diff --git a/lib/kolab_client_task.php b/lib/kolab_client_task.php
index e8c121d..3c6402f 100644
--- a/lib/kolab_client_task.php
+++ b/lib/kolab_client_task.php
@@ -1,1791 +1,1791 @@
 <?php
 /*
  +--------------------------------------------------------------------------+
  | This file is part of the Kolab Web Admin Panel                           |
  |                                                                          |
  | Copyright (C) 2011-2012, Kolab Systems AG                                |
  |                                                                          |
  | This program is free software: you can redistribute it and/or modify     |
  | it under the terms of the GNU Affero General Public License as published |
  | by the Free Software Foundation, either version 3 of the License, or     |
  | (at your option) any later version.                                      |
  |                                                                          |
  | This program is distributed in the hope that it will be useful,          |
  | but WITHOUT ANY WARRANTY; without even the implied warranty of           |
  | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the             |
  | GNU Affero General Public License for more details.                      |
  |                                                                          |
  | You should have received a copy of the GNU Affero General Public License |
  | along with this program. If not, see <http://www.gnu.org/licenses/>      |
  +--------------------------------------------------------------------------+
  | Author: Aleksander Machniak <machniak@kolabsys.com>                      |
  | Author: Jeroen van Meeuwen <vanmeeuwen@kolabsys.com>                     |
  +--------------------------------------------------------------------------+
 */
 
 
 class kolab_client_task
 {
     /**
      * @var kolab_client_output
      */
     protected $output;
 
     /**
      * @var kolab_client_api
      */
     protected $api;
 
     /**
      * @var Conf
      */
     protected $config;
 
     protected $ajax_only    = false;
     protected $page_title   = 'Kolab Web Admin Panel';
     protected $menu         = array();
     protected $cache        = array();
     protected $devel_mode   = false;
     protected $object_types = array('user', 'group', 'role', 'resource', 'sharedfolder', 'ou', 'domain');
     protected $page_size    = 20;
     protected $list_attribs = array();
     protected $list_module;
 
     protected $search_attribs = array(
         'name'  => array('cn', 'displayname'),
         'email' => array('mail', 'alias', 'mailalternateaddress'),
         'uid'   => array('uid'),
     );
 
     protected static $translation = array();
 
 
     /**
      * Class constructor.
      *
      * @param kolab_client_output $output Optional output object
      */
     public function __construct($output = null)
     {
         $this->config_init();
 
         $this->devel_mode = $this->config_get('devel_mode', false, Conf::BOOL);
 
         $this->output_init($output);
         $this->api_init();
 
         ini_set('session.use_cookies', 'On');
         session_start();
 
         $this->auth();
     }
 
     /**
      * Localization initialization.
      */
     protected function locale_init()
     {
         if (!empty(self::$translation)) {
             return;
         }
 
         $language = $this->get_language();
         $LANG     = array();
 
         if (!$language) {
             $language = 'en_US';
         }
 
         @include INSTALL_PATH . '/locale/en_US.php';
 
         if ($language != 'en_US') {
             @include INSTALL_PATH . "/locale/$language.php";
         }
 
         setlocale(LC_ALL, $language . '.utf8', $language . 'UTF-8', 'en_US.utf8', 'en_US.UTF-8');
 
         // workaround for http://bugs.php.net/bug.php?id=18556
         if (PHP_VERSION_ID < 50500 && in_array($language, array('tr_TR', 'ku', 'az_AZ'))) {
             setlocale(LC_CTYPE, 'en_US.utf8', 'en_US.UTF-8');
         }
 
         self::$translation = $LANG;
     }
 
     /**
      * Configuration initialization.
      */
     private function config_init()
     {
         $this->config = Conf::get_instance();
     }
 
     /**
      * Output initialization.
      */
     private function output_init($output = null)
     {
         if ($output) {
             $this->output = $output;
             return;
         }
 
         $skin = $this->config_get('skin', 'default');
         $this->output = new kolab_client_output($skin);
 
         // Assign self to template variable
         $this->output->assign('engine', $this);
     }
 
     /**
      * API initialization
      */
     private function api_init()
     {
         $url = $this->config_get('api_url', '');
 
         if (!$url) {
             $port = $_SERVER['SERVER_PORT'];
             $url  = kolab_utils::https_check() ? 'https://' : 'http://';
             $url .= $_SERVER['SERVER_NAME'] . ($port ? ":$port" : '');
             $url .= preg_replace('/\/?\?.*$/', '', $_SERVER['REQUEST_URI']);
             $url .= '/api';
         }
 
         // TODO: Debug logging
         //console($url);
 
         $this->api = new kolab_client_api($url);
     }
 
     /**
      * Returns system language (locale) setting.
      *
      * @return string Language code
      */
     private function get_language()
     {
         $aliases = array(
             'de' => 'de_DE',
             'en' => 'en_US',
             'pl' => 'pl_PL',
         );
 
         // UI language
         $langs = !empty($_SERVER['HTTP_ACCEPT_LANGUAGE']) ? $_SERVER['HTTP_ACCEPT_LANGUAGE'] : '';
         $langs = explode(',', $langs);
 
         if (!empty($_SESSION['user']) && !empty($_SESSION['user']['language'])) {
             array_unshift($langs, $_SESSION['user']['language']);
         }
 
         while ($lang = array_shift($langs)) {
             $lang = explode(';', $lang);
             $lang = $lang[0];
             $lang = str_replace('-', '_', $lang);
 
             if (file_exists(INSTALL_PATH . "/locale/$lang.php")) {
                 return $lang;
             }
 
             if (isset($aliases[$lang]) && ($alias = $aliases[$lang])
                 && file_exists(INSTALL_PATH . "/locale/$alias.php")
             ) {
                 return $alias;
             }
         }
 
         return null;
     }
 
     /**
      * User authentication (and authorization).
      */
     private function auth()
     {
         if (isset($_POST['login'])) {
             $login = $this->get_input('login', 'POST', true);
 
             if ($login['username']) {
                 $login['username'] = trim($login['username']);
                 $login['domain']   = trim($login['domain']);
 
                 $result = $this->api->login($login['username'], $login['password'], $login['domain'], true);
 
                 if ($token = $result->get('session_token')) {
                     $user = array(
                         'token'  => $token,
                         'id'     => $result->get('userid'),
                         'domain' => $result->get('domain')
                     );
 
                     $this->api->set_session_token($user['token']);
 
                     // Find user settings
                     // Don't call API user.info for non-existing users (#1025)
                     if (preg_match('/^cn=([a-z ]+)/i', $login['username'], $m)) {
                         $user['fullname'] = ucwords($m[1]);
                     }
                     else {
                         $res = $result->get('info');
                         if (empty($res)) {
                             $res = $this->api->get('user.info', array('id' => $user['id']));
                             $res = $res->get();
                         }
 
                         if (is_array($res) && !empty($res)) {
                             $user['language'] = $res['preferredlanguage'];
                             $user['fullname'] = $res['cn'];
 
                             // overwrite user id set in login request, which might be user base DN,
                             // with unique attribute, which suits better to our needs
                             $user['id'] = $res['id'];
                         }
                     }
 
                     // Save user data
                     $_SESSION['user'] = $user;
 
                     if (($language = $this->get_language()) && $language != 'en_US') {
                         $_SESSION['user']['language'] = $language;
                         $session_config['language']   = $language;
                     }
 
                     // Configure API session
                     if (!empty($session_config)) {
                         $this->api->post('system.configure', null, $session_config);
                     }
 
                     header('Location: ?');
                     die;
                 }
                 else {
                     $code  = $result->get_error_code();
                     $str   = $result->get_error_str();
                     $label = 'loginerror';
 
                     if ($code == kolab_client_api::ERROR_INTERNAL
                         || $code == kolab_client_api::ERROR_CONNECTION
                     ) {
                         $label = 'internalerror';
                         $this->raise_error(500, 'Login failed. ' . $str);
                     }
 
                     $this->output->command('display_message', $label, 'error');
                 }
             }
         }
         else if (!empty($_SESSION['user']) && !empty($_SESSION['user']['token'])) {
             // Validate session
             $timeout = $this->config_get('session_timeout', 3600);
             if ($timeout && $_SESSION['time'] && $_SESSION['time'] < time() - $timeout) {
                 $this->action_logout(true);
             }
 
             // update session time
             $_SESSION['time'] = time();
 
             // Set API session key
             $this->api->set_session_token($_SESSION['user']['token']);
         }
     }
 
     /**
      * Main execution.
      */
     public function run()
     {
         // Initialize locales
         $this->locale_init();
 
         // Session check
         if (empty($_SESSION['user']) || empty($_SESSION['user']['token'])) {
             $this->action_logout();
         }
 
         // Run security checks
         $this->input_checks();
 
         $this->action = $this->get_input('action', 'GET');
 
         if ($this->action) {
             $method = 'action_' . $this->action;
             if (method_exists($this, $method)) {
                 $this->$method();
             }
         }
         else if (method_exists($this, 'action_default')) {
             $this->action_default();
         }
     }
 
     /**
      * Security checks and input validation.
      */
     public function input_checks()
     {
         $ajax = $this->output->is_ajax();
 
         // Check AJAX-only tasks
         if ($this->ajax_only && !$ajax) {
             $this->raise_error(500, 'Invalid request type!', null, true);
         }
 
         // CSRF prevention
         $token  = $ajax ? kolab_utils::get_request_header('X-Session-Token') : $this->get_input('token');
         $task   = $this->get_task();
 
         if ($task != 'main' && $token != $_SESSION['user']['token']) {
             $this->raise_error(403, 'Invalid request data!', null, true);
         }
     }
 
     /**
      * Logout action.
      */
     private function action_logout($sess_expired = false, $stop_sess = true)
     {
         // Initialize locales
         $this->locale_init();
 
         if (!empty($_SESSION['user']) && !empty($_SESSION['user']['token']) && $stop_sess) {
             $this->api->logout();
         }
         $_SESSION = array();
 
         if ($this->output->is_ajax()) {
             if ($sess_expired) {
                 $args = array('error' => 'session.expired');
             }
             $this->output->command('main_logout', $args);
 
             if ($sess_expired) {
                 $this->output->send();
                 exit;
             }
         }
         else {
             $this->output->add_translation('loginerror', 'internalerror', 'session.expired');
         }
 
         if ($sess_expired) {
             $error = 'session.expired';
         }
         else {
             $error = $this->get_input('error', 'GET');
         }
 
         if ($error) {
             $this->output->command('display_message', $error, 'error', 60000);
         }
 
         $this->send('login');
         exit;
     }
 
     /**
      * Error action (with error logging).
      *
      * @param int    $code   Error code
      * @param string $msg    Error message
      * @param array  $args   Optional arguments (type, file, line)
      * @param bool   $output Enable to send output and finish
      */
     public function raise_error($code, $msg, $args = array(), $output = false)
     {
         $log_line = sprintf("%s Error: %s (%s)",
             isset($args['type']) ? $args['type'] : 'PHP',
             $msg . (isset($args['file']) ? sprintf(' in %s on line %d', $args['file'], $args['line']) : ''),
             $_SERVER['REQUEST_METHOD']);
 
         write_log('errors', $log_line);
 
         if (!$output) {
             return;
         }
 
         if ($this->output->is_ajax()) {
             header("HTTP/1.0 $code $msg");
             die;
         }
 
         $this->output->assign('error_code', $code);
         $this->output->assign('error_message', $msg);
         $this->send('error');
         exit;
     }
 
     /**
      * Output sending.
      */
     public function send($template = null)
     {
         if (!$template) {
             $template = $this->get_task();
         }
 
         if ($this->page_title) {
             $this->output->assign('pagetitle', $this->page_title);
         }
 
         $this->output->send($template);
         exit;
     }
 
     /**
      * Returns name of the current task.
      *
      * @return string Task name
      */
     public function get_task()
     {
         $class_name = get_class($this);
 
         if (preg_match('/^kolab_client_task_([a-z]+)$/', $class_name, $m)) {
             return $m[1];
         }
     }
 
     /**
      * Returns output environment variable value
      *
      * @param string $name Variable name
      *
      * @return mixed Variable value
      */
     public function get_env($name)
     {
         return $this->output->get_env($name);
     }
 
     /**
      * Returns configuration option value.
      *
      * @param string $name      Option name
      * @param mixed  $fallback  Default value
      * @param int    $type      Value type (one of Conf class constants)
      *
      * @return mixed Option value
      */
     public function config_get($name, $fallback = null, $type = null)
     {
         $value = $this->config->get('kolab_wap', $name, $type);
         return $value !== null ? $value : $fallback;
     }
 
     /**
      * Returns translation of defined label/message.
      *
      * @return string Translated string.
      */
     public static function translate()
     {
         $args = func_get_args();
 
         if (is_array($args[0])) {
             $args = $args[0];
         }
 
         $label = $args[0];
 
         if (isset(self::$translation[$label])) {
             $content = trim(self::$translation[$label]);
         }
         else {
             $content = $label;
         }
 
         for ($i = 1, $len = count($args); $i < $len; $i++) {
             $content = str_replace('$'.$i, $args[$i], $content);
         }
 
         return $content;
     }
 
     /**
      * Returns input parameter value.
      *
      * @param string $name       Parameter name
      * @param string $type       Parameter type (GET|POST|NULL)
      * @param bool   $allow_html Disables stripping of insecure content (HTML tags)
      *
      * @see kolab_utils::get_input
      * @return mixed Input value.
      */
     public static function get_input($name, $type = null, $allow_html = false)
     {
         if ($type == 'GET') {
             $type = kolab_utils::REQUEST_GET;
         }
         else if ($type == 'POST') {
             $type = kolab_utils::REQUEST_POST;
         }
         else {
             $type = kolab_utils::REQUEST_ANY;
         }
 
         return kolab_utils::get_input($name, $type, $allow_html);
     }
 
     /**
      * Returns task menu output.
      *
      * @return string HTML output
      */
     protected function menu()
     {
         if (empty($this->menu)) {
             return '';
         }
 
         $menu = array();
         $task = $this->get_task();
         $caps = (array) $this->get_capability('actions');
 
         foreach ($this->menu as $idx => $label) {
             if (in_array($task, $this->object_types)) {
                 if (!array_key_exists($task . "." . $idx, $caps)) {
                     continue;
                 }
             }
 
             if (strpos($idx, '.')) {
                 $action = $idx;
                 $class  = preg_replace('/\.[a-z_-]+$/', '', $idx);
             }
             else {
                 $action = $task . '.' . $idx;
                 $class  = $idx;
             }
 
             $menu[$idx] = sprintf('<li class="%s">'
                 .'<a href="#%s" onclick="return kadm.command(\'%s\', \'\', this)">%s</a></li>',
                 $class, $idx, $action, $this->translate($label));
         }
 
         return '<ul>' . implode("\n", $menu) . '</ul>';
     }
 
     /**
      * Adds watermark page definition into main page.
      */
     protected function watermark($name)
     {
         $this->output->command('set_watermark', $name);
     }
 
     /**
      * API GET request wrapper
      */
     protected function api_get($action, $get = array())
     {
         return $this->api_call('get', $action, $get);
     }
 
     /**
      * API POST request wrapper
      */
     protected function api_post($action, $get = array(), $post = array())
     {
         return $this->api_call('post', $action, $get, $post);
     }
 
     /**
      * API request wrapper with error handling
      */
     protected function api_call($type, $action, $get = array(), $post = array())
     {
         if ($type == 'post') {
             $result = $this->api->post($action, $get, $post);
         }
         else {
             $result = $this->api->get($action, $get);
         }
 
         // error handling
         if ($code = $result->get_error_code()) {
             // Invalid session, do logout
             if ($code == 403) {
                 $this->action_logout(true, false);
             }
 
             // Log communication errors, other should be logged on API side
             if ($code < 400) {
                 $this->raise_error($code, 'API Error: ' . $result->get_error_str());
             }
         }
 
         return $result;
     }
 
     /**
      * Returns list of object types.
      *
      * @para string  $type     Object type name
      * @param string $used_for Used_for attribute of object type
      *
      * @return array List of user types
      */
     protected function object_types($type, $used_for = null)
     {
         if (empty($type) || !in_array($type, $this->object_types)) {
             return array();
         }
 
         $cache_idx = $type . '_types' . ($used_for ? ":$used_for" : '');
 
         if (!array_key_exists($cache_idx, $this->cache)) {
             $result = $this->api_post($type . '_types.list');
             $list   = $result->get('list');
 
             if (!empty($used_for) && is_array($list)) {
                 foreach ($list as $type_id => $type_attrs) {
                     if ($type_attrs['used_for'] != $used_for) {
                         unset($list[$type_id]);
                     }
                 }
             }
 
             $this->cache[$cache_idx] = !empty($list) ? $list : array();
 
             Log::trace("kolab_client_task::${type}_types() returns: " . var_export($list, true));
         }
 
         return $this->cache[$cache_idx];
     }
 
     /**
      * Returns user name.
      *
      * @param string $dn User DN attribute value
      *
      * @return string User name (displayname)
      */
     protected function user_name($dn)
     {
         if (!$this->devel_mode) {
             if (!empty($this->cache['user_names']) && isset($this->cache['user_names'][$dn])) {
                 return $this->cache['user_names'][$dn];
             }
         }
 
         $result   = $this->api_get('user.info', array('id' => $dn));
         $username = $result->get('displayname');
 
         if (empty($username)) {
             $username = $result->get('cn');
         }
 
         if (empty($username)) {
             if (preg_match('/^cn=([a-zA=Z ]+)/', $dn, $m)) {
                 $username = ucwords($m[1]);
             }
         }
 
         if (!$this->devel_mode) {
             $this->cache['user_names'][$dn] = $username;
         }
 
         return $username;
     }
 
     /**
      * Returns list of system capabilities.
      *
      * @param bool $all     If enabled capabilities for all domains will be returned
      * @param bool $refresh Disable session cache
      *
      * @return array List of system capabilities
      */
     protected function capabilities($all = false, $refresh = false)
     {
         if (!$refresh && isset($_SESSION['capabilities']) && !$this->devel_mode) {
             $list = $_SESSION['capabilities'];
         }
         else {
             $result = $this->api_post('system.capabilities');
             $list   = $result->get('list');
 
             if (is_array($list) && !$this->devel_mode) {
                 $_SESSION['capabilities'] = $list;
             }
         }
 
         $domain = $this->domain ? $this->domain : $_SESSION['user']['domain'];
 
         return !$all ? $list[$domain] : $list;
     }
 
     /**
      * Returns system capability
      *
      * @param string $name Capability (key) name
      *
      * @return array Capability value if supported, NULL otherwise
      */
     protected function get_capability($name)
     {
         $caps = $this->capabilities();
 
         return $caps[$name];
     }
 
     /**
      * Returns domains list (based on capabilities response)
      *
      * @param bool $refresh Refresh session cache
      *
      * @return array List of domains
      */
     protected function get_domains($refresh = false)
     {
         $caps = $this->capabilities(true, $refresh);
 
         return is_array($caps) ? array_keys($caps) : array();
     }
 
     /**
      * Returns effective rights for the specified object
      *
      * @param string $type Object type
      * @param string $id   Object identifier
      *
      * @return array Two element array with 'attribute' and 'entry' elements
      */
     protected function effective_rights($type, $id = null)
     {
         $caps = $this->get_capability('actions');
 
         if (empty($caps[$type . '.effective_rights'])) {
             return array(
                 'attribute' => array(),
                 'entry'     => array(),
             );
         }
 
         // Get the rights on the entry and attribute level
         $result = $this->api_get($type . '.effective_rights', array('id' => $id));
 
         $result = array(
             'attribute' => $result->get('attributeLevelRights'),
             'entry'     => $result->get('entryLevelRights'),
         );
 
         return $result;
     }
 
     /**
      * Returns execution time in seconds
      *
      * @param string Execution time
      */
     public function gentime()
     {
         return sprintf('%.4f', microtime(true) - KADM_START);
     }
 
     /**
      * Returns HTML output of login form
      *
      * @param string HTML output
      */
     public function login_form()
     {
         $post = $this->get_input('login', 'POST', true);
 
         $username = kolab_html::label(array(
                 'for'     => 'login_name',
                 'content' => $this->translate('login.username')), true)
             . kolab_html::input(array(
                 'type'  => 'text',
                 'id'    => 'login_name',
                 'name'  => 'login[username]',
                 'value' => $post['username'],
                 'autofocus' => true));
 
         $password = kolab_html::label(array(
                 'for'     => 'login_pass',
                 'content' => $this->translate('login.password')), true)
             . kolab_html::input(array(
                 'type'  => 'password',
                 'id'    => 'login_pass',
                 'name'  => 'login[password]',
                 'value' => ''));
 
         $button = kolab_html::input(array(
             'type'  => 'submit',
             'id'    => 'login_submit',
             'value' => $this->translate('login.login')));
 
         $form = kolab_html::form(array(
             'id'     => 'login_form',
             'name'   => 'login',
             'method' => 'post',
             'action' => '?'),
             kolab_html::span(array('content' => $username))
             . kolab_html::span(array('content' => $password))
             . $button);
 
         return $form;
     }
 
     /**
      * Returns form element definition based on field attributes
      *
      * @param array $field Field attributes
      * @param array $data  Attribute values
      *
      * @return array Field definition
      */
     protected function form_element_type($field, $data = array())
     {
         $result = array();
 
         switch ($field['type']) {
         case 'select':
         case 'multiselect':
             $opts = $this->form_element_select_data($field, $data);
 
             $result['type']    = kolab_form::INPUT_SELECT;
             $result['options'] = $opts['options'];
             $result['value']   = $opts['default'];
             $result['default'] = $field['default'];
 
             if ($field['type'] == 'multiselect') {
                 $result['multiple'] = true;
             }
 
             break;
 
         case 'list':
             $result['type']      = kolab_form::INPUT_TEXTAREA;
             $result['data-type'] = 'list';
 
             if (!empty($field['maxlength'])) {
                 $result['data-maxlength'] = $field['maxlength'];
             }
             if (!empty($field['maxcount'])) {
                 $result['data-maxcount'] = $field['maxcount'];
             }
             if (!empty($field['autocomplete'])) {
                 $result['data-autocomplete'] = true;
             }
             break;
 
         case 'checkbox':
             $result['type'] = kolab_form::INPUT_CHECKBOX;
             break;
 
         case 'password':
             $result['type'] = kolab_form::INPUT_PASSWORD;
 
             if (isset($field['maxlength'])) {
                 $result['maxlength'] = $field['maxlength'];
             }
             break;
 
         case 'text-quota':
             $result['type']    = kolab_form::INPUT_TEXTQUOTA;
             $result['default'] = $field['default'];
             break;
 
         case 'aci':
             $result['type']      = kolab_form::INPUT_TEXTAREA;
             $result['data-type'] = 'aci';
 
             $this->output->add_translation('aci.new', 'aci.edit', 'aci.remove',
                 'aci.users', 'aci.rights', 'aci.targets', 'aci.aciname',
                 'aci.read', 'aci.compare', 'aci.search', 'aci.write', 'aci.selfwrite',
                 'aci.delete', 'aci.add', 'aci.proxy', 'aci.all', 'aci.allow', 'aci.deny',
                 'aci.typeusers', 'aci.typegroups', 'aci.typeroles', 'aci.typeadmins', 'aci.typespecials',
                 'aci.ldap-all', 'aci.ldap-anyone', 'aci.ldap-self', 'aci.ldap-parent',
                 'aci.usersearch', 'aci.usersearchresult', 'aci.selected', 'aci.other',
                 'aci.userselected', 'aci.useradd', 'aci.userremove', 'aci.thisentry',
                 'aci.rights.target', 'aci.rights.filter', 'aci.rights.attrs', 'aci.checkall', 'aci.checknone',
                 'aci.error.noname', 'aci.error.exists', 'aci.error.nousers',
                 'button.cancel', 'button.ok'
             );
             break;
 
         case 'imap_acl':
             $result['type']      = kolab_form::INPUT_TEXTAREA;
             $result['data-type'] = 'acl';
             $result['default']   = $field['default'];
 
             $this->output->add_translation('aci.new', 'aci.edit', 'aci.remove',
                 'button.ok', 'button.cancel', 'acl.all', 'acl.custom',
                 'acl.read-only', 'acl.read-write', 'acl.full', 'acl.semi-full',
                 'acl.l', 'acl.r', 'acl.s', 'acl.w', 'acl.i', 'acl.p', 'acl.k', 'acl.a',
                 'acl.x', 'acl.t', 'acl.n', 'acl.e', 'acl.d', 'acl.anyone', 'acl.anonymous',
                 'acl.identifier', 'acl.rights', 'acl.expire', 'acl.user',
                 'acl.error.invaliddate', 'acl.error.nouser', 'acl.error.subjectexists', 'acl.error.norights'
             );
             break;
 
         case 'text-separated':
             $result['type']      = kolab_form::INPUT_TEXTAREA;
             $result['data-type'] = 'separated';
             break;
 
         default:
             if (!empty($field['autocomplete'])) {
                 $result['type']              = kolab_form::INPUT_TEXTAREA;
                 $result['data-type']         = 'list';
                 $result['data-maxcount']     = 1;
                 $result['data-autocomplete'] = true;
             }
             else {
                 $result['type'] = kolab_form::INPUT_TEXT;
             }
 
             if ($field['type'] && $field['type'] != 'text') {
                 $result['data-type'] = $field['type'];
                 if ($field['type'] == 'ldap_url') {
                     $this->output->add_translation('ldap.one', 'ldap.sub', 'ldap.base',
                         'ldap.host', 'ldap.basedn','ldap.scope', 'ldap.conditions',
                         'ldap.filter_any', 'ldap.filter_both', 'ldap.filter_prefix', 'ldap.filter_suffix',
-                        'ldap.filter_exact'
+                        'ldap.filter_exact', 'ldap.filter_notexact'
                     );
                 }
             }
             else {
                 $result['default'] = $field['default'];
             }
 
             if (isset($field['maxlength'])) {
                 $result['maxlength'] = $field['maxlength'];
             }
         }
 
         $result['required'] = empty($field['optional']);
 
         return $result;
     }
 
     /**
      * Prepares options/value of select element
      *
      * @param array $field Field attributes
      * @param array $data  Attribute values
      * @param bool  $lc    Convert option values to lower-case
      *
      * @return array Options/Default definition
      */
     protected function form_element_select_data($field, $data = array(), $lc = false)
     {
         $options = array();
         $default = null;
 
         if (!isset($field['values'])) {
             $data['attributes'] = array($field['name']);
             $resp = $this->api_post('form_value.select_options', null, $data);
             $resp = $resp->get($field['name']);
             unset($data['attributes']);
 
             $default         = empty($data[$field['name']]) ? $resp['default'] : $data[$field['name']];
             $field['values'] = $resp['list'];
         }
 
         if (!empty($field['values'])) {
             if ($lc) {
                 $options = array_combine(array_map('strtolower', $field['values']), $field['values']);
             }
             else {
                 $options = array_combine($field['values'], $field['values']);
             }
 
             // Exceptions
             if ($field['name'] == 'ou') {
                 foreach ($options as $idx => $dn) {
                     $options[$idx] = kolab_utils::dn2ufn($dn);
                 }
             }
         }
 
         if (!empty($default)) {
             foreach ($options as $key => $value) {
                 if (strtolower($default) == $key) {
                     $default = strtolower($default);
                 }
             }
         }
 
         return array(
             'options' => $options,
             'default' => $default,
         );
     }
 
     /**
      * HTML Form elements preparation.
      *
      * @param string $name         Object name (user, group, etc.)
      * @param array  $data         Object data
      * @param array  $extra_fields Extra field names
      * @param string $used_for     Object types filter
      * @param string $id_section   Name of section for type_id field
      *
      * @return array Fields list, Object types list, Current type ID
      */
     protected function form_prepare($name, &$data, $extra_fields = array(), $used_for = null, $id_section = null)
     {
         $types        = (array) $this->object_types($name, $used_for);
         $add_mode     = empty($data['id']);
         $event_fields = array();
         $auto_fields  = array();
         $form_fields  = array();
         $fields       = array();
         $auto_attribs = array();
         $extra_fields = array_flip($extra_fields);
 
         // Object type
         $data['object_type'] = $name;
 
         // Selected account type
         if (!empty($data['type_id'])) {
             $type = $data['type_id'];
         }
         else {
             // find default object type
             foreach ($types as $type_id => $type) {
                 if ($type['is_default']) {
                     $default = $type_id;
                     break;
                 }
             }
 
             reset($types);
 
             $data['type_id'] = $type = ($default !== null ? $default : key($types));
         }
 
         if ($type) {
             $auto_fields = (array) $types[$type]['attributes']['auto_form_fields'];
             $form_fields = (array) $types[$type]['attributes']['form_fields'];
         }
 
         // Mark automatically generated fields as read-only, etc.
         foreach ($auto_fields as $idx => $field) {
             if (!is_array($field)) {
                 unset($auto_fields[$idx]);
                 continue;
             }
             // merge with field definition from
             if (isset($form_fields[$idx])) {
                 $field = array_merge($field, $form_fields[$idx]);
             }
             // remove auto-generated value on type change, it will be re-generated
             else if ($add_mode) {
                 unset($data[$idx]);
             }
 
             $field['name'] = $idx;
             $fields[$idx]  = $this->form_element_type($field, $data);
             $fields[$idx]['readonly'] = true;
 
             $extra_fields[$idx] = true;
 
             // build event_fields list
             if (!empty($field['data'])) {
                 foreach ($field['data'] as $fd) {
                     $event_fields[$fd][] = $idx;
                 }
             }
         }
 
         // Other fields
         foreach ($form_fields as $idx => $field) {
             if (!isset($fields[$idx])) {
                 $field['name'] = $idx;
                 $fields[$idx] = $this->form_element_type($field, $data);
             }
             else {
                 unset($extra_fields[$idx]);
             }
 
             $fields[$idx]['readonly'] = false;
 
             // Attach on-change events to some fields, to update
             // auto-generated field values
             if (!empty($event_fields[$idx])) {
                 $event = json_encode(array_unique($event_fields[$idx]));
                 $fields[$idx]['onchange'] = "kadm.form_value_change($event)";
             }
         }
 
         // Re-parse auto_fields again, to get attributes for auto-generation
         // Need to do this after form_fields have been initialized (#2980)
         foreach ($auto_fields as $idx => $field) {
             // build auto_attribs and event_fields lists
             if (!empty($field['data'])) {
                 $is_data = 0;
                 foreach ($field['data'] as $fd) {
                     if (!isset($data[$fd]) && isset($fields[$fd]['value'])) {
                         $data[$fd] = $fields[$fd]['value'];
                     }
                     if (isset($data[$fd])) {
                         $is_data++;
                     }
                 }
 
                 if (count($field['data']) == $is_data) {
                     $auto_attribs[] = $idx;
                 }
             }
             else {
                 $auto_attribs[] = $idx;
                 // Unset the $auto_fields array key to prevent the form field from
                 // becoming disabled/readonly
                 unset($auto_fields[$idx]);
             }
         }
 
         // Get the rights on the entry and attribute level
         $data['effective_rights'] = $this->effective_rights($name, $data['id']);
         $attribute_rights         = (array) $data['effective_rights']['attribute'];
         $entry_rights             = (array) $data['effective_rights']['entry'];
 
         // See if "administrators" (those who can delete and add back on the entry
         // level) may override the automatically generated contents of auto_form_fields.
         $admin_auto_fields_rw = $this->config_get('admin_auto_fields_rw', false, Conf::BOOL);
 
         foreach ($fields as $idx => $field) {
             $readonly = null;
             if (!array_key_exists($idx, $attribute_rights)) {
                 // If the entry level rights contain 'add' and 'delete', well, you're an admin
                 if (in_array('add', $entry_rights) && in_array('delete', $entry_rights)) {
                     if ($admin_auto_fields_rw) {
                         $fields[$idx]['readonly'] = false;
                     }
                 }
                 else {
                     $fields[$idx]['readonly'] = $readonly = true;
                 }
             }
             else {
                 if (in_array('add', $entry_rights) && in_array('delete', $entry_rights)) {
                     if ($admin_auto_fields_rw) {
                         $fields[$idx]['readonly'] = false;
                     }
                 }
                 // Explicit attribute level rights, check for 'write'
                 else if (!in_array('write', $attribute_rights[$idx])) {
                     $fields[$idx]['readonly'] = $readonly = true;
                 }
             }
 
             // disable auto-fields updates, user has no rights to modify them anyway
             if (is_bool($readonly) && $readonly) {
                 if (($s_idx = array_search($idx, $auto_attribs)) !== false) {
                     unset($auto_attribs[$s_idx]);
                 }
                 unset($auto_fields[$idx]);
             }
         }
 
         // Register list of auto-generated fields
         $this->output->set_env('auto_fields', $auto_fields);
         // Register list of disabled fields
         $this->output->set_env('extra_fields', array_keys($extra_fields));
 
         // (Re-|Pre-)populate auto_form_fields
         if ($add_mode) {
             if (!empty($auto_attribs)) {
                 $data['attributes'] = $auto_attribs;
                 $resp = $this->api_post('form_value.generate', null, $data);
                 $data = array_merge((array)$data, (array)$resp->get());
                 unset($data['attributes']);
             }
         }
         else {
             // Add common information fields
             $add_fields = array(
                 'creatorsname'  => 'createtimestamp',
                 'modifiersname' => 'modifytimestamp',
             );
             foreach ($add_fields as $idx => $val) {
                 if (!empty($data[$idx])) {
                     if ($value = $this->user_name($data[$idx])) {
                         if ($data[$val]) {
                             $value .= ' (' . strftime('%x %X', strtotime($data[$val])) . ')';
                         }
 
                         $fields[$idx] = array(
                             'label'   => $idx,
                             'section' => 'system',
                             'value'   => $value,
                         );
                     }
                 }
             }
 
             // Add debug information
             if ($this->devel_mode) {
                 ksort($data);
                 $debug = kolab_html::escape(print_r($data, true));
                 $debug = preg_replace('/(^Array\n\(|\n*\)$|\t)/', '', $debug);
                 $debug = str_replace("\n    ", "\n", $debug);
                 $debug = '<pre class="debug">' . $debug . '</pre>';
                 $fields['debug'] = array(
                         'label'   => 'debug',
                         'section' => 'system',
                         'value'   => $debug,
                     );
             }
         }
 
         // Add object type hidden field
         $fields['object_type'] = array(
             'section'  => 'system',
             'type'     => kolab_form::INPUT_HIDDEN,
             'value'    => $name,
         );
 
         // Get user-friendly names for lists
         foreach ($fields as $fname => $field) {
             if (!empty($field['data-autocomplete']) && !empty($data[$fname])) {
                 if (!is_array($data[$fname])) {
                     $data[$fname] = (array) $data[$fname];
                 }
 
                 // request parameters
                 $post = array(
                     'list'        => $data[$fname],
                     'attribute'   => $fname,
                     'object_type' => $name,
                     'type_id'     => $data['type_id'],
                 );
 
                 // get options list
                 $result = $this->api_post('form_value.list_options', null, $post);
                 $result = $result->get('list');
 
                 $data[$fname] = $result;
             }
         }
 
         // Add entry identifier
         if (!$add_mode) {
             $fields['id'] = array(
                 'section'   => 'system',
                 'type'      => kolab_form::INPUT_HIDDEN,
                 'value'     => $data['id']
             );
         }
 
         // Add object type id selector
         if ($id_section) {
             $object_types = array();
             foreach ($types as $idx => $elem) {
                 $object_types[$idx] = array('value' => $idx, 'content' => $elem['name']);
             }
 
             // Add object type id selector
             $fields['type_id'] = array(
                 'section'  => $id_section,
                 'type'     => kolab_form::INPUT_SELECT,
                 'options'  => $object_types,
                 'onchange' => "kadm.{$name}_save(true, '$id_section')",
             );
 
             // Hide account type selector if there's only one type
             if (count($object_types) < 2 || !$add_mode) {
                 $fields['type_id']['type'] = kolab_form::INPUT_HIDDEN;
             }
 
             // Add object type name
             if (!$add_mode && count($object_types) > 1) {
                 $fields['type_id_name'] = array(
                     'label'    => "$name.type_id",
                     'section'  => $id_section,
                     'value'    => $object_types[$type]['content'],
                 );
             }
         }
 
         $result = array($fields, $types, $type, $add_mode);
         return $result;
     }
 
     /**
      * HTML Form creation.
      *
      * @param string $name       Object name (user, group, etc.)
      * @param array  $attribs    HTML attributes of the form
      * @param array  $sections   List of form sections
      * @param array  $fields     Fields list (from self::form_prepare())
      * @param array  $fields_map Fields map (used for sorting and sections assignment)
      * @param array  $data       Object data (with effective rights, see form_prepare())
      * @param bool   $add_mode   Add mode enabled
      * @param string $title      Page title
      *
      * @return kolab_form HTML Form object
      */
     protected function form_create($name, $attribs, $sections, $fields, $fields_map, $data, $add_mode, $title = null)
     {
         // Assign sections to fields
         foreach ($fields as $idx => $field) {
             if (!$field['section']) {
                 $fields[$idx]['section'] = isset($fields_map[$idx]) ? $fields_map[$idx] : 'other';
             }
         }
 
         // Sort
         foreach ($fields_map as $idx => $val) {
             if (array_key_exists($idx, $fields)) {
                 $fields_map[$idx] = $fields[$idx];
                 unset($fields[$idx]);
             }
             else {
                 unset($fields_map[$idx]);
             }
         }
         if (!empty($fields)) {
             $fields_map = array_merge($fields_map, $fields);
         }
 
         $form = new kolab_form($attribs);
 
         $default_values = array();
         $assoc_fields   = array();
         $req_fields     = array();
         $writeable      = 0;
 
         $auto_fields  = $this->output->get_env('auto_fields');
         $conf_aliases = array('mailquota' => 'quota');
         $domain       = $this->domain ?: $_SESSION['user']['domain'];
 
         // Parse elements and add them to the form object
         foreach ($sections as $section_idx => $section) {
             $form->add_section($section_idx, kolab_html::escape($this->translate($section)));
 
             foreach ($fields_map as $idx => $field) {
                 if ($field['section'] != $section_idx) {
                     continue;
                 }
 
                 if (empty($field['label'])) {
                     $field['label'] = "$name.$idx";
                 }
 
                 $field['label']       = kolab_html::escape($this->translate($field['label']));
                 $field['description'] = "$name.$idx.desc";
                 $field['section']     = $section_idx;
 
                 if (empty($field['value']) && $data[$idx] !== null && $data[$idx] !== '') {
                     $value = $data[$idx];
 
                     // Convert data for the list field with autocompletion
                     if ($field['data-type'] == 'list') {
                         if (!is_array($value)) {
                             if (!empty($field['data-autocomplete'])) {
                                 $value = array($value => $value);
                             }
                             else {
                                 $value = (array) $value;
                             }
                         }
 
                         $value = !empty($field['data-autocomplete']) ? array_keys($value) : array_values($value);
                     }
 
                     if (is_array($value)) {
                         $value = implode("\n", $value);
                     }
 
                     $field['value'] = $value;
                 }
                 else if ($add_mode && !isset($field['value'])) {
                     // read default from config, e.g. default_quota
                     if (!isset($field['default'])) {
                         $conf_name = 'default_' . ($conf_aliases[$idx] ?: $idx);
                         $field['default'] = $this->config->get($domain, $conf_name);
                     }
 
                     if (isset($field['default'])) {
                         $field['value']       = $field['default'];
                         $default_values[$idx] = $field['default'];
 
                         unset($field['default']);
                     }
                 }
 
                 // @TODO: We assume here that all autocompletion lists are associative
                 // It's likely that we'll need autocompletion on ordinary lists
                 if (!empty($field['data-autocomplete'])) {
                     $assoc_fields[$idx] = !empty($data[$idx]) ? $data[$idx] : array();
                 }
 
                 if ($field['type'] == kolab_form::INPUT_CHECKBOX && !isset($field['checked'])) {
                     $field['checked'] = $field['value'] == 'TRUE';
                     $field['value'] = 'TRUE';
                 }
 /*
                 if (!empty($field['suffix'])) {
                     $field['suffix'] = kolab_html::escape($this->translate($field['suffix']));
                 }
 */
                 if (!empty($field['options']) && empty($field['escaped'])) {
                     foreach ($field['options'] as $opt_idx => $option) {
                         if (is_array($option)) {
                             $field['options'][$opt_idx]['content'] = kolab_html::escape($this->translate($option['content']));
                         }
                         else {
                             $field['options'][$opt_idx] = kolab_html::escape($this->translate($option));
                         }
                     }
 
                     $field['escaped'] = true;
                 }
 
                 if (!empty($field['description'])) {
                     $description = $this->translate($field['description']);
                     if ($description != $field['description']) {
                         $field['title'] = $description;
                     }
                     unset($field['description']);
                 }
 
                 if (empty($field['name'])) {
                     $field['name'] = $idx;
                 }
 
                 if (empty($field['readonly']) && empty($field['disabled'])) {
                     // count writeable fields
                     if ($field['type'] && $field['type'] != kolab_form::INPUT_HIDDEN) {
                         $writeable++;
                     }
                     if ($idx != "userpassword2") {
                         if (!empty($field['required'])) {
                             $req_fields[] = $idx;
                         }
                     }
                 }
 
                 $form->add_element($field);
             }
         }
 
         if (!empty($data['section'])) {
             $form->activate_section($data['section']);
         }
 
         if ($writeable) {
             $form->add_button(array(
                 'value'   => kolab_html::escape($this->translate('button.submit')),
                 'onclick' => "kadm.command('{$name}.save')",
                 'class'   => 'submit',
             ));
         }
 
         // add Delete button
         if ($this->is_deletable($data)) {
             $id = $data['id'];
             $form->add_button(array(
                 'value'   => kolab_html::escape($this->translate('button.delete')),
                 'onclick' => "kadm.command('{$name}.delete', '{$id}')",
             ));
         }
 
         // add Clone button
         if (!empty($attribs['clone-button'])) {
             $id = $data['id'];
             $form->add_button(array(
                 'value'   => kolab_html::escape($this->translate('button.clone')),
                 'onclick' => "kadm.command('{$attribs['clone-button']}', '{$id}')",
             ));
         }
 
         $ac_min_len = $this->config_get('autocomplete_min_length', 1, Conf::INT);
 
         $this->output->set_env('form_id', $attribs['id']);
         $this->output->set_env('default_values', $default_values);
         $this->output->set_env('assoc_fields', $assoc_fields);
         $this->output->set_env('required_fields', $req_fields);
         $this->output->set_env('autocomplete_min_length', $ac_min_len);
         $this->output->set_env('entrydn', $data['entrydn']);
         $this->output->add_translation('form.required.empty', 'form.maxcount.exceeded',
             $name . '.add.success', $name . '.edit.success', $name . '.delete.success',
             $name . '.delete.confirm', $name . '.delete.force',
             'add', 'edit', 'delete');
 
         if (empty($title)) {
             $title = $add_mode ? $this->translate("$name.add") : $data['cn'];
         }
 
         $form->set_title(kolab_html::escape($title));
 
         return $form;
     }
 
     /**
      * Check wether specified object can be deleted
      */
     protected function is_deletable($data)
     {
         return !empty($data['id']) && in_array('delete', (array) $data['effective_rights']['entry']);
     }
 
     /**
      * Search form.
      *
      * @return string HTML output of the form
      */
     public function search_form()
     {
         $attribs = $this->get_search_attribs();
 
         if (empty($attribs)) {
             return '';
         }
 
         $options = array();
         foreach (array_keys($attribs) as $key) {
             $options[$key] = kolab_html::escape($this->translate('search.' . $key));
         }
 
         $form = new kolab_form(array('id' => 'search-form'));
 
         $form->add_section('criteria', kolab_html::escape($this->translate('search.criteria')));
         $form->add_element(array(
             'section' => 'criteria',
             'label'   => $this->translate('search.field'),
             'name'    => 'field',
             'type'    => kolab_form::INPUT_SELECT,
             'options' => $options,
         ));
         $form->add_element(array(
             'section' => 'criteria',
             'label'   => $this->translate('search.method'),
             'name'    => 'method',
             'type'    => kolab_form::INPUT_SELECT,
             'options' => array(
                 'both'   => kolab_html::escape($this->translate('search.contains')),
                 'exact'  => kolab_html::escape($this->translate('search.is')),
                 'prefix' => kolab_html::escape($this->translate('search.prefix')),
             ),
         ));
 
         return $form->output();
     }
 
     /**
      * Returns list of attributes assigned to search field(s)
      *
      * @param string $name Optional search field name
      *
      * @return array List of attributes
      */
     protected function get_search_attribs($name = null)
     {
         $task    = $this->get_task();
         $types   = $this->object_types($task);
         $attribs = array();
 
         foreach ($this->search_attribs as $key => $value) {
             foreach ((array)$value as $idx => $attr) {
                 $found = false;
                 foreach ($types as $type) {
                     if (array_key_exists($attr, (array)$type['attributes']['auto_form_fields'])
                         || array_key_exists($attr, (array)$type['attributes']['form_fields'])
                         || array_key_exists($attr, (array)$type['attributes']['fields'])
                     ) {
                         $found = true;
                         break;
                     }
                 }
 
                 if (!$found) {
                     unset($value[$idx]);
                 }
             }
 
             if (!empty($value)) {
                 $attribs[$key] = $value;
             }
         }
 
         return $name ? $attribs[$name] : $attribs;
     }
 
     /**
      * Object list (and search handler)
      */
     public function action_list()
     {
         if (empty($this->list_attribs)) {
             return;
         }
 
         $task = $this->get_task();
         $page = (int) self::get_input('page', 'POST');
 
         if (!$page || $page < 1) {
             $page = 1;
         }
 
         // request parameters
         $post = array(
             'attributes' => $this->list_attribs,
             'sort_by'    => $this->list_attribs,
 //            'sort_order' => 'ASC',
             'page_size'  => $this->page_size,
             'page'       => $page,
         );
 
         // search parameters
         if (!empty($_POST['search'])) {
             $search = self::get_input('search', 'POST', true);
             $field  = self::get_input('field',  'POST');
             $method = self::get_input('method', 'POST');
             $attrs  = $this->get_search_attribs($field);
             $search_request = array();
 
             // Support attribute=value searches
             if ($task != 'settings' && preg_match('/^([a-z0-9]+)([~<>]*=)(.+)$/i', $search, $m)) {
                 $search_attr  = $m[1];
                 $search_type  = $m[2];
                 $search_value = $m[3];
 
                 if ($search_value === '*') {
                     $search_type  = 'exists';
                     $search_value = '';
                 }
                 else if ($search_value[0] === '*' && $search_value[strlen($search_value)-1] === '*') {
                     $search_type  = 'both';
                     $search_value = substr($search_value, 1, -1);
                 }
                 else if ($search_value[0] === '*') {
                     $search_type  = 'suffix';
                     $search_value = substr($search_value, 1);
                 }
                 else if ($search_value[strlen($search_value)-1] === '*') {
                     $search_type  = 'prefix';
                     $search_value = substr($search_value, 0, -1);
                 }
 
                 $search_request[$search_attr] = array(
                     'value' => $search_value,
                     'type'  => $search_type,
                 );
             }
             else {
                 foreach ($attrs as $attr) {
                     $search_request[$attr] = array(
                         'value' => $search,
                         'type'  => $method,
                     );
                 }
             }
         }
         else if (!empty($_POST['search_request'])) {
             $search_request = self::get_input('search_request', 'POST');
             $search_request = @unserialize(base64_decode($search_request));
         }
 
         if (!empty($search_request)) {
             $post['search']          = $search_request;
             $post['search_operator'] = 'OR';
         }
 
         // get users list
         $module = $this->list_module ? $this->list_module : $task . 's';
         $result = $this->api_post($module . '.list', null, $post);
         $count  = $result->get('count');
         $result = (array) $result->get('list');
 
         // calculate records
         if ($count) {
             $start = 1 + max(0, $page - 1) * $this->page_size;
             $end   = min($start + $this->page_size - 1, $count);
         }
 
         $rows = $head = $foot = array();
         $cols = array('name');
         $i    = 0;
 
         $table_class = 'list';
 
         // table header
         $head[0]['cells'][] = array('class' => 'name', 'body' => $this->translate($task . '.list'));
 
         // table footer (navigation)
         if ($count) {
             $pages = ceil($count / $this->page_size);
             $prev  = max(0, $page - 1);
             $next  = $page < $pages ? $page + 1 : 0;
 
             $count_str = kolab_html::span(array(
                 'content' => $this->translate('list.records', $start, $end, $count)), true);
             $prev = kolab_html::a(array(
                 'class' => 'prev' . ($prev ? '' : ' disabled'),
                 'href'  => '#',
                 'onclick' => $prev ? "kadm.command('$task.list', {page: $prev})" : "return false",
             ));
             $next = kolab_html::a(array(
                 'class' => 'next' . ($next ? '' : ' disabled'),
                 'href'  => '#',
                 'onclick' => $next ? "kadm.command('$task.list', {page: $next})" : "return false",
             ));
 
             $foot_body = kolab_html::span(array('content' => $prev . $count_str . $next));
         }
         $foot[0]['cells'][] = array('class' => 'listnav', 'body' => $foot_body);
 
         // table body
         if (!empty($result)) {
             if (method_exists($this, 'list_result_handler')) {
                 list($rows, $head, $foot, $table_class) = $this->list_result_handler($result, $head, $foot, $table_class);
             }
             else {
                 foreach ($result as $idx => $item) {
                     if (!is_array($item)) {
                         continue;
                     }
 
                     $class = array('selectable');
 
                     if (method_exists($this, 'list_item_handler')) {
                         $item = $this->list_item_handler($item, $class);
                     }
                     else {
                         $item = array_shift($item);
                     }
 
                     if (empty($item)) {
                         continue;
                     }
 
                     $i++;
                     $cells = array();
                     $cells[] = array('class' => 'name', 'body' => kolab_html::escape($item),
                         'onclick' => "kadm.command('$task.info', '" . kolab_utils::js_escape($idx) . "')");
                     $rows[] = array('id' => $i, 'class' => implode(' ', $class), 'cells' => $cells);
                 }
             }
         }
         else {
             $rows[] = array('cells' => array(
                 0 => array('class' => 'empty-body', 'body' => $this->translate($task . '.norecords')
             )));
         }
 
         $table = kolab_html::table(array(
             'id'    => $task . 'list',
             'class' => $table_class,
             'head'  => $head,
             'body'  => $rows,
             'foot'  => $foot,
         ));
 
         if ($this->action == 'list') {
             $this->output->command('set_watermark', 'taskcontent');
         }
 
         $this->output->set_env('search_request', $search_request ? base64_encode(serialize($search_request)) : null);
         $this->output->set_env('list_page', $page);
         $this->output->set_env('list_count', $count);
         $this->output->set_env('list_size', count($result));
         $this->output->set_object($task . 'list', $table);
     }
 }
diff --git a/lib/locale/en_US.php b/lib/locale/en_US.php
index 967141b..4cbe353 100644
--- a/lib/locale/en_US.php
+++ b/lib/locale/en_US.php
@@ -1,449 +1,450 @@
 <?php
 
 $LANG['about.community'] = 'This is the Community Edition of the <b>Kolab Server</b>.';
 $LANG['about.kolab'] = 'Kolab';
 $LANG['about.kolabsys'] = 'Kolab Systems';
 $LANG['about.support'] = 'Professional support is available from <a href="http://kolabsys.com">Kolab Systems</a>.';
 $LANG['about.technology'] = 'Technology';
 $LANG['about.warranty'] = 'It comes with absolutely <b>no warranties</b> and is typically run entirely self supported. You can find help & information on the community <a href="http://kolab.org">web site</a> & <a href="http://wiki.kolab.org">wiki</a>.';
 
 $LANG['aci.new'] = 'New...';
 $LANG['aci.edit'] = 'Edit...';
 $LANG['aci.remove'] = 'Remove';
 $LANG['aci.users'] = 'Users';
 $LANG['aci.rights'] = 'Rights';
 $LANG['aci.targets'] = 'Targets';
 $LANG['aci.aciname'] = 'ACI name:';
 $LANG['aci.hosts'] = 'Hosts';
 $LANG['aci.times'] = 'Times';
 $LANG['aci.name'] = 'Name';
 $LANG['aci.userid'] = 'User ID';
 $LANG['aci.email'] = 'E-mail';
 $LANG['aci.read'] = 'Read';
 $LANG['aci.compare'] = 'Compare';
 $LANG['aci.search'] = 'Search';
 $LANG['aci.write'] = 'Write';
 $LANG['aci.selfwrite'] = 'Self-write';
 $LANG['aci.delete'] = 'Delete';
 $LANG['aci.add'] = 'Add';
 $LANG['aci.proxy'] = 'Proxy';
 $LANG['aci.all'] = 'All rights';
 $LANG['aci.allow'] = 'Allow';
 $LANG['aci.deny'] = 'Deny';
 $LANG['aci.typeusers'] = 'Users';
 $LANG['aci.typegroups'] = 'Groups';
 $LANG['aci.typeroles'] = 'Roles';
 $LANG['aci.typeadmins'] = 'Administrators';
 $LANG['aci.typespecials'] = 'Special Rights';
 $LANG['aci.ldap-self'] = 'Self';
 $LANG['aci.ldap-anyone'] = 'All users';
 $LANG['aci.ldap-all'] = 'All authenticated users';
 $LANG['aci.ldap-parent'] = 'Parent';
 $LANG['aci.usersearch'] = 'Search for:';
 $LANG['aci.usersearchresult'] = 'Search results:';
 $LANG['aci.userselected'] = 'Selected users/groups/roles:';
 $LANG['aci.useradd'] = 'Add';
 $LANG['aci.userremove'] = 'Remove';
 $LANG['aci.error.noname'] = 'ACI rule name is required!';
 $LANG['aci.error.exists'] = 'ACI rule with specified name already exists!';
 $LANG['aci.error.nousers'] = 'At least one user entry is required!';
 $LANG['aci.rights.target'] = 'Target entry:';
 $LANG['aci.rights.filter'] = 'Filter:';
 $LANG['aci.rights.attrs'] = 'Attributes:';
 $LANG['aci.checkall'] = 'Check all';
 $LANG['aci.checknone'] = 'Check none';
 $LANG['aci.thisentry'] = 'This entry';
 $LANG['aci.selected'] = 'all selected';
 $LANG['aci.other'] = 'all except selected';
 
 $LANG['acl.all'] = 'All';
 $LANG['acl.custom'] = 'Custom...';
 $LANG['acl.full'] = 'Full (without access control)';
 $LANG['acl.read-only'] = 'Read-Only';
 $LANG['acl.read-write'] = 'Read/Write';
 $LANG['acl.semi-full'] = 'Write new items';
 $LANG['acl.l'] = 'l - Lookup';
 $LANG['acl.r'] = 'r - Read messages';
 $LANG['acl.s'] = 's - Keep Seen state';
 $LANG['acl.w'] = 'w - Write flags';
 $LANG['acl.i'] = 'i - Insert (Copy into)';
 $LANG['acl.p'] = 'p - Post';
 $LANG['acl.c'] = 'c - Create subfolders';
 $LANG['acl.k'] = 'k - Create subfolders';
 $LANG['acl.d'] = 'd - Delete messages';
 $LANG['acl.t'] = 't - Delete messages';
 $LANG['acl.e'] = 'e - Expunge';
 $LANG['acl.x'] = 'x - Delete folder';
 $LANG['acl.a'] = 'a - Administer';
 $LANG['acl.n'] = 'n - Annotate messages';
 $LANG['acl.identifier'] = 'Identifier';
 $LANG['acl.rights'] = 'Access Rights';
 $LANG['acl.expire'] = 'Expires On';
 $LANG['acl.user'] = 'User...';
 $LANG['acl.anyone'] = 'All users (anyone)';
 $LANG['acl.anonymous'] = 'Guests (anonymous)';
 $LANG['acl.error.invaliddate'] = 'Invalid date format!';
 $LANG['acl.error.norights'] = 'No access rights specified!';
 $LANG['acl.error.subjectexists'] = 'Access rights for specified identifier already exist!';
 $LANG['acl.error.nouser'] = 'User identifier not specified!';
 
 $LANG['add'] = 'Add';
 
 $LANG['api.notypeid'] = 'No object type ID specified!';
 $LANG['api.invalidtypeid'] = 'Invalid object type ID!';
 
 $LANG['attribute.add'] = 'Add attribute';
 $LANG['attribute.default'] = 'Default value';
 $LANG['attribute.static'] = 'Static value';
 $LANG['attribute.name'] = 'Attribute';
 $LANG['attribute.optional'] = 'Optional';
 $LANG['attribute.maxcount'] = 'Max. count';
 $LANG['attribute.readonly'] = 'Read-only';
 $LANG['attribute.type'] = 'Field type';
 $LANG['attribute.value'] = 'Value';
 $LANG['attribute.value.auto'] = 'Generated';
 $LANG['attribute.value.auto-readonly'] = 'Generated (read-only)';
 $LANG['attribute.value.normal'] = 'Normal';
 $LANG['attribute.value.static'] = 'Static';
 $LANG['attribute.options'] = 'Options';
 $LANG['attribute.key.invalid'] = 'Type key contains forbidden characters!';
 $LANG['attribute.required.error'] = 'Required attributes missing in attributes list ($1)!';
 $LANG['attribute.validate'] = ' Validation';
 $LANG['attribute.validate.default'] = 'default';
 $LANG['attribute.validate.none'] = 'none';
 $LANG['attribute.validate.basic'] = 'basic';
 $LANG['attribute.validate.extended'] = 'extended';
 
 $LANG['button.cancel'] = 'Cancel';
 $LANG['button.clone'] = 'Clone';
 $LANG['button.delete'] = 'Delete';
 $LANG['button.ok'] = 'OK';
 $LANG['button.save'] = 'Save';
 $LANG['button.submit'] = 'Submit';
 
 $LANG['creatorsname'] = 'Created by';
 $LANG['days'] = 'days';
 $LANG['debug'] = 'Debug info';
 $LANG['delete'] = 'Delete';
 $LANG['deleting'] = 'Deleting data...';
 
 $LANG['domain.add'] = 'Add Domain';
 $LANG['domain.add.success'] = 'Domain created successfully.';
 $LANG['domain.associateddomain'] = 'Domain name(s)';
 $LANG['domain.delete.confirm'] = 'Are you sure, you want to delete this domain?';
 $LANG['domain.delete.force'] = "There are users assigned to this domain.\nAre you sure, you want to delete this domain and all assigned objects?";
 $LANG['domain.delete.success'] = 'Domain deleted successfully.';
 $LANG['domain.edit'] = 'Edit domain';
 $LANG['domain.edit.success'] = 'Domain updated successfully.';
 $LANG['domain.inetdomainbasedn'] = 'Custom Root DN';
 $LANG['domain.inetdomainstatus'] = 'Status';
 $LANG['domain.list'] = 'Domains List';
 $LANG['domain.norecords'] = 'No domain records found!';
 $LANG['domain.o'] = 'Organization';
 $LANG['domain.other'] = 'Other';
 $LANG['domain.system'] = 'System';
 $LANG['domain.type_id'] = 'Standard Domain';
 
 $LANG['edit'] = 'Edit';
 $LANG['error'] = 'Error';
 
 $LANG['error.401'] = 'Unauthorized.';
 $LANG['error.403'] = 'Access forbidden.';
 $LANG['error.404'] = 'Object not found.';
 $LANG['error.408'] = 'Request timeout.';
 $LANG['error.450'] = 'Domain is not empty.';
 $LANG['error.500'] = 'Internal server error.';
 $LANG['error.503'] = 'Service unavailable. Try again later.';
 
 $LANG['form.required.empty'] = 'Some of the required fields are empty!';
 $LANG['form.maxcount.exceeded'] = 'Maximum count of items exceeded!';
 
 $LANG['group.add'] = 'Add Group';
 $LANG['group.add.success'] = 'Group created successfully.';
 $LANG['group.cn'] = 'Common name';
 $LANG['group.delete.confirm'] = 'Are you sure, you want to delete this group?';
 $LANG['group.delete.success'] = 'Group deleted successfully.';
 $LANG['group.edit.success'] = 'Group updated successfully.';
 $LANG['group.gidnumber'] = 'Primary group number';
 $LANG['group.kolaballowsmtprecipient'] = 'Recipient(s) Access List';
 $LANG['group.kolaballowsmtpsender'] = 'Sender Access List';
 $LANG['group.list'] = 'Groups List';
 $LANG['group.mail'] = 'Primary Email Address';
 $LANG['group.member'] = 'Member(s)';
 $LANG['group.memberurl'] = 'Members URL';
 $LANG['group.norecords'] = 'No group records found!';
 $LANG['group.other'] = 'Other';
 $LANG['group.ou'] = 'Organizational Unit';
 $LANG['group.system'] = 'System';
 $LANG['group.type_id'] = 'Group type';
 $LANG['group.uniquemember'] = 'Members';
 
 $LANG['info'] = 'Information';
 $LANG['internalerror'] = 'Internal system error!';
 
 $LANG['ldap.one'] = 'one: all entries one level under the base DN';
 $LANG['ldap.sub'] = 'sub: whole subtree starting with the base DN';
 $LANG['ldap.base'] = 'base: base DN only';
 $LANG['ldap.basedn'] = 'Base DN';
 $LANG['ldap.host'] = 'LDAP Server';
 $LANG['ldap.conditions'] = 'Conditions';
 $LANG['ldap.scope'] = 'Scope';
 $LANG['ldap.filter_any'] = 'is non-empty';
 $LANG['ldap.filter_both'] = 'contains';
 $LANG['ldap.filter_prefix'] = 'starts with';
 $LANG['ldap.filter_suffix'] = 'ends with';
 $LANG['ldap.filter_exact'] = 'is equal to';
+$LANG['ldap.filter_notexact'] = 'is not equal to';
 
 $LANG['list.records'] = '$1 to $2 of $3';
 
 $LANG['loading'] = 'Loading...';
 $LANG['logout'] = 'Logout';
 $LANG['login.username'] = 'Username:';
 $LANG['login.password'] = 'Password:';
 $LANG['login.domain'] = 'Domain:';
 $LANG['login.login'] = 'Login';
 $LANG['loginerror'] = 'Incorrect username or password!';
 $LANG['MB'] = 'MB';
 
 $LANG['menu.about'] = 'About';
 $LANG['menu.domains'] = 'Domains';
 $LANG['menu.groups'] = 'Groups';
 $LANG['menu.ous'] = 'Units';
 $LANG['menu.resources'] = 'Resources';
 $LANG['menu.roles'] = 'Roles';
 $LANG['menu.settings'] = 'Settings';
 $LANG['menu.sharedfolders'] = 'Shared Folders';
 $LANG['menu.users'] = 'Users';
 
 $LANG['modifiersname'] = 'Modified by';
 $LANG['password.generate'] = 'Generate password';
 $LANG['reqtime'] = 'Request time: $1 sec.';
 
 $LANG['ou.aci'] = 'Access Rights';
 $LANG['ou.add'] = 'Add Unit';
 $LANG['ou.add.success'] = 'Unit created successfully.';
 $LANG['ou.ou'] = 'Unit Name';
 $LANG['ou.delete.confirm'] = 'Are you sure, you want to delete this organizational unit?';
 $LANG['ou.delete.success'] = 'Unit deleted successfully.';
 $LANG['ou.description'] = 'Unit Description';
 $LANG['ou.edit.success'] = 'Unit updated successfully.';
 $LANG['ou.list'] = 'Organizational Unit List';
 $LANG['ou.norecords'] = 'No organizational unit records found!';
 $LANG['ou.system'] = 'Details';
 $LANG['ou.type_id'] = 'Unit Type';
 $LANG['ou.base_dn'] = 'Parent Unit';
 
 $LANG['resource.acl'] = 'Access Rights';
 $LANG['resource.add'] = 'Add Resource';
 $LANG['resource.add.success'] = 'Resource created successfully.';
 $LANG['resource.cn'] = 'Name';
 $LANG['resource.delete'] = 'Delete Resource';
 $LANG['resource.delete.confirm'] = 'Are you sure, you want to delete this resource?';
 $LANG['resource.delete.success'] = 'Resource deleted successfully.';
 $LANG['resource.edit'] = 'Edit Resource';
 $LANG['resource.edit.success'] = 'Resource updated successfully.';
 $LANG['resource.kolabtargetfolder'] = 'Target Folder';
 $LANG['resource.kolabinvitationpolicy'] = 'Invitation Policy';
 $LANG['resource.kolabdescattribute'] = 'Attributes';
 $LANG['resource.list'] = 'Resource (Collection) List';
 $LANG['resource.mail'] = 'Mail Address';
 $LANG['resource.member'] = 'Collection Members';
 $LANG['resource.norecords'] = 'No resource records found!';
 $LANG['resource.other'] = 'Other';
 $LANG['resource.ou'] = 'Organizational Unit';
 $LANG['resource.system'] = 'System';
 $LANG['resource.type_id'] = 'Resource Type';
 $LANG['resource.uniquemember'] = 'Collection Members';
 $LANG['resource.description'] = 'Description';
 $LANG['resource.owner'] = 'Owner';
 
 $LANG['role.add'] = 'Add Role';
 $LANG['role.add.success'] = 'Role created successfully.';
 $LANG['role.cn'] = 'Role Name';
 $LANG['role.delete.confirm'] = 'Are you sure, you want to delete this role?';
 $LANG['role.delete.success'] = 'Role deleted successfully.';
 $LANG['role.description'] = 'Role Description';
 $LANG['role.edit.success'] = 'Role updated successfully.';
 $LANG['role.list'] = 'Role List';
 $LANG['role.norecords'] = 'No role records found!';
 $LANG['role.system'] = 'Details';
 $LANG['role.type_id'] = 'Role Type';
 
 $LANG['saving'] = 'Saving data...';
 
 $LANG['search'] = 'Search';
 $LANG['search.reset'] = 'Reset';
 $LANG['search.criteria'] = 'Search criteria';
 $LANG['search.field'] = 'Field:';
 $LANG['search.method'] = 'Method:';
 $LANG['search.contains'] = 'contains';
 $LANG['search.is'] = 'is';
 $LANG['search.key'] = 'key';
 $LANG['search.prefix'] = 'begins with';
 $LANG['search.name'] = 'name';
 $LANG['search.email'] = 'email';
 $LANG['search.description'] = 'description';
 $LANG['search.uid'] = 'UID';
 $LANG['search.loading'] = 'Searching...';
 $LANG['search.acchars'] = 'At least $min characters required for autocompletion';
 
 $LANG['servererror'] = 'Server Error!';
 
 $LANG['session.expired'] = 'Session has expired. Login again, please';
 
 $LANG['sharedfolder.acl'] = 'IMAP Access Rights';
 $LANG['sharedfolder.add'] = 'Add Shared Folder';
 $LANG['sharedfolder.add.success'] = 'Shared folder created successfully.';
 $LANG['sharedfolder.alias'] = 'Secondary Email Address(es)';
 $LANG['sharedfolder.cn'] = 'Folder Name';
 $LANG['sharedfolder.delete.confirm'] = 'Are you sure, you want to delete this shared folder?';
 $LANG['sharedfolder.delete.success'] = 'Shared folder deleted successfully.';
 $LANG['sharedfolder.edit'] = 'Edit Shared Folder';
 $LANG['sharedfolder.edit.success'] = 'Shared folder updated successfully.';
 $LANG['sharedfolder.kolaballowsmtprecipient'] = 'Recipient(s) Access List';
 $LANG['sharedfolder.kolaballowsmtpsender'] = 'Sender Access List';
 $LANG['sharedfolder.kolabdelegate'] = 'Delegate(s)';
 $LANG['sharedfolder.kolabtargetfolder'] = 'Target IMAP Folder';
 $LANG['sharedfolder.list'] = 'Shared Folders List';
 $LANG['sharedfolder.norecords'] = 'No shared folder records found!';
 $LANG['sharedfolder.mail'] = 'Email Address';
 $LANG['sharedfolder.other'] = 'Other';
 $LANG['sharedfolder.system'] = 'System';
 $LANG['sharedfolder.type_id'] = 'Shared Folder Type';
 
 $LANG['signup.headline'] = 'Sign Up for Hosted Kolab';
 $LANG['signup.intro1'] = 'Having an account on a Kolab server is way better than just simple Email. It also provides you with full groupware functionality including synchronization for shared addressbooks, calendars, tasks, journal and more.';
 $LANG['signup.intro2'] = 'You can sign up here now for an account.';
 $LANG['signup.formtitle'] = 'Sign Up';
 $LANG['signup.username'] = 'Username';
 $LANG['signup.domain'] = 'Domain';
 $LANG['signup.mailalternateaddress'] = 'Current Email Address';
 $LANG['signup.futuremail'] = 'Future Email Address';
 $LANG['signup.company'] = 'Company';
 $LANG['signup.captcha'] = 'CAPTCHA';
 $LANG['signup.userexists'] = 'User already exists!';
 $LANG['signup.usercreated'] = '<h3>Your account has been successfully added!</h3>Congratulations, you now have your own Kolab account.';
 $LANG['signup.wronguid'] = 'Invalid Username!';
 $LANG['signup.wrongmailalternateaddress'] = 'Please provide a valid Email Address!';
 $LANG['signup.footer'] = 'This is a service offered by <a href="http://kolabsys.com">Kolab Systems</a>.';
 
 $LANG['type.add'] = 'Add Object Type';
 $LANG['type.add.success'] = 'Object type created successfully.';
 $LANG['type.attributes'] = 'Attributes';
 $LANG['type.description'] = 'Description';
 $LANG['type.delete.confirm'] = 'Are you sure, you want to delete this object type?';
 $LANG['type.delete.success'] = 'Object type deleted successfully.';
 $LANG['type.domain'] = 'Domain';
 $LANG['type.edit.success'] = 'Object type updated successfully.';
 $LANG['type.group'] = 'Group';
 $LANG['type.is_default'] = 'Default';
 $LANG['type.list'] = 'Object Types List';
 $LANG['type.key'] = 'Key';
 $LANG['type.name'] = 'Name';
 $LANG['type.norecords'] = 'No object type records found!';
 $LANG['type.objectclass'] = 'Object class';
 $LANG['type.object_type'] = 'Object type';
 $LANG['type.ou'] = 'Organizational Unit';
 $LANG['type.properties'] = 'Properties';
 $LANG['type.resource'] = 'Resource';
 $LANG['type.role'] = 'Role';
 $LANG['type.sharedfolder'] = 'Shared Folder';
 $LANG['type.used_for'] = 'Hosted';
 $LANG['type.user'] = 'User';
 
 $LANG['user.add'] = 'Add User';
 $LANG['user.add.success'] = 'User created successfully.';
 $LANG['user.alias'] = 'Secondary Email Address(es)';
 $LANG['user.astaccountallowedcodec'] = 'Allowed codec(s)';
 $LANG['user.astaccountcallerid'] = 'Caller ID';
 $LANG['user.astaccountcontext'] = 'Account Context';
 $LANG['user.astaccountdefaultuser'] = 'Asterisk Account Default User';
 $LANG['user.astaccountdeny'] = 'Account deny';
 $LANG['user.astaccounthost'] = 'Asterisk Host';
 $LANG['user.astaccountmailbox'] = 'Mailbox';
 $LANG['user.astaccountnat'] = 'Account uses NAT';
 $LANG['user.astaccountname'] = 'Asterisk Account Name';
 $LANG['user.astaccountqualify'] = 'Account Qualify';
 $LANG['user.astaccountrealmedpassword'] = 'Realmed Account Password';
 $LANG['user.astaccountregistrationexten'] = 'Extension';
 $LANG['user.astaccountregistrationcontext'] = 'Registration Context';
 $LANG['user.astaccountsecret'] = 'Plaintext Password';
 $LANG['user.astaccounttype'] = 'Account Type';
 $LANG['user.astcontext'] = 'Asterisk Context';
 $LANG['user.asterisk'] = 'Asterisk SIP';
 $LANG['user.astextension'] = 'Asterisk Extension';
 $LANG['user.astvoicemailpassword'] = 'Voicemail PIN Code';
 $LANG['user.c'] = 'Country';
 $LANG['user.city'] = 'City';
 $LANG['user.cn'] = 'Common name';
 $LANG['user.config'] = 'Configuration';
 $LANG['user.contact'] = 'Contact';
 $LANG['user.contact_info'] = 'Contact Information';
 $LANG['user.country'] = 'Country';
 $LANG['user.country.desc'] = '2 letter code from ISO 3166-1';
 $LANG['user.delete.confirm'] = 'Are you sure, you want to delete this user?';
 $LANG['user.delete.success'] = 'User deleted successfully.';
 $LANG['user.displayname'] = 'Display name';
 $LANG['user.edit.success'] = 'User updated successfully.';
 $LANG['user.fax'] = 'Fax number';
 $LANG['user.fbinterval'] = 'Free-Busy interval';
 $LANG['user.fbinterval.desc'] = 'Leave blank for default (60 days)';
 $LANG['user.gidnumber'] = 'Primary group number';
 $LANG['user.givenname'] = 'Given name';
 $LANG['user.homedirectory'] = 'Home directory';
 $LANG['user.homephone'] = 'Home Phone Number';
 $LANG['user.initials'] = 'Initials';
 $LANG['user.invitation-policy'] = 'Invitation policy';
 $LANG['user.kolaballowsmtprecipient'] = 'Recipient(s) Access List';
 $LANG['user.kolaballowsmtpsender'] = 'Sender Access List';
 $LANG['user.kolabdelegate'] = 'Delegates';
 $LANG['user.kolabhomeserver'] = 'Email Server';
 $LANG['user.kolabinvitationpolicy'] = 'Invitation Handling Policy';
 $LANG['user.l'] = 'City, Region';
 $LANG['user.list'] = 'Users List';
 $LANG['user.loginshell'] = 'Shell';
 $LANG['user.mail'] = 'Primary Email Address';
 $LANG['user.mailalternateaddress'] = 'External Email Address(es)';
 $LANG['user.mailforwardingaddress'] = 'Forward Mail To';
 $LANG['user.mailhost'] = 'Email Server';
 $LANG['user.mailquota'] = 'Quota';
 $LANG['user.mailquota.desc'] = 'Leave blank for unlimited';
 $LANG['user.mobile'] = 'Mobile Phone Number';
 $LANG['user.name'] = 'Name';
 $LANG['user.norecords'] = 'No user records found!';
 $LANG['user.nsrole'] = 'Role(s)';
 $LANG['user.nsroledn'] = 'Role(s)';
 $LANG['user.other'] = 'Other';
 $LANG['user.o'] = 'Organization';
 $LANG['user.org'] = 'Organization';
 $LANG['user.orgunit'] = 'Organizational Unit';
 $LANG['user.ou'] = 'Organizational Unit';
 $LANG['user.pager'] = 'Pager Number';
 $LANG['user.password.notallowed'] = 'Password contains characters (eg. Umlaut) that are not permitted';
 $LANG['user.password.mismatch'] = 'Passwords do not match!';
 $LANG['user.password.moreupper'] = 'Password needs to contain at least $1 uppercase character(s)';
 $LANG['user.password.morelower'] = 'Password needs to contain at least $1 lowercase character(s)';
 $LANG['user.password.moredigits'] = 'Password needs to contain at least $1 digit(s)';
 $LANG['user.password.morespecial'] = 'Password needs to contain at least $1 special character(s): $2';
 $LANG['user.password.tooshort'] = 'Password is too short, it must have at least $1 characters';
 $LANG['user.personal'] = 'Personal';
 $LANG['user.phone'] = 'Phone number';
 $LANG['user.postalcode'] = 'Postal Code';
 $LANG['user.postbox'] = 'Postal box';
 $LANG['user.postcode'] = 'Postal code';
 $LANG['user.preferredlanguage'] = 'Native tongue';
 $LANG['user.room'] = 'Room number';
 $LANG['user.sn'] = 'Surname';
 $LANG['user.street'] = 'Street';
 $LANG['user.system'] = 'System';
 $LANG['user.telephonenumber'] = 'Phone Number';
 $LANG['user.title'] = 'Job Title';
 $LANG['user.type_id'] = 'Account type';
 $LANG['user.uid'] = 'Unique identity (UID)';
 $LANG['user.userpassword'] = 'Password';
 $LANG['user.userpassword2'] = 'Confirm password';
 $LANG['user.uidnumber'] = 'User ID number';
 
 $LANG['welcome'] = 'Welcome to the Kolab Groupware Server Maintenance';
 
 $LANG['yes'] = 'yes';
diff --git a/public_html/js/kolab_admin.js b/public_html/js/kolab_admin.js
index 368557a..1701a8e 100644
--- a/public_html/js/kolab_admin.js
+++ b/public_html/js/kolab_admin.js
@@ -1,3639 +1,3649 @@
 /*
  +--------------------------------------------------------------------------+
  | This file is part of the Kolab Web Admin Panel                           |
  |                                                                          |
  | Copyright (C) 2011-2014, Kolab Systems AG                                |
  |                                                                          |
  | This program is free software: you can redistribute it and/or modify     |
  | it under the terms of the GNU Affero General Public License as published |
  | by the Free Software Foundation, either version 3 of the License, or     |
  | (at your option) any later version.                                      |
  |                                                                          |
  | This program is distributed in the hope that it will be useful,          |
  | but WITHOUT ANY WARRANTY; without even the implied warranty of           |
  | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the             |
  | GNU Affero General Public License for more details.                      |
  |                                                                          |
  | You should have received a copy of the GNU Affero General Public License |
  | along with this program. If not, see <http://www.gnu.org/licenses/>      |
  +--------------------------------------------------------------------------+
  | Author: Aleksander Machniak <machniak@kolabsys.com>                      |
  +--------------------------------------------------------------------------+
 */
 
 function kolab_admin()
 {
   var self = this;
 
   this.env = {};
   this.translations = {};
   this.request_timeout = 300;
   this.message_time = 3000;
   this.events = {};
   this.attr_default_rx = /^(text|select|imap_acl)/;
 
   // set jQuery ajax options
   $.ajaxSetup({
     cache: false,
     error: function(request, status, err) { self.http_error(request, status, err); },
     beforeSend: function(xmlhttp) { xmlhttp.setRequestHeader('X-Session-Token', self.env.token); }
   });
 
   /*********************************************************/
   /*********          basic utilities              *********/
   /*********************************************************/
 
   // set environment variable(s)
   this.set_env = function(p, value)
   {
     if (p != null && typeof p === 'object' && !value)
       for (var n in p)
         this.env[n] = p[n];
     else
       this.env[p] = value;
   };
 
   // add a localized label(s) to the client environment
   this.tdef = function(p, value)
   {
     if (typeof p == 'string')
       this.translations[p] = value;
     else if (typeof p == 'object')
       $.extend(this.translations, p);
   };
 
   // return a localized string
   this.t = function(label)
   {
     if (this.translations[label])
       return this.translations[label];
     else
       return label;
   };
 
   // print a message into browser console
   this.log = function(msg)
   {
     if (window.console && console.log)
       console.log(msg);
   };
 
   // execute a specific command on the web client
   this.command = function(command, props, obj)
   {
     if (obj && obj.blur)
       obj.blur();
 
     if (this.busy)
       return false;
 
     this.set_busy(true, 'loading');
 
     var ret = undefined,
       func = command.replace(/[^a-z]/g, '_'),
       task = command.replace(/\.[a-z-_]+$/g, '');
 
     if (this[func] && typeof this[func] === 'function') {
       ret = this[func](props);
     }
     else {
       this.http_post(command, props);
     }
 
     // update menu state
     $('li', $('#navigation')).removeClass('active');
     $('li.'+task, ('#navigation')).addClass('active');
 
     if (ret === false)
       this.set_busy(false);
 
     return ret === false ? false : obj ? false : true;
   };
 
   this.set_busy = function(a, message)
   {
     if (a && message) {
       var msg = this.t(message);
       if (msg == message)
         msg = 'Loading...';
 
       this.display_message(msg, 'loading');
     }
     else if (!a) {
       this.hide_message('loading');
     }
 
     this.busy = a;
 
 //    if (this.gui_objects.editform)
   //    this.lock_form(this.gui_objects.editform, a);
 
     // clear pending timer
     if (this.request_timer)
       clearTimeout(this.request_timer);
 
     // set timer for requests
     if (a && this.env.request_timeout)
       this.request_timer = window.setTimeout(function() { self.request_timed_out(); }, this.request_timeout * 1000);
   };
 
   // called when a request timed out
   this.request_timed_out = function()
   {
     this.set_busy(false);
     this.display_message('Request timed out!', 'error');
   };
 
   // Add variable to GET string, replace old value if exists
   this.add_url = function(url, name, value)
   {
     value = urlencode(value);
 
     if (/(\?.*)$/.test(url)) {
       var urldata = RegExp.$1,
         datax = RegExp('((\\?|&)'+RegExp.escape(name)+'=[^&]*)');
 
       if (datax.test(urldata))
         urldata = urldata.replace(datax, RegExp.$2 + name + '=' + value);
       else
         urldata += '&' + name + '=' + value
 
       return url.replace(/(\?.*)$/, urldata);
     }
     else
       return url + '?' + name + '=' + value;
   };
 
   this.trigger_event = function(event, data)
   {
     if (this.events[event])
       for (var i in this.events[event])
         this.events[event][i](data);
   };
 
   this.add_event_listener = function(event, func)
   {
     if (!this.events[event])
       this.events[event] = [];
 
     this.events[event].push(func);
   };
 
 
   /*********************************************************/
   /*********           GUI functionality           *********/
   /*********************************************************/
 
   // write to the document/window title
   this.set_pagetitle = function(title)
   {
     if (title && document.title)
       document.title = title;
   };
 
   // display a system message (types: loading, notice, error)
   this.display_message = function(msg, type, timeout)
   {
     var obj;
 
     if (!type)
       type = 'notice';
     if (msg)
       msg = this.t(msg);
 
     if (type == 'loading') {
       timeout = this.request_timeout * 1000;
       if (!msg)
         msg = this.t('loading');
     }
     else if (!timeout)
       timeout = this.message_time * (type == 'error' || type == 'warning' ? 2 : 1);
 
     obj = $('<div>');
 
     if (type != 'loading') {
       msg = '<div><span>' + msg + '</span></div>';
       obj.addClass(type).click(function() { return self.hide_message(); });
     }
 
     if (timeout > 0)
       window.setTimeout(function() { self.hide_message(type, type != 'loading'); }, timeout);
 
     if (type == 'loading')
       this.hide_message(type);
 
     obj.attr('id', type == 'loading' ? 'loading' : 'message')
       .appendTo('body').html(msg).show();
   };
 
   // make a message to disapear
   this.hide_message = function(type, fade)
   {
     if (type == 'loading')
       $('#loading').remove();
     else
       $('#message').fadeOut('normal', function() { $(this).remove(); });
   };
 
   this.set_watermark = function(id)
   {
     if (this.env.watermark)
       $('#'+id).html(this.env.watermark);
   }
 
   // modal dialog popup
   this.modal_dialog = function(content, buttons, opts)
   {
     var settings = {btns: {}},
       body = $('<div class="modal"></div>'),
       head, foot, footer = [];
 
     // title bar
     if (opts && opts.title)
       $('<div class="modal_header"></div>')
         .append($('<span>').text(opts.title))
         .appendTo(body);
 
     // dialog content
     if (typeof content != 'object')
       content = $('<div></div>').html(content);
 
     content.addClass('modal_msg').appendTo(body);
 
     // buttons
     $.each(buttons, function(i, v) {
       var n = i.replace(/[^a-z0-9_]/ig, '');
       settings.btns[n] = v;
       footer.push({name: n, label: self.t(i)});
     });
 
 //    if (!settings.btns.cancel && (!opts || !opts.no_cancel))
 //      settings.btns.cancel = function() { this.hide(); };
 
     if (footer.length) {
       foot = $('<div class="modal_btns"></div>');
       $.each(footer, function() {
         $('<div></div>').addClass('modal_btn_' + this.name).text(this.label).appendTo(foot);
       });
 
       body.append(foot);
     }
 
     // configure and display dialog
     body.wModal(settings).wModal('show');
   };
 
   this.tree_list_init = function()
   {
     $('table.list.tree span.expando').click(function() {
       var tr = $(this).parents('table.list.tree tr'),
         expanded = tr.hasClass('expanded'),
         level = tr.data('level') || 0,
         row = tr[0],
         found = false;
 
       tr[expanded ? 'removeClass' : 'addClass']('expanded');
 
       $('tr', tr.parent()).each(function() {
         if (this === row) {
           found = true;
           return;
         }
 
         if (!found)
           return;
 
         var r = $(this), l = r.data('level') || 0;
 
         if (l <= level)
           return false;
 
         if (!expanded && l == level+1)
           r.show();
         else if (expanded && l > level)
           r.hide().removeClass('expanded');
       });
 
       return false;
     });
   };
 
   // position and display popup
   this.popup_show = function(e, popup)
   {
     var popup = $(popup),
       pos = this.mouse_pos(e),
       win = $(window),
       w = popup.width(),
       h = popup.height(),
       left = pos.left - w,
       top = pos.top;
 
     if (top + h > win.height())
       top -= h;
     if (left + w > win.width())
       left -= w;
 
     popup.css({left: left + 'px', top: top + 'px'}).show();
     e.stopPropagation();
   };
 
 
   /********************************************************/
   /*********        Remote request methods        *********/
   /********************************************************/
 
   // compose a valid url with the given parameters
   this.url = function(action, query)
   {
     var k, param = {},
       querystring = typeof query === 'string' ? '&' + query : '';
 
     if (typeof action !== 'string')
       query = action;
     else if (!query || typeof query !== 'object')
       query = {};
 
     // overwrite task name
     if (action) {
       if (action.match(/^([a-z]+)/i))
         query.task = RegExp.$1;
       if (action.match(/[^a-z0-9-_]([a-z0-9-_]+)$/i))
         query.action = RegExp.$1;
     }
 
     // remove undefined values
     for (k in query) {
       if (query[k] !== undefined && query[k] !== null)
         param[k] = query[k];
     }
 
     return '?' + $.param(param) + querystring;
   };
 
   // send a http POST request to the server
   this.http_post = function(action, postdata)
   {
     var url = this.url(action);
 
     if (postdata && typeof postdata === 'object')
       postdata.remote = 1;
     else {
       if (!postdata)
         postdata = '';
       postdata += '&remote=1';
     }
 
     this.set_request_time();
 
     return $.ajax({
       type: 'POST', url: url, data: postdata, dataType: 'json',
       success: function(response) { kadm.http_response(response, action); },
       error: function(o, status, err) { kadm.http_error(o, status, err); }
     });
   };
 
   // send a http POST request to the API service
   this.api_post = function(action, postdata, func)
   {
     var url = 'api/' + action;
 
     if (!func) func = 'api_response';
 
     this.set_request_time();
 
     return $.ajax({
       type: 'POST', url: url, data: JSON.stringify(postdata), dataType: 'json',
       contentType: 'application/json; charset=utf-8',
       success: function(response) { kadm[func](response); },
       error: function(o, status, err) { kadm.http_error(o, status, err); }
     });
   };
 
   // handle HTTP response
   this.http_response = function(response, action)
   {
     var i;
 
     if (!response)
       return;
 
     // set env vars
     if (response.env)
       this.set_env(response.env);
 
     // we have translation labels to add
     if (typeof response.labels === 'object')
       this.tdef(response.labels);
 
     // HTML page elements
     if (response.objects)
       for (i in response.objects)
         $('#'+i).html(response.objects[i]);
 
     this.update_request_time();
     this.set_busy(false);
 
     // if we get javascript code from server -> execute it
     if (response.exec)
       eval(response.exec);
 
     response.action = action;
     this.trigger_event('http-response', response);
   };
 
   // handle HTTP request errors
   this.http_error = function(request, status, err)
   {
     var errmsg = request.statusText;
 
     this.set_busy(false);
     request.abort();
 
     if (request.status && errmsg)
       this.display_message(this.t('servererror') + ' (' + errmsg + ')', 'error');
   };
 
   this.api_response = function(response)
   {
     this.update_request_time();
     this.set_busy(false);
 
     if (!response || response.status != 'OK') {
       // Logout on invalid-session error
       if (response && response.code == 403)
         this.main_logout();
       else
         this.display_message(response && response.reason ? response.reason : this.t('servererror'), 'error');
 
       return false;
     }
 
     return true;
   };
 
 
   /*********************************************************/
   /*********     keyboard autocomplete methods     *********/
   /*********************************************************/
 
   this.ac_init = function(obj, props)
   {
     if (props && props.form) {
       if (i = $('[name="type_id"]', props.form).val())
         props.type_id = i;
       if (i = $('[name="object_type"]', props.form).val())
         props.object_type = i;
       if (i = $('[name="id"]', props.form).val())
         props.id = i;
 
       delete props['form'];
     }
 
     obj.keydown(function(e) { return kadm.ac_keydown(e, props); })
       .attr('autocomplete', 'off');
   };
 
   // handler for keyboard events on autocomplete-fields
   this.ac_keydown = function(e, props)
   {
     if (this.ac_timer)
       clearTimeout(this.ac_timer);
 
     var highlight, key = e.which;
 
     switch (key) {
       case 38:  // arrow up
       case 40:  // arrow down
         if (!this.ac_visible())
           break;
 
         var dir = key == 38 ? 1 : 0;
 
         highlight = $('.selected', this.ac_pane).get(0);
 
         if (!highlight)
           highlight = this.ac_pane.__ul.firstChild;
 
         if (highlight)
           this.ac_select(dir ? highlight.previousSibling : highlight.nextSibling);
 
         return e.stopPropagation();
 
       case 9:   // tab
         if (e.shiftKey || !this.ac_visible()) {
           this.ac_stop();
           return;
         }
 
       case 13:  // enter
         if (!this.ac_visible())
           return false;
 
         // insert selected item and hide selection pane
         this.ac_insert(this.ac_selected);
         this.ac_stop();
 
         e.stopPropagation();
         return false;
 
       case 27:  // escape
         this.ac_stop();
         return;
 
       case 37:  // left
       case 39:  // right
         if (!e.shiftKey)
           return;
     }
 
     // start timer
     this.ac_timer = window.setTimeout(function() { kadm.ac_start(props); }, 500);
     this.ac_input = e.target;
 
     return true;
   };
 
   this.ac_visible = function()
   {
     return (this.ac_selected !== null && this.ac_selected !== undefined && this.ac_value);
   };
 
   this.ac_select = function(node)
   {
     if (!node)
       return;
 
     var current = $('.selected', this.ac_pane);
 
     if (current.length)
       current.removeClass('selected');
 
     $(node).addClass('selected');
     this.ac_selected = node._id;
   };
 
   // autocomplete search processor
   this.ac_start = function(props)
   {
     var q = this.ac_input ? this.ac_input.value : null,
       min = this.env.autocomplete_min_length,
       old_value = this.ac_value,
       ac = this.ac_data;
 
     if (q === null)
       return;
 
     // trim query string
     q = $.trim(q);
 
     // Don't (re-)search if the last results are still active
     if (q == old_value)
       return;
 
     // Stop and destroy last search
     this.ac_stop();
 
     if (q.length && q.length < min) {
       this.display_message(this.t('search.acchars').replace('$min', min), 'notice', 2000);
       return;
     }
 
     this.ac_value = q;
 
     // ...string is empty
     if (!q.length)
       return;
 
     // ...new search value contains old one, but the old result was empty
     if (old_value && old_value.length && q.indexOf(old_value) == 0 && this.ac_result && !this.ac_result.length)
       return;
 
     var i, xhr, data = props,
       action = props && props.action ? props.action : 'form_value.list_options';
 
     this.ac_oninsert = props.oninsert;
     data.search = q;
     delete data['action'];
     delete data['insert_func'];
 
     this.display_message(this.t('search.loading'), 'loading');
     xhr = this.api_post(action, data, 'ac_result');
     this.ac_data = xhr;
   };
 
   this.ac_result = function(response)
   {
     // search stopped in meantime?
     if (!this.ac_value)
       return;
 
     if (!this.api_response(response))
       return;
 
     // ignore this outdated search response
     if (this.ac_input && response.result.search != this.ac_value)
       return;
 
     // display search results
     var i, ul, li, text,
       result = response.result.list,
       pos = $(this.ac_input).offset(),
       value = this.ac_value,
       rx = new RegExp('(' + RegExp.escape(value) + ')', 'ig');
 
     // create results pane if not present
     if (!this.ac_pane) {
       ul = $('<ul>');
       this.ac_pane = $('<div>').attr('id', 'autocompletepane')
         .css({ position:'absolute', 'z-index':30000 }).append(ul).appendTo(document.body);
       this.ac_pane.__ul = ul[0];
     }
 
     ul = this.ac_pane.__ul;
 
     // reset content
     ul.innerHTML = '';
     // move the results pane right under the input box
     this.ac_pane.css({left: (pos.left - 1)+'px', top: (pos.top + this.ac_input.offsetHeight - 1)+'px', display: 'none'});
 
     // add each result line to the list
     for (i in result) {
       text = result[i];
       li = document.createElement('LI');
       li.innerHTML = text.replace(rx, '##$1%%').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/##([^%]+)%%/g, '<b>$1</b>');
       li.onmouseover = function() { kadm.ac_select(this); };
       li.onmouseup = function() { kadm.ac_click(this) };
       li._id = i;
       ul.appendChild(li);
     }
 
     if (ul.childNodes.length) {
       this.ac_pane.show();
 
       // select the first
       li = $('li:first', ul);
       li.addClass('selected');
       this.ac_selected = li.get(0)._id;
     }
 
     this.env.ac_result = result;
   };
 
   this.ac_click = function(node)
   {
     if (this.ac_input)
       this.ac_input.focus();
 
     this.ac_insert(node._id);
     this.ac_stop();
   };
 
   this.ac_insert = function(id)
   {
     var val = this.env.ac_result[id];
 
     if (typeof this.ac_oninsert == 'function')
       this.ac_oninsert(id, val);
     else
       $(this.ac_input).val(val);
   };
 
   this.ac_blur = function()
   {
     if (this.ac_timer)
       clearTimeout(this.ac_timer);
 
     this.ac_input = null;
     this.ac_stop();
   };
 
   this.ac_stop = function()
   {
     this.ac_selected = null;
     this.ac_value = '';
 
     if (this.ac_pane)
       this.ac_pane.hide();
 
     this.ac_destroy();
   };
 
   // Clears autocomplete data/requests
   this.ac_destroy = function()
   {
     if (this.ac_data)
       this.ac_data.abort();
 
     this.ac_data = null;
     this.ac_info = null;
   };
 
 
   /*********************************************************/
   /*********            Forms widgets              *********/
   /*********************************************************/
 
   // Form initialization
   this.form_init = function(id)
   {
     var form = $('#'+id),
       aci_fields = $('textarea[data-type="aci"]', form);
 
     this.aci = {};
     this.acl = {};
     this.trigger_event('form-load', id);
 
     // replace some textarea fields with pretty/smart input lists
     $('textarea[data-type="list"]', form)
       .each(function() { kadm.form_list_element_wrapper(this); });
     // create smart select fields
     $('input[data-type="select"]', form)
       .each(function() { kadm.form_select_element_wrapper(this); });
     // create LDAP URL fields
     $('input[data-type="ldap_url"]:not(:disabled):not([readonly])', form)
       .each(function() { kadm.form_url_element_wrapper(this); });
     // create IMAP ACL fields
     $('textarea[data-type="acl"]', form)
       .each(function() { kadm.form_acl_element_wrapper(this); });
     // create ACI fields
     aci_fields.each(function() { kadm.form_aci_element_wrapper(this); });
     if (aci_fields.length)
       this.form_aci_init();
   };
 
   // Form serialization
   this.form_serialize = function(data)
   {
     var form = $(data.id);
 
     // smart list fields
     $('textarea[data-type="list"]:not(:disabled)', form).each(function() {
       var i, v, value = [],
         re = RegExp('^' + RegExp.escape(this.name) + '\[[0-9-]+\]$');
 
       for (i in data.json) {
         if (i.match(re)) {
           if (v = $('input[name="'+i+'"]', form).val())
             value.push(v);
           delete data.json[i];
         }
       }
 
       // autocompletion lists data is stored in env variable
       if (kadm.env.assoc_fields[this.name]) {
         value = [];
         for (i in kadm.env.assoc_fields[this.name])
           value.push(i);
       }
 
       data.json[this.name] = value;
     });
 
     // smart selects
     $('input[data-type="select"]', form).each(function() {
       delete data.json[this.name];
     });
 
     // LDAP URL fields
     $('input[data-type="ldap_url"]:not(:disabled):not([readonly])', form).each(function() {
       data.json = kadm.form_url_element_submit(this.name, data.json, form);
     });
 
     // IMAP ACL fields
     $('textarea[data-type="acl"]:not(:disabled):not([readonly])', form).each(function() {
       data.json = kadm.form_acl_element_submit(this.name, data.json, form);
     });
 
     // ACI fields
     $('textarea[data-type="aci"]:not(:disabled):not([readonly])', form).each(function() {
       data.json = kadm.form_aci_element_submit(this.name, data.json, form);
     });
 
     // text-separated fields (convert text into array)
     $('textarea[data-type="separated"]:not(:disabled)', form).each(function() {
       data.json[this.name] = data.json[this.name] ? data.json[this.name].split(/[\r\n]+/) : '';
     });
 
     // quota inputs
     $('input[data-type="quota"]', form).each(function() {
       var unit = $('select[name="' + this.name + '-unit"]').val();
       if (unit && this.value)
         data.json[this.name] = this.value + unit;
       delete data.json[this.name + '-unit'];
     });
 
     // "boolean" checkbox inputs
     $('input[type="checkbox"][value="TRUE"]', form).each(function() {
       data.json[this.name] = this.checked ? 'TRUE' : 'FALSE';
     });
 
     return data;
   };
 
   // Form element update handler
   this.form_element_update = function(data)
   {
     var elem = $('[name="'+data.name+'"]');
 
     if (!elem.length)
       return;
 
     if (elem.attr('data-type') == 'list') {
       // remove old wrapper
       $('span[class="listarea"]', elem.parent()).remove();
       // insert new list element
       this.form_list_element_wrapper(elem.get(0));
     }
   };
 
   // Replaces form element with smart list element
   this.form_list_element_wrapper = function(form_element)
   {
     var i = 0, j = 0, list = [], elem, e = $(form_element),
       form = form_element.form,
       disabled = e.attr('disabled'),
       readonly = e.attr('readonly'),
       autocomplete = e.attr('data-autocomplete'),
       maxlength = e.attr('data-maxlength'),
       maxcount = e.attr('data-maxcount'),
       area = $('<span class="listarea"></span>');
 
     e.hide();
 
     if (autocomplete)
       list = this.env.assoc_fields ? this.env.assoc_fields[form_element.name] : [];
     else if (form_element.value)
       list = form_element.value.split("\n");
 
     // Need at least one element
     if (!autocomplete || disabled || readonly) {
       $.each(list, function() { i++; });
       if (!i)
         list = [''];
     }
 
     // Create simple list for readonly/disabled
     if (disabled || readonly) {
       area.addClass('readonly');
 
       // add simple input rows
       $.each(list, function(i, v) {
         var elem = $('<input>');
         elem.attr({
           value: v,
           disabled: disabled,
           readonly: readonly,
           name: form_element.name + '[' + (j++) + ']'
           })
         elem = $('<span class="listelement">').append(elem);
         elem.appendTo(area);
       });
     }
     // extended widget with add/remove buttons and/or autocompletion
     else {
       // add autocompletion input
       if (autocomplete) {
         elem = this.form_list_element(form, {
           maxlength: maxlength,
           autocomplete: autocomplete,
           element: e
         }, -1);
 
         // Initialize autocompletion
         this.ac_init(elem, {
           form: form,
           attribute: form_element.name,
           oninsert: this.form_element_oninsert
         });
 
         // when max=1 we use only one input
         if (maxcount == 1) {
           $.each(list, function(i, v) {
             $('input', elem).val(v);
             return false;
           });
 
           list = [];
         }
 
         elem.appendTo(area);
         area.addClass('autocomplete');
       }
 
       // add input rows
       $.each(list, function(i, v) {
         var elem = kadm.form_list_element(form, {
           value: v,
           key: i,
           maxlength: maxlength,
           autocomplete: autocomplete,
           element: e
         }, j++);
 
         elem.appendTo(area);
       });
     }
 
     area.appendTo(form_element.parentNode);
   };
 
   // Creates smart list element
   this.form_list_element = function(form, data, idx)
   {
     var content, elem, input,
       key = data.key,
       orig = data.element
       ac = data.autocomplete;
 
     data.name = (orig ? orig.attr('name') : data.name) + '[' + idx + ']';
     data.readonly = (ac && idx >= 0);
 
     // remove internal attributes
     delete data['element'];
     delete data['autocomplete'];
     delete data['key'];
 
     // build element content
     content = '<span class="listelement"><span class="actions">'
       + (!ac ? '<span title="" class="add"></span>' : ac && idx == -1 ? '<span title="" class="search"></span>' : '')
       + (!ac || idx >= 0 ? '<span title="" class="reset"></span>' : '')
       + '</span><input type="text" autocomplete="off"></span>';
 
     elem = $(content);
     input = $('input', elem);
 
     // Set INPUT attributes
     input.attr(data);
 
     if (data.readonly)
       input.addClass('readonly');
     if (ac)
       input.addClass('autocomplete');
 
     // attach element creation event
     if (!ac)
       $('span[class="add"]', elem).click(function() {
         var name = data.name.replace(/\[[0-9]+\]$/, ''),
           span = $(this.parentNode.parentNode),
           maxcount = $('textarea[name="'+name+'"]').attr('data-maxcount');
 
         // check element count limit
         if (maxcount && maxcount <= span.parent().children().length) {
           alert(kadm.t('form.maxcount.exceeded'));
           return;
         }
 
         var dt = (new Date()).getTime(),
           elem = kadm.form_list_element(form, {name: name}, dt);
 
         kadm.ac_stop();
         span.after(elem);
         $('input', elem).focus();
       });
 
     // attach element deletion event
     if (!ac || idx >= 0)
       $('span[class="reset"]', elem).click(function() {
         var span = $(this.parentNode.parentNode),
           name = data.name.replace(/\[[0-9]+\]$/, ''),
           l = $('input[name^="' + name + '["]', form),
           key = $(this).data('key');
 
         if (l.length > 1 || $('input[name="' + name + '"]', form).attr('data-autocomplete'))
           span.remove();
         else
           $('input', span).val('').focus();
 
         // delete key from internal field representation
         if (key !== undefined && kadm.env.assoc_fields[name])
           delete kadm.env.assoc_fields[name][key];
 
         kadm.ac_stop();
       }).data('key', key);
 
     return elem;
   };
 
   this.form_element_oninsert = function(key, val)
   {
     var elem, input = $(this.ac_input).get(0),
       dt = (new Date()).getTime(),
       span = $(input.parentNode),
       name = input.name.replace(/\[-1\]$/, ''),
       af = kadm.env.assoc_fields,
       maxcount = $('textarea[name="'+name+'"]').attr('data-maxcount');
 
     if (maxcount == 1) {
       $(input).val(val);
       af[name] = {};
       af[name][key] = val;
       return;
     }
 
     // reset autocomplete input
     input.value = '';
 
     // check element count limit
     if (maxcount && maxcount <= span.parent().children().length - 1) {
       alert(kadm.t('form.maxcount.exceeded'));
       return;
     }
 
     // check if element doesn't exist on the list already
     if (!af[name])
       af[name] = {};
     if (af[name][key])
       return;
 
     // add element
     elem = kadm.form_list_element(input.form, {
       name: name,
       autocomplete: true,
       value: val
       }, dt);
     span.after(elem);
 
     // update field variable
     af[name][key] = val;
   };
 
   // Replaces form element with smart select element
   this.form_select_element_wrapper = function(form_element)
   {
     var e = $(form_element),
       form = form_element.form,
       name = form_element.name,
       elem = $('#selectlabel_' + name),
       area = $('<span class="listarea autocomplete select popup" id="selectarea_' + name + '"></span>'),
       content = $('<span class="listcontent" id="selectcontent_' + name + '"></span>'),
       list = this.env.assoc_fields ? this.env.assoc_fields[form_element.name] : [];
 
     if (elem.length) {
       $('#selectarea_' + name).remove();
       $('#selectcontent_' + name).remove();
     }
     else {
       elem = $('<span class="link" id="selectlabel_' + name + '"></span>')
         .css({cursor: 'pointer'})
         .click(function(e) {
           var popup = $('span.listarea', this.parentNode);
           kadm.popup_show(e, popup);
           $('input', popup).val('').focus();
           $('span.listcontent > span.listelement', popup).removeClass('selected').show();
         })
         .appendTo(form_element.parentNode);
     }
 
     elem.text(e.val());
 
     if (list.length <= 1)
       return;
 
     if (form_element.type != 'hidden') e.hide();
 
     elem = this.form_list_element(form, {
       autocomplete: true,
       element: e
     }, -1);
 
     elem.appendTo(area);
     content.appendTo(area);
     area.hide().appendTo(form_element.parentNode);
 
     // popup events
     $('input', area)
       .click(function(e) {
         // stop click on the popup
         e.stopPropagation();
       })
       .keypress(function(e) {
         // prevent form submission with Enter key
         if (e.which == 13)
           e.preventDefault();
       })
       .keydown(function(e) {
         // block Up/Down arrow keys,
         // in Firefox Up arrow moves cursor left
         if (e.which == 38 || e.which == 40)
           e.preventDefault();
       })
       .keyup(function(e) {
         // filtering
         var s = this.value,
           options = $('span.listcontent > span.listelement', area);
 
         // Enter key
         if (e.which == 13) {
           options.filter('.selected').click()
           return;
         }
         // Escape
         else if (e.which == 27) {
           area.hide();
           this.value = s = '';
         }
         // UP/Down arrows
         else if (e.which == 38 || e.which == 40) {
           options = options.not(':hidden');
 
           if (options.length <= 1)
             return;
 
           var focused,
             selected = options.filter('.selected'),
             index = options.index(selected);
 
           if (e.which == 40) {
             if (!(focused = options.get(index+1)))
               focused = options.get(index-1);
           }
           else {
             if (!(focused = options.get(index-1)))
               focused = options.get(index+1);
           }
 
           if (focused) {
             focused = $(focused);
             selected.removeClass('selected');
             focused.addClass('selected');
 
             var parent = focused.parent(),
               parent_height = parent.height(),
               parent_top = parent.get(0).scrollTop,
               top = focused.offset().top - parent.offset().top,
               height = focused.height();
 
             if (top < 0)
               parent.get(0).scrollTop = 0;
             else if (top >= parent_height)
               parent.get(0).scrollTop = top - parent_height + height + parent_top;
           }
 
           return;
         }
 
         if (!s) {
           options.show().removeClass('selected');
           return;
         }
 
         options.each(function() {
           var o = $(this), v = o.data('value');
           o[v.indexOf(s) != -1 ? 'show' : 'hide']().removeClass('selected');
         });
 
         options = options.not(':hidden');
         if (options.length == 1)
           options.addClass('selected');
       });
 
     // add option rows
     $.each(list, function(i, v) {
       var elem = kadm.form_select_option_element(form, {value: v, key: v, element: e});
       elem.appendTo(content);
     });
   };
 
   // Creates option element for smart select
   this.form_select_option_element = function(form, data)
   {
     // build element content
     var elem = $('<span class="listelement"></span>')
       .data('value', data.key).text(data.value)
       .click(function(e) {
         var val = $(this).data('value'),
           elem = $(data.element),
           old_val = elem.val();
 
         $('span.link', elem.parent()).text(val);
         elem.val(val);
         if (val != old_val)
           elem.change();
       });
 
     return elem;
   };
 
   // initialize ACI fields in form
   this.form_aci_init = function()
   {
     // get list of ldap attributes for ACI form
     if (!this.ldap_attributes) {
       this.api_post('form_value.select_options', {attributes: ['attribute']}, 'form_aci_init_response');
     }
   };
 
   this.form_aci_init_response = function(response)
   {
     if (!this.api_response(response))
       return;
 
     this.ldap_attributes = response.result.attribute ? response.result.attribute.list : [];
   };
 
   // Replaces form element with ACI element
   this.form_aci_element_wrapper = function(form_element)
   {
     var i, e = $(form_element),
       form = form_element.form,
       name = form_element.name,
       div = $('<div class="aci"></div>'),
       select = $('<select multiple="multiple" size="8"></select>'),
       table = $('<table class="acltable"><tr><td class="list"></td><td class="buttons"></td></tr></table>'),
       buttons = [
         $('<input type="button" />').attr({value: this.t('aci.new')}),
         $('<input type="button" />').attr({value: this.t('aci.edit'), disabled: true}),
         $('<input type="button" />').attr({value: this.t('aci.remove'), disabled: true})
       ],
       aci = this.parse_aci(e.val()) || [];
     this.aci[name] = aci;
     e.hide();
 
     // this.log(e.val());
     // this.log(aci);
 
     $.each(aci, function(i, entry) {
       $('<option></option>').val(i).text(entry.name).appendTo(select)
         .on('dblclick', function () { self.form_aci_dialog(name, this.value); });
     });
 
     select.attr('id', 'aci'+name).on('change', function() {
       var selected = $(this).val() || [];
 
       buttons[1].prop('disabled', selected.length != 1);
       buttons[2].prop('disabled', selected.length == 0);
     });
 
     // click on 'new' and 'edit' button
     buttons[0].on('click', function() { self.form_aci_dialog(name); });
     buttons[1].on('click', function() {
       var selected = select.val();
       self.form_aci_dialog(name, selected && selected.length ? selected[0] : null);
     });
 
     // click on 'remove' button
     buttons[2].on('click', function() {
       $.each(select.val() || [], function(i, v) {
         self.aci[name][v] = null;
         $('option[value="' + v + '"]', select).remove();
       });
       buttons[1].prop('disabled', true);
       buttons[2].prop('disabled', true);
     });
 
     $('.buttons', table).append(buttons);
     $('.list', table).append(select);
     div.append(table)
 
     $(form_element).parent().append(div);
   };
 
   // updates form data with ACI (on form submit)
   this.form_aci_element_submit = function(name, data, form)
   {
     data[name] = this.build_aci(this.aci[name]);
 
     return data;
   };
 
   // display aci dialog
   this.form_aci_dialog = function(name, id)
   {
     var aci = id ? this.aci[name][id] : {};
 
     this.aci_dialog_aci  = aci;
     this.aci_dialog_name = name;
     this.aci_dialog_id   = id;
 
     this.modal_dialog(this.form_aci_dialog_content(aci), this.form_aci_dialog_buttons());
 
     window.setTimeout(function() { $('#aci-name').focus(); }, 100);
   };
 
   // return aci dialog buttons
   this.form_aci_dialog_buttons = function()
   {
     var buttons = {
       'button.ok': function() {
         if (self.form_aci_dialog_submit()) {
           this.hide();
           $('#aci-dialog').remove();
         }
       },
       'button.cancel': function() {
         this.hide();
         $('#aci-dialog').remove();
       },
     };
 
     return buttons;
   };
 
   // build and return aci dialog content
   this.form_aci_dialog_content = function(aci)
   {
     var dialog = $('#aci-dialog');
 
     if (!dialog.length) {
       var i, tabs = [
         $('<fieldset></fieldset>').attr('id', 'aci-tab-users')
           .append($('<legend></legend>').text(this.t('aci.users')))
           .append(this.form_aci_dialog_tab_users()),
         $('<fieldset></fieldset>').attr('id', 'aci-tab-rights')
           .append($('<legend></legend>').text(this.t('aci.rights')))
           .append(this.form_aci_dialog_tab_rights()),
         $('<fieldset></fieldset>').attr('id', 'aci-tab-targets')
           .append($('<legend></legend>').text(this.t('aci.targets')))
           .append(this.form_aci_dialog_tab_targets())
       ];
 
       dialog = $('<div id="aci-dialog"><label></label><input id="aci-name" type="text" size="40" />'
           + '<form id="aci-form"></form></div>')
         .hide().appendTo('body');
 
       dialog.children('label').text(this.t('aci.aciname'));
 
       $('#aci-form').append(tabs);
 
       this.trigger_event('form-load', 'aci-form');
     }
 
     // reset form elements
     this.form_aci_dialog_reset(aci);
 
     return dialog.show();
   };
 
   this.form_aci_dialog_reset = function(aci)
   {
     var users = $('#aci-users').html(''),
       rights = aci.perms ? aci.perms[0].rights : [],
       inputs = $('#aci-rights input').prop('checked', false),
       target = $('#aci-targets-target').val(''),
       target_filter = $('#aci-targets-filter').val(''),
       target_operator = $('#aci-targets input[name="attr-operator"]'),
       rule = aci.perms ? aci.perms[0].type : 'userdn';
 
     $.each(rights, function(i, v) {
       $('#aci-rights-' + v).click();
     });
 
     $('#aci-name').val(aci.name);
     $('#aci-rights-type').val(aci.perms ? aci.perms[0].type : '');
     $('#aci-users-button-remove').prop('disabled', true);
     target_operator.filter('[value="="]').prop('checked', true);
     target_operator.filter('[value="!="]').prop('checked', false);
 
     $.each(aci.perms ? aci.perms : [], function(i, perm) {
       $.each(perm.rules || [], function(n, rule) {
         // these permission rules we do not support here
         if (!/^(userdn|groupdn|roledn)$/i.test(rule.keyword) || rule.operator != '=')
           return;
 
         $.each(rule.expression || [], function(x, v) {
           if (v.substr(0, 8) == 'ldap:///') {
             v = v.substr(8);
           }
 
           var t = v;
           if (t == 'all' || t == 'self' || t == 'anyone' || t == 'parent')
             t = self.t('aci.ldap-' + t);
           else if (/^cn=([^,]+)/.test(t))
             t = RegExp.$1;
           // @TODO: resolve users DN with user names
 
           $('<option></option>').attr({value: rule.keyword + ':' + v}).text(t).appendTo(users);
         });
       });
     });
 
     $.each(aci.targets || [], function(i, v) {
       switch (v.type) {
         case 'targetfilter':
           target_filter.val(v.expression);
           break;
 
         case 'targetattr':
           if (v.expression[0] == '*')
             $('#aci-targets-attr option').prop('selected', true);
           else
             $('#aci-targets-attr').val(v.expression);
 
           target_operator.filter('[value="="]').prop('checked', v.operator == '=');
           target_operator.filter('[value="!="]').prop('checked', v.operator == '!=');
           break;
 
         case 'target':
           target.val(v.expression);
           break;
       }
     });
   };
 
   // submits aci dialog, updates aci definition in form
   this.form_aci_dialog_submit = function()
   {
     var val, rules = [], rights = [],
       name_input = $('#aci-name'),
       name = name_input.val(),
       rights_type = $('#aci-rights-type').val(),
       aci_list = $('#aci' + this.aci_dialog_name),
       exists = false,
       aci = {perms: [], targets: [], version: '3.0', name: name};
 
     // sanity checks
     if (!name) {
       alert(this.t('aci.error.noname'));
       name_input.focus();
       return false;
     }
 
     $.each(this.aci[self.aci_dialog_name] || [], function(i, v) {
       if (v && v.name == name && (!self.aci_dialog_id || self.aci_dialog_id != i)) {
         exists = true;
         return false;
       }
     });
 
     if (exists) {
       alert(this.t('aci.error.exists'));
       name_input.focus();
       return false;
     }
 
     // permissions
     $('#aci-users option').each(function() {
       var keyword, value = this.value;
 
       /^([a-z]+):/.test(value);
       keyword = RegExp.$1;
       value   = value.substr(keyword.length + 1);
 
       rules.push({
         join: 'or',
         operator: '=',
         keyword: keyword,
         expression: ['ldap:///' + value]
       });
     });
 
     if (!rules.length) {
       alert(this.t('aci.error.nousers'));
       return false;
     }
 
     $('#aci-rights input').each(function() {
       if (this.checked) {
         if (this.value == 'all') {
           rights = ['all'];
           return false;
         }
 
         rights.push(this.value);
       }
     });
 
     if (!rights.length) {
       rights = ['all'];
       rights_type = rights_type == 'allow' ? 'deny' : 'allow';
     }
 
     aci.perms.push({
       rights: rights,
       type: rights_type,
       rules: rules
     });
 
     // targets
     if ((v = $('#aci-targets-attr').val() || []).length)
       aci.targets.push({
         type: 'targetattr',
         expression: v.length == $('#aci-targets-attr option').length ? ['*'] : v,
         operator: $('#aci-targets input[name="attr-operator"][value="!="]').is(':checked') ? '!=' : '=',
       });
 
     if (v = $('#aci-targets-target').val())
       aci.targets.push({
         type: 'target',
         expression: v,
         operator: '='
       });
 
     if (v = $('#aci-targets-filter').val())
       aci.targets.push({
         type: 'targetfilter',
         expression: v,
         operator: '=' // @TODO,
       });
 
     // this.log(aci);
     // this.log(this.build_aci([aci]));
 
     if (this.aci_dialog_id) {
       this.aci[this.aci_dialog_name][this.aci_dialog_id] = aci;
       $('option[value="' + this.aci_dialog_id + '"]', aci_list).text(aci.name);
     }
     else {
       this.aci[this.aci_dialog_name].push(aci);
       $('<option></option>').val(this.aci[this.aci_dialog_name].length-1)
         .text(aci.name)
         .appendTo(aci_list)
         .on('dblclick', function () { self.form_aci_dialog(self.aci_dialog_name, this.value); });
     }
 
     return true;
   };
 
   // tab Users in aci dialog
   this.form_aci_dialog_tab_users = function()
   {
     var select = $('<select id="aci-users" multiple="multiple" size="8"></select>'),
       table = $('<table class="acltable"><tr><td class="list"></td><td class="buttons"></td></tr></table>'),
       buttons = [
         $('<input type="button" />').attr({value: this.t('aci.new')}),
         $('<input type="button" id="aci-users-button-remove" />').attr({value: this.t('aci.remove'), disabled: true})
       ];
 
     select.on('change', function() {
       var selected = $(this).val() || [];
       buttons[1].attr('disabled', selected.length == 0);
     });
 
     // click on 'new' button
     buttons[0].on('click', function() { self.form_aci_user_dialog(); });
 
     // click on 'remove' button
     buttons[1].on('click', function() {
       $.each(select.val() || [], function(i, v) {
         $('option[value="' + v + '"]', select).remove();
       });
 
       $(this).prop('disabled', true);
     });
 
     $('.buttons', table).append(buttons);
     $('.list', table).append(select);
 
     return table;
   };
 
   // tab Rights in aci dialog
   this.form_aci_dialog_tab_rights = function()
   {
     var div = $('<div id="aci-rights"></div>'),
       select = $('<select id="aci-rights-type"></select>'),
       types = ['allow', 'deny'],
       rights = ['read', 'compare', 'search', 'write', 'selfwrite', 'delete', 'add', 'proxy', 'all'],
       inputs = [];
 
     $.each(rights, function(i, v) {
       var input = $('<input type="checkbox" name="aci-right[]" />').attr({value: v, id: 'aci-rights-' + v});
       inputs.push($('<label for="aci-rights-' + v + '"></label>').text(self.t('aci.' + v)).prepend(input));
 
       if (v == 'all')
         input.on('change', function() {
           var list = $('input:not(#aci-rights-all)', div);
 
           if (this.checked)
             list.prop({checked: true, disabled: true});
           else
             list.prop({disabled: false});
         });
     });
 
     $.each(types, function(i, v) {
       $('<option></option>').attr({value: v}).text(self.t('aci.' + v)).appendTo(select);
     });
 
     return div.append(select).append(inputs);
   };
 
   // tab Targets in aci dialog
   this.form_aci_dialog_tab_targets = function()
   {
     var opts = [],
       content = $('<div id="aci-targets"></div>'),
       target = $('<input id="aci-targets-target" type="text" size="40" />'),
       filter = $('<input id="aci-targets-filter" type="text" size="40" />'),
       button = $('<input type="button" id="aci-targets-targetbtn" />').val(this.t('aci.thisentry'))
         .on('click', function() { target.val('ldap:///' + self.env.entrydn); }),
       select = $('<select id="aci-targets-attr" multiple="multiple" size="8"></select>'),
       radio = [
         $('<label>').text(this.t('aci.selected')).prepend($('<input type="radio" name="attr-operator" value="=" />')),
         $('<label>').text(this.t('aci.other')).prepend($('<input type="radio" name="attr-operator" value="!=" />'))
       ];
 
     $.each(this.ldap_attributes, function(i, v) {
       var o = document.createElement('option');
       o.value = v.toLowerCase();
       $(o).text(v);
       opts.push(o);
     });
 
     if (opts.length)
       select.append(opts);
 
     content.append([
       $('<label>').text(this.t('aci.rights.target')), $('<div>').append([target, button]),
       $('<label>').text(this.t('aci.rights.filter')), $('<div>').append(filter),
       $('<label>').text(this.t('aci.rights.attrs')), $('<div>').append([select, radio[0], radio[1]])
     ]);
 
     return content;
   };
 
   this.form_aci_user_dialog = function()
   {
     var dialog = $('#aci-dialog'),
       content = $('<div id="aci-users-dialog"></div>'),
       search = $('<input id="aci-users-search" type="text" />'),
       search_btn = $('<input id="aci-users-search-button" type="button" />')
         .val(this.t('aci.search')).on('click', function() { self.form_aci_user_search(); }),
       results = $('<select id="aci-users-results" multiple="multiple" size="6"></select>'),
       selected = $('<select id="aci-users-selected" multiple="multiple" size="6"></select>'),
       groups = $('<select id="aci-users-group"></select>')
         .on('change', function() {
           results.html('');
           if (this.value == 'specials')
             $.each(['self', 'all', 'anyone', 'parent'], function(i, v) {
               if (!$('option[value="userdn:' + v + '"]', selected).length)
                 $('<option></option>').attr({value: 'userdn:' + v}).text(self.t('aci.ldap-' + v))
                   .appendTo(results)
                   .on('dblclick', function() { self.form_aci_user_option_dblclick(this); });
             });
         }),
       options = ['users', 'groups', 'roles', /* 'admins', */ 'specials'],
       buttons = {
         'button.ok': function() {
           self.form_aci_user_dialog_submit();
           this.hide();
           $('#aci-users-dialog').remove();
           // bring back the main dialog
           self.modal_dialog(dialog, self.form_aci_dialog_buttons());
         },
         'button.cancel': function() {
           this.hide();
           $('#aci-users-dialog').remove();
           // bring back the main dialog
           self.modal_dialog(dialog, self.form_aci_dialog_buttons());
         }
       };
 
     $.each(options, function(i, v) {
       $('<option></option>').attr({value: v}).text(self.t('aci.type' + v)).appendTo(groups);
     });
 
     content.append([
       $('<label>').text(this.t('aci.usersearch')), $('<div>').append([search, groups, search_btn]),
       $('<label>').text(this.t('aci.usersearchresult')), $('<div>').append(results),
       $('<label>').text(this.t('aci.userselected')), $('<div>').append(selected)
     ]);
 
     this.modal_dialog(content, buttons);
   };
 
   this.form_aci_user_dialog_submit = function()
   {
     var user_list = $('#aci-users');
 
     $('#aci-users-selected option').each(function() {
       if (!$('option[value="' + this.value + '"]', user_list).length)
         $('<option></option>').attr({value: this.value}).text($(this).text()).appendTo(user_list);
     });
   };
 
   this.form_aci_user_search = function()
   {
     var search = $('#aci-users-search').val(),
       type = $('#aci-users-group').val(),
       val, props, attrs = {
         users: ['displayname', 'cn'],
         groups: ['cn'],
         roles: ['cn'],
       };
 
     if (search == '')
       return;
 
     if (type == 'specials') {
       $('#aci-users-results option').each(function() {
         $(this)[$(this).text().indexOf(search) == -1 ? 'hide' : 'show'];
       });
       return;
     }
 
     // reset results select
     $('#aci-users-results').html('');
 
     // build search post parameters
     val = {type: 'both', value: search};
     props = {attributes: ['cn', 'mail'], page_size: 10, sort_by: 'cn', search: {}};
     $.each(attrs[type], function(i, v) { props.search[v] = val; });
 
     // call search
     this.set_busy(true, 'searching');
     this.api_post(type + '.list', props, 'form_aci_user_search_response');
   };
 
   this.form_aci_user_search_response = function(response)
   {
     if (!this.api_response(response))
       return;
 
     var results = $('#aci-users-results'),
       selected = $('#aci-users-selected'),
       type = $('#aci-users-group').val(),
       prefixes = {users: 'userdn:', groups: 'groupdn:', roles: 'roledn:'},
       prefix = prefixes[type] || prefixes.users;
 
     $.each(response.result.list || {}, function(i, v) {
       var value = prefix + i;
       if (!$('option[value="' + value + '"]', selected).length) {
         name = v.cn;
 
         if (v.mail)
           name += ' (' + v.mail + ')';
 
         $('<option></option>').attr({value: value}).text(name)
           .appendTo(results)
           .on('dblclick', function() { self.form_aci_user_option_dblclick(this); });
       }
     });
   };
 
   this.form_aci_user_option_dblclick = function(elem)
   {
     var elem = $(elem), cloned = elem.clone(true),
       target = $('#aci-users-' + (elem.parent().attr('id') == 'aci-users-results' ? 'selected' : 'results'));
 
     if (!$('option[value="' + elem.val() + '"]', target).length) {
       cloned.appendTo(target);
       elem.remove();
     }
   };
 
   // Replaces form element with IMAP ACL element
   this.form_acl_element_wrapper = function(form_element)
   {
     var i, e = $(form_element),
       form = form_element.form,
       name = form_element.name,
       div = $('<div class="acl"></div>'),
       select = $('<select multiple="multiple" size="8"></select>'),
       table = $('<table class="acltable"><tr><td class="list"></td><td class="buttons"></td></tr></table>'),
       buttons = [
         $('<input type="button" />').attr({value: this.t('aci.new')}),
         $('<input type="button" />').attr({value: this.t('aci.edit'), disabled: true}),
         $('<input type="button" />').attr({value: this.t('aci.remove'), disabled: true})
       ],
       acl = this.parse_acl(e.val()) || [];
 
     this.acl[name] = acl;
     e.hide();
 
     // this.log(e.val());
     // this.log(acl);
 
     $.each(acl, function(i, entry) {
       $('<option></option>').val(i).text(entry.subject).appendTo(select)
         .on('dblclick', function () { self.form_acl_dialog(name, this.value); });
     });
 
     select.attr('id', 'acl'+name).on('change', function() {
       var selected = $(this).val() || [];
 
       buttons[1].prop('disabled', selected.length != 1);
       buttons[2].prop('disabled', selected.length == 0);
     });
 
     // click on 'new' and 'edit' button
     buttons[0].on('click', function() { self.form_acl_dialog(name); });
     buttons[1].on('click', function() {
       var selected = select.val();
       self.form_acl_dialog(name, selected && selected.length ? selected[0] : null);
     });
 
     // click on 'remove' button
     buttons[2].on('click', function() {
       $.each(select.val() || [], function(i, v) {
         self.acl[name][v] = null;
         $('option[value="' + v + '"]', select).remove();
       });
       buttons[1].prop('disabled', true);
       buttons[2].prop('disabled', true);
     });
 
     $('.buttons', table).append(buttons);
     $('.list', table).append(select);
     div.append(table)
 
     $(form_element).parent().append(div);
   };
 
   // updates form data with IMAP ACL (on form submit)
   this.form_acl_element_submit = function(name, data, form)
   {
     data[name] = this.build_acl(this.acl[name]);
 
     return data;
   };
 
   // display IMAP ACL dialog
   this.form_acl_dialog = function(name, id)
   {
     var acl = id ? this.acl[name][id] : {};
 
     this.acl_dialog_acl  = acl;
     this.acl_dialog_name = name;
     this.acl_dialog_id   = id;
 
     this.modal_dialog(this.form_acl_dialog_content(acl), this.form_acl_dialog_buttons());
 
     window.setTimeout(function() { $('#acl-subject').focus(); }, 100);
   };
 
   // return IMAP ACL dialog buttons
   this.form_acl_dialog_buttons = function()
   {
     var buttons = {
       'button.ok': function() {
         if (self.form_acl_dialog_submit()) {
           this.hide();
           $('#acl-dialog').remove();
         }
       },
       'button.cancel': function() {
         this.hide();
         $('#acl-dialog').remove();
       },
     };
 
     return buttons;
   };
 
   // build and return IMAP ACL dialog content
   this.form_acl_dialog_content = function(acl)
   {
     var dialog = $('<div id="acl-dialog"><form id="acl-form"><table class="form">'
         + '<tr><td class="label"></td><td class="value"></td></tr>'
         + '<tr><td class="label"></td><td class="value"></td></tr>'
         + '<tr><td class="label"></td><td class="value"></td></tr>'
         + '</table></form></div>'),
       rows = $('tr', dialog),
       rights_div = $('<div>'),
       spans = [$('<span>'), $('<span>')],
       subject_select = $('<select id="acl-subject"></select>')
         .on('change', function() {
           subject_input[$(this).val() == 'user' ? 'show' : 'hide']();
         }),
       subject_input = $('<input id="acl-subject-user" type="text" size="30" />'),
       select = $('<select id="acl-type"></select>')
         .on('change', function() {
           rights_div[$(this).val() == 'custom' ? 'show' : 'hide']();
         }),
 // Not yet implemented
 //      epoch_input = $('<input id="acl-epoch" type="text" size="13" />'),
       subjects = 'user,anyone,anonymous'.split(','),
       options = 'all,read-only,read-write,semi-full,full,custom'.split(','),
       rights = 'l,r,s,w,i,p,k,x,t,n,e,a'.split(',');
 
     $.each(subjects, function() {
       $('<option></option>').text(self.t('acl.'+this)).val(this).appendTo(subject_select);
     });
 
     $.each(options, function() {
       $('<option></option>').text(self.t('acl.'+this)).val(this).appendTo(select);
     });
 
     $.each(rights, function(i, v) {
       $('<label>')
         .append($('<input type="checkbox" />').val(v))
         .append($('<span>').text(self.t('acl.'+v)))
         .appendTo(spans[i > 5 ? 1 : 0]);
     });
 
     $('td.label', rows[0]).text(this.t('acl.identifier'));
     $('td.value', rows[0]).append(subject_select).append(subject_input);
     $('td.label', rows[1]).text(this.t('acl.rights'));
     $('td.value', rows[1]).append(select).append(rights_div.append(spans));
 // Not yet implemented
 //    $('td.label', rows[2]).text(this.t('acl.expire'));
 //    $('td.value', rows[2]).append(epoch_input);
 
     dialog.hide().appendTo('body');
 
     this.trigger_event('form-load', 'acl-form');
 
     // reset form elements
     subject_select.val(acl.subject && acl.subject.match(/^(anyone|anonymous)$/i) ? acl.subject : 'user').change();
     subject_input.val(acl.subject && subject_select.val() == 'user' ? acl.subject : '');
 // Not yet implemented
 /*    epoch_input.val(this.unix_to_date(acl.epoch, true));
     epoch_input.datetimepicker({
       lang: 'en',
       format: 'Y-m-d H:i'
     });
 */
     var v = !acl.rights ? 'read-write' : $.inArray(acl.rights, options) != -1 ? acl.rights : 'custom';
     select.val(v).change();
     $.each(rights, function() {
       $('input[value="' + this + '"]', rights_div).prop('checked', v == 'custom' && acl.rights && acl.rights.indexOf(this) > -1);
     });
 
     // Initialize autocompletion
     this.ac_init(subject_input, {
       action: 'form_value.list_options',
       attribute: 'owner',
       result_key: 'mail',
       oninsert: function(key, val) { $(this.ac_input).val(key); },
       form: $('textarea[name="' + this.acl_dialog_name + '"]').parents('form')
     });
 
     return dialog.show();
   };
 
   // submits IMAP ACL dialog, updates acl definition in form
   this.form_acl_dialog_submit = function()
   {
     var acl, exists, subject = $('#acl-subject').val(),
       user_input = $('#acl-subject-user'),
       user = $.trim(user_input.val()),
       rights = $('#acl-type').val(),
 // Not yet implemented
 //      epoch = $.trim($('#acl-epoch').val()),
       acl_list = $('#acl' + this.acl_dialog_name);
 
     // sanity checks
     if (subject == 'user') {
       subject = user;
       if (!subject) {
         alert(this.t('acl.error.nouser'));
         user_input.focus();
         return false;
       }
     }
 
     $.each(this.acl[self.acl_dialog_name] || [], function(i, v) {
       if (v && v.subject == subject && (!self.acl_dialog_id || self.acl_dialog_id != i)) {
         exists = true;
         return false;
       }
     });
 
     if (exists) {
       alert(this.t('acl.error.subjectexists'));
       return false;
     }
 
     if (rights == 'custom') {
       rights = '';
       $('#acl-form input:checked').each(function() { rights += this.value; });
 
       if (!rights) {
         alert(this.t('acl.error.norights'));
         return false;
       }
     }
 
 // Not yet implemented
 /*    if (epoch) {
       if (epoch.match(/^([0-9]{4})-([0-9]{2})-([0-9]{2}) ([0-9]{2}):([0-9]{2})$/))
         epoch = Date.UTC(RegExp.$1, RegExp.$2 - 1, RegExp.$3, RegExp.$4, RegExp.$5) / 1000;
       else if (epoch.match(/^([0-9]{4})-([0-9]{2})-([0-9]{2})$/))
         epoch = Date.UTC(RegExp.$1, RegExp.$2 - 1, RegExp.$3, 23, 59) / 1000;
       else {
         alert(this.t('acl.error.invaliddate'));
         return false;
       }
     }
 */
 
 //    acl = {subject: subject, rights: rights, epoch: epoch};
     acl = {subject: subject, rights: rights};
 
     // this.log(acl);
     // this.log(this.build_acl([acl]));
 
     if (this.acl_dialog_id) {
       this.acl[this.acl_dialog_name][this.acl_dialog_id] = acl;
       $('option[value="' + this.acl_dialog_id + '"]', acl_list).text(acl.subject);
     }
     else {
       this.acl[this.acl_dialog_name].push(acl);
       $('<option></option>').val(this.acl[this.acl_dialog_name].length-1)
         .text(acl.subject)
         .appendTo(acl_list)
         .on('dblclick', function () { self.form_acl_dialog(self.acl_dialog_name, this.value); });
     }
 
     return true;
   };
 
   // Replaces form element with LDAP URL element
   this.form_url_element_wrapper = function(form_element)
   {
     var i, e = $(form_element),
       form = form_element.form,
       name = form_element.name,
       ldap = this.parse_ldap_url(e.val()) || {},
       options = ['sub', 'one', 'base'],
       div = $('<div class="ldap_url"><table></table></div>'),
       host = $('<input type="text">').attr({name: 'ldap_host_'+name, size: 30, value: ldap.host, 'class': 'ldap_host'}),
       port = $('<input type="text">').attr({name: 'ldap_port_'+name, size: 5, value: ldap.port || '389'}),
       base = $('<input type="text">').attr({name: 'ldap_base_'+name, value: ldap.base}),
       scope = $('<select>').attr({name: 'ldap_scope_'+name}),
       filter = $('<ul>'),
       row_host = $('<tr class="ldap_host"><td></td><td></td></tr>'),
       row_base = $('<tr class="ldap_base"><td></td><td></td></tr>'),
       row_scope = $('<tr class="ldap_scope"><td></td><td></td></tr>'),
       row_filter = $('<tr class="ldap_filter"><td></td><td></td></tr>');
 
     for (i in options)
       $('<option>').val(options[i]).text(this.t('ldap.'+options[i])).appendTo(scope);
     scope.val(ldap.scope);
 
     for (i in ldap.filter)
       filter.append(this.form_url_filter_element(name, i, ldap.filter[i]));
     if (!$('li', filter).length)
       filter.append(this.form_url_filter_element(name, 0, {}));
 
     e.hide();
 
     $('td:first', row_host).text(this.t('ldap.host'));
     $('td:last', row_host).append(host).append($('<span>').text(':')).append(port);
     $('td:first', row_base).text(this.t('ldap.basedn'));
     $('td:last', row_base).append(base);
     $('td:first', row_scope).text(this.t('ldap.scope'));
     $('td:last', row_scope).append(scope);
     $('td:first', row_filter).text(this.t('ldap.conditions'));
     $('td:last', row_filter).append(filter);
     $('table', div).append(row_host).append(row_base).append(row_scope).append(row_filter);
     $(form_element).parent().append(div);
   };
 
   this.form_url_filter_element = function(name, idx, filter)
   {
-    var options = ['any', 'both', 'prefix', 'suffix', 'exact'],
+    var options = ['any', 'both', 'prefix', 'suffix', 'exact', 'notexact'],
       filter_type = $('<select>').attr({name: 'ldap_filter_type_'+name+'['+idx+']'}),
       filter_name = $('<input type="text">').attr({name: 'ldap_filter_name_'+name+'['+idx+']'}),
       filter_value = $('<input type="text">').attr({name: 'ldap_filter_value_'+name+'['+idx+']'}),
       a_add = $('<a class="button add" href="#add"></a>').click(function() {
         var dt = new Date().getTime();
         $(this.parentNode.parentNode).append(kadm.form_url_filter_element(name, dt, {}));
       }).attr({title: this.t('add')}),
       a_del = $('<a class="button delete" href="#delete"></a>').click(function() {
         if ($('li', this.parentNode.parentNode).length > 1)
           $(this.parentNode).remove();
         else {
           $('input', this.parentNode).val('');
           $('select', this.parentNode).val('any').change();
         }
       }).attr({title: this.t('delete')}),
       li = $('<li>');
 
     for (i in options)
       $('<option>').val(options[i]).text(this.t('ldap.filter_'+options[i])).appendTo(filter_type);
 
     if (filter.type)
       filter_type.val(filter.type);
     if (filter.name)
       filter_name.val(filter.name);
     if (filter.value)
       filter_value.val(filter.value);
 
     filter_type.change(function() {
       filter_value.css({display: $(this).val() == 'any' ? 'none' : 'inline'});
     }).change();
 
     return li.append(filter_name).append(filter_type).append(filter_value)
       .append(a_del).append(a_add);
   };
 
   // updates form data with LDAP URL (on form submit)
   this.form_url_element_submit = function(name, data, form)
   {
     var i, rx = new RegExp('^ldap_(host|port|base|scope|filter_name|filter_type|filter_value)_'+name+'(\\[|$)');
 
     for (i in data)
       if (rx.test(i))
         delete data[i];
 
     data[name] = this.form_url_element_save(name, form);
 
     return data;
   };
 
   // updates LDAP URL field
   this.form_url_element_save = function(name, form)
   {
     var url, form = $(form), params = {
       host: $('input[name="ldap_host_'+name+'"]', form).val(),
       port: $('input[name="ldap_port_'+name+'"]', form).val(),
       base: $('input[name="ldap_base_'+name+'"]', form).val(),
       scope: $('select[name="ldap_scope_'+name+'"]', form).val(),
       filter: []};
 
     $('input[name^="ldap_filter_name_'+name+'"]', form).each(function() {
       if (this.value && /\[([^\]]+)\]/.test(this.name)) {
         var suffix = name + '[' + RegExp.$1 + ']',
           type = $('select[name="ldap_filter_type_'+suffix+'"]', form).val(),
           value = type == 'any' ? '' : $('input[name="ldap_filter_value_'+suffix+'"]', form).val();
 
         params.filter.push({name: this.value, type: type, value: value, join: 'AND', level: 0});
       }
     });
 
     url = this.build_ldap_url(params);
     $('input[name="'+name+'"]').val(url);
 
     return url;
   };
 
 
   /*********************************************************/
   /*********                 Forms                 *********/
   /*********************************************************/
 
   // disable/enable all fields of a form
   this.lock_form = function(form, lock)
   {
     if (!form || !form.elements)
       return;
 
     var n, len, elm;
 
     if (lock)
       this.disabled_form_elements = [];
 
     for (n=0, len=form.elements.length; n<len; n++) {
       elm = form.elements[n];
 
       if (elm.type == 'hidden')
         continue;
       // remember which elem was disabled before lock
       if (lock && elm.disabled)
         this.disabled_form_elements.push(elm);
       // check this.disabled_form_elements before inArray() as a workaround for FF5 bug
       // http://bugs.jquery.com/ticket/9873
       else if (lock || (this.disabled_form_elements && $.inArray(elm, this.disabled_form_elements)<0))
         elm.disabled = lock;
     }
   };
 
   this.serialize_form = function(id)
   {
     var json = {}, form = $(id), query = form.serializeArray();
 
     // convert to name-value object
     $.each(query, function() { json[this.name] = this.value; });
 
     // read extra (disabled) fields
     $.each(this.env.extra_fields || [], function() {
       var value = $('[name="' + this + '"]', form).val();
       if (value)
         json[this] = value;
     });
 
     // serializeArray() doesn't work properly for multi-select
     $('select[multiple="multiple"]', form).each(function() {
       var name = this.name;
       json[name] = [];
       $(':selected', this).each(function() {
         json[name].push(this.value);
       });
     });
 
     this.form_serialize({id: id, json: json});
 
     return json;
   };
 
   this.form_value_change = function(events)
   {
     var i, j, e, elem, name, elem_name,
       form = $('#'+this.env.form_id),
       id = $('[name="id"]', form).val(),
       type_id = $('[name="type_id"]', form).val(),
       object_type = $('[name="object_type"]', form).val(),
       data = {type_id: type_id, object_type: object_type, attributes: []};
 
     if (id)
       data.id = id;
 
     this.set_busy(true, 'loading');
 
     for (i=0; i<events.length; i++) {
       name = events[i];
       e = this.env.auto_fields[name];
 
       if (!e)
         continue;
 
       data.attributes.push(name);
       for (j=0; j<e.data.length; j++) {
         elem_name = e.data[j];
         if (!data[elem_name] && (elem = $('[name="'+elem_name+'"]', form)))
           data[elem_name] = elem.val();
       }
     }
 
     if (data.attributes.length)
       this.api_post('form_value.generate', data, 'form_value_response');
   };
 
   this.form_value_response = function(response)
   {
     var i, val, field;
     if (!this.api_response(response))
       return;
 
     for (i in response.result) {
       val = response.result[i];
       field = $('[name="'+i+'"]');
       // @TODO: indexed list support
       if ($.isArray(val))
         val = field.is('textarea') ? val.join("\n") : val.shift();
       field.val(val);
 
       this.form_element_update({name: i});
     }
   };
 
   this.form_value_error = function(name)
   {
     $('[name="'+name+'"]', $('#'+this.env.form_id)).addClass('error');
   }
 
   this.form_error_clear = function()
   {
     $('input,textarea', $('#'+this.env.form_id)).removeClass('error');
   }
 
   this.check_required_fields = function(data)
   {
     var i, n, is_empty, ret = true,
       req_fields = this.env.required_fields;
 
     for (i=0; i<req_fields.length; i++) {
       n = req_fields[i];
       is_empty = 0;
 
       if ($.isArray(data[n]))
         is_empty = (data[n].length == 0) ? 1 : 0;
       else
         is_empty = !data[n];
 
       if (is_empty) {
         this.form_value_error(n);
         ret = false;
       }
     }
 
     return ret;
   };
 
   /*********************************************************/
   /*********          Client commands              *********/
   /*********************************************************/
 
   this.main_logout = function(params)
   {
     location.href = '?task=main&action=logout' + (params ? '&' + $.param(params) : '');
     return false;
   };
 
   this.domain_info = function(id)
   {
     this.http_post('domain.info', {id: id});
   };
 
   this.domain_list = function(props)
   {
     this.list_handler('domain', props);
   };
 
   this.domain_delete = function(id)
   {
     this.env.delete_domain_id = id;
     return this.delete_handler(id, 'domain');
   };
 
   this.domain_save = function(reload, section)
   {
     return this.save_handler('domain', reload, section);
   };
 
   this.domain_delete_response = function(response)
   {
     // domain is not empty
     if (response && response.code == 450) {
       this.set_busy(false);
 
       if (confirm(this.t('domain.delete.force'))) {
         this.set_busy(true, 'deleting');
         this.api_post('domain.delete', {'id': this.env.delete_domain_id, force: 1}, 'domain_delete_response');
       }
     }
     else
       this.response_handler(response, 'domain.delete', 'domain.list', {refresh: 1});
   };
 
   this.domain_add_response = function(response)
   {
     this.response_handler(response, 'domain.add', 'domain.list', {refresh: 1});
   };
 
   this.domain_edit_response = function(response)
   {
     // domain is not empty and delete was requested
     if (response && response.code == 450) {
       this.set_busy(false);
 
       // warn the user and re-send the request
       if (confirm(this.t('domain.delete.force'))) {
         var data = this.serialize_form('#'+this.env.form_id);
         data.force = 1;
 
         this.set_busy(true, 'saving');
         this.api_post('domain.edit', data, 'domain_edit_response');
       }
     }
     else
       this.response_handler(response, 'domain.edit', 'domain.list', {refresh: 1});
   };
 
   this.user_info = function(id)
   {
     this.http_post('user.info', {'id': id});
   };
 
   this.user_list = function(props)
   {
     return this.list_handler('user', props);
   };
 
   this.user_delete = function(id)
   {
     return this.delete_handler(id, 'user');
   };
 
   this.user_save = function(reload, section)
   {
     var validate = function(obj, data) {
       // check password
       if (data.userpassword != data.userpassword2) {
         obj.display_message('user.password.mismatch', 'error');
         obj.form_value_error('userpassword2');
         return false;
       }
 
       delete data['userpassword2'];
       return data;
     };
 
     return this.save_handler('user', reload, section, validate);
   };
 
   this.user_delete_response = function(response)
   {
     this.response_handler(response, 'user.delete', 'user.list');
   };
 
   this.user_add_response = function(response)
   {
     this.response_handler(response, 'user.add', 'user.list');
   };
 
   this.user_edit_response = function(response)
   {
     this.response_handler(response, 'user.edit', 'user.list');
   };
 
   this.group_info = function(id)
   {
     this.http_post('group.info', {id: id});
   };
 
   this.group_list = function(props)
   {
     return this.list_handler('group', props);
   };
 
   this.group_delete = function(id)
   {
     return this.delete_handler(id, 'group');
   };
 
   this.group_save = function(reload, section)
   {
     return this.save_handler('group', reload, section);
   };
 
   this.group_delete_response = function(response)
   {
     this.response_handler(response, 'group.delete', 'group.list');
   };
 
   this.group_add_response = function(response)
   {
     this.response_handler(response, 'group.add', 'group.list');
   };
 
   this.group_edit_response = function(response)
   {
     this.response_handler(response, 'group.edit', 'group.list');
   };
 
   this.ou_info = function(id)
   {
     this.http_post('ou.info', {id: id});
   };
 
   this.ou_list = function(props)
   {
     return this.list_handler('ou', props);
   };
 
   this.ou_delete = function(id)
   {
     return this.delete_handler(id, 'ou');
   };
 
   this.ou_save = function(reload, section)
   {
     return this.save_handler('ou', reload, section);
   };
 
   this.ou_delete_response = function(response)
   {
     this.response_handler(response, 'ou.delete', 'ou.list');
   };
 
   this.ou_add_response = function(response)
   {
     this.response_handler(response, 'ou.add', 'ou.list');
   };
 
   this.ou_edit_response = function(response)
   {
     this.response_handler(response, 'ou.edit', 'ou.list');
   };
 
   this.resource_info = function(id)
   {
     this.http_post('resource.info', {id: id});
   };
 
   this.resource_list = function(props)
   {
     return this.list_handler('resource', props);
   };
 
   this.resource_delete = function(id)
   {
     return this.delete_handler(id, 'resource');
   };
 
   this.resource_save = function(reload, section)
   {
     return this.save_handler('resource', reload, section);
   };
 
   this.resource_delete_response = function(response)
   {
     this.response_handler(response, 'resource.delete', 'resource.list');
   };
 
   this.resource_add_response = function(response)
   {
     this.response_handler(response, 'resource.add', 'resource.list');
   };
 
   this.resource_edit_response = function(response)
   {
     this.response_handler(response, 'resource.edit', 'resource.list');
   };
 
   this.role_info = function(id)
   {
     this.http_post('role.info', {id: id});
   };
 
   this.role_list = function(props)
   {
     return this.list_handler('role', props);
   };
 
   this.role_delete = function(id)
   {
     return this.delete_handler(id, 'role');
   };
 
   this.role_save = function(reload, section)
   {
     return this.save_handler('role', reload, section);
   };
 
   this.role_delete_response = function(response)
   {
     this.response_handler(response, 'role.delete', 'role.list');
   };
 
   this.role_add_response = function(response)
   {
     this.response_handler(response, 'role.add', 'role.list');
   };
 
   this.role_edit_response = function(response)
   {
     this.response_handler(response, 'role.edit', 'role.list');
   };
 
   this.sharedfolder_info = function(id)
   {
     this.http_post('sharedfolder.info', {id: id});
   };
 
   this.sharedfolder_list = function(props)
   {
     return this.list_handler('sharedfolder', props);
   };
 
   this.sharedfolder_delete = function(id)
   {
     return this.delete_handler(id, 'sharedfolder');
   };
 
   this.sharedfolder_save = function(reload, section)
   {
     return this.save_handler('sharedfolder', reload, section);
   };
 
   this.sharedfolder_delete_response = function(response)
   {
     this.response_handler(response, 'sharedfolder.delete', 'sharedfolder.list');
   };
 
   this.sharedfolder_add_response = function(response)
   {
     this.response_handler(response, 'sharedfolder.add', 'sharedfolder.list');
   };
 
   this.sharedfolder_edit_response = function(response)
   {
     this.response_handler(response, 'sharedfolder.edit', 'sharedfolder.list');
   };
 
   this.settings_type_info = function(id)
   {
     this.http_post('settings.type_info', {id: id});
   };
 
   this.settings_type_add = function()
   {
     this.http_post('settings.type_add', {type: $('#type_list_filter').val()});
   };
 
   this.settings_type_clone = function(id)
   {
     this.http_post('settings.type_add', {type: $('#type_list_filter').val(), clone_id: id});
   };
 
   this.settings_type_list = function(props)
   {
     if (!props)
       props = {};
 
     if (props.search === undefined && this.env.search_request)
       props.search_request = this.env.search_request;
 
     props.type = $('#type_list_filter').val();
 
     this.http_post('settings.type_list', props);
   };
 
   this.type_delete = function(id)
   {
     return this.delete_handler(this.type_id_parse(id), 'type');
   };
 
   this.type_save = function(reload, section)
   {
     var i, n, attr, request = {},
       data = this.serialize_form('#'+this.env.form_id),
       action = data.id ? 'edit' : 'add',
       required = this.env.attributes_required || [];
 
     if (reload) {
       data.section = section;
       this.http_post('type.' + action, {data: data});
       return;
     }
 
     this.form_error_clear();
 
     if (!this.check_required_fields(data)) {
       this.display_message('form.required.empty', 'error');
       return false;
     }
 
     if (data.key.match(/[^a-z_-]/)) {
       this.display_message('attribute.key.invalid', 'error');
       return false;
     }
 
     request.id = data.id;
     request.key = data.key;
     request.name = data.name;
     request.type = data.type;
     request.description = data.description;
     request.used_for = data.used_for;
     request.is_default = data.is_default;
     request.attributes = {fields: {}, form_fields: {}, auto_form_fields: {}};
     request.attributes.fields.objectclass = data.objectclass;
 
     // Build attributes array compatible with the API format
     // @TODO: use attr_table format
     for (i in this.env.attr_table) {
       // attribute doesn't exist in specified object classes set
       if (!(n = this.env.attributes[i]))
         continue;
 
       // check required attributes
       if (required.length)
         required = $.map(required, function(a) { return a != n ? a : null; });
 
       attr = this.env.attr_table[i];
       data = {};
 
       if (attr.valtype == 'static') {
         request.attributes.fields[i] = attr.data;
         continue;
       }
 
       if (attr.type == 'list-autocomplete') {
         data.type = 'list';
         data.autocomplete = true;
       }
       else if (attr.type == 'text-autocomplete') {
         data.autocomplete = true;
       }
       else if (attr.type != 'text')
         data.type = attr.type;
 
       if ((attr.type == 'select' || attr.type == 'multiselect') && attr.values && attr.values.length)
         data.values = attr.values;
 
       if (attr.optional)
         data.optional = true;
       if (attr.maxcount)
         data.maxcount = attr.maxcount;
       if (attr.validate != 'default')
         data.validate = attr.validate;
 
       if (attr['default'] && attr.valtype == 'normal' && attr.type.match(this.attr_default_rx))
         data['default'] = attr['default'];
 
       if (attr.valtype == 'normal' || attr.valtype == 'auto')
         request.attributes.form_fields[i] = data;
       if (attr.valtype == 'auto' || attr.valtype == 'auto-readonly') {
         if (attr.data)
           data.data = attr.data.split(/,/);
         request.attributes.auto_form_fields[i] = data;
       }
     }
 
     if (required.length) {
       this.display_message(this.t('attribute.required.error').replace(/\$1/, required.join(',')), 'error');
       return false;
     }
 
     this.set_busy(true, 'saving');
     this.api_post('type.' + action, request, 'type_' + action + '_response');
   };
 
   this.type_delete_response = function(response)
   {
     this.response_handler(response, 'type.delete', 'settings.type_list');
   };
 
   this.type_add_response = function(response)
   {
     this.response_handler(response, 'type.add', 'settings.type_list');
   };
 
   this.type_edit_response = function(response)
   {
     this.response_handler(response, 'type.edit', 'settings.type_list');
   };
 
   /*********************************************************/
   /*********       Various helper methods          *********/
   /*********************************************************/
 
   // universal API response handler
   this.response_handler = function(response, action, list, list_params)
   {
     if (!this.api_response(response))
       return;
 
     this.display_message(action + '.success');
 
     var page = this.env.list_page,
       list_id = list.replace(/[^a-z]/g, '');
 
     // if objects list exists
     if ($('#'+list_id).length) {
       // goto previous page if last record on the current page has been deleted
       if (this.env.list_page > 1 && this.env.list_size == 1 && action.match(/\.delete/))
         page -= 1;
 
       if (!list_params)
         list_params = {};
 
       list_params.page = page;
       this.command(list, list_params);
       this.set_watermark('taskcontent');
     }
   };
 
   // universal list request handler
   this.list_handler = function(type, props)
   {
     if (!props)
       props = {};
 
     if (props.search === undefined && this.env.search_request)
       props.search_request = this.env.search_request;
 
     this.http_post(type + '.list', props);
   };
 
   // universal object delete handler
   this.delete_handler = function(request, type)
   {
     if (!confirm(this.t(type + '.delete.confirm')))
       return false;
 
     if (typeof request != 'object')
       request = {'id': request};
 
     this.set_busy(true, 'deleting');
     this.api_post(type + '.delete', request, type + '_delete_response');
   };
 
   // universal form save handler
   this.save_handler = function(type, reload, section, validation_function)
   {
     var data = this.serialize_form('#'+this.env.form_id),
       action = data.id ? 'edit' : 'add';
 
     if (reload) {
       // remove unchanged defaults
       $.each(this.env.default_values || [], function(i, v) {
         if (v == data[i])
           delete data[i];
       });
 
       data.section = section;
       this.http_post(type + '.' + action, {data: data});
       return false;
     }
 
     this.form_error_clear();
 
     if (validation_function)
       data = validation_function(this, data);
 
     if (data === false)
       return false;
 
     if (!this.check_required_fields(data)) {
       this.display_message('form.required.empty', 'error');
       return false;
     }
 
     this.set_busy(true, 'saving');
     this.api_post(type + '.' + action, data, type + '_' + action + '_response');
 
     return true;
   };
 
   // Parses object type identifier
   this.type_id_parse = function(id)
   {
     var id = String(id).split(':');
     return {type: id[0], id: id[1]};
   };
 
   // Removes attribute row
   this.type_attr_delete = function(attr)
   {
     $('#attr_table_row_' + attr).remove();
     $('select[name="attr_name"] > option[value="'+attr+'"]').show();
 
     delete this.env.attr_table[attr];
     this.type_attr_cancel();
   };
 
   // Displays attribute edition form
   this.type_attr_edit = function(attr)
   {
     var form = $('#type_attr_form');
 
     form.detach();
     $('#attr_table_row_'+attr).after(form);
     this.type_attr_form_init(attr);
     form.slideDown(400);
   };
 
   // Displays attribute addition form
   this.type_attr_add = function()
   {
     var form = $('#type_attr_form');
 
     form.detach();
     $('#type_attr_table > tbody').append(form);
     this.type_attr_form_init();
     form.slideDown(400);
   };
 
   // Saves attribute form, create/update attribute row
   this.type_attr_save = function()
   {
     var attr, row, data = {},
       form_data = this.serialize_form('#'+this.env.form_id),
       name_select = $('select[name="attr_name"]');
 
     // read attribute form data
     data.type = form_data.attr_type;
     data.valtype = form_data.attr_value;
     data.optional = form_data.attr_optional;
     data.validate = form_data.attr_validate;
     data.data = data.valtype != 'normal' ? form_data.attr_data : null;
     data.maxcount = data.type == 'list' || data.type == 'list-autocomplete' ? form_data.attr_maxcount : 0;
     data.values = data.type == 'select' || data.type == 'multiselect' ? form_data.attr_options : [];
 
     if (name_select.is(':visible')) {
       // new attribute
       attr = name_select.val();
       row = $('<tr><td class="name"></td><td class="type"></td><td class="readonly"></td>'
         +'<td class="optional"></td><td class="validate"></td><td class="actions">'
         +'<a class="button delete" title="delete" onclick="kadm.type_attr_delete(\''+attr+'\')" href="#delete"></a>'
         +'<a class="button edit" title="edit" onclick="kadm.type_attr_edit(\''+attr+'\')" href="#edit"></a></td></tr>')
         .attr('id', 'attr_table_row_' + attr).appendTo('#type_attr_table > tbody');
     }
     else {
       // edited attribute
       attr = $('span', name_select.parent()).text().toLowerCase();
       row = $('#attr_table_row_' + attr);
     }
 
     if (data.valtype != 'normal') {
       row.attr('title', this.t('attribute.value.' + (data.valtype == 'static' ? 'static' : 'auto')) + ': ' + data.data);
     }
 
     if (form_data.attr_default && data.valtype == 'normal' && data.type.match(this.attr_default_rx)) {
       data['default'] = form_data.attr_default;
     }
 
     // Update table row
     $('td.name', row).text(this.env.attributes[attr]);
     $('td.type', row).text(data.type);
     $('td.readonly', row).text(data.valtype == 'auto-readonly' ? this.env.yes_label : this.env.no_label);
     $('td.optional', row).text(data.optional ? this.env.yes_label : this.env.no_label);
     $('td.validate', row).text(this.t('attribute.validate.' + data.validate));
 
     // Update env data
     this.env.attr_table[attr] = data;
 
     this.type_attr_cancel();
   };
 
   // Hide attribute form
   this.type_attr_cancel = function()
   {
     $('#type_attr_form').hide();
   };
 
   this.type_attr_form_init = function(attr)
   {
     var name_select = $('select[name="attr_name"]'),
       data = attr ? this.env.attr_table[attr] : {},
       type = data.type || 'text';
 
     $('select[name="attr_type"]').val(type);
     $('select[name="attr_value"]').val(attr ? data.valtype : 'normal');
     $('select[name="attr_validate"]').val(data.validate || 'default');
     $('input[name="attr_default"]').val(data['default'] || '');
     $('input[name="attr_optional"]').prop('checked', attr ? data.optional : false);
     $('input[name="attr_data"]').val(data.data || '');
     $('input[name="attr_maxcount"]').val(data.maxcount || '');
     $('textarea[name="attr_options"]').val(data.values ? data.values.join("\n") : '');
     $('span', name_select.parent()).remove();
 
     if (attr) {
       name_select.hide().val(attr);
       $('<span></span>').text(this.env.attributes[attr] ? this.env.attributes[attr] : attr)
         .appendTo(name_select.parent());
     }
     else {
       this.type_attr_select_init();
       name_select.show();
     }
 
     this.form_element_update({name: 'attr_options'});
     this.type_attr_type_change();
     this.type_attr_value_change();
   };
 
   // Initialize attribute name selector
   this.type_attr_select_init = function()
   {
     var select = $('select[name="attr_name"]'),
       options = $('option', select);
 
     options.each(function() {
       if (kadm.env.attr_table[this.value])
         $(this).attr('disabled', true);
     });
     options.not(':disabled').first().attr('selected', true);
   };
 
   // Update attribute form on attribute name change
   this.type_attr_name_change = function(elem)
   {
     this.type_attr_value_change();
   };
 
   // Update attribute form on value type change
   this.type_attr_value_change = function(elem)
   {
     var type = $(elem || 'select[name="attr_value"]').val(),
       field_type = $('select[name="attr_type"]').val(),
       optional = $('#attr_form_row_optional'),
       select = $('select[name="attr_name"]').val(),
       attr_name = this.env.attributes[select],
       // only non-static and non-required attributes can be marked as optional
       opt = type != 'static' && $.inArray(attr_name, this.env.attributes_required) == -1;
 
     $('input[name="attr_data"]')[type != 'normal' ? 'show' : 'hide']();
     $('#attr_form_row_readonly')[type != 'static' ? 'show' : 'hide']();
     $('#attr_form_row_default')[type == 'normal' && field_type.match(this.attr_default_rx) ? 'show' : 'hide']();
     optional[opt ? 'show' : 'hide']();
 
     if (!opt)
       $('input', optional).attr('checked', false);
   };
 
   // Update attribute form on type change
   this.type_attr_type_change = function(elem)
   {
     var type = $(elem || 'select[name="attr_type"]').val(),
       val_type = $('select[name="attr_value"]').val();
 
     $('#attr_form_row_maxcount')[type == 'list' || type == 'list-autocomplete' ? 'show' : 'hide']();
     $('#attr_form_row_options')[type == 'select' || type == 'multiselect' ? 'show' : 'hide']();
     $('#attr_form_row_default')[val_type == 'normal' && type.match(this.attr_default_rx) ? 'show' : 'hide']();
   };
 
   // Update attributes list on object classes change
   this.type_attr_class_change = function(field)
   {
     var data = {attributes: 'attribute', classes: this.type_object_classes(field)};
     this.api_post('form_value.select_options', data, 'type_attr_class_change_response');
     this.type_attr_cancel();
   };
 
   // Update attributes list on object classes change - API response handler
   this.type_attr_class_change_response = function(response)
   {
     if (!this.api_response(response))
       return;
 
     var i, lc, list = response.result.attribute.list || [],
       required = response.result.attribute.required || [],
       select = $('select[name="attr_name"]');
 
     // remove objectClass from attributes list(s)
     required = $.map(required, function(a) { return a == 'objectClass' ? null : a; });
     list = $.map(list, function(a) { return a == 'objectClass' ? null : a; });
 
     // append special attributes
     $.each(this.env.special_attributes || [], function() {
       if ($.inArray(this, list) == -1)
         list.push(this);
     });
     list.sort();
 
     this.env.attributes = {};
     this.env.attributes_required = required;
     select.empty();
 
     for (i in list) {
       lc = list[i].toLowerCase();
       this.env.attributes[lc] = list[i];
       $('<option>').text(list[i]).val(lc).appendTo(select);
     }
   };
 
   // Return selected objectclasses array
   this.type_object_classes = function(field)
   {
     var classes = [];
     $('option:selected', $(field)).each(function() {
       classes.push(this.value);
     });
     return classes;
   };
 
   // Password generation - request
   this.generate_password = function(fieldname)
   {
     this.env.password_field = fieldname;
     this.set_busy(true, 'loading');
     // we can send only 'attributes' here, because password generation doesn't require object type name/id
     this.api_post('form_value.generate', {attributes: [fieldname]}, 'generate_password_response');
   };
 
   // Password generation - response handler
   this.generate_password_response = function(response)
   {
     if (!this.api_response(response))
       return;
 
     var f = this.env.password_field, pass = response.result[f];
 
     $('input[name="' + f + '"]').val(pass);
     $('input[name="' + f + '2"]').val(pass);
   };
 
   // convert ACI string into object
   this.parse_aci = function(aci_str)
   {
     var aci = [];
 
     $.each((aci_str || '').split(/\r?\n/), function(i, str) {
       var s, target, permission,
         or_rx = /\s*\|\|\s*/,
         entry = {targets: [], perms: []};
 
       // Syntax: (target)(version 3.0; acl "name";permission bindRules;)
 
       // target is optional and there can be many of it
       while (/^\(target/.test(str)) {
         if (s = str.match(/^\((target|targetattr|targetscope|targetcontrol|extop|targetfilter|targattrfilters)\s*([!=]+)\s*\"([^"]+)\"\)/)) {
           target = {operator: s[2], type: s[1], expression: s[3]};
 
           switch (target.type) {
             case 'targetattr':
             case 'targetcontrol':
             case 'extop':
               target.expression = target.expression.toLowerCase().split(or_rx);
               break;
           };
 
           entry.targets.push(target);
           str = str.substr(s[0].length);
         }
       }
 
       // there must be one version and acl entry
       if (s = str.match(/^\s*\(version\s*([0-9.]+)\s*;\s*acl\s*\"([^"]+)\";\s*/)) {
         entry.version = s[1];
         entry.name = s[2];
 
         str = str.substr(s[0].length);
 
         // there can be multiple permission/bindRule blocks
         $.each(str.split(';'), function(i, perm) {
           if (permission = self.parse_aci_permission(perm))
             entry.perms.push(permission);
         });
       }
 
       if (entry.name)
         aci.push(entry);
     });
 
     return aci;
   };
 
   this.parse_aci_permission = function(perm)
   {
     var s, rule, permission;
 
     if (s = perm.match(/^\s*(allow|deny)\s*\(([a-zA-Z, ]+)\)(.*)/)) {
       permission = {type: s[1], rules: [], rights: s[2].toLowerCase().split(/\s*,\s*/)};
 
       rule = s[3].replace(/^[ (]+/, '').replace(/[ )]+$/, '');
 
       while (s = rule.match(/^\s*(or|and|or not|and not)?\s*(userdn|groupdn|roledn|userattr|ip|dns|timeofday|dayofweek|authmethod|ssf)\s*([<>!=]+)\s*\"([^"]+)\"/i)) {
         permission.rules.push({
           join: permission.rules.length ? (s[1] || '').toUpperCase() : null,
           keyword: s[2],
           operator: s[3],
           expression: s[4].split(/\s*\|\|\s*/)
         });
 
         rule = rule.substr(s[0].length);
       }
     }
 
     return permission;
   };
 
   // convert ACI object into ACI array (of strings)
   this.build_aci = function(aci)
   {
     var result = [];
 
     $.each(aci, function(i, entry) {
       // skip removed entries
       if (!entry)
         return;
 
       var acl = [], tokens = [];
       $.each(entry.targets || [], function(i, target) {
         var txt = target.expression;
 
         if ($.isArray(txt))
           txt = txt.join(' || ');
 
         tokens.push('(' + target.type + ' ' + (target.operator || '=') + ' "' + txt + '")');
       });
 
       acl.push('version ' + entry.version);
       acl.push('acl "' + entry.name + '"');
 
       $.each(entry.perms || [], function(i, perm) {
         var num = 0, text = perm.type + ' (' + perm.rights.join(',') + ')';
 
         $.each(perm.rules || [], function(n, rule) {
           if (rule.join && num)
             text += ' ' + rule.join;
           text += ' ' + rule.keyword + ' ' + (rule.operator || '=') + ' "' + rule.expression.join(' || ') + '"';
           num++;
         });
 
         acl.push(text);
       });
 
       tokens.push('(' + acl.join('; ') + ';)');
       result.push(tokens.join(''));
     });
 
     return result;
   };
 
   // convert ACL string into object
   this.parse_acl = function(acl_str)
   {
     var acl = [];
 
     $.each((acl_str || '').split(/\r?\n/), function(i, str) {
       // Syntax subject, rights[, epoch]
       var entry = self.explode_quoted_str(str, ',');
 
       if (entry.length == 2 || entry.length == 3) {
 // Not yet implemented
 //        acl.push({subject: entry[0], rights: entry[1], epoch: entry[2] || 0});
         acl.push({subject: entry[0], rights: entry[1] || 0});
       }
     });
 
     return acl;
   };
 
   // convert IMAP ACL object into ACL array (of strings)
   this.build_acl = function(acl)
   {
     var result = [];
 
     $.each(acl, function(i, entry) {
       // skip removed and invalid entries
       if (!entry || !entry.subject || !entry.rights)
         return;
 
       var tokens = [], subject = entry.subject;
 
       if (subject.indexOf(',') > -1 || subject.indexOf('"') > -1)
         subject = subject.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
 
       tokens.push(subject);
       tokens.push(entry.rights);
 // Not yet implemented
 //      if (entry.epoch)
 //        tokens.push(entry.epoch);
 
       result.push(tokens.join(', '));
     });
 
     return result;
   };
 
   // LDAP URL parser
   this.parse_ldap_url = function(url)
   {
     var result = {},
       url_parser = /^([^:]+):\/\/([^\/]*)\/([^?]*)\?([^?]*)\?([^?]*)\?(.*)$/;
       matches = url_parser.exec(url);
 
     if (matches && matches[1])
       return {
         scheme: matches[1],
         host: matches[2],
         base: matches[3],
         attrs: matches[4],
         scope: matches[5],
         filter: this.parse_ldap_filter(matches[6])
       };
   };
 
   // LDAP filter parser
   this.parse_ldap_filter = function(filter)
   {
     var chr, next, elem, pos = 0, join, level = -1, res = [],
       len = filter ? filter.length : 0;
 
     if (!filter.match(/^\(.*\)$/))
       filter = '(' + filter + ')';
 
     while (len > pos) {
       chr = filter.charAt(pos);
       if (chr == '&') {
           join = 'AND';
           level++;
       }
       else if (chr == '|') {
           join = 'OR';
           level++;
       }
       else if (chr == '(') {
         next = filter.charAt(pos+1);
         if (next != '&' && next != '|') {
           next = filter.indexOf(')', pos);
           if (next > 0) {
+            if (filter.charAt(pos+1) == '!' && filter.charAt(pos+2) == '(')
+              next++;
             if (elem = this.parse_ldap_filter_entry(filter.substr(pos + 1, next - pos - 1))) {
               elem.join = join;
               elem.level = level;
               res.push(elem);
             }
             pos = next;
           }
         }
       }
       else if (chr == ')')
         level--;
 
       pos++;
     }
 
     return res;
   };
 
   // LDAP filter-entry parser
   this.parse_ldap_filter_entry = function(entry)
   {
-    var type = 'exact', name, value;
+    var type = 'exact', not, name, value;
 
-    if (entry.match(/^([a-zA-Z0-9_-]+)=(.*)$/)) {
-      name = RegExp.$1;
-      value = RegExp.$2;
+    if (entry.match(/^(!?)\(?([a-zA-Z0-9_-]+)=([^\)]*)\)?$/)) {
+      name = RegExp.$2;
+      value = RegExp.$3;
+      not = RegExp.$1.length > 0;
 
       if (value == '*') {
         value = ''
         type = 'any';
       }
       else if (value.match(/^\*(.+)\*$/)) {
         value = RegExp.$1;
         type = 'both';
       }
       else if (value.match(/^\*(.+)$/)) {
         value = RegExp.$1;
         type = 'suffix';
       }
       else if (value.match(/^(.+)\*$/)) {
         value = RegExp.$1;
         type = 'prefix';
       }
 
-      return {name: name, type: type, value: value};
+      return {name: name, type: (not ? 'not' : '') + type, value: value};
     }
   };
 
   // Builds LDAP filter string from the defined structure
   this.build_ldap_filter = function(filter)
   {
-    var i, elem, str = '', last = -1, join = {'AND': '&', 'OR': '|'};
+    var i, elem, not, str = '', last = -1, join = {'AND': '&', 'OR': '|'};
 
     for (i=0; i<filter.length; i++) {
       elem = filter[i];
       if (elem.level > last)
         str += (elem.join && filter.length > 1 ? join[elem.join] : '');
       else if (elem.level < last)
         str += ')';
 
-      str += '(' + elem.name + '=';
+      str += '('
+
+      if (not = /^not(.*)$/.test(elem.type)) {
+        str += '!(';
+        elem.type = RegExp.$1;
+      }
+
+      str += elem.name + '=';
 
       if (elem.type == 'any')
         str += '*';
       else if (elem.type == 'both')
         str += '*' + elem.value + '*';
       else if (elem.type == 'prefix')
         str += elem.value + '*';
       else if (elem.type == 'suffix')
         str += '*' + elem.value;
       else
         str += elem.value;
 
-      str += ')';
+      str += (not ? ')' : '') + ')';
       last = elem.level;
     }
 
     if (filter.length > 1)
       str = '(' + str + ')';
 
     return str;
   };
 
   // Builds LDAP URL string from the defined structure
   this.build_ldap_url = function(params)
   {
     var url = '';
 
     if (!params.filter.length && !params.base)
       return url;
 
     url += (params.scheme ? params.scheme : 'ldap') + '://';
     url += (params.host ? params.host + (params.port && params.port != 389 ? ':'+params.port : '') : '') + '/';
     url += (params.base ? params.base : '') + '?';
     url += (params.attrs ? params.attrs : '') + '?';
     url += (params.scope ? params.scope : '') + '?';
     if (params.filter)
       url += this.build_ldap_filter(params.filter);
 
     return url;
   };
 
   this.set_request_time = function()
   {
     this.env.request_time = (new Date()).getTime();
   };
 
   // Update request time element
   this.update_request_time = function()
   {
     if (this.env.request_time) {
       var t = ((new Date()).getTime() - this.env.request_time)/1000,
         el = $('#reqtime');
       el.text(el.text().replace(/[0-9.,]+/, t));
     }
   };
 
   // Return absolute mouse position of an event
   this.mouse_pos = function(e)
   {
     if (!e) e = window.event;
 
     var mX = (e.pageX) ? e.pageX : e.clientX,
       mY = (e.pageY) ? e.pageY : e.clientY;
 
     if (document.body && document.all) {
       mX += document.body.scrollLeft;
       mY += document.body.scrollTop;
     }
 
     if (e._offset) {
       mX += e._offset.left;
       mY += e._offset.top;
     }
 
     return { left:mX, top:mY };
   };
 
   this.explode_quoted_str = function(str, separator)
   {
     var i, c, q = false, p = 0, result = [], len = str.length;
 
     for (i=0; i<len; i++) {
       c = str.charAt(i);
       if (c == '"' && str.charAt(i-1) != '\\')
         q = q ? false : true;
       else if (!q && c == separator) {
         result.push(this.unescape_quoted_str(str.substr(p, i - p)));
         p = i + 1;
       }
     }
 
     result.push($.trim(p ? str.substr(p) : str));
 
     return result;
   };
 
   this.unescape_quoted_str = function(str)
   {
     str = $.trim(str || '');
 
     if (str.charAt(0) == '"')
       str = str.replace(/^"/, '').replace(/"$/, '')
         .replace(/\\(.?)/g, function(s, n1) { return n1; });
 
     return str;
   };
 
   // convert unix timestamp to datetime string
   this.unix_to_date = function(epoch, with_time)
   {
     if (!epoch)
       return '';
 
     var result, dt = new Date(epoch * 1000),
       dts = dt.toISOString(),
       parts = dts.split('T');
 
     result = parts[0];
 
     if (with_time)
       result += ' ' + parts[1].split(':').slice(0,2).join(':');
 
     return result;
   };
 };
 
 /**
  * Modal dialogs
  */
 (function($) {
   $.fn.wModal = function(option, settings) {
     if (typeof option === 'object') {
       settings = option;
     }
     else if (typeof option === 'string') {
       var values = [],
         elements = this.each(function() {
           var data = $(this).data('modal');
 
           if (data) {
             if (option === 'show')
               data.show(settings || {});
             else if (option === 'hide')
               data.hide(settings || {});
             else if ($.fn.wModal.defaultSettings[option] !== undefined) {
               if (settings !== undefined)
                 data.settings[option] = settings;
               else
                 values.push(data.settings[option]);
             }
           }
         });
 
       if (values.length === 1)
         return values[0];
       else if (values.length > 0)
         return values;
       else
         return elements;
     }
 
     return this.each(function() {
       var _settings = $.extend({}, $.fn.wModal.defaultSettings, settings || {}),
         modal = new Modal(_settings, $(this)),
         $el = modal.generate();
 
       modal.pixel.append($el);
 
       $(this).data('modal', modal);
     });
   }
 
   $.fn.wModal.defaultSettings = {btns: {}, msg: null};
 
   function Modal(settings, elem)
   {
     this.modal = null;
     this.settings = settings;
     this.elem = elem;
     this.tempButtons = {};
 
     return this;
   }
 
   Modal.prototype =
   {
     generate: function()
     {
       var _this = this;
 
       if (this.modal) return this.modal;
 
       // bg - check if bg already exists
       if ($('#modal_bg').length) {
         this.bg = $('#modal_bg');
         this.pixel = $('#modal_pixel');
       }
       else {
         this.bg = $('<div id="modal_bg"></div>').css({position:'fixed', left:'0', top:'0', display:'none'});
         $('body').append(this.bg);
         $(window).resize(function() { if(_this.bg.is(':visible')) _this.resetBg.apply(_this); });
 
         // positioning pixel setting to body produces some weird effects with scrollbars when doing sliding effects
         this.pixel = $('<div id="modal_pixel"></div>').css({position:'fixed', left:'0', top:'0', width:'0', height:'0', lineHeight:'0', fontSize:'0'});
         $('body').append(this.pixel);
       }
 
       // modal
       this.modal = $('<div class="modal_holder"></div>').css({position:'absolute', display:'none'});
       this.modal.append(this.elem);
 
       $(window).resize(function() { if(_this.modal.is(':visible')) _this.resetModal.apply(_this); });
 
       this.resetBtns();
 
       return this.modal;
     },
 
     resetModal: function()
     {
       var modalWidth = this.modal.outerWidth(true),
         modalHeight = this.modal.outerHeight(true),
         viewWidth = $(window).width(),
         viewHeight = $(window).height(),
         left = (viewWidth/2) - (modalWidth/2),
         top = (viewHeight/2) - (modalHeight/2);
 
       this.modal.css({left:(left > 0 ? left + 'px' : 'auto'), top:(top > 0 ? top + 'px' : 'auto'), bottom: 'auto', right: 'auto'});
     },
 
     resetBg: function()
     {
       this.bg.css({width:$(window).width(), height:$(window).height()});
     },
 
     resetBtns: function(btns)
     {
       var btns = btns || this.settings.btns,
         _this = this;
 
       for (var btn in btns) {
         (function(btn) {
           _this.modal.find('.modal_btn_' + btn).unbind('click');
           _this.modal.find('.modal_btn_' + btn).click(function() {
             if (_this.tempBtns[btn])
               _this.tempBtns[btn].apply(_this);
             else
               btns[btn].apply(_this);
           });
         })(btn);
       }
     },
 
     show: function(settings)
     {
       this.tempBtns = settings.btns || {};
       this.resetBg();
       this.resetModal();
       this.pixel.children('.modal_holder').hide();
 
       var _this = this;
       this.bg.fadeIn(100, function(){ _this.modal.fadeIn(100); });
     },
 
     hide: function()
     {
       this.modal.hide().remove();
       this.bg.hide();
     }
   }
 })(jQuery);
 
 // Add escape() method to RegExp object
 // http://dev.rubyonrails.org/changeset/7271
 RegExp.escape = function(str)
 {
   return String(str).replace(/([.*+?^=!:${}()|[\]\/\\])/g, '\\$1');
 };
 
 // make a string URL safe (and compatible with PHP's rawurlencode())
 function urlencode(str)
 {
   if (window.encodeURIComponent)
     return encodeURIComponent(str).replace('*', '%2A');
 
   return escape(str)
     .replace('+', '%2B')
     .replace('*', '%2A')
     .replace('/', '%2F')
     .replace('@', '%40');
 };
 
 // Initialize application object (don't change var name!)
 var kadm = new kolab_admin();
 
 // general click handler
 $(document).click(function() {
   // destroy autocompletion
   kadm.ac_stop();
   $('.popup').hide();
 });