diff --git a/framework/base/router.class.php b/framework/base/router.class.php
index 5b5ff3c496..ab502399e8 100644
--- a/framework/base/router.class.php
+++ b/framework/base/router.class.php
@@ -2636,6 +2636,7 @@ class ztSessionHandler
 {
     public $sessSavePath;
     public $tagID;
+    public $sessionFile;
 
     /**
      * Construct.
@@ -2649,6 +2650,23 @@ class ztSessionHandler
         $this->tagID = $tagID;
     }
 
+    /**
+     * Get session file.
+     *
+     * @param  string    $id
+     * @access public
+     * @return string
+     */
+    public function getSessionFile($id)
+    {
+        if(!empty($this->sessionFile)) return $this->sessionFile;
+
+        $fileName = "sess_$id";
+        if($this->tagID) $fileName = "sess_" . md5($id . $this->tagID);
+        $this->sessionFile = $this->sessSavePath . '/' . $fileName;
+        return $this->sessionFile;
+    }
+
     /**
      * Open
      *
@@ -2683,7 +2701,7 @@ class ztSessionHandler
      */
     public function read($id)
     {
-        $sessFile = "$this->sessSavePath/sess_$id" . $this->tagID;
+        $sessFile = $this->getSessionFile($id);
         if(!file_exists($sessFile))
         {
             ($this->tagID and file_exists("$this->sessSavePath/sess_$id")) ? copy("$this->sessSavePath/sess_$id", $sessFile) : touch($sessFile);
@@ -2701,7 +2719,7 @@ class ztSessionHandler
      */
     public function write($id, $sessData)
     {
-        $sessFile = "$this->sessSavePath/sess_$id" . $this->tagID;
+        $sessFile = $this->getSessionFile($id);
         if(file_put_contents($sessFile, $sessData)) return true;
         return false;
     }
@@ -2715,7 +2733,7 @@ class ztSessionHandler
      */
     public function destroy($id)
     {
-        $sessFile = "$this->sessSavePath/sess_$id" . $this->tagID;
+        $sessFile = $this->getSessionFile($id);
         @unlink($sessFile);
         touch($sessFile);
         return true;
diff --git a/module/api/model.php b/module/api/model.php
index 0518c9730d..fd4a2b6ed9 100644
--- a/module/api/model.php
+++ b/module/api/model.php
@@ -69,7 +69,7 @@ class apiModel extends model
                 $param = ltrim($param, ',');
             }
             $url  = rtrim($host, '/') . inlink('getModel',  "moduleName=$moduleName&methodName=$methodName&params=$param", 'json');
-            $url .= substr($url, '?') === false ? '?' : '&';
+            $url .= strpos($url, '?') === false ? '?' : '&';
             $url .= $this->config->sessionVar . '=' . session_id();
         }
         else
@@ -80,7 +80,7 @@ class apiModel extends model
                 $param = ltrim($param, '&');
             }
             $url  = rtrim($host, '/') . helper::createLink($moduleName, $methodName, $param, 'json');
-            $url .= substr($url, '?') === false ? '?' : '&';
+            $url .= strpos($url, '?') === false ? '?' : '&';
             $url .= $this->config->sessionVar . '=' . session_id();
         }
 
diff --git a/module/doc/view/content.html.php b/module/doc/view/content.html.php
index 368767cb7d..6938eff77a 100644
--- a/module/doc/view/content.html.php
+++ b/module/doc/view/content.html.php
@@ -111,7 +111,7 @@
                 if(common::hasPriv('file', 'download'))
                 {
                     $downloadLink  = $this->createLink('file', 'download', 'fileID=' . $file->id);
-                    $downloadLink .= substr($downloadLink, '?') === false ? '?' : '&';
+                    $downloadLink .= strpos($downloadLink, '?') === false ? '?' : '&';
                     $downloadLink .= $sessionString;
                     echo html::a($downloadLink, "<i class='icon icon-export'></i>", '', "class='btn-icon' style='margin-right: 10px;' title=\"{$lang->doc->download}\"");
                 }
diff --git a/module/doc/view/showfiles.html.php b/module/doc/view/showfiles.html.php
index c805ae8439..c2396511a5 100644
--- a/module/doc/view/showfiles.html.php
+++ b/module/doc/view/showfiles.html.php
@@ -82,7 +82,7 @@
 
               $fileID = $file->id;
               $url    = helper::createLink('file', 'download', 'fileID=' . $fileID);
-              $url   .= substr($url, '?') === false ? '?' : '&';
+              $url   .= strpos($url, '?') === false ? '?' : '&';
               $url   .= session_name() . '=' . session_id();
               ?>
               <div class='file'>
diff --git a/module/doc/view/view.html.php b/module/doc/view/view.html.php
index a5fb4a38ff..b465309911 100644
--- a/module/doc/view/view.html.php
+++ b/module/doc/view/view.html.php
@@ -131,7 +131,7 @@ js::set('docID', $doc->id);
               if(common::hasPriv('file', 'download'))
               {
                   $downloadLink  = $this->createLink('file', 'download', 'fileID=' . $file->id);
-                  $downloadLink .= substr($downloadLink, '?') === false ? '?' : '&';
+                  $downloadLink .= strpos($downloadLink, '?') === false ? '?' : '&';
                   $downloadLink .= $sessionString;
                   echo html::a($downloadLink, "<i class='icon icon-export'></i>", '', "class='btn-icon' style='margin-right: 10px;' title=\"{$lang->doc->download}\"");
               }
diff --git a/module/file/view/printfiles.html.php b/module/file/view/printfiles.html.php
index d1a3d2e929..b3f719cca6 100644
--- a/module/file/view/printfiles.html.php
+++ b/module/file/view/printfiles.html.php
@@ -80,7 +80,7 @@
               }
 
               $downloadLink  = $this->createLink('file', 'download', "fileID=$file->id");
-              $downloadLink .= substr($downloadLink, '?') === false ? '?' : '&';
+              $downloadLink .= strpos($downloadLink, '?') === false ? '?' : '&';
               $downloadLink .= $sessionString;
               echo "<li title='{$uploadDate}'>" . html::a($downloadLink, $fileTitle . " <span class='text-muted'>({$fileSize})</span>", '_blank', "onclick=\"return downloadFile($file->id, '$file->extension', $imageWidth, '$file->title')\"");
 
diff --git a/module/mail/control.php b/module/mail/control.php
index 2b9c82ba01..5402a27117 100755
--- a/module/mail/control.php
+++ b/module/mail/control.php
@@ -438,7 +438,7 @@ class mail extends control
             $idList = join('|', $this->post->mailIDList);
 
             $confirmLink  = inlink('batchDelete', "confirm=yes");
-            $confirmLink .= substr($confirmLink, '?') === false ? '?' : '&';
+            $confirmLink .= strpos($confirmLink, '?') === false ? '?' : '&';
             $confirmLink .= "idList=$idList";
             die(js::confirm($this->lang->mail->confirmDelete, $confirmLink));
         }
diff --git a/module/repo/model.php b/module/repo/model.php
index 4f91a0d4bc..7d1179d67b 100644
--- a/module/repo/model.php
+++ b/module/repo/model.php
@@ -922,7 +922,7 @@ class repoModel extends model
     {
         session_start();
         $uri = $this->app->getURI(true);
-        if(!empty($_GET) and $this->config->requestType == 'PATH_INFO') $uri .= (substr($uri, '?') === false ? '?' : '&') . http_build_query($_GET);
+        if(!empty($_GET) and $this->config->requestType == 'PATH_INFO') $uri .= (strpos($uri, '?') === false ? '?' : '&') . http_build_query($_GET);
 
         $backKey = 'repo' . ucfirst(strtolower($type));
         $this->session->set($backKey, $uri);
diff --git a/module/task/control.php b/module/task/control.php
index 1f2dcd71b9..ef2f626244 100644
--- a/module/task/control.php
+++ b/module/task/control.php
@@ -836,7 +836,7 @@ class task extends control
 
         $uri = $this->app->getURI(true);
         $this->session->set('estimateList', $uri, 'execution');
-        if(isonlybody()) $this->session->set('estimateList', $uri . (substr($uri, '?') === false ? '?' : '&')  . 'onlybody=yes', 'execution');
+        if(isonlybody()) $this->session->set('estimateList', $uri . (strpos($uri, '?') === false ? '?' : '&')  . 'onlybody=yes', 'execution');
 
         $this->view->task      = $this->task->getById($taskID);
         $this->view->estimates = $this->task->getTaskEstimate($taskID);
diff --git a/module/user/control.php b/module/user/control.php
index 0782d019c2..c2330563f2 100644
--- a/module/user/control.php
+++ b/module/user/control.php
@@ -816,18 +816,19 @@ class user extends control
                 die(helper::removeUTF8Bom(json_encode(array('status' => 'success') + $data)));
             }
 
-            $response['result']  = 'success';
+            $response['result'] = 'success';
             if(strpos($this->referer, $loginLink) === false and
                strpos($this->referer, $denyLink)  === false and
                strpos($this->referer, 'block')  === false and $this->referer
             )
             {
-                $response['locate']  = $this->referer;
+                $response['locate'] = $this->referer;
+                if(helper::isWithTID() and strpos($response['locate'], 'tid=') === false) $response['locate'] .= (strpos($response['locate'], '?') === false ? '?' : '&') . "tid={$this->get->tid}";
                 return $this->send($response);
             }
             else
             {
-                $response['locate']  = $this->config->webRoot . (helper::isWithTID() ? "?tid={$this->get->tid}" : '');
+                $response['locate'] = $this->config->webRoot . (helper::isWithTID() ? "?tid={$this->get->tid}" : '');
                 return $this->send($response);
             }
         }
@@ -897,12 +898,13 @@ class user extends control
                     $response['result']  = 'success';
                     if(common::hasPriv($module, $method))
                     {
-                        $response['locate']  = $this->post->referer;
+                        $response['locate'] = $this->post->referer;
+                        if(helper::isWithTID() and strpos($response['locate'], 'tid=') === false) $response['locate'] .= (strpos($response['locate'], '?') === false ? '?' : '&') . "tid={$this->get->tid}";
                         return $this->send($response);
                     }
                     else
                     {
-                        $response['locate']  = $this->config->webRoot . (helper::isWithTID() ? "?tid={$this->get->tid}" : '');
+                        $response['locate'] = $this->config->webRoot . (helper::isWithTID() ? "?tid={$this->get->tid}" : '');
                         return $this->send($response);
                     }
                 }
@@ -1047,7 +1049,7 @@ class user extends control
 
         /* Remove the real path for security reason. */
         $pathPos       = strrpos($this->app->getBasePath(), DIRECTORY_SEPARATOR, -2);
-        $resetFileName = substr($resetFileName, $pathPos+1);
+        $resetFileName = substr($resetFileName, $pathPos + 1);
 
         $this->view->title          = $this->lang->user->resetPassword;
         $this->view->status         = 'reset';
diff --git a/module/user/model.php b/module/user/model.php
index 6cadebbd09..a567c4b1ef 100644
--- a/module/user/model.php
+++ b/module/user/model.php
@@ -112,7 +112,7 @@ class userModel extends model
             $moreLinkParams = "params={$params}&usersToAppended={$usersToAppended}";
 
             $moreLink  = helper::createLink('user', 'ajaxGetMore');
-            $moreLink .= substr($moreLink, '?') === false ? '?' : '&';
+            $moreLink .= strpos($moreLink, '?') === false ? '?' : '&';
             $moreLink .= "params=" . base64_encode($moreLinkParams);
             $this->config->user->moreLink = $moreLink;
         }