* Finish task #3220.

module/task/model.php

@@ -111,7 +111,27 @@ class taskModel extends model
         $tasks    = fixer::input('post')->get();
         $batchNum = count(reset($tasks));
 
-        $result = $this->loadModel('common')->removeDuplicate('task', $tasks, "project=$projectID");
+        $storyIDs   = array();
+        $taskNames = array();
+        foreach($tasks->story as $key => $storyID)
+        {
+            if(empty($tasks->name[$key])) continue;
+
+            $inNames = in_array($tasks->name[$key], $taskNames);
+            if(!$inNames || $inNames && !in_array($storyID, $storyIDs))
+            {
+                $storyIDs[]   = $storyID;
+                $taskNames[] = $tasks->name[$key];
+            }
+            else
+            {
+                dao::$errors['message'][] = sprintf($this->lang->duplicate, $this->lang->task->common);
+                echo js::error(dao::getError());
+                exit;
+            }
+        }
+
+        $result = $this->loadModel('common')->removeDuplicate('task', $tasks, "project=$projectID and story " . helper::dbIN($storyIDs));
         $tasks  = $result['data'];
 
         /* check estimate. */

module/user/control.php

@@ -858,12 +858,14 @@ class user extends control
             die(js::locate(inlink('logout', $referer), 'parent'));
         }
 
-        $pathPos = strrpos($this->app->getBasePath(), DIRECTORY_SEPARATOR, -2);
+        /* Remove the real path for security reason. */
+        $pathPos       = strrpos($this->app->getBasePath(), DIRECTORY_SEPARATOR, -2);
+        $resetFileName = substr($resetFileName, $pathPos+1);
 
         $this->view->title          = $this->lang->user->resetPassword;
         $this->view->status         = 'reset';
         $this->view->needCreateFile = $needCreateFile;
-        $this->view->resetFileName  = substr($resetFileName, $pathPos+1);
+        $this->view->resetFileName  = $resetFileName;
 
         $this->display();
     }