diff --git a/trunk/module/company/model.php b/trunk/module/company/model.php
index 310a61afb2..b10b32e751 100644
--- a/trunk/module/company/model.php
+++ b/trunk/module/company/model.php
@@ -28,7 +28,7 @@ class companyModel extends model
     /* 设置菜单。*/
     public function setMenu($dept = 0)
     {
-        common::setMenuVars($this->lang->company->menu, 'addUser', array($this->app->company->id, $dept));
+        common::setMenuVars($this->lang->company->menu, 'addUser', array($dept));
     }
 
     /* 获得公司列表。*/
diff --git a/trunk/module/company/view/browse.html.php b/trunk/module/company/view/browse.html.php
index 56fa2997f9..7727d13720 100644
--- a/trunk/module/company/view/browse.html.php
+++ b/trunk/module/company/view/browse.html.php
@@ -35,7 +35,7 @@ include '../../common/view/tablesorter.html.php';
       <div class='a-right'>
         <?php 
         common::printLink('dept', 'browse', '', $lang->dept->manage);
-        common::printLink('user', 'create', "companyID={$this->app->company->id}&from=company", $lang->user->create);
+        common::printLink('user', 'create', "dept=$deptID&from=company", $lang->user->create);
         common::printLink('company', 'browse', '', $lang->user->allUsers);
         ?>
       </div>
diff --git a/trunk/module/user/control.php b/trunk/module/user/control.php
index a88b066634..2de0139577 100644
--- a/trunk/module/user/control.php
+++ b/trunk/module/user/control.php
@@ -179,20 +179,20 @@ class user extends control
     }
 
     /* 创建一个用户。*/
-    public function create($companyID = 0, $deptID = 0, $from = 'admin')
+    public function create($deptID = 0, $from = 'admin')
     {
-        if($companyID == 0) $companyID = $this->app->company->id;
         $this->lang->set('menugroup.user', $from);
+        $this->lang->user->menu = $this->lang->company->menu;
 
         if(!empty($_POST))
         {
-            $this->user->create($companyID);
+            $this->user->create();
             if(dao::isError()) die(js::error(dao::getError()));
             die(js::locate($this->createLink('company', 'browse'), 'parent'));
         }
 
         $header['title'] = $this->lang->admin->common . $this->lang->colon . $this->lang->user->create;
-        $position[]      = html::a($this->createLink('admin', 'browseuser', "companyid={$this->app->company->id}"), $this->lang->admin->user);
+        $position[]      = html::a($this->createLink('admin', 'browseuser') , $this->lang->admin->user);
         $position[]      = $this->lang->user->create;
         $this->assign('header',   $header);
         $this->assign('position', $position);
@@ -213,7 +213,7 @@ class user extends control
             if(dao::isError()) die(js::error(dao::getError()));
             if($from == 'admin')
             {
-                die(js::locate($this->createLink('admin', 'browseuser', "companyid={$this->app->company->id}"), 'parent'));
+                die(js::locate($this->createLink('admin', 'browseuser'), 'parent'));
             }
             else
             {
@@ -291,7 +291,7 @@ class user extends control
         /* 用户提交了登陆信息，则检查用户的身份。*/
         if(!empty($_POST))
         {
-            $user = $this->user->identify($_POST['account'], $_POST['password'], $this->app->company->id);
+            $user = $this->user->identify($_POST['account'], $_POST['password']);
             if($user)
             {
                 $user->rights = $this->user->authorize($_POST['account']);
diff --git a/trunk/module/user/model.php b/trunk/module/user/model.php
index 48e99d5cce..4a6df08361 100644
--- a/trunk/module/user/model.php
+++ b/trunk/module/user/model.php
@@ -39,16 +39,15 @@ class userModel extends model
     }
 
     /* 获得某一个公司的用户列表。*/
-    public function getList($companyID)
+    public function getList()
     {
-        return $this->dao->select('*')->from(TABLE_USER)->where('company')->eq((int)$companyID)->orderBy('account')->fetchAll();
+        return $this->dao->select('*')->from(TABLE_USER)->orderBy('account')->fetchAll();
     }
 
     /* 获得account=>realname的列表。params: noletter|noempty|noclosed。*/
-    public function getPairs($params = '', $companyID = 0)
+    public function getPairs($params = '')
     {
-        if($companyID == 0) $companyID = $this->app->company->id;
-        $users = $this->dao->select('account, realname')->from(TABLE_USER)->where('company')->eq((int)$companyID)->orderBy('account')->fetchPairs();
+        $users = $this->dao->select('account, realname')->from(TABLE_USER)->orderBy('account')->fetchPairs();
         foreach($users as $account => $realName)
         {
             $firstLetter = ucfirst(substr($account, 0, 1)) . ':';
@@ -82,13 +81,12 @@ class userModel extends model
     }
 
     /* 新增一个用户。*/
-    function create($companyID)
+    public function create()
     {
         /* 先检查密码是否符合规则。*/
         if(!$this->checkPassword()) return;
 
         $user = fixer::input('post')
-            ->add('company', (int)$companyID)
             ->setDefault('join', '0000-00-00')
             ->setIF($this->post->password1 != false, 'password', md5($this->post->password1))
             ->setIF($this->post->password1 == false, 'password', '')
@@ -105,7 +103,7 @@ class userModel extends model
     }
 
     /* 更新一个用户。*/
-    function update($userID)
+    public function update($userID)
     {
         /* 先检查密码是否符合规则。*/
         if(!$this->checkPassword()) return;
@@ -129,7 +127,7 @@ class userModel extends model
     }
 
     /* 检查密码是否符合要求。*/
-    function checkPassword()
+    public function checkPassword()
     {
         if($this->post->password1 != false)
         {
@@ -159,20 +157,18 @@ class userModel extends model
      * @access  public
      * @return  object
      */
-    public function identify($account, $password, $companyID)
+    public function identify($account, $password)
     {
         $account  = filter_var($account,  FILTER_SANITIZE_STRING);
         $password = filter_var($password, FILTER_SANITIZE_STRING);
         if(!$account or !$password) return false;
 
-        $sql  = "SELECT * FROM " . TABLE_USER . " WHERE account  = '$account' AND password = md5('$password') AND company  = '$companyID' AND status = 'active' LIMIT 1";
-        $user = $this->dbh->query($sql)->fetch();
+        $user = $this->dao->select('*')->from(TABLE_USER)->where('account')->eq($account)->andWhere('password')->eq(md5($password))->fetch();
         if($user)
         {
             $ip   = $_SERVER['REMOTE_ADDR'];
             $last = time();
-            $sql  = "UPDATE " . TABLE_USER . " SET visits = visits + 1, ip = '$ip', last = '$last' WHERE account = '$account'";
-            $this->dbh->exec($sql);
+            $this->dao->update(TABLE_USER)->set('visits = visits + 1')->set('ip')->eq($ip)->set('last')->eq($last)->where('account')->eq($account)->exec();
             $user->last = date(DT_DATETIME1, $user->last);
         }
         return $user;
@@ -193,17 +189,16 @@ class userModel extends model
         $rights = array();
         if($account == 'guest')
         {
-            $sql = "SELECT module, method FROM " . TABLE_GROUP . " AS t1 LEFT JOIN " . TABLE_GROUPPRIV . " AS t2
-                    ON t1.id = t2.group
-                 WHERE t1.name = 'guest'";
+            $sql = $this->dao->select('module, method')->from(TABLE_GROUP)->alias('t1')->leftJoin(TABLE_GROUPPRIV)->alias('t2')
+                ->on('t1.id = t2.group')->where('t1.name')->eq('guest');
         }
         else
         {
-            $sql = "SELECT module, method FROM " . TABLE_USERGROUP . " AS t1 LEFT JOIN " . TABLE_GROUPPRIV . " AS t2
-                ON t1.group = t2.group
-                WHERE t1.account = '$account'";
+            $sql = $this->dao->select('module, method')->from(TABLE_USERGROUP)->alias('t1')->leftJoin(TABLE_GROUPPRIV)->alias('t2')
+                ->on('t1.group = t2.group')
+                ->where('t1.account')->eq($account);
         }
-        $stmt = $this->dbh->query($sql);
+        $stmt = $sql->query();
         if(!$stmt) return $rights;
         while($row = $stmt->fetch(PDO::FETCH_ASSOC))
         {
@@ -233,14 +228,15 @@ class userModel extends model
     /* 获得用户参与的项目列表。*/
     public function getProjects($account)
     {
-        $sql = "SELECT T1.*, T2.* FROM " . TABLE_TEAM . " AS T1 LEFT JOIN " .TABLE_PROJECT . " AS T2 ON T1.project = T2.id WHERE T1.account = '$account'";
-        return $this->dbh->query($sql)->fetchAll();
+        return $this->dao->select('t1.*,t2.*')->from(TABLE_TEAM)->alias('t1')
+            ->leftJoin(TABLE_PROJECT)->alias('t2')->on('t1.project = t2.id')
+            ->where('t1.account')->eq($account)
+            ->fetchAll();
     }
 
     /* 获得用户的Bug列表。*/
     public function getBugs($account)
     {
-        $sql = "SELECT * FROM " . TABLE_BUG . " WHERE assignedTO = '$account'";
-        return $this->dbh->query($sql)->fetchAll();
+        return $this->dao->findByAssignedTo($account)->from(TABLE_BUG)->fetchAll();
     }
 }