diff --git a/e107_handlers/admin_ui.php b/e107_handlers/admin_ui.php
index 2129570f0..331390c0d 100644
--- a/e107_handlers/admin_ui.php
+++ b/e107_handlers/admin_ui.php
@@ -1035,7 +1035,7 @@ class e_admin_dispatcher
 		if($this->adminMenu)
 		{
 			reset($this->adminMenu);
-			list($mode, $action) = explode('/', key($this->adminMenu), 2);
+			list($mode, $action) = explode('/', key($this->adminMenu), 3);
 		}
 		else
 		{
@@ -1303,11 +1303,14 @@ class e_admin_dispatcher
 	{
 		$tp = e107::getParser();
 		$var = array();
-
+		$selected = false;
 		foreach($this->adminMenu as $key => $val)
 		{
-			$tmp = explode('/', trim($key, '/'), 2);
-
+			$tmp = explode('/', trim($key, '/'), 3);
+			
+			// custom 'selected' check
+			if(isset($val['selected']) && $val['selected']) $selected = $val['selected'] === true ? $key : $val['selected'];
+			
 			foreach ($val as $k=>$v)
 			{
 				switch($k)
@@ -1321,6 +1324,11 @@ class e_admin_dispatcher
 						$k2 = 'link';
 						$v = $tp->replaceConstants($v, 'abs').'?mode='.$tmp[0].'&action='.$tmp[1];
 					break;
+					
+					case 'uri':
+						$k2 = 'link';
+						$v = $tp->replaceConstants($v, 'abs');
+					break;
 
 					default:
 						$k2 = $k;
@@ -1352,7 +1360,7 @@ class e_admin_dispatcher
 		}
 
 		$request = $this->getRequest();
-		$selected = $request->getMode().'/'.$request->getAction();
+		if(!$selected) $selected = $request->getMode().'/'.$request->getAction();
 		$selected = vartrue($this->adminMenuAliases[$selected], $selected);
 		return e_admin_menu($this->menuTitle, $selected, $var);
 	}
@@ -2009,6 +2017,12 @@ class e_admin_controller_ui extends e_admin_controller
 	 * @var string SQL order, false to disable order, null is default order
 	 */
 	protected $listOrder = null;
+	
+	/**
+	 * Structure same as TreeModel parameters used for building the load() SQL
+	 * @var additional SQL to be applied when auto-building the list query
+	 */
+	protected $listQrySql = array();
 
 	/**
 	 * @var boolean
@@ -2949,7 +2963,14 @@ class e_admin_controller_ui extends e_admin_controller
 
 		if($raw)
 		{
-			$rawData = array('joinWhere' => $jwhere, 'filter' => $filter, 'filterFrom' => $filterFrom, 'search' => $searchQry, 'tableFromName' => $tableFrom);
+			$rawData = array(
+				'joinWhere' => $jwhere, 
+				'filter' => $filter, 
+				'listQrySql' => $this->listQrySql,
+				'filterFrom' => $filterFrom, 
+				'search' => $searchQry, 
+				'tableFromName' => $tableFrom,
+			);
 			$rawData['tableFrom'] = $tableSFieldsArr;
 			$rawData['joinsFrom'] = $tableSJoinArr;
 			$rawData['joins'] = $joins;
@@ -2971,6 +2992,19 @@ class e_admin_controller_ui extends e_admin_controller
 		{
 			$searchQry[] = " ( ".implode(" OR ",$filter)." ) ";
 		}
+		
+		// more user added sql
+		if(isset($this->listQrySql['db_where']) && $this->listQrySql['db_where'])
+		{
+			if(is_array($this->listQrySql['db_where']))
+			{
+				$searchQry[] = implode(" AND ", $this->listQrySql['db_where']);
+			}
+			else
+			{
+				$searchQry[] = $this->listQrySql['db_where'];
+			}
+		}
 
 		// where query
 		if(count($searchQry) > 0)
@@ -3701,7 +3735,10 @@ class e_admin_ui extends e_admin_controller_ui
 				}*/
 			}
 		}
-
+		
+		// don't touch it if already exists
+		if($this->_model) return $this;
+		
 		// default model
 		$this->_model = new e_admin_model();
 		$this->_model->setModelTable($this->table)
@@ -4093,7 +4130,7 @@ class e_admin_form_ui extends e_form
 			$option = array();
 			$parms = vartrue($val['writeParms'], array());
 			if(is_string($parms)) parse_str($parms, $parms);
-
+			
 			switch($val['type'])
 			{
 					case 'bool':
@@ -4167,7 +4204,7 @@ class e_admin_form_ui extends e_form
 					case 'method':
 						$method = $key; 
 						$list = call_user_func_array(array($this, $method), array('', $type, $parms));
-
+						
 						if(is_array($list))
 						{
 							//check for single option
diff --git a/e107_handlers/e107_class.php b/e107_handlers/e107_class.php
index 4d6537f57..20eaf39ae 100644
--- a/e107_handlers/e107_class.php
+++ b/e107_handlers/e107_class.php
@@ -2246,9 +2246,6 @@ class e107
 		define('e_REQUEST_URI', str_replace(array("'", '"'), array('%27', '%22'), $requestUri));
 		unset($requestUrl, $requestUri);
 		// END request uri/url detection, XSS protection
-		
-		define('e_SIGNUP', e_BASE.(file_exists(e_BASE.'customsignup.php') ? 'customsignup.php' : 'signup.php'));
-		define('e_LOGIN', e_BASE.(file_exists(e_BASE.'customlogin.php') ? 'customlogin.php' : 'login.php'));
 
 		// e_SELF has the full HTML path
 		$inAdminDir = FALSE;
@@ -2285,6 +2282,10 @@ class e107
 
 		define('SITEURLBASE', $this->HTTP_SCHEME.'://'.$_SERVER['HTTP_HOST']);
 		define('SITEURL', SITEURLBASE.e_HTTP);
+		
+		// login/signup
+		define('e_SIGNUP', SITEURL.(file_exists(e_BASE.'customsignup.php') ? 'customsignup.php' : 'signup.php'));
+		define('e_LOGIN', SITEURL.(file_exists(e_BASE.'customlogin.php') ? 'customlogin.php' : 'login.php'));
 
 		return $this;
 	}
diff --git a/e107_handlers/form_handler.php b/e107_handlers/form_handler.php
index 30e111ec9..8d2fdcb14 100644
--- a/e107_handlers/form_handler.php
+++ b/e107_handlers/form_handler.php
@@ -312,11 +312,14 @@ class e_form
 	function userpicker($name_fld, $id_fld, $default_name, $default_id, $options = array())
 	{
 		if(!is_array($options)) parse_str($options, $options);
+		
+		$label_fld = str_replace('_', '-', $name_fld).'-upicker-lable';
 
 		//'.$this->text($id_fld, $default_id, 10, array('id' => false, 'readonly'=>true, 'class'=>'tbox number')).'
 		$ret = '
 		<div class="e-autocomplete-c">
 			'.$this->text($name_fld, $default_name, 150, array('id' => false, 'readonly' => vartrue($options['readonly']) ? true : false)).'
+			<span id="'.$label_fld.'" class="'.($default_id ? 'success' : 'warning').'">Id #'.((int) $default_id).'</span>
 			'.$this->hidden($id_fld, $default_id, array('id' => false)).'
 				<span class="indicator" style="display: none;">
 					<img src="'.e_IMAGE_ABS.'generic/loading_16.gif" class="icon action S16" alt="Loading..." />
@@ -343,10 +346,17 @@ class e_form
 					  frequency: 0.5,
 					  afterUpdateElement: function(txt, li) {
 					  	if(!\$(li)) return;
+					  	var elnext = el.next('input[name={$id_fld}]'),
+					  		ellab = \$('{$label_fld}');
 					  	if(\$(li).id) {
-							el.next('input[name={$id_fld}]').value = parseInt(\$(li).id);
+							elnext.value = parseInt(\$(li).id);
 						} else {
-							el.next('input[name={$id_fld}]').value = 0
+							elnext.value = 0
+						}
+						if(ellab)
+						{
+							ellab.removeClassName('warning').removeClassName('success');
+							ellab.addClassName((elnext.value ? 'success' : 'warning')).update('Id #' + elnext.value);
 						}
 					  },
 					  indicator:  el.next('span.indicator'),
@@ -519,6 +529,7 @@ class e_form
 
 		foreach ($elements as $value => $label)
 		{
+			$label = defset($label, $label);
 			$text[] = $this->radio($name, $value, $checked == $value)."".$this->label($label, $name, $value).(isset($help[$value]) ? "<div class='field-help'>".$help[$value]."</div>" : '');
 		}
 		if(!$multi_line)
@@ -1230,10 +1241,11 @@ class e_form
 				return $value;
 			break;
 		}
-
+		
 		switch($attributes['type'])
 		{
 			case 'number':
+				if(!$value) $value = '0';
 				if($parms)
 				{
 					if(!isset($parms['sep'])) $value = number_format($value, $parms['decimals']);
@@ -1302,6 +1314,17 @@ class e_form
 				}
 				$value = ($value ? vartrue($parms['pre']).defset($value, $value).vartrue($parms['post']) : '');
 			break;
+			
+			case 'radio':
+				if($parms && is_array($parms)) // FIXME - add support for multi-level arrays (option groups)
+				{
+					$value = vartrue($parms['pre']).vartrue($parms[$value]).vartrue($parms['post']);
+					break;
+				}
+				
+				if(!is_array($attributes['writeParms'])) parse_str($attributes['writeParms'], $attributes['writeParms']);
+				$value = vartrue($parms['pre']).vartrue($parms[$value]).vartrue($parms['post']);
+			break;
 
 			case 'text':
 
@@ -1429,6 +1452,7 @@ class e_form
 				$ttl = '';
 				if(vartrue($parms['link']))
 				{
+					// previously set - real parameters are idField && nameField
 					$id = vartrue($parms['__idval']);
 					if($value && !is_numeric($value))
 					{
@@ -1551,7 +1575,7 @@ class e_form
 		{
 			return $this->renderValue($key, $value, $attributes).$this->hidden($key, $value); //
 		}
-
+		
 		switch($attributes['type'])
 		{
 			case 'number':
@@ -1559,6 +1583,7 @@ class e_form
 				unset($parms['maxlength']);
 				if(!vartrue($parms['size'])) $parms['size'] = 15;
 				if(!vartrue($parms['class'])) $parms['class'] = 'tbox number';
+				if(!$value) $value = '0';
 				return vartrue($parms['pre']).$this->text($key, $value, $maxlength, $parms).vartrue($parms['post']);
 			break;
 
@@ -1681,6 +1706,14 @@ class e_form
 				return vartrue($eloptions['pre']).$this->selectbox($key, $parms, $value, $eloptions).vartrue($eloptions['post']);
 			break;
 
+			case 'radio':
+				// TODO - more options (multi-line, help)
+				/*$eloptions  = vartrue($parms['__options'], array());
+				if(is_string($eloptions)) parse_str($eloptions, $eloptions);
+				unset($parms['__options']);*/
+				return vartrue($eloptions['pre']).$this->radio_multi($key, $parms, $value, false).vartrue($eloptions['post']);
+			break;
+
 			case 'userclass':
 			case 'userclasses':
 				$uc_options = vartrue($parms['classlist'], 'public,guest,nobody,member,classes,admin,main'); // defaults to 'public,guest,nobody,member,classes' (userclass handler)
@@ -1711,7 +1744,7 @@ class e_form
 
 				if(!is_array($value))
 				{
-					$value = get_user_data($value);
+					$value = $value ? e107::getSystemUser($value, true)->getUserData() : array();// get_user_data($value);
 				}
 
 				$colname = vartrue($parms['nameType'], 'user_name');
@@ -1988,6 +2021,7 @@ class e_form
 		// required fields - model definition
 		$model_required = $model->getValidationRules();
 		$required_help = false;
+		$hidden_fields = array();
 		foreach($fdata['fields'] as $key => $att)
 		{
 			// convert aliases - not supported in edit mod
@@ -2034,6 +2068,11 @@ class e_form
 					}
 				}
 				
+				if('hidden' === $att['type'])
+				{
+					$hidden_fields[] = $this->renderElement($keyName, $model->getIfPosted($valPath), $att, varset($model_required[$key], array()));
+					continue;
+				}
 				$text .= "
 					<tr>
 						<td class='label'>
@@ -2058,6 +2097,7 @@ class e_form
 		$text .= "
 					</tbody>
 				</table>
+				".implode("\n", $hidden_fields)."
 				".$required_help."
 				".vartrue($fdata['table_post'])."
 				<div class='buttons-bar center'>
diff --git a/e107_handlers/model_class.php b/e107_handlers/model_class.php
index 10a5d8d9b..f35832b0b 100644
--- a/e107_handlers/model_class.php
+++ b/e107_handlers/model_class.php
@@ -2099,11 +2099,13 @@ class e_front_model extends e_model
 			}
 		}
 
+		$tp = e107::getParser();
     	foreach ($data as $field => $dt)
     	{
     		// get values form validated array when possible
     		// we need it because of advanced validation methods e.g. 'compare'
-    		if(isset($valid_data[$field])) $dt = $valid_data[$field];
+    		// FIX - security issue, toDb required
+    		if(isset($valid_data[$field])) $dt = $tp->toDb($valid_data[$field]);
 
     		$this->setData($field, $dt, $strict)
     			->removePostedData($field);
@@ -2433,7 +2435,7 @@ class e_front_model extends e_model
 			}
 			return $ret;
 		}
-
+		
 		if(!isset($this->_data_fields[$key]))
 		{
 			return null;