diff --git a/config/filter.php b/config/filter.php
index e173dd69be..a5db047a7f 100644
--- a/config/filter.php
+++ b/config/filter.php
@@ -13,7 +13,7 @@ $filter->rules->word       = '/^\w+$/';
 $filter->rules->paramName  = '/^[a-zA-Z0-9_\.]+$/';
 $filter->rules->paramValue = '/^[a-zA-Z0-9=_,`#+\^\/\.%\|\x7f-\xff]+$/';
 
-$filter->default = new stdclass(); 
+$filter->default = new stdclass();
 $filter->default->moduleName = 'code';
 $filter->default->methodName = 'code';
 $filter->default->paramName  = 'reg::paramName';
@@ -194,6 +194,7 @@ $filter->sso->login->get['md5']         = 'reg::md5';
 $filter->sso->login->get['referer']     = 'reg::base64';
 $filter->sso->login->get['status']      = 'code';
 $filter->sso->login->get['token']       = 'reg::md5';
+$filter->sso->login->get['sessionid']   = 'reg::base64';
 $filter->sso->logout->get['status']     = 'code';
 $filter->sso->logout->get['token']      = 'reg::md5';
 
diff --git a/module/bug/model.php b/module/bug/model.php
index 99f2b8b319..27c0f4b58d 100644
--- a/module/bug/model.php
+++ b/module/bug/model.php
@@ -927,8 +927,8 @@ class bugModel extends model
             if(dao::isError()) return false;
 
             $buildData = new stdclass();
-            $buildData->product = $oldBug->product;
-            $buildData->branch  = $oldBug->branch;
+            $buildData->product = (int)$oldBug->product;
+            $buildData->branch  = (int)$oldBug->branch;
             $buildData->project = $bug->buildProject;
             $buildData->name    = $bug->buildName;
             $buildData->date    = date('Y-m-d');
diff --git a/module/build/model.php b/module/build/model.php
index f40a24ddf4..cfcbd7796b 100644
--- a/module/build/model.php
+++ b/module/build/model.php
@@ -199,6 +199,7 @@ class buildModel extends model
         $build = fixer::input('post')
             ->setDefault('product', 0)
             ->setDefault('branch', 0)
+            ->cleanInt('product,branch')
             ->add('project', (int)$projectID)
             ->stripTags($this->config->build->editor->create['id'], $this->config->allowedTags)
             ->remove('resolvedBy,allchecker,files,labels,uid')
@@ -230,8 +231,10 @@ class buildModel extends model
      */
     public function update($buildID)
     {
-        $oldBuild = $this->dao->select('*')->from(TABLE_BUILD)->where('id')->eq((int)$buildID)->fetch();
+        $buildID  = (int)$buildID;
+        $oldBuild = $this->dao->select('*')->from(TABLE_BUILD)->where('id')->eq($buildID)->fetch();
         $build    = fixer::input('post')->stripTags($this->config->build->editor->edit['id'], $this->config->allowedTags)
+            ->cleanInt('product,branch')
             ->remove('allchecker,resolvedBy,files,labels,uid')
             ->get();
         if(!isset($build->branch)) $build->branch = $oldBuild->branch;
@@ -240,7 +243,7 @@ class buildModel extends model
         $this->dao->update(TABLE_BUILD)->data($build)
             ->autoCheck()
             ->batchCheck($this->config->build->edit->requiredFields, 'notempty')
-            ->where('id')->eq((int)$buildID)
+            ->where('id')->eq($buildID)
             ->check('name', 'unique', "id != $buildID AND product = {$build->product} AND branch = {$build->branch} AND deleted = '0'")
             ->exec();
         if(isset($build->branch) and $oldBuild->branch != $build->branch) $this->dao->update(TABLE_RELEASE)->set('branch')->eq($build->branch)->where('build')->eq($buildID)->exec();
diff --git a/module/common/lang/en.php b/module/common/lang/en.php
index d8292e1fb5..1146055c8e 100644
--- a/module/common/lang/en.php
+++ b/module/common/lang/en.php
@@ -495,7 +495,7 @@ $lang->noResultsMatch     = "No results match!";
 $lang->searchMore         = "More results：";
 $lang->chooseUsersToMail  = "Choose users that will be notified.";
 $lang->browserNotice      = 'Your current browser might not show the best effect. Please use Chrome, Firefox, IE9+, Opera or Safari.';
-$lang->noticePasteImg     = "Support pasting images here.";
+$lang->noticePasteImg     = "Paste images here";
 
 /* 时间格式设置。*/
 if(!defined('DT_DATETIME1')) define('DT_DATETIME1',  'Y-m-d H:i:s');
diff --git a/module/custom/model.php b/module/custom/model.php
index 4d1f576faa..9663ae6ea5 100644
--- a/module/custom/model.php
+++ b/module/custom/model.php
@@ -484,6 +484,8 @@ class customModel extends model
             }
         }
 
-        $this->loadModel('setting')->setItems("system.{$moduleName}", $requiredFields);
+        $this->loadModel('setting');
+        $this->setting->deleteItems("owner=system&module={$moduleName}");
+        $this->setting->setItems("system.{$moduleName}", $requiredFields);
     }
 }
diff --git a/module/doc/css/createlib.css b/module/doc/css/createlib.css
index d5f518687f..a71c64e34e 100644
--- a/module/doc/css/createlib.css
+++ b/module/doc/css/createlib.css
@@ -1,3 +1,3 @@
-form {margin-right: 30px;}
+form {margin-right: 30px; margin-bottom:130px;}
 
 #whiteListBox div.input-group {margin-bottom: 2px;}
diff --git a/module/doc/model.php b/module/doc/model.php
index d81b91560f..7b15723fff 100644
--- a/module/doc/model.php
+++ b/module/doc/model.php
@@ -606,7 +606,7 @@ class docModel extends model
             ->add('version', 1)
             ->setDefault('product,project,module', 0)
             ->stripTags($this->config->doc->editor->create['id'], $this->config->allowedTags)
-            ->cleanInt('product,project,module')
+            ->cleanInt('product,project,module,lib')
             ->join('groups', ',')
             ->join('users', ',')
             ->remove('files,labels,uid')
diff --git a/module/editor/lang/zh-cn.php b/module/editor/lang/zh-cn.php
index 9fe3cd7f5b..8f034c31ad 100644
--- a/module/editor/lang/zh-cn.php
+++ b/module/editor/lang/zh-cn.php
@@ -44,7 +44,7 @@ $lang->editor->translate['model.php']   = 'model';
 $lang->editor->modules['action']      = '系统日志';
 $lang->editor->modules['admin']       = '后台管理';
 $lang->editor->modules['api']         = 'API接口';
-$lang->editor->modules['bug']         = '缺陷管理';
+$lang->editor->modules['bug']         = 'Bug管理';
 $lang->editor->modules['build']       = 'Build';
 $lang->editor->modules['common']      = '公有模块';
 $lang->editor->modules['company']     = '组织视图';
diff --git a/module/editor/lang/zh-tw.php b/module/editor/lang/zh-tw.php
index b87cf3e878..692a552ef2 100644
--- a/module/editor/lang/zh-tw.php
+++ b/module/editor/lang/zh-tw.php
@@ -44,7 +44,7 @@ $lang->editor->translate['model.php']   = 'model';
 $lang->editor->modules['action']      = '系統日誌';
 $lang->editor->modules['admin']       = '後台管理';
 $lang->editor->modules['api']         = 'API介面';
-$lang->editor->modules['bug']         = '缺陷管理';
+$lang->editor->modules['bug']         = 'Bug管理';
 $lang->editor->modules['build']       = 'Build';
 $lang->editor->modules['common']      = '公有模組';
 $lang->editor->modules['company']     = '組織視圖';
diff --git a/module/product/model.php b/module/product/model.php
index 28a9fb539e..e170f85ba9 100644
--- a/module/product/model.php
+++ b/module/product/model.php
@@ -433,6 +433,7 @@ class productModel extends model
         $oldProducts = $this->getByIdList($this->post->productIDList);
         foreach($data->productIDList as $productID)
         {
+            $productID = (int)$productID;
             $products[$productID] = new stdClass();
             $products[$productID]->name   = $data->names[$productID];
             $products[$productID]->code   = $data->codes[$productID];
diff --git a/module/project/model.php b/module/project/model.php
index 14101e7eaa..ecd4abb46b 100644
--- a/module/project/model.php
+++ b/module/project/model.php
@@ -378,7 +378,8 @@ class projectModel extends model
      */
     public function update($projectID)
     {
-        $oldProject = $this->dao->findById((int)$projectID)->from(TABLE_PROJECT)->fetch();
+        $projectID  = (int)$projectID;
+        $oldProject = $this->dao->findById($projectID)->from(TABLE_PROJECT)->fetch();
         $team = $this->getTeamMemberPairs($projectID);
         $this->lang->project->team = $this->lang->project->teamname;
         $projectID = (int)$projectID;
@@ -443,6 +444,7 @@ class projectModel extends model
         $oldProjects = $this->getByIdList($this->post->projectIDList);
         foreach($data->projectIDList as $projectID)
         {
+            $projectID = (int)$projectID;
             $projects[$projectID] = new stdClass();
             $projects[$projectID]->name   = $data->names[$projectID];
             $projects[$projectID]->code   = $data->codes[$projectID];
diff --git a/module/release/model.php b/module/release/model.php
index 9373150af5..be6d099162 100644
--- a/module/release/model.php
+++ b/module/release/model.php
@@ -103,7 +103,9 @@ class releaseModel extends model
      */
     public function create($productID, $branch = 0)
     {
-        $buildID = 0;
+        $productID = (int)$productID;
+        $branch    = (int)$branch;
+        $buildID   = 0;
         if($this->post->build == false && $this->post->name)
         {
             $build = $this->dao->select('*')->from(TABLE_BUILD)
@@ -186,11 +188,13 @@ class releaseModel extends model
      */
     public function update($releaseID)
     {
-        $oldRelease = $this->dao->select('*')->from(TABLE_RELEASE)->where('id')->eq((int)$releaseID)->fetch();
-        $branch     = $this->dao->select('branch')->from(TABLE_BUILD)->where('id')->eq($this->post->build)->fetch('branch');
+        $releaseID  = (int)$releaseID;
+        $oldRelease = $this->dao->select('*')->from(TABLE_RELEASE)->where('id')->eq($releaseID)->fetch();
+        $branch     = $this->dao->select('branch')->from(TABLE_BUILD)->where('id')->eq((int)$this->post->build)->fetch('branch');
 
         $release = fixer::input('post')->stripTags($this->config->release->editor->edit['id'], $this->config->allowedTags)
             ->add('branch',  (int)$branch)
+            ->cleanInt('product')
             ->remove('files,labels,allchecker,uid')
             ->get();
         $release = $this->loadModel('file')->processImgURL($release, $this->config->release->editor->edit['id'], $this->post->uid);
diff --git a/module/sso/control.php b/module/sso/control.php
index e2eee29823..bf89541177 100644
--- a/module/sso/control.php
+++ b/module/sso/control.php
@@ -13,8 +13,8 @@ class sso extends control
 {
     /**
      * SSO login.
-     * 
-     * @param  string $type 
+     *
+     * @param  string $type
      * @access public
      * @return void
      */
@@ -44,6 +44,11 @@ class sso extends control
             {
                 $location = rtrim($location, '?') . "?token=$token&auth=$auth&userIP=$userIP&callback=$callback&referer=$referer";
             }
+            if(!empty($_GET['sessionid']))
+            {
+                $sessionConfig = json_decode(base64_decode($this->get->sessionid), false);
+                $location     .= '&' . $sessionConfig->session_name . '=' . $sessionConfig->session_id;
+            }
             $this->locate($location);
         }
 
@@ -95,8 +100,8 @@ class sso extends control
 
     /**
      * SSO logout.
-     * 
-     * @param  string $type 
+     *
+     * @param  string $type
      * @access public
      * @return void
      */
@@ -115,9 +120,9 @@ class sso extends control
             if(strpos($location, '&') !== false)
             {
                 $location = rtrim($location, '&') . "&token=$token&auth=$auth&userIP=$userIP&callback=$callback";
-            }   
+            }
             else
-            {   
+            {
                 $location = rtrim($location, '?') . "?token=$token&auth=$auth&userIP=$userIP&callback=$callback";
             }
             $this->locate($location);
@@ -135,7 +140,7 @@ class sso extends control
 
     /**
      * Ajax set config.
-     * 
+     *
      * @access public
      * @return void
      */
@@ -158,9 +163,9 @@ class sso extends control
     }
 
     /**
-     * Bind user. 
-     * 
-     * @param  string $referer 
+     * Bind user.
+     *
+     * @param  string $referer
      * @access public
      * @return void
      */
@@ -199,7 +204,7 @@ class sso extends control
 
     /**
      * Get pairs of user.
-     * 
+     *
      * @access public
      * @return void
      */
@@ -212,7 +217,7 @@ class sso extends control
 
     /**
      * Get bind users with ranzhi.
-     * 
+     *
      * @access public
      * @return void
      */
@@ -225,7 +230,7 @@ class sso extends control
 
     /**
      * Bind user from ranzhi.
-     * 
+     *
      * @access public
      * @return void
      */
@@ -242,7 +247,7 @@ class sso extends control
 
     /**
      * Create user from ranzhi.
-     * 
+     *
      * @access public
      * @return void
      */
@@ -258,8 +263,8 @@ class sso extends control
 
     /**
      * Get todo list for ranzhi.
-     * 
-     * @param  string  $account 
+     *
+     * @param  string  $account
      * @access public
      * @return void
      */
diff --git a/module/story/model.php b/module/story/model.php
index d299d0baa8..ac96fb8eee 100644
--- a/module/story/model.php
+++ b/module/story/model.php
@@ -168,7 +168,7 @@ class storyModel extends model
         if($result['stop']) return array('status' => 'exists', 'id' => $result['duplicate']);
 
         if($this->checkForceReview()) $story->status = 'draft';
-        if($story->status == 'draft') $story->stage   = $this->post->plan > 0 ? 'planned' : 'wait';
+        if($story->status == 'draft') $story->stage  = $this->post->plan > 0 ? 'planned' : 'wait';
         $story = $this->loadModel('file')->processImgURL($story, $this->config->story->editor->create['id'], $this->post->uid);
         $this->dao->insert(TABLE_STORY)->data($story, 'spec,verify')->autoCheck()->batchCheck($this->config->story->create->requiredFields, 'notempty')->exec();
         if(!dao::isError())
@@ -476,7 +476,8 @@ class storyModel extends model
         }
 
         $story = fixer::input('post')
-            ->cleanInt('product,module,pri,duplicateStory,estimate')
+            ->cleanInt('product,module,pri,duplicateStory')
+            ->cleanFloat('estimate')
             ->add('assignedDate', $oldStory->assignedDate)
             ->add('lastEditedBy', $this->app->user->account)
             ->add('lastEditedDate', $now)
diff --git a/module/task/control.php b/module/task/control.php
index ba8539f1cf..3a0da100d7 100644
--- a/module/task/control.php
+++ b/module/task/control.php
@@ -1382,7 +1382,7 @@ class task extends control
                     $task->files = '';
                     foreach($relatedFiles[$task->id] as $file)
                     {
-                        $fileURL = common::getSysURL() . $this->file->webPath . $this->file->getRealPathName($file->pathname);
+                        $fileURL = common::getSysURL() . $this->createLink('file', 'download', "fileID={$file->id}");
                         $task->files .= html::a($fileURL, $file->title, '_blank') . '<br />';
                     }
                 }
diff --git a/module/testcase/lang/en.php b/module/testcase/lang/en.php
index 3a217eecd7..545f8ac6c5 100644
--- a/module/testcase/lang/en.php
+++ b/module/testcase/lang/en.php
@@ -148,7 +148,7 @@ $lang->testcase->priList[4] = 4;
 
 /* Define the types. */
 $lang->testcase->typeList['']            = '';
-$lang->testcase->typeList['feature']     = 'Function';
+$lang->testcase->typeList['feature']     = 'Feature';
 $lang->testcase->typeList['performance'] = 'Performance';
 $lang->testcase->typeList['config']      = 'Config';
 $lang->testcase->typeList['install']     = 'Install';
diff --git a/module/testreport/control.php b/module/testreport/control.php
index f42f97fc9a..a374571706 100644
--- a/module/testreport/control.php
+++ b/module/testreport/control.php
@@ -158,6 +158,8 @@ class testreport extends control
             $tasks = array($task->id => $task);
             $owner = $task->owner;
 
+            $this->setChartDatas($objectID);
+
             $this->view->title       = $task->name . $this->lang->testreport->create;
             $this->view->position[]  = html::a(inlink('browse', "objectID=$productID&objectType=product&extra={$task->id}"), $task->name);
             $this->view->position[]  = $this->lang->testreport->create;
@@ -306,6 +308,8 @@ class testreport extends control
                 $bugs = $this->testreport->getBugs4Test($builds, $report->product, $report->begin, $report->end);
             }
             $tasks = array($task->id => $task);
+
+            $this->setChartDatas($report->objectID);
         }
         else
         {
@@ -390,6 +394,8 @@ class testreport extends control
         $cases   = $this->testreport->getTaskCases($tasks, $report->cases);
         $bugInfo = $this->testreport->getBugInfo($tasks, $report->product, $report->begin, $report->end, $builds);
 
+        if($report->objectType == 'testtask') $this->setChartDatas($report->objectID);
+
         $this->view->title      = $report->title;
         $this->view->browseLink = $browseLink;
         $this->view->position[] = $report->title;
@@ -461,4 +467,29 @@ class testreport extends control
             return $projectID;
         }
     }
+
+    /**
+     * Set chart datas of cases.
+     *
+     * @param  int    $taskID
+     * @access public
+     * @return void
+     */
+    public function setChartDatas($taskID)
+    {
+        $this->loadModel('report');
+        $task   = $this->loadModel('testtask')->getById($taskID);
+        foreach($this->lang->testtask->report->charts as $chart => $title)
+        {
+            if(strpos($chart, 'testTask') === false) continue;
+
+            $chartFunc   = 'getDataOf' . $chart;
+            $chartData   = $this->testtask->$chartFunc($taskID);
+            $chartOption = $this->testtask->mergeChartOption($chart);
+            if(!empty($chartType)) $chartOption->type = $chartType;
+
+            $this->view->charts[$chart] = $chartOption;
+            $this->view->datas[$chart]  = $this->report->computePercent($chartData);
+        }
+    }
 }
diff --git a/module/testreport/lang/zh-cn.php b/module/testreport/lang/zh-cn.php
index 7894d57ac9..55b334c8c7 100644
--- a/module/testreport/lang/zh-cn.php
+++ b/module/testreport/lang/zh-cn.php
@@ -24,7 +24,7 @@ $lang->testreport->bugs        = '测试的Bug';
 $lang->testreport->builds      = '版本信息';
 $lang->testreport->goal        = '项目目标';
 $lang->testreport->cases       = '用例';
-$lang->testreport->bugInfo     = '缺陷分布';
+$lang->testreport->bugInfo     = 'Bug分布';
 $lang->testreport->report      = '总结';
 $lang->testreport->legacyBugs  = '遗留的Bug';
 $lang->testreport->createdDate = '创建时间';
diff --git a/module/testreport/lang/zh-tw.php b/module/testreport/lang/zh-tw.php
index c0355c0dc1..82ce33904f 100644
--- a/module/testreport/lang/zh-tw.php
+++ b/module/testreport/lang/zh-tw.php
@@ -24,7 +24,7 @@ $lang->testreport->bugs        = '測試的Bug';
 $lang->testreport->builds      = '版本信息';
 $lang->testreport->goal        = '項目目標';
 $lang->testreport->cases       = '用例';
-$lang->testreport->bugInfo     = '缺陷分佈';
+$lang->testreport->bugInfo     = 'Bug分佈';
 $lang->testreport->report      = '總結';
 $lang->testreport->legacyBugs  = '遺留的Bug';
 $lang->testreport->createdDate = '創建時間';
diff --git a/module/testreport/view/blockbugreport.html.php b/module/testreport/view/blockbugreport.html.php
index c5acb1ac11..232a061728 100644
--- a/module/testreport/view/blockbugreport.html.php
+++ b/module/testreport/view/blockbugreport.html.php
@@ -1,4 +1,50 @@
 <table class='table table-form'>
+  <?php foreach($charts as $chartType => $chartOption):?>
+  <tr>
+    <td class='text-top'>
+      <table class='table table-condensed table-report' id='bugSeverityGroups'>
+        <?php if(empty($datas[$chartType])):?>
+        <tr>
+          <td class='none-data'>
+            <h5><?php echo $lang->testtask->report->charts[$chartType];?></h5>
+            <?php echo $lang->testreport->none;?>
+          </td>
+        </tr>
+        <?php else:?>
+        <tr class='text-top'>
+          <td class='w-p70'>
+            <div class='chart-wrapper text-center'>
+              <h5><?php echo $lang->testtask->report->charts[$chartType];?></h5>
+              <div class='chart-canvas'><canvas id='chart-<?php echo $chartType ?>' width='<?php echo $chartOption->width;?>' height='<?php echo $chartOption->height;?>' data-responsive='true'></canvas></div>
+            </div>
+          </td>
+          <td>
+            <div class='table-wrapper' style='overflow:auto'>
+              <table class='table table-condensed table-hover table-striped table-bordered table-chart' data-chart='<?php echo $chartOption->type; ?>' data-target='#chart-<?php echo $chartType ?>' data-animation='false'>
+                <thead>
+                  <tr>
+                    <th class='chart-label' colspan='2'><?php echo $lang->report->item;?></th>
+                    <th class='w-50px'><?php echo $lang->report->value;?></th>
+                    <th class='w-50px'><?php echo $lang->report->percent;?></th>
+                  </tr>
+                </thead>
+                <?php foreach($datas[$chartType] as $key => $data):?>
+                <tr class='text-center'>
+                  <td class='chart-color'><i class='chart-color-dot'></i></td>
+                  <td class='chart-label'><?php echo $data->name;?></td>
+                  <td class='chart-value'><?php echo $data->value;?></td>
+                  <td><?php echo ($data->percent * 100) . '%';?></td>
+                </tr>
+                <?php endforeach;?>
+              </table>
+            </div>
+          </td>
+        </tr>
+        <?php endif;?>
+      </table>
+    </td>
+  </tr>
+  <?php endforeach;?>
   <?php foreach($bugInfo as $infoKey => $infoValue):?>
   <tr>
     <td class='text-top'>
diff --git a/module/testtask/js/create.js b/module/testtask/js/create.js
index 7987acb312..ae1a8ceb76 100755
--- a/module/testtask/js/create.js
+++ b/module/testtask/js/create.js
@@ -22,7 +22,7 @@ function loadProjectBuilds(projectID)
     selectedBuild = $('#build').val();
     if(!selectedBuild) selectedBuild = 0;
     link = createLink('build', 'ajaxGetProjectBuilds', 'projectID=' + projectID + '&productID=' + $('#product').val() + '&varName=testTaskBuild&build=' + selectedBuild);
-    $('#buildBox').load(link, function(){$('#build').chosen(window.);});
+    $('#buildBox').load(link, function(){$('#build').chosen();});
 }
 
 /**
diff --git a/module/user/lang/zh-cn.php b/module/user/lang/zh-cn.php
index 62ce6e2784..c8d852c127 100644
--- a/module/user/lang/zh-cn.php
+++ b/module/user/lang/zh-cn.php
@@ -72,7 +72,7 @@ $lang->user->search          = '搜索';
 $lang->user->profile     = '档案';
 $lang->user->project     = $lang->projectCommon;
 $lang->user->task        = '任务';
-$lang->user->bug         = '缺陷';
+$lang->user->bug         = 'Bug';
 $lang->user->test        = '测试';
 $lang->user->testTask    = '测试任务';
 $lang->user->testCase    = '测试用例';
diff --git a/module/user/lang/zh-tw.php b/module/user/lang/zh-tw.php
index bd0bd3584e..5519ad7edb 100644
--- a/module/user/lang/zh-tw.php
+++ b/module/user/lang/zh-tw.php
@@ -72,7 +72,7 @@ $lang->user->search          = '搜索';
 $lang->user->profile     = '檔案';
 $lang->user->project     = $lang->projectCommon;
 $lang->user->task        = '任務';
-$lang->user->bug         = '缺陷';
+$lang->user->bug         = 'Bug';
 $lang->user->test        = '測試';
 $lang->user->testTask    = '測試任務';
 $lang->user->testCase    = '測試用例';