diff --git a/module/personnel/control.php b/module/personnel/control.php
index 27e6a8a072..9bdd964a9d 100644
--- a/module/personnel/control.php
+++ b/module/personnel/control.php
@@ -138,13 +138,30 @@ class personnel extends control
         $this->lang->program->switcherMenu = $this->program->getPGMCommonAction() . $this->program->getPGMSwitcher($objectID);
         $this->program->setPGMViewMenu($objectID);
 
+        if($_POST)
+        {
+            $this->personnel->addWhitelist('program', $objectID);
+            if(dao::isError())
+            {
+                $response['result']  = 'fail';
+                $response['message'] = $this->getError();
+                $this->send($response);
+            }
+
+            $this->send(array('result' => 'success', 'message' => $this->lang->saveSuccess, 'locate' => inLink('whitelist', "programID=$objectID")));
+        }
+
+        $this->loadModel('dept');
+        $deptUsers = empty($deptID) ? array() : $this->dept->getDeptUserPairs($deptID);
+
         $this->view->title      = $this->lang->personnel->addWhitelist;
         $this->view->position[] = $this->lang->personnel->addWhitelist;
 
         $this->view->objectID  = $objectID;
         $this->view->deptID    = $deptID;
+        $this->view->deptUsers = $deptUsers;
         $this->view->whitelist = $this->personnel->getWhitelist($objectID);
-        $this->view->depts     = $this->loadModel('dept')->getOptionMenu();
+        $this->view->depts     = $this->dept->getOptionMenu();
         $this->view->users     = $this->loadModel('user')->getPairs('noclosed|nodeleted');
         $this->view->dept      = $this->dept->getByID($deptID);
 
@@ -159,7 +176,7 @@ class personnel extends control
      * @access public
      * @return void
      */
-    public function unlinkACL($id = 0, $confirm = 'no')
+    public function unbindWhielist($id = 0, $confirm = 'no')
     {
         if($confirm == 'no')
         {
diff --git a/module/personnel/lang/de.php b/module/personnel/lang/de.php
index eb06941909..3aced58727 100644
--- a/module/personnel/lang/de.php
+++ b/module/personnel/lang/de.php
@@ -15,3 +15,7 @@ $lang->personnel->search        = 'Search';
 $lang->personnel->program       = 'Program';
 $lang->personnel->emptyTip      = 'No data';
 $lang->personnel->childrenStage = 'Child stage';
+
+$lang->personnel->whitelist     = 'Whitelist';
+$lang->personnel->addWhitelist  = 'Add Whitelist';
+$lang->personnel->confirmDelete = 'Confirm removal of the user from the whitelist?';
diff --git a/module/personnel/lang/en.php b/module/personnel/lang/en.php
index eb06941909..3aced58727 100644
--- a/module/personnel/lang/en.php
+++ b/module/personnel/lang/en.php
@@ -15,3 +15,7 @@ $lang->personnel->search        = 'Search';
 $lang->personnel->program       = 'Program';
 $lang->personnel->emptyTip      = 'No data';
 $lang->personnel->childrenStage = 'Child stage';
+
+$lang->personnel->whitelist     = 'Whitelist';
+$lang->personnel->addWhitelist  = 'Add Whitelist';
+$lang->personnel->confirmDelete = 'Confirm removal of the user from the whitelist?';
diff --git a/module/personnel/lang/fr.php b/module/personnel/lang/fr.php
index eb06941909..3aced58727 100644
--- a/module/personnel/lang/fr.php
+++ b/module/personnel/lang/fr.php
@@ -15,3 +15,7 @@ $lang->personnel->search        = 'Search';
 $lang->personnel->program       = 'Program';
 $lang->personnel->emptyTip      = 'No data';
 $lang->personnel->childrenStage = 'Child stage';
+
+$lang->personnel->whitelist     = 'Whitelist';
+$lang->personnel->addWhitelist  = 'Add Whitelist';
+$lang->personnel->confirmDelete = 'Confirm removal of the user from the whitelist?';
diff --git a/module/personnel/lang/vi.php b/module/personnel/lang/vi.php
index eb06941909..3aced58727 100644
--- a/module/personnel/lang/vi.php
+++ b/module/personnel/lang/vi.php
@@ -15,3 +15,7 @@ $lang->personnel->search        = 'Search';
 $lang->personnel->program       = 'Program';
 $lang->personnel->emptyTip      = 'No data';
 $lang->personnel->childrenStage = 'Child stage';
+
+$lang->personnel->whitelist     = 'Whitelist';
+$lang->personnel->addWhitelist  = 'Add Whitelist';
+$lang->personnel->confirmDelete = 'Confirm removal of the user from the whitelist?';
diff --git a/module/personnel/lang/zh-tw.php b/module/personnel/lang/zh-tw.php
index 102873c2d8..af1b741934 100644
--- a/module/personnel/lang/zh-tw.php
+++ b/module/personnel/lang/zh-tw.php
@@ -15,3 +15,7 @@ $lang->personnel->search        = '搜索';
 $lang->personnel->program       = '項目集';
 $lang->personnel->emptyTip      = '暫無';
 $lang->personnel->childrenStage = '子階段';
+
+$lang->personnel->whitelist     = '白名單列表';
+$lang->personnel->addWhitelist  = '添加白名單';
+$lang->personnel->confirmDelete = '確認將該用戶移除白名單？';
diff --git a/module/personnel/model.php b/module/personnel/model.php
index 24fb0c537c..0768ba8aac 100644
--- a/module/personnel/model.php
+++ b/module/personnel/model.php
@@ -215,6 +215,58 @@ class personnelModel extends model
             ->fetchAll();
     }
 
+    /**
+     * Adding users to access control lists.
+     *
+     * @param  array   $users
+     * @param  string  $objectType  program|project|product|sprint
+     * @param  int     $objectID
+     * @param  string  $type    whitelist|blacklist
+     * @param  string  $source  upgrade|add
+     * @param  string  $desc
+     * @access public
+     * @return void
+     */
+    public function updateWhitelist($users = array(), $objectType = '', $objectID = 0, $type = 'whitelist', $source = 'add', $desc = '')
+    {
+        $this->dao->delete()->from(TABLE_ACL)->where('objectID')->eq($objectID)->exec();
+
+        $users = array_filter($users);
+        $users = array_unique($users);
+        if(empty($users)) return false;
+
+        $whitelist = '';
+        foreach($users as $account)
+        {
+            $acl             = new stdClass();
+            $acl->account    = $account;
+            $acl->objectType = $objectType;
+            $acl->objectID   = $objectID;
+            $acl->type       = $type;
+            $acl->source     = $source;
+            $acl->desc       = $desc;
+            $this->dao->insert(TABLE_ACL)->data($acl)->autoCheck()->exec();
+            $whitelist .= ',' . $account;
+        }
+
+        $objectTable = $objectType == 'product' ? TABLE_PRODUCT : TABLE_PROJECT;
+        $this->dao->update($objectTable)->set('whitelist')->eq($whitelist)->where('id')->eq($objectID)->exec();
+    }
+
+    /**
+     * Adding users to access control lists.
+     *
+     * @param  string  $objectType  program|project|product|sprint
+     * @param  int     $objectID
+     * @access public
+     * @return void
+     */
+    public function addWhitelist($objectType = '', $objectID = 0)
+    {
+        $users = $this->post->accounts;
+        $this->updateWhitelist($users, $objectType, $objectID);
+    }
+
     /**
      * Create access links by department.
      *
diff --git a/module/personnel/view/addwhitelist.html.php b/module/personnel/view/addwhitelist.html.php
index 5d7b54e242..cf6f9bc56f 100644
--- a/module/personnel/view/addwhitelist.html.php
+++ b/module/personnel/view/addwhitelist.html.php
@@ -24,7 +24,7 @@
   </div>
 </div>
 <div id='mainContent' class='main-content'>
-  <form class='main-form' method='post'>
+  <form class='main-form form-ajax' method='post' target='hiddenwin' id="whitelistForm">
     <table class='table table-form'>
       <thead>
         <tr class='text-center'>
@@ -34,6 +34,7 @@
       </thead>
       <tbody>
         <?php $i = 1;?>
+        <?php $whitelistUsers = array();?>
         <?php foreach($whitelist as $user):?>
         <tr id="whitelist<?php echo $i;?>" data-id="<?php echo $i;?>">
           <td>
@@ -45,12 +46,29 @@
             <a href='javascript:;' onclick='deleteItem(this)' class='btn btn-link'><i class='icon icon-close'></i></a>
           </td>
         </tr>
+        <?php
+            $i++;
+            $whitelistUsers[$user->account] = $user->realname;
+        ?>
+        <?php endforeach;?>
+
+        <?php foreach($deptUsers as $account => $realname):?>
+        <?php if(isset($whitelistUsers[$account])) continue;?>
+        <tr id="whitelist<?php echo $i;?>" data-id="<?php echo $i;?>">
+          <td>
+            <?php echo html::select('accounts[]', $users, $account, "class='form-control chosen'");?>
+          </td>
+          <td class='c-actions text-center'>
+            <a href='javascript:;' onclick='addItem(this)' class='btn btn-link'><i class='icon-plus'></i></a>
+            <a href='javascript:;' onclick='deleteItem(this)' class='btn btn-link'><i class='icon icon-close'></i></a>
+          </td>
+        </tr>
         <?php $i++;?>
         <?php endforeach;?>
 
         <?php for($j = 0; $j < 5; $j ++):?>
         <tr id="whitelist<?php echo $i;?>" data-id="<?php echo $i;?>">
-          <td><?php echo html::select("accounts[]", $users, '', "class='form-control chosen'");?></td>
+          <td><?php echo html::select('accounts[]', $users, '', "class='form-control chosen'");?></td>
           <td class='c-actions text-center'>
             <a href='javascript:;' onclick='addItem(this)' class='btn btn-link'><i class='icon-plus'></i></a>
             <a href='javascript:;' onclick='deleteItem(this)' class='btn btn-link'><i class='icon icon-close'></i></a>
diff --git a/module/personnel/view/whitelist.html.php b/module/personnel/view/whitelist.html.php
index 361e3a45b8..42659dcd51 100644
--- a/module/personnel/view/whitelist.html.php
+++ b/module/personnel/view/whitelist.html.php
@@ -53,8 +53,8 @@
           <td title="<?php echo $user->email;?>"><?php echo $user->email;?></td>
           <td class='c-actions'>
             <?php
-            $deleteClass = common::hasPriv('personnel', 'unlinkACL') ? 'btn' : 'btn disabled';
-            echo html::a($this->createLink('personnel', 'unlinkACL', "id=$user->id&confirm=no"), '<i class="icon-unlink"></i>', 'hiddenwin', "title='{$lang->delete}' class='{$deleteClass}'");
+            $deleteClass = common::hasPriv('personnel', 'unbindWhielist') ? 'btn' : 'btn disabled';
+            echo html::a($this->createLink('personnel', 'unbindWhielist', "id=$user->id&confirm=no"), '<i class="icon-unlink"></i>', 'hiddenwin', "title='{$lang->delete}' class='{$deleteClass}'");
             ?>
           </td>
         </tr>
diff --git a/module/product/model.php b/module/product/model.php
index 55f3702d59..c9a722276e 100644
--- a/module/product/model.php
+++ b/module/product/model.php
@@ -490,7 +490,7 @@ class productModel extends model
         $this->file->updateObjectID($this->post->uid, $productID, 'product');
         $this->dao->update(TABLE_PRODUCT)->set('`order`')->eq($productID * 5)->where('id')->eq($productID)->exec();
 
-        $this->loadModel('program')->updateUserACL($this->post->whitelist, 'product', $productID);
+        $this->loadModel('personnel')->updateWhitelist($this->post->whitelist, 'product', $productID);
         if($product->acl != 'open') $this->loadModel('user')->updateUserView($productID, 'product');
 
         /* Create doc lib. */
@@ -534,7 +534,7 @@ class productModel extends model
         if(!dao::isError())
         {
             $this->file->updateObjectID($this->post->uid, $productID, 'product');
-            $this->loadModel('program')->updateUserACL($this->post->whitelist, 'product', $productID);
+            $this->loadModel('personnel')->updateWhitelist($this->post->whitelist, 'product', $productID);
             if($product->acl != 'open') $this->loadModel('user')->updateUserView($productID, 'product');
             return common::createChanges($oldProduct, $product);
         }
diff --git a/module/program/model.php b/module/program/model.php
index 5682d9bc3a..47055e2df2 100644
--- a/module/program/model.php
+++ b/module/program/model.php
@@ -280,7 +280,7 @@ class programModel extends model
             $programID = $this->dao->lastInsertId();
             $this->dao->update(TABLE_PROGRAM)->set('`order`')->eq($programID * 5)->where('id')->eq($programID)->exec(); // Save order.
 
-            $this->updateUserACL($this->post->whitelist, 'program', $programID);
+            $this->loadModel('personnel')->updateWhitelist($this->post->whitelist, 'program', $programID);
             if($program->acl != 'open') $this->loadModel('user')->updateUserView($programID, 'program');
 
             $this->file->updateObjectID($this->post->uid, $programID, 'project');
@@ -373,7 +373,7 @@ class programModel extends model
         if(!dao::isError())
         {
             $this->file->updateObjectID($this->post->uid, $programID, 'project');
-            $this->updateUserACL($this->post->whitelist, 'program', $programID);
+            $this->loadModel('personnel')->updateWhitelist($this->post->whitelist, 'program', $programID);
             if($program->acl != 'open') $this->loadModel('user')->updateUserView($programID, 'program');
 
             if($oldProgram->parent != $program->parent) $this->processNode($programID, $program->parent, $oldProgram->path, $oldProgram->grade);
@@ -1100,7 +1100,7 @@ class programModel extends model
         if(!dao::isError())
         {
             $projectID = $this->dao->lastInsertId();
-            $this->updateUserACL($this->post->whitelist, 'project', $projectID);
+            $this->loadModel('personnel')->updateWhitelist($this->post->whitelist, 'project', $projectID);
             if($project->acl != 'open') $this->loadModel('user')->updateUserView($projectID, 'project');
 
             /* Save order. */
@@ -1191,7 +1191,7 @@ class programModel extends model
         if(!dao::isError())
         {
             $this->file->updateObjectID($this->post->uid, $projectID, 'project');
-            $this->updateUserACL($this->post->whitelist, 'project', $projectID);
+            $this->loadModel('personnel')->updateWhitelist($this->post->whitelist, 'project', $projectID);
             if($project->acl != 'open') $this->loadModel('user')->updateUserView($projectID, 'project');
 
             if($oldProject->parent != $project->parent) $this->processNode($projectID, $project->parent, $oldProject->path, $oldProject->grade);
@@ -1373,34 +1373,4 @@ class programModel extends model
             }
         }
     }
-
-    /**
-     * Adding users to access control lists.
-     *
-     * @param  array   $users
-     * @param  string  $objectType  program|project|product|sprint
-     * @param  int     $objectID
-     * @param  string  $type    whitelist|blacklist
-     * @param  string  $source  upgrade|add
-     * @param  string  $desc
-     * @access public
-     * @return void
-     */
-    public function updateUserACL($users = array(), $objectType = '', $objectID = 0, $type = 'whitelist', $source = 'add', $desc = '')
-    {
-        if(empty($users)) return false;
-        $this->dao->delete()->from(TABLE_ACL)->where('objectID')->eq($objectID)->exec();
-        foreach($users as $account)
-        {
-            if(empty($account)) continue;
-            $acl             = new stdClass();
-            $acl->account    = $account;
-            $acl->objectType = $objectType;
-            $acl->objectID   = $objectID;
-            $acl->type       = $type;
-            $acl->source     = $source;
-            $acl->desc       = $desc;
-            $this->dao->insert(TABLE_ACL)->data($acl)->autoCheck()->exec();
-        }
-    }
 }
diff --git a/module/project/model.php b/module/project/model.php
index 6d5e6376b0..0d53c49438 100644
--- a/module/project/model.php
+++ b/module/project/model.php
@@ -393,7 +393,7 @@ class projectModel extends model
             $lib->acl     = 'default';
             $this->dao->insert(TABLE_DOCLIB)->data($lib)->exec();
 
-            $this->loadModel('program')->updateUserACL($this->post->whitelist, 'sprint', $projectID);
+            $this->loadModel('personnel')->updateWhitelist($this->post->whitelist, 'sprint', $projectID);
             if($sprint->acl != 'open') $this->updateUserView($projectID);
 
             if(!dao::isError()) $this->loadModel('score')->create('program', 'createguide', $projectID);
@@ -458,7 +458,7 @@ class projectModel extends model
             }
         }
 
-        $this->loadModel('program')->updateUserACL($this->post->whitelist, 'sprint', $projectID);
+        $this->loadModel('personnel')->updateWhitelist($this->post->whitelist, 'sprint', $projectID);
 
         /* Fix bug#3074, Update views for team members. */
         if($project->acl != 'open') $this->updateUserView($projectID, 'sprint', $changedAccounts);