From 75f28186a995aa930f6db9f05ec7b63bbd2cd284 Mon Sep 17 00:00:00 2001
From: xue <>
Date: Tue, 30 May 2006 03:30:14 +0000
Subject: Merge from 3.0 branch till 1103

---
 demos/blog/protected/Pages/Admin/AdminMenu.php     |  17 +++
 demos/blog/protected/Pages/Admin/ConfigMan.page    |  29 +++--
 demos/blog/protected/Pages/Admin/ConfigMan.php     |  60 ++++++++++
 demos/blog/protected/Pages/Admin/PostMan.php       |  21 +++-
 demos/blog/protected/Pages/Admin/Settings.page     |   4 -
 demos/blog/protected/Pages/Admin/UserMan.php       |  17 +++
 demos/blog/protected/Pages/ErrorReport.page        |   2 +-
 demos/blog/protected/Pages/ErrorReport.php         |  23 +++-
 demos/blog/protected/Pages/Posts/EditCategory.page |   7 +-
 demos/blog/protected/Pages/Posts/EditCategory.php  |  43 +++++---
 demos/blog/protected/Pages/Posts/EditPost.page     |  15 ++-
 demos/blog/protected/Pages/Posts/EditPost.php      |  49 +++++++--
 demos/blog/protected/Pages/Posts/ListPost.page     |  28 +++++
 demos/blog/protected/Pages/Posts/ListPost.php      | 121 +++++++++++++++++++--
 demos/blog/protected/Pages/Posts/MyPost.page       |   2 +-
 demos/blog/protected/Pages/Posts/MyPost.php        |  21 +++-
 demos/blog/protected/Pages/Posts/NewCategory.page  |   7 +-
 demos/blog/protected/Pages/Posts/NewCategory.php   |  17 +++
 demos/blog/protected/Pages/Posts/NewPost.page      |  18 +--
 demos/blog/protected/Pages/Posts/NewPost.php       |  28 ++++-
 demos/blog/protected/Pages/Posts/ViewPost.page     |  20 ++--
 demos/blog/protected/Pages/Posts/ViewPost.php      |  59 ++++++----
 demos/blog/protected/Pages/Posts/config.xml        |   2 +
 demos/blog/protected/Pages/SearchPost.page         |  44 ++++++++
 demos/blog/protected/Pages/SearchPost.php          |  76 +++++++++++++
 demos/blog/protected/Pages/Users/EditUser.page     |  31 +++---
 demos/blog/protected/Pages/Users/EditUser.php      |  38 ++++++-
 demos/blog/protected/Pages/Users/NewUser.page      |  47 ++++----
 demos/blog/protected/Pages/Users/NewUser.php       |  31 +++++-
 demos/blog/protected/Pages/Users/ViewUser.page     |  47 +++++---
 demos/blog/protected/Pages/Users/ViewUser.php      |  41 +++++--
 31 files changed, 798 insertions(+), 167 deletions(-)
 delete mode 100644 demos/blog/protected/Pages/Admin/Settings.page
 create mode 100644 demos/blog/protected/Pages/SearchPost.page
 create mode 100644 demos/blog/protected/Pages/SearchPost.php

(limited to 'demos/blog/protected/Pages')

diff --git a/demos/blog/protected/Pages/Admin/AdminMenu.php b/demos/blog/protected/Pages/Admin/AdminMenu.php
index 40f40b88..9e46acea 100644
--- a/demos/blog/protected/Pages/Admin/AdminMenu.php
+++ b/demos/blog/protected/Pages/Admin/AdminMenu.php
@@ -1,5 +1,22 @@
 <?php
+/**
+ * AdminMenu class file
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ * @version $Revision: $  $Date: $
+ */
 
+/**
+ * AdminMenu class
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ */
 class AdminMenu extends TTemplateControl
 {
 }
diff --git a/demos/blog/protected/Pages/Admin/ConfigMan.page b/demos/blog/protected/Pages/Admin/ConfigMan.page
index ad728284..69ee0899 100644
--- a/demos/blog/protected/Pages/Admin/ConfigMan.page
+++ b/demos/blog/protected/Pages/Admin/ConfigMan.page
@@ -4,16 +4,16 @@
 
 <com:Application.Pages.Admin.AdminMenu />
 
-<com:TPanel GroupingText="Site settings">
+<com:TPanel GroupingText="General settings">
 
 <span class="input-label">Title</span>
 <br/>
-<com:TTextBox ID="SiteTitle" />
+<com:TTextBox ID="SiteTitle" Columns="50"/>
 <br/>
 
 <span class="input-label">Subtitle</span>
 <br/>
-<com:TTextBox ID="SiteSubtitle" />
+<com:TTextBox ID="SiteSubtitle" Columns="50"/>
 <br/>
 
 <span class="input-label">Owner name</span>
@@ -28,7 +28,7 @@
 
 <span class="input-label">Site theme</span>
 <br/>
-<com:TDropDownList ID="ThemeList" />
+<com:TDropDownList ID="ThemeName" />
 <br/>
 
 </com:TPanel>
@@ -36,7 +36,7 @@
 
 <com:TPanel GroupingText="Account settings">
 
-<com:TCheckBox ID="MultipleUser" Text="Allow multiple users" />
+<com:TCheckBox ID="MultipleUser" Text="Allow creating new accounts" />
 <br/>
 
 <com:TCheckBox ID="AccountApproval" Text="New accounts need approval" />
@@ -46,11 +46,26 @@
 
 <com:TPanel GroupingText="Post settings">
 
+<span class="input-label">Number of posts per page</span>
+<com:TTextBox ID="PostPerPage" Columns="8"/>
+<com:TRegularExpressionValidator
+	ControlToValidate="PostPerPage"
+	ValidationGroup="settings"
+	Display="Dynamic"
+	RegularExpression="[1-9]\d*"
+	Text="Please enter a number." />
+<br/>
+
 <com:TCheckBox ID="PostApproval" Text="New posts need approval" />
 <br/>
 
 </com:TPanel>
-
-<com:TLinkButton Text="Save" OnClick="saveButtonClicked" />
+<br/>
+<com:TLinkButton
+	Text="Save"
+	ValidationGroup="settings"
+	CssClass="link-button"
+	OnClick="saveButtonClicked" />
+<com:TLabel ID="Result" Visible=<%= $this->IsPostBack && $this->IsValid %> Text="Your changes have been saved." />
 
 </com:TContent>
\ No newline at end of file
diff --git a/demos/blog/protected/Pages/Admin/ConfigMan.php b/demos/blog/protected/Pages/Admin/ConfigMan.php
index dcbe1537..6443e5a0 100644
--- a/demos/blog/protected/Pages/Admin/ConfigMan.php
+++ b/demos/blog/protected/Pages/Admin/ConfigMan.php
@@ -1,14 +1,74 @@
 <?php
+/**
+ * ConfigMan class file
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ * @version $Revision: $  $Date: $
+ */
 
+/**
+ * ConfigMan class
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ */
 class ConfigMan extends BlogPage
 {
+	const CONFIG_FILE='Application.Data.Settings';
+
 	public function onLoad($param)
 	{
 		parent::onLoad($param);
+		if(!$this->IsPostBack)
+		{
+			$parameters=$this->Application->Parameters;
+			$this->SiteTitle->Text=$parameters['SiteTitle'];
+			$this->SiteSubtitle->Text=$parameters['SiteSubtitle'];
+			$this->SiteOwner->Text=$parameters['SiteOwner'];
+			$this->AdminEmail->Text=$parameters['AdminEmail'];
+			$this->MultipleUser->Checked=TPropertyValue::ensureBoolean($parameters['MultipleUser']);
+			$this->AccountApproval->Checked=TPropertyValue::ensureBoolean($parameters['AccountApproval']);
+			$this->PostPerPage->Text=$parameters['PostPerPage'];
+			$this->PostApproval->Checked=TPropertyValue::ensureBoolean($parameters['PostApproval']);
+			$themes=$this->Service->ThemeManager->AvailableThemes;
+			$this->ThemeName->DataSource=$themes;
+			$this->ThemeName->dataBind();
+			$this->ThemeName->SelectedValue=array_search($parameters['ThemeName'],$themes);
+		}
 	}
 
 	public function saveButtonClicked($sender,$param)
 	{
+		$dom=new TXmlDocument;
+		$dom->Encoding='utf-8';
+		$dom->TagName='parameters';
+		$elements=$dom->Elements;
+		$elements[]=$this->createParameter('SiteTitle',$this->SiteTitle->Text);
+		$elements[]=$this->createParameter('SiteSubtitle',$this->SiteSubtitle->Text);
+		$elements[]=$this->createParameter('SiteOwner',$this->SiteOwner->Text);
+		$elements[]=$this->createParameter('AdminEmail',$this->AdminEmail->Text);
+		$elements[]=$this->createParameter('MultipleUser',$this->MultipleUser->Checked);
+		$elements[]=$this->createParameter('AccountApproval',$this->AccountApproval->Checked);
+		$elements[]=$this->createParameter('PostPerPage',$this->PostPerPage->Text);
+		$elements[]=$this->createParameter('PostApproval',$this->PostApproval->Checked);
+		$themeName=$this->ThemeName->SelectedItem->Text;
+		$elements[]=$this->createParameter('ThemeName',$themeName);
+		$dom->saveToFile(Prado::getPathOfNamespace(self::CONFIG_FILE,'.xml'));
+		if($themeName!==$this->Theme->Name)
+			$this->Response->reload();
+	}
+
+	private function createParameter($id,$value)
+	{
+		$element=new TXmlElement('parameter');
+		$element->Attributes['id']=$id;
+		$element->Attributes['value']=TPropertyValue::ensureString($value);
+		return $element;
 	}
 }
 
diff --git a/demos/blog/protected/Pages/Admin/PostMan.php b/demos/blog/protected/Pages/Admin/PostMan.php
index a99332eb..349278fc 100644
--- a/demos/blog/protected/Pages/Admin/PostMan.php
+++ b/demos/blog/protected/Pages/Admin/PostMan.php
@@ -1,13 +1,30 @@
 <?php
+/**
+ * PostMan class file
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ * @version $Revision: $  $Date: $
+ */
 
+/**
+ * PostMan class
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ */
 class PostMan extends BlogPage
 {
 	protected function bindData()
 	{
 		$offset=$this->PostGrid->CurrentPageIndex*$this->PostGrid->PageSize;
 		$limit=$this->PostGrid->PageSize;
-		$this->PostGrid->DataSource=$this->DataAccess->queryPosts('','','','ORDER BY a.status DESC, create_time DESC',"LIMIT $offset,$limit");
-		$this->PostGrid->VirtualItemCount=$this->DataAccess->queryPostCount('','','');
+		$this->PostGrid->DataSource=$this->DataAccess->queryPosts('','','ORDER BY a.status DESC, create_time DESC',"LIMIT $offset,$limit");
+		$this->PostGrid->VirtualItemCount=$this->DataAccess->queryPostCount('','');
 		$this->PostGrid->dataBind();
 	}
 
diff --git a/demos/blog/protected/Pages/Admin/Settings.page b/demos/blog/protected/Pages/Admin/Settings.page
deleted file mode 100644
index 48dfde96..00000000
--- a/demos/blog/protected/Pages/Admin/Settings.page
+++ /dev/null
@@ -1,4 +0,0 @@
-<com:TContent ID="main" >
-Welcome, <com:TLabel Text=<%= $this->User->Name %> />!
-This page contains site settings accessible only to site admin.
-</com:TContent>
\ No newline at end of file
diff --git a/demos/blog/protected/Pages/Admin/UserMan.php b/demos/blog/protected/Pages/Admin/UserMan.php
index 1cb62482..b13703a1 100644
--- a/demos/blog/protected/Pages/Admin/UserMan.php
+++ b/demos/blog/protected/Pages/Admin/UserMan.php
@@ -1,5 +1,22 @@
 <?php
+/**
+ * UserMan class file
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ * @version $Revision: $  $Date: $
+ */
 
+/**
+ * UserMan class
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ */
 class UserMan extends BlogPage
 {
 	protected function bindData()
diff --git a/demos/blog/protected/Pages/ErrorReport.page b/demos/blog/protected/Pages/ErrorReport.page
index a9b461d9..3a068e3c 100644
--- a/demos/blog/protected/Pages/ErrorReport.page
+++ b/demos/blog/protected/Pages/ErrorReport.page
@@ -3,7 +3,7 @@
 <h2>Error</h2>
 
 <p>
-<%= $this->ErrorMessage %>
+<com:TLiteral ID="ErrorMessage" />
 </p>
 
 <p>
diff --git a/demos/blog/protected/Pages/ErrorReport.php b/demos/blog/protected/Pages/ErrorReport.php
index 3b24170f..58e15796 100644
--- a/demos/blog/protected/Pages/ErrorReport.php
+++ b/demos/blog/protected/Pages/ErrorReport.php
@@ -1,11 +1,28 @@
 <?php
+/**
+ * ErrorReport class file
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ * @version $Revision: $  $Date: $
+ */
 
+/**
+ * ErrorReport class
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ */
 class ErrorReport extends BlogPage
 {
-	public function getErrorMessage()
+	public function onLoad($param)
 	{
-		$id=TPropertyValue::ensureInteger($this->Request['id']);
-		return BlogErrors::getMessage($id);
+		parent::onLoad($param);
+		$this->ErrorMessage->Text=$this->Application->SecurityManager->validateData(urldecode($this->Request['msg']));
 	}
 }
 
diff --git a/demos/blog/protected/Pages/Posts/EditCategory.page b/demos/blog/protected/Pages/Posts/EditCategory.page
index fdde2648..1f61c0af 100644
--- a/demos/blog/protected/Pages/Posts/EditCategory.page
+++ b/demos/blog/protected/Pages/Posts/EditCategory.page
@@ -1,3 +1,5 @@
+<%@ Title="Edit Category" %>
+
 <com:TContent ID="Main">
 
 <h2>Update Post Category</h2>
@@ -14,7 +16,7 @@
 	Display="Dynamic"
 	OnServerValidate="checkCategoryName"
 	Text="...must be unique"
-	ControlCssClass="inputerror" />
+	ControlCssClass="input-error1" />
 <br/>
 <com:TTextBox ID="CategoryName" Columns="50" MaxLength="128" />
 <br/>
@@ -27,10 +29,11 @@
 	Columns="50"
 	Rows="5" />
 <br/>
-
+<br/>
 <com:TLinkButton
 	Text="Save"
 	OnClick="saveButtonClicked"
+	CssClass="link-button"
 	ValidationGroup="category" />
 
 </com:TContent>
\ No newline at end of file
diff --git a/demos/blog/protected/Pages/Posts/EditCategory.php b/demos/blog/protected/Pages/Posts/EditCategory.php
index fd2d0707..920d2d80 100644
--- a/demos/blog/protected/Pages/Posts/EditCategory.php
+++ b/demos/blog/protected/Pages/Posts/EditCategory.php
@@ -1,14 +1,33 @@
 <?php
+/**
+ * EditCategory class file
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ * @version $Revision: $  $Date: $
+ */
 
+/**
+ * EditCategory class
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ */
 class EditCategory extends BlogPage
 {
-	public function getCurrentCategory()
+	private $_category;
+
+	public function onInit($param)
 	{
+		parent::onInit($param);
 		$id=TPropertyValue::ensureInteger($this->Request['id']);
-		if(($cat=$this->DataAccess->queryCategoryByID($id))!==null)
-			return $cat;
-		else
-			throw new BlogException('xxx');
+		$this->_category=$this->DataAccess->queryCategoryByID($id);
+		if($this->_category===null)
+			throw new BlogException(500,'category_id_invalid',$id);
 	}
 
 	public function onLoad($param)
@@ -16,9 +35,8 @@ class EditCategory extends BlogPage
 		parent::onLoad($param);
 		if(!$this->IsPostBack)
 		{
-			$catRecord=$this->getCurrentCategory();
-			$this->CategoryName->Text=$catRecord->Name;
-			$this->CategoryDescription->Text=$catRecord->Description;
+			$this->CategoryName->Text=$this->_category->Name;
+			$this->CategoryDescription->Text=$this->_category->Description;
 		}
 	}
 
@@ -26,11 +44,10 @@ class EditCategory extends BlogPage
 	{
 		if($this->IsValid)
 		{
-			$categoryRecord=$this->getCurrentCategory();
-			$categoryRecord->Name=$this->CategoryName->Text;
-			$categoryRecord->Description=$this->CategoryDescription->Text;
-			$this->DataAccess->updateCategory($categoryRecord);
-			$this->gotoPage('Posts.ListPost',array('cat'=>$categoryRecord->ID));
+			$this->_category->Name=$this->CategoryName->Text;
+			$this->_category->Description=$this->CategoryDescription->Text;
+			$this->DataAccess->updateCategory($this->_category);
+			$this->gotoPage('Posts.ListPost',array('cat'=>$this->_category->ID));
 		}
 	}
 
diff --git a/demos/blog/protected/Pages/Posts/EditPost.page b/demos/blog/protected/Pages/Posts/EditPost.page
index 591f5945..97702848 100644
--- a/demos/blog/protected/Pages/Posts/EditPost.page
+++ b/demos/blog/protected/Pages/Posts/EditPost.page
@@ -1,28 +1,31 @@
+<%@ Title="Edit Post" %>
+
 <com:TContent ID="Main">
 
 <h2>Update Post</h2>
 
-Title
+<span class="input-label">Title</span>
 <com:TRequiredFieldValidator
 Display="Dynamic"
 	ControlToValidate="Title"
 	ErrorMessage="...is required"
 	ValidationGroup="post" />
 <br/>
-<com:TTextBox ID="Title" Columns="70" MaxLength="256" />
+<com:TTextBox ID="Title" Columns="80" MaxLength="256" />
 <br/>
 
-Content
+<span class="input-label">Content</span>
 <com:TRequiredFieldValidator
 Display="Dynamic"
 	ControlToValidate="Content"
 	ErrorMessage="...is required"
 	ValidationGroup="post" />
 <br/>
-<com:THtmlArea ID="Content" Width="450px" />
+<com:THtmlArea ID="Content" Width="500px" />
 <br/>
 
-Categories<br/>
+<span class="input-label">Categories</span>
+<br/>
 <com:TListBox
 	ID="Categories"
 	SelectionMode="Multiple"
@@ -32,10 +35,12 @@ Categories<br/>
 
 <com:TCheckBox ID="DraftMode" Text="in draft mode (the post will not be published)" />
 <br/>
+<br/>
 
 <com:TLinkButton
 	Text="Save"
 	OnClick="saveButtonClicked"
+	CssClass="link-button"
 	ValidationGroup="post" />
 
 </com:TContent>
\ No newline at end of file
diff --git a/demos/blog/protected/Pages/Posts/EditPost.php b/demos/blog/protected/Pages/Posts/EditPost.php
index 57e92b1c..24b58529 100644
--- a/demos/blog/protected/Pages/Posts/EditPost.php
+++ b/demos/blog/protected/Pages/Posts/EditPost.php
@@ -1,14 +1,36 @@
 <?php
+/**
+ * EditPost class file
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ * @version $Revision: $  $Date: $
+ */
 
+/**
+ * EditPost class
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ */
 class EditPost extends BlogPage
 {
-	public function getCurrentPost()
+	private $_postRecord=null;
+
+	public function onInit($param)
 	{
+		parent::onInit($param);
 		$id=TPropertyValue::ensureInteger($this->Request['id']);
-		if(($post=$this->DataAccess->queryPostByID($id))!==null)
-			return $post;
-		else
-			throw new BlogException('xxx');
+		$this->_postRecord=$this->DataAccess->queryPostByID($id);
+		if($this->_postRecord===null)
+			throw new BlogException(500,'post_id_invalid',$id);
+		// only the author and admin can edit the post
+		if(!$this->User->IsAdmin && $this->User->ID!==$this->_postRecord->AuthorID)
+			throw new BlogException(500,'post_edit_disallowed',$id);
 	}
 
 	public function onLoad($param)
@@ -16,10 +38,10 @@ class EditPost extends BlogPage
 		parent::onLoad($param);
 		if(!$this->IsPostBack)
 		{
-			$postRecord=$this->getCurrentPost();
+			$postRecord=$this->_postRecord;
 			$this->Title->Text=$postRecord->Title;
 			$this->Content->Text=$postRecord->Content;
-			$this->DraftMode->Checked=$postRecord->Status===0;
+			$this->DraftMode->Checked=$postRecord->Status!==PostRecord::STATUS_PUBLISHED;
 			$this->Categories->DataSource=$this->DataAccess->queryCategories();
 			$this->Categories->dataBind();
 			$cats=$this->DataAccess->queryCategoriesByPostID($postRecord->ID);
@@ -34,10 +56,15 @@ class EditPost extends BlogPage
 	{
 		if($this->IsValid)
 		{
-			$postRecord=$this->getCurrentPost();
-			$postRecord->Title=$this->Title->Text;
-			$postRecord->Content=$this->Content->Text;
-			$postRecord->Status=$this->DraftMode->Checked?0:1;
+			$postRecord=$this->_postRecord;
+			$postRecord->Title=$this->Title->SafeText;
+			$postRecord->Content=$this->Content->SafeText;
+			if($this->DraftMode->Checked)
+				$postRecord->Status=PostRecord::STATUS_DRAFT;
+			else if(!$this->User->IsAdmin && TPropertyValue::ensureBoolean($this->Application->Parameters['PostApproval']))
+				$postRecord->Status=PostRecord::STATUS_PENDING;
+			else
+				$postRecord->Status=PostRecord::STATUS_PUBLISHED;
 			$postRecord->ModifyTime=time();
 			$cats=array();
 			foreach($this->Categories->SelectedValues as $value)
diff --git a/demos/blog/protected/Pages/Posts/ListPost.page b/demos/blog/protected/Pages/Posts/ListPost.page
index 15fc3d0c..4c96d6fb 100644
--- a/demos/blog/protected/Pages/Posts/ListPost.page
+++ b/demos/blog/protected/Pages/Posts/ListPost.page
@@ -1,5 +1,20 @@
 <com:TContent ID="Main">
 
+<com:TPanel ID="CategoryPanel" Visible="false" CssClass="category">
+<div class="category-name">
+<%= $this->Category->Name %>
+<com:TLinkButton
+	Text="[-]"
+	Tooltip="Delete this category"
+	Visible=<%= $this->User->IsAdmin %>
+	Attributes.onclick="if(!confirm('Are you sure to delete this category? Posts in this category will NOT be removed.')) return false;"
+	OnClick="deleteButtonClicked" />
+</div>
+<div class="category-description">
+<%= $this->Category->Description %>
+</div>
+</com:TPanel>
+
 <com:TRepeater ID="PostList" EnableViewState="false">
 	<prop:ItemTemplate>
 <div class="post">
@@ -24,4 +39,17 @@ posted by
 	</prop:ItemTemplate>
 </com:TRepeater>
 
+<div class="postlist-pager">
+<com:THyperLink
+	ID="PrevPage"
+	Visible="false"
+	Text="&lt; Previous Page"
+	/>
+<com:THyperLink
+	ID="NextPage"
+	Visible="false"
+	Text="Next Page &gt;"
+	/>
+</div>
+
 </com:TContent>
\ No newline at end of file
diff --git a/demos/blog/protected/Pages/Posts/ListPost.php b/demos/blog/protected/Pages/Posts/ListPost.php
index 6d56b543..bed18222 100644
--- a/demos/blog/protected/Pages/Posts/ListPost.php
+++ b/demos/blog/protected/Pages/Posts/ListPost.php
@@ -1,13 +1,59 @@
 <?php
+/**
+ * ListPost class file
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ * @version $Revision: $  $Date: $
+ */
 
+/**
+ * ListPost class
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ */
 class ListPost extends BlogPage
 {
-	const DEFAULT_LIMIT=10;
+	private $_posts;
+	private $_category;
 
-	public function getPosts()
+	public function onInit($param)
+	{
+		parent::onInit($param);
+		$this->_posts=$this->DataAccess->queryPosts(
+				$this->getPostFilter(),
+				$this->getCategoryFilter(),
+				'ORDER BY create_time DESC',
+				'LIMIT '.$this->getPageOffset().','.$this->getPageSize());
+		if($this->Request['cat']!==null)
+		{
+			$catID=TPropertyValue::ensureInteger($this->Request['cat']);
+			$this->_category=$this->DataAccess->queryCategoryByID($catID);
+			$this->CategoryPanel->Visible=true;
+		}
+	}
+
+	private function getPageOffset()
+	{
+		if(($offset=TPropertyValue::ensureInteger($this->Request['offset']))<=0)
+			$offset=0;
+		return $offset;
+	}
+
+	private function getPageSize()
+	{
+		if(($limit=TPropertyValue::ensureInteger($this->Request['limit']))<=0)
+			$limit=TPropertyValue::ensureInteger($this->Application->Parameters['PostPerPage']);
+		return $limit;
+	}
+
+	private function getTimeFilter()
 	{
-		$timeFilter='';
-		$catFilter='';
 		if(($time=TPropertyValue::ensureInteger($this->Request['time']))>0)
 		{
 			$year=(integer)($time/100);
@@ -19,25 +65,76 @@ class ListPost extends BlogPage
 				$year++;
 			}
 			$endTime=mktime(0,0,0,$month,1,$year);
-			$timeFilter="create_time>=$startTime AND create_time<$endTime";
+			return "create_time>=$startTime AND create_time<$endTime";
 		}
+		else
+			return '';
+	}
+
+	private function getPostFilter()
+	{
+		$filter='a.status=0';
+		if(($timeFilter=$this->getTimeFilter())!=='')
+			return "$filter AND $timeFilter";
+		else
+			return $filter;
+	}
+
+	private function getCategoryFilter()
+	{
 		if(($catID=$this->Request['cat'])!==null)
 		{
 			$catID=TPropertyValue::ensureInteger($catID);
-			$catFilter="category_id=$catID";
+			return "category_id=$catID";
 		}
-		if(($offset=TPropertyValue::ensureInteger($this->Request['offset']))<=0)
-			$offset=0;
-		if(($limit=TPropertyValue::ensureInteger($this->Request['limit']))<=0)
-			$limit=self::DEFAULT_LIMIT;
-		return $this->DataAccess->queryPosts('',$timeFilter,$catFilter,'ORDER BY create_time DESC',"LIMIT $offset,$limit");
+		else
+			return '';
+	}
+
+	private function formUrl($newOffset)
+	{
+		$gets=array();
+		$gets['offset']=$newOffset;
+		if($this->Request['limit']!==null)
+			$gets['limit']=$this->Request['limit'];
+		if($this->Request['time']!==null)
+			$gets['time']=$this->Request['time'];
+		if($this->Request['cat']!==null)
+			$gets['cat']=$this->Request['cat'];
+		return $this->Service->constructUrl('Posts.ListPost',$gets);
+	}
+
+	public function getCategory()
+	{
+		return $this->_category;
 	}
 
 	public function onLoad($param)
 	{
 		parent::onLoad($param);
-		$this->PostList->DataSource=$this->getPosts();
+		$this->PostList->DataSource=$this->_posts;
 		$this->PostList->dataBind();
+		if($this->getPageOffset()>0)
+		{
+			if(($offset=$this->getPageOffset()-$this->getPageSize())<0)
+				$offset=0;
+			$this->PrevPage->NavigateUrl=$this->formUrl($offset);
+			$this->PrevPage->Visible=true;
+		}
+		if(count($this->_posts)===$this->getPageSize())
+		{
+			$this->NextPage->NavigateUrl=$this->formUrl($this->getPageOffset()+$this->getPageSize());
+			$this->NextPage->Visible=true;
+		}
+	}
+
+	public function deleteButtonClicked($sender,$param)
+	{
+		if($this->User->IsAdmin)
+		{
+			$this->DataAccess->deleteCategory($this->Category->ID);
+			$this->gotoDefaultPage();
+		}
 	}
 }
 
diff --git a/demos/blog/protected/Pages/Posts/MyPost.page b/demos/blog/protected/Pages/Posts/MyPost.page
index 95a32ac9..ca153166 100644
--- a/demos/blog/protected/Pages/Posts/MyPost.page
+++ b/demos/blog/protected/Pages/Posts/MyPost.page
@@ -25,7 +25,7 @@
 	<com:TBoundColumn
 		HeaderText="Status"
 		DataField="Status"
-		DataFormatString="#{0}?'Published':'Draft'"
+		DataFormatString="#{0}===0?'Published':({0}===1?'Draft':'Pending')"
 		ItemStyle.Width="70px"
 		/>
 	<com:TBoundColumn
diff --git a/demos/blog/protected/Pages/Posts/MyPost.php b/demos/blog/protected/Pages/Posts/MyPost.php
index be03ca63..dff98426 100644
--- a/demos/blog/protected/Pages/Posts/MyPost.php
+++ b/demos/blog/protected/Pages/Posts/MyPost.php
@@ -1,5 +1,22 @@
 <?php
+/**
+ * MyPost class file
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ * @version $Revision: $  $Date: $
+ */
 
+/**
+ * MyPost class
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ */
 class MyPost extends BlogPage
 {
 	protected function bindData()
@@ -7,8 +24,8 @@ class MyPost extends BlogPage
 		$author=$this->User->ID;
 		$offset=$this->PostGrid->CurrentPageIndex*$this->PostGrid->PageSize;
 		$limit=$this->PostGrid->PageSize;
-		$this->PostGrid->DataSource=$this->DataAccess->queryPosts("author_id=$author",'','','ORDER BY a.status ASC, create_time DESC',"LIMIT $offset,$limit");
-		$this->PostGrid->VirtualItemCount=$this->DataAccess->queryPostCount("author_id=$author",'','');
+		$this->PostGrid->DataSource=$this->DataAccess->queryPosts("author_id=$author",'','ORDER BY a.status DESC, create_time DESC',"LIMIT $offset,$limit");
+		$this->PostGrid->VirtualItemCount=$this->DataAccess->queryPostCount("author_id=$author",'');
 		$this->PostGrid->dataBind();
 	}
 
diff --git a/demos/blog/protected/Pages/Posts/NewCategory.page b/demos/blog/protected/Pages/Posts/NewCategory.page
index 92fe1468..43dba79b 100644
--- a/demos/blog/protected/Pages/Posts/NewCategory.page
+++ b/demos/blog/protected/Pages/Posts/NewCategory.page
@@ -1,3 +1,5 @@
+<%@ Title="Create New Category" %>
+
 <com:TContent ID="Main">
 
 <h2>New Post Category</h2>
@@ -14,7 +16,7 @@
 	Display="Dynamic"
 	OnServerValidate="checkCategoryName"
 	Text="...must be unique"
-	ControlCssClass="inputerror" />
+	ControlCssClass="input-error1" />
 <br/>
 <com:TTextBox ID="CategoryName" Columns="50" MaxLength="128" />
 <br/>
@@ -27,10 +29,11 @@
 	Columns="50"
 	Rows="5" />
 <br/>
-
+<br/>
 <com:TLinkButton
 	Text="Save"
 	OnClick="saveButtonClicked"
+	CssClass="link-button"
 	ValidationGroup="category" />
 
 </com:TContent>
\ No newline at end of file
diff --git a/demos/blog/protected/Pages/Posts/NewCategory.php b/demos/blog/protected/Pages/Posts/NewCategory.php
index d36f6af1..215200a9 100644
--- a/demos/blog/protected/Pages/Posts/NewCategory.php
+++ b/demos/blog/protected/Pages/Posts/NewCategory.php
@@ -1,5 +1,22 @@
 <?php
+/**
+ * NewCategory class file
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ * @version $Revision: $  $Date: $
+ */
 
+/**
+ * NewCategory class
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ */
 class NewCategory extends BlogPage
 {
 	public function saveButtonClicked($sender,$param)
diff --git a/demos/blog/protected/Pages/Posts/NewPost.page b/demos/blog/protected/Pages/Posts/NewPost.page
index a49188f6..15071e3a 100644
--- a/demos/blog/protected/Pages/Posts/NewPost.page
+++ b/demos/blog/protected/Pages/Posts/NewPost.page
@@ -1,28 +1,31 @@
+<%@ Title="Write New Post" %>
+
 <com:TContent ID="Main">
 
-<h2>Write a New Post</h2>
+<h2>Write New Post</h2>
 
-Title
+<span class="input-label">Title</span>
 <com:TRequiredFieldValidator
 Display="Dynamic"
 	ControlToValidate="Title"
 	ErrorMessage="...is required"
 	ValidationGroup="post" />
 <br/>
-<com:TTextBox ID="Title" Columns="70" MaxLength="256" />
+<com:TTextBox ID="Title" Columns="80" MaxLength="256" />
 <br/>
 
-Content
+<span class="input-label">Content</span>
 <com:TRequiredFieldValidator
 Display="Dynamic"
 	ControlToValidate="Content"
 	ErrorMessage="...is required"
 	ValidationGroup="post" />
 <br/>
-<com:THtmlArea ID="Content" Width="450px" />
+<com:THtmlArea ID="Content" Width="500px" />
 <br/>
 
-Categories<br/>
+<span class="input-label">Categories</span>
+<br/>
 <com:TListBox
 	ID="Categories"
 	SelectionMode="Multiple"
@@ -32,10 +35,11 @@ Categories<br/>
 
 <com:TCheckBox ID="DraftMode" Text="in draft mode (the post will not be published)" />
 <br/>
-
+<br/>
 <com:TLinkButton
 	Text="Save"
 	OnClick="saveButtonClicked"
+	CssClass="link-button"
 	ValidationGroup="post" />
 
 </com:TContent>
\ No newline at end of file
diff --git a/demos/blog/protected/Pages/Posts/NewPost.php b/demos/blog/protected/Pages/Posts/NewPost.php
index 055c7f92..7d02557d 100644
--- a/demos/blog/protected/Pages/Posts/NewPost.php
+++ b/demos/blog/protected/Pages/Posts/NewPost.php
@@ -1,5 +1,22 @@
 <?php
+/**
+ * NewPost class file
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ * @version $Revision: $  $Date: $
+ */
 
+/**
+ * NewPost class
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ */
 class NewPost extends BlogPage
 {
 	public function onLoad($param)
@@ -17,9 +34,14 @@ class NewPost extends BlogPage
 		if($this->IsValid)
 		{
 			$postRecord=new PostRecord;
-			$postRecord->Title=$this->Title->Text;
-			$postRecord->Content=$this->Content->Text;
-			$postRecord->Status=$this->DraftMode->Checked?0:1;
+			$postRecord->Title=$this->Title->SafeText;
+			$postRecord->Content=$this->Content->SafeText;
+			if($this->DraftMode->Checked)
+				$postRecord->Status=PostRecord::STATUS_DRAFT;
+			else if(!$this->User->IsAdmin && TPropertyValue::ensureBoolean($this->Application->Parameters['PostApproval']))
+				$postRecord->Status=PostRecord::STATUS_PENDING;
+			else
+				$postRecord->Status=PostRecord::STATUS_PUBLISHED;
 			$postRecord->CreateTime=time();
 			$postRecord->AuthorID=$this->User->ID;
 			$cats=array();
diff --git a/demos/blog/protected/Pages/Posts/ViewPost.page b/demos/blog/protected/Pages/Posts/ViewPost.page
index 4b233615..5bd80a52 100644
--- a/demos/blog/protected/Pages/Posts/ViewPost.page
+++ b/demos/blog/protected/Pages/Posts/ViewPost.page
@@ -5,6 +5,10 @@
 <%= $this->CurrentPost->Title %>
 </div>
 <div class="post-time">
+<com:TLabel
+	ID="Status"
+	ForeColor="red"
+	Text=<%= $this->CurrentPost->Status===PostRecord::STATUS_DRAFT?'[Draft]':'[Pending approval]'%> />
 <%= date('l, F j, Y \a\t h:i:s a',$this->CurrentPost->CreateTime) %>
 by
 <%= '<a href="' . $this->Service->constructUrl('Users.ViewUser',array('id'=>$this->CurrentPost->AuthorID)) . '">' . $this->CurrentPost->AuthorName . '</a>' %>
@@ -47,11 +51,11 @@ by
 <%# date('F j, Y \a\t h:i:s a',$this->DataItem->CreateTime) %>
 by
 <%# $this->DataItem->AuthorWebsite==='' ?
-		$this->DataItem->AuthorName :
-		'<a href="' . $this->DataItem->AuthorWebsite . '">' . $this->DataItem->AuthorName . '</a>' %>
+		htmlentities($this->DataItem->AuthorName,ENT_QUOTES,'UTF-8') :
+		'<a href="' . htmlentities($this->DataItem->AuthorWebsite) . '">' . htmlentities($this->DataItem->AuthorName,ENT_QUOTES,'UTF-8') . '</a>' %>
 </div>
 <div class="comment-content">
-<%# $this->DataItem->Content %>
+<%# nl2br(htmlentities($this->DataItem->Content,ENT_QUOTES,'UTF-8')) %>
 </div>
 </div>
 	</prop:ItemTemplate>
@@ -65,7 +69,7 @@ by
 	ValidationGroup="comment""
 	Display="Dynamic"
 	Text="...is required"
-	ControlCssClass="inputerror" />
+	ControlCssClass="input-error1" />
 <br/>
 <com:TTextBox ID="CommentAuthor" />
 <br/>
@@ -76,14 +80,14 @@ by
 	ValidationGroup="comment""
 	Display="Dynamic"
 	Text="...is required"
-	ControlCssClass="inputerror" />
+	ControlCssClass="input-error1" />
 <com:TEmailAddressValidator
 	ControlToValidate="CommentEmail"
 	ValidationGroup="comment"
 	Display="Dynamic"
 	Text="*"
 	ErrorMessage="You entered an invalid email address."
-	ControlCssClass="inputerror" />
+	ControlCssClass="input-error2" />
 <br/>
 <com:TTextBox ID="CommentEmail" />
 <br/>
@@ -99,14 +103,16 @@ by
 	ValidationGroup="comment"
 	Display="Dynamic"
 	Text="...is required"
-	ControlCssClass="inputerror" />
+	ControlCssClass="input-error1" />
 <br/>
 <com:TTextBox ID="CommentContent" TextMode="MultiLine" Columns="55" Rows="10"/>
 <br/>
+<br/>
 
 <com:TLinkButton
 	Text="Submit"
 	ValidationGroup="comment"
+	CssClass="link-button"
 	OnClick="submitCommentButtonClicked" />
 
 </div>
diff --git a/demos/blog/protected/Pages/Posts/ViewPost.php b/demos/blog/protected/Pages/Posts/ViewPost.php
index 309bedc1..84f33cff 100644
--- a/demos/blog/protected/Pages/Posts/ViewPost.php
+++ b/demos/blog/protected/Pages/Posts/ViewPost.php
@@ -1,40 +1,57 @@
 <?php
+/**
+ * ViewPost class file
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ * @version $Revision: $  $Date: $
+ */
 
+/**
+ * ViewPost class
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ */
 class ViewPost extends BlogPage
 {
-	private $_postID=null;
 	private $_post=null;
 
-	public function getPostID()
-	{
-		if($this->_postID===null)
-			$this->_postID=TPropertyValue::ensureInteger($this->Request['id']);
-		return $this->_postID;
-	}
-
-	public function getCurrentPost()
+	public function onInit($param)
 	{
+		parent::onInit($param);
+		$id=TPropertyValue::ensureInteger($this->Request['id']);
+		$this->_post=$this->DataAccess->queryPostByID($id);
 		if($this->_post===null)
-		{
-			if(($this->_post=$this->DataAccess->queryPostByID($this->getPostID()))===null)
-				$this->reportError(BlogErrors::ERROR_POST_NOT_FOUND);
-		}
-		return $this->_post;
+			throw new BlogException(500,'post_id_invalid',$id);
+		// if post is not published, only the author and admin can view it
+		if($this->_post->Status!==PostRecord::STATUS_PUBLISHED && !$this->User->IsAdmin && $this->User->ID!==$this->_post->AuthorID)
+			throw new BlogException(500,'post_view_disallowed',$id);
+		$this->Title=htmlentities($this->_post->Title,ENT_QUOTES,'UTF-8');
 	}
 
 	public function getCanEditPost()
 	{
 		$user=$this->getUser();
-		$authorID=$this->getCurrentPost()->AuthorID;
-		return $authorID===$user->getID() || $user->isInRole('admin');
+		return $user->getIsAdmin() || $user->getID()===$this->_post->AuthorID;
+	}
+
+	public function getCurrentPost()
+	{
+		return $this->_post;
 	}
 
 	public function onLoad($param)
 	{
 		parent::onLoad($param);
-		$this->CategoryList->DataSource=$this->DataAccess->queryCategoriesByPostID($this->getPostID());
+		$this->Status->Visible=$this->_post->Status!==PostRecord::STATUS_PUBLISHED;
+		$this->CategoryList->DataSource=$this->DataAccess->queryCategoriesByPostID($this->_post->ID);
 		$this->CategoryList->dataBind();
-		$this->CommentList->DataSource=$this->DataAccess->queryCommentsByPostID($this->getPostID());
+		$this->CommentList->DataSource=$this->DataAccess->queryCommentsByPostID($this->_post->ID);
 		$this->CommentList->dataBind();
 	}
 
@@ -44,11 +61,11 @@ class ViewPost extends BlogPage
 		{
 			$commentRecord=new CommentRecord;
 			$commentRecord->PostID=$this->CurrentPost->ID;
-			$commentRecord->AuthorName=$this->CommentAuthor->Text;
+			$commentRecord->AuthorName=$this->CommentAuthor->SafeText;
 			$commentRecord->AuthorEmail=$this->CommentEmail->Text;
-			$commentRecord->AuthorWebsite=$this->CommentWebsite->Text;
+			$commentRecord->AuthorWebsite=$this->CommentWebsite->SafeText;
 			$commentRecord->AuthorIP=$this->Request->UserHostAddress;
-			$commentRecord->Content=$this->CommentContent->Text;
+			$commentRecord->Content=$this->CommentContent->SafeText;
 			$commentRecord->CreateTime=time();
 			$commentRecord->Status=0;
 			$this->DataAccess->insertComment($commentRecord);
diff --git a/demos/blog/protected/Pages/Posts/config.xml b/demos/blog/protected/Pages/Posts/config.xml
index 1c04e946..f3684e58 100644
--- a/demos/blog/protected/Pages/Posts/config.xml
+++ b/demos/blog/protected/Pages/Posts/config.xml
@@ -3,5 +3,7 @@
 <configuration>
   <authorization>
     <deny pages="EditPost,NewPost,MyPost" users="?" />
+    <allow pages="NewCategory,EditCategory" roles="admin" />
+    <deny pages="NewCategory,EditCategory" users="*" />
   </authorization>
 </configuration>
\ No newline at end of file
diff --git a/demos/blog/protected/Pages/SearchPost.page b/demos/blog/protected/Pages/SearchPost.page
new file mode 100644
index 00000000..e3a71d44
--- /dev/null
+++ b/demos/blog/protected/Pages/SearchPost.page
@@ -0,0 +1,44 @@
+<com:TContent ID="Main">
+
+<div class="search-title">
+Search results for <b><%= htmlentities($this->Request['keyword'],ENT_QUOTES,'UTF-8') %></b>:
+</div>
+
+<com:TRepeater ID="PostList" EnableViewState="false">
+	<prop:ItemTemplate>
+<div class="post">
+<div class="post-title">
+<%# $this->DataItem->Title %>
+</div>
+<div class="post-time">
+<%# date('l, F j, Y \a\t h:i:s a',$this->DataItem->CreateTime) %>
+</div>
+<div class="post-content">
+<%# $this->DataItem->Content %>
+</div>
+<div class="post-footer">
+posted by
+<%# '<a href="' . $this->Service->constructUrl('Users.ViewUser',array('id'=>$this->DataItem->AuthorID)) . '">' . $this->DataItem->AuthorName . '</a>' %>
+|
+<%# '<a href="' . $this->Service->constructUrl('Posts.ViewPost',array('id'=>$this->DataItem->ID)) . '">PermaLink</a>' %>
+|
+<%# '<a href="' . $this->Service->constructUrl('Posts.ViewPost',array('id'=>$this->DataItem->ID)) . '#comments">Comments (' . $this->DataItem->CommentCount . ')</a>' %>
+</div>
+</div>
+	</prop:ItemTemplate>
+</com:TRepeater>
+
+<div class="postlist-pager">
+<com:THyperLink
+	ID="PrevPage"
+	Visible="false"
+	Text="&lt; Previous Page"
+	/>
+<com:THyperLink
+	ID="NextPage"
+	Visible="false"
+	Text="Next Page &gt;"
+	/>
+</div>
+
+</com:TContent>
\ No newline at end of file
diff --git a/demos/blog/protected/Pages/SearchPost.php b/demos/blog/protected/Pages/SearchPost.php
new file mode 100644
index 00000000..53e8401c
--- /dev/null
+++ b/demos/blog/protected/Pages/SearchPost.php
@@ -0,0 +1,76 @@
+<?php
+
+class SearchPost extends BlogPage
+{
+	private $_posts;
+
+	public function onInit($param)
+	{
+		parent::onInit($param);
+		$this->_posts=$this->DataAccess->queryPosts(
+				$this->getPostFilter(),
+				'',
+				'ORDER BY create_time DESC',
+				'LIMIT '.$this->getPageOffset().','.$this->getPageSize());
+	}
+
+	private function getPostFilter()
+	{
+		$filter='a.status=0';
+		$keywords=explode(' ',$this->Request['keyword']);
+		foreach($keywords as $keyword)
+		{
+			if(($keyword=$this->DataAccess->escapeString(trim($keyword)))!=='')
+				$filter.=" AND content LIKE '%$keyword%'";
+		}
+		return $filter;
+	}
+
+	private function getPageOffset()
+	{
+		if(($offset=TPropertyValue::ensureInteger($this->Request['offset']))<=0)
+			$offset=0;
+		return $offset;
+	}
+
+	private function getPageSize()
+	{
+		if(($limit=TPropertyValue::ensureInteger($this->Request['limit']))<=0)
+			$limit=TPropertyValue::ensureInteger($this->Application->Parameters['PostPerPage']);
+		return $limit;
+	}
+
+	private function formUrl($newOffset)
+	{
+		$gets=array();
+		$gets['offset']=$newOffset;
+		if($this->Request['limit']!==null)
+			$gets['limit']=$this->Request['limit'];
+		if($this->Request['time']!==null)
+			$gets['time']=$this->Request['time'];
+		if($this->Request['cat']!==null)
+			$gets['cat']=$this->Request['cat'];
+		return $this->Service->constructUrl('Posts.ListPost',$gets);
+	}
+
+	public function onLoad($param)
+	{
+		parent::onLoad($param);
+		$this->PostList->DataSource=$this->_posts;
+		$this->PostList->dataBind();
+		if($this->getPageOffset()>0)
+		{
+			if(($offset=$this->getPageOffset()-$this->getPageSize())<0)
+				$offset=0;
+			$this->PrevPage->NavigateUrl=$this->formUrl($offset);
+			$this->PrevPage->Visible=true;
+		}
+		if(count($this->_posts)===$this->getPageSize())
+		{
+			$this->NextPage->NavigateUrl=$this->formUrl($this->getPageOffset()+$this->getPageSize());
+			$this->NextPage->Visible=true;
+		}
+	}
+}
+
+?>
\ No newline at end of file
diff --git a/demos/blog/protected/Pages/Users/EditUser.page b/demos/blog/protected/Pages/Users/EditUser.page
index 8c21fd50..0155dc26 100644
--- a/demos/blog/protected/Pages/Users/EditUser.page
+++ b/demos/blog/protected/Pages/Users/EditUser.page
@@ -1,14 +1,12 @@
-<com:TContent ID="Main">
-
-<h2>Update Profile</h2>
+<%@ Title="Edit Profile" %>
 
-<com:TValidationSummary Display="Dynamic" ValidationGroup="user" />
+<com:TContent ID="Main">
 
-<span class="input-label">Username</span>
-<br/>
-<com:TLabel ID="Username" />
+<h2>Update Profile: <com:TLabel ID="Username" /></h2>
 
-<br/>
+<com:TValidationSummary
+	Display="Dynamic"
+	ValidationGroup="user" />
 
 <span class="input-label">Full name</span>
 <br/>
@@ -26,7 +24,7 @@
 	RegularExpression="[\w\.]{6,16}"
 	Text="*"
 	ErrorMessage="Your password must contain only letters, digits and underscores, and it must contain at least 6 and at most 16 characters."
-	ControlCssClass="inputerror" />
+	ControlCssClass="input-error1" />
 
 <br/>
 
@@ -40,7 +38,7 @@
 	Display="Dynamic"
 	Text="*"
 	ErrorMessage="Your password entries did not match."
-	ControlCssClass="inputerror" />
+	ControlCssClass="input-error3" />
 
 <br/>
 
@@ -52,23 +50,28 @@
 	ValidationGroup="user"
 	Text="*"
 	ErrorMessage="Please provide your email address."
-	ControlCssClass="inputerror" />
+	ControlCssClass="input-error1" />
 <com:TEmailAddressValidator
 	ControlToValidate="Email"
 	ValidationGroup="user"
 	Display="Dynamic"
 	Text="*"
 	ErrorMessage="You entered an invalid email address."
-	ControlCssClass="inputerror" />
+	ControlCssClass="input-error2" />
 
 <br/>
 
 <span class="input-label">Personal Website</span>
 <br/>
-<com:TTextBox ID="Website" AutoTrim="true" />
+<com:TTextBox ID="Website" AutoTrim="true" Columns="40"/>
 
+<br/>
 <br/>
 
-<com:TLinkButton Text="Save" ValidationGroup="user" OnClick="saveButtonClicked" />
+<com:TLinkButton
+	Text="Save"
+	ValidationGroup="user"
+	CssClass="link-button"
+	OnClick="saveButtonClicked" />
 
 </com:TContent>
\ No newline at end of file
diff --git a/demos/blog/protected/Pages/Users/EditUser.php b/demos/blog/protected/Pages/Users/EditUser.php
index e3efcfd1..73eef8bb 100644
--- a/demos/blog/protected/Pages/Users/EditUser.php
+++ b/demos/blog/protected/Pages/Users/EditUser.php
@@ -1,13 +1,39 @@
 <?php
+/**
+ * EditUser class file
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ * @version $Revision: $  $Date: $
+ */
 
+/**
+ * EditUser class
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ */
 class EditUser extends BlogPage
 {
-	public function getCurrentUser()
+	private $_userRecord=null;
+
+	public function onInit($param)
 	{
-		if(($user=$this->DataAccess->queryUserByID($this->User->ID))!==null)
-			return $user;
+		parent::onInit($param);
+		if(($id=$this->Request['id'])!==null)
+		{
+			$id=TPropertyValue::ensureInteger($id);
+			if(!$this->User->IsAdmin && $this->User->ID!==$id)
+				throw new BlogException(500,'profile_edit_disallowed',$id);
+		}
 		else
-			throw new BlogException('xxx');
+			$id=$this->User->ID;
+		if(($this->_userRecord=$this->DataAccess->queryUserByID($id))===null)
+			throw new BlogException(500,'profile_id_invalid',$id);
 	}
 
 	public function onLoad($param)
@@ -15,7 +41,7 @@ class EditUser extends BlogPage
 		parent::onLoad($param);
 		if(!$this->IsPostBack)
 		{
-			$userRecord=$this->getCurrentUser();
+			$userRecord=$this->_userRecord;
 			$this->Username->Text=$userRecord->Name;
 			$this->FullName->Text=$userRecord->FullName;
 			$this->Email->Text=$userRecord->Email;
@@ -27,7 +53,7 @@ class EditUser extends BlogPage
 	{
 		if($this->IsValid)
 		{
-			$userRecord=$this->getCurrentUser();
+			$userRecord=$this->_userRecord;
 			if($this->Password->Text!=='')
 				$userRecord->Password=md5($this->Password->Text);
 			$userRecord->FullName=$this->FullName->Text;
diff --git a/demos/blog/protected/Pages/Users/NewUser.page b/demos/blog/protected/Pages/Users/NewUser.page
index eba2dcec..f096ffb1 100644
--- a/demos/blog/protected/Pages/Users/NewUser.page
+++ b/demos/blog/protected/Pages/Users/NewUser.page
@@ -1,35 +1,39 @@
+<%@ Title="Create New Account" %>
+
 <com:TContent ID="Main">
 
 <h2>Create New Account</h2>
 
-<com:TValidationSummary Display="Dynamic" ValidationGroup="NewUser" />
+<com:TValidationSummary
+	Display="Dynamic"
+	ValidationGroup="user" />
 
 <span class="input-label">Username</span>
 <br/>
 <com:TTextBox ID="Username" />
 <com:TRequiredFieldValidator
 	ControlToValidate="Username"
-	ValidationGroup="NewUser"
+	ValidationGroup="user"
 	Display="Dynamic"
 	Text="*"
 	ErrorMessage="Please choose a username."
-	ControlCssClass="inputerror" />
+	ControlCssClass="input-error1" />
 <com:TRegularExpressionValidator
 	ControlToValidate="Username"
-	ValidationGroup="NewUser"
+	ValidationGroup="user"
 	Display="Dynamic"
 	RegularExpression="[\w]{3,16}"
 	Text="*"
 	ErrorMessage="Your username must contain only letters, digits and underscores, and it must contain at least 3 and at most 16 characters."
-	ControlCssClass="inputerror" />
+	ControlCssClass="input-error2" />
 <com:TCustomValidator
 	ControlToValidate="Username"
-	ValidationGroup="NewUser"
+	ValidationGroup="user"
 	Display="Dynamic"
 	OnServerValidate="checkUsername"
 	Text="*"
 	ErrorMessage="Sorry, your username is taken by someone else. Please choose another username."
-	ControlCssClass="inputerror" />
+	ControlCssClass="input-error3" />
 
 <br/>
 
@@ -44,19 +48,19 @@
 <com:TTextBox ID="Password" TextMode="Password" />
 <com:TRequiredFieldValidator
 	ControlToValidate="Password"
-	ValidationGroup="NewUser"
+	ValidationGroup="user"
 	Display="Dynamic"
 	Text="*"
 	ErrorMessage="Please choose a password."
-	ControlCssClass="inputerror" />
+	ControlCssClass="input-error1" />
 <com:TRegularExpressionValidator
 	ControlToValidate="Password"
-	ValidationGroup="NewUser"
+	ValidationGroup="user"
 	Display="Dynamic"
 	RegularExpression="[\w\.]{6,16}"
 	Text="*"
 	ErrorMessage="Your password must contain only letters, digits and underscores, and it must contain at least 6 and at most 16 characters."
-	ControlCssClass="inputerror" />
+	ControlCssClass="input-error2" />
 
 <br/>
 
@@ -66,11 +70,11 @@
 <com:TCompareValidator
 	ControlToValidate="Password"
 	ControlToCompare="Password2"
-	ValidationGroup="NewUser"
+	ValidationGroup="user"
 	Display="Dynamic"
 	Text="*"
 	ErrorMessage="Your password entries did not match."
-	ControlCssClass="inputerror" />
+	ControlCssClass="input-error3" />
 
 <br/>
 
@@ -79,26 +83,31 @@
 <com:TTextBox ID="Email" />
 <com:TRequiredFieldValidator
 	ControlToValidate="Email"
-	ValidationGroup="NewUser"
+	ValidationGroup="user"
 	Text="*"
 	ErrorMessage="Please provide your email address."
-	ControlCssClass="inputerror" />
+	ControlCssClass="input-error1" />
 <com:TEmailAddressValidator
 	ControlToValidate="Email"
-	ValidationGroup="NewUser"
+	ValidationGroup="user"
 	Display="Dynamic"
 	Text="*"
 	ErrorMessage="You entered an invalid email address."
-	ControlCssClass="inputerror" />
+	ControlCssClass="input-error2" />
 
 <br/>
 
 <span class="input-label">Personal Website</span>
 <br/>
-<com:TTextBox ID="Website" AutoTrim="true" />
+<com:TTextBox ID="Website" AutoTrim="true" Columns="40"/>
 
+<br/>
 <br/>
 
-<com:TLinkButton Text="Register" ValidationGroup="NewUser" OnClick="createUser" />
+<com:TLinkButton
+	Text="Register"
+	ValidationGroup="user"
+	CssClass="link-button"
+	OnClick="createUser" />
 
 </com:TContent>
\ No newline at end of file
diff --git a/demos/blog/protected/Pages/Users/NewUser.php b/demos/blog/protected/Pages/Users/NewUser.php
index 166abf66..50a8100b 100644
--- a/demos/blog/protected/Pages/Users/NewUser.php
+++ b/demos/blog/protected/Pages/Users/NewUser.php
@@ -1,10 +1,33 @@
 <?php
+/**
+ * NewUser class file
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ * @version $Revision: $  $Date: $
+ */
 
+/**
+ * NewUser class
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ */
 class NewUser extends BlogPage
 {
+	public function onInit($param)
+	{
+		if(!$this->User->IsAdmin && !TPropertyValue::ensureBoolean($this->Application->Parameters['MultipleUser']))
+			throw new BlogException(500,'newuser_registration_disallowed');
+	}
+
 	public function checkUsername($sender,$param)
 	{
-		$username=$this->Username->Text;
+		$username=strtolower($this->Username->Text);
 		$param->IsValid=$this->DataAccess->queryUserByName($username)===null;
 	}
 
@@ -13,13 +36,17 @@ class NewUser extends BlogPage
 		if($this->IsValid)
 		{
 			$userRecord=new UserRecord;
-			$userRecord->Name=$this->Username->Text;
+			$userRecord->Name=strtolower($this->Username->Text);
 			$userRecord->FullName=$this->FullName->Text;
 			$userRecord->Role=0;
 			$userRecord->Password=md5($this->Password->Text);
 			$userRecord->Email=$this->Email->Text;
 			$userRecord->CreateTime=time();
 			$userRecord->Website=$this->Website->Text;
+			if(TPropertyValue::ensureBoolean($this->Application->Parameters['AccountApproval']))
+				$userRecord->Status=UserRecord::STATUS_PENDING;
+			else
+				$userRecord->Status=UserRecord::STATUS_NORMAL;
 			$this->DataAccess->insertUser($userRecord);
 			$authManager=$this->Application->getModule('auth');
 			$authManager->login($this->Username->Text,$this->Password->Text);
diff --git a/demos/blog/protected/Pages/Users/ViewUser.page b/demos/blog/protected/Pages/Users/ViewUser.page
index 2dba6b77..faae720b 100644
--- a/demos/blog/protected/Pages/Users/ViewUser.page
+++ b/demos/blog/protected/Pages/Users/ViewUser.page
@@ -1,21 +1,40 @@
+<%@ Title="View User Profile" %>
+
 <com:TContent ID="Main">
 
 <h2>User Profile</h2>
 
-Username: <%= $this->CurrentUser->Name %>
-<br/>
-
-Full name: <%= $this->CurrentUser->FullName %>
-<br/>
-
-Email: <%= $this->CurrentUser->Email %>
+<table class="profile-table">
+<tr>
+  <td class="profile-table-label">Username</td>
+  <td class="profile-table-value"><%= $this->Profile->Name %></td>
+</tr>
+<tr>
+  <td class="profile-table-label">Full name</td>
+  <td class="profile-table-value"><%= htmlentities($this->Profile->FullName,ENT_QUOTES,'UTF-8') %></td>
+</tr>
+<tr>
+  <td class="profile-table-label">Email</td>
+  <td class="profile-table-value"><%= $this->Profile->Email %></td>
+</tr>
+<tr>
+  <td class="profile-table-label">Role</td>
+  <td class="profile-table-value"><%= $this->Profile->Role===0? 'Normal user':'Administrator' %></td>
+</tr>
+<tr>
+  <td class="profile-table-label">Website</td>
+  <td class="profile-table-value"><%= htmlentities($this->Profile->Website,ENT_QUOTES,'UTF-8') %></td>
+</tr>
+<tr>
+  <td class="profile-table-label">Member since</td>
+  <td class="profile-table-value"><%= date('l, F j, Y',$this->Profile->CreateTime) %></td>
+</tr>
+</table>
 <br/>
-
-Privilege: <%= $this->CurrentUser->Role===0? 'User':'Administrator' %>
-<br/>
-
-Personal website: <%= $this->CurrentUser->Website %>
-<br/>
-
+<com:THyperLink
+	Text="Update"
+	NavigateUrl=<%= $this->Service->constructUrl('Users.EditUser',array('id'=>$this->Profile->ID)) %>
+	Visible=<%= $this->User->IsAdmin || $this->Profile->ID===$this->User->ID %>
+	CssClass="link-button" />
 
 </com:TContent>
\ No newline at end of file
diff --git a/demos/blog/protected/Pages/Users/ViewUser.php b/demos/blog/protected/Pages/Users/ViewUser.php
index 3485f56b..453ae349 100644
--- a/demos/blog/protected/Pages/Users/ViewUser.php
+++ b/demos/blog/protected/Pages/Users/ViewUser.php
@@ -1,18 +1,41 @@
 <?php
+/**
+ * ViewUser class file
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ * @version $Revision: $  $Date: $
+ */
 
+/**
+ * ViewUser class
+ *
+ * @author Qiang Xue <qiang.xue@gmail.com>
+ * @link http://www.pradosoft.com/
+ * @copyright Copyright &copy; 2006 PradoSoft
+ * @license http://www.pradosoft.com/license/
+ */
 class ViewUser extends BlogPage
 {
-	private $_currentUser=null;
+	private $_userRecord=null;
 
-	public function getCurrentUser()
+	public function onInit($param)
 	{
-		if($this->_currentUser===null)
-		{
-			$id=TPropertyValue::ensureInteger($this->Request['id']);
-			if(($this->_currentUser=$this->DataAccess->queryUserByID($id))===null)
-				throw new BlogException('xxx');
-		}
-		return $this->_currentUser;
+		parent::onInit($param);
+		if(($id=$this->Request['id'])!==null)
+			$id=TPropertyValue::ensureInteger($id);
+		else
+			$id=$this->User->ID;
+		if(($this->_userRecord=$this->DataAccess->queryUserByID($id))===null)
+			throw new BlogException(500,'profile_id_invalid',$id);
+		$this->_userRecord->Email=strtr(strtoupper($this->_userRecord->Email),array('@'=>' at ','.'=>' dot '));
+	}
+
+	public function getProfile()
+	{
+		return $this->_userRecord;
 	}
 }
 
-- 
cgit v1.2.3