From 5c9ac0014edb62b3ada45f31bf89fbcd2d698ea5 Mon Sep 17 00:00:00 2001
From: Eric Rasmussen <erasmussen2@unl.edu>
Date: Tue, 27 Apr 2010 18:27:54 +0000
Subject: [PATCH] update to latest form plugin

---
 plugins/form/.project                         |  22 ++
 plugins/form/CHANGES.txt                      |  84 ++++-
 plugins/form/README.txt                       |  11 +-
 plugins/form/actions/manage_field.php         |  14 +-
 plugins/form/actions/submit.php               |   3 +
 plugins/form/display_object.php               |   2 +-
 plugins/form/languages/en.php                 |  16 +-
 plugins/form/list_fields.php                  |   8 +-
 plugins/form/models/form_types.php            |   7 +
 plugins/form/models/model.php                 | 326 +++++++++++++++---
 plugins/form/models/profile.php               |  58 ++--
 plugins/form/my_forms.php                     |   2 +
 plugins/form/search_results.php               |   4 +-
 plugins/form/start.php                        |  40 +--
 plugins/form/thumbnail.php                    |  58 ++++
 .../form/views/default/form/display_field.php |   3 +-
 .../views/default/form/display_templates.php  |  27 +-
 .../form/views/default/form/field_list.php    |   8 +-
 .../views/default/form/form_data_admin.php    |   3 +-
 .../views/default/form/forms/display_form.php |   6 +-
 .../form/forms/display_form_content.php       |  10 +-
 .../views/default/form/forms/field_adders.php |   5 +
 .../views/default/form/forms/list_fields.php  |   7 +-
 .../form/forms/list_search_definitions.php    |   3 +-
 .../default/form/forms/manage_all_forms.php   |   5 +-
 .../views/default/form/forms/manage_field.php |  50 ++-
 .../views/default/form/forms/manage_form.php  |   9 +-
 .../form/forms/manage_form_translation.php    |   2 +
 .../forms/manage_group_profile_categories.php |   4 +-
 .../form/forms/manage_search_definition.php   |   2 +
 .../views/default/form/input/longtext.php     |  25 ++
 .../default/form/input/radio_with_other.php   |  57 +++
 .../views/default/form/input/shorttext.php    |   7 +-
 plugins/form/views/default/form/nav.php       |   4 +-
 .../form/views/default/form/output/image.php  |   2 +-
 .../form/views/default/form/output/link.php   |  26 ++
 .../views/default/form/search_results.php     |   2 +-
 .../default/form/search_results_simple.php    |   4 +-
 .../form/views/default/settings/form/edit.php |  10 +
 39 files changed, 762 insertions(+), 174 deletions(-)
 create mode 100644 plugins/form/.project
 create mode 100644 plugins/form/models/form_types.php
 create mode 100644 plugins/form/thumbnail.php
 create mode 100644 plugins/form/views/default/form/input/longtext.php
 create mode 100644 plugins/form/views/default/form/input/radio_with_other.php
 create mode 100644 plugins/form/views/default/form/output/link.php

diff --git a/plugins/form/.project b/plugins/form/.project
new file mode 100644
index 00000000..9312bd30
--- /dev/null
+++ b/plugins/form/.project
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<projectDescription>
+	<name>form</name>
+	<comment></comment>
+	<projects>
+	</projects>
+	<buildSpec>
+		<buildCommand>
+			<name>org.eclipse.php.core.PhpIncrementalProjectBuilder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+		<buildCommand>
+			<name>org.eclipse.php.core.ValidationManagerWrapper</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+	</buildSpec>
+	<natures>
+		<nature>org.eclipse.php.core.PHPNature</nature>
+	</natures>
+</projectDescription>
diff --git a/plugins/form/CHANGES.txt b/plugins/form/CHANGES.txt
index f8c5f90f..42d42fdb 100755
--- a/plugins/form/CHANGES.txt
+++ b/plugins/form/CHANGES.txt
@@ -1,3 +1,85 @@
+Changes for release 0.86
+
+Removed experimental code that was preventing form submits for some users.
+
+Removed bad <? tag in "form/nav" view.
+
+Added a 'groupprofile_preupdate' event so that plugins can look at the 
+current and new group profile fields and refuse the update or carry out 
+some other action.
+
+Added a group description plugin hook so that plugins can append text below
+the group description field.
+
+Hid access controls for invisible fields.
+
+Changes for release 0.85
+
+Introduced flexreg plugin for registration forms
+
+Added ability to assign a validation function for field definitions
+
+Introduced templates for form display (currently only for registration forms,
+but could be expanded)
+
+Added a plugin setting for user content on the Elgg search page and turned it off by default.
+
+Introduced group_configure plugin for more complex group category
+configuration
+
+Introduced group_messaging plugin
+
+Checkbox searches should now work as expected.
+
+Fixed a bug in the edit group form which displayed the wrong message
+if the group already existed.
+
+Stopped displaying profile data in the extended view if it is set 
+to invisible (regardless of access level), unless the viewer is an admin.
+
+Fixed a bug which occasionally unset admin-only fields.
+
+The pages that list all fields no longer care about the user who created them.
+
+Replaced input/longtext with form/input/longtext in several places
+to avoid TinyMCE problems.
+
+Turned off input filtering for the form, display and listing templates
+so that they can contain arbitrary content.
+
+Made flexgroupprofile work even if no group profile form is defined.
+
+Added the ability to make group icons and descriptions mandatory
+
+Now properly copies over an existing group icon if transferring the
+group to a new owner.
+
+Fixed a broken link on the orphan fields page.
+
+Added a 'profilepreupdate' event so that plugins can look at the current and new profile
+fields and refuse the update or carry out some other action.
+
+Fixed the video box and image upload thumbnail display.
+
+Added the ability to display three thumbnail sizes for image
+uploads:
+
+{$my_field_name:thumb:tiny} (60x60)
+{$my_field_name:thumb:small} (153x153)
+{$my_field_name:thumb:large} (600x600)
+
+Added clarification to README.txt that image upload works only with 
+the file plugin activated.
+
+Changes for release 0.8.4
+
+Fixed several display problems with flexfile.
+
+Creating new groups should work properly with flexgroupprofile.
+
+Added new private groups option (introduced in Elgg 1.6) to flexgroup profile.
+This has not been tested so I would appreciate feedback on that.
+
 Changes for release 0.8.3
 
 Fixed some weirdness in the display of the orientation option 
@@ -10,7 +92,7 @@ metadata is always searchable if you have the right access level).
 Fixed the display of checkbox groups (previously these would only
 display properly if only one had been selected).
 
-Added a ${_friendlytime} template variable.
+Added a $_friendlytime template variable.
 
 Fixed several problems with the group profile display and added a
 "wide tabbed" display for groups that need more room for their profile
diff --git a/plugins/form/README.txt b/plugins/form/README.txt
index 43298cef..caf4004d 100755
--- a/plugins/form/README.txt
+++ b/plugins/form/README.txt
@@ -227,6 +227,8 @@ I may replace this in future with the jQuery date picker.
 The image upload automatically places the uploaded image in the user's file
 upload area where it can be viewed separately from the specific form content.
 
+Image upload fields will *not* work unless Elgg's file plugin is activated.
+
 The video box accepts Youtube URLs.
 
 The group category type creates a select (dropdown/pulldown) box to allow users
@@ -306,6 +308,13 @@ You can also use:
 
 to display a thumbnail for the image or video.
 
+For image upload fields, you can further qualify the thumbnail to get
+three standard sizes:
+
+{$my_field_name:thumb:tiny} (60x60)
+{$my_field_name:thumb:small} (153x153)
+{$my_field_name:thumb:large} (600x600)
+
 There are a number of special variables:
 
 $_url is the site url.
@@ -375,7 +384,7 @@ definitions that you saved to the database.
 This may not be convenient if you want to translate the form into multiple
 languages.
 
-The form trsnlation page lets you export the text from your form and field
+The form translation page lets you export the text from your form and field
 definitions into Elgg language files saved in the mod/form/languages/formtrans
 directory.
 
diff --git a/plugins/form/actions/manage_field.php b/plugins/form/actions/manage_field.php
index 63ec67a4..fd5916b0 100755
--- a/plugins/form/actions/manage_field.php
+++ b/plugins/form/actions/manage_field.php
@@ -96,7 +96,9 @@ switch($form_action) {
             
         break;
     case "delete_orphans":
-        form_delete_orphan_fields(get_user_from_username($username)->getGUID());
+        //form_delete_orphan_fields(get_user_from_username($username)->getGUID());
+        // change to delete all orphan fields
+        form_delete_orphan_fields(0);
         system_message(elgg_echo('form:orphan_delete_all_response'));
         $redirect_url = $CONFIG->wwwroot.'mod/form/list_fields.php?type=orphan&username='.$username;
         break;
@@ -120,7 +122,9 @@ switch($form_action) {
         $existing_field_name = trim(get_input('existing_field_name',''));
         $form_id = get_input('form_id',0);
         $form = get_entity($form_id);
-        $field_id = form_get_field_id_from_name($existing_field_name,$form->owner_guid);
+        //$field_id = form_get_field_id_from_name($existing_field_name,$form->owner_guid);
+        // changed to no longer care about form owner
+        $field_id = form_get_field_id_from_name($existing_field_name);
         if ($field_id) {        
             if (form_add_existing_field($form_id,$field_id)) {
                 system_message(sprintf(elgg_echo('form:field_existing_add_response'), $existing_field_name));
@@ -138,7 +142,9 @@ switch($form_action) {
         $new_field_name = get_input('new_field_name','');
         $form_id = get_input('form_id',0);
         $form = get_entity($form_id);
-        $field_id = form_get_field_id_from_name($existing_field_name,$form->owner_guid);
+        //$field_id = form_get_field_id_from_name($existing_field_name,$form->owner_guid);
+        // changed to no longer care about form owner
+        $field_id = form_get_field_id_from_name($existing_field_name);
 
         if ($field_id) {
             $field = form_get_field_definition($field_id);
@@ -158,7 +164,7 @@ switch($form_action) {
 
         // make sure that this field does not already exist
         $form = get_entity($form_id);
-        $field_id = form_get_field_id_from_name($new_field_name,$form->owner_guid);
+        $field_id = form_get_field_id_from_name($new_field_name);
         if ($field_id) {
             register_error(elgg_echo('form:error_field_exists'));
             $redirect_url = $CONFIG->wwwroot.'mod/form/manage_form.php?id='.$form_id;
diff --git a/plugins/form/actions/submit.php b/plugins/form/actions/submit.php
index b1980c7f..bde6dcb3 100755
--- a/plugins/form/actions/submit.php
+++ b/plugins/form/actions/submit.php
@@ -33,6 +33,9 @@ if ($preview) {
         foreach ($maps as $map) {
             $field = get_entity($map->field_id);
             $value = isset($form_data[$field->internal_name])?$form_data[$field->internal_name]:'';
+            if (is_array($value)) {
+            	$value = implode(', ',$value);
+            }
             $body .= '<p><b>'.$field->title.' ('.$field->internal_name.') : '.$value.'</p>';
         }
     }
diff --git a/plugins/form/display_object.php b/plugins/form/display_object.php
index 3c8a3f57..7a51a8a7 100755
--- a/plugins/form/display_object.php
+++ b/plugins/form/display_object.php
@@ -23,7 +23,7 @@ $form_data = $fd = get_entity($form_data_id);
 $form_id = $form_data->form_id;
 if($form_data->canEdit()) {
 	add_submenu_item(elgg_echo('form:edit_content'),$CONFIG->wwwroot.'mod/form/form.php?id='.$form_id.'&d='.$form_data_id,'0formadmin');
-	add_submenu_item(elgg_echo('form:delete_content'),$CONFIG->wwwroot.'action/form/manage_form_data?form_action=delete&d='.$form_data_id,'0formadmin');
+	add_submenu_item(elgg_echo('form:delete_content'),$CONFIG->wwwroot.'action/form/manage_form_data?form_action=delete&d='.$form_data_id.'&'.form_add_security_fields(),'0formadmin');
 }
 set_input('form_id',$form_id);
 $form = get_entity($form_id);
diff --git a/plugins/form/languages/en.php b/plugins/form/languages/en.php
index 4892c57d..2cf676cc 100755
--- a/plugins/form/languages/en.php
+++ b/plugins/form/languages/en.php
@@ -48,7 +48,7 @@
     'form:title_label' => "Form title",
     'form:form_title_description' => "Enter a brief title. For content forms this will appear as a heading at the top of the form.",
     'form:description_label' => "Description",
-    'form:form_description_description' => "Optionally enter a sentence or two of text describing your form. For content forms this will be displayed at the top of your content creation form to explain its purpose.",
+    'form:form_description_description' => "Optionally enter a sentence or two of text describing your form. For content and registration forms this will be displayed at the top of your content creation form to explain its purpose.",
     'form:listing_description_label' => "Listing Description",
     'form:form_listing_description' => "For content forms, you can optionally enter a sentence or two of text that will appear at the top of listings of form content.",
     'form:profile_title_label' => "Profile title",
@@ -129,6 +129,7 @@
     'form:choice_field_type_description' => "Choose the type of field.",
     'form:dropdown' => "Pulldown (select) box",
     'form:radio' => "Radio buttons",
+    'form:radio_with_other' => "Radio buttons with \"Other\" text box",
     'form:checkbox' => "Checkbox group",
     'form:default_value_label' => "Default value",
     'form:default_value_description' => "Enter the default value for this field. If the field is a checkbox group, then you can precheck"
@@ -191,6 +192,8 @@
     'form:search_definition_title' => "Manage search definition for \"%s\"",
     'form:search_field_label' => "Searchable fields",
     'form:search_field_description' => "Supply a comma-separated list of the internal names of the fields you want to be on the search form.",
+	'form:form_template_label' => "Form template",
+    'form:form_template_description' => "Supply an HTML template if you want to replace the default form display with your own customised version.",        
     'form:list_template_label' => "List template",
     'form:list_template_description' => "Supply an HTML template if you want the search results to be displayable in the list format.",
     'form:gallery_template_label' => "Gallery template",
@@ -239,7 +242,7 @@
     'form:save_succeeded' => "Your information has been saved.",
     'form:preview_results_description' => "Here is the information that would have been saved as a result of this form submission.",
     'form:preview_description' => "This is a form preview and will show the form submission results without saving the data.",
-    'form:error_missing_fields' => "Error: You must provide the following required information: %s.",
+    'form:error_missing_fields' => "Error: This information is missing or invalid: %s.",
     'form:delete_data_response' => "Your content has been deleted.",
     'form:no_content' => "No content is available.",
     'form:add' => "Add",
@@ -288,6 +291,7 @@
     'form:invite_subject' => "%s has sent you an invitation",
     'form:profiles' => "Profiles",
     'form:user_content_status_title' => "Put User content links in Tools and sidebar menus",
+    'form:user_content_register_title' => "Add user content option on Elgg search page",
     'form:put_user_content_in_menu_for_all_users' => "For all users",
     'form:put_user_content_in_menu_for_admins_only' => "For admins only",
     'form:user_content_status_response' => "The user content status has been changed.",
@@ -312,18 +316,17 @@
     'form:extended_profile_title' => "%s's extended profile",
     'form:main_profile_link_text' => "Main profile",
     'form:extended_profile_link_text' => "Extended profile",
-    //'form:error_no_profile_form' => "Error: no profile form exists. You must create at least one profile form to use the flexprofile plugin.",
-    'form:error_no_profile_form' => "This user has not opened their profile to anonymous users. Please login in order to view this profile.",
+    'form:error_no_profile_form' => "Error: no profile form exists. You must create at least one profile form to use the flexprofile plugin.",
     'form:error_no_group_profile_form' => "Error: no group profile form exists. You must create at least one group profile form for this group category "
         ."or a group profile form with a blank category to use the flexgroupprofile plugin.",
-    'form:manage_group_profile_categories_title' => "Manage group profile categories",
+    'form:manage_group_profile_categories_title' => "Set group categories",
     'form:manage_group_profile_categories_description' => "Enter the names of your group categories below, one per line.",
     'form:manage_group_profile_categories_response' => "The group profile categories have been saved.",
-   	'form:new_group_description' => "Please enter the information below to create a new group.",
     'form:content_type' => "Content form",
     'form:user_profile_type' => "User profile form",
     'form:group_profile_type' => "Group profile form",
     'form:file_type' => "File form",
+    'form:registration_type' => "Registration form",
     'form:type_label' => "Form type",
     'form:type_description' => "Specify how this form will be used.",
     'form:form_list' => "Form list",
@@ -346,6 +349,7 @@
     'form:enable_create_menu_description' => "Tick if you want the content creation page for this form to appear in the Tools menu.",
     'form:create_menu_title_label' => "Content creation tools menu title",
     'form:create_menu_title_description' => "Title to use if displaying a link to the content creation page for this form in the Tools menu.",
+    'form:other' => "Other",
         
     /**
 	 * Form data (content form) river
diff --git a/plugins/form/list_fields.php b/plugins/form/list_fields.php
index 8d530452..89cc6658 100755
--- a/plugins/form/list_fields.php
+++ b/plugins/form/list_fields.php
@@ -6,7 +6,7 @@
  * Radagast Solutions
  * http://radagast.biz
  *
- * Lists fields owned by the user.
+ * Lists field definitions
  *
  */
  
@@ -28,10 +28,12 @@ $user = get_user_by_username($username);
 if ($user) {
     $type = get_input('type','');
     if ($type == 'orphan') {      
-        $fields = form_get_orphan_fields($user->getGUID());        
+        //$fields = form_get_orphan_fields($user->getGUID());
+        $fields = form_get_orphan_fields(0);             
         $title = elgg_echo('form:list_orphan_fields_title');
     } else {
-        $fields = form_get_all_fields($user->getGUID());        
+        //$fields = form_get_all_fields($user->getGUID());
+        $fields = form_get_all_fields(0);                
         $title = elgg_echo('form:list_fields_title');
     }
     
diff --git a/plugins/form/models/form_types.php b/plugins/form/models/form_types.php
new file mode 100644
index 00000000..a2885328
--- /dev/null
+++ b/plugins/form/models/form_types.php
@@ -0,0 +1,7 @@
+<?php
+define('FORM_CONTENT',0);
+define('FORM_USER_PROFILE',1);
+define('FORM_GROUP_PROFILE',2);
+define('FORM_FILE',3);
+define('FORM_REGISTRATION',4);
+?>
\ No newline at end of file
diff --git a/plugins/form/models/model.php b/plugins/form/models/model.php
index 5716da5e..2b8dc862 100755
--- a/plugins/form/models/model.php
+++ b/plugins/form/models/model.php
@@ -1,5 +1,6 @@
 <?php
 require_once(dirname(__FILE__).'/profile.php');
+require_once(dirname(__FILE__).'/form_types.php');
 
 function form_get_form_field_types() {
 	// Load form field types model
@@ -12,7 +13,7 @@ function form_get_form_field_types() {
 	}
 }
 
-function form_custom_field_type_manager($type='',$label='',$input_view='',$output_view='') {
+function form_custom_field_type_manager($type='',$label='',$input_view='',$output_view='',$validation_function='') {
 	static $form_custom_field_types;
 	
 	if (!isset($form_custom_field_types)) {
@@ -24,6 +25,9 @@ function form_custom_field_type_manager($type='',$label='',$input_view='',$outpu
 		$obj->label = $label;
 		$obj->input_view = $input_view;
 		$obj->output_view = $output_view;
+		if ($validation_function) {
+			$obj->validation_function = $validation_function;
+		}
 		$form_custom_field_types[$type] = $obj;		
 	}
 	return $form_custom_field_types;	
@@ -306,6 +310,11 @@ function form_set_field_definition() {
         $map->form_id = $form_id;
         $map->display_order = 100000;
         $map->save();
+        // the next line looks iffy
+        // It probably should be
+        // form_reorder($form_id);
+        // TODO: investigate
+        
         form_reorder($field->form_id);
     }
     
@@ -356,16 +365,18 @@ function form_reorder($form_id) {
     $order = array();
     $map_array = array();
     $i = 1;
-    foreach($maps as $map) {
-        $map_id = $map->getGUID();
-        $order[$map_id] = $i * 10;
-        $map_array[$map_id] = $map;
-        $i++;
-    }
-    foreach($order as $map_id => $display_order) {
-        $map = $map_array[$map_id];
-        $map->display_order = $display_order;
-        $map->save();
+    if ($maps) {
+	    foreach($maps as $map) {
+	        $map_id = $map->getGUID();
+	        $order[$map_id] = $i * 10;
+	        $map_array[$map_id] = $map;
+	        $i++;
+	    }
+	    foreach($order as $map_id => $display_order) {
+	        $map = $map_array[$map_id];
+	        $map->display_order = $display_order;
+	        $map->save();
+	    }
     }
 }
 
@@ -459,8 +470,11 @@ function form_set_form_definition() {
 	    $form->profile_category = get_input('profile_category','');
 	    $form->profile_format = get_input('profile_format','');
     }
-	$form->list_template = get_input('list_template','');
-	$form->display_template = get_input('display_template','');
+    // get the templates but don't filter them to avoid screwing up
+    // any HTML details
+    $form->form_template = trim(get_input('form_template','',false));
+	$form->list_template = trim(get_input('list_template','',false));
+	$form->display_template = trim(get_input('display_template','',false));
 	$form->allow_comments = get_input('allow_comments',0);
 	$form->email_form = get_input('email_form',0);
 	$form->email_to = get_input('email_to','');
@@ -559,7 +573,7 @@ function form_field_type_to_view($field_type,$mode) {
     		$view = $form_field_types[$field_type]->output_view;
     	}
     } else {
-    	if (in_array($field_type,array('radio','checkboxes'))) {
+    	if (in_array($field_type,array('radio','radio_with_other','checkboxes'))) {
     		$view = 'form/input/'.$field_type;
     	} else if ($field_type == 'pulldown') {
     		$view = 'input/pulldown';
@@ -583,7 +597,13 @@ function form_get_data_from_form_submit($form_id=0) {
 			foreach($fields as $field) {
 				$value = get_input('form_data_'.$field->internal_name,'');
 				if ($value) {
-					$data[$field->internal_name] = $value;
+					if ($field->field_type == 'tags') {
+	            		// KJ - I reverse the array to fix an annoying Elgg tag order bug
+	            		// I will remove this workaround when the bug is fixed
+						$data[$field->internal_name] = array_reverse(string_to_tag_array($value));
+					} else {
+						$data[$field->internal_name] = $value;
+					}
 				}
 			}			
 		}
@@ -645,12 +665,29 @@ function form_delete_data($form_data_id) {
     return $form_data->delete();
 }
 
-function form_get_input_display_item($form,$field,$data=null,$prepopulate=true,$format_view='form/display_field') {
+function form_get_default_access($field) {
+	// must do this because Elgg has trouble with metadata set to "0"
+ 	// in Elgg 1.5 using a simple reference
+	$m = get_metadata_byname($field->getGUID(),'default_access');
+	if ($m && ($m->value || ($m->value === 0) || ($m->value === '0'))) {
+		$access_id = $m->value;
+	} else {
+		$access_id = get_default_access();
+	}
+	
+	return $access_id;
+}
+
+function form_get_input_display_item($form,$field,$data=null,$prepopulate=true,$format_view='form/display_field',$get_admin=false) {
     global $CONFIG;
     $internalname = $field->internal_name;
     $access_id = '';
     //print($internalname.':');
-    if (!isset($field->admin_only) || !$field->admin_only || isadminloggedin()) {
+    if (($field->field_type == 'group_category')
+    	&& get_input('hide_gpc') 
+    	&& ($group_profile_category = get_input('group_profile_category'))) {
+    		$html = elgg_view('input/hidden',array('internalname'=>'form_data_'.$internalname,'value'=>$group_profile_category));
+    } else if ($get_admin || !isset($field->admin_only) || !$field->admin_only || isadminloggedin()) {
         if (!isset($data)) {
             $data = array();
         }
@@ -660,14 +697,7 @@ function form_get_input_display_item($form,$field,$data=null,$prepopulate=true,$
                 $access_id = $data[$internalname]->access_id;            
             } else {
                 $value = $field->default_value;
-                // must do this because Elgg has trouble with metadata set to "0"
-			    // in Elgg 1.5 using a simple reference
-			    $m = get_metadata_byname($field->getGUID(),'default_access');
-                if ($m && ($m->value || ($m->value === 0) || ($m->value === '0'))) {
-                	$access_id = $m->value;
-                } else {
-                	$access_id = get_default_access();
-                }
+			    $access_id = form_get_default_access($field);
             }
         } else {
             $value = '';
@@ -721,9 +751,14 @@ function form_get_input_display_item($form,$field,$data=null,$prepopulate=true,$
         //print $field_type.'#';
         $view = form_field_type_to_view($field_type,"input");
         //print ($field_type.':'.$view.'; ');
-        
-        $html = elgg_view($format_view, array('field'=>$view_prefix.elgg_view($view,$vars),
-            'title'=>form_field_t($form,$field,'title'),'description'=>form_field_t($form,$field,'description')));
+        $params = array('field'=>$view_prefix.elgg_view($view,$vars),
+            'title'=>form_field_t($form,$field,'title'),'description'=>form_field_t($form,$field,'description'));
+        if ($form->form_template) {
+        	// kludge to just hand back the result for templating
+        	$html = $params;
+        } else {
+        	$html = elgg_view($format_view, $params);
+        }
     } else {
         if ($prepopulate) {
             if (isset($data[$internalname]) && $data[$internalname]->value) {
@@ -782,14 +817,15 @@ function form_display_filtered($form,$namelist,$data=null,$prepopulate=true,$hid
 
 // returns collections of field items keyed by tab
 
-function form_display_by_tab($form,$data=null,$prepopulate=true,$hidden=null) {
+function form_display_by_tab($form,$data=null,$prepopulate=true,$hidden=null,$get_admin=false) {
     $tabs = array();
+    $extra = array();
     $maps = form_get_maps($form->getGUID());
     if ($maps) {
         foreach($maps as $map) {
             $field = get_entity($map->field_id);
-            if (!$field->admin_only || isadminloggedin() ) {
-            	// don't display admin fields to non-admins
+            if ($get_admin || (!$field->admin_only || isadminloggedin()) ) {
+            	// normally don't display admin fields to non-admins
 	            if (isset($hidden) && isset($hidden[$name]) && $hidden[$name]) {
 	            	// hardcode this as a hidden field
 	            	$name = $field->internal_name;
@@ -803,7 +839,8 @@ function form_display_by_tab($form,$data=null,$prepopulate=true,$hidden=null) {
 	            	$f->html = elgg_view('input/hidden', array('internalname'=>'form_data_'.$name,'value'=>$value));
 	            	$item = $f;
 	            } else {
-	            	$item = form_get_input_display_item($form,$field,$data,$prepopulate);
+	            	$item = form_get_input_display_item($form,$field,$data,$prepopulate,'form/display_field',$get_admin);
+	            	$item->invisible = $field->invisible;	            		
 	            }
 	            if (!$field->tab) {
 	                if ($form->translate) {
@@ -819,19 +856,79 @@ function form_display_by_tab($form,$data=null,$prepopulate=true,$hidden=null) {
 	                $tabs[$tab] = array();
 	            }
 	            $tabs[$tab][] = $item;
+            } else {
+            	$name = $field->internal_name;
+            	if (isset($data) && isset($data[$name])) {
+            		$value = $data[$name]->value;
+            	} else {
+            		$value = $field->default_value;
+            	}
+            	$f = new stdClass;
+            	$f->internalname = $name;
+            	$f->html = elgg_view('input/hidden', array('internalname'=>'form_data_'.$name,'value'=>$value));
+            	$item = $f;
+            	
+	            $extra[] = $item;
             }
+            	
         }
     }
-    return $tabs;
+    return array('main'=>$tabs,'extra'=>$extra);
+}
+
+function form_get_data_for_templated_edit_form($form,$data,$get_admin = false) {
+	$prepopulate=true;
+	$extra = array();
+	$fields = array();
+	$maps = form_get_maps($form->getGUID());
+    if ($maps) {
+        foreach($maps as $map) {
+            $field = get_entity($map->field_id);
+            if ($get_admin || (!$field->admin_only || isadminloggedin()) ) {
+            	// normally don't display admin fields to non-admins
+	            if (isset($hidden) && isset($hidden[$name]) && $hidden[$name]) {
+	            	// hardcode this as a hidden field
+	            	$name = $field->internal_name;
+	            	if (isset($data) && isset($data[$name])) {
+	            		$value = $data[$name]->value;
+	            	} else {
+	            		$value = '';
+	            	}
+	            	$f = new stdClass;
+            		$f->internalname = $name;
+            		$f->html = elgg_view('input/hidden', array('internalname'=>'form_data_'.$name,'value'=>$value));
+            		$extra[] = $f;
+	            } else {
+	            	$fields[] = form_get_input_display_item($form,$field,$data,$prepopulate,'form/display_field',$get_admin);	            	
+	            }
+            } else {
+            	$name = $field->internal_name;
+            	if (isset($data) && isset($data[$name])) {
+            		$value = $data[$name]->value;
+            	} else {
+            		$value = $field->default_value;
+            	}
+            	$f = new stdClass;
+            	$f->internalname = $name;
+            	$f->html = elgg_view('input/hidden', array('internalname'=>'form_data_'.$name,'value'=>$value));
+            	$item = $f;
+            	
+	            $extra[] = $item;
+            }            	
+        }
+    }
+    
+    return array('fields'=>$fields,'extra'=>$extra);
 }
 
 // Return the form fields (indexed by tab), optionally prepopulated with data
 
-function form_get_data_for_edit_form($form,$data=null) {
+function form_get_data_for_edit_form($form,$data=null,$get_admin=false) {
         
     $tab_data = array();
-    $tabs = form_display_by_tab($form,$data);
+    $form_tabs = form_display_by_tab($form,$data,true,null,$get_admin);
     // just flatten the result and return
+    $tabs = $form_tabs['main'];
     if ($tabs) {
         foreach ($tabs as $tab => $tab_items) {
             $tab_data[$tab] = '';
@@ -840,7 +937,11 @@ function form_get_data_for_edit_form($form,$data=null) {
             }
         }
     }
-    return $tab_data;
+    $extra = '';
+    foreach ($form_tabs['extra'] as $item) {
+    	$extra .= $item->html;
+    }
+    return array('main' => $tab_data, 'extra'=>$extra);
 }
 
 /**
@@ -895,7 +996,7 @@ function form_get_field_output($form,$field,$value) {
     } else {
     	$profile = 0;
     }
-    $type_array = array('form_data','user','group');
+    $type_array = array('form_data','user','group','file');
 	if (strtolower($field->field_type) == "choices") {
 		$choices = form_get_field_choices($field->getGUID());
 		if (is_array($value)) {
@@ -989,9 +1090,12 @@ function form_view_entities($entities, $form, $viewtype) {
 						$item = $md[$internalname];
 						$vars[$item->name] = form_get_field_output($form,$field,$item->value);
 						if ($field->field_type == 'image_upload') {
-							$vars[$item->name.':thumb'] = elgg_view($view,array('value'=>$item->value,'size'=>'small'));
+							$vars[$item->name.':thumb:tiny'] = elgg_view('form/output/image',array('value'=>$item->value,'size'=>'tiny'));
+							$vars[$item->name.':thumb:small'] = elgg_view('form/output/image',array('value'=>$item->value,'size'=>'small'));
+							$vars[$item->name.':thumb:large'] = elgg_view('form/output/image',array('value'=>$item->value,'size'=>'large'));
+							$vars[$item->name.':thumb'] = $vars[$item->name.':thumb:small'];
 						} else if ($field->field_type == 'video_box') {
-							$vars[$item->name.':thumb'] = elgg_view($view,array('value'=>$item->value,'size'=>'thumb'));
+							$vars[$item->name.':thumb'] = elgg_view('form/output/video_box',array('value'=>$item->value,'size'=>'thumb'));
 						}
 					} else {
 						// just return empty strings
@@ -1031,7 +1135,7 @@ function form_view_entities($entities, $form, $viewtype) {
 					$user_guid = $_SESSION['user']->getGUID();
 					if ($number_of_my_recommendations == 0){
 						$recommendation_template = '<a href="%s">'.elgg_echo("form:recommend_this"). '</a>';
-						$my_recommend_bit = ' ['.sprintf($recommendation_template,$CONFIG->wwwroot.'action/form/manage_form_data?form_action=recommend&d='.$form_data_id).']';
+						$my_recommend_bit = ' ['.sprintf($recommendation_template,$CONFIG->wwwroot.'action/form/manage_form_data?form_action=recommend&d='.$form_data_id.'&'.form_add_security_fields()).']';
 					} else {
 						$my_recommend_bit = '';
 					}
@@ -1348,18 +1452,21 @@ function form_send_email($to_list, $from, $subject, $message) {
     }
 }
 
-function form_get_field_id_from_name($existing_field_name,$user_guid) {
-    $fields = get_entities_from_metadata('internal_name', $existing_field_name, 'object', 'form:form_field', $user_guid,500);
+function form_get_field_id_from_name($existing_field_name,$user_guid=0) {
+    $fields = get_entities_from_metadata('internal_name', $existing_field_name, 'object', 'form:field', $user_guid,500);
     if ($fields) {
         $field_id = $fields[0]->getGUID();
     } else {
         $field_id = 0;
     }
+    if (!$field_id) {
+    	error_log("ID for field $existing_field_name is $field_id");
+    }
     return $field_id;
 }
 
-function form_get_field_from_name($existing_field_name,$user_guid) {
-    $fields = get_entities_from_metadata('internal_name', $existing_field_name, 'object', 'form:form_field', $user_guid,500);
+function form_get_field_from_name($existing_field_name,$user_guid=0) {
+    $fields = get_entities_from_metadata('internal_name', $existing_field_name, 'object', 'form:field', $user_guid,500);
     if ($fields) {
         return $fields[0];
     } else {
@@ -1402,15 +1509,29 @@ function form_add_existing_field($form_id,$field_id) {
 
 function form_get_data_with_search_conditions($conditions,$sd,$limit,$offset) {
     global $CONFIG;
+    if (function_exists('elgg_get_entities_from_metadata')) {
+    	return form_get_data_with_search_conditions2($conditions,$sd,$limit,$offset);
+    }
+    $ac = array();
+    
+    // remove array values from conditions as 
+    // get_entities_from_metadata_multi does not handle them as expected
+    
+    foreach ($conditions as $k => $v) {
+    	if (is_array($v)) {
+    		unset($conditions[$k]);
+    		$ac[$k] = $v;
+    	}
+    }
     
     $search_order_field = trim($sd->search_order);
     $form = get_entity($sd->form_id);
     // will return at most 500 search results
-    if ($form->profile == 1) {
+    if ($form->profile == FORM_USER_PROFILE) {
     	// this is a profile form, so get the data from users
         $entities = get_entities_from_metadata_multi($conditions, 'user', '',0,500);
-    } else if ($form->profile == 2) {
-    	// this is a profile form, so get the data from groups
+    } else if ($form->profile == FORM_GROUP_PROFILE) {
+    	// this is a group profile form, so get the data from groups
     	// if a profile category is set for this form, restrict the search
     	// to groups of that category
     	if ($form->profile_category) {
@@ -1445,7 +1566,11 @@ function form_get_data_with_search_conditions($conditions,$sd,$limit,$offset) {
 	        }
     	} else {
     		$new_results2 = $entities;
-    	}        
+    	}
+
+    	if ($ac) {
+    		// TODO: filter by array value (ORing results)
+    	}
             
         // sort by search order if required
         if($search_order_field) {
@@ -1465,6 +1590,62 @@ function form_get_data_with_search_conditions($conditions,$sd,$limit,$offset) {
 //    }
 }
 
+// this version uses the new elgg_get_entities API
+
+function form_get_data_with_search_conditions2($conditions,$sd,$limit,$offset) {
+	global $CONFIG;
+		
+	$form = get_entity($sd->form_id);
+	$options = array();
+	$c = array();
+	foreach ($conditions as $k => $v) {
+		if (is_array($v)) {
+			$operand = 'IN';
+		} else {
+			$operand = '=';
+		}
+		$c[] = array('name'=>$k,'value'=>$v,'operand'=>$operand);
+	}
+	if ($form->profile == FORM_CONTENT) {
+		// restrict to appropriate form
+		$options['type'] = 'object';
+		$options['subtype'] = 'form_data';
+		$c[] = array('name'=>'form_id','value'=>$sd->form_id,'operand'=>'=');
+        // filter content by language
+        $new_results2 = array();
+        $view_languages = array();
+        if (isloggedin()) {
+            $key = 'form:view_content_languages';
+            $user = get_loggedin_user();
+            if (!empty($user->$key)) {
+                $view_languages = explode(',',$user->$key);
+            }
+        }
+        // we can always see content in the current language
+        $view_languages[] = $CONFIG->language;
+        $view_languages[] = '';
+        $c[] = array('name'=>'_language','value'=>$view_languages,'operand'=>'IN');
+	} else if ($form->profile == FORM_USER_PROFILE) {
+		$options['type'] = 'user';
+	} else if ($form->profile == FORM_GROUP_PROFILE) {
+		$options['type'] = 'group';
+		if ($form->profile_category) {
+			$c[] = array('name'=>'group_profile_category','value'=>$form->profile_category,'operand'=>'=');
+    	}
+	}
+	$options['metadata_name_value_pairs'] = $c;
+	$search_order_field = trim($sd->search_order);
+	if ($search_order_field) {
+		$options['order_by_metadata'] = array('name'=>$search_order_field,'direction'=>'ASC');
+	}
+	$options['limit'] = $limit;
+	$options['offset'] = $offset;
+    $entities = elgg_get_entities_from_metadata($options);
+    $options['count'] = true;
+    $count = elgg_get_entities_from_metadata($options);
+    return array($count,$entities);	
+}
+
 // this is a simpler version of the function above that does not require a search definition
 // TODO: filter for more than the current language
 
@@ -1476,9 +1657,14 @@ function form_get_data_with_search_conditions_simple($conditions,$type,$form_id,
         $entities = get_entities_from_metadata_multi($conditions, 'user','',0,$limit,$offset);
         $count = get_entities_from_metadata_multi($conditions, 'user','',0,$limit,$offset,"",0,true);
     } else if ($type == 'group') {
-    	// this is a user profile form, so get the data from groups
+    	// this is a group profile form, so get the data from groups
         $entities = get_entities_from_metadata_multi($conditions, 'group','',0,$limit,$offset);
         $count = get_entities_from_metadata_multi($conditions, 'group','',0,$limit,$offset,"",0,true);
+    } else if ($type == 'file') {
+    	// this is a file form, so get the data from files
+        $entities = get_entities_from_metadata_multi($conditions, 'object','file',0,$limit,$offset);
+        $count = get_entities_from_metadata_multi($conditions, 'object','file',0,$limit,$offset,"",0,true);
+        
     } else {
     	if (!$conditions) {
     		$conditions = array();
@@ -1580,10 +1766,11 @@ function form_set_user_content_status($status) {
 function form_type_options() {
 	
 	return array (
-		0 => elgg_echo('form:content_type'),
-		1 => elgg_echo('form:user_profile_type'),
-		2 => elgg_echo('form:group_profile_type'),
-		3 => elgg_echo('form:file_type'),
+		FORM_CONTENT => elgg_echo('form:content_type'),
+		FORM_USER_PROFILE => elgg_echo('form:user_profile_type'),
+		FORM_GROUP_PROFILE => elgg_echo('form:group_profile_type'),
+		FORM_FILE => elgg_echo('form:file_type'),
+		FORM_REGISTRATION => elgg_echo('form:registration_type'),
 	);
 }
 
@@ -1594,7 +1781,7 @@ function form_get_tabbed_output_display($form,$data) {
     if ($maps) {
         foreach($maps as $map) {
             $field = get_entity($map->field_id);
-            if ($field->field_type != 'access') {
+            if (($field->field_type != 'access') && (!$field->invisible || isadminloggedin())) {
 	            $internalname = $field->internal_name;
 	            if (isset($data[$internalname]) && $data[$internalname]->value) {
 		            if (!$field->tab) {
@@ -1616,7 +1803,36 @@ function form_get_tabbed_output_display($form,$data) {
             }
         }
     }
-    return $tab_data;
+    return array('main'=>$tab_data,'extra'=>'');
 }
 
+function form_render_form_template($form,$field_list) {
+	$template = $form->form_template;
+	$tvars = array();
+	foreach ($field_list as $field) {
+		$field_name = $field->internalname;
+		$ft = $field_name.':t';
+		$fd = $field_name.':d';
+		$fi = $field_name.':i';
+		$html = $field->html;
+		$tvars[$ft] = $html['title'];
+		$tvars[$fd] = $html['description'];
+		$tvars[$fi] = $html['field'];
+	}
+	if ($form->profile == FORM_REGISTRATION) {
+		if(is_plugin_enabled('flexreg')) {
+			$standard_fields = flexreg_get_standard_fields(false);
+			$tvars = array_merge($tvars,$standard_fields);
+		}
+	}
+	$result = form_parse_template($template,$tvars);
+	return form_language_template($result);
+}
+
+function form_add_security_fields() {
+		$ts = time();
+		$token = generate_action_token($ts);
+		return "__elgg_token=$token&__elgg_ts=$ts";
+	}
+
 ?>
\ No newline at end of file
diff --git a/plugins/form/models/profile.php b/plugins/form/models/profile.php
index 3d1aa220..000782e9 100755
--- a/plugins/form/models/profile.php
+++ b/plugins/form/models/profile.php
@@ -53,7 +53,7 @@ function form_get_group_profile_categories() {
 function form_set_group_profile_categories($group_profile_categories) {
 	$form_config = get_entities('object','form:config');
     if (!$form_config) {
-        $form_config = new ElggObject();
+        $form_config = new ElggUnsearchableObject();
         $form_config->subtype = 'form:config';
         $form_config->owner_guid = $_SESSION['user']->getGUID();
         $form_config->access_id = ACCESS_PUBLIC;
@@ -151,23 +151,28 @@ function form_get_data_for_profile_tabbed_display($form, $entity) {
 }
     
 
-// Return the form fields (indexed by tab), optionally prepopulated with data from the specified user or group entity.
+// Return the form fields (indexed by tab), 
+// prepopulated with the data (if supplied) or 
+// from the specified user or group entity.
 
-function form_get_data_for_profile_edit_form($form, $entity=null, $group_profile_category='') {
+function form_get_data_for_profile_edit_form($form, $entity=null, $group_profile_category='',$data=null) {
 
-    if ($entity) {
-        $data = form_get_data_from_profile($form->getGUID(),$entity);
-    } else {
-    	if ($group_profile_category) {
-	    	$item = new stdClass;
-	    	$item->name = 'group_profile_category';
-	    	$item->value = $group_profile_category;
-	        $data = array('group_profile_category'=>$item);
-    	}
-    }
+	if (!isset($data)) {
+	    if ($entity) {
+	        $data = form_get_data_from_profile($form->getGUID(),$entity);
+	    } else {
+	    	if ($group_profile_category) {
+		    	$item = new stdClass;
+		    	$item->name = 'group_profile_category';
+		    	$item->value = $group_profile_category;
+		        $data = array('group_profile_category'=>$item);
+	    	}
+	    }
+	}
     
     $tab_data = array();
-    $tabs = form_display_by_tab($form,$data,true);
+    $form_tabs = form_display_by_tab($form,$data,true);
+    $tabs = $form_tabs['main'];
     if ($tabs) {
         foreach ($tabs as $tab => $tab_items) {
             $tab_data[$tab] = '';
@@ -194,7 +199,11 @@ function form_get_data_for_profile_edit_form($form, $entity=null, $group_profile
             }
         }
     }
-    return $tab_data;
+    $extra = '';
+    foreach ($form_tabs['extra'] as $item) {
+    	$extra .= $item->html;
+    }
+    return array('main' => $tab_data, 'extra'=>$extra);
 }
 
 function form_get_profile_data_from_form_post() {
@@ -209,14 +218,17 @@ function form_get_profile_data_from_form_post() {
     if ($maps) {
         foreach($maps as $map) {
             $field = get_entity($map->field_id);
-            $flexprofile_data[$field->internal_name] = get_input('form_data_'.$field->internal_name,'');
-			if ($field->field_type == 'tags'){
-            	// KJ - I reverse the array to fix an annoying Elgg tag order bug
-            	// I will remove this workaround when the bug is fixed
-				$flexprofile_data[$field->internal_name] = array_reverse(string_to_tag_array($flexprofile_data[$field->internal_name]));
-            } else if ($field->field_type == 'image_upload') {
-                // special handling for images
-                $images[] = $field->internal_name;
+            $value = get_input('form_data_'.$field->internal_name,null);
+            if ($value != null) {
+	            $flexprofile_data[$field->internal_name] = $value;
+				if ($field->field_type == 'tags'){
+	            	// KJ - I reverse the array to fix an annoying Elgg tag order bug
+	            	// I will remove this workaround when the bug is fixed
+					$flexprofile_data[$field->internal_name] = array_reverse(string_to_tag_array($flexprofile_data[$field->internal_name]));
+	            } else if ($field->field_type == 'image_upload') {
+	                // special handling for images
+	                $images[] = $field->internal_name;
+	            }
             }
         }
     }
diff --git a/plugins/form/my_forms.php b/plugins/form/my_forms.php
index 0550ae74..2804c8d5 100755
--- a/plugins/form/my_forms.php
+++ b/plugins/form/my_forms.php
@@ -24,6 +24,8 @@ $username = get_input('username');
 $form_view = get_input('form_view');
 $callback = get_input('callback');
 
+//TODO: make sure it is safe and then remove the next two lines
+
 $_SESSION['last_search_qs'] = null;
 $_SESSION['last_view_qs'] = $_SERVER["QUERY_STRING"];
 
diff --git a/plugins/form/search_results.php b/plugins/form/search_results.php
index 0de94249..57199819 100755
--- a/plugins/form/search_results.php
+++ b/plugins/form/search_results.php
@@ -23,10 +23,10 @@ $sd = get_entity($search_definition_id);
 
 if($sd) {
 	$form = get_entity($sd->form_id);
-	if ($form && ($form->profile == 2)) {
+	if ($form && ($form->profile == FORM_GROUP_PROFILE)) {
 		// this is searching group profiles
 		set_context('groups');
-	} else if ($form && ($form->profile == 3)) {
+	} else if ($form && ($form->profile == FORM_FILE)) {
 		// this is searching files
 		set_context('file');
 	}
diff --git a/plugins/form/start.php b/plugins/form/start.php
index d3e6b7c6..0d4f2292 100755
--- a/plugins/form/start.php
+++ b/plugins/form/start.php
@@ -33,7 +33,9 @@
 			register_translations($CONFIG->pluginspath . "form/languages/formtrans/");
 			
 		// Register entity type
-			register_entity_type('object','form_data');
+			if (get_plugin_setting('register_user_content', 'form') == 'yes') {
+				register_entity_type('object','form_data');
+			}
 			
 		// Register a page handler, so we can have nice URLs
 			register_page_handler('form','form_page_handler');
@@ -43,16 +45,7 @@
 		// Register a URL handler for form data
 		register_entity_url_handler('form_data_url','object','form_data');
 		
-		extend_view('css','form/css');
-		
-		add_subtype('object', 'form:form');
-		add_subtype('object', 'form:config');
-		add_subtype('object', 'form:field');
-		add_subtype('object', 'form:field_map');
-		add_subtype('object', 'form:field_choice');
-		add_subtype('object', 'form:search_definition');
-		add_subtype('object', 'form_data');
-					
+		extend_view('css','form/css');			
 	}
 	
 	function form_pagesetup() {
@@ -71,18 +64,23 @@
 
 		$context = get_context();
 		
-		$form_id = get_input('form_id',get_input('id',0));
-		if (!$form_id && ($sid = get_input('sid',0))) {
-			$form_id = get_entity($sid)->form_id;
-		}
-		if ($form_id) {
-			$form = get_entity($form_id);
-			set_page_owner($form->getOwner());
+		if (in_array($context,array('form','form:content','form:admin'))) {
+		
+			$form_id = get_input('form_id',get_input('id',0));
+			if (!$form_id && ($sid = get_input('sid',0))) {
+				$form_id = get_entity($sid)->form_id;
+			}
+			if ($form_id) {
+				$form = get_entity($form_id);
+				set_page_owner($form->getOwner());
+			}
 		}
 		
-		$username = page_owner_entity()->username;
+		if (page_owner_entity()) {
+			$username = page_owner_entity()->username;
+		}
 		
-		if (get_context() == 'admin') {
+		if ($context == 'admin') {
 			$admin_url = $CONFIG->wwwroot.'mod/form/manage_all_forms.php';
 			if ($username) {
 				$admin_url .= '?username='.$username;
@@ -232,7 +230,7 @@
 		return false;
 	}
 	
-// Make sure the blog initialisation function is called on initialisation
+// Make sure the form event functions are called
 	register_elgg_event_handler('init','system','form_init');
 	register_elgg_event_handler('pagesetup','system','form_pagesetup');
 	
diff --git a/plugins/form/thumbnail.php b/plugins/form/thumbnail.php
new file mode 100644
index 00000000..67763b6a
--- /dev/null
+++ b/plugins/form/thumbnail.php
@@ -0,0 +1,58 @@
+<?php
+
+	/**
+	 * Elgg file thumbnail
+	 * 
+	 * @package ElggFile
+	 * @author Curverider Ltd
+	 * @copyright Curverider Ltd 2008-2009
+	 * @link http://elgg.com/
+	 */
+
+	// Get engine
+		require_once(dirname(dirname(dirname(__FILE__))) . "/engine/start.php");
+		
+	// Get file GUID
+		$file_guid = (int) get_input('file_guid',0);
+		
+	// Get file thumbnail size
+		$size = get_input('size','small');
+		
+	// Get file entity
+		if ($file = get_entity($file_guid)) {
+			
+			if ($file->getSubtype() == "file") {
+				
+				$simpletype = $file->simpletype;
+				if ($simpletype == "image") {
+					
+					// Get file thumbnail
+						if ($size == "tiny") {
+							$thumbfile = $file->thumbnail;
+						} else if ($size == "small") {
+							$thumbfile = $file->smallthumb;
+						} else {
+							$thumbfile = $file->largethumb;
+						}
+						
+					// Grab the file
+						if ($thumbfile && !empty($thumbfile)) {
+							$readfile = new ElggFile();
+							$readfile->owner_guid = $file->owner_guid;
+							$readfile->setFilename($thumbfile);
+							$mime = $file->getMimeType();
+							$contents = $readfile->grabFile();
+							
+							header("Content-type: $mime");
+							echo $contents;
+							exit;
+							
+						} 
+					
+				}
+				
+			}
+			
+		}
+		
+?>
\ No newline at end of file
diff --git a/plugins/form/views/default/form/display_field.php b/plugins/form/views/default/form/display_field.php
index 8e3085ec..64ef0385 100755
--- a/plugins/form/views/default/form/display_field.php
+++ b/plugins/form/views/default/form/display_field.php
@@ -17,9 +17,8 @@
 	 $description = $vars['description'];
 	 
 	 $body = <<<END
-<label>$title<br />
+<label>$title</label><br />
 $field
-</label>
 <p class="form-field-description">$description</p>
 END;
     print $body;
diff --git a/plugins/form/views/default/form/display_templates.php b/plugins/form/views/default/form/display_templates.php
index fb6b5261..926afb64 100755
--- a/plugins/form/views/default/form/display_templates.php
+++ b/plugins/form/views/default/form/display_templates.php
@@ -1,16 +1,25 @@
 <?php
+
+//TODO: support form templates for content forms as well
 $form = $vars['form'];
 $display_bit = '<div class="tabbertab" title="'.elgg_echo('form:display_templates_tab_label').'">';
 
-$display_bit .= '<label for="list_template">'.elgg_echo('form:list_template_label');
-$display_bit .= elgg_view('input/longtext',array('internalname'=>'list_template','value'=>$form->list_template));
-$display_bit .= '</label>';
-$display_bit .= '<p class="description">'.elgg_echo('form:list_template_description').'</p>';
-
-$display_bit .= '<label for="display_template">'.elgg_echo('form:display_template_label');
-$display_bit .= elgg_view('input/longtext',array('internalname'=>'display_template','value'=>$form->display_template));
-$display_bit .= '</label>';
-$display_bit .= '<p class="description">'.elgg_echo('form:display_template_description').'</p>';
+if ($form->profile == FORM_REGISTRATION) {
+	$display_bit .= '<label for="form_template">'.elgg_echo('form:form_template_label');
+	$display_bit .= elgg_view('form/input/longtext',array('internalname'=>'form_template','value'=>$form->form_template));
+	$display_bit .= '</label>';
+	$display_bit .= '<p class="description">'.elgg_echo('form:form_template_description').'</p>';
+} else {
+	$display_bit .= '<label for="list_template">'.elgg_echo('form:list_template_label');
+	$display_bit .= elgg_view('form/input/longtext',array('internalname'=>'list_template','value'=>$form->list_template));
+	$display_bit .= '</label>';
+	$display_bit .= '<p class="description">'.elgg_echo('form:list_template_description').'</p>';
+	
+	$display_bit .= '<label for="display_template">'.elgg_echo('form:display_template_label');
+	$display_bit .= elgg_view('form/input/longtext',array('internalname'=>'display_template','value'=>$form->display_template));
+	$display_bit .= '</label>';
+	$display_bit .= '<p class="description">'.elgg_echo('form:display_template_description').'</p>';
+}
 $display_bit .= '<input type="submit"  name="submit" value="'.elgg_echo('form:form_manage_button').'">';
 $display_bit .= '</div>';
 
diff --git a/plugins/form/views/default/form/field_list.php b/plugins/form/views/default/form/field_list.php
index 0198aa4f..e3448c8f 100755
--- a/plugins/form/views/default/form/field_list.php
+++ b/plugins/form/views/default/form/field_list.php
@@ -17,13 +17,13 @@ $moveup_img = sprintf($img_template,$moveup_msg,$moveup_msg,"16-em-open.png");
 $movedown_img = sprintf($img_template,$movedown_msg,$movedown_msg,"16-em-down.png");
 $movetop_img = sprintf($img_template,$movetop_msg,$movetop_msg,"16-em-left.png");
 $movebottom_img = sprintf($img_template,$movebottom_msg,$movebottom_msg,"16-em-right.png");
-
-$start_url = $vars['config']->wwwroot.'action/form/manage_field?form_action=move&id=%s&form_id=%s&direction=';
+$tokens = form_add_security_fields();
+$start_url = $vars['config']->wwwroot.'action/form/manage_field?form_action=move&id=%s&form_id=%s'.'&'.$tokens.'&direction=';
 $link_template = '<a onclick="javascript:$(\'#field_list\').load(\'%s%s\'); return false;" href="%s%s">%s</a>';
 
 $field_template = <<<END
-<a href="{$vars['config']->wwwroot}action/form/manage_field?form_action=edit&id=%s&form_id=%s&profile=$profile">$edit_img</a> |
-<a onclick="return confirm('$remove_confirm_msg')" href="{$CONFIG->wwwroot}action/form/manage_field?form_action=remove&id=%s&form_id=%s">$remove_img</a> |
+<a href="{$vars['config']->wwwroot}action/form/manage_field?form_action=edit&id=%s&form_id=%s&$tokens&profile=$profile">$edit_img</a> |
+<a onclick="return confirm('$remove_confirm_msg')" href="{$CONFIG->wwwroot}action/form/manage_field?form_action=remove&id=%s&form_id=%s&$tokens">$remove_img</a> |
 %s |
 %s |
 %s |
diff --git a/plugins/form/views/default/form/form_data_admin.php b/plugins/form/views/default/form/form_data_admin.php
index 19a6e536..11ff8db5 100755
--- a/plugins/form/views/default/form/form_data_admin.php
+++ b/plugins/form/views/default/form/form_data_admin.php
@@ -1,10 +1,11 @@
 <?php
+$tokens = form_add_security_fields();
 $manage_bit = '<div class="form-manage">';
 $manage_bit .= '<a href="'.$vars['url'].'mod/form/form.php?id='.$vars['form_id'].'&d='.$vars['form_data_id'].'">';
 $manage_bit .= elgg_echo('form:edit');
 $manage_bit .= '</a> | ';
 $manage_bit .= '<a onclick="return confirm(\''.elgg_echo('form:content_delete_confirm').'\')" ';
-$manage_bit .= 'href="'.$vars['url'].'action/form/manage_form_data?form_action=delete&d='.$vars['form_data_id'].'">';
+$manage_bit .= 'href="'.$vars['url'].'action/form/manage_form_data?form_action=delete&d='.$vars['form_data_id'].'&'.$tokens.'">';
 $manage_bit .= elgg_echo('form:delete');
 $manage_bit .= '</a>';
 $manage_bit .= '</div><br />';
diff --git a/plugins/form/views/default/form/forms/display_form.php b/plugins/form/views/default/form/forms/display_form.php
index c8eb0ccc..14986d6c 100755
--- a/plugins/form/views/default/form/forms/display_form.php
+++ b/plugins/form/views/default/form/forms/display_form.php
@@ -12,7 +12,8 @@
 	 * @link http://radagast.biz/
 	 */
 	 
-	 $tab_data = $vars['tab_data'];
+	 $form_tabs = $vars['tab_data'];
+	 $tab_data = $form_tabs['main'];
 	 $form = $vars['form'];
 	 $preview = $vars['preview'];
 	 $form_data_id = $vars['form_data_id'];
@@ -38,6 +39,7 @@ $description
 <div class="contentWrapper">
 <form action="{$vars['url']}action/form/submit" method="post" enctype="multipart/form-data">
 END;
+	$body .= elgg_view('input/securitytoken');
     $body .= elgg_view('input/hidden',array('internalname'=>'form_id', 'value'=>$form->getGUID()));
     $body .= elgg_view('input/hidden',array('internalname'=>'preview', 'value'=>$preview));
     $body .= elgg_view('input/hidden',array('internalname'=>'form_data_id', 'value'=>$form_data_id));
@@ -62,6 +64,8 @@ END;
             $body .= $html;
         }
     }
+    
+    $body .= $form_tabs['extra'];
                  
     $body .= elgg_view('input/submit', array('internalname'=>'submit','value'=>elgg_echo('form:submit')));
     $body .= '</form></div>';
diff --git a/plugins/form/views/default/form/forms/display_form_content.php b/plugins/form/views/default/form/forms/display_form_content.php
index 1960df38..5de0d757 100755
--- a/plugins/form/views/default/form/forms/display_form_content.php
+++ b/plugins/form/views/default/form/forms/display_form_content.php
@@ -33,14 +33,14 @@ $body .= elgg_view('input/hidden',array('internalname'=>'preview', 'value'=>$pre
 $body .= elgg_view('input/hidden',array('internalname'=>'form_data_id', 'value'=>$form_data_id));
 $body .= "<p class=\"form-description\">$description</p>";
 
-if (count($tab_data) > 1) {
+if (count($tab_data['main']) > 1) {
 	$body .= <<<END
 	<script type="text/javascript" src="{$CONFIG->wwwroot}mod/form/tabber/tabber.js"></script>
 	<link rel="stylesheet" href="{$CONFIG->wwwroot}mod/form/tabber/example.css" type="text/css" media="screen" />
 END;
 	$body .= '<div class="tabber">';
 	$body .= '<div class="tabberloading" ></div>';
-	foreach($tab_data as $tab => $html) {
+	foreach($tab_data['main'] as $tab => $html) {
 		if ($html) {
 			$body .= "<div class=\"tabbertab\" title=\"$tab\">";
 			$body .= $html;
@@ -48,10 +48,10 @@ END;
 		}
 	}
 	$body .= '</div>';
-} else if (count($tab_data) == 1) {
-	foreach($tab_data as $tab => $html) {
+} else if (count($tab_data['main']) == 1) {
+	foreach($tab_data['main'] as $tab => $html) {
 		$body .= $html;
 	}
 }
-echo $body;
+echo $body.$tab_data['extra'];
 ?>
\ No newline at end of file
diff --git a/plugins/form/views/default/form/forms/field_adders.php b/plugins/form/views/default/form/forms/field_adders.php
index 7774a73f..70b16235 100755
--- a/plugins/form/views/default/form/forms/field_adders.php
+++ b/plugins/form/views/default/form/forms/field_adders.php
@@ -26,11 +26,14 @@ $add_existing_title = elgg_echo('form:add_existing_title');
 $copy_existing_title = elgg_echo('form:copy_existing_title');
 $add_new_title =  elgg_echo('form:add_new_title');
 
+$tokens = elgg_view('input/securitytoken');
+
 $field_adders_tab = elgg_echo('form:field_adders_tab_label');
  
 $buttons = <<<END
 <div class="tabbertab" title="$field_adders_tab">
 <form action="{$vars['url']}action/form/manage_field" method="post">
+$tokens
 <input type="hidden" name="form_id" value="$form_id">
 <input type="hidden" name="form_action" value="add_new">
 <input type="hidden" name="profile" value="$profile">
@@ -46,6 +49,7 @@ $buttons .= <<<END
 </form>
 <br />
 <form action="{$vars['url']}action/form/manage_field" method="post">
+$tokens
 <input type="hidden" name="form_id" value="$form_id">
 <input type="hidden" name="form_action" value="add_existing">
 <input type="hidden" name="profile" value="$profile">
@@ -60,6 +64,7 @@ $buttons .= <<<END
 <input type="submit" name="submit" value="$add_existing_button"></span>
 </form>
 <form action="{$vars['url']}action/form/manage_field" method="post">
+$tokens
 <input type="hidden" name="form_id" value="$form_id">
 <input type="hidden" name="form_action" value="copy_existing">
 <input type="hidden" name="profile" value="$profile">
diff --git a/plugins/form/views/default/form/forms/list_fields.php b/plugins/form/views/default/form/forms/list_fields.php
index 10cb297c..c2dab282 100755
--- a/plugins/form/views/default/form/forms/list_fields.php
+++ b/plugins/form/views/default/form/forms/list_fields.php
@@ -28,17 +28,18 @@ if ($type == 'orphan') {
 $img_template = '<img border="0" width="16" height="16" alt="%s" title="%s" src="'.$CONFIG->wwwroot.'mod/form/images/%s" />';
 $edit_img = sprintf($img_template,$edit_msg,$edit_msg,"16-em-pencil.png");
 $delete_img = sprintf($img_template,$delete_msg,$delete_msg,"16-em-cross.png");
+$tokens = form_add_security_fields();
 
 $field_template = <<<END
-<a href="{$CONFIG->wwwroot}action/form/manage_field?form_action=edit_with_field_id&id=%s&type=%s&username=$username">$edit_img</a> |
-<a onclick="return confirm('$delete_confirm_msg')" href="{$CONFIG->wwwroot}action/form/manage_field?form_action=delete&id=%s&type=%s&username=$username">$delete_img</a>
+<a href="{$CONFIG->wwwroot}action/form/manage_field?form_action=edit_with_field_id&id=%s&type=%s&username=$username&$tokens">$edit_img</a> |
+<a onclick="return confirm('$delete_confirm_msg')" href="{$CONFIG->wwwroot}action/form/manage_field?form_action=delete&id=%s&type=%s&username=$username&$tokens">$delete_img</a>
 &nbsp;&nbsp;&nbsp;%s
 <br />
 END;
 
 $body .= '<div class="contentWrapper">';
 if ($type == 'orphan') {
-	$body .= '<p><b><a onclick="return confirm(\''.$delete_orphans_confirm_msg.'\')" href="'.$CONFIG->wwwroot.'action/form/manage_fields?form_action=delete_orphans&username='.$username.'">'.elgg_echo('form:delete_orphans').'</a></b></p> '."\n";
+	$body .= '<p><b><a onclick="return confirm(\''.$delete_orphans_confirm_msg.'\')" href="'.$CONFIG->wwwroot.'action/form/manage_field?form_action=delete_orphans&username='.$username.'&'.$tokens.'">'.elgg_echo('form:delete_orphans').'</a></b></p> '."\n";
     $body .= '<p>'.elgg_echo('form:orphan_list_description').'</p>'."\n";
 } else {
     $body .= '<p>'.elgg_echo('form:field_list_description').'</p>'."\n";
diff --git a/plugins/form/views/default/form/forms/list_search_definitions.php b/plugins/form/views/default/form/forms/list_search_definitions.php
index 5e79cf40..d6364b9c 100755
--- a/plugins/form/views/default/form/forms/list_search_definitions.php
+++ b/plugins/form/views/default/form/forms/list_search_definitions.php
@@ -17,10 +17,11 @@ $search_page = elgg_echo('form:search_page_link');
 $img_template = '<img border="0" width="16" height="16" alt="%s" title="%s" src="'.$CONFIG->wwwroot.'mod/form/images/%s" />';
 $edit_img = sprintf($img_template,$edit_msg,$edit_msg,"16-em-pencil.png");
 $delete_img = sprintf($img_template,$delete_msg,$delete_msg,"16-em-cross.png");
+$tokens = form_add_security_fields();
 
 $sd_template = <<<END
 <a href="{$CONFIG->wwwroot}mod/form/manage_search_definition.php?sid=%s">$edit_img</a> |
-<a onclick="return confirm('$delete_confirm_msg')" href="{$CONFIG->wwwroot}action/form/manage_search_definition?form_action=delete&sid=%s">$delete_img</a> |
+<a onclick="return confirm('$delete_confirm_msg')" href="{$CONFIG->wwwroot}action/form/manage_search_definition?form_action=delete&sid=%s&$tokens">$delete_img</a> |
 <a href="{$CONFIG->wwwroot}mod/form/search.php?sid=%s">$search_page</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;%s (%s)
 <br />
 END;
diff --git a/plugins/form/views/default/form/forms/manage_all_forms.php b/plugins/form/views/default/form/forms/manage_all_forms.php
index 6231a512..ad5180e3 100755
--- a/plugins/form/views/default/form/forms/manage_all_forms.php
+++ b/plugins/form/views/default/form/forms/manage_all_forms.php
@@ -21,10 +21,11 @@ $delete_img = sprintf($img_template,$delete_msg,$delete_msg,"16-em-cross.png");
 $export_text = elgg_echo('form:export');
 $preview_text = elgg_echo('form:preview');
 $link_text = elgg_echo('form:link');
+$tokens = form_add_security_fields();
 
 $form_template = <<<END
 <a href="{$CONFIG->wwwroot}mod/form/manage_form.php?id=%s">$edit_img</a> |
-<a onclick="return confirm('$delete_confirm_msg')" href="{$CONFIG->wwwroot}action/form/manage_form?form_action=delete&id=%s">$delete_img</a> |
+<a onclick="return confirm('$delete_confirm_msg')" href="{$CONFIG->wwwroot}action/form/manage_form?form_action=delete&id=%s&$tokens">$delete_img</a> |
 <a href="{$CONFIG->wwwroot}mod/form/form.php?id=%s&preview=true">$preview_text</a> |
 <a href="{$CONFIG->wwwroot}mod/form/form.php?id=%s">$link_text</a>
 &nbsp;&nbsp;&nbsp;%s
@@ -49,7 +50,7 @@ $body .= '</form>';*/
 
 $body .= '<h2>'.elgg_echo('form:form_list').'</h2><br />';
 
-$forms = get_entities('object','form:form');
+$forms = get_entities('object','form:form',0,"",1000);
 if ($forms) {
     foreach ($forms as $form) {
         $ident = $form->getGUID();
diff --git a/plugins/form/views/default/form/forms/manage_field.php b/plugins/form/views/default/form/forms/manage_field.php
index ed7522c8..d63eb578 100755
--- a/plugins/form/views/default/form/forms/manage_field.php
+++ b/plugins/form/views/default/form/forms/manage_field.php
@@ -50,14 +50,14 @@ if (!isset($vars['profile'])) {
 	if ($form_id) {
 		$profile = get_entity($form_id)->profile;
 	} else {
-    	$profile = 0;
+    	$profile = FORM_CONTENT;
 	}
 } else {
 	$profile = $vars['profile'];
 }
 
 if (!$profile) {
-	$profile = 0;
+	$profile = FORM_CONTENT;
 }
 
 // set up the field values
@@ -140,7 +140,7 @@ if ($field) {
     $profile_no_checked = '';
     $profile_yes_checked = '';
     
-    if (($profile == 1) || ($profile==2)) {
+    if (($profile == FORM_USER_PROFILE) || ($profile==FORM_GROUP_PROFILE)) {
         $profile_yes_checked = 'checked';
         $profile_class = 'visible';
     } else {
@@ -193,6 +193,7 @@ if ($field) {
     
     $choice_type_select_checked = '';
     $choice_type_radio_checked = '';
+    $choice_type_radio_with_other_checked = '';
     $choice_type_checkbox_checked = '';
     if ($field->choice_type == 'pulldown') {
         $choice_type_select_checked = 'checked';
@@ -200,6 +201,9 @@ if ($field) {
     } else if ($field->choice_type == 'radio') {
         $choice_type_radio_checked = 'checked';
         $orientation_class = 'visible';
+    } else if ($field->choice_type == 'radio_with_other') {
+        $choice_type_radio_with_other_checked = 'checked';
+        $orientation_class = 'visible';
     } else {
         $choice_type_checkbox_checked = 'checked';
         $orientation_class = 'visible';
@@ -248,18 +252,14 @@ if ($field) {
             
     $profile_no_checked = '';
     $profile_yes_checked = '';
-    if (($profile == 1) || ($profile == 2)) {
+    if (($profile == FORM_USER_PROFILE) || ($profile == FORM_GROUP_PROFILE)) {
         $profile_yes_checked = 'checked';
         $profile_class = 'visible';
-        $profile_bit = '<input type="hidden" name="profile" value="'.$profile.'1">';
     } else {
         $profile_no_checked = 'checked';
         $profile_class = 'invisible';
-        // for now lock this in
-        // will have a toggle when I introduce mixed forms
-        //$profile_bit = sprintf($profile_bit, $profile_no_checked, $profile_yes_checked);
-        $profile_bit = '<input type="hidden" name="profile" value="'.$profile.'">';
     }
+    $profile_bit = '<input type="hidden" name="profile" value="'.$profile.'">';
     
     $category = '';
     $subtype_filter = '';
@@ -277,6 +277,7 @@ if ($field) {
     
     $choice_type_select_checked = 'checked';
     $choice_type_radio_checked = '';
+    $choice_type_radio_with_other_checked = '';
     $choice_type_checkbox_checked = '';
     
     $orientation_horizontal_checked = 'checked';
@@ -473,6 +474,7 @@ $choice_field_type_description = elgg_echo('form:choice_field_type_description')
 
 $dropdown = elgg_echo('form:dropdown');
 $radio = elgg_echo('form:radio');
+$radio_with_other = elgg_echo('form:radio_with_other');
 $checkbox = elgg_echo('form:checkbox');
 
 $default_value_label = elgg_echo('form:default_value_label');
@@ -523,7 +525,7 @@ $access_options[''] = elgg_echo('form:use_system_default_access');
 );*/
 
 $access = '<select name="default_access">'."\n";
-foreach ($access_options AS $value => $label) {
+foreach ($access_options as $value => $label) {
     if ($value === $field_access) {
         $selected = 'selected';
     } else {
@@ -536,7 +538,7 @@ $access .= '</select>'."\n";
 
 $field_type_select = '<select name="field_type" onChange="vis();">'."\n";
 
-foreach ($form_field_types AS $value => $ft) {
+foreach ($form_field_types as $value => $ft) {
     if ($value == $field_type) {
         $selected = 'selected';
     } else {
@@ -558,7 +560,7 @@ $contact_options = array(
 
 $contact_radio = '';
 
-foreach ($contact_options AS $value => $label) {
+foreach ($contact_options as $value => $label) {
     if ($value == $contact_type) {
         $checked = 'checked';
     } else {
@@ -581,8 +583,7 @@ if ($number_of_options > 0) {
     }
 }
 
-if (!$profile) {
-	// currently only content forms support required fields
+if ($profile != FORM_FILE) {
 	$required_bit = <<<END
 	<label class="labelclass" for="required">$required_label</label>
 <input type="radio" name="required" value="0" $required_no_checked> $no
@@ -593,8 +594,21 @@ END;
 	$required_bit = '';
 }
 
+if ($profile != FORM_REGISTRATION) {
+	$admin_bit = <<<END
+	<label class="labelclass" for="admin_only">$admin_only_label</label>
+<input type="radio" name="admin_only" value="0" $admin_only_no_checked> $no
+<input type="radio" name="admin_only" value="1" $admin_only_yes_checked> $yes
+<p class="description">$admin_only_description</p>
+END;
+} else {
+	$admin_bit = '<input type="hidden" name="admin_only" value="'.$field->admin_only.'">';
+}
+
 // define the form
 
+$security_token = elgg_view('input/securitytoken');
+
 $body = <<< END
 <div class="contentWrapper">
 <p>$form_description</p>
@@ -605,7 +619,7 @@ $body = <<< END
 <input type="hidden" name="number_of_options" value="$number_of_options">
 <input type="hidden" name="type" value="$page_return_type">
 <input type="hidden" name="username" value="$username">
-
+$security_token
 <label class="labelclass" for="internal_name">$internal_name_label</label>
 <input type="text" class="standard" name="internal_name" value="$internal_name">
 <p class="description">$internal_name_description</p>
@@ -619,10 +633,7 @@ $body = <<< END
 <input type="text" class="standard" name="default_value" value="$default_value">
 <p class="description">$default_value_description</p>
 $required_bit
-<label class="labelclass" for="admin_only">$admin_only_label</label>
-<input type="radio" name="admin_only" value="0" $admin_only_no_checked> $no
-<input type="radio" name="admin_only" value="1" $admin_only_yes_checked> $yes
-<p class="description">$admin_only_description</p>
+$admin_bit
 <label class="labelclass" for="category">$category_label</label>
 <input type="text" class="standard" name="category" value="$category">
 <p class="description">$category_description</p>
@@ -638,6 +649,7 @@ $field_type_select
     <label class="labelclass" for="choice_type">$choice_field_type_label</label>
     <input type="radio" name="choice_type" onChange="javascript:vis();" value="pulldown" $choice_type_select_checked> $dropdown
     <input type="radio" name="choice_type" onChange="javascript:vis();" value="radio" $choice_type_radio_checked> $radio
+    <input type="radio" name="choice_type" onChange="javascript:vis();" value="radio_with_other" $choice_type_radio_with_other_checked> $radio_with_other
     <input type="radio" name="choice_type" onChange="javascript:vis();" value="checkboxes" $choice_type_checkbox_checked> $checkbox
     <p class="description">$choice_field_type_description</p>
     <div id="is_keyword_tag_config" class="$is_keyword_tag_class">
diff --git a/plugins/form/views/default/form/forms/manage_form.php b/plugins/form/views/default/form/forms/manage_form.php
index f30c46db..10722b97 100755
--- a/plugins/form/views/default/form/forms/manage_form.php
+++ b/plugins/form/views/default/form/forms/manage_form.php
@@ -38,8 +38,8 @@ if ($form) {
     $access_id = $form->access_id;
     $field_list = elgg_view('form/field_list',array('fields' => $vars['fields'],'form_id' => $form_id, 'profile' => $profile));
         
-    if (($profile == 0) || ($profile == 3)) {
-    	// this bit is just for data or file forms
+    if (($profile == FORM_CONTENT) || ($profile == FORM_FILE) || ($profile == FORM_REGISTRATION)) {
+    	// this bit is just for data, file or registration forms
         $display_bit = elgg_view('form/display_templates',array('form'=>$form));
     } else {
         $display_bit = '';
@@ -83,6 +83,9 @@ $tab_bit
 <input type="hidden" name="username" value="$username">
 END;
 
+// security token
+$body .= elgg_view('input/securitytoken');
+
 // form name
 $body .= '<label class="labelclass" for="form_name">'.elgg_echo('form:name_label').'</label>';
 $body .= elgg_view('input/text',array('internalname'=>'form_name','value'=>$form_name));
@@ -95,7 +98,7 @@ $body .= '<p class="description">'.elgg_echo('form:form_title_description').'</p
 
 // form content creation description
 $body .= '<label class="labelclass" for="description">'.elgg_echo('form:description_label').'</label>';
-$body .= elgg_view('input/longtext',array('internalname'=>'description','value'=>$description));
+$body .= elgg_view('form/input/longtext',array('internalname'=>'description','value'=>$description));
 $body .= '<p class="description">'.elgg_echo('form:form_description_description').'</p>';
 
 // form type
diff --git a/plugins/form/views/default/form/forms/manage_form_translation.php b/plugins/form/views/default/form/forms/manage_form_translation.php
index 9655668e..a4784638 100755
--- a/plugins/form/views/default/form/forms/manage_form_translation.php
+++ b/plugins/form/views/default/form/forms/manage_form_translation.php
@@ -35,6 +35,8 @@ $options = array(   0=>elgg_echo('form:text_from_database'),
                     1=>elgg_echo('form:use_translation_system') );
                     
 $body = '<form action="'.$CONFIG->wwwroot.'action/form/manage_form" method ="post" >';
+// security token
+$body .= elgg_view('input/securitytoken');
 $body .= elgg_view('input/hidden',array('internalname'=>'id', 'value'=>$form->getGUID()));
 $body .= elgg_view('input/hidden',array('internalname'=>'form_action', 'value'=>'translate_status'));
 
diff --git a/plugins/form/views/default/form/forms/manage_group_profile_categories.php b/plugins/form/views/default/form/forms/manage_group_profile_categories.php
index 6b7ac6db..970177fc 100755
--- a/plugins/form/views/default/form/forms/manage_group_profile_categories.php
+++ b/plugins/form/views/default/form/forms/manage_group_profile_categories.php
@@ -18,9 +18,11 @@ $body .= '<div class="contentWrapper">';
 $body .= '<p class="form-description">'.elgg_echo('form:manage_group_profile_categories_description').'</p>';
                     
 $body .= '<form action="'.$CONFIG->wwwroot.'action/form/manage_form" method ="post" >';
+// security token
+$body .= elgg_view('input/securitytoken');
 $body .= elgg_view('input/hidden',array('internalname'=>'form_action', 'value'=>'manage_group_profile_categories'));
 
-$body .= elgg_view('input/longtext',array('internalname'=>'group_profile_categories','value'=>$group_profile_categories));
+$body .= elgg_view('form/input/longtext',array('internalname'=>'group_profile_categories','value'=>$group_profile_categories));
 
 $body .= elgg_view('input/submit', array('internalname'=>'submit','value'=>elgg_echo('form:submit')));
 $body .= '</form>';
diff --git a/plugins/form/views/default/form/forms/manage_search_definition.php b/plugins/form/views/default/form/forms/manage_search_definition.php
index e7fd6226..a19e8cc1 100755
--- a/plugins/form/views/default/form/forms/manage_search_definition.php
+++ b/plugins/form/views/default/form/forms/manage_search_definition.php
@@ -42,6 +42,8 @@ if (isset($vars['search_definition_id']) && $vars['search_definition_id']) {
 $body = '<div class="contentWrapper">';
 
 $body .= '<form action="'.$vars['url'].'action/form/manage_search_definition" method="post">';
+// security token
+$body .= elgg_view('input/securitytoken');
 
 $body .= elgg_view('input/hidden',array('internalname'=>'form_id', 'value'=>$form_id));
 $body .= elgg_view('input/hidden',array('internalname'=>'form_action', 'value'=>$form_action));
diff --git a/plugins/form/views/default/form/input/longtext.php b/plugins/form/views/default/form/input/longtext.php
new file mode 100644
index 00000000..81b1f1c2
--- /dev/null
+++ b/plugins/form/views/default/form/input/longtext.php
@@ -0,0 +1,25 @@
+<?php
+
+	/**
+	 * Elgg long text input
+	 * Displays a long text input field
+	 * 
+	 * @package Elgg
+	 * @subpackage Core
+	 * @license http://www.gnu.org/licenses/old-licenses/gpl-2.0.html GNU Public License version 2
+	 * @author Curverider Ltd
+	 * @copyright Curverider Ltd 2008
+	 * @link http://elgg.org/
+	 * 
+	 * @uses $vars['value'] The current value, if any
+	 * @uses $vars['js'] Any Javascript to enter into the input tag
+	 * @uses $vars['internalname'] The name of the input field
+	 * 
+	 */
+
+	$class = $vars['class'];
+	if (!$class) $class = "input-textarea";
+	
+?>
+
+<textarea class="<?php echo $class; ?>" name="<?php echo $vars['internalname']; ?>" <?php if ($vars['disabled']) echo ' disabled="yes" '; ?> <?php echo $vars['js']; ?>><?php echo $vars['value']; ?></textarea> 
\ No newline at end of file
diff --git a/plugins/form/views/default/form/input/radio_with_other.php b/plugins/form/views/default/form/input/radio_with_other.php
new file mode 100644
index 00000000..5bd3f102
--- /dev/null
+++ b/plugins/form/views/default/form/input/radio_with_other.php
@@ -0,0 +1,57 @@
+<?php
+
+	/**
+	 * Elgg radio input
+	 * Displays a radio input field
+	 * 
+	 * @package Elgg
+	 * @subpackage Core
+	 * @license http://www.gnu.org/licenses/old-licenses/gpl-2.0.html GNU Public License version 2
+	 * @author Curverider Ltd
+	 * @copyright Curverider Ltd 2008
+	 * @link http://elgg.org/
+	 * 
+	 * @uses $vars['value'] The current value, if any
+	 * @uses $vars['js'] Any Javascript to enter into the input tag
+	 * @uses $vars['internalname'] The name of the input field
+	 * @uses $vars['options'] An array of strings representing the options for the radio field
+	 * 
+	 * Modified by Kevin Jardine to add orientation and "other" field
+	 * 
+	 */
+	
+	$class = $vars['class'];
+	if (!$class) $class = "input-radio";
+	
+	$orientation = $vars['orientation'];
+	if ($orientation == 'horizontal') {
+    	$ending = ' ';
+	} else {
+    	$ending = '<br />';
+	}
+	
+	if ($vars['disabled']) $disabled = ' disabled="yes" ';
+
+    foreach($vars['options'] as $option => $label) {
+        if ($option != $vars['value']) {
+            $selected = "";
+        } else {
+            $selected = "checked = \"checked\"";
+        }
+         
+        echo "<label><input type=\"radio\" $disabled {$vars['js']} name=\"{$vars['internalname']}\" value=\"".htmlentities($option, null, 'UTF-8')."\" {$selected} class=\"$class\" />{$label}</label>".$ending;
+    }
+    $label = elgg_echo('form:other');
+    echo "<label><input type=\"radio\" $disabled {$vars['js']} id=\"{$vars['internalname']}\" name=\"{$vars['internalname']}\" value=\"\" class=\"$class\" />{$label}</label>";
+	echo elgg_view('form/input/shorttext',array('internalid'=>$vars['internalname'].'_text'))
+?>
+<script type="text/javascript">
+$().ready(function() {
+	$("#<?php echo $vars['internalname']; ?>_text").change(function() {
+		$("#<?php echo $vars['internalname']; ?>").val($("#<?php echo $vars['internalname']; ?>_text").val());
+	});
+	$("#<?php echo $vars['internalname']; ?>_text").focus(function() {
+		$("#<?php echo $vars['internalname']; ?>").attr("checked", "checked");
+	});
+});
+</script>
\ No newline at end of file
diff --git a/plugins/form/views/default/form/input/shorttext.php b/plugins/form/views/default/form/input/shorttext.php
index d26f89ab..8fb2ab27 100755
--- a/plugins/form/views/default/form/input/shorttext.php
+++ b/plugins/form/views/default/form/input/shorttext.php
@@ -21,7 +21,12 @@
 	
 	$class = $vars['class'];
 	if (!$class) $class = "input-text";
+	if (isset($vars['internalid'])) {
+		$id_bit = ' id = "'.$vars['internalid'].'" ';
+	} else {
+		$id_bit = '';
+	}
 	
 ?>
 
-<input style="width:250px;" type="text" <?php if ($vars['disabled']) echo ' disabled="yes" '; ?> <?php echo $vars['js']; ?> name="<?php echo $vars['internalname']; ?>" value="<?php echo htmlentities($vars['value'], null, 'UTF-8'); ?>" class="<?php echo $class ?>"/> 
\ No newline at end of file
+<input style="width:250px;" type="text" <?php echo $id_bit; ?> <?php if ($vars['disabled']) echo ' disabled="yes" '; ?> <?php echo $vars['js']; ?> name="<?php echo $vars['internalname']; ?>" value="<?php echo htmlentities($vars['value'], null, 'UTF-8'); ?>" class="<?php echo $class ?>"/> 
\ No newline at end of file
diff --git a/plugins/form/views/default/form/nav.php b/plugins/form/views/default/form/nav.php
index dfcefbc8..22458aae 100755
--- a/plugins/form/views/default/form/nav.php
+++ b/plugins/form/views/default/form/nav.php
@@ -18,8 +18,8 @@ $url_start = $vars['url'].'mod/form/my_forms.php?id='.$vars['form_id'].'&amp;mod
 	<ul>
 		<li <?php echo $allselect; ?> ><a onclick="javascript:$('#form_wrapper').load('<?php echo $url_start; ?>&amp;form_view=all&amp;callback=true'); return false;" href="<?php echo $url_start; ?>&amp;form_view=all&amp;callback=true"><?php echo elgg_echo('all'); ?></a></li>
 		<?php if ($vars['enable_recommendations'])  {?>
-		<li <?php echo $recommendedselect; ?> ><a onclick="javascript:$('#form_wrapper').load('<?php echo $url_start; ?>&amp;form_view=recommendations&amp;callback=true'); return false;" href="<?php echo $url_start; ?>&amp;form_view=recommendations&amp;callback=true"><?php echo elgg_echo('form:recommended'); ?></a></li>
-		<? } ?>
+			<li <?php echo $recommendedselect; ?> ><a onclick="javascript:$('#form_wrapper').load('<?php echo $url_start; ?>&amp;form_view=recommendations&amp;callback=true'); return false;" href="<?php echo $url_start; ?>&amp;form_view=recommendations&amp;callback=true"><?php echo elgg_echo('form:recommended'); ?></a></li>
+		<?php } ?>
 		<li <?php echo $friendsselect; ?> ><a onclick="javascript:$('#form_wrapper').load('<?php echo $url_start; ?>&amp;form_view=friends&amp;callback=true'); return false;" href="<?php echo $url_start; ?>&amp;form_view=friends&amp;callback=true"><?php echo elgg_echo('friends'); ?></a></li>
 		<li <?php echo $mineselect; ?> ><a onclick="javascript:$('#form_wrapper').load('<?php echo $url_start; ?>&amp;form_view=mine&amp;callback=true'); return false;" href="<?php echo $url_start; ?>&amp;form_view=mine&amp;callback=true"><?php echo elgg_echo('mine'); ?></a></li>
 	</ul>
diff --git a/plugins/form/views/default/form/output/image.php b/plugins/form/views/default/form/output/image.php
index 7db638b8..76070ad2 100755
--- a/plugins/form/views/default/form/output/image.php
+++ b/plugins/form/views/default/form/output/image.php
@@ -6,6 +6,6 @@ if (!$size) {
     $size = 'large';
 }
 
-print '<img src="'.$vars['url'].'/mod/file/thumbnail.php?size='.$size.'&file_guid='.$value.'">';
+print '<img src="'.$vars['url'].'/mod/form/thumbnail.php?size='.$size.'&file_guid='.$value.'">';
 
 ?>
\ No newline at end of file
diff --git a/plugins/form/views/default/form/output/link.php b/plugins/form/views/default/form/output/link.php
new file mode 100644
index 00000000..d305a3d3
--- /dev/null
+++ b/plugins/form/views/default/form/output/link.php
@@ -0,0 +1,26 @@
+<?php
+
+	/**
+	 * Elgg link display
+	 */
+
+    $val = trim($vars['href']);
+    if (!empty($val)) {
+	    if ((substr_count($val, "http://") == 0) && (substr_count($val, "https://") == 0)) {
+	        $val = "http://" . $val;
+	    }
+	    
+	    if ($vars['is_action'])
+		{
+			$ts = time();
+			$token = generate_action_token($ts);
+	    	
+	    	$sep = "?";
+			if (strpos($val, '?')>0) $sep = "&";
+			$val = "$val{$sep}__elgg_token=$token&__elgg_ts=$ts";
+		}
+	    
+	    echo "<a href=\"{$val}\" target=\"_blank\">". htmlentities($vars['text'], ENT_QUOTES, 'UTF-8'). "</a>";
+    }
+
+?>
\ No newline at end of file
diff --git a/plugins/form/views/default/form/search_results.php b/plugins/form/views/default/form/search_results.php
index d7bbb028..b7174216 100755
--- a/plugins/form/views/default/form/search_results.php
+++ b/plugins/form/views/default/form/search_results.php
@@ -35,7 +35,7 @@ $count = $result[0];
 $entities = $result[1];
 
 if ($entities) {
-	if (($form->profile == 1) || ($form->profile == 2)) {
+	if (($form->profile == FORM_USER_PROFILE) || ($form->profile == FORM_GROUP_PROFILE)) {
 		echo elgg_view_entity_list($entities, $count, $offset, $limit, false, false);
 	} else {
         echo form_view_entity_list($entities, $form, $count, $offset, $limit, false, false);
diff --git a/plugins/form/views/default/form/search_results_simple.php b/plugins/form/views/default/form/search_results_simple.php
index fe32bc4b..11e0bc12 100755
--- a/plugins/form/views/default/form/search_results_simple.php
+++ b/plugins/form/views/default/form/search_results_simple.php
@@ -48,11 +48,13 @@ $count = $result[0];
 $entities = $result[1];
 
 if ($entities) {
-	if (($form->profile == 1) || ($form->profile == 2)) {
+	set_context('search');
+	if (in_array((int) $form->profile, array(1,2,3))) {
 		echo elgg_view_entity_list($entities, $count, $offset, $limit, false, false);
 	} else {
 		echo form_view_entity_list($entities, $form, $count, $offset, $limit, false, false);
 	}
+	set_context('form');
 } else {
     echo '<p>'.elgg_echo('form:no_search_results').'</p>';
 }
diff --git a/plugins/form/views/default/settings/form/edit.php b/plugins/form/views/default/settings/form/edit.php
index 01798eee..bb589ceb 100755
--- a/plugins/form/views/default/settings/form/edit.php
+++ b/plugins/form/views/default/settings/form/edit.php
@@ -15,6 +15,16 @@ $body .= elgg_echo('form:user_content_status_title');
 $body .= '<br />';
 $body .= elgg_view('input/radio',array('internalname'=>'params[user_content_area]','value'=>$form_user_content_area,'options'=>$options));
 
+if (get_plugin_setting('register_user_content', 'form') == 'yes') {
+	$form_register_user_content = 'yes';
+} else {
+	$form_register_user_content = 'no';
+}
+
+$body .= elgg_echo('form:user_content_register_title');
+$body .= '<br />';
+$body .= elgg_view('input/radio',array('internalname'=>'params[register_user_content]','value'=>$form_register_user_content,'options'=>$options));
+
 echo $body;
 
 ?>
\ No newline at end of file
-- 
GitLab