diff --git a/config/config.php b/config/config.php
index d253bf00f4..8dda2c7753 100644
--- a/config/config.php
+++ b/config/config.php
@@ -1,28 +1,28 @@
 <?php
 /**
- * The config file of ZenTaoPMS.
+ * ZenTaoPHP的config文件。如果更改配置，不要直接修改该文件，复制到my.php修改相应的值。
+ * The config file of zentaophp.  Don't modify this file directly, copy the item to my.php and change it.
  *
- * Don't modify this file directly, copy the item to my.php and change it.
- *
- * @copyright   Copyright 2009-2015 青岛易软天创网络科技有限公司(QingDao Nature Easy Soft Network Technology Co,LTD, www.cnezsoft.com)
- * @license     ZPL (http://zpl.pub/page/zplv12.html)
- * @author      Chunsheng Wang <chunsheng@cnezsoft.com>
- * @package     config
- * @version     $Id: config.php 5068 2013-07-08 02:41:22Z wyd621@gmail.com $
- * @link        http://www.zentao.net
+ * The author disclaims copyright to this source code.  In place of
+ * a legal notice, here is a blessing:
+ * 
+ *  May you do good and not evil.
+ *  May you find forgiveness for yourself and forgive others.
+ *  May you share freely, never taking more than you give.
  */
-/* Judge class config and function getWebRoot exists or not, make sure php shells can work. */
+
+/* 保证在命令行环境也能运行。Make sure to run in ztcli env. */
 if(!class_exists('config')){class config{}}
 if(!function_exists('getWebRoot')){function getWebRoot(){}}
 
-/* Basic settings. */
+/* 基本设置。Basic settings. */
 $config->version      = '9.2.1';        // The version of zentaopms. Don't change it.
 $config->charset      = 'UTF-8';           // The charset of zentaopms.
 $config->cookieLife   = time() + 2592000;  // The cookie life time.
 $config->timezone     = 'Asia/Shanghai';   // The time zone setting, for more see http://www.php.net/manual/en/timezones.php
 $config->webRoot      = '';                // The root path of the pms.
 
-/* The request settings. */
+/* 框架路由相关设置。Routing settings. */
 $config->requestType = 'PATH_INFO';       // The request type: PATH_INFO|GET, if PATH_INFO, must use url rewrite.
 $config->requestFix  = '-';               // The divider in the url when PATH_INFO.
 $config->moduleVar   = 'm';               // requestType=GET: the module var name.
@@ -37,6 +37,78 @@ $config->langs['zh-cn'] = '简体';
 $config->langs['en']    = 'English';
 $config->langs['zh-tw'] = '繁體';
 
+/* 设备类型视图文件前缀。The prefix for view file for different device. */ 
+$config->devicePrefix['mhtml'] = 'm.';
+
+/* 默认值设置。Default settings. */
+$config->default = new stdclass();
+$config->default->view   = 'html';        // Default view.
+$config->default->lang   = 'en';          // Default language.
+$config->default->theme  = 'default';     // Default theme.
+$config->default->module = 'index';       // Default module.
+$config->default->method = 'index';       // Default method.
+
+/* 数据库设置。Database settings. */
+$config->db = new stdclass();
+$config->slaveDB = new stdclass();
+$config->db->persistant     = false;     // Pconnect or not.
+$config->db->driver         = 'mysql';   // Must be MySQL. Don't support other database server yet.
+$config->db->encoding       = 'UTF8';    // Encoding of database.
+$config->db->strictMode     = false;     // Turn off the strict mode of MySQL.
+$config->db->prefix         = 'zt_';     // 数据库表名前缀。       The prefix of the table name.
+$config->slaveDB->persistant = false;
+$config->slaveDB->driver     = 'mysql';
+$config->slaveDB->encoding   = 'UTF8';
+$config->slaveDB->strictMode = false;
+
+/* 可用域名后缀列表。Domain postfix lists. */
+$config->domainPostfix  = "|com|com.cn|com.hk|com.tw|com.vc|edu.cn|es|";
+$config->domainPostfix .= "|eu|fm|gov.cn|gs|hk|im|in|info|jp|kr|la|me|";
+$config->domainPostfix .= "|mobi|my|name|net|net.cn|org|org.cn|pk|pro|";
+$config->domainPostfix .= "|sg|so|tel|tk|to|travel|tv|tw|uk|us|ws|";
+$config->domainPostfix .= "|ac.cn|bj.cn|sh.cn|tj.cn|cq.cn|he.cn|sn.cn|";
+$config->domainPostfix .= "|sx.cn|nm.cn|ln.cn|jl.cn|hl.cn|js.cn|zj.cn|";
+$config->domainPostfix .= "|ah.cn|fj.cn|jx.cn|sd.cn|ha.cn|hb.cn|hn.cn|";
+$config->domainPostfix .= "|gd.cn|gx.cn|hi.cn|sc.cn|gz.cn|yn.cn|gs.cn|pub|pw|";
+$config->domainPostfix .= "|qh.cn|nx.cn|xj.cn|tw.cn|hk.cn|mo.cn|xz.cn|xyz|wang|";
+$config->domainPostfix .= "|ae|asia|biz|cc|cd|cm|cn|co|co.jp|co.kr|co.uk|";
+$config->domainPostfix .= "|top|ren|club|space|tm|website|cool|company|city|email|";
+$config->domainPostfix .= "|market|software|ninja|bike|today|life|co.il|io|";
+$config->domainPostfix .= "|mn|ph|ps|tl|uz|vn|co.nz|cz|gg|gl|gr|je|md|me.uk|org.uk|pl|si|sx|vg|ag|";
+$config->domainPostfix .= "|bz|cl|ec|gd|gy|ht|lc|ms|mx|pe|tc|vc|ac|bi|mg|mu|sc|as|com.sb|cx|ki|nf|sh|";
+$config->domainPostfix .= "|rocks|social|co.com|bio|reviews|link|sexy|us.com|consulting|moda|desi|";
+$config->domainPostfix .= "|menu|info|events|webcam|dating|vacations|flights|cruises|global|ca|guru|";
+$config->domainPostfix .= "|futbol|rentals|dance|lawyer|attorney|democrat|republican|actor|condos|immobilien|";
+$config->domainPostfix .= "|villas|foundation|expert|works|tools|watch|zone|bargains|agency|best|solar|";
+$config->domainPostfix .= "|farm|pics|photo|marketing|holiday|gift|buzz|guitars|trade|construction|"; 
+$config->domainPostfix .= "|international|house|coffee|florist|rich|ceo|camp|education|repair|win|site|";
+
+/* 系统框架配置。Framework settings. */
+$config->framework = new stdclass();
+$config->framework->autoConnectDB   = true;  // 是否自动连接数据库。              Whether auto connect database or not.
+$config->framework->multiLanguage   = true; // 是否启用多语言功能。              Whether enable multi lanuage or not.
+$config->framework->multiTheme      = true; // 是否启用多风格功能。              Whether enable multi theme or not.
+$config->framework->multiSite       = false; // 是否启用多站点模式。              Whether enable multi site mode or not.
+$config->framework->extensionLevel  = 1;     // 0=>无扩展,1=>公共扩展,2=>站点扩展 0=>no extension, 1=> common extension, 2=> every site has it's extension.
+$config->framework->jsWithPrefix    = false;  // js::set()输出的时候是否增加前缀。 When us js::set(), add prefix or not.
+$config->framework->filterBadKeys   = true;  // 是否过滤不合要求的键值。          Whether filter bad keys or not.
+$config->framework->filterTrojan    = true;  // 是否过滤木马攻击代码。            Whether strip trojan code or not.
+$config->framework->filterXSS       = true;  // 是否过滤XSS攻击代码。             Whether strip xss code or not.
+$config->framework->filterParam     = 2;     // 1=>默认过滤，2=>开启过滤参数功能。0=>default filter 2=>Whether strip param.
+$config->framework->purifier        = true;  // 是否对数据做purifier处理。        Whether purifier data or not.
+$config->framework->logDays         = 14;    // 日志文件保存的天数。              The days to save log files.
+$config->framework->autoRepairTable = true;
+$config->framework->autoLang        = false;
+
+$config->framework->detectDevice['zh-cn'] = true; // 在zh-cn语言情况下，是否启用设备检测功能。 Whether enable device detect or not.
+$config->framework->detectDevice['zh-tw'] = true; // 在zh-tw语言情况下，是否启用设备检测功能。 Whether enable device detect or not.
+$config->framework->detectDevice['en']    = true; // 在en语言情况下，是否启用设备检测功能。 Whether enable device detect or not.
+
+/* 文件上传设置。 Upload settings. */
+$config->file = new stdclass();    
+$config->file->dangers = 'php,php3,php4,phtml,php5,jsp,py,rb,asp,aspx,ashx,asa,cer,cdx,aspl,shtm,shtml,html,htm';
+$config->file->allowed = 'txt,doc,docx,dot,wps,wri,pdf,ppt,xls,xlsx,ett,xlt,xlsm,csv,jpg,jpeg,png,psd,gif,ico,bmp,swf,avi,rmvb,rm,mp3,mp4,3gp,flv,mov,movie,rar,zip,bz,bz2,tar,gz';
+
 $config->allowedTags = '<p><span><h1><h2><h3><h4><h5><em><u><strong><br><ol><ul><li><img><a><b><font><hr><pre><div><table><td><th><tr><tbody><embed><style>';
 $config->accountRule = '|^[a-zA-Z0-9_]{1}[a-zA-Z0-9_\.]{1,}[a-zA-Z0-9_]{1}$|';
 $config->checkVersion = true;              // Auto check for new version or not.
@@ -46,7 +118,6 @@ $config->wideSize      = 1400;
 $config->timeout       = 30000;
 $config->duplicateTime = 60;
 
-
 $config->productCommonList['en'][0]    = 'Product';
 $config->productCommonList['en'][1]    = 'Project';
 $config->projectCommonList['en'][0]    = 'Project';
@@ -71,83 +142,15 @@ $config->charsets['en']['GBK']      = 'GBK';
 /* IP white list settings.*/
 $config->ipWhiteList = '*';
 
-/* 设备类型视图文件前缀。The prefix for view file for different device. */ 
-$config->devicePrefix['mhtml'] = 'm.';
+/* 配置参数过滤。Filter param settings. */
+$filterConfig = dirname(__FILE__) . DIRECTORY_SEPARATOR . 'filter.php';
+if(file_exists($filterConfig)) include $filterConfig;
 
-/* Default settings. */
-$config->default = new stdclass();
-$config->default->view   = 'html';        // Default view.
-$config->default->lang   = 'en';          // Default language.
-$config->default->theme  = 'default';     // Default theme.
-$config->default->module = 'index';       // Default module.
-$config->default->method = 'index';       // Default method.
-
-
-/* Master database settings. */
-$config->db = new stdclass();
-$config->slaveDB = new stdclass();
-$config->db->persistant     = false;     // Pconnect or not.
-$config->db->driver         = 'mysql';   // Must be MySQL. Don't support other database server yet.
-$config->db->encoding       = 'UTF8';    // Encoding of database.
-$config->db->strictMode     = false;     // Turn off the strict mode of MySQL.
-$config->db->prefix         = 'zt_';     // 数据库表名前缀。       The prefix of the table name.
-$config->slaveDB->persistant = false;      
-$config->slaveDB->driver     = 'mysql';    
-$config->slaveDB->encoding   = 'UTF8';     
-$config->slaveDB->strictMode = false;      
-
-/* Framework config. */
-$config->framework = new stdclass();
-$config->framework->autoConnectDB   = true;  // 是否自动连接数据库。              Whether auto connect database or not.
-$config->framework->multiLanguage   = true; // 是否启用多语言功能。              Whether enable multi lanuage or not.
-$config->framework->multiTheme      = true; // 是否启用多风格功能。              Whether enable multi theme or not.
-$config->framework->multiSite       = false; // 是否启用多站点模式。              Whether enable multi site mode or not.
-$config->framework->extensionLevel  = 1;     // 0=>无扩展,1=>公共扩展,2=>站点扩展 0=>no extension, 1=> common extension, 2=> every site has it's extension.
-$config->framework->jsWithPrefix    = false;  // js::set()输出的时候是否增加前缀。 When us js::set(), add prefix or not.
-$config->framework->filterBadKeys   = true;  // 是否过滤不合要求的键值。          Whether filter bad keys or not.
-$config->framework->filterTrojan    = true;  // 是否过滤木马攻击代码。            Whether strip trojan code or not.
-$config->framework->filterXSS       = true;  // 是否过滤XSS攻击代码。             Whether strip xss code or not.
-$config->framework->filterParam     = 2;     // 是否开启过滤参数功能。            Whether strip param or not.
-$config->framework->purifier        = true;  // 是否对数据做purifier处理。        Whether purifier data or not.
-$config->framework->logDays         = 14;    // 日志文件保存的天数。              The days to save log files.
-$config->framework->autoRepairTable = true;
-$config->framework->autoLang        = false;
-
-$config->framework->detectDevice['zh-cn'] = true; // 在zh-cn语言情况下，是否启用设备检测功能。 Whether enable device detect or not.
-$config->framework->detectDevice['zh-tw'] = true; // 在zh-tw语言情况下，是否启用设备检测功能。 Whether enable device detect or not.
-$config->framework->detectDevice['en']    = true; // 在en语言情况下，是否启用设备检测功能。 Whether enable device detect or not.
-
-/* Include the custom config file. */
+/* 引用自定义的配置。 Include the custom config file. */
 $configRoot = dirname(__FILE__) . DIRECTORY_SEPARATOR;
 $myConfig   = $configRoot . 'my.php';
 if(file_exists($myConfig)) include $myConfig;
 
-/* 文件上传设置。 Upload settings. */
-$config->file = new stdclass();    
-// 危险文件类型。 Dangerous file types.
-$config->file->dangers = 'php,php3,php4,phtml,php5,jsp,py,rb,asp,aspx,ashx,asa,cer,cdx,aspl,shtm,shtml,html,htm';
-// 允许上传的文件类型。 Allowed file types.
-$config->file->allowed = 'txt,doc,docx,dot,wps,wri,pdf,ppt,xls,xlsx,ett,xlt,xlsm,csv,jpg,jpeg,png,psd,gif,ico,bmp,swf,avi,rmvb,rm,mp3,mp4,3gp,flv,mov,movie,rar,zip,bz,bz2,tar,gz';
-
-/* 配置参数过滤。Filter param settings. */
-/* Like $config->filterParam->param[moduleName][methodname][ruleType] = rule. */
-$config->filterParam          = new stdclass();
-$config->filterParam->badKeys = '[^a-zA-Z0-9_\.]'; 
-$config->filterParam->module['reg'] = '/^[a-zA-Z0-9]+$/';
-$config->filterParam->method['common']['reg'] = '/^[a-zA-Z0-9]+$/';
-$config->filterParam->param['common']['name']['reg']  = '/^[a-zA-Z0-9_\.]+$/';
-$config->filterParam->param['common']['value']['reg'] = '/^[a-zA-Z0-9=_,`#+\^\/\.%\|\x7f-\xff]+$/';
-
-$config->filterParam->get['common']['onlybody']['reg']                = '/^yes$|^no$/';
-$config->filterParam->get['common']['HTTP_X_REQUESTED_WITH']['equal'] = 'XMLHttpRequest';
-$config->filterParam->get['common'][$config->sessionVar]['reg']       = '/^[a-zA-Z0-9]+$/';
-
-$config->filterParam->cookie['common']['lang']['reg']   = '/^[a-zA-Z\-_]+$/';
-$config->filterParam->cookie['common']['theme']['reg']  = '/^[a-zA-Z0-9_]+$/';
-$config->filterParam->cookie['common']['device']['reg'] = '/^[a-zA-Z0-9_]+$/';
-$config->filterParam->cookie['common']['za']['account'] = '';
-$config->filterParam->cookie['common']['zp']['reg']     = '/^[a-f0-9]{40}$/';
-
 /* Define the tables. */
 define('TABLE_COMPANY',       '`' . $config->db->prefix . 'company`');
 define('TABLE_DEPT',          '`' . $config->db->prefix . 'dept`');
diff --git a/config/filter.php b/config/filter.php
new file mode 100644
index 0000000000..1f779e1fb8
--- /dev/null
+++ b/config/filter.php
@@ -0,0 +1,196 @@
+<?php
+$filter = new stdclass();
+$filter->rules = new stdclass();
+$filter->rules->md5        = '/^[a-z0-9]{32}$/';
+$filter->rules->base64     = '/^[a-zA-Z0-9\+\/\=]+$/';
+$filter->rules->checked    = '/^[0-9,]+$/';
+$filter->rules->idList     = '/^[0-9\|]+$/';
+$filter->rules->lang       = '/^[a-zA-Z_\-]+$/';
+$filter->rules->any        = '/./';
+$filter->rules->orderBy    = '/^\w+_(desc|asc)$/i';
+$filter->rules->browseType = '/^by\w+$/i';
+$filter->rules->word       = '/^\w+$/';
+$filter->rules->paramName  = '/^[a-zA-Z0-9_\.]+$/';
+$filter->rules->paramValue = '/^[a-zA-Z0-9=_,`#+\^\/\.%\|\x7f-\xff]+$/';
+
+$filter->default = new stdclass(); 
+$filter->default->moduleName = 'code';
+$filter->default->methodName = 'code';
+$filter->default->paramName  = 'reg::paramName';
+$filter->default->paramValue = 'reg::paramValue';
+
+$filter->default->get['onlybody'] = 'equal::yes';
+$filter->default->get['HTTP_X_REQUESTED_WITH'] = 'equal::XMLHttpRequest';
+
+$filter->bug        = new stdclass();
+$filter->doc        = new stdclass();
+$filter->product    = new stdclass();
+$filter->qa         = new stdclass();
+$filter->story      = new stdclass();
+$filter->task       = new stdclass();
+$filter->testcase   = new stdclass();
+$filter->project    = new stdclass();
+$filter->testreport = new stdclass();
+$filter->testsuite  = new stdclass();
+$filter->todo       = new stdclass();
+$filter->testtask   = new stdclass();
+$filter->upgrade    = new stdclass();
+$filter->sso        = new stdclass();
+$filter->misc       = new stdclass();
+$filter->mail       = new stdclass();
+$filter->user       = new stdclass();
+$filter->block      = new stdclass();
+$filter->file       = new stdclass();
+
+$filter->block->default          = new stdclass();
+$filter->block->main             = new stdclass();
+$filter->bug->batchcreate        = new stdclass();
+$filter->bug->browse             = new stdclass();
+$filter->bug->default            = new stdclass();
+$filter->bug->create             = new stdclass();
+$filter->bug->export             = new stdclass();
+$filter->doc->browse             = new stdclass();
+$filter->doc->default            = new stdclass();
+$filter->doc->showfiles          = new stdclass();
+$filter->mail->ztcloud           = new stdclass();
+$filter->mail->batchdelete       = new stdclass();
+$filter->misc->checkupdate       = new stdclass();
+$filter->file->download          = new stdclass();
+$filter->file->ajaxueditorupload = new stdclass();
+$filter->product->browse         = new stdclass();
+$filter->product->default        = new stdclass();
+$filter->product->index          = new stdclass();
+$filter->project->default        = new stdclass();
+$filter->project->story          = new stdclass();
+$filter->project->task           = new stdclass();
+$filter->qa->default             = new stdclass();
+$filter->story->export           = new stdclass();
+$filter->sso->getbindusers       = new stdclass();
+$filter->sso->gettodolist        = new stdclass();
+$filter->sso->getuserpairs       = new stdclass();
+$filter->sso->login              = new stdclass();
+$filter->sso->logout             = new stdclass();
+$filter->task->export            = new stdclass();
+$filter->testcase->default       = new stdclass();
+$filter->testcase->browse        = new stdclass();
+$filter->testcase->export        = new stdclass();
+$filter->testcase->groupcase     = new stdclass();
+$filter->testreport->default     = new stdclass();
+$filter->testsuite->default      = new stdclass();
+$filter->testsuite->library      = new stdclass();
+$filter->testtask->default       = new stdclass();
+$filter->todo->export            = new stdclass();
+$filter->upgrade->license        = new stdclass();
+$filter->user->login             = new stdclass();
+
+$filter->bug->batchcreate->cookie['preBranch'] = 'int';
+$filter->bug->browse->cookie['bugModule']      = 'int';
+$filter->bug->browse->cookie['preBranch']      = 'int';
+$filter->bug->browse->cookie['qaBugOrder']     = 'reg::orderBy';
+$filter->bug->browse->cookie['windowWidth']    = 'int';
+$filter->bug->default->cookie['lastProduct']   = 'int';
+$filter->bug->default->cookie['preProductID']  = 'int';
+$filter->bug->create->cookie['preBranch']      = 'int';
+$filter->bug->export->cookie['checkedItem']    = 'reg::checked';
+
+$filter->doc->browse->cookie['browseType'] = 'reg::browseType';
+$filter->doc->default->cookie['from']      = 'code';
+$filter->doc->default->cookie['product']   = 'int';
+
+$filter->file->download->cookie[$config->sessionVar] = 'code';
+
+$filter->mail->ztcloud->cookie['ztCloudLicense'] = 'equal::yes';
+
+$filter->product->browse->cookie['preBranch']         = 'int';
+$filter->product->browse->cookie['preProductID']      = 'int';
+$filter->product->browse->cookie['productStoryOrder'] = 'reg::orderBy';
+$filter->product->browse->cookie['storyModule']       = 'int';
+$filter->product->default->cookie['lastProduct']      = 'int';
+$filter->product->default->cookie['preProductID']     = 'int';
+$filter->product->index->cookie['preBranch']          = 'int';
+
+$filter->project->default->cookie['lastProject']     = 'int';
+$filter->project->default->cookie['projectMode']     = 'code';
+$filter->project->story->cookie['projectStoryOrder'] = 'reg::orderBy';
+$filter->project->task->cookie['moduleBrowseParam']  = 'int';
+$filter->project->task->cookie['preProjectID']       = 'int';
+$filter->project->task->cookie['productBrowseParam'] = 'int';
+$filter->project->task->cookie['projectTaskOrder']   = 'reg::orderBy';
+$filter->project->task->cookie['windowWidth']        = 'int';
+
+$filter->qa->default->cookie['lastProduct']  = 'int';
+$filter->qa->default->cookie['preBranch']    = 'int';
+$filter->qa->default->cookie['preProductID'] = 'int';
+
+$filter->story->export->cookie['checkedItem'] = 'reg::checked';
+
+$filter->task->export->cookie['checkedItem'] = 'reg::checked';
+
+$filter->testcase->browse->cookie['caseModule']    = 'int';
+$filter->testcase->browse->cookie['caseSuite']     = 'int';
+$filter->testcase->browse->cookie['preBranch']     = 'int';
+$filter->testcase->default->cookie['lastProduct']  = 'int';
+$filter->testcase->default->cookie['preProductID'] = 'int';
+$filter->testcase->export->cookie['checkedItem']   = 'reg::checked';
+$filter->testcase->groupcase->cookie['preBranch']  = 'int';
+
+$filter->testreport->default->cookie['lastProduct']  = 'int';
+$filter->testreport->default->cookie['lastProject']  = 'int';
+$filter->testreport->default->cookie['preProductID'] = 'int';
+$filter->testreport->default->cookie['projectMode']  = 'code';
+
+$filter->testsuite->default->cookie['lastCaseLib']   = 'int';
+$filter->testsuite->default->cookie['lastProduct']   = 'int';
+$filter->testsuite->default->cookie['preProductID']  = 'int';
+$filter->testsuite->library->cookie['libCaseModule'] = 'int';
+$filter->testsuite->library->cookie['preCaseLibID']  = 'int';
+
+$filter->testtask->browse->cookie['preBranch']     = 'int';
+$filter->testtask->cases->cookie['preProductID']   = 'int';
+$filter->testtask->cases->cookie['taskCaseModule'] = 'int';
+$filter->testtask->default->cookie['lastProduct']  = 'int';
+$filter->testtask->default->cookie['preProductID'] = 'int';
+
+$filter->todo->export->cookie['checkedItem'] = 'reg::checked';
+
+$filter->user->login->cookie['keepLogin'] = 'equal::on';
+
+
+$filter->block->default->get['hash']    = 'reg::md5';
+$filter->block->main->get['blockid']    = 'code';
+$filter->block->main->get['blockTitle'] = 'reg::any';
+$filter->block->main->get['entry']      = 'code';
+$filter->block->main->get['lang']       = 'reg::lang';
+$filter->block->main->get['mode']       = 'code';
+$filter->block->main->get['param']      = 'reg::base64';
+$filter->block->main->get['sso']        = 'reg::base64';
+
+$filter->doc->showfiles->get['pageID']     = 'int';
+$filter->doc->showfiles->get['recPerPage'] = 'int';
+$filter->doc->showfiles->get['recTotal']   = 'int';
+$filter->doc->showfiles->get['title']      = 'reg::any';
+
+$filter->file->ajaxueditorupload->get['action'] = 'equal::config';
+$filter->file->download->get['charset']         = 'reg::lang';
+
+$filter->mail->batchdelete->get['idList'] = 'reg::idList';
+
+$filter->misc->checkupdate->get['browser'] = 'code';
+$filter->misc->checkupdate->get['note']    = 'reg::base64';
+
+$filter->sso->getbindusers->get['hash'] = 'reg::md5';
+$filter->sso->gettodolist->get['hash']  = 'reg::md5';
+$filter->sso->getuserpairs->get['hash'] = 'reg::md5';
+$filter->sso->login->get['data']        = 'reg::base64';
+$filter->sso->login->get['md5']         = 'reg::md5';
+$filter->sso->login->get['referer']     = 'reg::base64';
+$filter->sso->login->get['status']      = 'code';
+$filter->sso->login->get['token']       = 'reg::md5';
+$filter->sso->logout->get['status']     = 'code';
+$filter->sso->logout->get['token']      = 'reg::md5';
+
+$filter->upgrade->license->get['agree'] = 'equal::true';
+
+$filter->user->login->get['account']  = 'account';
+$filter->user->login->get['lang']     = 'reg::lang';
+$filter->user->login->get['password'] = 'reg::any';
diff --git a/framework/base/control.class.php b/framework/base/control.class.php
index 99ec7e2359..23dde557c2 100644
--- a/framework/base/control.class.php
+++ b/framework/base/control.class.php
@@ -274,10 +274,10 @@ class baseControl
         if(empty($moduleName)) $moduleName = $this->moduleName;
         if(empty($appName))    $appName    = $this->appName;
 
-        global $singleModule;
-        if(isset($singleModule[$appName][$moduleName]))
+        global $loadedModels;
+        if(isset($loadedModels[$appName][$moduleName]))
         {
-            $this->$moduleName = $singleModule[$appName][$moduleName];
+            $this->$moduleName = $loadedModels[$appName][$moduleName];
             $this->dao = $this->$moduleName->dao;
             return $this->$moduleName;
         }
@@ -290,7 +290,7 @@ class baseControl
          */
         if(!helper::import($modelFile)) 
         {
-            $this->app->loadModuleConfig($moduleName, $appName, false);
+            $this->app->loadModuleConfig($moduleName, $appName);
             $this->app->loadLang($moduleName, $appName);
             $this->dao = new dao();
             return false;
@@ -311,8 +311,8 @@ class baseControl
          * 初始化model对象，在control对象中可以通过$this->$moduleName来引用。同时将dao对象赋为control对象的成员变量，方便引用。
          * Init the model object thus you can try $this->$moduleName to access it. Also assign the $dao object as a member of control object.
          */
-        $singleModule[$appName][$moduleName] = new $modelClass($appName);
-        $this->$moduleName = $singleModule[$appName][$moduleName];
+        $loadedModels[$appName][$moduleName] = new $modelClass($appName);
+        $this->$moduleName = $loadedModels[$appName][$moduleName];
         $this->dao = $this->$moduleName->dao;
         return $this->$moduleName;
     }
@@ -691,6 +691,7 @@ class baseControl
         $currentModuleName = $this->moduleName;
         $currentMethodName = $this->methodName;
         $currentAppName    = $this->appName;
+        $currentParams     = $this->app->getParams();
 
         /**
          * 设置调用指定模块的指定方法。
@@ -700,14 +701,7 @@ class baseControl
         $this->app->setMethodName($methodName);
 
         if(!is_array($params)) parse_str($params, $params);
-        if($this->config->requestType != 'GET')
-        {
-            $this->app->setParamsByPathInfo($params, $type = 'fetch');
-        }
-        else
-        {
-            $this->app->setParamsByGET($params, $type = 'fetch');
-        }
+        $this->app->params = $params;
 
         $currentPWD = getcwd();
 
@@ -778,54 +772,7 @@ class baseControl
          */
         $this->app->setModuleName($currentModuleName);
         $this->app->setMethodName($currentMethodName);
-
-        $currentClassName = class_exists("my$currentModuleName") ? "my$currentModuleName" : $currentModuleName;
-        if(!class_exists($currentClassName)) $this->app->triggerError(" The class $currentClassName not found", __FILE__, __LINE__, $exit = true);
-
-        /* include default value for module*/
-        $defaultValueFiles = glob($this->app->getTmpRoot() . "defaultvalue/*.php");
-        if($defaultValueFiles) foreach($defaultValueFiles as $file) include $file;
-
-        /* 
-         * 使用反射机制获取函数参数的默认值。
-         * Get the default settings of the method to be called using the reflecting. 
-         *
-         * */
-        $defaultParams = array();
-        $methodReflect = new reflectionMethod($currentClassName, $currentMethodName);
-        foreach($methodReflect->getParameters() as $param)
-        {
-            $name = $param->getName();
-
-            $default = '_NOT_SET';
-            if(isset($paramDefaultValue[$currentAppName][$currentClassName][$currentMethodName][$name]))
-            {
-                $default = $paramDefaultValue[$currentAppName][$currentClassName][$currentMethodName][$name];
-            }
-            elseif(isset($paramDefaultValue[$currentClassName][$currentMethodName][$name]))
-            {
-                $default = $paramDefaultValue[$currentClassName][$currentMethodName][$name];
-            }
-            elseif($param->isDefaultValueAvailable())
-            {
-                $default = $param->getDefaultValue();
-            }
-
-            $defaultParams[$name] = $default;
-        }
-
-        /** 
-         * 根据PATH_INFO或者GET方式设置请求的参数。
-         * Set params according PATH_INFO or GET.
-         */
-        if($this->config->requestType != 'GET')
-        {
-            $this->app->setParamsByPathInfo($defaultParams);
-        }
-        else
-        {
-            $this->app->setParamsByGET($defaultParams);
-        }
+        $this->app->params = $currentParams;
 
         chdir($currentPWD);
 
diff --git a/framework/base/model.class.php b/framework/base/model.class.php
index 8fc67f71fc..0b84a41ee2 100644
--- a/framework/base/model.class.php
+++ b/framework/base/model.class.php
@@ -146,7 +146,7 @@ class baseModel
 
         $moduleName = $this->getModuleName();
         if($this->config->framework->multiLanguage) $this->app->loadLang($moduleName, $this->appName);
-        if($moduleName != 'common') $this->app->loadModuleConfig($moduleName, $this->appName, $exitIfNone = false);
+        if($moduleName != 'common') $this->app->loadModuleConfig($moduleName, $this->appName);
 
         $this->loadDAO();
         $this->setSuperVars();
@@ -208,10 +208,10 @@ class baseModel
         if(empty($moduleName)) return false;
         if(empty($appName)) $appName = $this->appName;
 
-        global $singleModule;
-        if(isset($singleModule[$appName][$moduleName]))
+        global $loadedModels;
+        if(isset($loadedModels[$appName][$moduleName]))
         {
-            $this->$moduleName = $singleModule[$appName][$moduleName];
+            $this->$moduleName = $loadedModels[$appName][$moduleName];
             return $this->$moduleName;
         }
 
@@ -225,8 +225,8 @@ class baseModel
             if(!class_exists($modelClass)) $this->app->triggerError(" The model $modelClass not found", __FILE__, __LINE__, $exit = true);
         }
 
-        $singleModule[$appName][$moduleName] = new $modelClass($appName);
-        $this->$moduleName = $singleModule[$appName][$moduleName];
+        $loadedModels[$appName][$moduleName] = new $modelClass($appName);
+        $this->$moduleName = $loadedModels[$appName][$moduleName];
         return $this->$moduleName;
     }
 
diff --git a/framework/base/router.class.php b/framework/base/router.class.php
index 5ea0578fb7..5f30e83aba 100644
--- a/framework/base/router.class.php
+++ b/framework/base/router.class.php
@@ -364,15 +364,14 @@ class baseRouter
         $this->setTimezone();
         $this->startSession();
 
-        if($this->config->framework->multiSite)     $this->setSiteCode() && $this->loadExtraConfig();
         if($this->config->framework->autoConnectDB) $this->connectDB();
-        if($this->config->framework->multiLanguage) $this->setClientLang();
+        if($this->config->framework->multiLanguage) $this->setClientLang() && $this->loadLang('common');
 
-        $isDetectDevice     = zget($this->config->framework->detectDevice, $this->clientLang, false);
-        $this->clientDevice = $isDetectDevice ? $this->setClientDevice() : 'desktop';
+        $needDetectDevice   = zget($this->config->framework->detectDevice, $this->clientLang, false);
+        $this->clientDevice = $needDetectDevice ? $this->setClientDevice() : 'desktop';
 
-        if($this->config->framework->multiLanguage) $this->loadLang('common');
-        if($this->config->framework->multiTheme)    $this->setClientTheme();
+        if($this->config->framework->multiTheme) $this->setClientTheme();
+        if($this->config->framework->multiSite)  $this->setSiteCode() && $this->loadExtraConfig();
     }
 
     /**
@@ -519,25 +518,6 @@ class baseRouter
         $this->configRoot = $this->basePath . 'config' . DS;
     }
 
-    /**
-     * Start the session.
-     *
-     * @access public
-     * @return void
-     */
-    public function startSession()
-    {
-        if(!defined('SESSION_STARTED'))
-        {
-            $sessionName = $this->config->sessionVar;
-            session_name($sessionName);
-            if(isset($_GET[$this->config->sessionVar])) session_id($_GET[$this->config->sessionVar]);
-            session_start();
-            define('SESSION_STARTED', true);
-        }
-    }
-
-
     /**
      * 设置模块的根目录。
      * Set the module root.
@@ -819,6 +799,25 @@ class baseRouter
         if(isset($this->config->timezone)) date_default_timezone_set($this->config->timezone);
     }
 
+    /**
+     * 开启 session
+     * Start the session.
+     *
+     * @access public
+     * @return void
+     */
+    public function startSession()
+    {
+        if(!defined('SESSION_STARTED'))
+        {
+            $sessionName = $this->config->sessionVar;
+            session_name($sessionName);
+            if(isset($_GET[$this->config->sessionVar])) session_id($_GET[$this->config->sessionVar]);
+            session_start();
+            define('SESSION_STARTED', true);
+        }
+    }
+
     /**
      * 根据用户浏览器的语言设置和服务器配置，选择显示的语言。
      * 优先级：$lang参数 > session > cookie > 浏览器 > 配置文件。
@@ -1018,7 +1017,6 @@ class baseRouter
     public function parsePathInfo()
     {
         $pathInfo = $this->getPathInfo();
-        if(trim($pathInfo, '/') == trim($this->config->webRoot, '/')) $pathInfo = '';
         if(!empty($pathInfo))
         {
             $dotPos = strrpos($pathInfo, '.');
@@ -1065,7 +1063,7 @@ class baseRouter
         }
         elseif(isset($_SERVER['REQUEST_URI']))
         {
-            $value = $_SERVER['REQUEST_URI'];
+            $value = htmlspecialchars($_SERVER['REQUEST_URI'], ENT_QUOTES);
             $subpath = str_replace($_SERVER['DOCUMENT_ROOT'], '', dirname($_SERVER['SCRIPT_FILENAME']));
             if($subpath != '/') $subpath = '/' . $subpath;
             if($subpath != '' and $subpath != '/' and strpos($value, $subpath) === 0) $value = substr($value, strlen($subpath));
@@ -1076,12 +1074,14 @@ class baseRouter
             if(empty($value)) $value = @getenv('ORIG_PATH_INFO');
         }
 
-        if(defined('RUN_MODE') and RUN_MODE == 'front' and strpos($value, $_SERVER['SCRIPT_NAME']) !== false) $value = str_replace($_SERVER['SCRIPT_NAME'], '', $value);
-
+        if(strpos($value, $_SERVER['SCRIPT_NAME']) !== false) $value = str_replace($_SERVER['SCRIPT_NAME'], '', $value);
         if(strpos($value, '?') === false) return trim($value, '/');
 
-        $value = parse_url($value);
-        return trim(zget($value, 'path', ''), '/');
+        $value    = parse_url($value);
+        $pathInfo = trim(zget($value, 'path', ''), '/');
+        if(trim($pathInfo, '/') == trim($this->config->webRoot, '/')) $pathInfo = '';
+
+        return $pathInfo;
     }
 
     /**
@@ -1161,6 +1161,7 @@ class baseRouter
 
         helper::import($commonModelFile);
 
+        if($this->config->framework->extensionLevel == 0 and class_exists('commonModel'))    return new commonModel();
         if($this->config->framework->extensionLevel > 0  and class_exists('extCommonModel')) return new extCommonModel();
 
         if(class_exists('commonModel')) return new commonModel();
@@ -1177,7 +1178,7 @@ class baseRouter
      */
     public function setModuleName($moduleName = '')
     {
-        if($this->checkAlnum($moduleName, 'module')) $this->moduleName = strtolower($moduleName);
+        if($this->checkModuleName($moduleName)) $this->moduleName = strtolower($moduleName);
     }
 
     /**
@@ -1206,7 +1207,7 @@ class baseRouter
      */
     public function setMethodName($methodName = '')
     {
-        if($this->checkAlnum($methodName, 'method')) $this->methodName = strtolower($methodName);
+        if($this->checkMethodName($methodName)) $this->methodName = strtolower($methodName);
     }
 
     /**
@@ -1222,7 +1223,7 @@ class baseRouter
     {
         if($moduleName == '') $moduleName = $this->moduleName;
 
-        if($this->checkAlnum($moduleName, 'module'))
+        if($this->checkModuleName($moduleName))
         {
             $modulePath = $this->getModuleRoot($appName) . strtolower($moduleName) . DS;
             return $modulePath;
@@ -1245,7 +1246,7 @@ class baseRouter
     public function getModuleExtPath($appName, $moduleName, $ext)
     {
         /* 检查失败或者extensionLevel为0，直接返回空。If check failed or extensionLevel == 0, return empty array. */
-        if(!$this->checkAlnum($moduleName, 'module') or $this->config->framework->extensionLevel == 0) return array();
+        if(!$this->checkModuleName($moduleName) or $this->config->framework->extensionLevel == 0) return array();
 
         /* When extensionLevel == 1. */
         $modulePath = $this->getModulePath($appName, $moduleName);
@@ -1259,24 +1260,34 @@ class baseRouter
     }
 
     /**
-     * 检查某一个变量必须为英文字母和数字组合。Check a variable must be ascii.
+     * 检查模块中某一个变量必须为英文字母和数字组合。Check module a variable must be ascii.
      * 
      * @param  string    $var 
-     * @param  string    $type 
      * @access public
-     * @return void
+     * @return bool
      */
-    public function checkAlnum($var, $type)
+    public function checkModuleName($var)
     {
-        $filterConfig = $this->config->filterParam;
-        $rules = $filterConfig->module;
-        if($type == 'method')
-        {
-            $rules  = $filterConfig->method['common'];
-            if($this->config->framework->filterParam == 2) $rules = zget($filterConfig->method, $this->moduleName, $rules);
-        }
+        global $filter;
+        $rule = $filter->default->moduleName;
+        if(validater::checkByRule($var, $rule)) return true;
+        $this->triggerError("'$var' illegal. ", __FILE__, __LINE__, $exit = true);
+    }
 
-        if(validater::checkByRules($var, $rules)) return true;
+    /**
+     * 检查方法中某一个变量必须为英文字母和数字组合。Check method a variable must be ascii.
+     * 
+     * @param  string    $var 
+     * @access public
+     * @return bool
+     */
+    public function checkMethodName($var)
+    {
+        global $filter;
+        $rule = $filter->default->methodName;
+        if($this->config->framework->filterParam == 2 and isset($filter->{$this->moduleName}->methodName)) $rule = $filter->{$this->moduleName}->methodName;
+
+        if(validater::checkByRule($var, $rule)) return true;
         $this->triggerError("'$var' illegal. ", __FILE__, __LINE__, $exit = true);
     }
 
@@ -1749,17 +1760,23 @@ class baseRouter
      */
     public function mergeParams($defaultParams, $passedParams)
     {
+        global $filter;
+
         /* Remove these two params. */
         unset($passedParams['onlybody']);
         unset($passedParams['HTTP_X_REQUESTED_WITH']);
 
         /* Check params from URL. */
-        $nameRules  = isset($this->config->filterParam->param[$this->moduleName][$this->methodName]['name'])  ? $this->config->filterParam->param[$this->moduleName][$this->methodName]['name']  : $this->config->filterParam->param['common']['name'];
-        $valueRules = isset($this->config->filterParam->param[$this->moduleName][$this->methodName]['value']) ? $this->config->filterParam->param[$this->moduleName][$this->methodName]['value'] : $this->config->filterParam->param['common']['value'];
+        $nameRule = isset($filter->{$this->moduleName}->{$this->methodName}->paramName)  ? $filter->{$this->moduleName}->{$this->methodName}->paramName  : $filter->default->paramName;
         foreach($passedParams as $param => $value)
         {
-            if(!validater::checkByRules($param, $nameRules)) die('Bad Request!');
-            if($value and !validater::checkByRules($value, $valueRules)) die('Bad Request!');
+            if(!validater::checkByRule($param, $nameRule)) die('Bad Request!');
+            $valueRule = $filter->default->paramValue;
+            if(isset($filter->{$this->moduleName}->{$this->methodName}->paramValue[$param]))
+            {
+                $valueRule = $filter->{$this->moduleName}->{$this->methodName}->paramValue[$param];
+            }
+            if($value and !validater::checkByRule($value, $valueRule)) die('Bad Request!');
         }
 
         $passedParams = array_values($passedParams);
@@ -1870,7 +1887,7 @@ class baseRouter
     public function loadMainConfig()
     {
         /* 初始化$config对象。Init the $config object. */
-        global $config;
+        global $config, $filter;
         if(!is_object($config)) $config = new config();
         $this->config = $config;
 
@@ -2003,11 +2020,9 @@ class baseRouter
         $view->viewVar     = $this->config->viewVar;
         $view->sessionVar  = $this->config->sessionVar;
 
-        $this->session->set('rand', mt_rand(0, 10000));
-        $this->session->set('random', $this->session->rand);
+        $this->session->set('random', mt_rand(0, 10000));
         $view->sessionName = session_name();
         $view->sessionID   = session_id();
-        $view->rand        = $this->session->rand;
         $view->random      = $this->session->random;
         $view->expiredTime = ini_get('session.gc_maxlifetime');
         $view->serverTime  = time();
diff --git a/framework/router.class.php b/framework/router.class.php
index 38394bf2d2..536dddf8dd 100755
--- a/framework/router.class.php
+++ b/framework/router.class.php
@@ -125,8 +125,35 @@ class router extends baseRouter
         parent::saveError($level, $message, $file, $line);
     }
 
+    /**
+     * Alias load  module config.
+     * 
+     * @param  string $moduleName 
+     * @param  string $appName 
+     * @access public
+     * @return void
+     */
     public function loadConfig($moduleName, $appName = '')
     {
         return parent::loadModuleConfig($moduleName, $appName);
     }
+
+    /**
+     * Export config.
+     * 
+     * @access public
+     * @return void
+     */
+    public function exportConfig()
+    {
+        ob_start();
+        parent::exportConfig();
+        $view = ob_get_contents();
+        ob_end_clean();
+
+        $view = json_decode($view);
+        $view->rand = $this->session->random;
+        $this->session->set('rand', $this->session->random);
+        echo json_encode($view);
+    }
 }
diff --git a/lib/base/filter/filter.class.php b/lib/base/filter/filter.class.php
index 355265c53b..fad01e3727 100644
--- a/lib/base/filter/filter.class.php
+++ b/lib/base/filter/filter.class.php
@@ -668,72 +668,95 @@ class baseValidater
      */
     public static function filterParam($var, $type)
     {
-        global $config, $app;
-
-        if(!isset($config->filterParam->$type)) return array();
+        global $config, $filter, $app;
 
         $moduleName   = $app->getModuleName();
         $methodName   = $app->getMethodName();
         $params       = $app->getParams();
-        $filterConfig = $config->filterParam->$type;
 
         if($type == 'cookie')
         {
             $pagerCookie = 'pager' . ucfirst($moduleName) . ucfirst($methodName);
-            $filterConfig['common'][$pagerCookie]['int'] = '';
+            $filter->default->cookie[$pagerCookie] = 'int';
         }
         foreach($var as $key => $value)
         {
             if($config->requestType == 'GET' and $type == 'get' and isset($params[$key])) continue;
 
             $rules = '';
-            if(isset($filterConfig[$moduleName][$methodName][$key]))
+            if(isset($filter->{$moduleName}->{$methodName}->$type[$key]))
             {
-                $rules = $filterConfig[$moduleName][$methodName][$key];
+                $rules = $filter->{$moduleName}->{$methodName}->$type[$key];
             }
-            elseif(isset($filterConfig[$moduleName]['common'][$key]))
+            elseif(isset($filter->{$moduleName}->default->$type[$key]))
             {
-                $rules = $filterConfig[$moduleName]['common'][$key];
+                $rules = $filter->{$moduleName}->default->$type[$key];
             }
-            elseif(isset($filterConfig['common'][$key]))
+            elseif(isset($filter->default->$type[$key]))
             {
-                $rules = $filterConfig['common'][$key];
+                $rules = $filter->default->$type[$key];
             }
 
-            if(!self::checkByRules($value, $rules)) unset($var[$key]);
+            if(!self::checkByRule($value, $rules)) unset($var[$key]);
         }
         return $var;
     }
 
     /**
-     * Check by rules.
+     * Check by rule.
      * 
      * @param  string   $var 
-     * @param  array    $rules 
+     * @param  string   $rule   like: int account reg::md5 reg::/^[a-zA-Z0-9]+$/.
      * @static
      * @access public
      * @return bool
      */
-    public static function checkByRules($var, $rules)
+    public static function checkByRule($var, $rule)
     {
-        if(empty($rules)) return false;
-        foreach($rules as $type => $rule)
+        if(empty($rule)) return false;
+
+        /* Parse rule to operator and param. */
+        list($operator, $param) = baseValidater::parseRuleString($rule);
+
+        /* check by operator. */
+        $checkMethod = 'check' . $operator;
+        if(method_exists('baseValidater', $checkMethod))
         {
-            $checkMethod = 'check' . $type;
-            if(method_exists('baseValidater', $checkMethod))
-            {
-                if(empty($rule)  and self::$checkMethod($var) === false) return false;
-                if(!empty($rule) and self::$checkMethod($var, $rule) === false) return false;
-            }
-            elseif(function_exists('is_' . $type))
-            {
-                $checkFunction = 'is_' . $type;
-                if(!$checkFunction($var)) return false;
-            }
+            if(empty($param)  and self::$checkMethod($var) === false) return false;
+            if(!empty($param) and self::$checkMethod($var, $param) === false) return false;
         }
+        elseif(function_exists('is_' . $operator))
+        {
+            $checkFunction = 'is_' . $operator;
+            if(!$checkFunction($var)) return false;
+        }
+        else
+        {
+            return false;
+        }
+
         return true;
     }
 
+    /**
+     * Parse rule string.
+     * 
+     * @param  string $rule   like: int account reg::md5 reg::/^[a-zA-Z0-9]+$/.
+     * @static
+     * @access public
+     * @return array
+     */
+    public static function parseRuleString($rule)
+    {
+        global $filter;
+
+        if(strpos($rule, '::') !== false) list($operator, $param) = explode('::', $rule);
+        if(strpos($rule,'::') === false) list($operator, $param) = array($rule, '');
+        if($operator == 'reg' and isset($filter->rules->$param)) $param = $filter->rules->$param;
+
+        return array($operator, $param);
+    }
+
     /**
      * 调用一个方法进行检查。
      * Call a function to check it.
diff --git a/lib/base/pager/pager.class.php b/lib/base/pager/pager.class.php
index ddedb63612..84ea784097 100644
--- a/lib/base/pager/pager.class.php
+++ b/lib/base/pager/pager.class.php
@@ -342,7 +342,7 @@ class basePager
         $pager = '';
 
         $pager .= "<li class='previous" . ($this->pageID == 1 ? ' disabled' : '') . "'>";
-        $this->params['pageID'] = min(1, $this->pageID - 1);
+        $this->params['pageID'] = 1;
         $pager .= $this->createLink('« ' . $this->lang->pager->previousPage) . '</li>';
 
         $pager .= "<li class='caption'>";
diff --git a/module/block/config.php b/module/block/config.php
index 2051b81664..16b7ffefad 100644
--- a/module/block/config.php
+++ b/module/block/config.php
@@ -19,12 +19,3 @@ $config->block->gridOptions[8]  = '2/3';
 $config->block->gridOptions[3]  = '1/4';
 $config->block->gridOptions[9]  = '3/4';
 $config->block->gridOptions[12] = '100%';
-
-$config->filterParam->get['block']['common']['hash']['reg']     = '/^[a-z0-9]{32}$/';
-$config->filterParam->get['block']['main']['entry']['reg']      = '/^[a-zA-Z0-9_]+$/';
-$config->filterParam->get['block']['main']['lang']['reg']       = '/^[a-zA-Z_\-]+$/';
-$config->filterParam->get['block']['main']['mode']['reg']       = '/^[a-zA-Z0-9_]+$/';
-$config->filterParam->get['block']['main']['blockid']['reg']    = '/^[a-zA-Z0-9]+$/';
-$config->filterParam->get['block']['main']['blockTitle']['reg'] = '/./';
-$config->filterParam->get['block']['main']['param']['reg']      = '/^[a-zA-Z0-9\+\/\=]+$/';
-$config->filterParam->get['block']['main']['sso']['reg']        = '/^[a-zA-Z0-9\+\/\=]+$/';
diff --git a/module/bug/config.php b/module/bug/config.php
index 4e011c2828..525b6d7bca 100644
--- a/module/bug/config.php
+++ b/module/bug/config.php
@@ -276,13 +276,3 @@ $config->bug->datatable->fieldList['branch']['title']    = 'branch';
 $config->bug->datatable->fieldList['branch']['fixed']    = 'left';
 $config->bug->datatable->fieldList['branch']['width']    = '100';
 $config->bug->datatable->fieldList['branch']['required'] = 'no';
-
-$config->filterParam->cookie['bug']['common']['lastProduct']['int']    = '';
-$config->filterParam->cookie['bug']['common']['preProductID']['int']   = '';
-$config->filterParam->cookie['bug']['browse']['preBranch']['int']      = '';
-$config->filterParam->cookie['bug']['browse']['bugModule']['int']      = '';
-$config->filterParam->cookie['bug']['browse']['qaBugOrder']['reg']     = '/^[a-zA-Z0-9_]+$/';
-$config->filterParam->cookie['bug']['browse']['windowWidth']['int']    = '';
-$config->filterParam->cookie['bug']['create']['preBranch']['int']      = '';
-$config->filterParam->cookie['bug']['batchcreate']['preBranch']['int'] = '';
-$config->filterParam->cookie['bug']['export']['checkedItem']['reg']    = '/^[0-9,]+$/';
diff --git a/module/doc/config.php b/module/doc/config.php
index f2824e6297..6bcb942298 100644
--- a/module/doc/config.php
+++ b/module/doc/config.php
@@ -45,12 +45,3 @@ $config->doc->search['params']['addedDate']     = array('operator' => '=',
 $config->doc->search['params']['editedBy']      = array('operator' => '=',       'control' => 'select', 'values' => 'users');
 $config->doc->search['params']['editedDate']    = array('operator' => '=',       'control' => 'input',  'values' => '', 'class' => 'date');
 $config->doc->search['params']['version']       = array('operator' => '=',       'control' => 'input',  'values' => '');
-
-$config->filterParam->get['doc']['showfiles']['recTotal']['reg']   = '/^[0-9_]+$/';
-$config->filterParam->get['doc']['showfiles']['recPerPage']['reg'] = '/^[0-9]+$/';
-$config->filterParam->get['doc']['showfiles']['pageID']['reg']     = '/^[0-9]+$/';
-$config->filterParam->get['doc']['showfiles']['title']['reg']      = '/./';
-
-$config->filterParam->cookie['doc']['common']['product']['int']    = '';
-$config->filterParam->cookie['doc']['common']['from']['code']      = '';
-$config->filterParam->cookie['doc']['browse']['browseType']['reg'] = '/^by[a-z]+$/';
diff --git a/module/file/config.php b/module/file/config.php
index 25bbb5e44b..7b55622f10 100644
--- a/module/file/config.php
+++ b/module/file/config.php
@@ -30,8 +30,3 @@ $config->file->ueditor["videoMaxSize"]    = 102400000;
 $config->file->ueditor["videoAllowFiles"] = array(".flv", ".swf", ".mkv", ".avi", ".rm", ".rmvb", ".mpeg", ".mpg", ".ogg", ".ogv", ".mov", ".wmv", ".mp4", ".webm", ".mp3", ".wav", ".mid");
 $config->file->ueditor["videoUrlPrefix"]  = "";
 $config->file->ueditor["videoPathFormat"] = "";
-
-$config->filterParam->get['file']['ajaxueditorupload']['action']['equal'] = 'config';
-$config->filterParam->get['file']['download']['charset']['reg']           = '/^[a-zA-Z0-9\-_]+$/';
-
-$config->filterParam->cookie['file']['download'][$config->sessionVar]['reg'] = '/^[a-zA-Z0-9]+$/';
diff --git a/module/file/model.php b/module/file/model.php
index 186aa6692a..4a9d537185 100644
--- a/module/file/model.php
+++ b/module/file/model.php
@@ -595,7 +595,8 @@ class fileModel extends model
     public function processEditor($data, $editorList, $uid = '')
     {
         if(is_string($editorList)) $editorList = explode(',', str_replace(' ', '', $editorList));
-        $readLinkReg = htmlspecialchars(str_replace(array('%fileID%', $this->app->getWebRoot(), '/', '?'), array('[0-9]+', '', '\/', '\?'), helper::createLink('file', 'read', 'fileID=(%fileID%)')));
+        $readLinkReg = basename(helper::createLink('file', 'read', 'fileID=(%fileID%)'));
+        $readLinkReg = htmlspecialchars(str_replace(array('%fileID%', '?'), array('[0-9]+', '\?'), $readLinkReg));
         foreach($editorList as $editorID)
         {
             if(empty($editorID) or empty($data->$editorID)) continue;
diff --git a/module/mail/config.php b/module/mail/config.php
index 765fc96c6f..2fbfa040cb 100644
--- a/module/mail/config.php
+++ b/module/mail/config.php
@@ -47,7 +47,3 @@ $config->mail->provider['googlemail.com']       = $config->mail->provider['gmail
 
 $config->mail->provider['263.net']['host']      = 'smtp.263.net';
 $config->mail->provider['263xmail.com']['host'] = 'smtp.263xmail.com';
-
-$config->filterParam->get['mail']['batchdelete']['idList']['reg'] = '/^[0-9\|]+$/';
-
-$config->filterParam->cookie['mail']['ztcloud']['ztCloudLicense']['equal'] = 'yes';
diff --git a/module/misc/config.php b/module/misc/config.php
deleted file mode 100644
index e92f6cd1a1..0000000000
--- a/module/misc/config.php
+++ /dev/null
@@ -1,3 +0,0 @@
-<?php
-$config->filterParam->get['misc']['params']['note']['reg']     = '/^[a-zA-Z0-9\+\/\=]+$/';
-$config->filterParam->get['misc']['params']['browser']['code'] = '';
diff --git a/module/product/config.php b/module/product/config.php
index 1dd31ff0d2..be14f8dbe0 100644
--- a/module/product/config.php
+++ b/module/product/config.php
@@ -84,11 +84,3 @@ $config->product->editor = new stdclass();
 $config->product->editor->create = array('id' => 'desc', 'tools' => 'simpleTools');
 $config->product->editor->edit   = array('id' => 'desc', 'tools' => 'simpleTools');
 $config->product->editor->close  = array('id' => 'comment', 'tools' => 'simpleTools');
-
-$config->filterParam->cookie['product']['common']['lastProduct']['int']       = '';
-$config->filterParam->cookie['product']['common']['preProductID']['int']      = '';
-$config->filterParam->cookie['product']['index']['preBranch']['int']          = '';
-$config->filterParam->cookie['product']['browse']['preBranch']['int']         = '';
-$config->filterParam->cookie['product']['browse']['preProductID']['int']      = '';
-$config->filterParam->cookie['product']['browse']['storyModule']['int']       = '';
-$config->filterParam->cookie['product']['browse']['productStoryOrder']['reg'] = '/^[a-zA-Z0-9_]+$/';
diff --git a/module/project/config.php b/module/project/config.php
index 0bfb104506..b25686b377 100644
--- a/module/project/config.php
+++ b/module/project/config.php
@@ -98,12 +98,3 @@ $config->printKanban->col['wait']   = 2;
 $config->printKanban->col['doing']  = 3;
 $config->printKanban->col['done']   = 4;
 $config->printKanban->col['closed'] = 5;
-
-$config->filterParam->cookie['project']['common']['lastProject']['int']      = '';
-$config->filterParam->cookie['project']['common']['projectMode']['code']     = '';
-$config->filterParam->cookie['project']['task']['windowWidth']['int']        = '';
-$config->filterParam->cookie['project']['task']['preProjectID']['int']       = '';
-$config->filterParam->cookie['project']['task']['moduleBrowseParam']['int']  = '';
-$config->filterParam->cookie['project']['task']['productBrowseParam']['int'] = '';
-$config->filterParam->cookie['project']['task']['projectTaskOrder']['reg']   = '/^[a-zA-Z0-9_]+$/';
-$config->filterParam->cookie['project']['story']['projectStoryOrder']['reg'] = '/^[a-zA-Z0-9_]+$/';
diff --git a/module/qa/config.php b/module/qa/config.php
index f9bf8261f3..e69de29bb2 100644
--- a/module/qa/config.php
+++ b/module/qa/config.php
@@ -1,4 +0,0 @@
-<?php
-$config->filterParam->cookie['qa']['params']['preBranch']['int'] = '';
-$config->filterParam->cookie['qa']['params']['lastProduct']['int'] = '';
-$config->filterParam->cookie['qa']['params']['preProductID']['int'] = '';
diff --git a/module/sso/config.php b/module/sso/config.php
deleted file mode 100644
index 583fd5c418..0000000000
--- a/module/sso/config.php
+++ /dev/null
@@ -1,11 +0,0 @@
-<?php
-$config->filterParam->get['sso']['login']['referer']['reg']     = '/^[a-zA-Z0-9\+\/\=]+$/';
-$config->filterParam->get['sso']['login']['token']['reg']       = '/^[a-z0-9]{32}$/';
-$config->filterParam->get['sso']['login']['status']['code']     = '';
-$config->filterParam->get['sso']['login']['data']['reg']        = '/^[a-zA-Z0-9\+\/\=]+$/';
-$config->filterParam->get['sso']['login']['md5']['reg']         = '/^[a-z0-9]{32}$/';
-$config->filterParam->get['sso']['logout']['token']['reg']      = '/^[a-z0-9]{32}$/';
-$config->filterParam->get['sso']['logout']['status']['code']    = '';
-$config->filterParam->get['sso']['getuserpairs']['hash']['reg'] = '/^[a-z0-9]{32}$/';
-$config->filterParam->get['sso']['getbindusers']['hash']['reg'] = '/^[a-z0-9]{32}$/';
-$config->filterParam->get['sso']['gettodolist']['hash']['reg']  = '/^[a-z0-9]{32}$/';
diff --git a/module/story/config.php b/module/story/config.php
index 222d49bff3..54ddb6f137 100644
--- a/module/story/config.php
+++ b/module/story/config.php
@@ -161,5 +161,3 @@ $config->story->datatable->fieldList['branch']['title']    = 'branch';
 $config->story->datatable->fieldList['branch']['fixed']    = 'left';
 $config->story->datatable->fieldList['branch']['width']    = '100';
 $config->story->datatable->fieldList['branch']['required'] = 'no';
-
-$config->filterParam->cookie['story']['export']['checkedItem']['reg'] = '/^[0-9,]+$/';
diff --git a/module/task/config.php b/module/task/config.php
index dc47f9ceac..3c235ccdd7 100644
--- a/module/task/config.php
+++ b/module/task/config.php
@@ -183,5 +183,3 @@ $config->task->datatable->fieldList['actions']['title']    = 'actions';
 $config->task->datatable->fieldList['actions']['fixed']    = 'right';
 $config->task->datatable->fieldList['actions']['width']    = '140';
 $config->task->datatable->fieldList['actions']['required'] = 'yes';
-
-$config->filterParam->cookie['task']['export']['checkedItem']['reg'] = '/^[0-9,]+$/';
diff --git a/module/testcase/config.php b/module/testcase/config.php
index 125af19143..e7853dd740 100644
--- a/module/testcase/config.php
+++ b/module/testcase/config.php
@@ -164,11 +164,3 @@ $config->testcase->datatable->fieldList['stepNumber']['fixed']    = 'no';
 $config->testcase->datatable->fieldList['stepNumber']['width']    = '80';
 $config->testcase->datatable->fieldList['stepNumber']['required'] = 'no';
 $config->testcase->datatable->fieldList['stepNumber']['sort']     = 'no';
-
-$config->filterParam->cookie['testcase']['common']['lastProduct']['int']  = '';
-$config->filterParam->cookie['testcase']['common']['preProductID']['int'] = '';
-$config->filterParam->cookie['testcase']['browse']['preBranch']['int']    = '';
-$config->filterParam->cookie['testcase']['browse']['caseModule']['int']   = '';
-$config->filterParam->cookie['testcase']['browse']['caseSuite']['int']    = '';
-$config->filterParam->cookie['testcase']['groupcase']['preBranch']['int'] = '';
-$config->filterParam->cookie['testcase']['export']['checkedItem']['reg']  = '/^[0-9,]+$/';
diff --git a/module/testreport/config.php b/module/testreport/config.php
index 467c9fe774..1d68e71a97 100644
--- a/module/testreport/config.php
+++ b/module/testreport/config.php
@@ -8,8 +8,3 @@ $config->testreport->edit->requiredFields = 'title,owner';
 $config->testreport->editor = new stdclass();
 $config->testreport->editor->create = array('id' => 'report', 'tools' => 'simpleTools');
 $config->testreport->editor->edit   = array('id' => 'report', 'tools' => 'simpleTools');
-
-$config->filterParam->cookie['testreport']['common']['lastProduct']['int']  = '';
-$config->filterParam->cookie['testreport']['common']['preProductID']['int'] = '';
-$config->filterParam->cookie['testreport']['common']['lastProject']['int']  = '';
-$config->filterParam->cookie['testreport']['common']['projectMode']['code'] = '';
diff --git a/module/testsuite/config.php b/module/testsuite/config.php
index 9a672c66a9..4d20c4b2ad 100644
--- a/module/testsuite/config.php
+++ b/module/testsuite/config.php
@@ -16,9 +16,3 @@ $config->testsuite->editor->createlib = array('id' => 'desc', 'tools' => 'simple
 
 $config->testsuite->datatable = new stdclass();
 $config->testsuite->datatable->defaultField = array('id', 'pri', 'title', 'type', 'assignedTo', 'lastRunner', 'lastRunDate', 'lastRunResult', 'status', 'bugs', 'results', 'actions');
-
-$config->filterParam->cookie['testsuite']['common']['lastCaseLib']['int']    = '';
-$config->filterParam->cookie['testsuite']['common']['lastProduct']['int']    = '';
-$config->filterParam->cookie['testsuite']['common']['preProductID']['int']   = '';
-$config->filterParam->cookie['testsuite']['library']['preCaseLibID']['int']  = '';
-$config->filterParam->cookie['testsuite']['library']['libCaseModule']['int'] = '';
diff --git a/module/testtask/config.php b/module/testtask/config.php
index 3bcb6a5cb6..e56adeac74 100644
--- a/module/testtask/config.php
+++ b/module/testtask/config.php
@@ -16,9 +16,3 @@ $config->testtask->editor->activate= array('id' => 'comment', 'tools' => 'simple
 
 $config->testtask->datatable = new stdclass();
 $config->testtask->datatable->defaultField = array('id', 'pri', 'title', 'type', 'assignedTo', 'lastRunner', 'lastRunDate', 'lastRunResult', 'status', 'bugs', 'results', 'actions');
-
-$config->filterParam->cookie['testtask']['common']['lastProduct']['int']   = '';
-$config->filterParam->cookie['testtask']['common']['preProductID']['int']  = '';
-$config->filterParam->cookie['testtask']['browse']['preBranch']['int']     = '';
-$config->filterParam->cookie['testtask']['cases']['preProductID']['int']   = '';
-$config->filterParam->cookie['testtask']['cases']['taskCaseModule']['int'] = '';
diff --git a/module/todo/config.php b/module/todo/config.php
index d2203e9b8d..6ee664628b 100644
--- a/module/todo/config.php
+++ b/module/todo/config.php
@@ -25,5 +25,3 @@ $config->todo->list->customBatchEditFields   = 'type,pri,desc,beginAndEnd,status
 $config->todo->custom = new stdclass();
 $config->todo->custom->batchCreateFields = 'type,pri,desc,beginAndEnd';
 $config->todo->custom->batchEditFields   = 'type,pri,beginAndEnd,status';
-
-$config->filterParam->cookie['todo']['export']['checkedItem']['reg'] = '/^[0-9,]+$/';
diff --git a/module/upgrade/config.php b/module/upgrade/config.php
index 94e9d3b34e..0086b916b3 100644
--- a/module/upgrade/config.php
+++ b/module/upgrade/config.php
@@ -16,5 +16,3 @@ $config->upgrade->lowerTables[$config->db->prefix . 'userContact']    = $config-
 $config->upgrade->lowerTables[$config->db->prefix . 'userGroup']      = $config->db->prefix . 'usergroup';
 $config->upgrade->lowerTables[$config->db->prefix . 'userQuery']      = $config->db->prefix . 'userquery';
 $config->upgrade->lowerTables[$config->db->prefix . 'userTPL']        = $config->db->prefix . 'usertpl';
-
-$config->filterParam->get['upgrade']['license']['agree']['equal'] = 'true';
diff --git a/module/user/config.php b/module/user/config.php
index 04ee6eb53f..eedb75b09b 100644
--- a/module/user/config.php
+++ b/module/user/config.php
@@ -16,9 +16,3 @@ $config->user->custom->batchEditFields   = 'dept,join,email,commiter';
 $config->user->failTimes   = 6;
 $config->user->lockMinutes = 10;
 $config->user->batchCreate = 10;
-
-$config->filterParam->get['user']['login']['account']['account'] = '';
-$config->filterParam->get['user']['login']['password']['reg']    = '/./';
-$config->filterParam->get['user']['login']['lang']['reg']        = '/^[a-zA-Z\-_]+$/';
-
-$config->filterParam->cookie['user']['login']['keepLogin']['equal'] = 'on';