Merge branch 'master' of github.com:gallery/gallery3

27 files changed, 130 insertions, 68 deletions

diff --git a/lib/gallery.dialog.js b/lib/gallery.dialog.js
index 6ec8c634..1d0eae7e 100644
--- a/lib/gallery.dialog.js
+++ b/lib/gallery.dialog.js
@@ -1,3 +1,4 @@
+
 (function($) {
    $.widget("ui.gallery_dialog",  {
      _init: function() {
@@ -26,8 +27,9 @@
 
        $("#g-dialog").gallery_show_loading();
 
-       $.get(sHref, function(data) {
-         $("#g-dialog").html(data).gallery_show_loading();
+       var url = sHref + (sHref.indexOf("?") == -1 ? "?" : "&") + "g-in-dialog";
+       $.getJSON(url, function(data) {
+         $("#g-dialog").html(unescape(data.form)).gallery_show_loading();
 
          if ($("#g-dialog form").length) {
            self.form_loaded(null, $("#g-dialog form"));
@@ -35,15 +37,7 @@
          self._layout();
 
          $("#g-dialog").dialog("open");
-         // Remove titlebar for progress dialogs or set title
-         if ($("#g-dialog #g-progress").length) {
-           $(".ui-dialog-titlebar").remove();
-         } else if ($("#g-dialog h1").length) {
-           $("#g-dialog").dialog('option', 'title', $("#g-dialog h1:eq(0)").html());
-	   $("#g-dialog h1:eq(0)").hide();
-         } else if ($("#g-dialog fieldset legend").length) {
-           $("#g-dialog").dialog('option', 'title', $("#g-dialog fieldset legend:eq(0)").html());
-         }
+         self._set_title();
 
          if ($("#g-dialog form").length) {
            self._ajaxify_dialog();
@@ -117,8 +111,10 @@
            if (data.form) {
              var formData = unescape(data.form);
              $("#g-dialog form").replaceWith(formData);
+             $("#g-dialog").dialog("option", "position", "center");
              $("#g-dialog form :submit").removeClass("ui-state-disabled")
                .attr("disabled", null);
+             self._set_title();
              self._ajaxify_dialog();
              self.form_loaded(null, $("#g-dialog form"));
              if (typeof data.reset == 'function') {
@@ -136,6 +132,18 @@
        });
      },
 
+     _set_title: function() {
+       // Remove titlebar for progress dialogs or set title
+       if ($("#g-dialog #g-progress").length) {
+         $(".ui-dialog-titlebar").remove();
+       } else if ($("#g-dialog h1").length) {
+         $("#g-dialog").dialog('option', 'title', $("#g-dialog h1:eq(0)").html());
+         $("#g-dialog h1:eq(0)").hide();
+       } else if ($("#g-dialog fieldset legend").length) {
+         $("#g-dialog").dialog('option', 'title', $("#g-dialog fieldset legend:eq(0)").html());
+       }
+     },
+
      form_closing: function(event, ui) {},
      dialog_closing: function(event, ui) {}
    });
diff --git a/modules/exif/controllers/exif.php b/modules/exif/controllers/exif.php
index 2fe875e3..fe5b2ff4 100644
--- a/modules/exif/controllers/exif.php
+++ b/modules/exif/controllers/exif.php
@@ -28,6 +28,6 @@ class Exif_Controller extends Controller {
     $view = new View("exif_dialog.html");
     $view->details = exif::get($item);
 
-    print $view;
+    print json_encode(array("form" => (string) $view));
   }
 }
diff --git a/modules/gallery/config/routes.php b/modules/gallery/config/routes.php
index 55d3cf6c..aa5d152b 100644
--- a/modules/gallery/config/routes.php
+++ b/modules/gallery/config/routes.php
@@ -23,10 +23,10 @@ $config["^admin_.*"] = null;
 
 // Redirect /form/add/admin/controller and /form/edit/admin/controller to
 // admin/controller/form_(add|edit)/parms. provides the same as below for admin pages
-$config["^form/(edit|add)/admin/(\w+)/(.*)$"] = "admin/$2/form_$1/$3";
+$config["^form/(edit|add)/admin/(\w+)(.*)$"] = "admin/$2/form_$1/$3";
 
 // Redirect /form/add and /form/edit to the module/form_(add|edit)/parms.
-$config["^form/(edit|add)/(\w+)/(.*)$"] = "$2/form_$1/$3";
+$config["^form/(edit|add)/(\w+)(.*)$"] = "$2/form_$1/$3";
 
 // Default page is the root album
 $config["_default"] = "albums";
diff --git a/modules/gallery/controllers/admin.php b/modules/gallery/controllers/admin.php
index 40dd260b..7d2a0c43 100644
--- a/modules/gallery/controllers/admin.php
+++ b/modules/gallery/controllers/admin.php
@@ -82,10 +82,14 @@ class Admin_Controller extends Controller {
   }
 
   private static function _prompt_for_reauth($controller_name, $args) {
-    if (request::method() == "get" && !request::is_ajax()) {
+    if (request::method() == "get") {
       // Avoid anti-phishing protection by passing the url as session variable.
-      Session::instance()->set("continue_url", url::abs_current(true));
+      $reauthenticate = array("continue_url" => url::abs_current(true),
+                              "in_dialog" => strpos(Router::$query_string, "g-in-dialog") !== false,
+                              "controller" => $controller_name, "args" => $args);
+      Session::instance()->set("reauthenticate", $reauthenticate);
     }
+
     url::redirect("reauthenticate");
   }
 }
diff --git a/modules/gallery/controllers/admin_advanced_settings.php b/modules/gallery/controllers/admin_advanced_settings.php
index 6f4e9403..2bbbdf50 100644
--- a/modules/gallery/controllers/admin_advanced_settings.php
+++ b/modules/gallery/controllers/admin_advanced_settings.php
@@ -39,7 +39,7 @@ class Admin_Advanced_Settings_Controller extends Admin_Controller {
     $group->input("var_name")->label(t("Setting"))->value($var_name)->disabled(1);
     $group->textarea("value")->label(t("Value"))->value($value);
     $group->submit("")->value(t("Save"));
-    print $form;
+    print json_encode(array("form" => (string) $form));
   }
 
   public function save($module_name, $var_name) {
diff --git a/modules/gallery/controllers/admin_maintenance.php b/modules/gallery/controllers/admin_maintenance.php
index d6a2d191..489f5d54 100644
--- a/modules/gallery/controllers/admin_maintenance.php
+++ b/modules/gallery/controllers/admin_maintenance.php
@@ -64,7 +64,7 @@ class Admin_Maintenance_Controller extends Admin_Controller {
     log::info("tasks", t("Task %task_name started (task id %task_id)",
                          array("task_name" => $task->name, "task_id" => $task->id)),
               html::anchor("admin/maintenance", t("maintenance")));
-    print $view;
+    print json_encode(array("form" => (string) $view));
   }
 
   /**
@@ -86,7 +86,7 @@ class Admin_Maintenance_Controller extends Admin_Controller {
     log::info("tasks", t("Task %task_name resumed (task id %task_id)",
                          array("task_name" => $task->name, "task_id" => $task->id)),
               html::anchor("admin/maintenance", t("maintenance")));
-    print $view;
+    print json_encode(array("form" => (string) $view));
   }
 
   /**
@@ -103,7 +103,7 @@ class Admin_Maintenance_Controller extends Admin_Controller {
     $view = new View("admin_maintenance_show_log.html");
     $view->task = $task;
 
-    print $view;
+    print json_encode(array("form" => (string) $view));
   }
 
   /**
diff --git a/modules/gallery/controllers/admin_themes.php b/modules/gallery/controllers/admin_themes.php
index e59eadaf..b1bd438f 100644
--- a/modules/gallery/controllers/admin_themes.php
+++ b/modules/gallery/controllers/admin_themes.php
@@ -52,7 +52,7 @@ class Admin_Themes_Controller extends Admin_Controller {
     } else {
       $view->url = item::root()->url("theme=$theme_name");
     }
-    print $view;
+    print json_encode(array("form" => (string) $view));
   }
 
   public function choose($type, $theme_name) {
diff --git a/modules/gallery/controllers/albums.php b/modules/gallery/controllers/albums.php
index eaa09be5..8aed1341 100644
--- a/modules/gallery/controllers/albums.php
+++ b/modules/gallery/controllers/albums.php
@@ -168,7 +168,7 @@ class Albums_Controller extends Items_Controller {
     access::required("view", $album);
     access::required("add", $album);
 
-    print album::get_add_form($album);
+    print json_encode(array("form" => (string) album::get_add_form($album)));
   }
 
   public function form_edit($album_id) {
@@ -176,6 +176,6 @@ class Albums_Controller extends Items_Controller {
     access::required("view", $album);
     access::required("edit", $album);
 
-    print album::get_edit_form($album);
+    print json_encode(array("form" => (string) album::get_edit_form($album)));
   }
 }
diff --git a/modules/gallery/controllers/flash_uploader.php b/modules/gallery/controllers/flash_uploader.php
index bc8b964f..6bfdd851 100644
--- a/modules/gallery/controllers/flash_uploader.php
+++ b/modules/gallery/controllers/flash_uploader.php
@@ -26,7 +26,8 @@ class Flash_Uploader_Controller extends Controller {
       $item = $item->parent();
     }
 
-    print $this->_get_add_form($item);
+    print json_encode(array("form" => (string)$this->_get_add_form($item)));
+    //print $this->_get_add_form($item);
   }
 
   public function start() {
diff --git a/modules/gallery/controllers/login.php b/modules/gallery/controllers/login.php
index 2b60316b..b823504b 100644
--- a/modules/gallery/controllers/login.php
+++ b/modules/gallery/controllers/login.php
@@ -22,7 +22,7 @@ class Login_Controller extends Controller {
   public function ajax() {
     $view = new View("login_ajax.html");
     $view->form = auth::get_login_form("login/auth_ajax");
-    print $view;
+    print json_encode(array("form" => (string) $view));
   }
 
   public function auth_ajax() {
diff --git a/modules/gallery/controllers/move.php b/modules/gallery/controllers/move.php
index f8b85b6f..a99ef341 100644
--- a/modules/gallery/controllers/move.php
+++ b/modules/gallery/controllers/move.php
@@ -26,7 +26,7 @@ class Move_Controller extends Controller {
     $view = new View("move_browse.html");
     $view->source = $source;
     $view->tree = $this->_get_tree_html($source, ORM::factory("item", 1));
-    print $view;
+    print json_encode(array("form" => (string) $view));
   }
 
   public function save($source_id) {
diff --git a/modules/gallery/controllers/movies.php b/modules/gallery/controllers/movies.php
index 16d22d90..c18dbcde 100644
--- a/modules/gallery/controllers/movies.php
+++ b/modules/gallery/controllers/movies.php
@@ -102,6 +102,6 @@ class Movies_Controller extends Items_Controller {
     access::required("view", $movie);
     access::required("edit", $movie);
 
-    print movie::get_edit_form($movie);
+    print json_encode(array("form" => (string) movie::get_edit_form($movie)));
   }
 }
diff --git a/modules/gallery/controllers/permissions.php b/modules/gallery/controllers/permissions.php
index fc06cb44..8fdda7b2 100644
--- a/modules/gallery/controllers/permissions.php
+++ b/modules/gallery/controllers/permissions.php
@@ -33,7 +33,7 @@ class Permissions_Controller extends Controller {
     $view->parents = $item->parents();
     $view->form = $this->_get_form($item);
 
-    print $view;
+    print json_encode(array("form" => (string) $view));
   }
 
   function form($id) {
diff --git a/modules/gallery/controllers/photos.php b/modules/gallery/controllers/photos.php
index f336d07c..9f17cebb 100644
--- a/modules/gallery/controllers/photos.php
+++ b/modules/gallery/controllers/photos.php
@@ -24,9 +24,9 @@ class Photos_Controller extends Items_Controller {
       // sure that we're actually receiving an object
       throw new Kohana_404_Exception();
     }
-  
+
     access::required("view", $photo);
-  
+
     $where = array(array("type", "!=", "album"));
     $position = $photo->parent()->get_position($photo, $where);
     if ($position > 1) {
@@ -102,6 +102,6 @@ class Photos_Controller extends Items_Controller {
     access::required("view", $photo);
     access::required("edit", $photo);
 
-    print photo::get_edit_form($photo);
+    print json_encode(array("form" => (string) photo::get_edit_form($photo)));
   }
 }
diff --git a/modules/gallery/controllers/quick.php b/modules/gallery/controllers/quick.php
index dc0c380a..253a279b 100644
--- a/modules/gallery/controllers/quick.php
+++ b/modules/gallery/controllers/quick.php
@@ -91,17 +91,10 @@ class Quick_Controller extends Controller {
     access::required("view", $item);
     access::required("edit", $item);
 
-    if ($item->is_album()) {
-      print t(
-        "Delete the album <b>%title</b>? All photos and movies in the album will also be deleted.",
-        array("title" => html::purify($item->title)));
-    } else {
-      print t("Are you sure you want to delete <b>%title</b>?",
-              array("title" => html::purify($item->title)));
-    }
-
-    $form = item::get_delete_form($item);
-    print $form;
+    $v = new View("quick_delete_confirm.html");
+    $v->item = $item;
+    $v->form = item::get_delete_form($item);
+    print json_encode(array("form" => (string) $v));
   }
 
   public function delete($id) {
@@ -161,6 +154,6 @@ class Quick_Controller extends Controller {
     // Pass on the source item where this form was generated, so we have an idea where to return to.
     $form->hidden("from_id")->value((int)Input::instance()->get("from_id", 0));
 
-    print $form;
+    print json_encode(array("form" => (string) $form));
   }
 }
diff --git a/modules/gallery/controllers/reauthenticate.php b/modules/gallery/controllers/reauthenticate.php
index acb27f6a..d35259e5 100644
--- a/modules/gallery/controllers/reauthenticate.php
+++ b/modules/gallery/controllers/reauthenticate.php
@@ -22,7 +22,12 @@ class Reauthenticate_Controller extends Controller {
     if (!identity::active_user()->admin) {
       access::forbidden();
     }
-    return self::_show_form(self::_form());
+    $reauthenticate = Session::instance()->get("reauthenticate", array());
+    if (empty($reauthenticate["in_dialog"])) {
+      self::_show_form(self::_form());
+    } else {
+      print json_encode(array("form" => (string) self::_form()));
+    }
   }
 
   public function auth() {
@@ -31,18 +36,29 @@ class Reauthenticate_Controller extends Controller {
     }
     access::verify_csrf();
 
+    $reauthenticate = Session::instance()->get("reauthenticate", array());
+
     $form = self::_form();
     $valid = $form->validate();
     $user = identity::active_user();
     if ($valid) {
-      message::success(t("Successfully re-authenticated!"));
       module::event("user_auth", $user);
-      url::redirect($form->continue_url->value);
+      Session::instance()->delete("reauthenticate");
+      if (empty($reauthenticate["in_dialog"])) {
+        message::success(t("Successfully re-authenticated!"));
+        url::redirect($reauthenticate["continue_url"]);
+      } else {
+        self::_call_admin_function($reauthenticate);
+      }
     } else {
       $name = $user->name;
       log::warning("user", t("Failed re-authentication for %name", array("name" => $name)));
       module::event("user_auth_failed", $name);
-      return self::_show_form($form);
+      if (empty($reauthenticate["in_dialog"])) {
+        self::_show_form($form);
+      } else {
+        print json_encode(array("form" => (string) $form));
+      }
     }
   }
 
@@ -52,6 +68,7 @@ class Reauthenticate_Controller extends Controller {
     $view->content = new View("reauthenticate.html");
     $view->content->form = $form;
     $view->content->user_name = identity::active_user()->name;
+
     print $view;
   }
 
@@ -70,4 +87,25 @@ class Reauthenticate_Controller extends Controller {
     $group->submit("")->value(t("Submit"));
     return $form;
   }
+
+  private static function _call_admin_function($reauthenticate) {
+    $controller_name = $reauthenticate["controller"];
+    $args = $reauthenticate["args"];
+    if ($controller_name == "index") {
+      $controller_name = "dashboard";
+    }
+
+    $controller_name = "Admin_{$controller_name}_Controller";
+    if ($args) {
+      $method = array_shift($args);
+    } else {
+      $method = "index";
+    }
+
+    if (!method_exists($controller_name, $method)) {
+      throw new Kohana_404_Exception();
+    }
+
+    call_user_func_array(array(new $controller_name, $method), $args);
+  }
 }
diff --git a/modules/gallery/controllers/user_profile.php b/modules/gallery/controllers/user_profile.php
index c064e791..431918ff 100644
--- a/modules/gallery/controllers/user_profile.php
+++ b/modules/gallery/controllers/user_profile.php
@@ -44,7 +44,7 @@ class User_Profile_Controller extends Controller {
 
   public function contact($id) {
     $user = identity::lookup_user($id);
-    print user_profile::get_contact_form($user);
+    print json_encode(array("form" => (string) user_profile::get_contact_form($user)));
   }
 
   public function send($id) {
diff --git a/modules/gallery/tests/xss_data.txt b/modules/gallery/tests/xss_data.txt
index 26edaebc..475f75c1 100644
--- a/modules/gallery/tests/xss_data.txt
+++ b/modules/gallery/tests/xss_data.txt
@@ -253,6 +253,7 @@ modules/gallery/views/permissions_form.html.php              75  DIRTY_JS $item-
 modules/gallery/views/permissions_form.html.php              80  DIRTY_JS $group->id
 modules/gallery/views/permissions_form.html.php              80  DIRTY_JS $permission->id
 modules/gallery/views/permissions_form.html.php              80  DIRTY_JS $item->id
+modules/gallery/views/quick_delete_confirm.html.php          11  DIRTY    $form
 modules/gallery/views/reauthenticate.html.php                9   DIRTY    $form
 modules/gallery/views/upgrader.html.php                      57  DIRTY_ATTR $done?"muted":""
 modules/gallery/views/upgrader.html.php                      61  DIRTY_ATTR $done?"muted":""
diff --git a/modules/gallery/views/form_uploadify.html.php b/modules/gallery/views/form_uploadify.html.php
index 6b8ed09c..937a37b6 100644
--- a/modules/gallery/views/form_uploadify.html.php
+++ b/modules/gallery/views/form_uploadify.html.php
@@ -88,6 +88,7 @@
 </ul>
 <? endif ?>
 
+<? if (!empty($album)): ?>
 <div>
   <p>
     <?= t("Photos will be uploaded to album: ") ?>
@@ -99,6 +100,7 @@
     <li class="g-active"> <?= html::purify($album->title) ?> </li>
   </ul>
 </div>
+<? endif ?>
 
 <div id="g-add-photos-canvas">
   <button id="g-add-photos-button" class="g-button ui-state-default ui-corner-all" href="#"><?= t("Select photos...") ?></button>
diff --git a/modules/gallery/views/move_browse.html.php b/modules/gallery/views/move_browse.html.php
index ce3fc2fd..f77c724c 100644
--- a/modules/gallery/views/move_browse.html.php
+++ b/modules/gallery/views/move_browse.html.php
@@ -1,4 +1,5 @@
 <?php defined("SYSPATH") or die("No direct script access.") ?>
+<div>
 <script type="text/javascript">
  var load_tree = function(target_id, locked) {
    var load_url = "<?= url::site("move/show_sub_tree/{$source->id}/__TARGETID__") ?>";
@@ -24,13 +25,13 @@
    }
  }
 </script>
-<h1 style="display: none">
+<h1 style="display:none" >
   <? if ($source->type == "photo"): ?>
-  <? t("Move this photo to a new album") ?>
+  <?= t("Move this photo to a new album") ?>
   <? elseif ($source->type == "movie"): ?>
-  <? t("Move this movie to a new album") ?>
+  <?= t("Move this movie to a new album") ?>
   <? elseif ($source->type == "album"): ?>
-  <? t("Move this album to a new album") ?>
+  <?= t("Move this album to a new album") ?>
   <? endif ?>
 </h1>
 <div id="g-move">
@@ -42,6 +43,8 @@
   <form method="post" action="<?= url::site("move/save/$source->id") ?>">
     <?= access::csrf_form_field() ?>
     <input type="hidden" name="target_id" value="" />
-    <input type="submit" id="g-move-button" value="<?= t("Move")->for_html_attr() ?>" disabled="disabled"/>
+    <input type="submit" id="g-move-button" value="<?= t("Move")->for_html_attr() ?>"
+       disabled="disabled" class="submit" />
   </form>
 </div>
+</div>
diff --git a/modules/gallery/views/quick_delete_confirm.html.php b/modules/gallery/views/quick_delete_confirm.html.php
new file mode 100644
index 00000000..176ffb96
--- /dev/null
+++ b/modules/gallery/views/quick_delete_confirm.html.php
@@ -0,0 +1,12 @@
+<?php defined("SYSPATH") or die("No direct script access.") ?>
+<div class="ui-helper-clearfix">
+  <p>
+  <? if ($item->is_album()): ?>
+    <?= t("Delete the album <b>%title</b>? All photos and movies in the album will also be deleted.",
+          array("title" => html::purify($item->title))) ?>
+  <? else: ?>
+    <?= t("Are you sure you want to delete <b>%title</b>?", array("title" => html::purify($item->title))) ?>
+  <? endif ?>
+  </p>
+  <?= $form ?>
+</div>
diff --git a/modules/organize/controllers/organize.php b/modules/organize/controllers/organize.php
index 557b3d67..0e647e09 100644
--- a/modules/organize/controllers/organize.php
+++ b/modules/organize/controllers/organize.php
@@ -47,7 +47,7 @@ class Organize_Controller extends Controller {
     $v->controller_uri = url::site("organize") . "/";
     $v->swf_uri = url::file("modules/organize/lib/Gallery3WebClient.swf?") .
       filemtime(MODPATH . "organize/lib/Gallery3WebClient.swf");
-    print $v;
+    print json_encode(array("form" => (string) $v));
   }
 
   function add_album_fields() {
diff --git a/modules/server_add/controllers/server_add.php b/modules/server_add/controllers/server_add.php
index 62c01143..e91d9dd9 100644
--- a/modules/server_add/controllers/server_add.php
+++ b/modules/server_add/controllers/server_add.php
@@ -30,7 +30,7 @@ class Server_Add_Controller extends Admin_Controller {
     $view->tree = new View("server_add_tree.html");
     $view->tree->files = $files;
     $view->tree->parents = array();
-    print $view;
+    print json_encode(array("form" => (string) $view));
   }
 
   public function children() {
diff --git a/modules/tag/controllers/admin_tags.php b/modules/tag/controllers/admin_tags.php
index 9e875d14..c2da7bc3 100644
--- a/modules/tag/controllers/admin_tags.php
+++ b/modules/tag/controllers/admin_tags.php
@@ -37,7 +37,7 @@ class Admin_Tags_Controller extends Admin_Controller {
   public function form_delete($id) {
     $tag = ORM::factory("tag", $id);
     if ($tag->loaded()) {
-      print tag::get_delete_form($tag);
+      print json_encode(array("form" => (string) tag::get_delete_form($tag)));
     }
   }
 
diff --git a/modules/user/controllers/admin_users.php b/modules/user/controllers/admin_users.php
index e14be393..b9d06891 100644
--- a/modules/user/controllers/admin_users.php
+++ b/modules/user/controllers/admin_users.php
@@ -61,7 +61,7 @@ class Admin_Users_Controller extends Admin_Controller {
   }
 
   public function add_user_form() {
-    print $this->_get_user_add_form_admin();
+    print json_encode(array("form" => (string) $this->_get_user_add_form_admin()));
   }
 
   public function delete_user($id) {
@@ -95,7 +95,7 @@ class Admin_Users_Controller extends Admin_Controller {
     if (empty($user)) {
       throw new Kohana_404_Exception();
     }
-    print $this->_get_user_delete_form_admin($user);
+    print json_encode(array("form" => (string) $this->_get_user_delete_form_admin($user)));
   }
 
   public function edit_user($id) {
@@ -146,7 +146,7 @@ class Admin_Users_Controller extends Admin_Controller {
       throw new Kohana_404_Exception();
     }
 
-    print $this->_get_user_edit_form_admin($user);
+    print json_encode(array("form" => (string) $this->_get_user_edit_form_admin($user)));
   }
 
   public function add_user_to_group($user_id, $group_id) {
@@ -199,7 +199,7 @@ class Admin_Users_Controller extends Admin_Controller {
   }
 
   public function add_group_form() {
-    print $this->_get_group_add_form_admin();
+    print json_encode(array("form" => (string) $this->_get_group_add_form_admin()));
   }
 
   public function delete_group($id) {
@@ -230,7 +230,7 @@ class Admin_Users_Controller extends Admin_Controller {
       throw new Kohana_404_Exception();
     }
 
-    print $this->_get_group_delete_form_admin($group);
+    print json_encode(array("form" => (string) $this->_get_group_delete_form_admin($group)));
   }
 
   public function edit_group($id) {
@@ -272,7 +272,7 @@ class Admin_Users_Controller extends Admin_Controller {
       throw new Kohana_404_Exception();
     }
 
-    print $this->_get_group_edit_form_admin($group);
+    print json_encode(array("form" => (string) $this->_get_group_edit_form_admin($group)));
   }
 
   /* User Form Definitions */
diff --git a/modules/user/controllers/users.php b/modules/user/controllers/users.php
index 7f3f6b1f..4ddfb47c 100644
--- a/modules/user/controllers/users.php
+++ b/modules/user/controllers/users.php
@@ -139,7 +139,7 @@ class Users_Controller extends Controller {
       access::forbidden();
     }
 
-    print $this->_get_edit_form($user);
+    print json_encode(array("form" => (string) $this->_get_edit_form($user)));
   }
 
   public function form_change_password($id) {
@@ -148,7 +148,7 @@ class Users_Controller extends Controller {
       access::forbidden();
     }
 
-    print $this->_get_change_password_form($user);
+    print json_encode(array("form" => (string) $this->_get_change_password_form($user)));
   }
 
   public function form_change_email($id) {
@@ -157,7 +157,7 @@ class Users_Controller extends Controller {
       access::forbidden();
     }
 
-    print $this->_get_change_email_form($user);
+    print json_encode(array("form" => (string) $this->_get_change_email_form($user)));
   }
 
   private function _get_change_password_form($user) {
diff --git a/modules/watermark/controllers/admin_watermarks.php b/modules/watermark/controllers/admin_watermarks.php
index 18b463ca..8b217b4a 100644
--- a/modules/watermark/controllers/admin_watermarks.php
+++ b/modules/watermark/controllers/admin_watermarks.php
@@ -35,7 +35,7 @@ class Admin_Watermarks_Controller extends Admin_Controller {
   }
 
   public function form_edit() {
-    print watermark::get_edit_form();
+    print json_encode(array("form" => (string) watermark::get_edit_form()));
   }
 
   public function edit() {
@@ -58,7 +58,7 @@ class Admin_Watermarks_Controller extends Admin_Controller {
   }
 
   public function form_delete() {
-    print watermark::get_delete_form();
+    print json_encode(array("form" => (string) watermark::get_delete_form()));
   }
 
   public function delete() {
@@ -88,7 +88,7 @@ class Admin_Watermarks_Controller extends Admin_Controller {
   }
 
   public function form_add() {
-    print watermark::get_add_form();
+    print json_encode(array("form" => (string) watermark::get_add_form()));
   }
 
   public function add() {