.requests.push(xhr);
         }
       }
-      else if (!maxlen && !this.ksearch_msg)
-        this.ksearch_msg = this.display_message(this.get_label('autocompletemore'));
+      else if (!maxlen) {
+        if (!this.ksearch_msg)
+          this.ksearch_msg = this.display_message(this.get_label('autocompletemore'));
+        // abort pending searches
+        this.ksearch_abort();
+      }
     }
   };
 
@@ -3772,16 +4039,10 @@
     this.ksearch_destroy();
   };
 
-  // Aborts pending autocomplete requests
+  // Clears autocomplete data/requests
   this.ksearch_destroy = function()
   {
-    var i, len, ac = this.ksearch_data;
-
-    if (!ac)
-      return;
-
-    for (i=0, len=ac.locks.length; i<len; i++)
-      this.abort_request({request: ac.requests[i], lock: ac.locks[i]});
+    this.ksearch_abort();
 
     if (this.ksearch_info)
       this.hide_message(this.ksearch_info);
@@ -3793,6 +4054,19 @@
     this.ksearch_info = null;
     this.ksearch_msg = null;
   }
+
+  // Aborts pending autocomplete requests
+  this.ksearch_abort = function()
+  {
+    var i, len, ac = this.ksearch_data;
+
+    if (!ac)
+      return;
+
+    for (i=0, len=ac.locks.length; i<len; i++)
+      this.abort_request({request: ac.requests[i], lock: ac.locks[i]});
+  };
+
 
   /*********************************************************/
   /*********         address book methods          *********/
@@ -3809,41 +4083,56 @@
     if (this.preview_timer)
       clearTimeout(this.preview_timer);
 
-    var n, id, sid, ref = this, writable = false,
+    var n, id, sid, contact, ref = this, writable = false,
       source = this.env.source ? this.env.address_sources[this.env.source] : null;
 
+    // we don't have dblclick handler here, so use 200 instead of this.dblclick_time
     if (id = list.get_single_selection())
-      this.preview_timer = window.setTimeout(function(){ ref.load_contact(id, 'show'); }, 200);
+      this.preview_timer = setTimeout(function(){ ref.load_contact(id, 'show'); }, 200);
     else if (this.env.contentframe)
       this.show_contentframe(false);
 
-    // no source = search result, we'll need to detect if any of
-    // selected contacts are in writable addressbook to enable edit/delete
     if (list.selection.length) {
-      if (!source) {
-        for (n in list.selection) {
+      list.draggable = false;
+
+      // no source = search result, we'll need to detect if any of
+      // selected contacts are in writable addressbook to enable edit/delete
+      // we'll also need to know sources used in selection for copy
+      // and group-addmember operations (drag&drop)
+      this.env.selection_sources = [];
+
+      if (source)
+        this.env.selection_sources.push(this.env.source);
+
+      for (n in list.selection) {
+        contact = list.data[list.selection[n]];
+        if (!source) {
           sid = String(list.selection[n]).replace(/^[^-]+-/, '');
-          if (sid && this.env.address_sources[sid] && !this.env.address_sources[sid].readonly) {
-            writable = true;
-            break;
+          if (sid && this.env.address_sources[sid]) {
+            writable = writable || (!this.env.address_sources[sid].readonly && !contact.readonly);
+            this.env.selection_sources.push(sid);
           }
         }
+        else
+          writable = writable || (!source.readonly && !contact.readonly);
       }
-      else {
-        writable = !source.readonly;
-      }
+
+      this.env.selection_sources = $.unique(this.env.selection_sources);
     }
 
-    this.enable_command('compose', list.selection.length > 0);
+    // if a group is currently selected, and there is at least one contact selected
+    // thend we can enable the group-remove-selected command
+    this.enable_command('group-remove-selected', this.env.group && list.selection.length > 0 && writable);
+    this.enable_command('compose', this.env.group || list.selection.length > 0);
     this.enable_command('edit', id && writable);
-    this.enable_command('delete', list.selection.length && writable);
+    this.enable_command('delete', list.selection.length > 0 && writable);
 
     return false;
   };
 
   this.list_contacts = function(src, group, page)
   {
-    var folder, add_url = '',
+    var win, folder, url = {},
       target = window;
 
     if (!src)
@@ -3861,13 +4150,31 @@
 
     if (this.env.search_id)
       folder = 'S'+this.env.search_id;
-    else
+    else if (!this.env.search_request)
       folder = group ? 'G'+src+group : src;
-
-    this.select_folder(folder);
 
     this.env.source = src;
     this.env.group = group;
+
+    // truncate groups listing stack
+    var index = $.inArray(this.env.group, this.env.address_group_stack);
+    if (index < 0)
+      this.env.address_group_stack = [];
+    else
+      this.env.address_group_stack = this.env.address_group_stack.slice(0,index);
+
+    // make sure the current group is on top of the stack
+    if (this.env.group) {
+      this.env.address_group_stack.push(this.env.group);
+
+      // mark the first group on the stack as selected in the directory list
+      folder = 'G'+src+this.env.address_group_stack[0];
+    }
+    else if (this.gui_objects.addresslist_title) {
+      $(this.gui_objects.addresslist_title).html(this.get_label('contacts'));
+    }
+
+    this.select_folder(folder, '', true);
 
     // load contacts remotely
     if (this.gui_objects.contactslist) {
@@ -3875,22 +4182,24 @@
       return;
     }
 
-    if (this.env.contentframe && window.frames && window.frames[this.env.contentframe]) {
-      target = window.frames[this.env.contentframe];
-      add_url = '&_framed=1';
+    if (win = this.get_frame_window(this.env.contentframe)) {
+      target = win;
+      url._framed = 1;
     }
 
     if (group)
-      add_url += '&_gid='+group;
+      url._gid = group;
     if (page)
-      add_url += '&_page='+page;
+      url._page = page;
+    if (src)
+      url._source = src;
 
     // also send search request to get the correct listing
     if (this.env.search_request)
-      add_url += '&_search='+this.env.search_request;
+      url._search = this.env.search_request;
 
     this.set_busy(true, 'loading');
-    this.location_href(this.env.comm_path + (src ? '&_source='+urlencode(src) : '') + add_url, target);
+    this.location_href(url, target);
   };
 
   // send remote request to load contacts list
@@ -3900,44 +4209,72 @@
     this.list_contacts_clear();
 
     // send request to server
-    var url = (src ? '_source='+urlencode(src) : '') + (page ? (src?'&':'') + '_page='+page : ''),
-      lock = this.set_busy(true, 'loading');
+    var url = {}, lock = this.set_busy(true, 'loading');
+
+    if (src)
+      url._source = src;
+    if (page)
+      url._page = page;
+    if (group)
+      url._gid = group;
 
     this.env.source = src;
     this.env.group = group;
 
-    if (group)
-      url += '&_gid='+group;
-
-    // also send search request to get the right messages
+    // also send search request to get the right records
     if (this.env.search_request)
-      url += '&_search='+this.env.search_request;
+      url._search = this.env.search_request;
 
-    this.http_request('list', url, lock);
+    this.http_request(this.env.task == 'mail' ? 'list-contacts' : 'list', url, lock);
   };
 
   this.list_contacts_clear = function()
   {
+    this.contact_list.data = {};
     this.contact_list.clear(true);
     this.show_contentframe(false);
-    this.enable_command('delete', 'compose', false);
+    this.enable_command('delete', false);
+    this.enable_command('compose', this.env.group ? true : false);
+  };
+
+  this.set_group_prop = function(prop)
+  {
+    if (this.gui_objects.addresslist_title) {
+      var boxtitle = $(this.gui_objects.addresslist_title).html('');  // clear contents
+
+      // add link to pop back to parent group
+      if (this.env.address_group_stack.length > 1) {
+        $('<a href="#list">...</a>')
+          .addClass('poplink')
+          .appendTo(boxtitle)
+          .click(function(e){ return ref.command('popgroup','',this); });
+        boxtitle.append('&nbsp;&raquo;&nbsp;');
+      }
+
+      boxtitle.append($('<span>'+prop.name+'</span>'));
+    }
+
+    this.triggerEvent('groupupdate', prop);
   };
 
   // load contact record
   this.load_contact = function(cid, action, framed)
   {
-    var add_url = '', target = window;
+    var win, url = {}, target = window,
+      rec = this.contact_list ? this.contact_list.data[cid] : null;
 
-    if (this.env.contentframe && window.frames && window.frames[this.env.contentframe]) {
-      add_url = '&_framed=1';
-      target = window.frames[this.env.contentframe];
+    if (win = this.get_frame_window(this.env.contentframe)) {
+      url._framed = 1;
+      target = win;
       this.show_contentframe(true);
 
       // load dummy content
       if (!cid) {
         // unselect selected row(s)
         this.contact_list.clear_selection();
-        this.enable_command('delete', 'compose', false);
+
+        this.enable_command('compose', rec && rec.email);
+        this.enable_command('delete', rec && rec._type != 'group');
       }
     }
     else if (framed)
@@ -3945,12 +4282,15 @@
 
     if (action && (cid || action=='add') && !this.drag_active) {
       if (this.env.group)
-        add_url += '&_gid='+urlencode(this.env.group);
+        url._gid = this.env.group;
 
-      this.location_href(this.env.comm_path+'&_action='+action
-        +'&_source='+urlencode(this.env.source)
-        +'&_cid='+urlencode(cid) + add_url, target, true);
+      url._action = action;
+      url._source = this.env.source;
+      url._cid = cid;
+
+      this.location_href(url, target, true);
     }
+
     return true;
   };
 
@@ -3958,47 +4298,62 @@
   this.group_member_change = function(what, cid, source, gid)
   {
     what = what == 'add' ? 'add' : 'del';
-    var lock = this.display_message(this.get_label(what == 'add' ? 'addingmember' : 'removingmember'), 'loading');
+    var label = this.get_label(what == 'add' ? 'addingmember' : 'removingmember'),
+      lock = this.display_message(label, 'loading'),
+      post_data = {_cid: cid, _source: source, _gid: gid};
 
-    this.http_post('group-'+what+'members', '_cid='+urlencode(cid)
-      + '&_source='+urlencode(source)
-      + '&_gid='+urlencode(gid), lock);
+    this.http_post('group-'+what+'members', post_data, lock);
   };
 
   // copy a contact to the specified target (group or directory)
   this.copy_contact = function(cid, to)
   {
+    var n, dest = to.type == 'group' ? to.source : to.id,
+      source = this.env.source,
+      group = this.env.group ? this.env.group : '';
+
     if (!cid)
       cid = this.contact_list.get_selection().join(',');
 
-    if (to.type == 'group' && to.source == this.env.source)
-      this.group_member_change('add', cid, to.source, to.id);
-    else if (to.type == 'group' && !this.env.address_sources[to.source].readonly) {
-      var lock = this.display_message(this.get_label('copyingcontact'), 'loading');
-      this.http_post('copy', '_cid='+urlencode(cid)
-        + '&_source='+urlencode(this.env.source)
-        + '&_to='+urlencode(to.source)
-        + '&_togid='+urlencode(to.id)
-        + (this.env.group ? '&_gid='+urlencode(this.env.group) : ''), lock);
+    if (!cid || !this.env.address_sources[dest] || this.env.address_sources[dest].readonly)
+      return;
+
+    // search result may contain contacts from many sources, but if there is only one...
+    if (source == '' && this.env.selection_sources.length == 1)
+      source = this.env.selection_sources[0];
+
+    // tagret is a group
+    if (to.type == 'group') {
+      if (dest == source)
+        this.group_member_change('add', cid, dest, to.id);
+      else {
+        var lock = this.display_message(this.get_label('copyingcontact'), 'loading'),
+          post_data = {_cid: cid, _source: this.env.source, _to: dest, _togid: to.id, _gid: group};
+
+        this.http_post('copy', post_data, lock);
+      }
     }
-    else if (to.id != this.env.source && cid && this.env.address_sources[to.id] && !this.env.address_sources[to.id].readonly) {
-      var lock = this.display_message(this.get_label('copyingcontact'), 'loading');
-      this.http_post('copy', '_cid='+urlencode(cid)
-        + '&_source='+urlencode(this.env.source)
-        + '&_to='+urlencode(to.id)
-        + (this.env.group ? '&_gid='+urlencode(this.env.group) : ''), lock);
+    // target is an addressbook
+    else if (to.id != source) {
+      var lock = this.display_message(this.get_label('copyingcontact'), 'loading'),
+        post_data = {_cid: cid, _source: this.env.source, _to: to.id, _gid: group};
+
+      this.http_post('copy', post_data, lock);
     }
   };
 
   this.delete_contacts = function()
   {
+    var selection = this.contact_list.get_selection(),
+      undelete = this.env.source && this.env.address_sources[this.env.source].undelete;
+
     // exit if no mailbox specified or if selection is empty
-    var selection = this.contact_list.get_selection();
-    var undelete = this.env.address_sources[this.env.source].undelete;
     if (!(selection.length || this.env.cid) || (!undelete && !confirm(this.get_label('deletecontactconfirm'))))
       return;
 
-    var id, n, a_cids = [], qs = '';
+    var id, n, a_cids = [],
+      post_data = {_source: this.env.source, _from: (this.env.action ? this.env.action : '')},
+      lock = this.display_message(this.get_label('contactdeleting'), 'loading');
 
     if (this.env.cid)
       a_cids.push(this.env.cid);
@@ -4014,25 +4369,27 @@
         this.show_contentframe(false);
     }
 
+    post_data._cid = a_cids.join(',');
+
     if (this.env.group)
-      qs += '&_gid='+urlencode(this.env.group);
+      post_data._gid = this.env.group;
 
     // also send search request to get the right records from the next page
     if (this.env.search_request)
-      qs += '&_search='+this.env.search_request;
+      post_data._search = this.env.search_request;
 
     // send request to server
-    this.http_post('delete', '_cid='+urlencode(a_cids.join(','))+'&_source='+urlencode(this.env.source)+'&_from='+(this.env.action ? this.env.action : '')+qs);
+    this.http_post('delete', post_data, lock)
 
     return true;
   };
 
   // update a contact record in the list
-  this.update_contact_row = function(cid, cols_arr, newcid, source)
+  this.update_contact_row = function(cid, cols_arr, newcid, source, data)
   {
     var c, row, list = this.contact_list;
 
-    cid = String(cid).replace(this.identifier_expr, '_');
+    cid = this.html_identifier(cid);
 
     // when in searching mode, concat cid with the source name
     if (!list.rows[cid]) {
@@ -4048,54 +4405,58 @@
 
       // cid change
       if (newcid) {
-        newcid = String(newcid).replace(this.identifier_expr, '_');
+        newcid = this.html_identifier(newcid);
         row.id = 'rcmrow' + newcid;
         list.remove_row(cid);
         list.init_row(row);
         list.selection[0] = newcid;
         row.style.display = '';
       }
+
+      list.data[cid] = data;
     }
   };
 
   // add row to contacts list
-  this.add_contact_row = function(cid, cols, select)
+  this.add_contact_row = function(cid, cols, classes, data)
   {
-    if (!this.gui_objects.contactslist || !this.gui_objects.contactslist.tBodies[0])
+    if (!this.gui_objects.contactslist)
       return false;
 
-    var tbody = this.gui_objects.contactslist.tBodies[0],
-      rowcount = tbody.rows.length,
-      even = rowcount%2,
+    var c, col, list = this.contact_list,
       row = document.createElement('tr');
 
-    row.id = 'rcmrow'+String(cid).replace(this.identifier_expr, '_');
-    row.className = 'contact '+(even ? 'even' : 'odd');
+    row.id = 'rcmrow'+this.html_identifier(cid);
+    row.className = 'contact ' + (classes || '');
 
-    if (this.contact_list.in_selection(cid))
+    if (list.in_selection(cid))
       row.className += ' selected';
 
     // add each submitted col
-    for (var c in cols) {
+    for (c in cols) {
       col = document.createElement('td');
       col.className = String(c).toLowerCase();
-      col.innerHTML = cols[c];
+      if (cols[c])
+        col.innerHTML = cols[c];
       row.appendChild(col);
     }
 
-    this.contact_list.insert_row(row);
+    // store data in list member
+    list.data[cid] = data;
+    list.insert_row(row);
 
-    this.enable_command('export', (this.contact_list.rowcount > 0));
+    this.enable_command('export', list.rowcount > 0);
   };
 
   this.init_contact_form = function()
   {
     var ref = this, col;
 
-    this.set_photo_actions($('#ff_photo').val());
-
-    for (col in this.env.coltypes)
-      this.init_edit_field(col, null);
+    if (this.env.coltypes) {
+      this.set_photo_actions($('#ff_photo').val());
+      for (col in this.env.coltypes)
+        this.init_edit_field(col, null);
+    }
 
     $('.contactfieldgroup .row a.deletebutton').click(function() {
       ref.delete_edit_field(this);
@@ -4107,7 +4468,26 @@
       this.selectedIndex = 0;
     });
 
+    // enable date pickers on date fields
+    if ($.datepicker && this.env.date_format) {
+      $.datepicker.setDefaults({
+        dateFormat: this.env.date_format,
+        changeMonth: true,
+        changeYear: true,
+        yearRange: '-100:+10',
+        showOtherMonths: true,
+        selectOtherMonths: true,
+        onSelect: function(dateText) { $(this).focus().val(dateText) }
+      });
+      $('input.datepicker').datepicker();
+    }
+
     $("input[type='text']:visible").first().focus();
+
+    // Submit search form on Enter
+    if (this.env.action == 'search')
+      $(this.gui_objects.editform).append($('<input type="submit">').hide())
+        .submit(function() { $('input.mainaction').click(); return false; });
   };
 
   this.group_create = function()
@@ -4126,7 +4506,7 @@
       this.name_input.bind('keydown', function(e){ return rcmail.add_input_keydown(e); });
       this.env.group_renaming = true;
 
-      var link, li = this.get_folder_li(this.env.source+this.env.group, 'rcmliG');
+      var link, li = this.get_folder_li('G'+this.env.source+this.env.group,'',true);
       if (li && (link = li.firstChild)) {
         $(link).hide().before(this.name_input);
       }
@@ -4139,7 +4519,7 @@
   {
     if (this.env.group && confirm(this.get_label('deletegroupconfirm'))) {
       var lock = this.set_busy(true, 'groupdeleting');
-      this.http_post('group-delete', '_source='+urlencode(this.env.source)+'&_gid='+urlencode(this.env.group), lock);
+      this.http_post('group-delete', {_source: this.env.source, _gid: this.env.group}, lock);
     }
   };
 
@@ -4147,7 +4527,7 @@
   this.remove_group_item = function(prop)
   {
     var li, key = 'G'+prop.source+prop.id;
-    if ((li = this.get_folder_li(key))) {
+    if ((li = this.get_folder_li(key,'',true))) {
       this.triggerEvent('group_delete', { source:prop.source, id:prop.id, li:li });
 
       li.parentNode.removeChild(li);
@@ -4169,12 +4549,45 @@
       this.name_input.bind('keydown', function(e){ return rcmail.add_input_keydown(e); });
       this.name_input_li = $('<li>').addClass(type).append(this.name_input);
 
-      var li = type == 'contactsearch' ? $('li:last', this.gui_objects.folderlist) : this.get_folder_li(this.env.source);
-      this.name_input_li.insertAfter(li);
+      var ul, li;
+
+      // find list (UL) element
+      if (type == 'contactsearch')
+        ul = this.gui_objects.folderlist;
+      else
+        ul = $('ul.groups', this.get_folder_li(this.env.source,'',true));
+
+      // append to the list
+      li = $('li:last', ul);
+      if (li.length)
+        this.name_input_li.insertAfter(li);
+      else {
+        this.name_input_li.appendTo(ul);
+        ul.show(); // make sure the list is visible
+      }
     }
 
     this.name_input.select().focus();
   };
+
+  //remove selected contacts from current active group
+  this.group_remove_selected = function()
+  {
+    ref.http_post('group-delmembers', {_cid: this.contact_list.selection,
+      _source: this.env.source, _gid: this.env.group});
+  };
+
+  //callback after deleting contact(s) from current group
+  this.remove_group_contacts = function(props)
+  {
+    if('undefined' != typeof this.env.group && (this.env.group === props.gid)){
+      var n, selection = this.contact_list.get_selection();
+      for (n=0; n<selection.length; n++) {
+        id = selection[n];
+        this.contact_list.remove_row(id, (n == selection.length-1));
+      }
+    }
+  }
 
   // handler for keyboard events on the input field
   this.add_input_keydown = function(e)
@@ -4190,11 +4603,11 @@
         var lock = this.set_busy(true, 'loading');
 
         if (itype == 'contactsearch')
-          this.http_post('search-create', '_search='+urlencode(this.env.search_request)+'&_name='+urlencode(newname), lock);
+          this.http_post('search-create', {_search: this.env.search_request, _name: newname}, lock);
         else if (this.env.group_renaming)
-          this.http_post('group-rename', '_source='+urlencode(this.env.source)+'&_gid='+urlencode(this.env.group)+'&_name='+urlencode(newname), lock);
+          this.http_post('group-rename', {_source: this.env.source, _gid: this.env.group, _name: newname}, lock);
         else
-          this.http_post('group-create', '_source='+urlencode(this.env.source)+'&_name='+urlencode(newname), lock);
+          this.http_post('group-create', {_source: this.env.source, _name: newname}, lock);
       }
       return false;
     }
@@ -4208,11 +4621,13 @@
   this.reset_add_input = function()
   {
     if (this.name_input) {
+      var li = this.name_input.parent();
       if (this.env.group_renaming) {
-        var li = this.name_input.parent();
         li.children().last().show();
         this.env.group_renaming = false;
       }
+      else if ($('li', li.parent()).length == 1)
+        li.parent().hide();
 
       this.name_input.remove();
 
@@ -4236,7 +4651,7 @@
         .attr('rel', prop.source+':'+prop.id)
         .click(function() { return rcmail.command('listgroup', prop, this); })
         .html(prop.name),
-      li = $('<li>').attr({id: 'rcmli'+key.replace(this.identifier_expr, '_'), 'class': 'contactgroup'})
+      li = $('<li>').attr({id: 'rcmli'+this.html_identifier(key), 'class': 'contactgroup'})
         .append(link);
 
     this.env.contactfolders[key] = this.env.contactgroups[key] = prop;
@@ -4251,7 +4666,7 @@
     this.reset_add_input();
 
     var key = 'G'+prop.source+prop.id,
-      li = this.get_folder_li(key),
+      li = this.get_folder_li(key,'',true),
       link;
 
     // group ID has changed, replace link node and identifiers
@@ -4259,7 +4674,7 @@
       var newkey = 'G'+prop.source+prop.newid,
         newprop = $.extend({}, prop);;
 
-      li.id = String('rcmli'+newkey).replace(this.identifier_expr, '_');
+      li.id = 'rcmli' + this.html_identifier(newkey);
       this.env.contactfolders[newkey] = this.env.contactfolders[key];
       this.env.contactfolders[newkey].id = prop.newid;
       this.env.group = prop.newid;
@@ -4290,8 +4705,8 @@
   this.add_contact_group_row = function(prop, li, reloc)
   {
     var row, name = prop.name.toUpperCase(),
-      sibling = this.get_folder_li(prop.source),
-      prefix = 'rcmliG'+(prop.source).replace(this.identifier_expr, '_');
+      sibling = this.get_folder_li(prop.source,'',true),
+      prefix = 'rcmli' + this.html_identifier('G'+prop.source, true);
 
     // When renaming groups, we need to remove it from DOM and insert it in the proper place
     if (reloc) {
@@ -4320,12 +4735,13 @@
 
   this.init_edit_field = function(col, elem)
   {
+    var label = this.env.coltypes[col].label;
+
     if (!elem)
       elem = $('.ff_' + col);
 
-    elem.focus(function(){ ref.focus_textfield(this); })
-      .blur(function(){ ref.blur_textfield(this); })
-      .each(function(){ this._placeholder = this.title = ref.env.coltypes[col].label; ref.blur_textfield(this); });
+    if (label)
+      elem.placeholder(label);
   };
 
   this.insert_edit_field = function(col, section, menu)
@@ -4340,8 +4756,15 @@
       var lastelem = $('.ff_'+col),
         appendcontainer = $('#contactsection'+section+' .contactcontroller'+col);
 
-      if (!appendcontainer.length)
-        appendcontainer = $('<fieldset>').addClass('contactfieldgroup contactcontroller'+col).insertAfter($('#contactsection'+section+' .contactfieldgroup').last());
+      if (!appendcontainer.length) {
+        var sect = $('#contactsection'+section),
+          lastgroup = $('.contactfieldgroup', sect).last();
+        appendcontainer = $('<fieldset>').addClass('contactfieldgroup contactcontroller'+col);
+        if (lastgroup.length)
+          appendcontainer.insertAfter(lastgroup);
+        else
+          sect.prepend(appendcontainer);
+      }
 
       if (appendcontainer.length && appendcontainer.get(0).nodeName == 'FIELDSET') {
         var input, colprop = this.env.coltypes[col],
@@ -4359,6 +4782,17 @@
           input = $('<input>')
             .addClass('ff_'+col)
             .attr({type: 'text', name: '_'+col+name_suffix, size: colprop.size})
+            .appendTo(cell);
+
+          this.init_edit_field(col, input);
+
+          if (colprop.type == 'date' && $.datepicker)
+            input.datepicker();
+        }
+        else if (colprop.type == 'textarea') {
+          input = $('<textarea>')
+            .addClass('ff_'+col)
+            .attr({ name: '_'+col+name_suffix, cols:colprop.size, rows:colprop.rows })
             .appendTo(cell);
 
           this.init_edit_field(col, input);
@@ -4418,6 +4852,9 @@
           if (++colprop.count == colprop.limit && colprop.limit)
             $(menu).children('option[value="'+col+'"]').prop('disabled', true);
         }
+
+        if (contact._type != 'group')
+          list.draggable = true;
       }
     }
   };
@@ -4454,11 +4891,11 @@
   {
     if (form && form.elements._photo.value) {
       this.async_upload_form(form, 'upload-photo', function(e) {
-        rcmail.set_busy(false, null, rcmail.photo_upload_id);
+        rcmail.set_busy(false, null, rcmail.file_upload_id);
       });
 
       // display upload indicator
-      this.photo_upload_id = this.set_busy(true, 'uploading');
+      this.file_upload_id = this.set_busy(true, 'uploading');
     }
   };
 
@@ -4473,15 +4910,15 @@
 
   this.photo_upload_end = function()
   {
-    this.set_busy(false, null, this.photo_upload_id);
-    delete this.photo_upload_id;
+    this.set_busy(false, null, this.file_upload_id);
+    delete this.file_upload_id;
   };
 
   this.set_photo_actions = function(id)
   {
     var n, buttons = this.buttons['upload-photo'];
     for (n=0; buttons && n < buttons.length; n++)
-      $('#'+buttons[n].id).html(this.get_label(id == '-del-' ? 'addphoto' : 'replacephoto'));
+      $('a#'+buttons[n].id).html(this.get_label(id == '-del-' ? 'addphoto' : 'replacephoto'));
 
     $('#ff_photo').val(id);
     this.enable_command('upload-photo', this.env.coltypes.photo ? true : false);
@@ -4491,15 +4928,15 @@
   // load advanced search page
   this.advanced_search = function()
   {
-    var add_url = '&_form=1', target = window;
+    var win, url = {_form: 1, _action: 'search'}, target = window;
 
-    if (this.env.contentframe && window.frames && window.frames[this.env.contentframe]) {
-      add_url += '&_framed=1';
-      target = window.frames[this.env.contentframe];
+    if (win = this.get_frame_window(this.env.contentframe)) {
+      url._framed = 1;
+      target = win;
       this.contact_list.clear_selection();
     }
 
-    this.location_href(this.env.comm_path+'&_action=search'+add_url, target, true);
+    this.location_href(url, target, true);
 
     return true;
   };
@@ -4521,12 +4958,12 @@
         .attr('rel', id)
         .click(function() { return rcmail.command('listsearch', id, this); })
         .html(name),
-      li = $('<li>').attr({id: 'rcmli'+key.replace(this.identifier_expr, '_'), 'class': 'contactsearch'})
+      li = $('<li>').attr({ id:'rcmli' + this.html_identifier(key,true), 'class':'contactsearch' })
         .append(link),
       prop = {name:name, id:id, li:li[0]};
 
     this.add_saved_search_row(prop, li);
-    this.select_folder('S'+id);
+    this.select_folder(key,'',true);
     this.enable_command('search-delete', true);
     this.env.search_id = id;
 
@@ -4572,7 +5009,7 @@
   {
     if (this.env.search_request) {
       var lock = this.set_busy(true, 'savedsearchdeleting');
-      this.http_post('search-delete', '_sid='+urlencode(this.env.search_id), lock);
+      this.http_post('search-delete', {_sid: this.env.search_id}, lock);
     }
   };
 
@@ -4580,7 +5017,7 @@
   this.remove_search_item = function(id)
   {
     var li, key = 'S'+id;
-    if ((li = this.get_folder_li(key))) {
+    if ((li = this.get_folder_li(key,'',true))) {
       this.triggerEvent('search_delete', { id:id, li:li });
 
       li.parentNode.removeChild(li);
@@ -4602,11 +5039,11 @@
     }
 
     this.reset_qsearch();
-    this.select_folder('S'+id);
+    this.select_folder('S'+id, '', true);
 
     // reset vars
     this.env.current_page = 1;
-    this.http_request('search', '_sid='+urlencode(id), lock);
+    this.http_request('search', {_sid: id}, lock);
   };
 
 
@@ -4617,14 +5054,15 @@
   // preferences section select and load options frame
   this.section_select = function(list)
   {
-    var id = list.get_single_selection(), add_url = '', target = window;
+    var win, id = list.get_single_selection(), target = window,
+      url = {_action: 'edit-prefs', _section: id};
 
     if (id) {
-      if (this.env.contentframe && window.frames && window.frames[this.env.contentframe]) {
-        add_url = '&_framed=1';
-        target = window.frames[this.env.contentframe];
+      if (win = this.get_frame_window(this.env.contentframe)) {
+        url._framed = 1;
+        target = win;
       }
-      this.location_href(this.env.comm_path+'&_action=edit-prefs&_section='+id+add_url, target, true);
+      this.location_href(url, target, true);
     }
 
     return true;
@@ -4633,27 +5071,29 @@
   this.identity_select = function(list)
   {
     var id;
-    if (id = list.get_single_selection())
+    if (id = list.get_single_selection()) {
+      this.enable_command('delete', list.rowcount > 1 && this.env.identities_level < 2);
       this.load_identity(id, 'edit-identity');
+    }
   };
 
   // load identity record
   this.load_identity = function(id, action)
   {
-    if (action=='edit-identity' && (!id || id==this.env.iid))
+    if (action == 'edit-identity' && (!id || id == this.env.iid))
       return false;
 
-    var add_url = '', target = window;
+    var win, target = window,
+      url = {_action: action, _iid: id};
 
-    if (this.env.contentframe && window.frames && window.frames[this.env.contentframe]) {
-      add_url = '&_framed=1';
-      target = window.frames[this.env.contentframe];
-      document.getElementById(this.env.contentframe).style.visibility = 'inherit';
+    if (win = this.get_frame_window(this.env.contentframe)) {
+      url._framed = 1;
+      target = win;
     }
 
-    if (action && (id || action=='add-identity')) {
+    if (action && (id || action == 'add-identity')) {
       this.set_busy(true);
-      this.location_href(this.env.comm_path+'&_action='+action+'&_iid='+id+add_url, target);
+      this.location_href(url, target);
     }
 
     return true;
@@ -4661,7 +5101,7 @@
 
   this.delete_identity = function(id)
   {
-    // exit if no mailbox specified or if selection is empty
+    // exit if no identity is specified or if selection is empty
     var selection = this.identity_list.get_selection();
     if (!(selection.length || this.env.iid))
       return;
@@ -4669,10 +5109,27 @@
     if (!id)
       id = this.env.iid ? this.env.iid : selection[0];
 
-    // append token to request
-    this.goto_url('delete-identity', '_iid='+id+'&_token='+this.env.request_token, true);
+    // submit request with appended token
+    if (confirm(this.get_label('deleteidentityconfirm')))
+      this.goto_url('delete-identity', { _iid: id, _token: this.env.request_token }, true);
 
     return true;
+  };
+
+  this.update_identity_row = function(id, name, add)
+  {
+    var row, col, list = this.identity_list,
+      rid = this.html_identifier(id);
+
+    if (list.rows[rid] && (row = list.rows[rid].obj)) {
+      $(row.cells[0]).html(name);
+    }
+    else if (add) {
+      row = $('<tr>').attr('id', 'rcmrow'+rid).get(0);
+      col = $('<td>').addClass('mail').html(name).appendTo(row);
+      list.insert_row(row);
+      list.select(rid);
+    }
   };
 
 
@@ -4761,7 +5218,7 @@
         newname = this.env.dstfolder === '' ? basename : this.env.dstfolder+this.env.delimiter+basename;
 
       if (newname != this.env.mailbox) {
-        this.http_post('rename-folder', '_folder_oldname='+urlencode(this.env.mailbox)+'&_folder_newname='+urlencode(newname), this.set_busy(true, 'foldermoving'));
+        this.http_post('rename-folder', {_folder_oldname: this.env.mailbox, _folder_newname: newname}, this.set_busy(true, 'foldermoving'));
         this.subscription_list.draglayer.hide();
       }
     }
@@ -4783,7 +5240,7 @@
 
     if (folder && confirm(this.get_label('deletefolderconfirm'))) {
       var lock = this.set_busy(true, 'folderdeleting');
-      this.http_post('delete-folder', '_mbox='+urlencode(folder), lock);
+      this.http_post('delete-folder', {_mbox: folder}, lock);
     }
   };
 
@@ -4793,7 +5250,7 @@
     if (!this.gui_objects.subscriptionlist)
       return false;
 
-    var row, n, i, tmp, folders, rowid, list = [], slist = [],
+    var row, n, i, tmp, tmp_name, folders, rowid, list = [], slist = [],
       tbody = this.gui_objects.subscriptionlist.tBodies[0],
       refrow = $('tr', tbody).get(1),
       id = 'rcmrow'+((new Date).getTime());
@@ -4829,8 +5286,12 @@
     for (n in folders) {
       // protected folder
       if (folders[n][2]) {
+        tmp_name = folders[n][0] + this.env.delimiter;
+        // prefix namespace cannot have subfolders (#1488349)
+        if (tmp_name == this.env.prefix_ns)
+          continue;
         slist.push(folders[n][0]);
-        tmp = folders[n][0]+this.env.delimiter;
+        tmp = tmp_name;
       }
       // protected folder's child
       else if (tmp && folders[n][0].indexOf(tmp) == 0)
@@ -4977,7 +5438,7 @@
   {
     if (folder) {
       var lock = this.display_message(this.get_label('foldersubscribing'), 'loading');
-      this.http_post('subscribe', '_mbox='+urlencode(folder), lock);
+      this.http_post('subscribe', {_mbox: folder}, lock);
     }
   };
 
@@ -4985,7 +5446,7 @@
   {
     if (folder) {
       var lock = this.display_message(this.get_label('folderunsubscribing'), 'loading');
-      this.http_post('unsubscribe', '_mbox='+urlencode(folder), lock);
+      this.http_post('unsubscribe', {_mbox: folder}, lock);
     }
   };
 
@@ -5003,23 +5464,21 @@
   // when user select a folder in manager
   this.show_folder = function(folder, path, force)
   {
-    var target = window,
+    var win, target = window,
       url = '&_action=edit-folder&_mbox='+urlencode(folder);
 
     if (path)
       url += '&_path='+urlencode(path);
 
-    if (this.env.contentframe && window.frames && window.frames[this.env.contentframe]) {
-      target = window.frames[this.env.contentframe];
+    if (win = this.get_frame_window(this.env.contentframe)) {
+      target = win;
       url += '&_framed=1';
     }
 
-    if (String(target.location.href).indexOf(url) >= 0 && !force) {
+    if (String(target.location.href).indexOf(url) >= 0 && !force)
       this.show_contentframe(true);
-    }
-    else {
+    else
       this.location_href(this.env.comm_path+url, target, true);
-    }
   };
 
   // disables subscription checkbox (for protected folder)
@@ -5033,7 +5492,7 @@
   this.folder_size = function(folder)
   {
     var lock = this.set_busy(true, 'loading');
-    this.http_post('folder-size', '_mbox='+urlencode(folder), lock);
+    this.http_post('folder-size', {_mbox: folder}, lock);
   };
 
   this.folder_size_update = function(size)
@@ -5074,13 +5533,6 @@
     }
   };
 
-  // enable/disable buttons for page shifting
-  this.set_page_buttons = function()
-  {
-    this.enable_command('nextpage', 'lastpage', (this.env.pagecount > this.env.current_page));
-    this.enable_command('previouspage', 'firstpage', (this.env.current_page > 1));
-  };
-
   // set event handlers on registered buttons
   this.init_buttons = function()
   {
@@ -5088,46 +5540,50 @@
       if (typeof cmd !== 'string')
         continue;
 
-      for (var i=0; i< this.buttons[cmd].length; i++) {
+      for (var i=0; i<this.buttons[cmd].length; i++) {
         init_button(cmd, this.buttons[cmd][i]);
       }
     }
+
+    // set active task button
+    this.set_button(this.task, 'sel');
   };
 
   // set button to a specific state
   this.set_button = function(command, state)
   {
-    var button, obj, a_buttons = this.buttons[command];
+    var n, button, obj, a_buttons = this.buttons[command],
+      len = a_buttons ? a_buttons.length : 0;
 
-    if (!a_buttons || !a_buttons.length)
-      return false;
-
-    for (var n=0; n<a_buttons.length; n++) {
+    for (n=0; n<len; n++) {
       button = a_buttons[n];
       obj = document.getElementById(button.id);
 
+      if (!obj)
+        continue;
+
       // get default/passive setting of the button
-      if (obj && button.type=='image' && !button.status) {
+      if (button.type == 'image' && !button.status) {
         button.pas = obj._original_src ? obj._original_src : obj.src;
         // respect PNG fix on IE browsers
         if (obj.runtimeStyle && obj.runtimeStyle.filter && obj.runtimeStyle.filter.match(/src=['"]([^'"]+)['"]/))
           button.pas = RegExp.$1;
       }
-      else if (obj && !button.status)
+      else if (!button.status)
         button.pas = String(obj.className);
 
       // set image according to button state
-      if (obj && button.type=='image' && button[state]) {
+      if (button.type == 'image' && button[state]) {
         button.status = state;
         obj.src = button[state];
       }
       // set class name according to button state
-      else if (obj && button[state] !== undefined) {
+      else if (button[state] !== undefined) {
         button.status = state;
         obj.className = button[state];
       }
       // disable/enable input buttons
-      if (obj && button.type=='input') {
+      if (button.type == 'input') {
         button.status = state;
         obj.disabled = !state;
       }
@@ -5137,15 +5593,14 @@
   // display a specific alttext
   this.set_alttext = function(command, label)
   {
-    if (!this.buttons[command] || !this.buttons[command].length)
-      return;
+    var n, button, obj, link, a_buttons = this.buttons[command],
+      len = a_buttons ? a_buttons.length : 0;
 
-    var button, obj, link;
-    for (var n=0; n<this.buttons[command].length; n++) {
-      button = this.buttons[command][n];
+    for (n=0; n<len; n++) {
+      button = a_buttons[n];
       obj = document.getElementById(button.id);
 
-      if (button.type=='image' && obj) {
+      if (button.type == 'image' && obj) {
         obj.setAttribute('alt', this.get_label(label));
         if ((link = obj.parentNode) && link.tagName.toLowerCase() == 'a')
           link.setAttribute('title', this.get_label(label));
@@ -5158,20 +5613,18 @@
   // mouse over button
   this.button_over = function(command, id)
   {
-    var button, elm, a_buttons = this.buttons[command];
+    var n, button, obj, a_buttons = this.buttons[command],
+      len = a_buttons ? a_buttons.length : 0;
 
-    if (!a_buttons || !a_buttons.length)
-      return false;
-
-    for (var n=0; n<a_buttons.length; n++) {
+    for (n=0; n<len; n++) {
       button = a_buttons[n];
       if (button.id == id && button.status == 'act') {
-        elm = document.getElementById(button.id);
-        if (elm && button.over) {
+        obj = document.getElementById(button.id);
+        if (obj && button.over) {
           if (button.type == 'image')
-            elm.src = button.over;
+            obj.src = button.over;
           else
-            elm.className = button.over;
+            obj.className = button.over;
         }
       }
     }
@@ -5180,20 +5633,18 @@
   // mouse down on button
   this.button_sel = function(command, id)
   {
-    var button, elm, a_buttons = this.buttons[command];
+    var n, button, obj, a_buttons = this.buttons[command],
+      len = a_buttons ? a_buttons.length : 0;
 
-    if (!a_buttons || !a_buttons.length)
-      return;
-
-    for (var n=0; n<a_buttons.length; n++) {
+    for (n=0; n<len; n++) {
       button = a_buttons[n];
       if (button.id == id && button.status == 'act') {
-        elm = document.getElementById(button.id);
-        if (elm && button.sel) {
+        obj = document.getElementById(button.id);
+        if (obj && button.sel) {
           if (button.type == 'image')
-            elm.src = button.sel;
+            obj.src = button.sel;
           else
-            elm.className = button.sel;
+            obj.className = button.sel;
         }
         this.buttons_sel[id] = command;
       }
@@ -5203,40 +5654,21 @@
   // mouse out of button
   this.button_out = function(command, id)
   {
-    var button, elm, a_buttons = this.buttons[command];
+    var n, button, obj, a_buttons = this.buttons[command],
+      len = a_buttons ? a_buttons.length : 0;
 
-    if (!a_buttons || !a_buttons.length)
-      return;
-
-    for (var n=0; n<a_buttons.length; n++) {
+    for (n=0; n<len; n++) {
       button = a_buttons[n];
       if (button.id == id && button.status == 'act') {
-        elm = document.getElementById(button.id);
-        if (elm && button.act) {
+        obj = document.getElementById(button.id);
+        if (obj && button.act) {
           if (button.type == 'image')
-            elm.src = button.act;
+            obj.src = button.act;
           else
-            elm.className = button.act;
+            obj.className = button.act;
         }
       }
     }
-  };
-
-
-  this.focus_textfield = function(elem)
-  {
-    elem._hasfocus = true;
-    var $elem = $(elem);
-    if ($elem.hasClass('placeholder') || $elem.val() == elem._placeholder)
-      $elem.val('').removeClass('placeholder').attr('spellcheck', true);
-  };
-
-  this.blur_textfield = function(elem)
-  {
-    elem._hasfocus = false;
-    var $elem = $(elem);
-    if (elem._placeholder && (!$elem.val() || $elem.val() == elem._placeholder))
-      $elem.addClass('placeholder').attr('spellcheck', false).val(elem._placeholder);
   };
 
   // write to the document/window title
@@ -5256,14 +5688,14 @@
     if (!this.gui_objects.message) {
       // save message in order to display after page loaded
       if (type != 'loading')
-        this.pending_message = new Array(msg, type, timeout);
-      return false;
+        this.pending_message = [msg, type, timeout];
+      return 1;
     }
 
     type = type ? type : 'notice';
 
     var ref = this,
-      key = String(msg).replace(this.identifier_expr, '_'),
+      key = this.html_identifier(msg),
       date = new Date(),
       id = type + date.getTime();
 
@@ -5288,7 +5720,7 @@
       }
       // add element and set timeout
       this.messages[key].elements.push(id);
-      window.setTimeout(function() { ref.hide_message(id, type == 'loading'); }, timeout);
+      setTimeout(function() { ref.hide_message(id, type == 'loading'); }, timeout);
       return id;
     }
 
@@ -5305,8 +5737,10 @@
       obj.click(function() { return ref.hide_message(obj); });
     }
 
+    this.triggerEvent('message', { message:msg, type:type, timeout:timeout, object:obj });
+
     if (timeout > 0)
-      window.setTimeout(function() { ref.hide_message(id, type == 'loading'); }, timeout);
+      setTimeout(function() { ref.hide_message(id, type == 'loading'); }, timeout);
     return id;
   };
 
@@ -5316,6 +5750,9 @@
     // pass command to parent window
     if (this.is_framed())
       return parent.rcmail.hide_message(obj, fade);
+
+    if (!this.gui_objects.message)
+      return;
 
     var k, n, i, msg, m = this.messages;
 
@@ -5355,8 +5792,58 @@
     }
   };
 
+  // remove all messages immediately
+  this.clear_messages = function()
+  {
+    // pass command to parent window
+    if (this.is_framed())
+      return parent.rcmail.clear_messages();
+
+    var k, n, m = this.messages;
+
+    for (k in m)
+      for (n in m[k].elements)
+        if (m[k].obj)
+          m[k].obj.hide();
+
+    this.messages = {};
+  };
+
+  // open a jquery UI dialog with the given content
+  this.show_popup_dialog = function(html, title)
+  {
+    // forward call to parent window
+    if (this.is_framed()) {
+      parent.rcmail.show_popup_dialog(html, title);
+      return;
+    }
+
+    var popup = $('<div class="popup">')
+      .html(html)
+      .dialog({
+        title: title,
+        modal: true,
+        resizable: true,
+        width: 580,
+        close: function(event, ui) { $(this).remove() }
+      });
+
+      // resize and center popup
+      var win = $(window), w = win.width(), h = win.height(),
+        width = popup.width(), height = popup.height();
+      popup.dialog('option', { height: Math.min(h-40, height+50), width: Math.min(w-20, width+50) })
+        .dialog('option', 'position', ['center', 'center']);  // only works in a separate call (!?)
+  };
+
+  // enable/disable buttons for page shifting
+  this.set_page_buttons = function()
+  {
+    this.enable_command('nextpage', 'lastpage', (this.env.pagecount > this.env.current_page));
+    this.enable_command('previouspage', 'firstpage', (this.env.current_page > 1));
+  };
+
   // mark a mailbox as selected and set environment variable
-  this.select_folder = function(name, prefix)
+  this.select_folder = function(name, prefix, encode)
   {
     if (this.gui_objects.folderlist) {
       var current_li, target_li;
@@ -5364,7 +5851,7 @@
       if ((current_li = $('li.selected', this.gui_objects.folderlist))) {
         current_li.removeClass('selected').addClass('unfocused');
       }
-      if ((target_li = this.get_folder_li(name, prefix))) {
+      if ((target_li = this.get_folder_li(name, prefix, encode))) {
         $(target_li).removeClass('unfocused').addClass('selected');
       }
 
@@ -5373,14 +5860,26 @@
     }
   };
 
+  // adds a class to selected folder
+  this.mark_folder = function(name, class_name, prefix, encode)
+  {
+    $(this.get_folder_li(name, prefix, encode)).addClass(class_name);
+  };
+
+  // adds a class to selected folder
+  this.unmark_folder = function(name, class_name, prefix, encode)
+  {
+    $(this.get_folder_li(name, prefix, encode)).removeClass(class_name);
+  };
+
   // helper method to find a folder list item
-  this.get_folder_li = function(name, prefix)
+  this.get_folder_li = function(name, prefix, encode)
   {
     if (!prefix)
       prefix = 'rcmli';
 
     if (this.gui_objects.folderlist) {
-      name = String(name).replace(this.identifier_expr, '_');
+      name = this.html_identifier(name, encode);
       return document.getElementById(prefix+name);
     }
 
@@ -5389,7 +5888,7 @@
 
   // for reordering column array (Konqueror workaround)
   // and for setting some message list global variables
-  this.set_message_coltypes = function(coltypes, repl)
+  this.set_message_coltypes = function(coltypes, repl, smart_col)
   {
     var list = this.message_list,
       thead = list ? list.list.tHead : null,
@@ -5405,27 +5904,25 @@
 
         for (c=0, len=repl.length; c < len; c++) {
           cell = document.createElement('td');
-          cell.innerHTML = repl[c].html;
+          cell.innerHTML = repl[c].html || '';
           if (repl[c].id) cell.id = repl[c].id;
           if (repl[c].className) cell.className = repl[c].className;
           tr.appendChild(cell);
         }
         th.appendChild(tr);
         thead.parentNode.replaceChild(th, thead);
-        thead = th;
+        list.thead = thead = th;
       }
 
       for (n=0, len=this.env.coltypes.length; n<len; n++) {
         col = this.env.coltypes[n];
-        if ((cell = thead.rows[0].cells[n]) && (col=='from' || col=='to')) {
+        if ((cell = thead.rows[0].cells[n]) && (col == 'from' || col == 'to' || col == 'fromto')) {
           cell.id = 'rcm'+col;
+          $('span,a', cell).text(this.get_label(col == 'fromto' ? smart_col : col));
           // if we have links for sorting, it's a bit more complicated...
-          if (cell.firstChild && cell.firstChild.tagName.toLowerCase()=='a') {
-            cell = cell.firstChild;
-            cell.onclick = function(){ return rcmail.command('sort', this.__col, this); };
-            cell.__col = col;
-          }
-          cell.innerHTML = this.get_label(col);
+          $('a', cell).click(function(){
+            return rcmail.command('sort', this.id.replace(/^rcm/, ''), this);
+          });
         }
       }
     }
@@ -5449,8 +5946,12 @@
   };
 
   // replace content of row count display
-  this.set_rowcount = function(text)
+  this.set_rowcount = function(text, mbox)
   {
+    // #1487752
+    if (mbox && mbox != this.env.mailbox)
+      return false;
+
     $(this.gui_objects.countdisplay).html(text);
 
     // update page navigation buttons
@@ -5467,22 +5968,26 @@
   // replace content of quota display
   this.set_quota = function(content)
   {
-    if (content && this.gui_objects.quotadisplay) {
-      if (typeof content === 'object' && content.type == 'image')
-        this.percent_indicator(this.gui_objects.quotadisplay, content);
-      else
-        $(this.gui_objects.quotadisplay).html(content);
-    }
+    if (this.gui_objects.quotadisplay && content && content.type == 'text')
+      $(this.gui_objects.quotadisplay).html(content.percent+'%').attr('title', content.title);
+
+    this.triggerEvent('setquota', content);
+    this.env.quota_content = content;
   };
 
   // update the mailboxlist
-  this.set_unread_count = function(mbox, count, set_title)
+  this.set_unread_count = function(mbox, count, set_title, mark)
   {
     if (!this.gui_objects.mailboxlist)
       return false;
 
     this.env.unread_counts[mbox] = count;
     this.set_unread_count_display(mbox, set_title);
+
+    if (mark)
+      this.mark_folder(mbox, mark, '', true);
+    else if (!count)
+      this.unmark_folder(mbox, 'recent', '', true);
   };
 
   // update the mailbox count display
@@ -5490,7 +5995,7 @@
   {
     var reg, link, text_obj, item, mycount, childcount, div;
 
-    if (item = this.get_folder_li(mbox)) {
+    if (item = this.get_folder_li(mbox, '', true)) {
       mycount = this.env.unread_counts[mbox] ? this.env.unread_counts[mbox] : 0;
       link = $(item).children('a').eq(0);
       text_obj = link.children('span.unreadcount');
@@ -5502,13 +6007,13 @@
       if ((div = item.getElementsByTagName('div')[0]) &&
           div.className.match(/collapsed/)) {
         // add children's counters
-        for (var k in this.env.unread_counts) 
+        for (var k in this.env.unread_counts)
           if (k.indexOf(mbox + this.env.delimiter) == 0)
             childcount += this.env.unread_counts[k];
       }
 
       if (mycount && text_obj.length)
-        text_obj.html(' ('+mycount+')');
+        text_obj.html(this.env.unreadwrap.replace(/%[sd]/, mycount));
       else if (text_obj.length)
         text_obj.remove();
 
@@ -5541,20 +6046,6 @@
     }
   };
 
-  this.toggle_prefer_html = function(checkbox)
-  {
-    var elem;
-    if (elem = document.getElementById('rcmfd_addrbook_show_images'))
-      elem.disabled = !checkbox.checked;
-  };
-
-  this.toggle_preview_pane = function(checkbox)
-  {
-    var elem;
-    if (elem = document.getElementById('rcmfd_preview_pane_mark_read'))
-      elem.disabled = !checkbox.checked;
-  };
-
   // display fetched raw headers
   this.set_headers = function(content)
   {
@@ -5563,96 +6054,33 @@
   };
 
   // display all-headers row and fetch raw message headers
-  this.load_headers = function(elem)
+  this.show_headers = function(props, elem)
   {
     if (!this.gui_objects.all_headers_row || !this.gui_objects.all_headers_box || !this.env.uid)
       return;
 
     $(elem).removeClass('show-headers').addClass('hide-headers');
     $(this.gui_objects.all_headers_row).show();
-    elem.onclick = function() { rcmail.hide_headers(elem); };
+    elem.onclick = function() { rcmail.command('hide-headers', '', elem); };
 
     // fetch headers only once
     if (!this.gui_objects.all_headers_box.innerHTML) {
       var lock = this.display_message(this.get_label('loading'), 'loading');
-      this.http_post('headers', '_uid='+this.env.uid, lock);
+      this.http_post('headers', {_uid: this.env.uid}, lock);
     }
   };
 
   // hide all-headers row
-  this.hide_headers = function(elem)
+  this.hide_headers = function(props, elem)
   {
     if (!this.gui_objects.all_headers_row || !this.gui_objects.all_headers_box)
       return;
 
     $(elem).removeClass('hide-headers').addClass('show-headers');
     $(this.gui_objects.all_headers_row).hide();
-    elem.onclick = function() { rcmail.load_headers(elem); };
+    elem.onclick = function() { rcmail.command('show-headers', '', elem); };
   };
 
-  // percent (quota) indicator
-  this.percent_indicator = function(obj, data)
-  {
-    if (!data || !obj)
-      return false;
-
-    var limit_high = 80,
-      limit_mid  = 55,
-      width = data.width ? data.width : this.env.indicator_width ? this.env.indicator_width : 100,
-      height = data.height ? data.height : this.env.indicator_height ? this.env.indicator_height : 14,
-      quota = data.percent ? Math.abs(parseInt(data.percent)) : 0,
-      quota_width = parseInt(quota / 100 * width),
-      pos = $(obj).position();
-
-    // workarounds for Opera and Webkit bugs
-    pos.top = Math.max(0, pos.top);
-    pos.left = Math.max(0, pos.left);
-
-    this.env.indicator_width = width;
-    this.env.indicator_height = height;
-
-    // overlimit
-    if (quota_width > width) {
-      quota_width = width;
-      quota = 100; 
-    }
-
-    if (data.title)
-      data.title = this.get_label('quota') + ': ' +  data.title;
-
-    // main div
-    var main = $('<div>');
-    main.css({position: 'absolute', top: pos.top, left: pos.left,
-	    width: width + 'px', height: height + 'px', zIndex: 100, lineHeight: height + 'px'})
-	  .attr('title', data.title).addClass('quota_text').html(quota + '%');
-    // used bar
-    var bar1 = $('<div>');
-    bar1.css({position: 'absolute', top: pos.top + 1, left: pos.left + 1,
-	    width: quota_width + 'px', height: height + 'px', zIndex: 99});
-    // background
-    var bar2 = $('<div>');
-    bar2.css({position: 'absolute', top: pos.top + 1, left: pos.left + 1,
-	    width: width + 'px', height: height + 'px', zIndex: 98})
-	  .addClass('quota_bg');
-
-    if (quota >= limit_high) {
-      main.addClass(' quota_text_high');
-      bar1.addClass('quota_high');
-    }
-    else if(quota >= limit_mid) {
-      main.addClass(' quota_text_mid');
-      bar1.addClass('quota_mid');
-    }
-    else {
-      main.addClass(' quota_text_low');
-      bar1.addClass('quota_low');
-    }
-
-    // replace quota image
-    $(obj).html('').append(bar1).append(bar2).append(main);
-    // update #quotaimg title
-    $('#quotaimg').attr('title', data.title);
-  };
 
   /********************************************************/
   /*********  html to text conversion functions   *********/
@@ -5668,14 +6096,17 @@
 
     $.ajax({ type: 'POST', url: url, data: htmlText, contentType: 'application/octet-stream',
       error: function(o, status, err) { rcmail.http_error(o, status, err, lock); },
-      success: function(data) { rcmail.set_busy(false, null, lock); $(document.getElementById(id)).val(data); rcmail.log(data); }
+      success: function(data) { rcmail.set_busy(false, null, lock); $('#'+id).val(data); rcmail.log(data); }
     });
   };
 
-  this.plain2html = function(plainText, id)
+  this.plain2html = function(plain, id)
   {
     var lock = this.set_busy(true, 'converting');
-    $(document.getElementById(id)).val('<pre>'+plainText+'</pre>');
+
+    plain = plain.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+    $('#'+id).val(plain ? '<pre>'+plain+'</pre>' : '');
+
     this.set_busy(false, null, lock);
   };
 
@@ -5699,7 +6130,7 @@
     else
       query._action = this.env.action;
 
-    var base = this.env.comm_path;
+    var base = this.env.comm_path, k, param = {};
 
     // overwrite task name
     if (query._action.match(/([a-z]+)\/([a-z0-9-_.]+)/)) {
@@ -5708,8 +6139,7 @@
     }
 
     // remove undefined values
-    var param = {};
-    for (var k in query) {
+    for (k in query) {
       if (query[k] !== undefined && query[k] !== null)
         param[k] = query[k];
     }
@@ -5722,10 +6152,18 @@
     if (lock || lock === null)
       this.set_busy(true);
 
-    if (this.is_framed())
+    if (this.is_framed()) {
       parent.rcmail.redirect(url, lock);
-    else
+    }
+    else {
+      if (this.env.extwin) {
+        if (typeof url == 'string')
+          url += (url.indexOf('?') < 0 ? '?' : '&') + '_extwin=1';
+        else
+          url._extwin = 1;
+      }
       this.location_href(url, window);
+    }
   };
 
   this.goto_url = function(action, query, lock)
@@ -5738,11 +6176,17 @@
     if (frame)
       this.lock_frame();
 
+    if (typeof url == 'object')
+      url = this.env.comm_path + '&' + $.param(url);
+
     // simulate real link click to force IE to send referer header
     if (bw.ie && target == window)
       $('<a>').attr('href', url).appendTo(document.body).get(0).click();
     else
       target.location.href = url;
+
+    // reset keep-alive interval
+    this.start_keepalive();
   };
 
   // send a http request to the server
@@ -5766,10 +6210,13 @@
     // send request
     this.log('HTTP GET: ' + url);
 
+    // reset keep-alive interval
+    this.start_keepalive();
+
     return $.ajax({
       type: 'GET', url: url, data: { _unlock:(lock?lock:0) }, dataType: 'json',
       success: function(data){ ref.http_response(data); },
-      error: function(o, status, err) { rcmail.http_error(o, status, err, lock); }
+      error: function(o, status, err) { ref.http_error(o, status, err, lock, action); }
     });
   };
 
@@ -5788,7 +6235,7 @@
     // trigger plugin hook
     var result = this.triggerEvent('request'+action, postdata);
     if (result !== undefined) {
-      // abort if one the handlers returned false
+      // abort if one of the handlers returned false
       if (result === false)
         return false;
       else
@@ -5798,10 +6245,13 @@
     // send request
     this.log('HTTP POST: ' + url);
 
+    // reset keep-alive interval
+    this.start_keepalive();
+
     return $.ajax({
       type: 'POST', url: url, data: postdata, dataType: 'json',
       success: function(data){ ref.http_response(data); },
-      error: function(o, status, err) { rcmail.http_error(o, status, err, lock); }
+      error: function(o, status, err) { ref.http_error(o, status, err, lock, action); }
     });
   };
 
@@ -5884,30 +6334,32 @@
       case 'purge':
       case 'expunge':
         if (this.task == 'mail') {
-          if (!this.env.messagecount) {
+          if (!this.env.exists) {
             // clear preview pane content
             if (this.env.contentframe)
               this.show_contentframe(false);
             // disable commands useless when mailbox is empty
             this.enable_command(this.env.message_commands, 'purge', 'expunge',
-              'select-all', 'select-none', 'sort', 'expand-all', 'expand-unread', 'collapse-all', false);
+              'select-all', 'select-none', 'expand-all', 'expand-unread', 'collapse-all', false);
           }
           if (this.message_list)
             this.triggerEvent('listupdate', { folder:this.env.mailbox, rowcount:this.message_list.rowcount });
         }
         break;
 
+      case 'refresh':
       case 'check-recent':
       case 'getunread':
       case 'search':
         this.env.qsearch = null;
       case 'list':
         if (this.task == 'mail') {
-          this.enable_command('show', 'expunge', 'select-all', 'select-none', 'sort', (this.env.messagecount > 0));
+          this.enable_command('show', 'select-all', 'select-none', this.env.messagecount > 0);
+          this.enable_command('expunge', this.env.exists);
           this.enable_command('purge', this.purge_mailbox_test());
           this.enable_command('expand-all', 'expand-unread', 'collapse-all', this.env.threading && this.env.messagecount);
 
-          if (response.action == 'list' || response.action == 'search') {
+          if ((response.action == 'list' || response.action == 'search') && this.message_list) {
             this.msglist_select(this.message_list);
             this.triggerEvent('listupdate', { folder:this.env.mailbox, rowcount:this.message_list.rowcount });
           }
@@ -5930,18 +6382,55 @@
 
     this.triggerEvent('responseafter', {response: response});
     this.triggerEvent('responseafter'+response.action, {response: response});
+
+    // reset keep-alive interval
+    this.start_keepalive();
   };
 
   // handle HTTP request errors
-  this.http_error = function(request, status, err, lock)
+  this.http_error = function(request, status, err, lock, action)
   {
     var errmsg = request.statusText;
 
     this.set_busy(false, null, lock);
     request.abort();
 
+    // don't display error message on page unload (#1488547)
+    if (this.unload)
+      return;
+
     if (request.status && errmsg)
       this.display_message(this.get_label('servererror') + ' (' + errmsg + ')', 'error');
+    else if (status == 'timeout')
+      this.display_message(this.get_label('requesttimedout'), 'error');
+    else if (request.status == 0 && status != 'abort')
+      this.display_message(this.get_label('servererror') + ' (No connection)', 'error');
+
+    // redirect to url specified in location header if not empty
+    var location_url = request.getResponseHeader("Location");
+    if (location_url && this.env.action != 'compose')  // don't redirect on compose screen, contents might get lost (#1488926)
+      this.redirect(location_url);
+
+    // 403 Forbidden response (CSRF prevention) - reload the page.
+    // In case there's a new valid session it will be used, otherwise
+    // login form will be presented (#1488960).
+    if (request.status == 403) {
+      (this.is_framed() ? parent : window).location.reload();
+      return;
+    }
+
+    // re-send keep-alive requests after 30 seconds
+    if (action == 'keep-alive')
+      setTimeout(function(){ ref.keep_alive(); ref.start_keepalive(); }, 30000);
+  };
+
+  // callback when an iframe finished loading
+  this.iframe_loaded = function(unlock)
+  {
+    this.set_busy(false, null, unlock);
+
+    if (this.submit_timer)
+      clearTimeout(this.submit_timer);
   };
 
   // post the given form to a hidden iframe
@@ -5966,7 +6455,7 @@
     // have to do it this way for IE
     // otherwise the form will be posted to a new window
     if (document.all) {
-      var html = '<iframe name="'+frame_name+'" src="program/blank.gif" style="width:0;height:0;visibility:hidden;"></iframe>';
+      var html = '<iframe name="'+frame_name+'" src="program/resources/blank.gif" style="width:0;height:0;visibility:hidden;"></iframe>';
       document.body.insertAdjacentHTML('BeforeEnd', html);
     }
     else { // for standards-compilant browsers
@@ -5992,16 +6481,148 @@
     return frame_name;
   };
 
-  // starts interval for keep-alive/check-recent signal
+  // html5 file-drop API
+  this.document_drag_hover = function(e, over)
+  {
+    e.preventDefault();
+    $(ref.gui_objects.filedrop)[(over?'addClass':'removeClass')]('active');
+  };
+
+  this.file_drag_hover = function(e, over)
+  {
+    e.preventDefault();
+    e.stopPropagation();
+    $(ref.gui_objects.filedrop)[(over?'addClass':'removeClass')]('hover');
+  };
+
+  // handler when files are dropped to a designated area.
+  // compose a multipart form data and submit it to the server
+  this.file_dropped = function(e)
+  {
+    // abort event and reset UI
+    this.file_drag_hover(e, false);
+
+    // prepare multipart form data composition
+    var files = e.target.files || e.dataTransfer.files,
+      formdata = window.FormData ? new FormData() : null,
+      fieldname = (this.env.filedrop.fieldname || '_file') + (this.env.filedrop.single ? '' : '[]'),
+      boundary = '------multipartformboundary' + (new Date).getTime(),
+      dashdash = '--', crlf = '\r\n',
+      multipart = dashdash + boundary + crlf;
+
+    if (!files || !files.length)
+      return;
+
+    // inline function to submit the files to the server
+    var submit_data = function() {
+      var multiple = files.length > 1,
+        ts = new Date().getTime(),
+        content = '<span>' + (multiple ? ref.get_label('uploadingmany') : files[0].name) + '</span>';
+
+      // add to attachments list
+      if (!ref.add2attachment_list(ts, { name:'', html:content, classname:'uploading', complete:false }))
+        ref.file_upload_id = ref.set_busy(true, 'uploading');
+
+      // complete multipart content and post request
+      multipart += dashdash + boundary + dashdash + crlf;
+
+      $.ajax({
+        type: 'POST',
+        dataType: 'json',
+        url: ref.url(ref.env.filedrop.action||'upload', { _id:ref.env.compose_id||ref.env.cid||'', _uploadid:ts, _remote:1 }),
+        contentType: formdata ? false : 'multipart/form-data; boundary=' + boundary,
+        processData: false,
+        timeout: 0, // disable default timeout set in ajaxSetup()
+        data: formdata || multipart,
+        headers: {'X-Roundcube-Request': ref.env.request_token},
+        xhr: function() { var xhr = jQuery.ajaxSettings.xhr(); if (!formdata && xhr.sendAsBinary) xhr.send = xhr.sendAsBinary; return xhr; },
+        success: function(data){ ref.http_response(data); },
+        error: function(o, status, err) { ref.http_error(o, status, err, null, 'attachment'); }
+      });
+    };
+
+    // get contents of all dropped files
+    var last = this.env.filedrop.single ? 0 : files.length - 1;
+    for (var j=0, i=0, f; j <= last && (f = files[i]); i++) {
+      if (!f.name) f.name = f.fileName;
+      if (!f.size) f.size = f.fileSize;
+      if (!f.type) f.type = 'application/octet-stream';
+
+      // file name contains non-ASCII characters, do UTF8-binary string conversion.
+      if (!formdata && /[^\x20-\x7E]/.test(f.name))
+        f.name_bin = unescape(encodeURIComponent(f.name));
+
+      // filter by file type if requested
+      if (this.env.filedrop.filter && !f.type.match(new RegExp(this.env.filedrop.filter))) {
+        // TODO: show message to user
+        continue;
+      }
+
+      // do it the easy way with FormData (FF 4+, Chrome 5+, Safari 5+)
+      if (formdata) {
+        formdata.append(fieldname, f);
+        if (j == last)
+          return submit_data();
+      }
+      // use FileReader supporetd by Firefox 3.6
+      else if (window.FileReader) {
+        var reader = new FileReader();
+
+        // closure to pass file properties to async callback function
+        reader.onload = (function(file, j) {
+          return function(e) {
+            multipart += 'Content-Disposition: form-data; name="' + fieldname + '"';
+            multipart += '; filename="' + (f.name_bin || file.name) + '"' + crlf;
+            multipart += 'Content-Length: ' + file.size + crlf;
+            multipart += 'Content-Type: ' + file.type + crlf + crlf;
+            multipart += reader.result + crlf;
+            multipart += dashdash + boundary + crlf;
+
+            if (j == last)  // we're done, submit the data
+              return submit_data();
+          }
+        })(f,j);
+        reader.readAsBinaryString(f);
+      }
+      // Firefox 3
+      else if (f.getAsBinary) {
+        multipart += 'Content-Disposition: form-data; name="' + fieldname + '"';
+        multipart += '; filename="' + (f.name_bin || f.name) + '"' + crlf;
+        multipart += 'Content-Length: ' + f.size + crlf;
+        multipart += 'Content-Type: ' + f.type + crlf + crlf;
+        multipart += f.getAsBinary() + crlf;
+        multipart += dashdash + boundary +crlf;
+
+        if (j == last)
+          return submit_data();
+      }
+
+      j++;
+    }
+  };
+
+  // starts interval for keep-alive signal
   this.start_keepalive = function()
   {
-    if (this._int)
-      clearInterval(this._int);
+    if (!this.env.session_lifetime || this.env.framed || this.env.extwin || this.task == 'login' || this.env.action == 'print')
+      return;
 
-    if (this.env.keep_alive && !this.env.framed && this.task == 'mail' && this.gui_objects.mailboxlist)
-      this._int = setInterval(function(){ ref.check_for_recent(false); }, this.env.keep_alive * 1000);
-    else if (this.env.keep_alive && !this.env.framed && this.task != 'login' && this.env.action != 'print')
-      this._int = setInterval(function(){ ref.keep_alive(); }, this.env.keep_alive * 1000);
+    if (this._keepalive)
+      clearInterval(this._keepalive);
+
+    this._keepalive = setInterval(function(){ ref.keep_alive(); }, this.env.session_lifetime * 0.5 * 1000);
+  };
+
+  // starts interval for refresh signal
+  this.start_refresh = function()
+  {
+    if (!this.env.refresh_interval || this.env.framed || this.env.extwin || this.task == 'login' || this.env.action == 'print')
+      return;
+
+    if (this._refresh)
+      clearInterval(this._refresh);
+
+    this._refresh = setInterval(function(){ ref.refresh(); }, this.env.refresh_interval * 1000);
   };
 
   // sends keep-alive signal
@@ -6011,35 +6632,56 @@
       this.http_request('keep-alive');
   };
 
-  // sends request to check for recent messages
-  this.check_for_recent = function(refresh)
+  // sends refresh signal
+  this.refresh = function()
   {
-    if (this.busy)
+    if (this.busy) {
+      // try again after 10 seconds
+      setTimeout(function(){ ref.refresh(); ref.start_refresh(); }, 10000);
       return;
-
-    var lock, addurl = '_mbox=' + urlencode(this.env.mailbox);
-
-    if (refresh) {
-      lock = this.set_busy(true, 'checkingmail');
-      addurl += '&_refresh=1';
-      // reset check-recent interval
-      this.start_keepalive();
     }
 
-    if (this.gui_objects.messagelist)
-      addurl += '&_list=1';
-    if (this.gui_objects.quotadisplay)
-      addurl += '&_quota=1';
-    if (this.env.search_request)
-      addurl += '&_search=' + this.env.search_request;
+    var params = {}, lock = this.set_busy(true, 'refreshing');
 
-    this.http_request('check-recent', addurl, lock);
+    if (this.task == 'mail' && this.gui_objects.mailboxlist)
+      params = this.check_recent_params();
+
+    // plugins should bind to 'requestrefresh' event to add own params
+    this.http_request('refresh', params, lock);
+  };
+
+  // returns check-recent request parameters
+  this.check_recent_params = function()
+  {
+    var params = {_mbox: this.env.mailbox};
+
+    if (this.gui_objects.mailboxlist)
+      params._folderlist = 1;
+    if (this.gui_objects.messagelist)
+      params._list = 1;
+    if (this.gui_objects.quotadisplay)
+      params._quota = 1;
+    if (this.env.search_request)
+      params._search = this.env.search_request;
+
+    return params;
   };
 
 
   /********************************************************/
   /*********            helper methods            *********/
   /********************************************************/
+
+  // get window.opener.rcmail if available
+  this.opener = function()
+  {
+    // catch Error: Permission denied to access property rcmail
+    try {
+      if (window.opener && !opener.closed && opener.rcmail)
+        return opener.rcmail;
+    }
+    catch (e) {}
+  };
 
   // check if we're in show mode or if we have a unique selection
   // and return the message uid
@@ -6059,9 +6701,10 @@
   {
     if (obj.selectionEnd !== undefined)
       return obj.selectionEnd;
-    else if (document.selection && document.selection.createRange) {
+
+    if (document.selection && document.selection.createRange) {
       var range = document.selection.createRange();
-      if (range.parentElement()!=obj)
+      if (range.parentElement() != obj)
         return 0;
 
       var gm = range.duplicate();
@@ -6073,10 +6716,10 @@
       gm.setEndPoint('EndToStart', range);
       var p = gm.text.length;
 
-      return p<=obj.value.length ? p : -1;
+      return p <= obj.value.length ? p : -1;
     }
-    else
-      return obj.value.length;
+
+    return obj.value.length;
   };
 
   // moves cursor to specified position
@@ -6119,6 +6762,131 @@
     }
   };
 
+  this.mailto_handler_uri = function()
+  {
+    return location.href.split('?')[0] + '?_task=mail&_action=compose&_to=%s';
+  };
+
+  this.register_protocol_handler = function(name)
+  {
+    try {
+      window.navigator.registerProtocolHandler('mailto', this.mailto_handler_uri(), name);
+    }
+    catch(e) {};
+  };
+
+  this.check_protocol_handler = function(name, elem)
+  {
+    var nav = window.navigator;
+    if (!nav
+      || (typeof nav.registerProtocolHandler != 'function')
+      || ((typeof nav.isProtocolHandlerRegistered == 'function')
+        && nav.isProtocolHandlerRegistered('mailto', this.mailto_handler_uri()) == 'registered')
+    )
+      $(elem).addClass('disabled');
+    else
+      $(elem).click(function() { rcmail.register_protocol_handler(name); return false; });
+  };
+
+  // Checks browser capabilities eg. PDF support, TIF support
+  this.browser_capabilities_check = function()
+  {
+    if (!this.env.browser_capabilities)
+      this.env.browser_capabilities = {};
+
+    if (this.env.browser_capabilities.pdf === undefined)
+      this.env.browser_capabilities.pdf = this.pdf_support_check();
+
+    if (this.env.browser_capabilities.flash === undefined)
+      this.env.browser_capabilities.flash = this.flash_support_check();
+
+    if (this.env.browser_capabilities.tif === undefined)
+      this.tif_support_check();
+  };
+
+  // Returns browser capabilities string
+  this.browser_capabilities = function()
+  {
+    if (!this.env.browser_capabilities)
+      return '';
+
+    var n, ret = [];
+
+    for (n in this.env.browser_capabilities)
+      ret.push(n + '=' + this.env.browser_capabilities[n]);
+
+    return ret.join();
+  };
+
+  this.tif_support_check = function()
+  {
+    var img = new Image();
+
+    img.onload = function() { rcmail.env.browser_capabilities.tif = 1; };
+    img.onerror = function() { rcmail.env.browser_capabilities.tif = 0; };
+    img.src = 'program/resources/blank.tif';
+  };
+
+  this.pdf_support_check = function()
+  {
+    var plugin = navigator.mimeTypes ? navigator.mimeTypes["application/pdf"] : {},
+      plugins = navigator.plugins,
+      len = plugins.length,
+      regex = /Adobe Reader|PDF|Acrobat/i;
+
+    if (plugin && plugin.enabledPlugin)
+        return 1;
+
+    if (window.ActiveXObject) {
+      try {
+        if (axObj = new ActiveXObject("AcroPDF.PDF"))
+          return 1;
+      }
+      catch (e) {}
+      try {
+        if (axObj = new ActiveXObject("PDF.PdfCtrl"))
+          return 1;
+      }
+      catch (e) {}
+    }
+
+    for (i=0; i<len; i++) {
+      plugin = plugins[i];
+      if (typeof plugin === 'String') {
+        if (regex.test(plugin))
+          return 1;
+      }
+      else if (plugin.name && regex.test(plugin.name))
+        return 1;
+    }
+
+    return 0;
+  };
+
+  this.flash_support_check = function()
+  {
+    var plugin = navigator.mimeTypes ? navigator.mimeTypes["application/x-shockwave-flash"] : {};
+
+    if (plugin && plugin.enabledPlugin)
+        return 1;
+
+    if (window.ActiveXObject) {
+      try {
+        if (axObj = new ActiveXObject("ShockwaveFlash.ShockwaveFlash"))
+          return 1;
+      }
+      catch (e) {}
+    }
+
+    return 0;
+  };
+
+  // Cookie setter
+  this.set_cookie = function(name, value, expires)
+  {
+    setCookie(name, value, expires, this.env.cookie_path, this.env.cookie_domain, this.env.cookie_secure);
+  }
+
 }  // end object rcube_webmail
 
 
@@ -6149,8 +6917,9 @@
   }
 };
 
+rcube_webmail.prototype.get_cookie = getCookie;
+
 // copy event engine prototype
 rcube_webmail.prototype.addEventListener = rcube_event_engine.prototype.addEventListener;
 rcube_webmail.prototype.removeEventListener = rcube_event_engine.prototype.removeEventListener;
 rcube_webmail.prototype.triggerEvent = rcube_event_engine.prototype.triggerEvent;
-

--
Gitblit v1.9.1