21 files changed, 250 insertions, 386 deletions

diff --git a/core/controllers/albums.php b/core/controllers/albums.php
index 10887592..47412dfc 100644
--- a/core/controllers/albums.php
+++ b/core/controllers/albums.php
@@ -82,10 +82,15 @@ class Albums_Controller extends Items_Controller {
       log::add("content", "Created an album", log::INFO,
                html::anchor("albums/$new_album->id", "view album"));
       message::add(_("Successfully created album"));
-      rest::http_status(rest::CREATED);
-      rest::http_location(url::site("albums/$new_album->id"));
+
+      print json_encode(
+        array("result" => "success",
+              "location" => url::site("albums/$new_album->id"),
+              "resource" => url::site("albums/$new_album->id")));
     } else {
-      print $form;
+      print json_encode(
+        array("result" => "error",
+              "form" => $form->__toString()));
     }
   }
 
@@ -105,11 +110,15 @@ class Albums_Controller extends Items_Controller {
       log::add("content", "Added a photo", log::INFO,
                html::anchor("photos/$photo->id", "view photo"));
       message::add(_("Successfully added photo"));
-      //rest::http_status(rest::CREATED);
-      //rest::http_location(url::site("photos/$photo->id"));
-      print "<h1>this is a response</h1>";
+
+      print json_encode(
+        array("result" => "success",
+              "resource" => url::site("photos/$photo->id"),
+              "location" => url::site("photos/$photo->id")));
     } else {
-      print $form;
+      print json_encode(
+        array("result" => "error",
+              "form" => $form->__toString()));
     }
   }
 
@@ -132,12 +141,15 @@ class Albums_Controller extends Items_Controller {
 
       log::add("content", "Updated album", log::INFO, "<a href=\"albums/$album->id\">view</a>");
       message::add(_("Successfully saved album"));
-      rest::http_status(rest::CREATED);
-      rest::http_location(url::site("albums/$album->id"));
+
+      print json_encode(
+        array("result" => "success",
+              "location" => url::site("albums/$album->id")));
     } else {
-      rest::html($form);
+      print json_encode(
+        array("result" => "error",
+              "form" => $form->__toString()));
     }
-    rest::respond();
   }
 
   /**
@@ -149,11 +161,11 @@ class Albums_Controller extends Items_Controller {
 
     switch ($this->input->get("type")) {
     case "album":
-      print album::get_add_form($album)->render();
+      print album::get_add_form($album);
       break;
 
     case "photo":
-      print photo::get_add_form($album)->render();
+      print photo::get_add_form($album);
       break;
 
     default:
diff --git a/core/controllers/items.php b/core/controllers/items.php
index ab63889e..60b2762f 100644
--- a/core/controllers/items.php
+++ b/core/controllers/items.php
@@ -20,27 +20,6 @@
 class Items_Controller extends REST_Controller {
   protected $resource_type = "item";
 
-  /**
-   *  @see REST_Controller::_index()
-   */
-  public function _index() {
-    throw new Exception("@todo Item_Controller::_index NOT IMPLEMENTED");
-  }
-
-  /**
-   *  @see REST_Controller::_form_add($parameters)
-   */
-  public function _form_add($parameters) {
-    throw new Exception("@todo Items_Controller::_form_add NOT IMPLEMENTED");
-  }
-
-  /**
-   *  @see REST_Controller::_form_edit($resource)
-   */
-  public function _form_edit($item) {
-    throw new Exception("@todo Items_Controller::_form_edit NOT IMPLEMENTED");
-  }
-
   public function _show($item) {
     // Redirect to the more specific resource type, since it will render
     // differently.  We could also just delegate here, but it feels more appropriate
@@ -48,16 +27,4 @@ class Items_Controller extends REST_Controller {
     access::required("view", $item);
     return url::redirect("{$item->type}s/$item->id");
   }
-
-  public function _delete($item) {
-    throw new Exception("@todo Item_Controller::_delete NOT IMPLEMENTED");
-  }
-
-  public function _create($item) {
-    throw new Exception("@todo Item_Controller::_create NOT IMPLEMENTED");
-  }
-
-  public function _update($item) {
-    throw new Exception("@todo Item_Controller::_update NOT IMPLEMENTED");
-  }
 }
diff --git a/core/controllers/photos.php b/core/controllers/photos.php
index a8282f36..04553bd1 100644
--- a/core/controllers/photos.php
+++ b/core/controllers/photos.php
@@ -59,12 +59,14 @@ class Photos_Controller extends Items_Controller {
       log::add("content", "Updated photo", log::INFO, "<a href=\"photos/$photo->id\">view</a>");
       message::add(_("Successfully saved photo"));
 
-      rest::http_status(rest::FOUND);
-      rest::http_location(url::site("photos/$photo->id"));
+      print json_encode(
+        array("result" => "success",
+              "location" => url::site("photos/$photo->id")));
     } else {
-      rest::html($form);
+      print json_encode(
+        array("result" => "error",
+              "form" => $form->__toString()));
     }
-    rest::respond();
   }
 
   /**
diff --git a/core/controllers/rest.php b/core/controllers/rest.php
index 0ac7a1c9..ceca321e 100644
--- a/core/controllers/rest.php
+++ b/core/controllers/rest.php
@@ -55,11 +55,11 @@
  *   }
  *
  * A request to http://example.com/gallery3/comments/3 will result in a call to
- * REST_Controller::dispatch(3) which will load up the comment associated with id 3.  If there's
+ * REST_Controller::__call(3) which will load up the comment associated with id 3.  If there's
  * no such comment, it returns a 404.  Otherwise, it will then delegate to
  * Comment_Controller::get() with the ORM instance as an argument.
  */
-abstract class REST_Controller extends Controller {
+class REST_Controller extends Controller {
   protected $resource_type = null;
 
   public function __construct() {
@@ -125,41 +125,55 @@ abstract class REST_Controller extends Controller {
    * Perform a GET request on the controller root
    * (e.g. http://www.example.com/gallery3/comments)
    */
-  abstract public function _index();
+  public function _index() {
+    throw new Exception("@todo _create NOT IMPLEMENTED");
+  }
 
   /**
    * Perform a POST request on this resource
    * @param ORM $resource the instance of this resource type
    */
-  abstract public function _create($resource);
+  public function _create($resource) {
+    throw new Exception("@todo _create NOT IMPLEMENTED");
+  }
 
   /**
    * Perform a GET request on this resource
    * @param ORM $resource the instance of this resource type
    */
-  abstract public function _show($resource);
+  public function _show($resource) {
+    throw new Exception("@todo _show NOT IMPLEMENTED");
+  }
 
   /**
    * Perform a PUT request on this resource
    * @param ORM $resource the instance of this resource type
    */
-  abstract public function _update($resource);
+  public function _update($resource) {
+    throw new Exception("@todo _update NOT IMPLEMENTED");
+  }
 
   /**
    * Perform a DELETE request on this resource
    * @param ORM $resource the instance of this resource type
    */
-  abstract public function _delete($resource);
+  public function _delete($resource) {
+    throw new Exception("@todo _delete NOT IMPLEMENTED");
+  }
 
   /**
    * Present a form for adding a new resource
    * @param string part of the URI after the controller name
    */
-  abstract public function _form_add($parameter);
+  public function _form_add($parameter) {
+    throw new Exception("@todo _form_add NOT IMPLEMENTED");
+  }
 
   /**
    * Present a form for editing an existing resource
    * @param ORM $resource the resource container for instances of this resource type
    */
-  abstract public function _form_edit($resource);
+  public function _form_edit($resource) {
+    throw new Exception("@todo _form_edit NOT IMPLEMENTED");
+  }
 }
diff --git a/core/helpers/core_menu.php b/core/helpers/core_menu.php
index 685ccf64..0a28f21f 100644
--- a/core/helpers/core_menu.php
+++ b/core/helpers/core_menu.php
@@ -57,11 +57,6 @@ class core_menu_Core {
                    ->label(_("Add an album"))
                    ->url(url::site("form/add/albums/$item->id?type=album")));
       }
-
-      $admin_menu->append(Menu::factory("dialog")
-                          ->id("edit")
-                          ->label(_("Edit"))
-                          ->url(url::site("form/edit/{$item->type}s/$item->id")));
     }
 
     if (user::active()->admin) {
diff --git a/modules/comment/controllers/comments.php b/modules/comment/controllers/comments.php
index e759309f..e6ade267 100644
--- a/modules/comment/controllers/comments.php
+++ b/modules/comment/controllers/comments.php
@@ -56,8 +56,10 @@ class Comments_Controller extends REST_Controller {
    */
   public function _create($comment) {
     rest::http_content_type(rest::JSON);
+    $item = ORM::factory("item", $this->input->post("item_id"));
+    access::required("view", $item);
 
-    $form = comment::get_add_form($this->input->post("item_id"));
+    $form = comment::get_add_form($item);
     if ($form->validate()) {
       $comment->author = $this->input->post("author");
       $comment->email = $this->input->post("email");
@@ -71,7 +73,7 @@ class Comments_Controller extends REST_Controller {
       print json_encode(
         array("result" => "success",
               "resource" => url::site("comments/{$comment->id}"),
-              "form" => comment::get_add_form($this->input->post("item_id"))->__toString()));
+              "form" => comment::get_add_form($item)->__toString()));
     } else {
       print json_encode(
         array("result" => "error",
@@ -86,7 +88,9 @@ class Comments_Controller extends REST_Controller {
    */
   public function _show($comment) {
     if (rest::output_format() == "json") {
-      print json_encode(array("result" => "success", "data" => $comment->as_array()));
+      print json_encode(
+        array("result" => "success",
+              "data" => $comment->as_array()));
     } else {
       $view = new View("comment.html");
       $view->comment = $comment;
@@ -135,8 +139,11 @@ class Comments_Controller extends REST_Controller {
    * Present a form for adding a new comment to this item or editing an existing comment.
    *  @see REST_Controller::form_add($resource)
    */
-  public function _form_add($item_id) {
-    print comment::get_add_form($item_id);
+  public function _form_add($item) {
+    $item = ORM::factory("item", $item_id);
+    access::required("view", $item);
+
+    print comment::get_add_form($item);
   }
 
   /**
diff --git a/modules/comment/helpers/comment.php b/modules/comment/helpers/comment.php
index 51246444..79aa9ddc 100644
--- a/modules/comment/helpers/comment.php
+++ b/modules/comment/helpers/comment.php
@@ -52,13 +52,13 @@ class comment_Core {
     return $comment;
   }
 
-  static function get_add_form($item_id) {
+  static function get_add_form($item) {
     $form = new Forge(url::site("comments"), "", "post");
     $group = $form->group("add_comment")->label(_("Add comment"));
     $group->input("author") ->label(_("Author")) ->id("gAuthor");
     $group->input("email")  ->label(_("Email"))  ->id("gEmail");
     $group->textarea("text")->label(_("Text"))   ->id("gText");
-    $group->hidden("item_id")->value($item_id);
+    $group->hidden("item_id")->value($item->id);
     $group->submit(_("Add"));
     $form->add_rules_from(ORM::factory("comment"));
     return $form;
diff --git a/modules/comment/js/comment.js b/modules/comment/js/comment.js
index 3ae23f62..c9cfeb08 100644
--- a/modules/comment/js/comment.js
+++ b/modules/comment/js/comment.js
@@ -6,8 +6,10 @@ function ajaxify_comment_form() {
   $("#gComments form").ajaxForm({
     dataType: "json",
     success: function(data) {
-      $("#gComments form").replaceWith(data.form);
-      ajaxify_comment_form();
+      if (data.form) {
+	$("#gComments form").replaceWith(data.form);
+	ajaxify_comment_form();
+      }
       if (data.result == "success") {
         $.get(data.resource, function(data, textStatus) {
           $("#gComments .gBlockContent ul:first").append("<li>"+data+"</li>");
diff --git a/modules/tag/controllers/tags.php b/modules/tag/controllers/tags.php
index 69bc9a48..4f8cfa5b 100644
--- a/modules/tag/controllers/tags.php
+++ b/modules/tag/controllers/tags.php
@@ -42,31 +42,22 @@ class Tags_Controller extends REST_Controller {
   }
 
   public function _index() {
-    // @todo: represent this in different formats
     print tag::cloud(30);
   }
 
-  public function _form_add($item_id) {
-    return tag::get_add_form($item_id);
-  }
-
-  public function _form_edit($tag) {
-    throw new Exception("@todo Tag_Controller::_form_edit NOT IMPLEMENTED");
-  }
-
   public function _create($tag) {
     rest::http_content_type(rest::JSON);
     $item = ORM::factory("item", $this->input->post("item_id"));
     access::required("edit", $item);
 
-    $form = tag::get_add_form($item->id);
+    $form = tag::get_add_form($item);
     if ($form->validate()) {
       tag::add($item, $this->input->post("tag_name"));
 
       print json_encode(
         array("result" => "success",
               "resource" => url::site("tags/{$tag->id}"),
-              "form" => tag::get_add_form($item->id)->__toString()));
+              "form" => tag::get_add_form($item)->__toString()));
     } else {
       print json_encode(
         array("result" => "error",
@@ -74,11 +65,10 @@ class Tags_Controller extends REST_Controller {
     }
   }
 
-  public function _delete($tag) {
-    throw new Exception("@todo Tag_Controller::_delete NOT IMPLEMENTED");
-  }
+  public function _form_add($item_id) {
+    $item = ORM::factory("item", $item_id);
+    access::required("view", $item);
 
-  public function _update($tag) {
-    throw new Exception("@todo Tag_Controller::_update NOT IMPLEMENTED");
+    return tag::get_add_form($item);
   }
 }
diff --git a/modules/tag/helpers/tag.php b/modules/tag/helpers/tag.php
index 7e42ed50..b6d39213 100644
--- a/modules/tag/helpers/tag.php
+++ b/modules/tag/helpers/tag.php
@@ -79,11 +79,11 @@ class tag_Core {
     }
   }
 
-  public static function get_add_form($item_id) {
+  public static function get_add_form($item) {
     $form = new Forge(url::site("tags"), "", "post", array("id" => "gAddTagForm"));
     $group = $form->group("add_tag")->label(_("Add Tag"));
     $group->input("tag_name")->label(_("Add tag"));
-    $group->hidden("item_id")->value($item_id);
+    $group->hidden("item_id")->value($item->id);
     $group->submit(_("Add"));
     $form->add_rules_from(ORM::factory("tag"));
     return $form;
diff --git a/modules/tag/js/tag.js b/modules/tag/js/tag.js
index 92f585a5..fc74eb26 100644
--- a/modules/tag/js/tag.js
+++ b/modules/tag/js/tag.js
@@ -6,8 +6,10 @@ function ajaxify_tag_form() {
   $("#gTag form").ajaxForm({
     dataType: "json",
     success: function(data) {
-      $("#gTag form").replaceWith(data.form);
-      ajaxify_tag_form();
+      if (data.form) {
+        $("#gTag form").replaceWith(data.form);
+        ajaxify_tag_form();
+      }
       if (data.result == "success") {
         $.get($("#gTagCloud").attr("src"), function(data, textStatus) {
 	  $("#gTagCloud").html(data);
diff --git a/modules/user/controllers/admin_users.php b/modules/user/controllers/admin_users.php
index c39092b2..630b5764 100644
--- a/modules/user/controllers/admin_users.php
+++ b/modules/user/controllers/admin_users.php
@@ -26,6 +26,40 @@ class Admin_Users_Controller extends Controller {
     print $view;
   }
 
+  public function create() {
+    $form = user::get_add_form();
+    if ($form->validate()) {
+      $user = user::create($form->add_user->inputs["name"]->value,
+                           $form->add_user->full_name->value, $form->add_user->password->value);
+      $user->email = $form->add_user->email->value;
+      $user->save();
+      log::add(sprintf(_("Created user %s"), $user->name));
+      message::add(sprintf(_("Created user %s"), $user->name));
+      url::redirect("admin/users");
+    }
+
+    print $form;
+  }
+
+  public function delete($id) {
+    $user = ORM::factory("user", $id);
+    if (!$user->loaded) {
+      kohana::show_404();
+    }
+
+    $form = user::get_delete_form($user);
+    if ($form->validate()) {
+      $name = $user->name;
+      $user->delete();
+
+      log::add(sprintf(_("Deleted user %s"), $name));
+      message::add(sprintf(_("Deleted user %s"), $name));
+      url::redirect("admin/users");
+    }
+
+    print $form;
+  }
+
   public function edit($id) {
     $user = ORM::factory("user", $id);
     if (!$user->loaded) {
@@ -39,6 +73,7 @@ class Admin_Users_Controller extends Controller {
       $user->password = $form->edit_user->password->value;
       $user->email = $form->edit_user->email->value;
       $user->save();
+      message::add(sprintf(_("Changed user %s"), $user->name));
       url::redirect("admin/users/edit/$id");
     }
 
diff --git a/modules/user/controllers/groups.php b/modules/user/controllers/groups.php
deleted file mode 100644
index 7c68c405..00000000
--- a/modules/user/controllers/groups.php
+++ /dev/null
@@ -1,106 +0,0 @@
-<?php defined("SYSPATH") or die("No direct script access.");
-/**
- * Gallery - a web based photo album viewer and editor
- * Copyright (C) 2000-2008 Bharat Mediratta
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or (at
- * your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
- */
-class Groups_Controller extends REST_Controller {
-  protected $resource_type = "group";
-
-  /**
-   * Display comments based on criteria.
-   *  @see REST_Controller::_index()
-   */
-  public function _index() {
-    throw new Exception("@todo Group_Controller::_index NOT IMPLEMENTED");
-  }
-
-  /**
-   *  @see REST_Controller::_create($resource)
-   */
-  public function _create($resource) {
-    $form = group::get_add_form();
-    if ($form->validate()) {
-      group::create($form->add_group->gname->value);
-      if ($continue = $this->input->get("continue")) {
-        url::redirect($continue);
-      }
-    }
-    print $form;
-  }
-
-  /**
-   * @see REST_Controller::_show($resource)
-   */
-  public function _show($user) {
-    throw new Exception("@todo Group_Controller::_show NOT IMPLEMENTED");
-  }
-
-  /**
-   *  @see REST_Controller::_update($resource)
-   */
-  public function _update($group) {
-    $form = group::get_edit_form($group);
-    if ($form->validate()) {
-      $group->name = $form->edit_group->gname->value;
-      $group->save();
-      if ($continue = $this->input->get("continue")) {
-        url::redirect($continue);
-      }
-    }
-    print $form;
-  }
-
-  /**
-   *  @see REST_Controller::_delete($resource)
-   */
-  public function _delete($group) {
-    if (!(user::active()->admin) || $group->special) {
-      access::forbidden();
-    }
-    // Prevent CSRF
-    $form = group::get_delete_form($group);
-    if ($form->validate()) {
-      $group->delete();
-      if ($continue = $this->input->get("continue")) {
-        url::redirect($continue);
-      }
-    }
-    print $form;
-  }
-
-  /**
-   * Present a form for editing a user
-   *  @see REST_Controller::form($resource)
-   */
-  public function _form_edit($group) {
-    if ($group->guest || group::active()->id != $group->id) {
-      access::forbidden();
-    }
-
-    print group::get_edit_form(
-      $group,
-      "users/{$group->id}?_method=put&continue=" . $this->input->get("continue"));
-  }
-
-  /**
-   * Present a form for adding a user
-   *  @see REST_Controller::form($resource)
-   */
-  public function _form_add($parameters) {
-    throw new Exception("@todo Group_Controller::_form_add NOT IMPLEMENTED");
-  }
-}
diff --git a/modules/user/controllers/login.php b/modules/user/controllers/login.php
index 508d282d..48527a41 100644
--- a/modules/user/controllers/login.php
+++ b/modules/user/controllers/login.php
@@ -19,26 +19,45 @@
  */
 class Login_Controller extends Controller {
   public function index() {
-    $form = new Forge(url::current(true), "", "post", array("id" => "gLoginForm"));
-    $group = $form->group("login_form")->label(_("Login"));
-    $group->input("name")->label(_("Name"))->id("gName")->class(null);
-    $group->password("password")->label(_("Password"))->id("gPassword")->class(null);
-    $group->inputs["name"]->error_messages("invalid_login", _("Invalid name or password"));
+    if (request::method() == "post") {
+      $this->_try_login();
+    } else {
+      print $this->_login_form();
+    }
+  }
+
+  private function _try_login() {
+    $form = $this->_login_form();
 
-    if (request::method() == "post" && $form->validate()) {
-      $user = ORM::factory("user")->where("name", $group->inputs["name"]->value)->find();
-      if ($user->loaded &&
-          user::is_correct_password($user, $group->password->value)) {
-        user::login($user);
-        log::add("user", "User $user->name logged in");
-        rest::http_status(rest::ACCEPTED);
-      } else {
-        log::add("user", sprintf(_("Failed login for %s"), $group->inputs["name"]->value),
+    $valid = $form->validate();
+    if ($valid) {
+      $user = ORM::factory("user")->where("name", $form->login->inputs["name"]->value)->find();
+      if (!$user->loaded || !user::is_correct_password($user, $form->login->password->value)) {
+        log::add("user", sprintf(_("Failed login for %s"), $form->login->inputs["name"]->value),
                  log::WARNING);
-        $group->inputs["name"]->add_error("invalid_login", 1);
+        $form->login->inputs["name"]->add_error("invalid_login", 1);
+        $valid = false;
       }
     }
 
-    print $form->render();
+    if ($valid) {
+      user::login($user);
+      log::add("user", "User $user->name logged in");
+      print json_encode(
+        array("result" => "success"));
+    } else {
+      print json_encode(
+        array("result" => "error",
+              "form" => $form->__toString()));
+    }
+  }
+
+  private function _login_form() {
+    $form = new Forge(url::current(true), "", "post", array("id" => "gLoginForm"));
+    $group = $form->group("login")->label(_("Login"));
+    $group->input("name")->label(_("Name"))->id("gName")->class(null);
+    $group->password("password")->label(_("Password"))->id("gPassword")->class(null);
+    $group->inputs["name"]->error_messages("invalid_login", _("Invalid name or password"));
+    return $form;
   }
 }
\ No newline at end of file
diff --git a/modules/user/controllers/users.php b/modules/user/controllers/users.php
index a0e89922..7ccab28f 100644
--- a/modules/user/controllers/users.php
+++ b/modules/user/controllers/users.php
@@ -20,101 +20,35 @@
 class Users_Controller extends REST_Controller {
   protected $resource_type = "user";
 
-  /**
-   * Display comments based on criteria.
-   *  @see REST_Controller::_index()
-   */
-  public function _index() {
-    throw new Exception("@todo User_Controller::_index NOT IMPLEMENTED");
-  }
-
-  /**
-   *  @see REST_Controller::_create($resource)
-   */
-  public function _create($resource) {
-    if (!(user::active()->admin)) {
-      access::forbidden();
-    }
-
-    $form = user::get_add_form();
-    if ($form->validate()) {
-      $user = user::create($form->add_user->uname->value,
-        $form->add_user->full_name->value, $form->add_user->password->value);
-      $user->email = $form->add_user->email->value;
-      $user->save();
-      if ($continue = $this->input->get("continue")) {
-        url::redirect($continue);
-      }
-    }
-    print $form;
-  }
-
-  /**
-   * @see REST_Controller::_show($resource)
-   */
-  public function _show($user) {
-    throw new Exception("@todo User_Controller::_show NOT IMPLEMENTED");
-  }
-
-  /**
-   *  @see REST_Controller::_update($resource)
-   */
   public function _update($user) {
-    if (!user::active()->admin && ($user->guest || $user->id != user::active()->id)) {
+    if ($user->guest || $user->id != user::active()->id) {
       access::forbidden();
     }
 
     $form = user::get_edit_form($user);
     $form->edit_user->password->rules("-required");
     if ($form->validate()) {
+      // @todo: allow the user to change their name
       $user->full_name = $form->edit_user->full_name->value;
       $user->password = $form->edit_user->password->value;
       $user->email = $form->edit_user->email->value;
       $user->save();
-      if ($continue = $this->input->get("continue")) {
-        url::redirect($continue);
-      }
-    }
-    print $form;
-  }
 
-  /**
-   *  @see REST_Controller::_delete($resource)
-   */
-  public function _delete($user) {
-    if (!user::active()->admin || $user->id == user::active()->id ) {
-      access::forbidden();
+      print json_encode(
+        array("result" => "success",
+              "resource" => url::site("users/{$user->id}")));
+    } else {
+      print json_encode(
+        array("result" => "error",
+              "form" => $form->__toString()));
     }
-    // Prevent CSRF
-    $form = user::get_delete_form($user);
-    if ($form->validate()) {
-      $user->delete();
-      if ($continue = $this->input->get("continue")) {
-        url::redirect($continue);
-      }
-    }
-    print $form;
   }
 
-  /**
-   * Present a form for editing a user
-   *  @see REST_Controller::form($resource)
-   */
   public function _form_edit($user) {
-    if (!user::active()->admin && ($user->guest || $user->id != user::active()->id)) {
+    if ($user->guest || $user->id != user::active()->id) {
       access::forbidden();
     }
 
-    print user::get_edit_form(
-      $user,
-      "users/{$user->id}?_method=put&continue=" . $this->input->get("continue"));
-  }
-
-  /**
-   * Present a form for adding a user
-   *  @see REST_Controller::form($resource)
-   */
-  public function _form_add($parameters) {
-    throw new Exception("@todo User_Controller::_form_add NOT IMPLEMENTED");
+    print user::get_edit_form($user);
   }
 }
diff --git a/modules/user/helpers/group.php b/modules/user/helpers/group.php
index 673f7d92..a1aea90f 100644
--- a/modules/user/helpers/group.php
+++ b/modules/user/helpers/group.php
@@ -46,50 +46,40 @@ class group_Core {
   /**
    * The group of all possible visitors.  This includes the guest user.
    *
-   * @todo consider caching
-   *
    * @return Group_Model
    */
   static function everybody() {
-    return ORM::factory("group", 1);
+    return model_cache::get("group", 1);
   }
 
   /**
    * The group of all logged-in visitors.  This does not include guest users.
    *
-   * @todo consider caching
-   *
    * @return Group_Model
    */
   static function registered_users() {
-    return ORM::factory("group", 2);
+    return model_cache::get("group", 2);
   }
-  
-  /**
-   * This is the API for handling groups.
-   * @TODO incorporate rules!
-   */
+
   public static function get_edit_form($group, $action = NULL) {
     $form = new Forge($action);
     $form_group = $form->group("edit_group")->label(_("Edit Group"));
-    $form_group->input("gname")->label(_("Name"))->id("gName")->value($group->name);
+    $form_group->input("name")->label(_("Name"))->id("gName")->value($group->name);
     $form_group->submit(_("Modify"));
     $form->add_rules_from($group);
-    $form->edit_group->gname->rules($group->rules["name"]);
     return $form;
   }
-  
+
   public static function get_add_form($action = NULL) {
     $form = new Forge($action);
     $form_group = $form->group("add_group")->label(_("Add Group"));
-    $form_group->input("gname")->label(_("Name"))->id("gName");
+    $form_group->input("name")->label(_("Name"))->id("gName");
     $form_group->submit(_("Create"));
     $group = ORM::factory("group");
     $form->add_rules_from($group);
-    $form->add_group->gname->rules($group->rules["name"]);
     return $form;
   }
-  
+
   public static function get_delete_form($group, $action = NULL) {
     $form = new Forge($action);
     $form_group = $form->group("delete_group")->label(_("Delete Group"));
@@ -97,4 +87,4 @@ class group_Core {
     $form_group->submit(_("Delete"));
     return $form;
   }
-}
\ No newline at end of file
+}
diff --git a/modules/user/helpers/user.php b/modules/user/helpers/user.php
index 34611dbd..83f9ca2b 100644
--- a/modules/user/helpers/user.php
+++ b/modules/user/helpers/user.php
@@ -25,39 +25,50 @@
  */
 class user_Core {
   public static function get_edit_form($user, $action = NULL) {
-    $form = new Forge($action, "", "post", array("id" => "gUserForm"));
+    $form = new Forge("users/$user->id?_method=put", "", "post", array("id" => "gUserForm"));
     $group = $form->group("edit_user")->label(_("Edit User"));
-    $group->input("uname")->label(_("Name"))->id("gName")->value($user->name);
+    $group->input("name")->label(_("Name"))->id("gName")->value($user->name);
     $group->input("full_name")->label(_("Full Name"))->id("gFullName")->value($user->full_name);
     $group->password("password")->label(_("Password"))->id("gPassword");
     $group->input("email")->label(_("Email"))->id("gEmail")->value($user->email);
     $group->submit(_("Modify"));
     $form->add_rules_from($user);
-    $form->edit_user->uname->rules($user->rules["name"]);
     return $form;
   }
 
-  public static function get_add_form($action = NULL) {
-    $form = new Forge($action);
+  public static function get_edit_form_admin($user, $action = NULL) {
+    $form = new Forge("admin/users/edit/$user->id", "", "post", array("id" => "gUserForm"));
+    $group = $form->group("edit_user")->label(_("Edit User"));
+    $group->input("name")->label(_("Name"))->id("gName")->value($user->name);
+    $group->input("full_name")->label(_("Full Name"))->id("gFullName")->value($user->full_name);
+    $group->password("password")->label(_("Password"))->id("gPassword");
+    $group->input("email")->label(_("Email"))->id("gEmail")->value($user->email);
+    $group->submit(_("Modify"));
+    $form->add_rules_from($user);
+    return $form;
+  }
+
+  public static function get_add_form_admin($action = NULL) {
+    $form = new Forge("admin/users/create");
     $group = $form->group("add_user")->label(_("Add User"));
-    $group->input("uname")->label(_("Name"))->id("gName");
+    $group->input("name")->label(_("Name"))->id("gName");
     $group->input("full_name")->label(_("Full Name"))->id("gFullName");
     $group->password("password")->label(_("Password"))->id("gPassword");
     $group->input("email")->label(_("Email"))->id("gEmail");
     $group->submit(_("Add"));
     $user = ORM::factory("user");
     $form->add_rules_from($user);
-    $form->add_user->uname->rules($user->rules["name"]);
     return $form;
   }
-  
-  public static function get_delete_form($user, $action = NULL) {
+
+  public static function get_delete_form_admin($user, $action = NULL) {
     $form = new Forge($action);
     $group = $form->group("delete_user")->label(_("Delete User"));
     $group->label(sprintf(_("Are you sure you want to delete %s?"), $user->name));
     $group->submit(_("Delete"));
     return $form;
   }
+
   /**
    * Make sure that we have a session and group_ids cached in the session.
    */
@@ -145,10 +156,9 @@ class user_Core {
     $user->full_name = $full_name;
     $user->password = $password;
 
-    // Everybody group
-    $user->add(ORM::factory("group", 1));
-    // Registered Users group
-    $user->add(ORM::factory("group", 2));
+    // Required groups
+    $user->add(group::everybody());
+    $user->add(group::registered_users());
 
     $user->save();
     module::event("user_created", $user);
diff --git a/modules/user/helpers/user_menu.php b/modules/user/helpers/user_menu.php
index 654a0d89..88f30f29 100644
--- a/modules/user/helpers/user_menu.php
+++ b/modules/user/helpers/user_menu.php
@@ -18,17 +18,6 @@
  * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
  */
 class user_menu_Core {
-  public static function site($menu, $theme) {
-    $user = user::active();
-    if (!$user->guest) {
-      $menu->get("admin_menu")->append(
-        Menu::Factory("dialog")
-        ->id("edit_profile")
-        ->label(_("Edit Profile"))
-        ->url(url::site("users/form/edit/$user->id")));
-    }
-  }
-
   public static function admin($menu, $theme) {
     $menu->get("users_groups_menu")
       ->append(Menu::factory("link")
diff --git a/modules/user/views/admin_users.html.php b/modules/user/views/admin_users.html.php
index 31ce7f2a..f9dc4c74 100644
--- a/modules/user/views/admin_users.html.php
+++ b/modules/user/views/admin_users.html.php
@@ -5,26 +5,25 @@
     <p>These are the users in your system</p>
     <ul class="ui-accordion-container">
       <? foreach ($users as $i => $user): ?>
-        <li>
-          <?= $user->name ?>
-          <?= ($user->last_login == 0) ? "" : "(" . date("M j, Y", $user->last_login) . ")" ?> 
-          <a href="#">edit</a>
-          <div>
-          <?= user::get_edit_form($user, "users/{$user->id}?_method=put&continue=/admin/users"); ?>
-          </div>
-          <? if (!(user::active()->id == $user->id || user::guest()->id == $user->id)): ?>
-            <a href="#">delete</a>
-            <div>
-              <?= user::get_delete_form($user, 
-                "users/{$user->id}?_method=delete&continue=/admin/users"); ?>
-            </div>
-          <? endif ?>
-        </li>
+      <li>
+        <?= $user->name ?>
+        <?= ($user->last_login == 0) ? "" : "(" . date("M j, Y", $user->last_login) . ")" ?>
+        <a href="#">edit</a>
+        <div>
+          <?= user::get_edit_form_admin($user); ?>
+        </div>
+        <? if (!(user::active()->id == $user->id || user::guest()->id == $user->id)): ?>
+        <a href="#">delete</a>
+        <div>
+          <?= user::get_delete_form_admin($user); ?>
+        </div>
+        <? endif ?>
+      </li>
       <? endforeach ?>
       <li><a href="#">Add user</a>
-          <div>
-          <?= user::get_add_form("users/add?_method=post&continue=/admin/users"); ?>
-          </div>
+        <div>
+          <?= user::get_add_form_admin(); ?>
+        </div>
       </li>
     </ul>
   </div>
@@ -32,27 +31,27 @@
   <div class="gBlockContent">
     <p>These are the groups in your system</p>
   </div>
-    <ul class="ui-accordion-container">
-      <? foreach ($groups as $i => $group): ?>
-        <li>
-          <?= $group->name ?>
-          <a href="#">edit</a>
-          <div>
-          <?= group::get_edit_form($group, "groups/{$group->id}?_method=put&continue=/admin/users"); ?>
-          </div>
-          <? if (!$group->special): ?>
-            <a href="#">delete</a>
-            <div>
-              <?= group::get_delete_form($group, 
-                "groups/{$group->id}?_method=delete&continue=/admin/users"); ?>
-            </div>
-          <? endif ?>
-        </li>
-      <? endforeach ?>
-      <li><a href="#">Add group</a>
-          <div>
-            <?= group::get_add_form("groups/add?_method=post&continue=/admin/users"); ?>
-          </div>
-      </li>
-    </ul>
+  <ul class="ui-accordion-container">
+    <? foreach ($groups as $i => $group): ?>
+    <li>
+      <?= $group->name ?>
+      <a href="#">edit</a>
+      <div>
+        <?= group::get_edit_form($group, "groups/{$group->id}?_method=put"); ?>
+      </div>
+      <? if (!$group->special): ?>
+      <a href="#">delete</a>
+      <div>
+        <?= group::get_delete_form($group,
+            "groups/{$group->id}?_method=delete"); ?>
+      </div>
+      <? endif ?>
+    </li>
+    <? endforeach ?>
+    <li><a href="#">Add group</a>
+      <div>
+        <?= group::get_add_form("groups/add?_method=post"); ?>
+      </div>
+    </li>
+  </ul>
 </div>
diff --git a/modules/user/views/login.html.php b/modules/user/views/login.html.php
index a29cdbbd..8b024815 100644
--- a/modules/user/views/login.html.php
+++ b/modules/user/views/login.html.php
@@ -5,9 +5,9 @@
          title="<?= _("Login to Gallery") ?>"
          id="gLoginLink"><?= _("Login") ?></a></li>
   <? else: ?>
-  <li><a href="<?= url::site("user/{$user->id}?continue=" . url::current(true))?>"
+  <li><a href="<?= url::site("form/edit/users/{$user->id}") ?>"
       title="<?= _("Edit Your Profile") ?>"
-      id="gUserProfileLink"><?= _("Modify Profile") ?></a></li>
+      id="gUserProfileLink" class="gDialogLink"><?= _("Modify Profile") ?></a></li>
   <li><a href="<?= url::site("logout?continue=" . url::current(true)) ?>"
          id="gLogoutLink"><?= _("Logout") ?></a></li>
   <? endif; ?>
diff --git a/themes/default/js/ui.init.js b/themes/default/js/ui.init.js
index b816dc46..90731faf 100644
--- a/themes/default/js/ui.init.js
+++ b/themes/default/js/ui.init.js
@@ -107,15 +107,18 @@ function openDialog(element) {
   var buttons = {};
   buttons["Submit"] = function() {
     $("#gDialog form").ajaxForm({
-      complete: function(xhr, statusText) {
-	if (xhr.status == 201) {
-	  $("#gDialog").dialog("close");
-	  window.location = xhr.getResponseHeader("Location");
-	} else if (xhr.status == 202) {
-	  $("#gDialog").dialog("close");
-	  window.location.reload();
-	} else {
-	  $("#gDialog form").replaceWith(xhr.responseText);
+      dataType: "json",
+      success: function(data) {
+	if (data.form) {
+          $("#gDialog form").replaceWith(data.form);
+	}
+	if (data.result == "success") {
+          $("#gDialog").dialog("close");
+	  if (data.location) {
+	    window.location = data.location;
+	  } else {
+	    window.location.reload();
+	  }
 	}
       }
     }).submit();