Added protection/permissions.

Contribution from Fabian Murer, as part of an ETH student project.
Supervised, refactorized and merged by Jocelyn Fiat.

Signed-off-by: Fabian Murer <fmurer@student.ethz.ch>
Signed-off-by: Jocelyn Fiat <git@djoce.net>

examples/demo/demo-safe.ecf

@@ -8,7 +8,7 @@
 			<exclude>/CVS$</exclude>
 			<exclude>/EIFGENs$</exclude>
 		</file_rule>
-		<option debug="true" warning="true" full_class_checking="false" is_attached_by_default="true" void_safety="all" syntax="transitional">
+		<option debug="true" warning="true" full_class_checking="false" is_attached_by_default="true" is_obsolete_routine_type="true" void_safety="all" syntax="transitional">
 			<debug name="dbglog" enabled="true"/>
 		</option>
 		<setting name="executable_name" value="demo"/>
@@ -28,6 +28,7 @@
 		<library name="cms_demo_module" location="modules\demo\cms_demo_module-safe.ecf" readonly="false"/>
 		<library name="cms_email_service" location="..\..\library\email\email-safe.ecf" readonly="false"/>
 		<library name="cms_feed_aggregator_module" location="..\..\modules\feed_aggregator\feed_aggregator-safe.ecf" readonly="false"/>
+		<library name="cms_files_module" location="..\..\modules\files\files-safe.ecf" readonly="false"/>
 		<library name="cms_google_search_module" location="..\..\modules\google_search\google_search-safe.ecf" readonly="false" use_application_options="true"/>
 		<library name="cms_model" location="..\..\library\model\cms_model-safe.ecf" readonly="false"/>
 		<library name="cms_node_module" location="..\..\modules\node\node-safe.ecf" readonly="false"/>
@@ -37,12 +38,9 @@
 		<library name="cms_seo_module" location="..\..\modules\seo\seo-safe.ecf" readonly="false"/>
 		<library name="cms_session_auth_module" location="..\..\modules\session_auth\cms_session_auth-safe.ecf" readonly="false"/>
 		<library name="cms_taxnomy_module" location="..\..\modules\taxonomy\taxonomy-safe.ecf" readonly="false"/>
-		<library name="persistence_sqlite3" location="..\..\library\persistence\sqlite3\sqlite3-safe.ecf" readonly="false">
-			<option>
-				<assertions/>
-			</option>
-		</library>
+		<library name="persistence_sqlite3" location="..\..\library\persistence\sqlite3\sqlite3-safe.ecf" readonly="false"/>
 		<!--
+			 By default, commented, since it depends on specific environment settings.
 		<library name="persistence_store_odbc" location="..\..\library\persistence\store_odbc\store_odbc-safe.ecf"/>
 		<library name="persistence_store_mysql" location="..\..\library\persistence\store_mysql\store_mysql-safe.ecf" />
 		-->		

examples/demo/demo.ini

@@ -1,2 +1,3 @@
 port=9090
+#port=12345
 #verbose=true

examples/demo/install_modules.bat

@@ -1,3 +1,4 @@
+@echo off
 setlocal
 set ROC_CMD=call %~dp0..\..\tools\roc.bat
 set ROC_CMS_DIR=%~dp0
@@ -16,3 +17,4 @@ set ROC_CMS_DIR=%~dp0
 %ROC_CMD% install --module ..\..\modules\seo	--dir %ROC_CMS_DIR%
 %ROC_CMD% install --module ..\..\modules\session_auth	--dir %ROC_CMS_DIR%
 %ROC_CMD% install --module ..\..\modules\taxonomy	--dir %ROC_CMS_DIR%
+%ROC_CMD% install --module ..\..\modules\files	--dir %ROC_CMS_DIR%

examples/demo/site/modules/auth/mail_templates/admin_account_evaluation.html

@@ -21,6 +21,6 @@
 
 	<p>To reject the registration, please click on the following link <p>
 
-	<p><a href="$rejection_url<">$rejection_url</a></p>
+	<p><a href="$rejection_url">$rejection_url</a></p>
 </body>
 </html>

examples/demo/site/modules/files/files/css/files.css

@@ -0,0 +1,52 @@
+.uploaded-files table {
+  width: 100%;
+  border-collapse: collapse;
+  border: 1px solid black;
+}
+.uploaded-files table th {
+  padding: 3px 0 3px 5px;
+}
+.uploaded-files table td {
+  padding: 3px 0 3px 5px;
+}
+.uploaded-files a.button {
+  color: black;
+  text-decoration: none;
+  border: solid 1px #999;
+  background-color: #ddd;
+  padding: 2px 4px 2px 4px;
+}
+.uploaded-files a.button:hover {
+  color: black;
+  border: solid 1px #06f;
+  background-color: #cff;
+}
+
+.upload-files .center {
+  text-align: center;
+  padding: 10px;
+}
+.upload-files a.button {
+  margin: auto;
+  width: 100px;
+  color: black;
+  text-decoration: none;
+  border: solid 1px #999;
+  background-color: #ddd;
+  padding: 2px 4px 2px 4px;
+}
+.upload-files a.button:hover {
+  color: black;
+  border: solid 1px #06f;
+  background-color: #cff;
+}
+
+/******************* Drop Zone *******************/
+.dropzone {
+  width: 100%;
+  border: 2px dashed blue;
+  border-radius: 3px;
+  text-align: center;
+  padding-top: 15px;
+  padding-bottom: 15px;
+}

examples/demo/site/modules/files/files/js/src/basic.scss

@@ -0,0 +1,78 @@
+/*
+ * The MIT License
+ * Copyright (c) 2012 Matias Meno <m@tias.me>
+ */
+
+// Permission is hereby granted, free of charge, to any person obtaining a copy of
+// this software and associated documentation files (the "Software"), to deal in
+// the Software without restriction, including without limitation the rights to
+// use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+// of the Software, and to permit persons to whom the Software is furnished to do
+// so, subject to the following conditions:
+
+// The above copyright notice and this permission notice shall be included in all
+// copies or substantial portions of the Software.
+
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+.dropzone, .dropzone * {
+  box-sizing: border-box;
+}
+.dropzone {
+
+  position: relative;
+
+  .dz-preview {
+    position: relative;
+    display: inline-block;
+    width: 120px;
+    margin: 0.5em;
+
+    .dz-progress {
+      display: block;
+      height: 15px;
+      border: 1px solid #aaa;
+      .dz-upload {
+        display: block;
+        height: 100%;
+        width: 0;
+        background: green;
+      }
+    }
+
+    .dz-error-message {
+      color: red;
+      display: none;
+    }
+    &.dz-error {
+      .dz-error-message, .dz-error-mark {
+        display: block;
+      }
+    }
+    &.dz-success {
+      .dz-success-mark {
+        display: block;
+      }
+    }
+
+    .dz-error-mark, .dz-success-mark {
+      position: absolute;
+      display: none;
+      left: 30px;
+      top: 30px;
+      width: 54px;
+      height: 58px;
+      left: 50%;
+      margin-left: -(54px/2);
+    }
+
+
+  }
+
+}

examples/demo/site/modules/files/files/js/src/dropzone.scss

@@ -0,0 +1,413 @@
+/*
+ * The MIT License
+ * Copyright (c) 2012 Matias Meno <m@tias.me>
+ */
+
+// Permission is hereby granted, free of charge, to any person obtaining a copy of
+// this software and associated documentation files (the "Software"), to deal in
+// the Software without restriction, including without limitation the rights to
+// use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+// of the Software, and to permit persons to whom the Software is furnished to do
+// so, subject to the following conditions:
+
+// The above copyright notice and this permission notice shall be included in all
+// copies or substantial portions of the Software.
+
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+@mixin keyframes($name) {
+  @-webkit-keyframes #{$name} {
+    @content; 
+  }
+  @-moz-keyframes #{$name} {
+    @content;
+  }
+  @keyframes #{$name} {
+    @content;
+  } 
+}
+
+
+@mixin prefix($map, $vendors: webkit moz ms o) {
+  @each $prop, $value in $map {
+    @if $vendors {
+      @each $vendor in $vendors {
+        #{"-" + $vendor + "-" + $prop}: #{$value};
+      }
+    }
+    // Dump regular property anyway
+    #{$prop}: #{$value};
+  }
+}
+
+
+@include keyframes(passing-through) {
+  
+  0% {
+    opacity: 0;
+    @include prefix((transform: translateY(40px)));
+  }
+
+  30%, 70% {
+    opacity: 1;
+    @include prefix((transform: translateY(0px)));
+  }
+
+  100% {
+    opacity: 0;
+    @include prefix((transform: translateY(-40px)));
+  }
+}
+
+
+@include keyframes(slide-in) {
+  
+  0% {
+    opacity: 0;
+    @include prefix((transform: translateY(40px)));
+  }
+
+  30% {
+    opacity: 1;
+    @include prefix((transform: translateY(0px)));
+  }
+}
+
+
+
+@include keyframes(pulse) {
+  
+  0% { @include prefix((transform: scale(1))); }
+  10% { @include prefix((transform: scale(1.1))); }
+  20% { @include prefix((transform: scale(1))); }
+
+}
+
+
+
+.dropzone, .dropzone * {
+  box-sizing: border-box;
+}
+.dropzone {
+
+  $image-size: 120px;
+
+  $image-border-radius: 20px;
+
+  &.dz-clickable {
+    cursor: pointer;
+
+    * {
+      cursor: default;
+    }
+    .dz-message {
+      &, * {
+        cursor: pointer;
+      }
+    }
+  }
+
+  min-height: 150px;
+  border: 2px solid rgba(0, 0, 0, 0.3);
+  background: white;
+  padding: 20px 20px;
+
+  &.dz-started {
+    .dz-message {
+      display: none;
+    }
+  }
+
+  &.dz-drag-hover {
+    border-style: solid;
+    .dz-message {
+      opacity: 0.5;
+    }
+  }
+  .dz-message {
+    text-align: center;
+    margin: 2em 0;
+
+
+  }
+
+
+
+  .dz-preview {
+    position: relative;
+    display: inline-block;
+
+    vertical-align: top;
+
+    margin: 16px;
+    min-height: 100px;
+
+    &:hover {
+      // Making sure that always the hovered preview element is on top
+      z-index: 1000;
+      .dz-details {
+        opacity: 1;
+      }
+    }
+
+    &.dz-file-preview {
+
+      .dz-image {
+        border-radius: $image-border-radius;
+        background: #999;
+        background: linear-gradient(to bottom, #eee, #ddd);
+      }
+
+      .dz-details {
+        opacity: 1;
+      }
+    }
+
+    &.dz-image-preview {
+      background: white;
+      .dz-details {
+        @include prefix((transition: opacity 0.2s linear));
+      }
+    }
+
+    .dz-remove {
+      font-size: 14px;
+      text-align: center;
+      display: block;
+      cursor: pointer;
+      border: none;
+      &:hover {
+        text-decoration: underline;
+      }
+    }
+
+    &:hover .dz-details {
+      opacity: 1;
+    }
+    .dz-details {
+      $background-color: #444;
+
+      z-index: 20;
+
+      position: absolute;
+      top: 0;
+      left: 0;
+
+      opacity: 0;
+
+      font-size: 13px;
+      min-width: 100%;
+      max-width: 100%;
+      padding: 2em 1em;
+      text-align: center;
+      color: rgba(0, 0, 0, 0.9);
+
+      $width: 120px;
+
+      line-height: 150%;
+
+      .dz-size {
+        margin-bottom: 1em;
+        font-size: 16px;
+      }
+
+      .dz-filename {
+
+        white-space: nowrap;
+
+        &:hover {
+          span {
+            border: 1px solid rgba(200, 200, 200, 0.8);
+            background-color: rgba(255, 255, 255, 0.8);
+          }
+        }
+        &:not(:hover) {
+          span {
+            border: 1px solid transparent;
+          }
+          overflow: hidden;
+          text-overflow: ellipsis;
+        }
+
+      }
+
+      .dz-filename, .dz-size {
+        span {
+          background-color: rgba(255, 255, 255, 0.4);
+          padding: 0 0.4em;
+          border-radius: 3px;
+        }
+      }
+
+    }
+
+    &:hover {
+      .dz-image {
+        // opacity: 0.8;
+        img {
+          @include prefix((transform: scale(1.05, 1.05))); // Getting rid of that white bleed-in
+          @include prefix((filter: blur(8px)), webkit); // Getting rid of that white bleed-in
+        }
+      }
+    }
+    .dz-image {
+      border-radius: $image-border-radius;
+      overflow: hidden;
+      width: $image-size;
+      height: $image-size;
+      position: relative;
+      display: block;
+      z-index: 10;
+
+      img {
+        display: block;
+      }
+    }
+
+
+    &.dz-success {
+      .dz-success-mark {
+        @include prefix((animation: passing-through 3s cubic-bezier(0.770, 0.000, 0.175, 1.000)));
+      }
+    }
+    &.dz-error {
+      .dz-error-mark {
+        opacity: 1;
+        @include prefix((animation: slide-in 3s cubic-bezier(0.770, 0.000, 0.175, 1.000)));
+      }
+    }
+
+
+    .dz-success-mark, .dz-error-mark {
+
+      $image-height: 54px;
+      $image-width: 54px;
+
+      pointer-events: none;
+
+      opacity: 0;
+      z-index: 500;
+
+      position: absolute;
+      display: block;
+      top: 50%;
+      left: 50%;
+      margin-left: -($image-width/2);
+      margin-top: -($image-height/2);
+
+      svg {
+        display: block;
+        width: $image-width;
+        height: $image-height;
+      }
+    }
+    
+      
+    &.dz-processing .dz-progress {
+      opacity: 1;
+      @include prefix((transition: all 0.2s linear));
+    }
+    &.dz-complete .dz-progress {
+      opacity: 0;
+      @include prefix((transition: opacity 0.4s ease-in));
+    }
+
+    &:not(.dz-processing) {
+      .dz-progress {
+        @include prefix((animation: pulse 6s ease infinite));
+      }
+    }
+    .dz-progress {
+
+      opacity: 1;
+      z-index: 1000;
+
+      pointer-events: none;
+      position: absolute;
+      height: 16px;
+      left: 50%;
+      top: 50%;
+      margin-top: -8px;
+
+      width: 80px;
+      margin-left: -40px;
+
+      // border: 2px solid #333;
+      background: rgba(255, 255, 255, 0.9);
+
+      // Fix for chrome bug: https://code.google.com/p/chromium/issues/detail?id=157218
+      -webkit-transform: scale(1);
+
+
+      border-radius: 8px;
+
+      overflow: hidden;
+
+      .dz-upload {
+        background: #333;
+        background: linear-gradient(to bottom, #666, #444);
+        position: absolute;
+        top: 0;
+        left: 0;
+        bottom: 0;
+        width: 0;
+        @include prefix((transition: width 300ms ease-in-out));
+      }
+
+    }
+
+    &.dz-error {
+      .dz-error-message {
+        display: block;
+      }
+      &:hover .dz-error-message {
+        opacity: 1;
+        pointer-events: auto;
+      }
+    }
+
+    .dz-error-message {
+      $width: $image-size + 20px;
+      $color: rgb(190, 38, 38);
+
+      pointer-events: none;
+      z-index: 1000;
+      position: absolute;
+      display: block;
+      display: none;
+      opacity: 0;
+      @include prefix((transition: opacity 0.3s ease));
+      border-radius: 8px;
+      font-size: 13px;
+      top: $image-size + 10px;
+      left: -10px;
+      width: $width;
+      background: $color;
+      background: linear-gradient(to bottom, $color, darken($color, 5%));
+      padding: 0.5em 1.2em;
+      color: white;
+
+      // The triangle pointing up
+      &:after {
+        content: '';
+        position: absolute;
+        top: -6px;
+        left: $width / 2 - 6px;
+        width: 0; 
+        height: 0; 
+        border-left: 6px solid transparent;
+        border-right: 6px solid transparent;
+        border-bottom: 6px solid $color;
+      }
+    }
+
+  }
+}
+
+

examples/demo/site/modules/files/files/scss/files.scss

@@ -0,0 +1,63 @@
+.uploaded-files {
+	table {
+		width: 100%;
+		border-collapse: collapse;
+		border: 1px solid black;
+
+		th {
+			padding: 3px 0 3px 5px;
+		}
+
+		td {
+			padding: 3px 0 3px 5px;
+		}
+	}
+
+	a.button{
+		color: black;
+		text-decoration: none;
+		border: solid 1px #999;
+		background-color: #ddd;
+		padding: 2px 4px 2px 4px;
+		&:hover {
+			color: black;
+			border: solid 1px #06f;
+			background-color: #cff;
+		}
+	}
+}
+
+.upload-files {
+	.center {
+		text-align: center;
+		padding: 10px;
+	}
+	a.button{
+		margin: auto;
+		width: 100px;
+
+		color: black;
+		text-decoration: none;
+		border: solid 1px #999;
+		background-color: #ddd;
+		padding: 2px 4px 2px 4px;
+		&:hover {
+			color: black;
+			border: solid 1px #06f;
+			background-color: #cff;
+		}
+	}
+}
+
+
+/******************* Drop Zone *******************/
+
+.dropzone {
+	width: 100%;
+	border: 2px dashed blue;
+	border-radius: 3px;
+	text-align: center;
+	padding-top: 15px;
+	padding-bottom: 15px;
+}
+

examples/demo/src/demo_cms_execution.e

@@ -57,6 +57,9 @@ feature -- CMS modules
 			a_setup.register_module (create {CMS_NODE_MODULE}.make (a_setup))
 			a_setup.register_module (create {CMS_BLOG_MODULE}.make)
 
+				-- Files
+			a_setup.register_module (create {CMS_FILES_MODULE}.make)
+
 				-- Contact
 			a_setup.register_module (create {CMS_CONTACT_MODULE}.make)
 
@@ -76,6 +79,7 @@ feature -- CMS modules
 			a_setup.register_module (create {GOOGLE_CUSTOM_SEARCH_MODULE}.make)
 			a_setup.register_module (create {CMS_DEBUG_MODULE}.make)
 			a_setup.register_module (create {CMS_DEMO_MODULE}.make)
+
 		end
 
 end

modules/auth/cms_auth_module_i.e

@@ -68,9 +68,9 @@ feature -- Hooks
 			l_destination: READABLE_STRING_8
 		do
 			if attached {WSF_STRING} a_response.request.query_parameter ("destination") as p_destination then
-				l_destination := p_destination.url_encoded_value
+				l_destination := p_destination.value
 			else
-				l_destination := percent_encoded (a_response.location)
+				l_destination := a_response.location
 			end
 			if is_authenticating (a_response) then
 

modules/auth/cms_authentication_email_service.e

@@ -112,6 +112,7 @@ feature -- Basic Operations / Contact
 			l_message.replace_substring_all ("$host", a_host)
 			l_message.replace_substring_all ("$sitename", parameters.utf_8_site_name)
 			l_message.replace_substring_all ("$user", a_user.utf_8_name)
+			l_message.replace_substring_all ("$email", a_to)
 			send_message (contact_email_address, a_to, parameters.contact_subject_register, l_message)
 		end
 
@@ -126,6 +127,7 @@ feature -- Basic Operations / Contact
 			l_message.replace_substring_all ("$host", a_host)
 			l_message.replace_substring_all ("$sitename", parameters.utf_8_site_name)
 			l_message.replace_substring_all ("$link", a_link)
+			l_message.replace_substring_all ("$email", a_to)
 			send_message (contact_email_address, a_to, parameters.contact_subject_activate, l_message)
 		end
 
@@ -137,7 +139,7 @@ feature -- Basic Operations / Contact
 			l_message: STRING
 		do
 			create l_message.make_from_string (parameters.account_activation_confirmation)
-			l_message.replace_substring_all ("$hot", a_host)
+			l_message.replace_substring_all ("$host", a_host)
 			l_message.replace_substring_all ("$sitename", parameters.utf_8_site_name)
 			l_message.replace_substring_all ("$user", a_user.utf_8_name)
 			l_message.replace_substring_all ("$email", a_to)

modules/auth/cms_authentication_email_service_parameters.e

@@ -130,13 +130,13 @@ feature	-- Access
 	account_re_activation: STRING
 			-- Account re_activation template email message.
 		do
-			Result := template_string ("accunt_re_activation.html", default_template_account_re_activation)
+			Result := template_string ("account_re_activation.html", default_template_account_re_activation)
 		end
 
 	account_rejected: STRING
 			-- Account rejected template email message.
 		do
-			Result := template_string ("accunt_rejected.html", default_template_account_rejected)
+			Result := template_string ("account_rejected.html", default_template_account_rejected)
 		end
 
 	account_password: STRING
@@ -277,7 +277,7 @@ feature {NONE} -- Message email
 		</head>
 
 		<body>
-			<p>You requested has been rejected, your application does not conform our rules <a href="$host">$sitename</a></p>
+			<p>Your account application is rejected, it does not conform our rules <a href="$host">$sitename</a></p>
 		</body>
 		</html>
 	]"
@@ -316,7 +316,7 @@ feature {NONE} -- Message email
 		</head>
 
 		<body>
-			<p>You have required a new password at <a href="$host">$sitename</a></p>
+			<p>You have requested a new password at <a href="$host">$sitename</a></p>
 
 			<p>To complete your request, please click on this link to generate a new password:<p>
 
@@ -337,7 +337,7 @@ feature {NONE} -- Message email
 		</head>
 
 		<body>
-			<p>Welcome to<a href="...">$sitename</a></p>
+			<p>Welcome to <a href="$host">$sitename</a>.</p>
 			<p>Thank you for joining us.</p>
 		</body>
 		</html>

modules/auth/cms_authentication_module.e

@@ -1,7 +1,7 @@
 note
 	description: "Module Auth"
-	date: "$Date: 2015-05-20 06:50:50 -0300 (mi. 20 de may. de 2015) $"
-	revision: "$Revision: 97328 $"
+	date: "$Date$"
+	revision: "$Revision$"
 
 class
 	CMS_AUTHENTICATION_MODULE
@@ -79,6 +79,10 @@ feature -- Access: docs
 
 feature -- Router
 
+	roc_login_location: STRING = "account/roc-login"
+
+	roc_logout_location: STRING = "account/roc-logout"
+
 	setup_router (a_router: WSF_ROUTER; a_api: CMS_API)
 			-- <Precursor>
 		do
@@ -97,8 +101,8 @@ feature -- Router
 			a_router.map (m, a_router.methods_head_get)
 
 
-			a_router.handle ("/account/roc-login", create {WSF_URI_AGENT_HANDLER}.make (agent handle_login(a_api, ?, ?)), a_router.methods_head_get)
-			a_router.handle ("/account/roc-logout", create {WSF_URI_AGENT_HANDLER}.make (agent handle_logout(a_api, ?, ?)), a_router.methods_head_get)
+			a_router.handle ("/" + roc_login_location, create {WSF_URI_AGENT_HANDLER}.make (agent handle_login(a_api, ?, ?)), a_router.methods_head_get)
+			a_router.handle ("/" + roc_logout_location, create {WSF_URI_AGENT_HANDLER}.make (agent handle_logout(a_api, ?, ?)), a_router.methods_head_get)
 			a_router.handle ("/account/roc-register", create {WSF_URI_AGENT_HANDLER}.make (agent handle_register(a_api, ?, ?)), a_router.methods_get_post)
 			a_router.handle ("/account/activate/{token}", create {WSF_URI_TEMPLATE_AGENT_HANDLER}.make (agent handle_activation(a_api, ?, ?)), a_router.methods_head_get)
 			a_router.handle ("/account/reject/{token}", create {WSF_URI_TEMPLATE_AGENT_HANDLER}.make (agent handle_reject(a_api, ?, ?)), a_router.methods_head_get)
@@ -128,8 +132,35 @@ feature -- Hooks configuration
 
 	value_table_alter (a_value: CMS_VALUE_TABLE; a_response: CMS_RESPONSE)
 			-- <Precursor>
+		local
+			l_destination: detachable READABLE_STRING_GENERAL
+			l_url: STRING
+			l_url_name: READABLE_STRING_GENERAL
 		do
-			a_value.force (a_response.user, "user")
+			if attached {WSF_STRING} a_response.request.query_parameter ("destination") as p_destination then
+				l_destination := p_destination.value
+			else
+				l_destination := a_response.location
+			end
+			if l_destination.starts_with ("account/auth/") then
+				l_destination := Void
+			end
+
+			if attached a_response.user as u then
+				a_value.force (u, "user")
+
+				l_url_name := "site_sign_out_url"
+				l_url := a_response.url (roc_logout_location, Void)
+			else
+				a_value.force (Void, "user")
+
+				l_url_name := "site_sign_in_url"
+				l_url := a_response.url (roc_login_location, Void)
+			end
+			if l_destination /= Void then
+				l_url.append ("?destination=" + percent_encoded (l_destination))
+			end
+			a_value.force (l_url, l_url_name)
 		end
 
 	menu_system_alter (a_menu_system: CMS_MENU_SYSTEM; a_response: CMS_RESPONSE)
@@ -143,14 +174,14 @@ feature -- Hooks configuration
 				lnk.set_weight (97)
 				a_menu_system.primary_menu.extend (lnk)
 
-				create lnk.make ("Logout", "account/roc-logout")
+				create lnk.make ("Logout", roc_logout_location)
 			else
-				create lnk.make ("Login", "account/roc-login")
+				create lnk.make ("Login", roc_login_location)
 			end
 			lnk.set_weight (98)
 			if
 				a_response.location.starts_with_general ("account/auth/")
-				or a_response.location.starts_with_general ("account/roc-log")
+				or a_response.location.starts_with_general ("account/roc-log") -- in ou out
 			then
 					-- ignore destination
 			else
@@ -199,7 +230,7 @@ feature -- Handler
 			r.set_main_content (b)
 
 			if l_user = Void then
-				r.set_redirection ("account/roc-login")
+				r.set_redirection (roc_login_location)
 			end
 			r.execute
 		end

modules/auth/site/mail_templates/admin_account_evaluation.html

@@ -21,6 +21,6 @@
 
 	<p>To reject the registration, please click on the following link <p>
 
-	<p><a href="$rejection_url<">$rejection_url</a></p>
+	<p><a href="$rejection_url">$rejection_url</a></p>
 </body>
 </html>

modules/files/cms_file.e

@@ -0,0 +1,69 @@
+note
+	description: "Interface representing any files under `{CMS_API}.files_location' ."
+	date: "$Date$"
+	revision: "$Revision$"
+
+class
+	CMS_FILE
+
+create
+	make
+
+feature {NONE} -- Initializaion
+
+	make (a_relative_path: PATH; a_api: CMS_API)
+		do
+			cms_api := a_api
+			relative_path := a_relative_path
+		end
+
+	cms_api: CMS_API
+
+feature -- Access
+
+	filename: STRING_32
+			-- File name of Current file.
+		local
+			p: PATH
+		do
+			p := relative_path
+			if attached p.entry as e then
+				Result := e.name
+			else
+				Result := p.name
+			end
+		end
+
+	relative_path: PATH
+			-- Path relative the `CMS_API.files_location'.
+
+	owner: detachable CMS_USER
+			-- Optional owner.
+
+feature -- Status report
+
+	is_directory: BOOLEAN
+		local
+			d: DIRECTORY
+		do
+			create d.make_with_path (cms_api.files_location.extended_path (relative_path))
+			Result := d.exists
+		end
+
+	is_file: BOOLEAN
+		local
+			f: RAW_FILE
+		do
+			create f.make_with_path (cms_api.files_location.extended_path (relative_path))
+			Result := f.exists
+		end
+
+feature -- Element change
+
+	set_owner (u: detachable CMS_USER)
+			-- Set `owner' to `u'.
+		do
+			owner := u
+		end
+
+end

modules/files/cms_file_metadata.e

@@ -0,0 +1,57 @@
+note
+	description: "Metadata associated to a CMS_FILE."
+	date: "$Date$"
+	revision: "$Revision$"
+
+class
+	CMS_FILE_METADATA
+
+create
+	make,
+	make_empty
+
+feature {NONE} -- Initialization
+
+	make_empty
+		do
+			create date.make_now_utc
+		end
+
+	make (f: CMS_FILE)
+		do
+			make_empty
+		end
+
+feature -- Access
+
+	user: detachable CMS_USER
+
+	date: detachable DATE_TIME
+
+	size: INTEGER
+
+	file_type: detachable READABLE_STRING_8
+
+feature -- Element change
+
+	set_user (u: detachable CMS_USER)
+		do
+			user := u
+		end
+
+	set_date (dt: detachable DATE_TIME)
+		do
+			date := dt
+		end
+
+	set_size (a_size: INTEGER)
+		do
+			size := a_size
+		end
+
+	set_file_type (a_type: detachable READABLE_STRING_8)
+		do
+			file_type := a_type
+		end
+
+end

modules/files/cms_files_api.e

@@ -0,0 +1,272 @@
+note
+	description: "API to manage files."
+	date: "$Date$"
+	revision: "$Revision$"
+
+class
+	CMS_FILES_API
+
+inherit
+	CMS_MODULE_API
+
+	REFACTORING_HELPER
+
+create
+	make
+
+feature -- Access : path
+
+	uploads_relative_path: PATH
+			-- Path relative to `{CMS_API}.files_location'.
+		do
+			create Result.make_from_string (uploads_directory_name)
+		end
+
+	uploads_directory: PATH
+		do
+			Result := cms_api.files_location.extended (uploads_directory_name)
+		end
+
+	uploaded_file_path (f: READABLE_STRING_GENERAL): PATH
+		do
+			Result := uploads_directory.extended (f)
+		end
+
+	thumbnail_directory: PATH
+		do
+			Result := uploads_directory.extended (thumbnail_directory_name)
+		end
+
+feature {CMS_FILES_MODULE} -- Access : metadata path
+
+	metadata_path (f: READABLE_STRING_GENERAL): PATH
+		do
+			Result := metadata_directory.extended (f).appended_with_extension ("cms-metadata")
+		end
+
+	metadata_directory: PATH
+		do
+			Result := uploads_directory.extended (metadata_directory_name)
+		end
+
+feature -- Access : links
+
+	file_link (f: CMS_FILE): CMS_LOCAL_LINK
+		local
+			s: STRING
+		do
+			s := "files"
+			across
+				f.relative_path.components as ic
+			loop
+				s.append_character ('/')
+				s.append (percent_encoded (ic.item.name))
+			end
+			create Result.make (f.filename, s)
+		end
+
+feature {NONE} -- Constants
+
+	uploads_directory_name: STRING = "uploads"
+
+	metadata_directory_name: STRING = ".metadata"
+
+	thumbnail_directory_name: STRING = ".thumbnails"
+
+feature -- Factory
+
+	new_file (a_relative_path: PATH): CMS_FILE
+			-- New CMS_FILE for path `a_relative_path' relative to `files' directory.
+		do
+			create Result.make (a_relative_path, cms_api)
+		end
+
+	new_uploads_file (p: PATH): CMS_FILE
+			-- New uploaded path from `p' relative to `uploads_directory'.
+		do
+			create Result.make (uploads_relative_path.extended_path (p), cms_api)
+		end
+
+feature -- Storage
+
+	delete_file (fn: READABLE_STRING_GENERAL)
+			-- Delete file at `fn'.
+		local
+			p: PATH
+		do
+			error_handler.reset
+			p := uploaded_file_path (fn)
+			safe_delete (p)
+			if not has_error then
+				p := metadata_path (fn)
+				safe_delete (p)
+			end
+		end
+
+	save_uploaded_file (uf: CMS_UPLOADED_FILE)
+		local
+			p: PATH
+			ut: FILE_UTILITIES
+			stored: BOOLEAN
+			original_name: STRING_32
+			n: INTEGER_32
+			finished: BOOLEAN
+		do
+			reset_error
+			create original_name.make_from_string (uf.filename)
+
+			p := uf.location
+			if not p.is_absolute then
+				p := uploads_directory.extended_path (p)
+			end
+
+			if ut.file_path_exists (p) then
+
+				from
+					n := 1
+				until
+					finished
+				loop
+					if ut.file_path_exists (p) then
+						uf.set_new_location_with_number (n)
+						p := uf.location
+						if p.is_absolute then
+						else
+							p := uploads_directory.extended_path (p)
+						end
+						n := n + 1
+					else
+						finished := True
+					end
+				end
+				stored := uf.move_to (p)
+			else
+					-- move file to path
+				stored := uf.move_to (p)
+			end
+
+			if stored then
+				save_metadata_from_uploaded_file (uf, cms_api.user)
+			else
+				error_handler.add_custom_error (-1, "uploaded file storage failed", "Issue occurred when saving uploaded file!")
+			end
+		end
+
+	save_metadata_from_uploaded_file (a_uploaded_file: CMS_UPLOADED_FILE; u: detachable CMS_USER)
+		local
+			f: detachable RAW_FILE
+			h_date: HTTP_DATE
+			retried: BOOLEAN
+		do
+			if retried then
+					-- FIXME: Report error?
+				if f /= Void and then not f.is_closed then
+					f.close
+				end
+			else
+					-- create a file for metadata
+				create f.make_with_path (metadata_path (a_uploaded_file.filename))
+
+				if f.exists then
+					f.open_write
+				else
+					f.create_read_write
+				end
+					-- insert username
+				if u /= Void then
+					f.put_string (u.id.out)
+					f.put_new_line
+--					f.put_string (utf.utf_32_string_to_utf_8_string_8 (u.name))
+--					f.put_new_line
+				else
+					f.put_new_line
+					f.put_new_line
+				end
+					-- insert uploaded_time
+				create h_date.make_now_utc
+				f.put_string (h_date.timestamp.out)
+				f.put_new_line
+
+					-- insert size of file
+				f.put_string (a_uploaded_file.size.out)
+				f.put_new_line
+
+					-- insert file type
+				if attached a_uploaded_file.type as type then
+					f.put_string (type.out)
+					f.put_new_line
+				end
+
+				f.close
+			end
+		rescue
+			retried := True
+			retry
+		end
+
+	metadata (a_cms_file: CMS_FILE): detachable CMS_FILE_METADATA
+		local
+			f: RAW_FILE
+			s: READABLE_STRING_8
+		do
+			if attached metadata_path (a_cms_file.filename) as p then
+				create f.make_with_path (p)
+				if f.exists and then f.is_access_readable then
+					create Result.make_empty
+
+					f.open_read
+
+					f.read_line
+					s := f.last_string
+					if s.is_integer_64 then
+						Result.set_user (cms_api.user_api.user_by_id (s.to_integer_64))
+					else
+						Result.set_user (cms_api.user_api.user_by_name (s))
+					end
+
+					f.read_line
+					s := f.last_string
+					if s.is_integer_64 then
+						Result.set_date ((create {HTTP_DATE}.make_from_timestamp (s.to_integer_64)).date_time)
+					end
+
+					f.read_line
+					s := f.last_string
+					if s.is_integer_32 then
+						Result.set_size (s.to_integer_32)
+					else
+						Result.set_size (-1)
+					end
+
+					if not f.end_of_file then
+						f.read_line
+						Result.set_file_type (f.last_string)
+					end
+					f.close
+				end
+			end
+		end
+
+	safe_delete (p: PATH)
+			-- Safe remove file at path `p'.
+		local
+			f: RAW_FILE
+			retried: BOOLEAN
+		do
+			if retried then
+				error_handler.add_custom_error (-1, "Can not delete file", {STRING_32} "Can not delete file %"" + p.name + "%"")
+			else
+				create f.make_with_path (p)
+				if f.exists then
+					f.delete
+				else
+						-- Not considered as failure.
+				end
+			end
+		rescue
+			retried := True
+			retry
+		end
+
+
+end

modules/files/cms_files_module.e

@@ -0,0 +1,504 @@
+note
+	description: "files module."
+	date: "$Date$"
+	revision: "$Revision$"
+
+class
+	CMS_FILES_MODULE
+
+inherit
+	CMS_MODULE
+		rename
+			module_api as files_api
+		redefine
+			install,
+			initialize,
+			setup_hooks,
+			permissions,
+			files_api
+		end
+
+	CMS_HOOK_MENU_SYSTEM_ALTER
+
+	SHARED_EXECUTION_ENVIRONMENT
+
+create
+	make
+
+feature {NONE} -- Initialization
+
+	make
+		do
+			name := "files"
+			version := "1.0"
+			description := "Service to upload files, and manage them."
+			package := "file"
+		end
+
+feature -- Access
+
+	name: STRING
+
+	permissions: LIST [READABLE_STRING_8]
+			-- List of permission ids, used by this module, and declared.
+		do
+			Result := Precursor
+			Result.force (admin_files_permission)
+			Result.force (upload_files_permission)
+			Result.force (browse_files_permission)
+		end
+
+	admin_files_permission: STRING = "admin files"
+	upload_files_permission: STRING = "upload files"
+	browse_files_permission: STRING = "browse files"
+
+feature {CMS_API} -- Module Initialization
+
+	initialize (api: CMS_API)
+			-- <Precursor>
+		do
+			Precursor (api)
+			if files_api = Void then
+				create files_api.make (api)
+			end
+		end
+
+feature {CMS_API}-- Module management
+
+	install (api: CMS_API)
+			-- install the module
+		local
+			l_files_api: like files_api
+			d: DIRECTORY
+		do
+			create l_files_api.make (api)
+			create d.make_with_path (l_files_api.uploads_directory)
+			if not d.exists then
+				d.recursive_create_dir
+			end
+			create d.make_with_path (l_files_api.metadata_directory)
+			if not d.exists then
+				d.recursive_create_dir
+			end
+
+			files_api := l_files_api
+			Precursor (api)
+		end
+
+feature {CMS_API} -- Access: API
+
+	files_api: detachable CMS_FILES_API
+			-- <Precursor>		
+
+feature -- Access: router
+
+	setup_router (a_router: WSF_ROUTER; a_api: CMS_API)
+			-- <Precursor>
+		do
+			map_uri_template_agent (a_router, "/" + uploads_location, agent execute_upload (?, ?, a_api), Void) -- Accepts any method GET, HEAD, POST, PUT, DELETE, ...
+			map_uri_template_agent (a_router, "/" + uploads_location + "{filename}", agent display_uploaded_file_info (?, ?, a_api), a_router.methods_get)
+			map_uri_template_agent (a_router, "/" + uploads_location + "remove/{filename}", agent remove_file (?, ?, a_api), a_router.methods_get)
+		end
+
+	uploads_location: STRING = "upload/"
+
+feature -- Hooks
+
+	setup_hooks (a_hooks: CMS_HOOK_CORE_MANAGER)
+		do
+			a_hooks.subscribe_to_menu_system_alter_hook (Current)
+		end
+
+	menu_system_alter (a_menu_system: CMS_MENU_SYSTEM; a_response: CMS_RESPONSE)
+		local
+			link: CMS_LOCAL_LINK
+		do
+			-- login in demo did somehow not work
+			if a_response.has_permission (upload_files_permission) then
+				create link.make ("Upload files", uploads_location)
+				a_menu_system.navigation_menu.extend (link)
+			end
+		end
+
+feature -- Handler
+
+	execute_not_found_handler (uri: READABLE_STRING_8; req: WSF_REQUEST; res: WSF_RESPONSE)
+			-- `uri' is not found, redirect to default page
+		do
+			res.redirect_now_with_content (req.script_url ("/"), uri + ": not found. %N Redirection to" + req.script_url ("/"), "text/html")
+		end
+
+	display_uploaded_file_info (req: WSF_REQUEST; res: WSF_RESPONSE; api: CMS_API)
+			-- Display information related to a cms uploaded file.
+		local
+			body: STRING_8
+			r: CMS_RESPONSE
+			f: CMS_FILE
+			md: detachable CMS_FILE_METADATA
+			fn: READABLE_STRING_32
+		do
+			check req.is_get_request_method end
+			if not api.has_permission (browse_files_permission) then
+				create {FORBIDDEN_ERROR_CMS_RESPONSE} r.make (req, res, api)
+				r.add_error_message ("You are not allowed to browse CMS files!")
+			elseif attached {WSF_STRING} req.path_parameter ("filename") as p_filename then
+				create {GENERIC_VIEW_CMS_RESPONSE} r.make (req, res, api)
+
+					-- add style
+				r.add_style (r.url ("/module/" + name + "/files/css/files.css", Void), Void)
+
+				create body.make_empty
+
+				fn := p_filename.value
+				r.set_page_title ({STRING_32} "File %"" + fn + {STRING_32} "%"")
+				body.append ("<div class=%"uploaded-files%">%N") -- To ease css customization.
+				if attached files_api as l_files_api then
+					f := l_files_api.new_uploads_file (create {PATH}.make_from_string (fn))
+
+					body.append ("<div class=%"metadata%">")
+
+					md := l_files_api.metadata (f)
+
+						--| Uploader user
+					body.append ("<strong>User: </strong>")
+					if md /= Void and then attached md.user as meta_user then
+						body.append (api.html_encoded (meta_user.name))
+					else
+						body.append ("unknown user")
+					end
+					body.append ("<br/>%N")
+
+						--| Uploaded date
+					body.append ("<strong>Upload Time: </strong>")
+					if md /= Void and then attached md.date as meta_time then
+						body.append (meta_time.out)
+					else
+						body.append ("NA")
+					end
+					body.append ("<br/>%N")
+
+						--| File size
+					body.append ("<strong> File Size: </strong>")
+					if md /= Void and then md.size > 0 then
+						body.append (file_size_human_string (md.size))
+					else
+						body.append ("NA")
+					end
+					body.append ("<br/>%N")
+
+						--| File type
+					body.append ("<strong>File Type: </strong>")
+					if md /= Void and then attached md.file_type as meta_type then
+						body.append (meta_type)
+					else
+						body.append ("NA")
+					end
+					body.append ("<br/><br/>%N")
+
+					body.append ("<a class=%"button%" href=%"" + req.script_url ("/" + l_files_api.file_link (f).location) + "%">Download</a>%N")
+					body.append ("<a class=%"button%" href=%"" + req.script_url ("/" + uploads_location + "remove/" + f.filename) + "%">Remove</a>%N")
+					body.append ("</div>%N") -- metadata
+
+					body.append ("<div class=%"overview%">")
+					if
+						attached f.relative_path.extension as ext and then
+						(
+							ext.is_case_insensitive_equal_general ("png")
+							or ext.is_case_insensitive_equal_general ("jpg")
+							or ext.is_case_insensitive_equal_general ("gif")
+						)
+					then
+						body.append ("<img src=%"" + req.script_url ("/" + l_files_api.file_link (f).location) + "%" />")
+					else
+							-- add default thumbnail
+						body.append ("<img src=%"" + req.script_url ("/module/" + name + "/files/img/file-logo.png") + "%" />")
+					end
+					body.append ("</div>%N") -- Overview
+				end
+				body.append ("</div>%N")
+
+				r.add_to_primary_tabs (create {CMS_LOCAL_LINK}.make ("Uploaded files", uploads_location))
+				r.set_main_content (body)
+			else
+				create {BAD_REQUEST_ERROR_CMS_RESPONSE} r.make (req, res, api)
+				r.set_main_content ("Missing 'filename' field value!")
+			end
+			r.execute
+		end
+
+	execute_upload (req: WSF_REQUEST; res: WSF_RESPONSE; api: CMS_API)
+		local
+			body: STRING_8
+			r: CMS_RESPONSE
+		do
+			if req.is_get_head_request_method or req.is_post_request_method then
+				create body.make_empty
+				body.append ("<h1> Upload files </h1>%N")
+
+				create {GENERIC_VIEW_CMS_RESPONSE} r.make (req, res, api)
+
+					-- set style
+				r.add_style (r.url ("/module/" + name + "/files/css/files.css", void), void)
+
+					-- add JS for dropzone
+				r.add_javascript_url (r.url ("/module/" + name + "/files/js/dropzone.js", void))
+				r.add_style (r.url ("/module/" + name + "/files/js/dropzone.css", void), void)
+
+				if api.has_permission (upload_files_permission) then
+						-- create body
+					body.append ("<p>Please choose some file(s) to upload.</p>")
+
+						-- create form to choose files and upload them
+					body.append ("<div class=%"upload-files%">")
+					body.append ("<form action=%"" + r.url (uploads_location, Void) + "%" class=%"dropzone%">")
+					body.append ("</form>%N")
+					body.append ("<div class=%"center%"><a class=%"button%" href=%""+ r.url (uploads_location, Void) +"%">Upload Files</a></div>")
+					body.append ("</div>")
+					if req.is_post_request_method then
+						process_uploaded_files (req, api, body)
+					end
+				else
+					create {FORBIDDEN_ERROR_CMS_RESPONSE} r.make (req, res, api)
+				end
+
+					-- Build the response.
+				if r.has_permission (browse_files_permission) then
+					append_uploaded_file_album_to (req, api, body)
+				else
+					r.add_warning_message ("You are not allowed to browse files!")
+				end
+
+				r.set_main_content (body)
+			else
+				create {BAD_REQUEST_ERROR_CMS_RESPONSE} r.make (req, res, api)
+			end
+			r.execute
+		end
+
+	process_uploaded_files (req: WSF_REQUEST; api: CMS_API; a_output: STRING)
+			-- Process http request uploaded files.
+		require
+			has_permission: api.has_permission (upload_files_permission)
+		local
+			l_uploaded_file: CMS_UPLOADED_FILE
+			uf: WSF_UPLOADED_FILE
+		do
+			if attached files_api as l_files_api then
+					-- if has uploaded files, then store them
+				if req.has_uploaded_file then
+					a_output.append ("<strong>Newly uploaded file(s): </strong>%N")
+					a_output.append ("<ul class=%"uploaded-files%">")
+					across
+						req.uploaded_files as ic
+					loop
+						uf := ic.item
+						create l_uploaded_file.make_with_uploaded_file (l_files_api.uploads_directory, uf)
+						a_output.append ("<li>")
+						a_output.append (api.html_encoded (l_uploaded_file.filename))
+
+							-- create medadata file
+						l_uploaded_file.set_size (uf.size)
+						l_uploaded_file.set_type (uf.content_type)
+
+							-- store the just uploaded file
+						l_files_api.save_uploaded_file (l_uploaded_file)
+
+						if l_files_api.has_error then
+							a_output.append (" <span class=%"error%">: upload failed!</span>")
+						end
+						a_output.append ("</li>")
+					end
+					a_output.append ("</ul>%N")
+				end
+			end
+		end
+
+	append_uploaded_file_album_to (req: WSF_REQUEST; api: CMS_API; a_output: STRING)
+		local
+			d: DIRECTORY
+			f: CMS_FILE
+			p: PATH
+			rel: PATH
+			md: detachable CMS_FILE_METADATA
+		do
+			if attached files_api as l_files_api then
+				rel := l_files_api.uploads_relative_path
+				p := l_files_api.uploads_directory
+
+				a_output.append ("<div class=%"uploaded-files%">%N")
+				a_output.append ("<strong>Uploaded files:</strong>%N")
+				a_output.append ("<table>%N")
+				a_output.append ("<tr><th>Filename</th><th>Uploading Time</th><th>User</th><th>Size</th><th></th><th></th></tr>%N")
+
+				create d.make_with_path (p)
+				if d.exists then
+					across
+						d.entries as ic
+					loop
+
+						if ic.item.is_current_symbol then
+								-- Ignore
+						elseif ic.item.is_parent_symbol then
+								-- Ignore for now.
+						else
+							f := l_files_api.new_file (rel.extended_path (ic.item))
+
+								-- check if f is directory -> yes, then do not show
+							if not f.is_directory then
+								a_output.append ("<tr>")
+
+									-- add filename
+								a_output.append ("<td class=%"filename%">")
+								a_output.append ("<a href=%"" + api.percent_encoded (f.filename) + "%">")
+								a_output.append (api.html_encoded (f.filename))
+								a_output.append ("</a>")
+								a_output.append ("</td>%N")
+
+								md := l_files_api.metadata (f)
+								if md = Void then
+									a_output.append ("<td class=%"date%"></td>%N")
+									a_output.append ("<td class=%"user%"></td>%N")
+									a_output.append ("<td class=%"size%"></td>%N")
+								else
+
+										-- add uploading time
+									a_output.append ("<td class=%"date%">")
+									if attached md.date as meta_time then
+										a_output.append (meta_time.out)
+									end
+									a_output.append ("</td>%N")
+
+										-- add user
+									a_output.append ("<td class=%"user%">")
+									if attached md.user as u then
+										a_output.append (api.html_encoded (u.name))
+									end
+									a_output.append ("</td>%N")
+
+										-- add size
+									a_output.append ("<td class=%"size%">")
+									if md.size > 0 then
+										a_output.append (file_size_human_string (md.size))
+									else
+										a_output.append ("NA")
+									end
+									a_output.append ("</td>%N")
+								end
+
+									-- add download link
+								a_output.append ("<td>")
+								a_output.append ("<a class=%"button%" href=%"" + req.script_url ("/" + l_files_api.file_link (f).location) + "%" download>Download</a>%N")
+								a_output.append ("</td>%N")
+
+									-- add remove button
+								a_output.append ("<td>")
+								a_output.append ("<a class=%"button%" href=%"" + req.script_url ("/" + uploads_location + "remove/" + f.filename) + "%">Remove</a>%N")
+								a_output.append ("</td>%N")
+
+								a_output.append ("</tr>%N")
+							else
+								if f.relative_path.is_current_symbol or f.relative_path.is_parent_symbol then
+										-- Ignore "." and ".."
+								else
+
+									-- folder support not yet supported
+
+--										-- add directory identifier
+--									a_output.append ("<td>[dir]</td>%N")
+
+--									a_output.append ("<td>")
+--									a_output.append ("<a href=%"" + api.percent_encoded (f.filename) + "%">")
+--									a_output.append (api.html_encoded (f.filename))
+--									a_output.append ("</a>")
+--									a_output.append ("</td>%N")
+
+--									a_output.append ("<td></td><td></td><td></td><td></td><td></td>")
+								end
+
+							end
+						end
+					end
+				end
+				a_output.append ("</table>%N")
+				a_output.append ("</div>%N")
+			end
+		end
+
+	remove_file (req: WSF_REQUEST; res: WSF_RESPONSE; api: CMS_API)
+		local
+			body: STRING
+			r: CMS_RESPONSE
+			err: BOOLEAN
+		do
+			if attached files_api as l_files_api then
+				if not api.has_permission (admin_files_permission) then
+					create {FORBIDDEN_ERROR_CMS_RESPONSE} r.make (req, res, api)
+					r.add_error_message ("You are not allowed to remove file!")
+				elseif attached {WSF_STRING} req.path_parameter ("filename") as p_filename then
+					create {GENERIC_VIEW_CMS_RESPONSE} r.make (req, res, api)
+
+					l_files_api.delete_file (p_filename.value)
+					err := l_files_api.has_error
+					l_files_api.reset_error
+					create body.make_empty
+
+					if err then
+						body.append ("<h3>The file has been removed successfully!</h3>")
+					else
+						body.append ("<h3>The file removal failed!</h3>")
+					end
+
+					r.add_to_primary_tabs (create {CMS_LOCAL_LINK}.make ("Uploaded files", uploads_location))
+					r.set_main_content (body)
+				else
+					create {BAD_REQUEST_ERROR_CMS_RESPONSE} r.make (req, res, api)
+					r.add_error_message ("Missing 'filename' parameter!")
+				end
+			else
+				create {INTERNAL_SERVER_ERROR_CMS_RESPONSE} r.make (req, res, api)
+				r.set_main_content ("Removal of file failed due to internal server error!")
+			end
+			r.execute
+		end
+
+feature -- Helpers
+
+	file_size_human_string (a_size: INTEGER): STRING
+		local
+			size: INTEGER
+		do
+			size := a_size
+			if size >= 1000000 then
+				size := size // 1000000
+				Result := size.out + " MB"
+			else
+				if size >= 1000 then
+					size := size // 1000
+					Result := size.out + " kB"
+				else
+					Result := size.out + " bytes"
+				end
+			end
+		end
+
+feature -- Mapping helper: uri template agent (analogue to the demo-module)
+
+	map_uri_template (a_router: WSF_ROUTER; a_tpl: STRING; h: WSF_URI_TEMPLATE_HANDLER; rqst_methods: detachable WSF_REQUEST_METHODS)
+			-- Map `h' as handler for `a_tpl', according to `rqst_methods'.
+		require
+			a_tpl_attached: a_tpl /= Void
+			h_attached: h /= Void
+		do
+			a_router.map (create {WSF_URI_TEMPLATE_MAPPING}.make (a_tpl, h), rqst_methods)
+		end
+
+	map_uri_template_agent (a_router: WSF_ROUTER; a_tpl: READABLE_STRING_8; proc: PROCEDURE [TUPLE [req: WSF_REQUEST; res: WSF_RESPONSE]]; rqst_methods: detachable WSF_REQUEST_METHODS)
+			-- Map `proc' as handler for `a_tpl', according to `rqst_methods'.
+		require
+			a_tpl_attached: a_tpl /= Void
+			proc_attached: proc /= Void
+		do
+			map_uri_template (a_router, a_tpl, create {WSF_URI_TEMPLATE_AGENT_HANDLER}.make (proc), rqst_methods)
+		end
+
+end

modules/files/cms_uploaded_file.e

@@ -0,0 +1,105 @@
+note
+	description: "Summary description for {CMS_UPLOADED_FILE}."
+	date: "$Date$"
+	revision: "$Revision$"
+
+class
+	CMS_UPLOADED_FILE
+
+create
+	make_with_uploaded_file
+
+feature {NONE} -- Initializaion
+
+	make_with_uploaded_file (a_uploads_directory: PATH; uf: WSF_UPLOADED_FILE)
+		do
+			uploads_directory := a_uploads_directory
+			uploaded_file := uf
+			location := a_uploads_directory.extended (uf.safe_filename)
+		end
+
+feature -- Access
+
+	uploaded_file: WSF_UPLOADED_FILE
+
+	uploads_directory: PATH
+
+	filename: STRING_32
+			-- File name of Current file.
+		local
+			p: PATH
+		do
+			p := location
+			if attached p.entry as e then
+				Result := e.name
+			else
+				Result := p.name
+			end
+		end
+
+
+	location: PATH
+			-- Absolute path, or relative path to the `CMS_API.files_location'.
+
+	owner: detachable CMS_USER
+			-- Optional owner.
+
+	upload_time: detachable DATE_TIME
+			-- time when the file was uploaded
+
+	size: detachable INTEGER_32
+			-- file size
+
+	type: detachable STRING
+			-- file type
+
+feature -- Element change
+
+	set_owner (u: detachable CMS_USER)
+			-- Set `owner' to `u'.
+		do
+			owner := u
+		end
+
+	set_time (a_time: detachable DATE_TIME)
+			-- Set `upload_time' to `a_time'
+		do
+			upload_time := a_time
+		end
+
+	set_size (a_size: detachable INTEGER_32)
+			-- Set `size' to `a_size'
+		do
+			size := a_size
+		end
+
+	set_type (a_type: detachable STRING)
+			-- Set `type' to `a_type'
+		do
+			type := a_type
+		end
+
+	set_new_location_with_number (a_number: INTEGER_32)
+			-- sets `a_number' after the name. This is done when the file was already uploaded
+		local
+			position: INTEGER_32
+			new_name: STRING_8
+		do
+			position := uploaded_file.string_representation.index_of ('.', 1)
+			create new_name.make_empty
+
+			new_name := uploaded_file.string_representation.head (position-1)
+			new_name.append ("_(" + a_number.out + ")")
+			new_name.append (uploaded_file.string_representation.substring (position, uploaded_file.string_representation.count))
+
+			location := uploads_directory.extended (new_name)
+		end
+
+feature -- Basic operation
+
+	move_to (p: PATH): BOOLEAN
+		do
+			Result := uploaded_file.move_to (p.name)
+		end
+
+end

modules/files/files-safe.ecf

@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<system xmlns="http://www.eiffel.com/developers/xml/configuration-1-15-0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.eiffel.com/developers/xml/configuration-1-15-0 http://www.eiffel.com/developers/xml/configuration-1-15-0.xsd" name="files_module" uuid="795C88E5-9218-4F35-A985-5501340E2D9D" library_target="files_module">
+	<target name="files_module">
+		<root all_classes="true" />
+		<file_rule>
+			<exclude>/.svn$</exclude>
+			<exclude>/CVS$</exclude>
+			<exclude>/EIFGENs$</exclude>
+		</file_rule>
+		<option warning="true" full_class_checking="true" is_attached_by_default="true" void_safety="all" syntax="standard"/>
+		<library name="base" location="$ISE_LIBRARY\library\base\base-safe.ecf"/>
+		<library name="cms" location="..\..\cms-safe.ecf"/>
+		<library name="cms_model" location="..\..\library\model\cms_model-safe.ecf"/>
+		<library name="http" location="$ISE_LIBRARY\contrib\library\network\protocol\http\http-safe.ecf"/>
+		<library name="json" location="$ISE_LIBRARY\contrib\library\text\parser\json\library\json-safe.ecf"/>
+		<library name="time" location="$ISE_LIBRARY\library\time\time-safe.ecf"/>
+		<library name="wsf" location="$ISE_LIBRARY\contrib\library\web\framework\ewf\wsf\wsf-safe.ecf"/>
+		<library name="wsf_encoder" location="$ISE_LIBRARY\contrib\library\web\framework\ewf\text\encoder\encoder-safe.ecf"/>
+		<cluster name="src" location=".\" recursive="true"/>
+	</target>
+</system>

modules/files/files.ecf

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<system xmlns="http://www.eiffel.com/developers/xml/configuration-1-15-0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.eiffel.com/developers/xml/configuration-1-15-0 http://www.eiffel.com/developers/xml/configuration-1-15-0.xsd" name="files_module" uuid="795C88E5-9218-4F35-A985-5501340E2D9D" library_target="files_module">
+	<target name="files_module">
+		<root all_classes="true"/>
+		<file_rule>
+			<exclude>/.svn$</exclude>
+			<exclude>/CVS$</exclude>
+			<exclude>/EIFGENs$</exclude>
+		</file_rule>
+		<option warning="true" full_class_checking="true" void_safety="none" syntax="standard">
+		</option>
+		<library name="base" location="$ISE_LIBRARY\library\base\base.ecf"/>
+		<library name="cms" location="..\..\cms.ecf"/>
+		<library name="cms_model" location="..\..\library\model\cms_model.ecf"/>
+		<library name="http" location="$ISE_LIBRARY\contrib\library\network\protocol\http\http.ecf"/>
+		<library name="json" location="$ISE_LIBRARY\contrib\library\text\parser\json\library\json.ecf"/>
+		<library name="time" location="$ISE_LIBRARY\library\time\time.ecf"/>
+		<library name="wsf" location="$ISE_LIBRARY\contrib\library\web\framework\ewf\wsf\wsf.ecf"/>
+		<library name="wsf_encoder" location="$ISE_LIBRARY\contrib\library\web\framework\ewf\text\encoder\encoder.ecf"/>
+		<cluster name="src" location=".\" recursive="true"/>
+	</target>
+</system>

modules/files/site/files/css/files.css

@@ -0,0 +1,52 @@
+.uploaded-files table {
+  width: 100%;
+  border-collapse: collapse;
+  border: 1px solid black;
+}
+.uploaded-files table th {
+  padding: 3px 0 3px 5px;
+}
+.uploaded-files table td {
+  padding: 3px 0 3px 5px;
+}
+.uploaded-files a.button {
+  color: black;
+  text-decoration: none;
+  border: solid 1px #999;
+  background-color: #ddd;
+  padding: 2px 4px 2px 4px;
+}
+.uploaded-files a.button:hover {
+  color: black;
+  border: solid 1px #06f;
+  background-color: #cff;
+}
+
+.upload-files .center {
+  text-align: center;
+  padding: 10px;
+}
+.upload-files a.button {
+  margin: auto;
+  width: 100px;
+  color: black;
+  text-decoration: none;
+  border: solid 1px #999;
+  background-color: #ddd;
+  padding: 2px 4px 2px 4px;
+}
+.upload-files a.button:hover {
+  color: black;
+  border: solid 1px #06f;
+  background-color: #cff;
+}
+
+/******************* Drop Zone *******************/
+.dropzone {
+  width: 100%;
+  border: 2px dashed blue;
+  border-radius: 3px;
+  text-align: center;
+  padding-top: 15px;
+  padding-bottom: 15px;
+}

modules/files/site/files/js/src/basic.scss

@@ -0,0 +1,78 @@
+/*
+ * The MIT License
+ * Copyright (c) 2012 Matias Meno <m@tias.me>
+ */
+
+// Permission is hereby granted, free of charge, to any person obtaining a copy of
+// this software and associated documentation files (the "Software"), to deal in
+// the Software without restriction, including without limitation the rights to
+// use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+// of the Software, and to permit persons to whom the Software is furnished to do
+// so, subject to the following conditions:
+
+// The above copyright notice and this permission notice shall be included in all
+// copies or substantial portions of the Software.
+
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+.dropzone, .dropzone * {
+  box-sizing: border-box;
+}
+.dropzone {
+
+  position: relative;
+
+  .dz-preview {
+    position: relative;
+    display: inline-block;
+    width: 120px;
+    margin: 0.5em;
+
+    .dz-progress {
+      display: block;
+      height: 15px;
+      border: 1px solid #aaa;
+      .dz-upload {
+        display: block;
+        height: 100%;
+        width: 0;
+        background: green;
+      }
+    }
+
+    .dz-error-message {
+      color: red;
+      display: none;
+    }
+    &.dz-error {
+      .dz-error-message, .dz-error-mark {
+        display: block;
+      }
+    }
+    &.dz-success {
+      .dz-success-mark {
+        display: block;
+      }
+    }
+
+    .dz-error-mark, .dz-success-mark {
+      position: absolute;
+      display: none;
+      left: 30px;
+      top: 30px;
+      width: 54px;
+      height: 58px;
+      left: 50%;
+      margin-left: -(54px/2);
+    }
+
+
+  }
+
+}

modules/files/site/files/js/src/dropzone.scss

@@ -0,0 +1,413 @@
+/*
+ * The MIT License
+ * Copyright (c) 2012 Matias Meno <m@tias.me>
+ */
+
+// Permission is hereby granted, free of charge, to any person obtaining a copy of
+// this software and associated documentation files (the "Software"), to deal in
+// the Software without restriction, including without limitation the rights to
+// use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+// of the Software, and to permit persons to whom the Software is furnished to do
+// so, subject to the following conditions:
+
+// The above copyright notice and this permission notice shall be included in all
+// copies or substantial portions of the Software.
+
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+@mixin keyframes($name) {
+  @-webkit-keyframes #{$name} {
+    @content; 
+  }
+  @-moz-keyframes #{$name} {
+    @content;
+  }
+  @keyframes #{$name} {
+    @content;
+  } 
+}
+
+
+@mixin prefix($map, $vendors: webkit moz ms o) {
+  @each $prop, $value in $map {
+    @if $vendors {
+      @each $vendor in $vendors {
+        #{"-" + $vendor + "-" + $prop}: #{$value};
+      }
+    }
+    // Dump regular property anyway
+    #{$prop}: #{$value};
+  }
+}
+
+
+@include keyframes(passing-through) {
+  
+  0% {
+    opacity: 0;
+    @include prefix((transform: translateY(40px)));
+  }
+
+  30%, 70% {
+    opacity: 1;
+    @include prefix((transform: translateY(0px)));
+  }
+
+  100% {
+    opacity: 0;
+    @include prefix((transform: translateY(-40px)));
+  }
+}
+
+
+@include keyframes(slide-in) {
+  
+  0% {
+    opacity: 0;
+    @include prefix((transform: translateY(40px)));
+  }
+
+  30% {
+    opacity: 1;
+    @include prefix((transform: translateY(0px)));
+  }
+}
+
+
+
+@include keyframes(pulse) {
+  
+  0% { @include prefix((transform: scale(1))); }
+  10% { @include prefix((transform: scale(1.1))); }
+  20% { @include prefix((transform: scale(1))); }
+
+}
+
+
+
+.dropzone, .dropzone * {
+  box-sizing: border-box;
+}
+.dropzone {
+
+  $image-size: 120px;
+
+  $image-border-radius: 20px;
+
+  &.dz-clickable {
+    cursor: pointer;
+
+    * {
+      cursor: default;
+    }
+    .dz-message {
+      &, * {
+        cursor: pointer;
+      }
+    }
+  }
+
+  min-height: 150px;
+  border: 2px solid rgba(0, 0, 0, 0.3);
+  background: white;
+  padding: 20px 20px;
+
+  &.dz-started {
+    .dz-message {
+      display: none;
+    }
+  }
+
+  &.dz-drag-hover {
+    border-style: solid;
+    .dz-message {
+      opacity: 0.5;
+    }
+  }
+  .dz-message {
+    text-align: center;
+    margin: 2em 0;
+
+
+  }
+
+
+
+  .dz-preview {
+    position: relative;
+    display: inline-block;
+
+    vertical-align: top;
+
+    margin: 16px;
+    min-height: 100px;
+
+    &:hover {
+      // Making sure that always the hovered preview element is on top
+      z-index: 1000;
+      .dz-details {
+        opacity: 1;
+      }
+    }
+
+    &.dz-file-preview {
+
+      .dz-image {
+        border-radius: $image-border-radius;
+        background: #999;
+        background: linear-gradient(to bottom, #eee, #ddd);
+      }
+
+      .dz-details {
+        opacity: 1;
+      }
+    }
+
+    &.dz-image-preview {
+      background: white;
+      .dz-details {
+        @include prefix((transition: opacity 0.2s linear));
+      }
+    }
+
+    .dz-remove {
+      font-size: 14px;
+      text-align: center;
+      display: block;
+      cursor: pointer;
+      border: none;
+      &:hover {
+        text-decoration: underline;
+      }
+    }
+
+    &:hover .dz-details {
+      opacity: 1;
+    }
+    .dz-details {
+      $background-color: #444;
+
+      z-index: 20;
+
+      position: absolute;
+      top: 0;
+      left: 0;
+
+      opacity: 0;
+
+      font-size: 13px;
+      min-width: 100%;
+      max-width: 100%;
+      padding: 2em 1em;
+      text-align: center;
+      color: rgba(0, 0, 0, 0.9);
+
+      $width: 120px;
+
+      line-height: 150%;
+
+      .dz-size {
+        margin-bottom: 1em;
+        font-size: 16px;
+      }
+
+      .dz-filename {
+
+        white-space: nowrap;
+
+        &:hover {
+          span {
+            border: 1px solid rgba(200, 200, 200, 0.8);
+            background-color: rgba(255, 255, 255, 0.8);
+          }
+        }
+        &:not(:hover) {
+          span {
+            border: 1px solid transparent;
+          }
+          overflow: hidden;
+          text-overflow: ellipsis;
+        }
+
+      }
+
+      .dz-filename, .dz-size {
+        span {
+          background-color: rgba(255, 255, 255, 0.4);
+          padding: 0 0.4em;
+          border-radius: 3px;
+        }
+      }
+
+    }
+
+    &:hover {
+      .dz-image {
+        // opacity: 0.8;
+        img {
+          @include prefix((transform: scale(1.05, 1.05))); // Getting rid of that white bleed-in
+          @include prefix((filter: blur(8px)), webkit); // Getting rid of that white bleed-in
+        }
+      }
+    }
+    .dz-image {
+      border-radius: $image-border-radius;
+      overflow: hidden;
+      width: $image-size;
+      height: $image-size;
+      position: relative;
+      display: block;
+      z-index: 10;
+
+      img {
+        display: block;
+      }
+    }
+
+
+    &.dz-success {
+      .dz-success-mark {
+        @include prefix((animation: passing-through 3s cubic-bezier(0.770, 0.000, 0.175, 1.000)));
+      }
+    }
+    &.dz-error {
+      .dz-error-mark {
+        opacity: 1;
+        @include prefix((animation: slide-in 3s cubic-bezier(0.770, 0.000, 0.175, 1.000)));
+      }
+    }
+
+
+    .dz-success-mark, .dz-error-mark {
+
+      $image-height: 54px;
+      $image-width: 54px;
+
+      pointer-events: none;
+
+      opacity: 0;
+      z-index: 500;
+
+      position: absolute;
+      display: block;
+      top: 50%;
+      left: 50%;
+      margin-left: -($image-width/2);
+      margin-top: -($image-height/2);
+
+      svg {
+        display: block;
+        width: $image-width;
+        height: $image-height;
+      }
+    }
+    
+      
+    &.dz-processing .dz-progress {
+      opacity: 1;
+      @include prefix((transition: all 0.2s linear));
+    }
+    &.dz-complete .dz-progress {
+      opacity: 0;
+      @include prefix((transition: opacity 0.4s ease-in));
+    }
+
+    &:not(.dz-processing) {
+      .dz-progress {
+        @include prefix((animation: pulse 6s ease infinite));
+      }
+    }
+    .dz-progress {
+
+      opacity: 1;
+      z-index: 1000;
+
+      pointer-events: none;
+      position: absolute;
+      height: 16px;
+      left: 50%;
+      top: 50%;
+      margin-top: -8px;
+
+      width: 80px;
+      margin-left: -40px;
+
+      // border: 2px solid #333;
+      background: rgba(255, 255, 255, 0.9);
+
+      // Fix for chrome bug: https://code.google.com/p/chromium/issues/detail?id=157218
+      -webkit-transform: scale(1);
+
+
+      border-radius: 8px;
+
+      overflow: hidden;
+
+      .dz-upload {
+        background: #333;
+        background: linear-gradient(to bottom, #666, #444);
+        position: absolute;
+        top: 0;
+        left: 0;
+        bottom: 0;
+        width: 0;
+        @include prefix((transition: width 300ms ease-in-out));
+      }
+
+    }
+
+    &.dz-error {
+      .dz-error-message {
+        display: block;
+      }
+      &:hover .dz-error-message {
+        opacity: 1;
+        pointer-events: auto;
+      }
+    }
+
+    .dz-error-message {
+      $width: $image-size + 20px;
+      $color: rgb(190, 38, 38);
+
+      pointer-events: none;
+      z-index: 1000;
+      position: absolute;
+      display: block;
+      display: none;
+      opacity: 0;
+      @include prefix((transition: opacity 0.3s ease));
+      border-radius: 8px;
+      font-size: 13px;
+      top: $image-size + 10px;
+      left: -10px;
+      width: $width;
+      background: $color;
+      background: linear-gradient(to bottom, $color, darken($color, 5%));
+      padding: 0.5em 1.2em;
+      color: white;
+
+      // The triangle pointing up
+      &:after {
+        content: '';
+        position: absolute;
+        top: -6px;
+        left: $width / 2 - 6px;
+        width: 0; 
+        height: 0; 
+        border-left: 6px solid transparent;
+        border-right: 6px solid transparent;
+        border-bottom: 6px solid $color;
+      }
+    }
+
+  }
+}
+
+

modules/files/site/files/scss/files.scss

@@ -0,0 +1,63 @@
+.uploaded-files {
+	table {
+		width: 100%;
+		border-collapse: collapse;
+		border: 1px solid black;
+
+		th {
+			padding: 3px 0 3px 5px;
+		}
+
+		td {
+			padding: 3px 0 3px 5px;
+		}
+	}
+
+	a.button{
+		color: black;
+		text-decoration: none;
+		border: solid 1px #999;
+		background-color: #ddd;
+		padding: 2px 4px 2px 4px;
+		&:hover {
+			color: black;
+			border: solid 1px #06f;
+			background-color: #cff;
+		}
+	}
+}
+
+.upload-files {
+	.center {
+		text-align: center;
+		padding: 10px;
+	}
+	a.button{
+		margin: auto;
+		width: 100px;
+
+		color: black;
+		text-decoration: none;
+		border: solid 1px #999;
+		background-color: #ddd;
+		padding: 2px 4px 2px 4px;
+		&:hover {
+			color: black;
+			border: solid 1px #06f;
+			background-color: #cff;
+		}
+	}
+}
+
+
+/******************* Drop Zone *******************/
+
+.dropzone {
+	width: 100%;
+	border: 2px dashed blue;
+	border-radius: 3px;
+	text-align: center;
+	padding-top: 15px;
+	padding-bottom: 15px;
+}
+

package.iron

@@ -1,14 +1,8 @@
-package ROC
+package roc
 
 project
 	cms = "cms-safe.ecf"
 	cms = "cms.ecf"
-	app_env = "library/app_env/app_env-safe.ecf"
-	app_env = "library/app_env/app_env.ecf"
-	config = "library/configuration/config-safe.ecf"
-	config = "library/configuration/config.ecf"
-	app_env = "library/layout/layout-safe.ecf"
-	app_env = "library/layout/layout.ecf"
 	cms_model = "library/model/cms_model-safe.ecf"
 	cms_model = "library/model/cms_model.ecf"
 	persistence_mysql = "library/persistence/mysql/persistence_mysql-safe.ecf"
@@ -20,13 +14,8 @@ project
 	node = "modules/node/node-safe.ecf"
 	node = "modules/node/node.ecf"
 	demo = "examples/demo/demo-safe.ecf"
-	cms_demo_module = "examples/demo/modules/demo/cms_demo_module-safe.ecf"
-	config_tests = "library/configuration/tests/config_tests-safe.ecf"
-	email_service = "library/email/email-safe.ecf"
-	persistence_sqlite3 = "library/persistence/sqlite3/persistence_sqlite3-safe.ecf"
 	store_mysql = "library/persistence/store_mysql/store_mysql-safe.ecf"
 	persistence_store_odbc = "library/persistence/store_odbc/store_odbc-safe.ecf"
-	tests_store_odbc = "library/persistence/store_odbc/tests/tests-safe.ecf"
 	admin = "modules/admin/admin-safe.ecf"
 	auth_module = "modules/auth/auth-safe.ecf"
 	cms_blog_module = "modules/blog/cms_blog_module-safe.ecf"
@@ -34,14 +23,39 @@ project
 	oauth_module = "modules/oauth20/oauth20-safe.ecf"
 	openid_module = "modules/openid/openid-safe.ecf"
 	recent_changes = "modules/recent_changes/recent_changes-safe.ecf"
+	gcse = "library/gcse/gcse-safe.ecf"
+	gcse = "library/gcse/gcse.ecf"
+	persistence_sqlite3 = "library/persistence/sqlite3/sqlite3-safe.ecf"
+	recaptcha = "library/recaptcha/recaptcha-safe.ecf"
+	recaptcha = "library/recaptcha/recaptcha.ecf"
+	contact = "modules/contact/contact-safe.ecf"
+	google_search = "modules/google_search/google_search-safe.ecf"
+	google_search = "modules/google_search/google_search.ecf"
+	recent_changes = "modules/recent_changes/recent_changes.ecf"
+	seo = "modules/seo/seo-safe.ecf"
+	session_auth = "modules/session_auth/cms_session_auth-safe.ecf"
+	cms_taxonomy_module = "modules/taxonomy/taxonomy-safe.ecf"
+	cms_taxonomy_module = "modules/taxonomy/taxonomy.ecf"
 
 note
 	title: ROC CMS
-	description: CMS written with Eiffel
-	tags: cms, web, rest, api
-	license: Eiffel Forum v2
-	copyright: Jocelyn Fiat, Javier Velilla, Eiffel Software
+	description: "[
+			Eiffel ROC CMS library is build with [EWF](http://eiffelwebframework.github.io/EWF/) and inspired by [Drupal](https://www.drupal.org/).
+
+			The goal of the library is to provide the following features.
+				- content type
+				- user management
+				- node management
+				- module design
+				- theme
+				- API
+				- ...
+		]"
+	tags: cms,user, web, rest, api,node,module,theme,authentication
+	copyright: 2011-2016, Jocelyn Fiat, Javier Velilla, Eiffel Software and others
+	license: "Eiffel Forum License v2 (see https://www.eiffel.com/licensing/forum.txt)"
+	link[license]: https://www.eiffel.com/licensing/forum.txt
 	link[source]: "Github" https://github.com/EiffelWebFramework/ROC.git
---	link[doc]: "Documentation" http:// 
+	link[doc]: "Documentation" https://github.com/EiffelWebFramework/ROC/blob/master/doc/readme.md
 
 end

src/kernel/form/cms_editor.e

@@ -9,31 +9,31 @@ deferred class
 
 feature -- Initialisation
 
-	load_assets : STRING
-			-- Loads all assest needed to show the editor
+	load_assets: STRING
+			-- Loads all assest needed to show the editor.
 		deferred
 		end
 
 feature -- Javascript
 
-	javascript_replace_textarea (a_textarea : WSF_FORM_TEXTAREA): STRING
-			-- Javascript code that replaces a textarea with the editor. The editor instance should be saved in editor_variable
+	javascript_replace_textarea (a_textarea: WSF_FORM_TEXTAREA): STRING
+			-- Javascript code that replaces a textarea with the editor. The editor instance should be saved in editor_variable.
 		deferred
 		end
 
-	javascript_restore_textarea (a_textarea : WSF_FORM_TEXTAREA): STRING
+	javascript_restore_textarea (a_textarea: WSF_FORM_TEXTAREA): STRING
 			-- Javascript code that restores a textarea
 		deferred
 		end
 
-	javascript_textarea_to_editor (a_textarea : WSF_FORM_TEXTAREA): STRING
-			-- Javascript code to display the textarea as a WYSIWIG editor as soon as the document is loaded
+	javascript_textarea_to_editor (a_textarea: WSF_FORM_TEXTAREA): STRING
+			-- Javascript code to display the textarea as a WYSIWIG editor as soon as the document is loaded.
 		do
 			Result := javascript_ready (javascript_replace_textarea (a_textarea))
 		end
 
-	javascript_textarea_to_editor_if_selected (a_textarea: WSF_FORM_TEXTAREA; a_select_field : WSF_FORM_SELECT; a_value : STRING) : STRING
-			-- Javascript code to display the textarea as a WYSIWIG editor if a_select_field has a_value
+	javascript_textarea_to_editor_if_selected (a_textarea: WSF_FORM_TEXTAREA; a_select_field: WSF_FORM_SELECT; a_value: STRING): STRING
+			-- Javascript code to display the textarea as a WYSIWIG editor if a_select_field has a_value,
 		local
 			initial_replace_code, on_select_replace_code: STRING
 		do
@@ -55,39 +55,41 @@ feature -- Javascript
 			Result := initial_replace_code + " " + on_select_replace_code
 		end
 
-	javascript_init_editor_variable (a_textarea : WSF_FORM_TEXTAREA) : STRING
-			-- Returns the javascript code that initializes a local variable to store the editor instance
+	javascript_init_editor_variable (a_textarea: WSF_FORM_TEXTAREA): STRING
+			-- Returns the javascript code that initializes a local variable to store the editor instance.
 		do
 			Result := "var " + editor_variable (a_textarea) + "; "
 		end
 
-	javascript_if_selected (a_select_field : WSF_FORM_SELECT; a_value : STRING; a_code : STRING) : STRING
-			-- Javascript that executes a_code if a_value is selected at a_select_field
+	javascript_if_selected (a_select_field: WSF_FORM_SELECT; a_value: STRING; a_code: STRING): STRING
+			-- Javascript that executes a_code if a_value is selected at a_select_field.
 		do
 			Result := "if($('#" + field_id (a_select_field) + "').val() == %"" + a_value + "%"){ " + a_code + " }"
 		end
 
-	javascript_ready (a_code : STRING) : STRING
-			-- Wraps the given javascript code with a ready statement, such that it's executed when the document has loaded
+	javascript_ready (a_code: STRING): STRING
+			-- Wraps the given javascript code with a ready statement,
+			-- such that it's executed when the document has loaded.
 		do
 			Result := "$(function() { " + a_code + " });"
 		end
 
-	javascript_on_select (a_select_field : WSF_FORM_SELECT; a_value : STRING; a_then : STRING; a_else : STRING) : STRING
-			-- Javascript code that executes a_then if at the given select_field the given string value is selected, otherwise it executes a_else
+	javascript_on_select (a_select_field: WSF_FORM_SELECT; a_value: STRING; a_then: STRING; a_else: STRING): STRING
+			-- Javascript code that executes `a_then' if at the given `a_select_field'
+			-- the given string `a_value' is selected, otherwise it executes `a_else'.
 		do
-			Result := "$('#" + field_id (a_select_field) + "').change(function(){" +
-					javascript_if_selected (a_select_field, a_value, a_then) +
-				"else{" +
-					a_else +
-				"}" +
-			"});"
+			Result := "$('#" + field_id (a_select_field) + "').change(function(){"
+				+		javascript_if_selected (a_select_field, a_value, a_then)
+				+ 	"else{"
+				+		a_else
+				+ 	"}"
+				+ "});"
 		end
 
 feature -- Helper
 
-	field_id(a_select_field : WSF_FORM_SELECT) : STRING
-			-- Returns the id of the given field
+	field_id (a_select_field: WSF_FORM_SELECT): STRING
+			-- Id of the given field.
 		do
 			if attached a_select_field.css_id as a_id then
 				Result := a_id
@@ -96,13 +98,13 @@ feature -- Helper
 			end
 		end
 
-	editor_variable (a_textarea : WSF_FORM_TEXTAREA) : STRING
+	editor_variable (a_textarea: WSF_FORM_TEXTAREA): STRING
 			-- Returns the variable name that stores the editor instance of the given textarea
 		do
 			Result := "cms_ckeditor_" + a_textarea.name
 		end
 
 note
-	copyright: "2011-2015, Jocelyn Fiat, Javier Velilla, Eiffel Software and others"
+	copyright: "2011-2016, Jocelyn Fiat, Javier Velilla, Eiffel Software and others"
 	license: "Eiffel Forum License v2 (see http://www.eiffel.com/licensing/forum.txt)"
 end

src/kernel/form/cms_editor_ckeditor.e

@@ -12,7 +12,7 @@ inherit
 
 feature -- Initialisation
 
-	load_assets : STRING
+	load_assets: STRING
 			-- <Precursor>
 		do
 			Result := "<script src=%"//cdn.ckeditor.com/4.4.7/standard/ckeditor.js%"></script>"
@@ -20,23 +20,25 @@ feature -- Initialisation
 
 feature -- Javascript
 
-	javascript_replace_textarea (a_textarea : WSF_FORM_TEXTAREA) : STRING
+	javascript_replace_textarea (a_textarea: WSF_FORM_TEXTAREA): STRING
 			-- <Precursor>
 		do
-				-- Replaces the textarea with an editor instance. Save the instance in a variable
+				-- Replaces the textarea with an editor instance.
+				-- Save the instance in a variable.
 			Result := "$(%"textarea[name="+ a_textarea.name +"]%").each(function() {"
 			Result.append (editor_variable (a_textarea) + " = CKEDITOR.replace(this);")
 			Result.append ("});")
 		end
 
-	javascript_restore_textarea (a_textarea : WSF_FORM_TEXTAREA) : STRING
+	javascript_restore_textarea (a_textarea: WSF_FORM_TEXTAREA): STRING
 			-- <Precursor>
 		do
-				-- Replaces the textarea with an editor instance. Save the instance in a variable
+				-- Replaces the textarea with an editor instance.
+				-- Save the instance in a variable.
 			Result := "if (" + editor_variable (a_textarea) + " != undefined) " + editor_variable (a_textarea) + ".destroy();"
 		end
 
 note
-	copyright: "2011-2015, Jocelyn Fiat, Javier Velilla, Eiffel Software and others"
+	copyright: "2011-2016, Jocelyn Fiat, Javier Velilla, Eiffel Software and others"
 	license: "Eiffel Forum License v2 (see http://www.eiffel.com/licensing/forum.txt)"
 end

src/service/response/cms_response.e

@@ -282,7 +282,9 @@ feature -- Head customization
 		local
 			s: STRING_8
 		do
-			s := "<link rel=%"stylesheet%" href=%""+ a_href + "%" type=%"text/css%""
+			create s.make_from_string ("<link rel=%"stylesheet%" href=%"")
+			s.append (a_href)
+			s.append ("%" type=%"text/css%"")
 			if a_media /= Void then
 				s.append (" media=%""+ a_media + "%"")
 			end
@@ -290,11 +292,24 @@ feature -- Head customization
 			add_additional_head_line (s, False)
 		end
 
+	add_style_content (a_style_content: STRING)
+			-- Add style content `a_style_content' in the head, using <style> tag.
+		local
+			s: STRING_8
+		do
+			create s.make_from_string ("<style>%N")
+			s.append (a_style_content)
+			s.append ("%N</style>")
+			add_additional_head_line (s, True)
+		end
+
 	add_javascript_url (a_src: STRING)
 		local
 			s: STRING_8
 		do
-			s := "<script type=%"text/javascript%" src=%"" + a_src + "%"></script>"
+			create s.make_from_string ("<script type=%"text/javascript%" src=%"")
+			s.append (a_src)
+			s.append ("%"></script>")
 			add_additional_head_line (s, False)
 		end
 
@@ -302,7 +317,9 @@ feature -- Head customization
 		local
 			s: STRING_8
 		do
-			s := "<script type=%"text/javascript%">%N" + a_script + "%N</script>"
+			create s.make_from_string ("<script type=%"text/javascript%">%N")
+			s.append (a_script)
+			s.append ("%N</script>")
 			add_additional_head_line (s, True)
 		end
 

src/theme/cms_html_page.e

@@ -144,12 +144,17 @@ feature -- Element change
 			title := s
 		end
 
+	add_additional_head_line (s: READABLE_STRING_8)
+		do
+			head_lines.extend (s)
+		end
+
 	add_meta_name_content (a_name: STRING; a_content: STRING)
 		local
 			s: STRING_8
 		do
 			s := "<meta name=%"" + a_name + "%" content=%"" + a_content + "%" />"
-			head_lines.extend (s)
+			add_additional_head_line (s)
 		end
 
 	add_meta_http_equiv (a_http_equiv: STRING; a_content: STRING)
@@ -157,39 +162,56 @@ feature -- Element change
 			s: STRING_8
 		do
 			s := "<meta http-equiv=%"" + a_http_equiv + "%" content=%"" + a_content + "%" />"
-			head_lines.extend (s)
+			add_additional_head_line (s)
 		end
 
 	add_style (a_href: STRING; a_media: detachable STRING)
 		local
 			s: STRING_8
 		do
-			s := "<link rel=%"stylesheet%" href=%""+ a_href + "%" type=%"text/css%""
+			create s.make_from_string ("<link rel=%"stylesheet%" href=%"")
+			s.append (a_href)
+			s.append ("%" type=%"text/css%"")
 			if a_media /= Void then
 				s.append (" media=%""+ a_media + "%"")
 			end
 			s.append ("/>")
-			head_lines.extend (s)
+			add_additional_head_line (s)
+		end
+
+	add_style_content (a_style_content: STRING)
+			-- Add style content `a_style_content' in the head, using <style> tag.
+		local
+			s: STRING_8
+		do
+			create s.make_from_string ("<style>%N")
+			s.append (a_style_content)
+			s.append ("%N</style>")
+			add_additional_head_line (s)
 		end
 
 	add_javascript_url (a_src: STRING)
 		local
 			s: STRING_8
 		do
-			s := "<script type=%"text/javascript%" src=%"" + a_src + "%"></script>"
-			head_lines.extend (s)
+			create s.make_from_string ("<script type=%"text/javascript%" src=%"")
+			s.append (a_src)
+			s.append ("%"></script>")
+			add_additional_head_line (s)
 		end
 
 	add_javascript_content (a_script: STRING)
 		local
 			s: STRING_8
 		do
-			s := "<script type=%"text/javascript%">%N" + a_script + "%N</script>"
-			head_lines.extend (s)
+			create s.make_from_string ("<script type=%"text/javascript%">%N")
+			s.append (a_script)
+			s.append ("%N</script>")
+			add_additional_head_line (s)
 		end
 
 note
-	copyright: "2011-2014, Jocelyn Fiat, Eiffel Software and others"
+	copyright: "2011-2016, Jocelyn Fiat, Javier Velilla, Eiffel Software and others"
 	license: "Eiffel Forum License v2 (see http://www.eiffel.com/licensing/forum.txt)"
 	source: "[
 			Eiffel Software

tools/roc.bat

@@ -30,7 +30,7 @@ set ROC_TOOL_PATH=%~dp0
 goto START
 
 :START
-echo Calling %ROC_TOOL_PATH%roc.exe %*
+rem echo Calling %ROC_TOOL_PATH%roc.exe %*
 call %ROC_TOOL_PATH%roc.exe %*
 goto END