Index: /sandbox/filemanager/inc/class.vfs_functions.inc.php
===================================================================
--- /sandbox/filemanager/inc/class.vfs_functions.inc.php	(revision 1869)
+++ /sandbox/filemanager/inc/class.vfs_functions.inc.php	(revision 1880)
@@ -277,5 +277,5 @@
 
 			if (strlen($this->pswd) > 0){
-				$command = " -P ".(base64_decode($this->pswd) ^ $this->path)." ".$command;
+				$command = " -P ".(base64_decode($this->pswd) ^ $_SESSION['phpgw_info']['filemanager']['user']['sec_key'])." ".$command;
 			}
 
@@ -305,5 +305,5 @@
 			$command = escapeshellarg($this->file);
 			if (strlen($this->pswd) > 0){
-				$command = " -P ".(base64_decode($this->pswd) ^ $this->path)." ".$command;
+				$command = " -P ".(base64_decode($this->pswd) ^ $_SESSION['phpgw_info']['filemanager']['user']['sec_key'])." ".$command;
 			}
 
Index: /sandbox/filemanager/inc/class.uifilemanager.inc.php
===================================================================
--- /sandbox/filemanager/inc/class.uifilemanager.inc.php	(revision 1879)
+++ /sandbox/filemanager/inc/class.uifilemanager.inc.php	(revision 1880)
@@ -616,4 +616,8 @@
 				$vars[css].='<link rel="stylesheet" type="text/css" href="phpgwapi/js/dftree/dftree.css">';
 				$vars[preferences]='<input type="hidden" id="userPreferences" value=\''.serialize($_SESSION['phpgw_info']['user']['preferences']['filemanager']).'\'>';
+				// Used for important operations that needs security
+				for ($key = ""; strlen($key) < 150; $key .= chr(rand(48,95)));
+				$_SESSION['phpgw_info']['filemanager']['user']['sec_key'] = $key;
+				$vars[sec_key]='<input type="hidden" id="userKey" value=\''.$key.'\'>';
 				$vars[script]='<script>initDrawApi();</script>';
 				
@@ -827,8 +831,5 @@
 		function removedir()
 		{
-			$now = intval(time() / 5);
-			for ($i=0;$i<20;$i++)
-				$now.=$now;
-			$toRemove = $this->path ^ $now;
+			$toRemove = $this->path ^ $_SESSION['phpgw_info']['filemanager']['user']['sec_key'];
 			if ( $this->bo->vfs->rm(array( 'string' => $toRemove,
 				'relatives' => array (RELATIVE_NONE)
Index: /sandbox/filemanager/js/draw_api.js
===================================================================
--- /sandbox/filemanager/js/draw_api.js	(revision 1879)
+++ /sandbox/filemanager/js/draw_api.js	(revision 1880)
@@ -148,4 +148,8 @@
 
 function initDrawApi(){
+	SecEl = document.getElementById('userKey');
+	crypt = new crypt(SecEl.value);
+	SecEl.parentNode.removeChild(SecEl);
+
 	loadPreferences();
 	currentPath = document.getElementById('currentPath').value;
@@ -286,5 +290,5 @@
 		if (preferences.createdby_id =='1') retBuff += fl.td+file.creatdby+'</td>';
 		if (preferences.modifiedby_id =='1') retBuff += fl.td+file.modifdby+'</td>';
-		if (preferences.comment =='1') retBuff += fl.td+'<input id="'+file.name+'" class="inputComment" onkeydown="enterComments(event,this)" onclick="presetComments(this)" onblur="setComments(this)" value="'+file.comm+'" alt="'+get_lang('Click to change comments')+'" title="'+get_lang('Click to change comments')+'"></input></td>';
+		if (preferences.comment =='1') retBuff += fl.td+'<input id="'+file.name+'" class="inputComment" onkeydown="enterComments(event,this)" onclick="presetComments(this)" onblur="setComments(this)" value="'+(file.comm==null?'':file.comm)+'" alt="'+get_lang('Click to change comments')+'" title="'+get_lang('Click to change comments')+'"></input></td>';
 		if (preferences.version =='1') retBuff += fl.td+'<span onclick="loadHistory(\''+file.name+'\')">'+file.vers+'</span></td>';
 		return retBuff;
@@ -499,5 +503,5 @@
 			}
 			// TODO use DES, or something strong
-			var pswd = crypt(password,currentPath);
+			var pswd = crypt.encode(password);
 			cExecute('./index.php?menuaction=filemanager.vfs_functions.archive&pswd='+base64_encode(pswd.toString())+'&path='+base64_encode(currentPath)+filesUrl,handler.archive);
 			break;
@@ -578,9 +582,8 @@
 
 function unarchive(filename){
-	password = prompt(get_lang('Please, type archive password or leave it empty if it is not encrypted'));
+	password = crypt.encode(prompt(get_lang('Please, type archive password or leave it empty if it is not encrypted')));
 	if (password == null)
 		return;
-	var pswd = crypt(password,currentPath);
-	cExecute('./index.php?menuaction=filemanager.vfs_functions.unarchive&pswd='+base64_encode(pswd)+'&path='+base64_encode(currentPath)+'&file='+base64_encode(filename),handler.archive);
+	cExecute('./index.php?menuaction=filemanager.vfs_functions.unarchive&pswd='+base64_encode(password)+'&path='+base64_encode(currentPath)+'&file='+base64_encode(filename),handler.archive);
 }
 
@@ -600,27 +603,22 @@
 	}
 	else
-	if (operation == 'remove'){
+		if (operation == 'remove'){
 			var Dfolder = document.getElementById('folders_box').value;
 			if (confirm(get_lang('Do you really want to remove folder: %1?',Dfolder), ''))
 			{
-				var now = new Date();
-				nowTs = parseInt(now.getTime()/5000).toString();
-				for (var i=0 ;i < 20; i++)
-					nowTs+=nowTs;
-				var toRemove = crypt(Dfolder,nowTs);
-				cExecute('./index.php?menuaction=filemanager.uifilemanager.removedir&path='+base64_encode(toRemove),handler.refreshDir);
-		                var lastIndex = Dfolder.lastIndexOf('/');
+				cExecute('./index.php?menuaction=filemanager.uifilemanager.removedir&path='+base64_encode(crypt.encode(Dfolder)),handler.refreshDir);
+				var lastIndex = Dfolder.lastIndexOf('/');
 				currentPath = Dfolder.substr(0,lastIndex);
 				close_window();
 			}
-	}
-	else{
-	var buf = "<select id='folders_box'>";
-	for (var i=0; i < folders.length; i++)
-		buf += "<option value='"+folders[i]+"'>"+folders[i]+"</option>";
-	buf += "</select>";
-	code = "<table><tbody><tr><td>"+buf+"</td></tr><tr><td><input type='button' onclick='editFolders(\"new\")' value='"+get_lang('new folder')+"'></td><td><input type='button' onclick='editFolders(\"remove\")' value='"+get_lang('remove folder')+"'></td></tr></tbody></table>";
-	draw_window(code);
-	}
+		}
+		else{
+			var buf = "<select id='folders_box'>";
+			for (var i=0; i < folders.length; i++)
+				buf += "<option value='"+folders[i]+"'>"+folders[i]+"</option>";
+			buf += "</select>";
+			code = "<table><tbody><tr><td>"+buf+"</td></tr><tr><td><input type='button' onclick='editFolders(\"new\")' value='"+get_lang('new folder')+"'></td><td><input type='button' onclick='editFolders(\"remove\")' value='"+get_lang('remove folder')+"'></td></tr></tbody></table>";
+			draw_window(code);
+		}
 }
 
Index: /sandbox/filemanager/js/handler.js
===================================================================
--- /sandbox/filemanager/js/handler.js	(revision 1879)
+++ /sandbox/filemanager/js/handler.js	(revision 1880)
@@ -127,5 +127,5 @@
 	var rootFold = new dNode({id:'root', caption:get_lang("filemanager")});
 	folders_tree.add(rootFold,'root');
-	var myfolder = new dNode({id:folders[0], caption:get_lang("My Folder"),onClick:'load(\''+folders[0]+'\',this)'});
+	var myfolder = new dNode({id:folders[0], caption:get_lang("My Folder"), plusSign:(folders[1].indexOf(folders[0]+'/') == 0), onClick:'load(\''+folders[0]+'\',this)'});
 	folders_tree.add(myfolder,'root');
 	for (var i=1;i<folders.length;i++)
@@ -135,10 +135,7 @@
 		var parentDir = folders[i].substr(0,lastIndex);
 		if (parentDir == '/home')
-		{
 			parentDir = 'root';
-			folder = new dNode({id:folders[i], caption:name, plusSign:true, onClick:'load(\''+folders[i]+'\',this)'});
-		}
-		else
-			folder = new dNode({id:folders[i], caption:name, plusSign:false, onClick:'load(\''+folders[i]+'\',this)'});
+		next = (folders[i+1]?folders[i+1]:"");
+		folder = new dNode({id:folders[i], caption:name, plusSign:(next.indexOf(folders[i]+'/') == 0), onClick:'load(\''+folders[i]+'\',this)'});
 	        folders_tree.add(folder,parentDir);
 	}
Index: /sandbox/filemanager/js/common_functions.js
===================================================================
--- /sandbox/filemanager/js/common_functions.js	(revision 1874)
+++ /sandbox/filemanager/js/common_functions.js	(revision 1880)
@@ -75,12 +75,29 @@
 	}
 }
-function crypt(data1,data2){
-	ret = "";
-	for (var i=0;i < data1.length; i++)
-	{
-		ret += String.fromCharCode(data1.charCodeAt(i) ^ data2.charCodeAt(i));
-	}
-	return ret;
-}
+
+(function( )
+{
+	var sec_key = null;
+	function encode( data )
+	{
+		if (data == null)
+			return null;
+		ret = "";
+		for ( var i=0;i < data.length; i++ )
+		{
+			ret += String.fromCharCode(data.charCodeAt(i) ^ sec_key.charCodeAt(i));
+		}
+		return ret;
+	}
+
+	function crypt( input )
+	{
+		sec_key = input;
+	}
+
+	crypt.prototype.encode = encode;
+	window.crypt = crypt;
+})( );
+
 /*
  * base64.js - Base64 encoding and decoding functions
Index: /sandbox/filemanager/js/global.js
===================================================================
--- /sandbox/filemanager/js/global.js	(revision 1879)
+++ /sandbox/filemanager/js/global.js	(revision 1880)
@@ -15,4 +15,5 @@
 var criteria='name';
 var order_type = '1'; // Ascending is 1, descending is 0
+var crypt; // Used to send encrypted stuff
 
 // Store permissions of current path use it BUT DO NOT rely on it
Index: /sandbox/filemanager/templates/default/main.tpl
===================================================================
--- /sandbox/filemanager/templates/default/main.tpl	(revision 1879)
+++ /sandbox/filemanager/templates/default/main.tpl	(revision 1880)
@@ -65,4 +65,5 @@
 </div>
 {preferences}
+{sec_key}
 {script}
 <!-- END filemanager_footer -->
