Merge branch 'master' into talmdal_dev

42 files changed, 173 insertions, 928 deletions

diff --git a/lib/gallery.common.css b/lib/gallery.common.css
index 8aa21193..e586f29a 100644
--- a/lib/gallery.common.css
+++ b/lib/gallery.common.css
@@ -621,10 +621,12 @@ div#g-action-status {
 
 #g-add-photos-status li.g-success {
   background: #d9efc2  url('images/ico-success.png') no-repeat .4em 50%;
+  width: 429px;
 }
 
 #g-add-photos-status li.g-error {
   background: #f6cbca url('images/ico-error.png') no-repeat .4em 50%;
+  width: 429px;
 /*  color: #f00;*/
 }
 
@@ -818,4 +820,4 @@ div#g-action-status {
 
 .rtl .g-paginator .ui-icon-seek-first {
   background-position: -64px -160px;
-}
\ No newline at end of file
+}
diff --git a/modules/comment/controllers/comments.php b/modules/comment/controllers/comments.php
index 74e0c974..068152a2 100644
--- a/modules/comment/controllers/comments.php
+++ b/modules/comment/controllers/comments.php
@@ -17,49 +17,12 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Comments_Controller extends REST_Controller {
-  protected $resource_type = "comment";
-
-  /**
-   * Display comments based on criteria.
-   *  @see REST_Controller::_index()
-   */
-  public function _index() {
-    $item = ORM::factory("item", $this->input->get('item_id'));
-    access::required("view", $item);
-
-    $comments = ORM::factory("comment")
-      ->where("item_id", $item->id)
-      ->where("state", "published")
-      ->orderby("created", "DESC")
-      ->find_all();
-
-    switch (rest::output_format()) {
-    case "json":
-      foreach ($comments as $comment) {
-        $data[] = array(
-          "id" => $comment->id,
-          "author_name" => html::clean($comment->author_name()),
-          "created" => $comment->created,
-          "text" => nl2br(html::purify($comment->text)));
-      }
-      print json_encode($data);
-      break;
-
-    case "html":
-      $view = new Theme_View("comments.html", "other", "comment");
-      $view->comments = $comments;
-      print $view;
-      break;
-    }
-  }
-
+class Comments_Controller extends Controller {
   /**
    * Add a new comment to the collection.
-   * @see REST_Controller::_create($resource)
    */
-  public function _create($comment) {
-    $item = ORM::factory("item", $this->input->post("item_id"));
+  public function create($id) {
+    $item = ORM::factory("item", $id);
     access::required("view", $item);
 
     $form = comment::get_add_form($item);
@@ -96,105 +59,27 @@ class Comments_Controller extends REST_Controller {
       }
 
       $form->add_comment->text->value("");
-      print json_encode(
-        array("result" => "success",
-              "resource" => ($comment->state == "published"
-                             ? url::site("comments/{$comment->id}")
-                             : null),
-              "form" => $form->__toString()));
-    } else {
-      print json_encode(
-        array("result" => "error",
-              "form" => $form->__toString()));
-    }
-  }
-
-  /**
-   * Display an existing comment.
-   *  @todo Set proper Content-Type in a central place (REST_Controller::dispatch?).
-   *  @see REST_Controller::_show($resource)
-   */
-  public function _show($comment) {
-    $item = ORM::factory("item", $comment->item_id);
-    access::required("view", $item);
-    if ($comment->state != "published") {
-      return;
-    }
-
-    if (rest::output_format() == "json") {
-      print json_encode(
-        array("result" => "success",
-              "data" => array(
-                "id" => $comment->id,
-                "author_name" => html::clean($comment->author_name()),
-                "created" => $comment->created,
-                "text" => nl2br(html::purify($comment->text)))));
-    } else {
       $view = new Theme_View("comment.html", "other", "comment-fragment");
       $view->comment = $comment;
-      print $view;
-    }
-  }
-
-  /**
-   * Change an existing comment.
-   *  @see REST_Controller::_update($resource)
-   */
-  public function _update($comment) {
-    $item = ORM::factory("item", $comment->item_id);
-    access::required("view", $item);
-    access::required("edit", $item);
-
-    $form = comment::get_edit_form($comment);
-    if ($form->validate()) {
-      $comment->guest_name = $form->edit_comment->inputs["name"]->value;
-      $comment->guest_email = $form->edit_comment->email->value;
-      $comment->url = $form->edit_comment->url->value;
-      $comment->text = $form->edit_comment->text->value;
-      $comment->save();
 
       print json_encode(
         array("result" => "success",
-              "resource" => url::site("comments/{$comment->id}")));
+              "view" => $view->__toString(),
+              "form" => $form->__toString()));
     } else {
       print json_encode(
         array("result" => "error",
-              "html" => $form->__toString()));
+              "form" => $form->__toString()));
     }
   }
 
   /**
-   * Delete existing comment.
-   *  @see REST_Controller::_delete($resource)
-   */
-  public function _delete($comment) {
-    $item = ORM::factory("item", $comment->item_id);
-    access::required("view", $item);
-    access::required("edit", $item);
-
-    $comment->delete();
-    print json_encode(array("result" => "success"));
-  }
-
-  /**
    * Present a form for adding a new comment to this item or editing an existing comment.
-   *  @see REST_Controller::form_add($resource)
    */
-  public function _form_add($item_id) {
+  public function form_add($item_id) {
     $item = ORM::factory("item", $item_id);
     access::required("view", $item);
 
     print comment::get_add_form($item);
   }
-
-  /**
-   * Present a form for editing an existing comment.
-   *  @see REST_Controller::form_edit($resource)
-   */
-  public function _form_edit($comment) {
-    if (!identity::active_user()->admin) {
-      access::forbidden();
-    }
-    print comment::get_edit_form($comment);
-  }
 }
diff --git a/modules/comment/helpers/comment.php b/modules/comment/helpers/comment.php
index 35685d8c..1e1e7d2f 100644
--- a/modules/comment/helpers/comment.php
+++ b/modules/comment/helpers/comment.php
@@ -65,7 +65,7 @@ class comment_Core {
   }
 
   static function get_add_form($item) {
-    $form = new Forge("comments", "", "post", array("id" => "g-comment-form"));
+    $form = new Forge("comments/create/{$item->id}", "", "post", array("id" => "g-comment-form"));
     $group = $form->group("add_comment")->label(t("Add comment"));
     $group->input("name")   ->label(t("Name"))            ->id("g-author");
     $group->input("email")  ->label(t("Email (hidden)"))  ->id("g-email");
@@ -87,29 +87,5 @@ class comment_Core {
 
     return $form;
   }
-
-  static function get_edit_form($comment) {
-    $form = new Forge("comments/{$comment->id}?_method=put", "", "post",
-                      array("id" => "g-edit-comment-form"));
-    $group = $form->group("edit_comment")->label(t("Edit comment"));
-    $group->input("name")   ->label(t("Author"))          ->id("g-author");
-    $group->input("email")  ->label(t("Email (hidden)"))  ->id("g-email");
-    $group->input("url")    ->label(t("Website (hidden)"))->id("g-url");
-    $group->textarea("text")->label(t("Comment"))         ->id("g-text");
-    $group->submit("")->value(t("Edit"));
-
-    $group->text = $comment->text;
-    $author = $comment->author();
-    if ($author->guest) {
-      $group->inputs["name"]->value = $comment->guest_name;
-      $group->email = $comment->guest_email;
-      $group->url = $comment->guest_url;
-    } else {
-      $group->inputs["name"]->value($author->full_name)->disabled("disabled");
-      $group->email->value($author->email)->disabled("disabled");
-      $group->url->value($author->url)->disabled("disabled");
-    }
-    return $form;
-  }
 }
 
diff --git a/modules/comment/js/comment.js b/modules/comment/js/comment.js
index 3f058062..bb204b78 100644
--- a/modules/comment/js/comment.js
+++ b/modules/comment/js/comment.js
@@ -28,17 +28,16 @@ function ajaxify_comment_form() {
   $("#g-comments form").ajaxForm({
     dataType: "json",
     success: function(data) {
-      if (data.form) {
-        $("#g-comments form").replaceWith(data.form);
-        ajaxify_comment_form();
-      }
-      if (data.result == "success" && data.resource) {
-        $.get(data.resource, function(data, textStatus) {
-          $("#g-comments .g-block-content ul:first").append("<li>"+data+"</li>");
-          $("#g-comments .g-block-content ul:first li:last").effect("highlight", {color: "#cfc"}, 8000);
-          $("#g-comment-form").hide(2000).remove();
-	  $("#g-no-comments-yet").hide(2000);
-        });
+      if (data.result == "success") {
+       $("#g-comments #g-comment-detail ul").append(data.view);
+        $("#g-comments #g-comment-detail ul li:last").effect("highlight", {color: "#cfc"}, 8000);
+        $("#g-comment-form").hide(2000).remove();
+        $("#g-no-comments-yet").hide(2000);
+      } else {
+        if (data.form) {
+          $("#g-comments form").replaceWith(data.form);
+          ajaxify_comment_form();
+        }
       }
     }
   });
diff --git a/modules/comment/views/comment.html.php b/modules/comment/views/comment.html.php
index c7957c15..2c485b53 100644
--- a/modules/comment/views/comment.html.php
+++ b/modules/comment/views/comment.html.php
@@ -8,9 +8,9 @@
            width="40"
            height="40" />
     </a>
-    <?= t("on %date_time, %author_name said",
+    <?= t("on %date_time,  <a href=\"#\">%name</a> said",
           array("date_time" => gallery::date_time($comment->created),
-                "author_name" => html::clean($comment->author_name()))) ?>
+                "name" => html::clean($comment->author_name()))) ?>
   </p>
   <div>
   <?= nl2br(html::purify($comment->text)) ?>
diff --git a/modules/gallery/config/routes.php b/modules/gallery/config/routes.php
index 0272ca15..63cc6150 100644
--- a/modules/gallery/config/routes.php
+++ b/modules/gallery/config/routes.php
@@ -18,14 +18,11 @@
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
 
-// The abstract REST_Controller is not directly routable.
-$config["^rest\b.*"] = null;
-
 // Admin controllers are not available, except via /admin
 $config["^admin_.*"] = null;
 
-// Redirect /form/add and /form/edit to REST_Controller.
+// Redirect /form/add and /form/edit to the module/form_(add|edit)/parms.
 $config["^form/(edit|add)/(\w+)/(.*)$"] = "$2/form_$1/$3";
 
 // Default page is the root album
-$config["_default"] = "albums/1";
+$config["_default"] = "albums";
diff --git a/modules/gallery/controllers/admin_theme_options.php b/modules/gallery/controllers/admin_theme_options.php
index 27a67bdb..9de54c78 100644
--- a/modules/gallery/controllers/admin_theme_options.php
+++ b/modules/gallery/controllers/admin_theme_options.php
@@ -58,6 +58,8 @@ class Admin_Theme_Options_Controller extends Admin_Controller {
       module::set_var("gallery", "footer_text", $form->edit_theme->footer_text->value);
       module::set_var("gallery", "show_credits", $form->edit_theme->show_credits->value);
 
+      module::event("theme_edit_form_completed", $form);
+
       message::success(t("Updated theme details"));
       url::redirect("admin/theme_options");
     } else {
diff --git a/modules/gallery/controllers/albums.php b/modules/gallery/controllers/albums.php
index e67df6f6..3c1a0adf 100644
--- a/modules/gallery/controllers/albums.php
+++ b/modules/gallery/controllers/albums.php
@@ -18,11 +18,16 @@
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
 class Albums_Controller extends Items_Controller {
+  public function index() {
+    $this->show(ORM::factory("item", 1));
+  }
 
-  /**
-   *  @see REST_Controller::_show($resource)
-   */
-  public function _show($album) {
+  public function show($album) {
+    if (!is_object($album)) {
+      // show() must be public because we route to it in url::parse_url(), so make
+      // sure that we're actually receiving an object
+      Kohana::show_404();
+    }
     $page_size = module::get_var("gallery", "page_size", 9);
     if (!access::can("view", $album)) {
       if ($album->id == 1) {
@@ -82,27 +87,9 @@ class Albums_Controller extends Items_Controller {
     print $template;
   }
 
-  /**
-   * @see REST_Controller::_create($resource)
-   */
-  public function _create($album) {
+  public function create($parent_id) {
     access::verify_csrf();
-    access::required("view", $album);
-    access::required("add", $album);
-
-    switch ($this->input->post("type")) {
-    case "album":
-      return $this->_create_album($album);
-
-    case "photo":
-      return $this->_create_photo($album);
-
-    default:
-      access::forbidden();
-    }
-  }
-
-  private function _create_album($album) {
+    $album = ORM::factory("item", $parent_id);
     access::required("view", $album);
     access::required("add", $album);
 
@@ -123,8 +110,7 @@ class Albums_Controller extends Items_Controller {
 
       print json_encode(
         array("result" => "success",
-              "location" => $new_album->url(),
-              "resource" => $new_album->url()));
+              "location" => $new_album->url()));
     } else {
       print json_encode(
         array(
@@ -133,43 +119,9 @@ class Albums_Controller extends Items_Controller {
     }
   }
 
-  private function _create_photo($album) {
-    access::required("view", $album);
-    access::required("add", $album);
-
-    // If we set the content type as JSON, it triggers saving the result as
-    // a document in the browser (well, in Chrome at least).
-    // @todo figure out why and fix this.
-    $form = photo::get_add_form($album);
-    if ($form->validate()) {
-      $photo = photo::create(
-        $album,
-        $this->input->post("file"),
-        $_FILES["file"]["name"],
-        $this->input->post("title", $this->input->post("name")),
-        $this->input->post("description"),
-        identity::active_user()->id);
-
-      log::success("content", "Added a photo", html::anchor("photos/$photo->id", "view photo"));
-      message::success(t("Added photo %photo_title",
-                         array("photo_title" => html::purify($photo->title))));
-
-      print json_encode(
-        array("result" => "success",
-              "resource" => $photo->url(),
-              "location" => $photo->url()));
-    } else {
-      print json_encode(
-        array("result" => "error",
-              "form" => $form->__toString()));
-    }
-  }
-
-  /**
-   * @see REST_Controller::_update($resource)
-   */
-  public function _update($album) {
+  public function update($album_id) {
     access::verify_csrf();
+    $album = ORM::factory("item", $album_id);
     access::required("view", $album);
     access::required("edit", $album);
 
@@ -229,32 +181,16 @@ class Albums_Controller extends Items_Controller {
     }
   }
 
-  /**
-   *  @see REST_Controller::_form_add($parameters)
-   */
-  public function _form_add($album_id) {
+  public function form_add($album_id) {
     $album = ORM::factory("item", $album_id);
     access::required("view", $album);
     access::required("add", $album);
 
-    switch ($this->input->get("type")) {
-    case "album":
-      print album::get_add_form($album);
-      break;
-
-    case "photo":
-      print photo::get_add_form($album);
-      break;
-
-    default:
-      kohana::show_404();
-    }
+    print album::get_add_form($album);
   }
 
-  /**
-   *  @see REST_Controller::_form_add($parameters)
-   */
-  public function _form_edit($album) {
+  public function form_edit($album_id) {
+    $album = ORM::factory("item", $album_id);
     access::required("view", $album);
     access::required("edit", $album);
 
diff --git a/modules/gallery/controllers/file_proxy.php b/modules/gallery/controllers/file_proxy.php
index acfd6eb9..8fde1132 100644
--- a/modules/gallery/controllers/file_proxy.php
+++ b/modules/gallery/controllers/file_proxy.php
@@ -112,7 +112,7 @@ class File_Proxy_Controller extends Controller {
     Session::abort_save();
 
     // Dump out the image.  If the item is a movie, then its thumbnail will be a JPG.
-    if (in_array($item->mime_type, array("video/x-flv", "video/mp4"))) {
+    if ($item->is_movie() && $type != "albums") {
       header("Content-type: image/jpeg");
     } else {
       header("Content-Type: $item->mime_type");
diff --git a/modules/gallery/controllers/items.php b/modules/gallery/controllers/items.php
index 7f60f2b7..b350c5a2 100644
--- a/modules/gallery/controllers/items.php
+++ b/modules/gallery/controllers/items.php
@@ -17,14 +17,18 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Items_Controller extends REST_Controller {
-  protected $resource_type = "item";
+class Items_Controller extends Controller {
+  public function __call($function, $args) {
+    $item = ORM::factory("item", (int)$function);
+    if (!$item->loaded) {
+      return Kohana::show_404();
+    }
 
-  public function _show($item) {
     // Redirect to the more specific resource type, since it will render
-    // differently.  We could also just delegate here, but it feels more appropriate
-    // to have a single canonical resource mapping.
+    // differently.  We can't delegate here because we may have gotten to this
+    // page via /items/<id> which means that we don't have a type-specific controller.  Also, we
+    // want to drive a single canonical resource mapping where possible.
     access::required("view", $item);
-    return url::redirect($item->abs_url());
+    url::redirect($item->abs_url());
   }
 }
diff --git a/modules/gallery/controllers/movies.php b/modules/gallery/controllers/movies.php
index 2e2e837c..575b2b60 100644
--- a/modules/gallery/controllers/movies.php
+++ b/modules/gallery/controllers/movies.php
@@ -18,11 +18,12 @@
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
 class Movies_Controller extends Items_Controller {
-
-  /**
-   *  @see REST_Controller::_show($resource)
-   */
-  public function _show($movie) {
+  public function show($movie) {
+    if (!is_object($movie)) {
+      // show() must be public because we route to it in url::parse_url(), so make
+      // sure that we're actually receiving an object
+      Kohana::show_404();
+    }
     access::required("view", $movie);
 
     $where = array("type != " => "album");
@@ -53,11 +54,9 @@ class Movies_Controller extends Items_Controller {
     print $template;
   }
 
-  /**
-   * @see REST_Controller::_update($resource)
-   */
-  public function _update($movie) {
+  public function update($movie_id) {
     access::verify_csrf();
+    $movie = ORM::factory("item", $movie_id);
     access::required("view", $movie);
     access::required("edit", $movie);
 
@@ -120,10 +119,8 @@ class Movies_Controller extends Items_Controller {
     }
   }
 
-  /**
-   *  @see REST_Controller::_form_edit($resource)
-   */
-  public function _form_edit($movie) {
+  public function form_edit($movie_id) {
+    $movie = ORM::factory("item", $movie_id);
     access::required("view", $movie);
     access::required("edit", $movie);
     print movie::get_edit_form($movie);
diff --git a/modules/gallery/controllers/photos.php b/modules/gallery/controllers/photos.php
index 0c2ff6ee..ba4cfb83 100644
--- a/modules/gallery/controllers/photos.php
+++ b/modules/gallery/controllers/photos.php
@@ -18,11 +18,12 @@
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
 class Photos_Controller extends Items_Controller {
-
-  /**
-   *  @see REST_Controller::_show($resource)
-   */
-  public function _show($photo) {
+  public function show($photo) {
+    if (!is_object($photo)) {
+      // show() must be public because we route to it in url::parse_url(), so make
+      // sure that we're actually receiving an object
+      Kohana::show_404();
+    }
     access::required("view", $photo);
 
     $where = array("type != " => "album");
@@ -53,12 +54,9 @@ class Photos_Controller extends Items_Controller {
     print $template;
   }
 
-
-  /**
-   * @see REST_Controller::_update($resource)
-   */
-  public function _update($photo) {
+  public function update($photo_id) {
     access::verify_csrf();
+    $photo = ORM::factory("item", $photo_id);
     access::required("view", $photo);
     access::required("edit", $photo);
 
@@ -125,10 +123,8 @@ class Photos_Controller extends Items_Controller {
     }
   }
 
-  /**
-   *  @see REST_Controller::_form_edit($resource)
-   */
-  public function _form_edit($photo) {
+  public function form_edit($photo_id) {
+    $photo = ORM::factory("item", $photo_id);
     access::required("view", $photo);
     access::required("edit", $photo);
 
diff --git a/modules/gallery/controllers/rest.php b/modules/gallery/controllers/rest.php
deleted file mode 100644
index 2edf079f..00000000
--- a/modules/gallery/controllers/rest.php
+++ /dev/null
@@ -1,183 +0,0 @@
-<?php defined("SYSPATH") or die("No direct script access.");
-/**
- * Gallery - a web based photo album viewer and editor
- * Copyright (C) 2000-2009 Bharat Mediratta
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or (at
- * your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
- */
-/**
- * This abstract controller makes it easy to create a RESTful controller.  To use it, create a
- * subclass which defines the resource type and implements get/post/put/delete methods, like this:
- *
- * class Comment_Controller extends REST_Controller {
- *   protected $resource_type = "comment";  // this tells REST which model to use
- *
- *   public function _index() {
- *     // Handle GET request to /controller
- *   }
- *
- *   public function _show(ORM $comment) {
- *     // Handle GET request to /comments/{comment_id}
- *   }
- *
- *   public function _update(ORM $comment) {
- *     // Handle PUT request to /comments/{comment_id}
- *   }
- *
- *   public function _create(ORM $comment) {
- *     // Handle POST request to /comments
- *   }
- *
- *   public function _delete(ORM $comment) {
- *     // Handle DELETE request to /comments/{comments_id}
- *   }
- *
- *   public function _form_add($parameters) {
- *     // Handle GET request to /form/add/comments
- *     // Show a form for creating a new comment
- *   }
- *
- *   public function _form_edit(ORM $comment) {
- *     // Handle GET request to /form/edit/comments
- *     // Show a form for editing an existing comment
- *   }
- *
- * A request to http://example.com/gallery3/comments/3 will result in a call to
- * REST_Controller::__call(3) which will load up the comment associated with id 3.  If there's
- * no such comment, it returns a 404.  Otherwise, it will then delegate to
- * Comment_Controller::get() with the ORM instance as an argument.
- */
-class REST_Controller extends Controller {
-  protected $resource_type = null;
-
-  public function __construct() {
-    if ($this->resource_type == null) {
-      throw new Exception("@todo ERROR_MISSING_RESOURCE_TYPE");
-    }
-    parent::__construct();
-  }
-
-  /**
-   * Handle dispatching for all REST controllers.
-   */
-  public function __call($function, $args) {
-    // If no parameter was provided after the controller name (eg "/albums") then $function will
-    // be set to "index".  Otherwise, $function is the first parameter, and $args are all
-    // subsequent parameters.
-    $request_method = rest::request_method();
-    if ($function == "index" && $request_method == "get") {
-      return $this->_index();
-    }
-
-    $resource = ORM::factory($this->resource_type, (int)$function);
-    if (!$resource->loaded && $request_method != "post") {
-      return Kohana::show_404();
-    }
-
-    switch ($request_method) {
-    case "get":
-      return $this->_show($resource);
-
-    case "put":
-      access::verify_csrf();
-      return $this->_update($resource);
-
-    case "delete":
-      access::verify_csrf();
-      return $this->_delete($resource);
-
-    case "post":
-      access::verify_csrf();
-      return $this->_create($resource);
-    }
-  }
-
-  /* We're editing an existing item, load it from the database. */
-  public function form_edit($resource_id) {
-    if ($this->resource_type == null) {
-      throw new Exception("@todo ERROR_MISSING_RESOURCE_TYPE");
-    }
-
-    $resource = ORM::factory($this->resource_type, $resource_id);
-    if (!$resource->loaded) {
-      return Kohana::show_404();
-    }
-
-    // Security checks must be performed in _form_edit
-    return $this->_form_edit($resource);
-  }
-
-  /* We're adding a new item, pass along any additional parameters. */
-  public function form_add($parameters) {
-    // Security checks must be performed in _form_add
-    return $this->_form_add($parameters);
-  }
-
-  /**
-   * Perform a GET request on the controller root
-   * (e.g. http://www.example.com/gallery3/comments)
-   */
-  public function _index() {
-    throw new Exception("@todo _create NOT IMPLEMENTED");
-  }
-
-  /**
-   * Perform a POST request on this resource
-   * @param ORM $resource the instance of this resource type
-   */
-  public function _create($resource) {
-    throw new Exception("@todo _create NOT IMPLEMENTED");
-  }
-
-  /**
-   * Perform a GET request on this resource
-   * @param ORM $resource the instance of this resource type
-   */
-  public function _show($resource) {
-    throw new Exception("@todo _show NOT IMPLEMENTED");
-  }
-
-  /**
-   * Perform a PUT request on this resource
-   * @param ORM $resource the instance of this resource type
-   */
-  public function _update($resource) {
-    throw new Exception("@todo _update NOT IMPLEMENTED");
-  }
-
-  /**
-   * Perform a DELETE request on this resource
-   * @param ORM $resource the instance of this resource type
-   */
-  public function _delete($resource) {
-    throw new Exception("@todo _delete NOT IMPLEMENTED");
-  }
-
-  /**
-   * Present a form for adding a new resource
-   * @param string part of the URI after the controller name
-   */
-  public function _form_add($parameter) {
-    throw new Exception("@todo _form_add NOT IMPLEMENTED");
-  }
-
-  /**
-   * Present a form for editing an existing resource
-   * @param ORM $resource the resource container for instances of this resource type
-   */
-  public function _form_edit($resource) {
-    throw new Exception("@todo _form_edit NOT IMPLEMENTED");
-  }
-}
diff --git a/modules/gallery/helpers/MY_url.php b/modules/gallery/helpers/MY_url.php
index 368c947e..139aec21 100644
--- a/modules/gallery/helpers/MY_url.php
+++ b/modules/gallery/helpers/MY_url.php
@@ -35,7 +35,8 @@ class url extends url_Core {
     if ($item && $item->loaded) {
       Router::$controller = "{$item->type}s";
       Router::$controller_path = MODPATH . "gallery/controllers/{$item->type}s.php";
-      Router::$method = $item->id;
+      Router::$method = "show";
+      Router::$arguments = array($item);
     }
   }
 
diff --git a/modules/gallery/helpers/access.php b/modules/gallery/helpers/access.php
index c1c1f9d1..88a02ce2 100644
--- a/modules/gallery/helpers/access.php
+++ b/modules/gallery/helpers/access.php
@@ -609,7 +609,8 @@ class access_Core {
       $dirs[] = dirname($album->thumb_path());
     }
 
-    $base_url = url::site("file_proxy");
+    $base_url = url::site("?kohana_uri=/file_proxy");
+    $base_url = str_replace("/?", "?", $base_url);
     foreach ($dirs as $dir) {
       if ($value === self::DENY) {
         $fp = fopen("$dir/.htaccess", "w+");
diff --git a/modules/gallery/helpers/album.php b/modules/gallery/helpers/album.php
index 72a79a75..e9a0f6ec 100644
--- a/modules/gallery/helpers/album.php
+++ b/modules/gallery/helpers/album.php
@@ -92,7 +92,7 @@ class album_Core {
   }
 
   static function get_add_form($parent) {
-    $form = new Forge("albums/{$parent->id}", "", "post", array("id" => "g-add-album-form"));
+    $form = new Forge("albums/create/{$parent->id}", "", "post", array("id" => "g-add-album-form"));
     $group = $form->group("add_album")
       ->label(t("Add an album to %album_title", array("album_title" => $parent->title)));
     $group->input("title")->label(t("Title"));
@@ -114,7 +114,7 @@ class album_Core {
   }
 
   static function get_edit_form($parent) {
-    $form = new Forge("albums/{$parent->id}", "", "post", array("id" => "g-edit-album-form"));
+    $form = new Forge("albums/update/{$parent->id}", "", "post", array("id" => "g-edit-album-form"));
     $form->hidden("_method")->value("put");
     $group = $form->group("edit_item")->label(t("Edit Album"));
 
diff --git a/modules/gallery/helpers/gallery_installer.php b/modules/gallery/helpers/gallery_installer.php
index 57a5ee9f..39859b36 100644
--- a/modules/gallery/helpers/gallery_installer.php
+++ b/modules/gallery/helpers/gallery_installer.php
@@ -432,6 +432,13 @@ class gallery_installer {
       module::clear_var("gallery", "blocks_site.sidebar");
       module::set_version("gallery", $version = 19);
     }
+
+    // Set a default for the number of simultaneous uploads
+    // Version 20 was reverted in 57adefc5baa7a2b0dfcd3e736e80c2fa86d3bfa2, so skip it.
+    if ($version == 19 || $version == 20) {
+      module::set_var("gallery", "simultaneous_upload_limit", 5);
+      module::set_version("gallery", $version = 21);
+    }
   }
 
   static function uninstall() {
diff --git a/modules/gallery/helpers/module.php b/modules/gallery/helpers/module.php
index e6c196ce..50abdaae 100644
--- a/modules/gallery/helpers/module.php
+++ b/modules/gallery/helpers/module.php
@@ -335,6 +335,21 @@ class module_Core {
         call_user_func_array(array($class, $function), $args);
       }
     }
+
+    // Give the admin theme a chance to respond, if we're in admin mode.
+    if (theme::$is_admin) {
+      $class = theme::$admin_theme_name . "_event";
+      if (method_exists($class, $function)) {
+        call_user_func_array(array($class, $function), $args);
+      }
+    }
+
+    // Give the site theme a chance to respond as well.  It gets a chance even in admin mode, as
+    // long as the theme has an admin subdir.
+    $class = theme::$site_theme_name . "_event";
+    if (method_exists($class, $function)) {
+      call_user_func_array(array($class, $function), $args);
+    }
   }
 
   /**
diff --git a/modules/gallery/helpers/movie.php b/modules/gallery/helpers/movie.php
index e84e8ea6..536d5143 100644
--- a/modules/gallery/helpers/movie.php
+++ b/modules/gallery/helpers/movie.php
@@ -129,7 +129,7 @@ class movie_Core {
   }
 
   static function get_edit_form($movie) {
-    $form = new Forge("movies/$movie->id", "", "post", array("id" => "g-edit-movie-form"));
+    $form = new Forge("movies/update/$movie->id", "", "post", array("id" => "g-edit-movie-form"));
     $form->hidden("_method")->value("put");
     $group = $form->group("edit_item")->label(t("Edit Movie"));
     $group->input("title")->label(t("Title"))->value($movie->title);
diff --git a/modules/gallery/helpers/photo.php b/modules/gallery/helpers/photo.php
index 01cf5278..4188e192 100644
--- a/modules/gallery/helpers/photo.php
+++ b/modules/gallery/helpers/photo.php
@@ -137,27 +137,8 @@ class photo_Core {
     return $photo;
   }
 
-  static function get_add_form($parent) {
-    $form = new Forge("albums/{$parent->id}", "", "post", array("id" => "g-add-photo-form"));
-    $group = $form->group("add_photo")->label(
-      t("Add Photo to %album_title", array("album_title" => $parent->title)));
-    $group->input("title")->label(t("Title"));
-    $group->textarea("description")->label(t("Description"));
-    $group->input("name")->label(t("Filename"));
-    $group->input("slug")->label(t("Internet Address"))->value($photo->slug)
-      ->callback("item::validate_url_safe")
-      ->error_messages(
-        "not_url_safe",
-        t("The internet address should contain only letters, numbers, hyphens and underscores"));
-    $group->upload("file")->label(t("File"))->rules("required|allow[jpg,png,gif,flv,mp4]");
-    $group->hidden("type")->value("photo");
-    $group->submit("")->value(t("Upload"));
-    $form->add_rules_from(ORM::factory("item"));
-    return $form;
-  }
-
   static function get_edit_form($photo) {
-    $form = new Forge("photos/$photo->id", "", "post", array("id" => "g-edit-photo-form"));
+    $form = new Forge("photos/update/$photo->id", "", "post", array("id" => "g-edit-photo-form"));
     $form->hidden("_method")->value("put");
     $group = $form->group("edit_item")->label(t("Edit Photo"));
     $group->input("title")->label(t("Title"))->value($photo->title);
diff --git a/modules/gallery/helpers/rest.php b/modules/gallery/helpers/rest.php
deleted file mode 100644
index a63b94c8..00000000
--- a/modules/gallery/helpers/rest.php
+++ /dev/null
@@ -1,116 +0,0 @@
-<?php defined("SYSPATH") or die("No direct script access.");
-/**
- * Gallery - a web based photo album viewer and editor
- * Copyright (C) 2000-2009 Bharat Mediratta
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or (at
- * your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
- */
-
-class rest_Core {
-  const OK = "200 OK";
-  const CREATED = "201 Created";
-  const ACCEPTED = "202 Accepted";
-  const NO_CONTENT = "204 No Content";
-  const RESET_CONTENT = "205 Reset Content";
-  const PARTIAL_CONTENT = "206 Partial Content";
-  const MOVED_PERMANENTLY = "301 Moved Permanently";
-  const FOUND = "302 Found";
-  const SEE_OTHER = "303 See Other";
-  const NOT_MODIFIED = "304 Not Modified";
-  const TEMPORARY_REDIRECT = "307 Temporary Redirect";
-  const BAD_REQUEST = "400 Bad Request";
-  const UNAUTHORIZED = "401 Unauthorized";
-  const FORBIDDEN = "403 Forbidden";
-  const NOT_FOUND = "404 Not Found";
-  const METHOD_NOT_ALLOWED = "405 Method Not Allowed";
-  const NOT_ACCEPTABLE = "406 Not Acceptable";
-  const CONFLICT = "409 Conflict";
-  const GONE = "410 Gone";
-  const LENGTH_REQUIRED = "411 Length Required";
-  const PRECONDITION_FAILED = "412 Precondition Failed";
-  const UNSUPPORTED_MEDIA_TYPE = "415 Unsupported Media Type";
-  const EXPECTATION_FAILED = "417 Expectation Failed";
-  const INTERNAL_SERVER_ERROR = "500 Internal Server Error";
-  const SERVICE_UNAVAILABLE = "503 Service Unavailable";
-
-  const XML = "application/xml";
-  const ATOM = "application/atom+xml";
-  const RSS = "application/rss+xml";
-  const JSON = "application/json";
-  const HTML = "text/html";
-
-  /**
-   * We're expecting to run in an environment that only supports GET/POST, so expect to tunnel
-   * PUT and DELETE through POST.
-   *
-   * Returns the HTTP request method taking into consideration PUT/DELETE tunneling.
-   * @return string HTTP request method
-   */
-  static function request_method() {
-    if (request::method() == "get") {
-      return "get";
-    } else {
-      $input = Input::instance();
-      switch (strtolower($input->post("_method", $input->get("_method", request::method())))) {
-      case "put":    return "put";
-      case "delete": return "delete";
-      default:       return "post";
-      }
-    }
-  }
-
-  /**
-   * Choose an output format based on what the client prefers to accept.
-   * @return string "html", "xml" or "json"
-   */
-  static function output_format() {
-    // Pick a format, but let it be overridden.
-    $input = Input::instance();
-    $fmt = $input->get(
-      "_format", $input->post(
-        "_format", request::preferred_accept(
-          array("xhtml", "html", "xml", "json"))));
-
-    // Some browsers (Chrome!) prefer xhtml over html, but we'll normalize this to html for now.
-    if ($fmt == "xhtml") {
-      $fmt = "html";
-    }
-    return $fmt;
-  }
-
-  /**
-   * Set HTTP response code.
-   * @param string Use one of the status code constants defined in this class.
-   */
-  static function http_status($status_code) {
-    header("HTTP/1.1 " . $status_code);
-  }
-
-  /**
-   * Set HTTP Location header.
-   * @param string URL
-   */
-  static function http_location($url) {
-    header("Location: " . $url);
-  }
-
-  /**
-   * Set HTTP Content-Type header.
-   * @param string content type
-   */
-  static function http_content_type($type) {
-    header("Content-Type: " . $type);
-  }
-}
diff --git a/modules/gallery/helpers/theme.php b/modules/gallery/helpers/theme.php
index 16ed104e..247aa5c4 100644
--- a/modules/gallery/helpers/theme.php
+++ b/modules/gallery/helpers/theme.php
@@ -24,6 +24,10 @@
  * Note: by design, this class does not do any permission checking.
  */
 class theme_Core {
+  public static $admin_theme_name;
+  public static $site_theme_name;
+  public static $is_admin;
+
   /**
    * Load the active theme.  This is called at bootstrap time.  We will only ever have one theme
    * active for any given request.
@@ -35,14 +39,31 @@ class theme_Core {
       $path = "/" . $input->get("kohana_uri");
     }
 
-    if (!(identity::active_user()->admin && $theme_name = $input->get("theme"))) {
-      $theme_name = module::get_var(
-        "gallery",
-        $path == "/admin" || !strncmp($path, "/admin/", 7) ?
-          "active_admin_theme" : "active_site_theme");
-    }
     $modules = Kohana::config("core.modules");
-    array_unshift($modules, THEMEPATH . $theme_name);
+    self::$is_admin = $path == "/admin" || !strncmp($path, "/admin/", 7);
+    self::$site_theme_name = module::get_var("gallery", "active_site_theme");
+    if (self::$is_admin) {
+      // Load the admin theme
+      self::$admin_theme_name = module::get_var("gallery", "active_admin_theme");
+      array_unshift($modules, THEMEPATH . self::$admin_theme_name);
+
+      // If the site theme has an admin subdir, load that as a module so that
+      // themes can provide their own code.
+      if (file_exists(THEMEPATH . self::$site_theme_name . "/admin")) {
+        array_unshift($modules, THEMEPATH . self::$site_theme_name . "/admin");
+      }
+    } else {
+      // Admins can override the site theme, temporarily.  This lets us preview themes.
+      if (identity::active_user()->admin && $override = $input->get("theme")) {
+        if (file_exists(THEMEPATH . $override)) {
+          self::$site_theme_name = $override;
+        } else {
+          Kohana::log("error", "Missing override theme: '$override'");
+        }
+      }
+      array_unshift($modules, THEMEPATH . self::$site_theme_name);
+    }
+
     Kohana::config_set("core.modules", $modules);
   }
 
@@ -64,6 +85,10 @@ class theme_Core {
       ->value(module::get_var("gallery", "footer_text"));
     $group->checkbox("show_credits")->label(t("Show site credits"))->id("g-footer-text")
       ->checked(module::get_var("gallery", "show_credits"));
+
+    module::event("theme_edit_form", $form);
+
+    $group = $form->group("buttons");
     $group->submit("")->value(t("Save"));
     return $form;
   }
diff --git a/modules/gallery/libraries/Admin_View.php b/modules/gallery/libraries/Admin_View.php
index cbb781a1..a990e4ca 100644
--- a/modules/gallery/libraries/Admin_View.php
+++ b/modules/gallery/libraries/Admin_View.php
@@ -27,12 +27,6 @@ class Admin_View_Core extends Gallery_View {
    * @return  void
    */
   public function __construct($name) {
-    $theme_name = module::get_var("gallery", "active_admin_theme");
-    if (!file_exists(THEMEPATH . $theme_name)) {
-      module::set_var("gallery", "active_admin_theme", "admin_wind");
-      theme::load_themes();
-      Kohana::log("error", "Unable to locate theme '$theme_name', switching to default theme.");
-    }
     parent::__construct($name);
 
     $this->theme_name = module::get_var("gallery", "active_admin_theme");
diff --git a/modules/gallery/libraries/Form_Uploadify.php b/modules/gallery/libraries/Form_Uploadify.php
index b1d9fa74..9d76153d 100644
--- a/modules/gallery/libraries/Form_Uploadify.php
+++ b/modules/gallery/libraries/Form_Uploadify.php
@@ -45,6 +45,7 @@ class Form_Uploadify_Core extends Form_Input {
     $v = new View("form_uploadify.html");
     $v->album = $this->data["album"];
     $v->script_data = $this->data["script_data"];
+    $v->simultaneous_upload_limit = module::get_var("gallery", "simultaneous_upload_limit");
     return $v;
   }
 
diff --git a/modules/gallery/libraries/ORM_MPTT.php b/modules/gallery/libraries/ORM_MPTT.php
index 83d2445c..ebd7abc2 100644
--- a/modules/gallery/libraries/ORM_MPTT.php
+++ b/modules/gallery/libraries/ORM_MPTT.php
@@ -48,6 +48,7 @@ class ORM_MPTT_Core extends ORM {
    */
   function add_to_parent($parent) {
     $this->lock();
+    $parent->reload();  // Assume that the prior lock holder may have changed the parent
 
     try {
       // Make a hole in the parent for this new item
@@ -91,6 +92,7 @@ class ORM_MPTT_Core extends ORM {
     }
 
     $this->lock();
+    $this->reload();  // Assume that the prior lock holder may have changed this entry
     try {
       $this->db->query(
         "UPDATE {{$this->table_name}} SET `left_ptr` = `left_ptr` - 2 WHERE `left_ptr` > {$this->right_ptr}");
@@ -224,6 +226,8 @@ class ORM_MPTT_Core extends ORM {
     $level_delta = ($target->level + 1) - $this->level;
 
     $this->lock();
+    $this->reload();  // Assume that the prior lock holder may have changed this entry
+    $target->reload();
     try {
       if ($level_delta) {
         // Update the levels for the to-be-moved items
diff --git a/modules/gallery/libraries/Theme_View.php b/modules/gallery/libraries/Theme_View.php
index b64deab9..f78a7018 100644
--- a/modules/gallery/libraries/Theme_View.php
+++ b/modules/gallery/libraries/Theme_View.php
@@ -29,12 +29,6 @@ class Theme_View_Core extends Gallery_View {
    * @return  void
    */
   public function __construct($name, $page_type, $page_subtype) {
-    $theme_name = module::get_var("gallery", "active_site_theme");
-    if (!file_exists(THEMEPATH . $theme_name)) {
-      module::set_var("gallery", "active_site_theme", "wind");
-      theme::load_themes();
-      Kohana::log("error", "Unable to locate theme '$theme_name', switching to default theme.");
-    }
     parent::__construct($name);
 
     $this->theme_name = module::get_var("gallery", "active_site_theme");
@@ -271,6 +265,13 @@ class Theme_View_Core extends Gallery_View {
         }
       }
 
+      $helper_class = theme::$site_theme_name . "_theme";
+      if (method_exists($helper_class, $function)) {
+        $blocks[] = call_user_func_array(
+          array($helper_class, $function),
+          array_merge(array($this), $args));
+      }
+
       if ($function == "head") {
         array_unshift($blocks, $this->combine_files($this->css, "css"));
         array_unshift($blocks, $this->combine_files($this->scripts, "javascript"));
diff --git a/modules/gallery/module.info b/modules/gallery/module.info
index ba1ee91d..b3366f7d 100644
--- a/modules/gallery/module.info
+++ b/modules/gallery/module.info
@@ -1,5 +1,4 @@
 name = "Gallery 3"
 description = "Gallery core application"
-; Note: skip version 20, use 21 as the next version
-version = 19
+version = 21
 
diff --git a/modules/gallery/tests/Albums_Controller_Test.php b/modules/gallery/tests/Albums_Controller_Test.php
index 8562355c..9b904387 100644
--- a/modules/gallery/tests/Albums_Controller_Test.php
+++ b/modules/gallery/tests/Albums_Controller_Test.php
@@ -48,7 +48,8 @@ class Albums_Controller_Test extends Unit_Test_Case {
     access::allow(identity::everybody(), "edit", $root);
 
     ob_start();
-    $controller->_update($this->_album);
+    $controller->update($this->_album->id);
+    $this->_album->reload();
     $results = ob_get_contents();
     ob_end_clean();
 
diff --git a/modules/gallery/tests/Controller_Auth_Test.php b/modules/gallery/tests/Controller_Auth_Test.php
index 0a7076c6..124d8b4c 100644
--- a/modules/gallery/tests/Controller_Auth_Test.php
+++ b/modules/gallery/tests/Controller_Auth_Test.php
@@ -18,11 +18,6 @@
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
 class Controller_Auth_Test extends Unit_Test_Case {
-  static $rest_methods = array("_index", "_show", "_form_edit", "_form_add", "_create",
-                               "_update", "_delete");
-
-  static $rest_methods_with_csrf_check = array("_update", "_delete", "_create");
-
   public function find_missing_auth_test() {
     $found = array();
     $controllers = explode("\n", `git ls-files '*/*/controllers/*.php'`);
@@ -46,7 +41,6 @@ class Controller_Auth_Test extends Unit_Test_Case {
       }
 
       $is_admin_controller = false;
-      $is_rest_controller = false;
 
       $open_braces = 0;
       $function = null;
@@ -64,7 +58,6 @@ class Controller_Auth_Test extends Unit_Test_Case {
               $function = null;
             } else if ($open_braces == 0) {
               $is_admin_controller = false;
-              $is_rest_controller = false;
             }
           } else if ($token == "{") {
             $open_braces++;
@@ -75,8 +68,6 @@ class Controller_Auth_Test extends Unit_Test_Case {
           if ($open_braces == 0 && $token[0] == T_EXTENDS) {
             if (self::_token_matches(array(T_STRING, "Admin_Controller"), $tokens, $token_number + 1)) {
               $is_admin_controller = true;
-            } else if (self::_token_matches(array(T_STRING, "REST_Controller"), $tokens, $token_number + 1)) {
-              $is_rest_controller = true;
             }
           } else if ($open_braces == 1 && $token[0] == T_FUNCTION) {
             $line = $token[2];
@@ -101,13 +92,8 @@ class Controller_Auth_Test extends Unit_Test_Case {
 
             $is_rss_feed = $name == "feed" && strpos(basename($controller), "_rss.php");
 
-            if ((!$is_static || $is_rss_feed) &&
-                (!$is_private ||
-                 ($is_rest_controller && in_array($name, self::$rest_methods)))) {
+            if ((!$is_static || $is_rss_feed) && !$is_private) {
               $function = self::_function($name, $line, $is_admin_controller);
-              if ($is_rest_controller && in_array($name, self::$rest_methods_with_csrf_check)) {
-                $function->checks_csrf(true);
-              }
             }
           }
 
diff --git a/modules/gallery/tests/Database_Test.php b/modules/gallery/tests/Database_Test.php
index ad2bbba1..98bd4046 100644
--- a/modules/gallery/tests/Database_Test.php
+++ b/modules/gallery/tests/Database_Test.php
@@ -138,7 +138,6 @@ class Database_For_Test extends Database {
 
   public function query($sql = '') {
     if (!empty($sql)) {
-      print " query($sql)\n";
       $sql = $this->add_table_prefixes($sql);
     }
     return $sql;
diff --git a/modules/gallery/tests/Photos_Controller_Test.php b/modules/gallery/tests/Photos_Controller_Test.php
index 624e6878..fa4f101a 100644
--- a/modules/gallery/tests/Photos_Controller_Test.php
+++ b/modules/gallery/tests/Photos_Controller_Test.php
@@ -44,7 +44,8 @@ class Photos_Controller_Test extends Unit_Test_Case {
     access::allow(identity::everybody(), "edit", $root);
 
     ob_start();
-    $controller->_update($photo);
+    $controller->update($photo->id);
+    $photo->reload();
     $results = ob_get_contents();
     ob_end_clean();
 
diff --git a/modules/gallery/tests/REST_Controller_Test.php b/modules/gallery/tests/REST_Controller_Test.php
deleted file mode 100644
index 8fb04d86..00000000
--- a/modules/gallery/tests/REST_Controller_Test.php
+++ /dev/null
@@ -1,197 +0,0 @@
-<?php defined("SYSPATH") or die("No direct script access.");
-/**
- * Gallery - a web based photo album viewer and editor
- * Copyright (C) 2000-2009 Bharat Mediratta
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or (at
- * your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
- */
-class REST_Controller_Test extends Unit_Test_Case {
-  public function setup() {
-    $this->_post = $_POST;
-    $this->mock_controller = new Mock_RESTful_Controller("mock");
-    $this->mock_not_loaded_controller = new Mock_RESTful_Controller("mock_not_loaded");
-    $_POST = array();
-  }
-
-  public function teardown() {
-    $_POST = $this->_post;
-  }
-
-  public function dispatch_index_test() {
-    $_SERVER["REQUEST_METHOD"] = "GET";
-    $_POST["_method"] = "";
-    $this->mock_controller->__call("index", "");
-    $this->assert_equal("index", $this->mock_controller->method_called);
-  }
-
-  public function dispatch_show_test() {
-    $_SERVER["REQUEST_METHOD"] = "GET";
-    $_POST["_method"] = "";
-    $this->mock_controller->__call("3", "");
-    $this->assert_equal("show", $this->mock_controller->method_called);
-    $this->assert_equal("Mock_Model", get_class($this->mock_controller->resource));
-  }
-
-  public function dispatch_update_test() {
-    $_SERVER["REQUEST_METHOD"] = "POST";
-    $_POST["_method"] = "PUT";
-    $_POST["csrf"] = access::csrf_token();
-    $this->mock_controller->__call("3", "");
-    $this->assert_equal("update", $this->mock_controller->method_called);
-    $this->assert_equal("Mock_Model", get_class($this->mock_controller->resource));
-  }
-
-  public function dispatch_update_fails_without_csrf_test() {
-    $_SERVER["REQUEST_METHOD"] = "POST";
-    $_POST["_method"] = "PUT";
-    try {
-      $this->mock_controller->__call("3", "");
-      $this->assert_false(true, "this should fail with a forbidden exception");
-    } catch (Exception $e) {
-      // pass
-    }
-  }
-
-  public function dispatch_delete_test() {
-    $_SERVER["REQUEST_METHOD"] = "POST";
-    $_POST["_method"] = "DELETE";
-    $_POST["csrf"] = access::csrf_token();
-    $this->mock_controller->__call("3", "");
-    $this->assert_equal("delete", $this->mock_controller->method_called);
-    $this->assert_equal("Mock_Model", get_class($this->mock_controller->resource));
-  }
-
-  public function dispatch_delete_fails_without_csrf_test() {
-    $_SERVER["REQUEST_METHOD"] = "POST";
-    $_POST["_method"] = "DELETE";
-    try {
-      $this->mock_controller->__call("3", "");
-      $this->assert_false(true, "this should fail with a forbidden exception");
-    } catch (Exception $e) {
-      // pass
-    }
-  }
-
-  public function dispatch_404_test() {
-    /* The dispatcher should throw a 404 if the resource isn't loaded and the method isn't POST. */
-    $methods = array(
-      array("GET", ""),
-      array("POST", "PUT"),
-      array("POST", "DELETE"));
-
-    foreach ($methods as $method) {
-      $_SERVER["REQUEST_METHOD"] = $method[0];
-      $_POST["_method"] = $method[1];
-      $exception_caught = false;
-      try {
-        $this->mock_not_loaded_controller->__call(rand(), "");
-      } catch (Kohana_404_Exception $e) {
-        $exception_caught = true;
-      }
-      $this->assert_true($exception_caught, "$method[0], $method[1]");
-    }
-  }
-
-  public function dispatch_create_test() {
-    $_SERVER["REQUEST_METHOD"] = "POST";
-    $_POST["_method"] = "";
-    $_POST["csrf"] = access::csrf_token();
-    $this->mock_not_loaded_controller->__call("", "");
-    $this->assert_equal("create", $this->mock_not_loaded_controller->method_called);
-    $this->assert_equal(
-      "Mock_Not_Loaded_Model", get_class($this->mock_not_loaded_controller->resource));
-  }
-
-  public function dispatch_create_fails_without_csrf_test() {
-    $_SERVER["REQUEST_METHOD"] = "POST";
-    $_POST["_method"] = "";
-    try {
-      $this->mock_not_loaded_controller->__call("", "");
-      $this->assert_false(true, "this should fail with a forbidden exception");
-    } catch (Exception $e) {
-      // pass
-    }
-  }
-
-  public function dispatch_form_test_add() {
-    $this->mock_controller->form_add("args");
-    $this->assert_equal("form_add", $this->mock_controller->method_called);
-    $this->assert_equal("args", $this->mock_controller->resource);
-  }
-
-  public function dispatch_form_test_edit() {
-    $this->mock_controller->form_edit("1");
-    $this->assert_equal("form_edit", $this->mock_controller->method_called);
-    $this->assert_equal("Mock_Model", get_class($this->mock_controller->resource));
-  }
-
-  public function routes_test() {
-    $this->assert_equal("mock/form_add/args", router::routed_uri("form/add/mock/args"));
-    $this->assert_equal("mock/form_edit/args", router::routed_uri("form/edit/mock/args"));
-    $this->assert_equal(null, router::routed_uri("rest/args"));
-  }
-}
-
-class Mock_RESTful_Controller extends REST_Controller {
-  public $method_called;
-  public $resource;
-
-  public function __construct($type) {
-    $this->resource_type = $type;
-    parent::__construct();
-  }
-
-  public function _index() {
-    $this->method_called = "index";
-  }
-
-  public function _create($resource) {
-    $this->method_called = "create";
-    $this->resource = $resource;
-  }
-
-  public function _show($resource) {
-    $this->method_called = "show";
-    $this->resource = $resource;
-  }
-
-  public function _update($resource) {
-    $this->method_called = "update";
-    $this->resource = $resource;
-  }
-
-  public function _delete($resource) {
-    $this->method_called = "delete";
-    $this->resource = $resource;
-  }
-
-  public function _form_add($args) {
-    $this->method_called = "form_add";
-    $this->resource = $args;
-  }
-
-  public function _form_edit($resource) {
-    $this->method_called = "form_edit";
-    $this->resource = $resource;
-  }
-}
-
-class Mock_Model {
-  public $loaded = true;
-}
-
-class Mock_Not_Loaded_Model {
-  public $loaded = false;
-}
diff --git a/modules/gallery/tests/REST_Helper_Test.php b/modules/gallery/tests/REST_Helper_Test.php
deleted file mode 100644
index 1bfc63ab..00000000
--- a/modules/gallery/tests/REST_Helper_Test.php
+++ /dev/null
@@ -1,45 +0,0 @@
-<?php defined("SYSPATH") or die("No direct script access.");
-/**
- * Gallery - a web based photo album viewer and editor
- * Copyright (C) 2000-2009 Bharat Mediratta
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or (at
- * your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
- */
-class REST_Helper_Test extends Unit_Test_Case {
-  public function setup() {
-    $this->_post = $_POST;
-  }
-
-  public function teardown() {
-    $_POST = $this->_post;
-  }
-
-  public function request_method_test() {
-    foreach (array("GET", "POST") as $method) {
-      foreach (array("", "PUT", "DELETE") as $tunnel) {
-        if ($method == "GET") {
-          $expected = "GET";
-        } else {
-          $expected = $tunnel == "" ? $method : $tunnel;
-        }
-        $_SERVER["REQUEST_METHOD"] = $method;
-        $_POST["_method"] = $tunnel;
-
-        $this->assert_equal(strtolower(rest::request_method()), strtolower($expected),
-          "Request method: {$method}, tunneled: {$tunnel}");
-      }
-    }
-  }
-}
diff --git a/modules/gallery/tests/controller_auth_data.txt b/modules/gallery/tests/controller_auth_data.txt
index 30102538..1fe29ffb 100644
--- a/modules/gallery/tests/controller_auth_data.txt
+++ b/modules/gallery/tests/controller_auth_data.txt
@@ -1,11 +1,9 @@
 modules/comment/controllers/admin_comments.php               queue                DIRTY_CSRF
-modules/comment/controllers/comments.php                     _index               DIRTY_CSRF
 modules/comment/helpers/comment_rss.php                      feed                 DIRTY_AUTH
 modules/digibug/controllers/digibug.php                      print_proxy          DIRTY_CSRF|DIRTY_AUTH
 modules/digibug/controllers/digibug.php                      close_window         DIRTY_AUTH
 modules/gallery/controllers/admin.php                        __call               DIRTY_AUTH
 modules/gallery/controllers/albums.php                       _show                DIRTY_CSRF
-modules/gallery/controllers/albums.php                       _form_add            DIRTY_CSRF
 modules/gallery/controllers/combined.php                     javascript           DIRTY_AUTH
 modules/gallery/controllers/combined.php                     css                  DIRTY_AUTH
 modules/gallery/controllers/file_proxy.php                   __call               DIRTY_CSRF|DIRTY_AUTH
@@ -15,17 +13,6 @@ modules/gallery/controllers/login.php                        html
 modules/gallery/controllers/login.php                        auth_html            DIRTY_AUTH
 modules/gallery/controllers/logout.php                       index                DIRTY_CSRF|DIRTY_AUTH
 modules/gallery/controllers/maintenance.php                  index                DIRTY_AUTH
-modules/gallery/controllers/rest.php                         __construct          DIRTY_AUTH
-modules/gallery/controllers/rest.php                         __call               DIRTY_AUTH
-modules/gallery/controllers/rest.php                         form_edit            DIRTY_AUTH
-modules/gallery/controllers/rest.php                         form_add             DIRTY_AUTH
-modules/gallery/controllers/rest.php                         _index               DIRTY_AUTH
-modules/gallery/controllers/rest.php                         _create              DIRTY_AUTH
-modules/gallery/controllers/rest.php                         _show                DIRTY_AUTH
-modules/gallery/controllers/rest.php                         _update              DIRTY_AUTH
-modules/gallery/controllers/rest.php                         _delete              DIRTY_AUTH
-modules/gallery/controllers/rest.php                         _form_add            DIRTY_AUTH
-modules/gallery/controllers/rest.php                         _form_edit           DIRTY_AUTH
 modules/gallery/controllers/simple_uploader.php              start                DIRTY_AUTH
 modules/gallery/controllers/simple_uploader.php              finish               DIRTY_AUTH
 modules/gallery/controllers/upgrader.php                     index                DIRTY_AUTH
@@ -35,6 +22,7 @@ modules/search/controllers/search.php                        index
 modules/server_add/controllers/admin_server_add.php          autocomplete         DIRTY_CSRF
 modules/server_add/controllers/server_add.php                children             DIRTY_CSRF
 modules/tag/controllers/admin_tags.php                       index                DIRTY_CSRF
-modules/tag/controllers/tags.php                             _show                DIRTY_CSRF|DIRTY_AUTH
+modules/tag/controllers/tags.php                             show                 DIRTY_CSRF|DIRTY_AUTH
+modules/tag/controllers/tags.php                             autocomplete         DIRTY_CSRF|DIRTY_AUTH
 modules/user/controllers/password.php                        reset                DIRTY_AUTH
 modules/user/controllers/password.php                        do_reset             DIRTY_CSRF|DIRTY_AUTH
diff --git a/modules/gallery/tests/xss_data.txt b/modules/gallery/tests/xss_data.txt
index fa818636..3708bc6d 100644
--- a/modules/gallery/tests/xss_data.txt
+++ b/modules/gallery/tests/xss_data.txt
@@ -298,8 +298,8 @@ modules/server_add/views/server_add_tree_dialog.html.php     4   DIRTY_JS url::s
 modules/server_add/views/server_add_tree_dialog.html.php     21  DIRTY    $tree
 modules/tag/views/admin_tags.html.php                        45  DIRTY_ATTR $tag->id
 modules/tag/views/admin_tags.html.php                        46  DIRTY    $tag->count
-modules/tag/views/tag_block.html.php                         27  DIRTY    $cloud
-modules/tag/views/tag_block.html.php                         29  DIRTY    $form
+modules/tag/views/tag_block.html.php                         25  DIRTY    $cloud
+modules/tag/views/tag_block.html.php                         27  DIRTY    $form
 modules/tag/views/tag_cloud.html.php                         4   DIRTY_ATTR (int)(($tag->count/$max_count)*7)
 modules/tag/views/tag_cloud.html.php                         5   DIRTY    $tag->count
 modules/tag/views/tag_cloud.html.php                         6   DIRTY_JS $tag->url()
diff --git a/modules/gallery/views/form_uploadify.html.php b/modules/gallery/views/form_uploadify.html.php
index 5e99c8d5..d856c464 100644
--- a/modules/gallery/views/form_uploadify.html.php
+++ b/modules/gallery/views/form_uploadify.html.php
@@ -24,7 +24,7 @@
       fileDesc: <?= t("Photos and movies")->for_js() ?>,
       cancelImg: "<?= url::file("lib/uploadify/cancel.png") ?>",
       buttonText: <?= t("Select photos...")->for_js() ?>,
-      simUploadLimit: 10,
+      simUploadLimit: <?= $simultaneous_upload_limit ?>,
       wmode: "transparent",
       hideButton: true, /* should be true */
       auto: true,
diff --git a/modules/rss/controllers/rss.php b/modules/rss/controllers/rss.php
index 1ecec9af..ed2acef8 100644
--- a/modules/rss/controllers/rss.php
+++ b/modules/rss/controllers/rss.php
@@ -62,7 +62,7 @@ class Rss_Controller extends Controller {
         url::abs_site(str_replace("&", "&amp;", url::merge(array("page" => $page + 1))));
     }
 
-    rest::http_content_type(rest::RSS);
+    header("Content-Type: application/rss+xml");
     print $view;
   }
 }
\ No newline at end of file
diff --git a/modules/rss/helpers/rss.php b/modules/rss/helpers/rss.php
index 81ff175f..4260206c 100644
--- a/modules/rss/helpers/rss.php
+++ b/modules/rss/helpers/rss.php
@@ -31,6 +31,6 @@ class rss_Core {
    */
   static function feed_link($uri) {
     $url = url::site("rss/feed/$uri");
-    return "<link rel=\"alternate\" type=\"" . rest::RSS . "\" href=\"$url\" />";
+    return "<link rel=\"alternate\" type=\"application/rss+xml\" href=\"$url\" />";
   }
 }
\ No newline at end of file
diff --git a/modules/tag/controllers/tags.php b/modules/tag/controllers/tags.php
index 52001719..9f9e45d9 100644
--- a/modules/tag/controllers/tags.php
+++ b/modules/tag/controllers/tags.php
@@ -17,10 +17,9 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
-class Tags_Controller extends REST_Controller {
-  protected $resource_type = "tag";
-
-  public function _show($tag) {
+class Tags_Controller extends Controller {
+  public function show($tag_id) {
+    $tag = ORM::factory("tag", $tag_id);
     $page_size = module::get_var("gallery", "page_size", 9);
     $page = (int) $this->input->get("page", "1");
     $children_count = $tag->items_count();
@@ -47,15 +46,15 @@ class Tags_Controller extends REST_Controller {
     print $template;
   }
 
-  public function _index() {
+  public function index() {
     // Far from perfection, but at least require view permission for the root album
     $album = ORM::factory("item", 1);
     access::required("view", $album);
     print tag::cloud(30);
   }
 
-  public function _create($tag) {
-    $item = ORM::factory("item", $this->input->post("item_id"));
+  public function create($item_id) {
+    $item = ORM::factory("item", $item_id);
     access::required("view", $item);
     access::required("edit", $item);
 
@@ -70,8 +69,7 @@ class Tags_Controller extends REST_Controller {
 
       print json_encode(
         array("result" => "success",
-              "resource" => url::site("tags/{$tag->id}"),
-              "form" => tag::get_add_form($item)->__toString()));
+              "cloud" => tag::cloud(30)->__toString()));
     } else {
       print json_encode(
         array("result" => "error",
@@ -79,14 +77,6 @@ class Tags_Controller extends REST_Controller {
     }
   }
 
-  public function _form_add($item_id) {
-    $item = ORM::factory("item", $item_id);
-    access::required("view", $item);
-    access::required("edit", $item);
-
-    return tag::get_add_form($item);
-  }
-
   public function autocomplete() {
     $tags = array();
     $tag_parts = preg_split("#,#", $this->input->get("q"));
diff --git a/modules/tag/helpers/tag.php b/modules/tag/helpers/tag.php
index feaf40c5..89a27034 100644
--- a/modules/tag/helpers/tag.php
+++ b/modules/tag/helpers/tag.php
@@ -101,7 +101,7 @@ class tag_Core {
   }
 
   static function get_add_form($item) {
-    $form = new Forge("tags", "", "post", array("id" => "g-add-tag-form", "class" => "g-short-form"));
+    $form = new Forge("tags/create/{$item->id}", "", "post", array("id" => "g-add-tag-form", "class" => "g-short-form"));
     $label = $item->is_album() ?
       t("Add tag to album") :
       ($item->is_photo() ? t("Add tag to photo") : t("Add tag to movie"));
diff --git a/modules/tag/models/tag.php b/modules/tag/models/tag.php
index 49512daa..be020f5f 100644
--- a/modules/tag/models/tag.php
+++ b/modules/tag/models/tag.php
@@ -110,7 +110,7 @@ class Tag_Model extends ORM {
    * @param string $query the query string (eg "page=3")
    */
   public function url($query=null) {
-    $url = url::site("tags/$this->id");
+    $url = url::site("tags/show/$this->id");
     if ($query) {
       $url .= "?$query";
     }
diff --git a/modules/tag/views/tag_block.html.php b/modules/tag/views/tag_block.html.php
index 00b57360..8b887282 100644
--- a/modules/tag/views/tag_block.html.php
+++ b/modules/tag/views/tag_block.html.php
@@ -14,9 +14,7 @@
       dataType: "json",
       success: function(data) {
         if (data.result == "success") {
-          $.get($("#g-tag-cloud").attr("ref"), function(data, textStatus) {
-            $("#g-tag-cloud").html(data);
-          });
+          $("#g-tag-cloud").html(data.cloud);
         }
         $("#g-add-tag-form").resetForm();
       }