5 files changed, 52 insertions, 17 deletions

diff --git a/frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js b/frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js
index 2295d3f..369b9ce 100644
--- a/frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js
+++ b/frontend/beta/js/Clipperz/PM/BookmarkletProcessor.js
@@ -93,97 +93,97 @@ Clipperz.PM.BookmarkletProcessor.prototype = MochiKit.Base.update(null, {
         },
         
         //-------------------------------------------------------------------------
 
         'configuration': function() {
                 return this._configuration;
         },
 
         //-------------------------------------------------------------------------
 
         'recordTitle': function() {
                 if (this._recordTitle == null) {
                         this._recordTitle = this.configuration().page.title;
                 }
                 
                 return this._recordTitle;
         },
 
         //-------------------------------------------------------------------------
 
         'fields': function() {
                 return this.configuration().form.inputs;
         },
 
         //-------------------------------------------------------------------------
 
         'editableFields': function() {
                 if (this._editableFields == null) {
                         this._editableFields = MochiKit.Base.filter(function(aField) {
                                 var result;
                                 var type;
                 
                                 type = aField['type'].toLowerCase();
                                 result = ((type != 'hidden') && (type != 'submit') && (type != 'checkbox') && (type != 'radio') && (type != 'select'));
                 
                                 return result;
                         }, this.fields())
                 }
                 
                 return this._editableFields;
         },
 
         //-------------------------------------------------------------------------
 
         'hostname': function() {
                 if (this._hostname == null) {
                         var actionUrl;
                         
-                        actionUrl = this.configuration()['form']['attributes']['action'];
+                        actionUrl = Clipperz.Base.sanitizeUrl(this.configuration()['form']['attributes']['action']);
 //MochiKit.Logging.logDebug("+++ actionUrl: " + actionUrl);
                         this._hostname = actionUrl.replace(/^https?:\/\/([^\/]*)\/.*/, '$1');
                 }
                 
                 return this._hostname;
         },
         
         'favicon': function() {
                 if (this._favicon == null) {
                         this._favicon = "http://" + this.hostname() + "/favicon.ico";
 //MochiKit.Logging.logDebug("+++ favicon: " + this._favicon);
                 }
                 
                 return this._favicon;
         },
         
         //-------------------------------------------------------------------------
         
         'record': function() {
                 if (this._record == null) {
                         var record;
                         var recordVersion;
                         var directLogin;
                         var bindings;
                         var i,c;
                         
                         record = new Clipperz.PM.DataModel.Record({
                                                                 label:this.recordTitle(),
                                                                 notes:"",
                                                                 user:this.user()
                         });
                         recordVersion = new Clipperz.PM.DataModel.RecordVersion(record, {})
                         record.setCurrentVersion(recordVersion);
                         
                         bindings = {};
                         
                         c = this.editableFields().length;
                         for (i=0; i<c; i++) {
                                 var formField;
                                 var recordField;
 
 //MochiKit.Logging.logDebug(">>> adding a field");
                                 formField = this.editableFields()[i];
                                 recordField = new Clipperz.PM.DataModel.RecordField({
                                                                         recordVersion:recordVersion,
                                                                         label:formField['name'],
                                                                         value:formField['value'],
                                                                         type:Clipperz.PM.Strings.inputTypeToRecordFieldType[formField['type']],
diff --git a/frontend/beta/js/Clipperz/PM/Components/RecordDetail/DirectLoginBindingComponent.js b/frontend/beta/js/Clipperz/PM/Components/RecordDetail/DirectLoginBindingComponent.js
index 0e4640e..a5a4697 100644
--- a/frontend/beta/js/Clipperz/PM/Components/RecordDetail/DirectLoginBindingComponent.js
+++ b/frontend/beta/js/Clipperz/PM/Components/RecordDetail/DirectLoginBindingComponent.js
@@ -55,115 +55,115 @@ YAHOO.extendX(Clipperz.PM.Components.RecordDetail.DirectLoginBindingComponent, C
 
         //-------------------------------------------------------------------------
 
         'directLoginBinding': function() {
                 return this._directLoginBinding;
         },
 
         //-------------------------------------------------------------------------
 
         'render': function() {
         //      Clipperz.YUI.DomHelper.append(this.element().dom, {tag:'span', style:'font-weight:bold;', html:this.directLoginBinding().key()})
         //      Clipperz.YUI.DomHelper.append(this.element().dom, {tag:'span', html:this.directLoginBinding().value()})
 //MochiKit.Logging.logDebug(">>> DirectLoginBindingComponent.render");
                 Clipperz.YUI.DomHelper.append(this.element().dom, {tag:'td', cls:'directLoginBindingLabelTD', children:[
                         {tag:'span', html:this.directLoginBinding().key()}
                 ]});
 //MochiKit.Logging.logDebug("--- DirectLoginBindingComponent.render - 1");
                 Clipperz.YUI.DomHelper.append(this.element().dom, {tag:'td', cls:'directLoginBindingValueTD', children:[
                         {tag:'div', id:this.getId('editModeBox'), children:[
                                 {tag:'select', id:this.getId('select'), children:this.recordFieldOptions()}
                         ]},
                         {tag:'div', id:this.getId('viewModeBox'), children:[
                                 {tag:'span', id:this.getId('viewValue'), html:""}
                         ]}
                 ]});
 //MochiKit.Logging.logDebug("--- DirectLoginBindingComponent.render - 2");
                 this.getElement('editModeBox').setVisibilityMode(YAHOO.ext.Element.DISPLAY);
                 this.getElement('viewModeBox').setVisibilityMode(YAHOO.ext.Element.DISPLAY);
 
                 this.update();
 //MochiKit.Logging.logDebug("<<< DirectLoginBindingComponent.render");
         },
 
         //-------------------------------------------------------------------------
 
         'recordFieldOptions': function() {
                         varresult;
                 var option;
                         varrecordFieldKey;
                         varrecordFields;
 
 //MochiKit.Logging.logDebug(">>> DirectLoginBindingComponent.recordFieldOptions");
                 recordFields = this.directLoginBinding().directLogin().record().currentVersion().fields();
                 result = [];
                 option = {tag:'option', value:null, html:'---'};
                 result.push(option);
                 for (recordFieldKey in recordFields) {
         //TODO: remove the value: field and replace it with element.dom.value = <some value>
-                        option = {tag:'option', value:recordFieldKey, html:recordFields[recordFieldKey].label()}
+                        option = {tag:'option', value:recordFieldKey, html:Clipperz.Base.sanitizeString(recordFields[recordFieldKey].label())}
                         if (recordFieldKey == this.directLoginBinding().fieldKey()) {
                                 option['selected'] = true;
                         }
                         result.push(option);
                 }
 //MochiKit.Logging.logDebug("<<< DirectLoginBindingComponent.recordFieldOptions");
                 
                 return result;
         },
 
         //-------------------------------------------------------------------------
 
         'syncAndUpdateEditMode': function() {
                 this.synchronizeComponentValues();
                 this.updateEditMode();
         },
         
         'updateEditMode': function() {
                         varselectElementBox;
 
 //MochiKit.Logging.logDebug(">>> DirectLoginBindingComponent.updateEditMode");
                 this.getElement('viewModeBox').hide();
 
                 selectElementBox = this.getElement('editModeBox');
                 selectElementBox.update("");
 
                 Clipperz.YUI.DomHelper.append(selectElementBox.dom, {tag:'select', id:this.getId('select'), children:this.recordFieldOptions()});
 
 /*
                 selectElement = this.getElement('select');
                 
                 selectElement.update("");
                 MochiKit.Iter.forEach(this.recordFieldOptions(), function(anOption) {
                         Clipperz.YUI.DomHelper.append(selectElement.dom, anOption);
                 });
 */
 
 
                 this.getElement('editModeBox').show();
 //MochiKit.Logging.logDebug("<<< DirectLoginBindingComponent.updateEditMode");
         },
         
         //-------------------------------------------------------------------------
 
         'updateViewMode': function() {
 //MochiKit.Logging.logDebug(">>> DirectLoginBindingComponent.updateViewMode");
                 this.getElement('editModeBox').hide();
                 this.getElement('viewModeBox').show();
 
-                this.getElement('viewValue').update(this.directLoginBinding().field().label());
+                this.getElement('viewValue').update(Clipperz.Base.sanitizeString(this.directLoginBinding().field().label()));
 //MochiKit.Logging.logDebug("<<< DirectLoginBindingComponent.updateViewMode");
         },
 
         //-------------------------------------------------------------------------
 
         'synchronizeComponentValues': function() {
 //MochiKit.Logging.logDebug(">>> DirectLoginBindingComponent.synchronizeComponentValues")
 //MochiKit.Logging.logDebug("--- DirectLoginBindingComponent.synchronizeComponentValues - 1 - " + this.getId('select'));
                 this.directLoginBinding().setFieldKey(this.getDom('select').value);
 //MochiKit.Logging.logDebug("<<< DirectLoginBindingComponent.synchronizeComponentValues");
         },
 
         //-------------------------------------------------------------------------
         __syntaxFix__: "syntax fix"
 });
 
diff --git a/frontend/beta/js/Clipperz/PM/DataModel/DirectLogin.js b/frontend/beta/js/Clipperz/PM/DataModel/DirectLogin.js
index c0cfa3c..56d9d59 100644
--- a/frontend/beta/js/Clipperz/PM/DataModel/DirectLogin.js
+++ b/frontend/beta/js/Clipperz/PM/DataModel/DirectLogin.js
@@ -1,187 +1,195 @@
 /*
 
 Copyright 2008-2013 Clipperz Srl
 
 This file is part of Clipperz, the online password manager.
 For further information about its features and functionalities please
 refer to http://www.clipperz.com.
 
 * Clipperz is free software: you can redistribute it and/or modify it
   under the terms of the GNU Affero General Public License as published
   by the Free Software Foundation, either version 3 of the License, or 
   (at your option) any later version.
 
 * Clipperz is distributed in the hope that it will be useful, but 
   WITHOUT ANY WARRANTY; without even the implied warranty of 
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
   See the GNU Affero General Public License for more details.
 
 * You should have received a copy of the GNU Affero General Public
   License along with Clipperz. If not, see http://www.gnu.org/licenses/.
 
 */
 
 if (typeof(Clipperz) == 'undefined') { Clipperz = {}; }
 if (typeof(Clipperz.PM) == 'undefined') { Clipperz.PM = {}; }
 if (typeof(Clipperz.PM.DataModel) == 'undefined') { Clipperz.PM.DataModel = {}; }
 
 
 //#############################################################################
 
 Clipperz.PM.DataModel.DirectLogin = function(args) {
 //MochiKit.Logging.logDebug(">>> new Clipperz.PM.DataModel.DirectLogin");
 //console.log(">>> new Clipperz.PM.DataModel.DirectLogin - args: %o", args);
 //console.log("--- formData: %s", Clipperz.Base.serializeJSON(args.formData));
         args = args || {};
 
 //MochiKit.Logging.logDebug("--- new Clipperz.PM.DataModel.DirectLogin - args: " + Clipperz.Base.serializeJSON(MochiKit.Base.keys(args)));
         this._record = args.record || null;
         this._label = args.label || "unnamed record"
         this._reference = args.reference || Clipperz.PM.Crypto.randomKey();
-        this._favicon = args.favicon || null;
+        this._favicon = Clipperz.Base.sanitizeFavicon(args.favicon) || null;
         this._bookmarkletVersion = args.bookmarkletVersion || "0.1";
 
         this._directLoginInputs = null;
         
         this._formValues = args.formValues || {};
         this.setFormData(args.formData || null);
 //console.log("=== formData: %o", this.formData());
 
         if (args.legacyBindingData == null) {
                 this.setBindingData(args.bindingData || null);
         } else {
                 this.setLegacyBindingData(args.legacyBindingData);
         }
 
         this._fixedFavicon = null;
         
         //this._formValues = args.formValues || (this.hasValuesToSet() ? {} : null);
 //MochiKit.Logging.logDebug("<<< new Clipperz.PM.DataModel.DirectLogin");
         
         return this;
 }
 
 Clipperz.PM.DataModel.DirectLogin.prototype = MochiKit.Base.update(null, {
 
         'remove': function() {
                 this.record().removeDirectLogin(this);
         },
         
         //-------------------------------------------------------------------------
 
         'record': function() {
                 return this._record;
         },
 
         //-------------------------------------------------------------------------
 
         'user': function() {
                 return this.record().user();
         },
         
         //-------------------------------------------------------------------------
 
         'reference': function() {
                 return this._reference;
         },
 
         //-------------------------------------------------------------------------
 
         'label': function() {
                 return this._label;
         },
 
         'setLabel': function(aValue) {
                 this._label = aValue;
         },
         
         //-------------------------------------------------------------------------
 
         'favicon': function() {
                 if (this._favicon == null) {
                                 varactionUrl;
                         var hostname;
                         
-                        actionUrl = this.formData()['attributes']['action'];
+                        actionUrl = this.action();
                         hostname = actionUrl.replace(/^https?:\/\/([^\/]*)\/.*/, '$1');
-                        this._favicon = "http://" + hostname + "/favicon.ico";
+                        this._favicon = Clipperz.Base.sanitizeFavicon("http://" + hostname + "/favicon.ico");
                 }
 
                 return this._favicon;
         },
 
         //-------------------------------------------------------------------------
 
         'fixedFavicon': function() {
                 var result;
                 
                 if (this._fixedFavicon == null) {
                         result = this.favicon();
 
                         if (Clipperz_IEisBroken) {
                                 if (this.user().preferences().disableUnsecureFaviconLoadingForIE()) {
                                         if (result.indexOf('https://') != 0) {
                                                 result = Clipperz.PM.Strings['defaultFaviconUrl_IE'];
                                                 this.setFixedFavicon(result);
                                         }
                                 }
                         }
                 } else {
                         result = this._fixedFavicon;
                 }
                 
                 return result;
         },
 
         'setFixedFavicon': function(aValue) {
                 this._fixedFavicon = aValue;
         },
         
+        'action': function () {
+                        varresult;
+                
+                result = Clipperz.Base.sanitizeUrl(this.formData()['attributes']['action']);
+                
+                return result;
+        },
+        
         //-------------------------------------------------------------------------
 
         'bookmarkletVersion': function() {
                 return this._bookmarkletVersion;
         },
         
         'setBookmarkletVersion': function(aValue) {
                 this._bookmarkletVersion = aValue;
         },
         
         //-------------------------------------------------------------------------
 
         'formData': function() {
                 return this._formData;
         },
 
         'setFormData': function(aValue) {
                 var formData;
                 
 //MochiKit.Logging.logDebug(">>> DirectLogin.setFormData - " + Clipperz.Base.serializeJSON(aValue));
                 switch (this.bookmarkletVersion()) {
                         case "0.2":
                                 formData = aValue;
                                 break;
                         case "0.1":
 //MochiKit.Logging.logDebug("--- DirectLogin.setFormData - fixing form data from bookmarklet version 0.1");
                                 formData = this.fixFormDataFromBookmarkletVersion_0_1(aValue);
                                 break;
                 }
 
                 this._formData = aValue;
                 this.setBookmarkletVersion("0.2");
 
 //MochiKit.Logging.logDebug("--- DirectLogin.setFormData - formData: " + Clipperz.Base.serializeJSON(formData));
                 if (formData != null) {
                         var i,c;
                         
                         this._directLoginInputs = [];
                         c = formData['inputs'].length;
                         for (i=0; i<c; i++) {
                                 var directLoginInput;
                                 
                                 directLoginInput = new Clipperz.PM.DataModel.DirectLoginInput(this, formData['inputs'][i]);
                                 this._directLoginInputs.push(directLoginInput);
                         }
                 }
 //MochiKit.Logging.logDebug("<<< DirectLogin.setFormData");
         },
@@ -397,135 +405,135 @@ Clipperz.PM.DataModel.DirectLogin.prototype = MochiKit.Base.update(null, {
         },
         
         //=========================================================================
         
         'runHttpAuthDirectLogin': function(aWindow) {
                 MochiKit.DOM.withWindow(aWindow, MochiKit.Base.bind(function() {
                         var completeUrl;
                         var url;
                         
                         url = this.bindings()['url'].field().value();
 
                         if (/^https?\:\/\//.test(url) == false) {
                                 url = 'http://' + url;
                         }
                         
                         if (Clipperz_IEisBroken === true) {
                                 completeUrl = url;
                         } else {
                                 var username;
                                 var password;
 
                                 username = this.bindings()['username'].field().value();
                                 password = this.bindings()['password'].field().value();
 
                                 /(^https?\:\/\/)?(.*)/.test(url);
 
                                 completeUrl = RegExp.$1 + username + ':' + password + '@' + RegExp.$2;
                         }
                         
                         MochiKit.DOM.currentWindow().location.href = completeUrl;
                 }, this));
         },
         
         //-------------------------------------------------------------------------
 
         'runSubmitFormDirectLogin': function(aWindow) {
                 MochiKit.DOM.withWindow(aWindow, MochiKit.Base.bind(function() {
                         var formElement;
                                 varformSubmitFunction;
                         var submitButtons;
                         
 //MochiKit.Logging.logDebug("### runDirectLogin - 3");
         //              MochiKit.DOM.currentDocument().write('<html><head><title>' + this.label() + '</title><META http-equiv="Content-Type" content="text/html; charset=utf-8" /></head><body></body></html>')
 //MochiKit.Logging.logDebug("### runDirectLogin - 3.1");
                         MochiKit.DOM.appendChildNodes(MochiKit.DOM.currentDocument().body, MochiKit.DOM.H3(null, "Loading " + this.label() + " ..."));
 //MochiKit.Logging.logDebug("### runDirectLogin - 4");
 //console.log(this.formData()['attributes']);
                                 formElement = MochiKit.DOM.FORM(MochiKit.Base.update({id:'directLoginForm'}, {'method':this.formData()['attributes']['method'],
-                                                                                                                                                                                        'action':this.formData()['attributes']['action']}));
+                                                                                                                                                                                        'action': this.action()}));
 //MochiKit.Logging.logDebug("### runDirectLogin - 5");
                         formSubmitFunction = MochiKit.Base.method(formElement, 'submit');
 //MochiKit.Logging.logDebug("### runDirectLogin - 6");
 
                         MochiKit.DOM.appendChildNodes(MochiKit.DOM.currentDocument().body,
                                 MochiKit.DOM.DIV({style:'display:none; visibility:hidden;'}, formElement)
                         );
 //MochiKit.Logging.logDebug("### runDirectLogin - 7");
                                 MochiKit.DOM.appendChildNodes(formElement, MochiKit.Base.map(MochiKit.Base.methodcaller("formConfiguration"),
                                                                                                                                                         this.directLoginInputs()));
 //MochiKit.Logging.logDebug("### runDirectLogin - 8");
 
                         submitButtons = MochiKit.Base.filter(function(anInputElement) {
 //MochiKit.Logging.logDebug("### runDirectLogin - 8.1 - " + anInputElement);
 //MochiKit.Logging.logDebug("### runDirectLogin - 8.2 - " + anInputElement.tagName);
 //MochiKit.Logging.logDebug("### runDirectLogin - 8.3 - " + anInputElement.getAttribute('type'));
                                 return ((anInputElement.tagName.toLowerCase() == 'input') && (anInputElement.getAttribute('type').toLowerCase() == 'submit'));
                         }, formElement.elements)
 //MochiKit.Logging.logDebug("### runDirectLogin - 9");
 
                         if (submitButtons.length == 0) {
 //MochiKit.Logging.logDebug("### OLD submit")
                                 if (Clipperz_IEisBroken == true) {
 //MochiKit.Logging.logDebug("### runDirectLogin - 10");
                                         formElement.submit();
                                 } else {
 //MochiKit.Logging.logDebug("### runDirectLogin - 11");
                                         formSubmitFunction();
                                 }
                         } else {
 //MochiKit.Logging.logDebug("### NEW submit")
                                 submitButtons[0].click();
                         }
 
                 }, this));
         },
         
         //-------------------------------------------------------------------------
 
         'runDirectLogin': function(aNewWindow) {
                         varnewWindow;
 
 //console.log("formData.attributes", this.formData()['attributes']);
         //      if (/^javascript/.test(this.formData()['attributes']['action'])) {
-                if ((/^(https?|webdav|ftp)\:/.test(this.formData()['attributes']['action']) == false) &&
-                        (this.formData()['attributes']['type'] != 'http_auth'))
-                {
+                if ((/^(https?|webdav|ftp)\:/.test(this.action()) == false) &&
+                        (this.formData()['attributes']['type'] != 'http_auth')
+                ) {
                         var messageBoxConfiguration;
 
                         if (typeof(aNewWindow) != 'undefined') {
                                 aNewWindow.close();
                         }
 
                         messageBoxConfiguration = {};
                         messageBoxConfiguration.title = Clipperz.PM.Strings['VulnerabilityWarning_Panel_title'];
                         messageBoxConfiguration.msg = Clipperz.PM.Strings['VulnerabilityWarning_Panel_message'];
                         messageBoxConfiguration.animEl = YAHOO.ext.Element.get("mainDiv");
                         messageBoxConfiguration.progress = false;
                         messageBoxConfiguration.closable = false;
                         messageBoxConfiguration.buttons = {'cancel': Clipperz.PM.Strings['VulnerabilityWarning_Panel_buttonLabel']};
 
                         Clipperz.YUI.MessageBox.show(messageBoxConfiguration);
 
                         throw Clipperz.Base.exception.VulnerabilityIssue;
                 }
 
 //MochiKit.Logging.logDebug("### runDirectLogin - 1 : " + Clipperz.Base.serializeJSON(this.serializedData()));
                 if (typeof(aNewWindow) == 'undefined') {
                         newWindow = window.open(Clipperz.PM.Strings['directLoginJumpPageUrl'], "");
                 } else {
                         newWindow = aNewWindow;
                 }
 //MochiKit.Logging.logDebug("### runDirectLogin - 2");
 
                 if (this.formData()['attributes']['type'] == 'http_auth') {
                         this.runHttpAuthDirectLogin(newWindow);
                 } else {
                         this.runSubmitFormDirectLogin(newWindow)
                 }
         },
 
         //-------------------------------------------------------------------------
         __syntaxFix__: "syntax fix"
         
 });
 
diff --git a/frontend/beta/js/Clipperz/PM/DataModel/DirectLoginReference.js b/frontend/beta/js/Clipperz/PM/DataModel/DirectLoginReference.js
index 236d7c9..ba302da 100644
--- a/frontend/beta/js/Clipperz/PM/DataModel/DirectLoginReference.js
+++ b/frontend/beta/js/Clipperz/PM/DataModel/DirectLoginReference.js
@@ -2,97 +2,97 @@
 
 Copyright 2008-2013 Clipperz Srl
 
 This file is part of Clipperz, the online password manager.
 For further information about its features and functionalities please
 refer to http://www.clipperz.com.
 
 * Clipperz is free software: you can redistribute it and/or modify it
   under the terms of the GNU Affero General Public License as published
   by the Free Software Foundation, either version 3 of the License, or 
   (at your option) any later version.
 
 * Clipperz is distributed in the hope that it will be useful, but 
   WITHOUT ANY WARRANTY; without even the implied warranty of 
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
   See the GNU Affero General Public License for more details.
 
 * You should have received a copy of the GNU Affero General Public
   License along with Clipperz. If not, see http://www.gnu.org/licenses/.
 
 */
 
 if (typeof(Clipperz) == 'undefined') { Clipperz = {}; }
 if (typeof(Clipperz.PM) == 'undefined') { Clipperz.PM = {}; }
 if (typeof(Clipperz.PM.DataModel) == 'undefined') { Clipperz.PM.DataModel = {}; }
 
 
 //#############################################################################
 
 Clipperz.PM.DataModel.DirectLoginReference = function(args) {
         args = args || {};
 
 //MochiKit.Logging.logDebug(">>> new DirectLoginReference: " + Clipperz.Base.serializeJSON(MochiKit.Base.keys(args)));
 //MochiKit.Logging.logDebug(">>> new DirectLoginReference - record: " + args.record);
         this._user = args.user;
         
         if (args.directLogin != null) {
                 this._reference = args.directLogin.reference();
                 this._recordReference = args.directLogin.record().reference();
                 this._label = args.directLogin.label();
                 this._favicon = args.directLogin.favicon() || null;
 
                 this._directLogin = args.directLogin;
                 this._record = args.directLogin.record();
         } else {
                 this._reference = args.reference;
                 this._recordReference = args.record;
                 this._label = args.label;
-                this._favicon = args.favicon || null;
+                this._favicon = Clipperz.Base.sanitizeFavicon(args.favicon) || null;
         
                 this._directLogin = null;
                 this._record = null;
         }
 
         this._fixedFavicon = null;
         
         return this;
 }
 
 Clipperz.PM.DataModel.DirectLoginReference.prototype = MochiKit.Base.update(null, {
 
         'user': function() {
                 return this._user;
         },
         
         //-------------------------------------------------------------------------
 
         'reference': function() {
                 return this._reference;
         },
 
         //-------------------------------------------------------------------------
 
         'synchronizeValues': function(aDirectLogin) {
                 this._label = aDirectLogin.label();
                 this._favicon = aDirectLogin.favicon();
         },
 
         //-------------------------------------------------------------------------
 
         'label': function() {
                 return this._label;
         },
 
         //-------------------------------------------------------------------------
 
         'recordReference': function() {
                 return this._recordReference;
         },
 
         //-------------------------------------------------------------------------
 
         'record': function() {
 //MochiKit.Logging.logDebug(">>> DirectLoginReference.record");
                 if (this._record == null) {
                         this._record = this.user().records()[this.recordReference()];
                 }
diff --git a/frontend/beta/js/Clipperz/PM/Proxy/Proxy.Offline.DataStore.js b/frontend/beta/js/Clipperz/PM/Proxy/Proxy.Offline.DataStore.js
index 1a5caff..b0b9b63 100644
--- a/frontend/beta/js/Clipperz/PM/Proxy/Proxy.Offline.DataStore.js
+++ b/frontend/beta/js/Clipperz/PM/Proxy/Proxy.Offline.DataStore.js
@@ -1,87 +1,88 @@
 /*
 
 Copyright 2008-2013 Clipperz Srl
 
 This file is part of Clipperz, the online password manager.
 For further information about its features and functionalities please
 refer to http://www.clipperz.com.
 
 * Clipperz is free software: you can redistribute it and/or modify it
   under the terms of the GNU Affero General Public License as published
   by the Free Software Foundation, either version 3 of the License, or 
   (at your option) any later version.
 
 * Clipperz is distributed in the hope that it will be useful, but 
   WITHOUT ANY WARRANTY; without even the implied warranty of 
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
   See the GNU Affero General Public License for more details.
 
 * You should have received a copy of the GNU Affero General Public
   License along with Clipperz. If not, see http://www.gnu.org/licenses/.
 
 */
 
 try { if (typeof(Clipperz.PM.Proxy.Offline) == 'undefined') { throw ""; }} catch (e) {
         throw "Clipperz.PM.Proxy.Offline.DataStore depends on Clipperz.PM.Proxy.Offline!";
 }  
 
 //=============================================================================
 
 Clipperz.PM.Proxy.Offline.DataStore = function(args) {
         args = args || {};
         
         this._data = args.data || (typeof(_clipperz_dump_data_) != 'undefined' ? _clipperz_dump_data_ : null);
         this._isReadOnly = (typeof(args.readOnly) == 'undefined' ? true : args.readOnly);
         this._shouldPayTolls = args.shouldPayTolls || false;
 
         this._tolls = {};
         this._connections = {};
 
+        this._C = null;
         this._b = null;
         this._B = null;
         this._A = null;
         this._userData = null;
 
         return this;
 }
 
 //Clipperz.Base.extend(Clipperz.PM.Proxy.Offline.DataStore, Object, {
 Clipperz.PM.Proxy.Offline.DataStore.prototype = MochiKit.Base.update(null, {
 
         //-------------------------------------------------------------------------
 
         'isReadOnly': function () {
                 return this._isReadOnly;
         },
         
         //-------------------------------------------------------------------------
 
         'shouldPayTolls': function() {
                 return this._shouldPayTolls;
         },
 
         //-------------------------------------------------------------------------
 
         'data': function () {
                 return this._data;
         },
 
         //-------------------------------------------------------------------------
 
         'tolls': function () {
                 return this._tolls;
         },
 
         //-------------------------------------------------------------------------
 
         'connections': function () {
                 return this._connections;
         },
 
         //=========================================================================
 
         'resetData': function() {
                 this._data = {
                         'users': {
                                 'catchAllUser': {
                                         __masterkey_test_value__: 'masterkey',
@@ -99,96 +100,106 @@ Clipperz.PM.Proxy.Offline.DataStore.prototype = MochiKit.Base.update(null, {
         },
 
         //-------------------------------------------------------------------------
 
         'setupWithData': function(someData) {
                 var deferredResult;
                 var resultData;
                 var i, c;
 
 //Clipperz.log(">>> Proxy.Test.setupWithData");
                 resultData = this._data;
 
                 deferredResult = new MochiKit.Async.Deferred();
                 c = someData['users'].length;
 
                 for (i=0; i<c; i++) {
                                 varnewConnection;
                                 varrecordConfiguration;
 
                         deferredResult.addCallback(MochiKit.Base.method(this, 'userSerializedEncryptedData', someData['users'][i]));
                         deferredResult.addCallback(MochiKit.Base.bind(function(aUserSerializationContext) {
 //console.log("SERIALIZED USER", aUserSerializationContext);
                                 resultData['users'][aUserSerializationContext['credentials']['C']] = {
                                                 's':    aUserSerializationContext['credentials']['s'],
                                                 'v':    aUserSerializationContext['credentials']['v'],
                                                 'version':                      aUserSerializationContext['data']['connectionVersion'],
                                                 'userDetails':          aUserSerializationContext['encryptedData']['user']['header'],
                                                 'userDetailsVersion':aUserSerializationContext['encryptedData']['user']['version'],
                                                 'statistics':           aUserSerializationContext['encryptedData']['user']['statistics'],
                                                 'lock':                                 aUserSerializationContext['encryptedData']['user']['lock'],
                                                 'records':                      this.rearrangeRecordsData(aUserSerializationContext['encryptedData']['records'])
                                 }
                         }, this));
                 }
                 
                 deferredResult.addCallback(MochiKit.Base.bind(function() {
 //console.log("this._data", resultData);
                         this._data = resultData;
                 }, this));
                 
                 deferredResult.callback();
 //Clipperz.log("<<< Proxy.Test.setupWithData");
 
                 return deferredResult;
         },
 
         //=========================================================================
 
+        'C': function() {
+                return this._C;
+        },
+
+        'set_C': function(aValue) {
+                this._C = aValue;
+        },
+
+        //-------------------------------------------------------------------------
+
         'b': function() {
                 return this._b;
         },
 
         'set_b': function(aValue) {
                 this._b = aValue;
         },
 
         //-------------------------------------------------------------------------
 
         'B': function() {
                 return this._B;
         },
 
         'set_B': function(aValue) {
                 this._B = aValue;
         },
 
         //-------------------------------------------------------------------------
 
         'A': function() {
                 return this._A;
         },
 
         'set_A': function(aValue) {
                 this._A = aValue;
         },
 
         //-------------------------------------------------------------------------
 
         'userData': function() {
                 return this._userData;
         },
         
         'setUserData': function(aValue) {
                 this._userData = aValue;
         },
 
         //=========================================================================
 
         'getTollForRequestType': function (aRequestType) {
                         varresult;
                         vartargetValue;
                 var cost;
                 
                 targetValue = Clipperz.Crypto.PRNG.defaultRandomGenerator().getRandomBytes(32).toHexString().substring(2);
                 switch (aRequestType) {
                         case 'REGISTER':
@@ -295,122 +306,138 @@ Clipperz.PM.Proxy.Offline.DataStore.prototype = MochiKit.Base.update(null, {
                                                 'lock':         Clipperz.Crypto.Base.generateRandomSeed(),
                 //                              'maxNumberOfRecords':'100',
                                                 'userDetails':          someParameters['user']['header'],
                                                 'statistics':           someParameters['user']['statistics'],
                                                 'userDetailsVersion':someParameters['user']['version'],
                                                 'records':{}
                                 }
                         } else {
                                 throw "user already exists";
                         }
                 } else {
                         throw Clipperz.PM.Proxy.Offline.DataStore.exception.ReadOnly;
                 }
 
                 result = {
                         result: {
                                         'lock':         this.data()['users'][someParameters['credentials']['C']]['lock'],
                                         'result':'done'
                         },
                         toll:   this.getTollForRequestType('CONNECT')
                 }
 
                 return MochiKit.Async.succeed(result);
         },
 
         //-------------------------------------------------------------------------
 
         '_handshake': function(someParameters) {
                 var result;
                         varnextTollRequestType;
 
 //Clipperz.log(">>> Proxy.Offline.DataStore._handshake");
                 result = {};
                 if (someParameters.message == "connect") {
                         var userData;
                         var randomBytes;
                         var b, B, v;
 
 //console.log(">>> Proxy.Offline.DataStore._handshake.connect", someParameters);
                         userData = this.data()['users'][someParameters.parameters.C];
                         
                         if ((typeof(userData) != 'undefined') && (userData['version'] == someParameters.version)) {
                                 this.setUserData(userData);
                         } else {
                                 this.setUserData(this.data()['users']['catchAllUser']);
                         }
 
                         randomBytes = Clipperz.Crypto.Base.generateRandomSeed();
+                        this.set_C(someParameters.parameters.C);
                         this.set_b(new Clipperz.Crypto.BigInt(randomBytes, 16));
                         v = new Clipperz.Crypto.BigInt(this.userData()['v'], 16);
-                        this.set_B(v.add(Clipperz.Crypto.SRP.g().powerModule(this.b(), Clipperz.Crypto.SRP.n())));
+                        this.set_B((Clipperz.Crypto.SRP.k().multiply(v)).add(Clipperz.Crypto.SRP.g().powerModule(this.b(), Clipperz.Crypto.SRP.n())));
                         
                         this.set_A(someParameters.parameters.A);
                         
                         result['s'] = this.userData()['s'];
                         result['B'] = this.B().asString(16);
                         
                         nextTollRequestType = 'CONNECT';
                 } else if (someParameters.message == "credentialCheck") {
-                        var v, u, S, A, K, M1;
+                        var v, u, s, S, A, K, M1;
+                        var stringHash = function (aValue) {
+                                return Clipperz.PM.Crypto.encryptingFunctions.versions[someParameters.version].hash(new Clipperz.ByteArray(aValue)).toHexString().substring(2);
+                        };
                         
 //console.log(">>> Proxy.Offline.DataStore._handshake.credentialCheck", someParameters);
                         v = new Clipperz.Crypto.BigInt(this.userData()['v'], 16);
-                        u = new Clipperz.Crypto.BigInt(Clipperz.PM.Crypto.encryptingFunctions.versions[someParameters.version].hash(new Clipperz.ByteArray(this.B().asString(10))).toHexString(), 16);
                         A = new Clipperz.Crypto.BigInt(this.A(), 16);
+                        u = new Clipperz.Crypto.BigInt(Clipperz.PM.Crypto.encryptingFunctions.versions[someParameters.version].hash(new Clipperz.ByteArray(A.asString(10) + this.B().asString(10))).toHexString(), 16);
+                        s = new Clipperz.Crypto.BigInt(this.userData()['s'], 16);
                         S = (A.multiply(v.powerModule(u, Clipperz.Crypto.SRP.n()))).powerModule(this.b(), Clipperz.Crypto.SRP.n());
 
-                        K = Clipperz.PM.Crypto.encryptingFunctions.versions[someParameters.version].hash(new Clipperz.ByteArray(S.asString(10))).toHexString().slice(2);
+                        K = stringHash(S.asString(10));
 
-                        M1 = Clipperz.PM.Crypto.encryptingFunctions.versions[someParameters.version].hash(new Clipperz.ByteArray(A.asString(10) + this.B().asString(10) + K)).toHexString().slice(2);
+                        M1 = stringHash(
+                                "597626870978286801440197562148588907434001483655788865609375806439877501869636875571920406529" +
+                                stringHash(this.C()) +
+                                s.asString(10) +
+                                A.asString(10) +
+                                this.B().asString(10) +
+                                K
+                        );
                         if (someParameters.parameters.M1 == M1) {
                                 var M2;
                                 
-                                M2 = Clipperz.PM.Crypto.encryptingFunctions.versions[someParameters.version].hash(new Clipperz.ByteArray(A.asString(10) + someParameters.parameters.M1 + K)).toHexString().slice(2);
+                                M2 = stringHash(
+                                        A.asString(10) +
+                                        someParameters.parameters.M1 +
+                                        K
+                                );
                                 result['M2'] = M2;
                         } else {
                                 throw new Error("Client checksum verification failed! Expected <" + M1 + ">, received <" + someParameters.parameters.M1 + ">.", "Error");
                         }
 
                         nextTollRequestType = 'MESSAGE';
                 } else if (someParameters.message == "oneTimePassword") {
                         var otpData;
                         
 //console.log("HANDSHAKE WITH OTP", someParameters.parameters.oneTimePasswordKey);
 //console.log("someParameters", someParameters);
 //console.log("data.OTP", Clipperz.Base.serializeJSON(this.data()['onetimePasswords']));
                         otpData = this.data()['onetimePasswords'][someParameters.parameters.oneTimePasswordKey];
 
                         try {
                                 if (typeof(otpData) != 'undefined') {
                                         if (otpData['status'] == 'ACTIVE') {
                                                 if (otpData['key_checksum'] == someParameters.parameters.oneTimePasswordKeyChecksum) {
                                                         result = {
                                                                         'data':         otpData['data'],
                                                                         'version':otpData['version']
                                                         }
 
                                                         otpData['status'] = 'REQUESTED';
                                                 } else {
                                                         otpData['status'] = 'DISABLED';
                                                         throw "The requested One Time Password has been disabled, due to a wrong keyChecksum";
                                                 }
                                         } else {
                                                 throw "The requested One Time Password was not active";
                                         }
                                 } else {
                                         throw "The requested One Time Password has not been found"
                                 }
                         } catch (exception) {
                                 result = {
                                                 'data':         Clipperz.PM.Crypto.randomKey(),
                                                 'version':Clipperz.PM.Connection.communicationProtocol.currentVersion
                                 }
                         }
                         nextTollRequestType = 'CONNECT';
                 } else {
                         MochiKit.Logging.logError("Clipperz.PM.Proxy.Test.handshake - unhandled message: " + someParameters.message);
                 }
 //console.log("<<< Proxy.Offline._handshake", result);
 
                 result = {
                         result: result,