CVE-2015-2972: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Multiple SQL injection vulnerabilities in Sysphonic Thetis before 2.3.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2015-07-19T15:59Z
Repository: https://github.com/sysphonic/thetis
Language: Ruby
Files changed: app/controllers/addressbook_controller.rb, app/controllers/config_controller.rb, app/controllers/desktop_controller.rb, app/controllers/equipment_controller.rb, app/controllers/folders_controller.rb, app/controllers/groups_controller.rb, app/controllers/items_controller.rb, app/controllers/locations_controller.rb, app/controllers/login_controller.rb, app/controllers/logs_controller.rb, app/controllers/mail_accounts_controller.rb, app/controllers/mail_filters_controller.rb, app/controllers/mail_folders_controller.rb, app/controllers/official_titles_controller.rb, app/controllers/paintmail_controller.rb, app/controllers/researches_controller.rb, app/controllers/schedules_controller.rb, app/controllers/send_mails_controller.rb, app/controllers/teams_controller.rb, app/controllers/templates_controller.rb, app/controllers/timecards_controller.rb, app/controllers/users_controller.rb, app/controllers/workflows_controller.rb, app/controllers/zeptair_dist_controller.rb, app/controllers/zeptair_post_controller.rb, app/controllers/zeptair_xlogs_controller.rb, app/helpers/addressbook_helper.rb, app/helpers/application_helper.rb, app/models/research.rb
Commit date: 2015-07-09 22:49:16 +0900
Commit message: Reinforcement of security.
Signed-off-by: MORITA Shintaro <shin@sysphonic.com>

Diff: diff --git a/app/controllers/addressbook_controller.rb b/app/controllers/addressbook_controller.rb
index 23d1d5b9..24ec7f73 100644
--- a/app/controllers/addressbook_controller.rb
+++ b/app/controllers/addressbook_controller.rb
@@ -56,20 +56,24 @@ class AddressbookController < ApplicationController
   def new
     if params[:action] == 'new'
       Log.add_info(request, params.inspect)
     end
 
+    return unless request.post?
+
     render(:action => 'edit', :layout => (!request.xhr?))
   end
 
   #=== create
   #
   #Creates Address.
   #
   def create
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @address = Address.new(params.require(:address).permit(Address::PERMIT_BASE))
 
     @address = AddressbookHelper.arrange_per_scope(@address, @login_user, params[:scope], params[:groups], params[:teams])
     if @address.nil?
       flash[:notice] = t('msg.need_to_be_owner')
@@ -104,10 +108,11 @@ class AddressbookController < ApplicationController
     address_id = params[:id]
 
     begin
       @address = Address.find(address_id)
     rescue => evar
+      @address = nil
       Log.add_error(request, evar)
       redirect_to(:controller => 'login', :action => 'logout')
       return
     end
     render(:layout => (!request.xhr?))
@@ -140,10 +145,12 @@ class AddressbookController < ApplicationController
   #Updates Address information.
   #
   def update
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @address = Address.find(params[:id])
     @address.attributes = params[:address]
 
     @address = AddressbookHelper.arrange_per_scope(@address, @login_user, params[:scope], params[:groups], params[:teams])
     if @address.nil?
@@ -240,10 +247,12 @@ class AddressbookController < ApplicationController
   #Deletes Addresses.
   #
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     if params[:check_address].nil?
       list
       render(:action => 'list')
       return
     end
@@ -294,10 +303,12 @@ class AddressbookController < ApplicationController
   #Imports Address list as a CSV file.
   #
   def import_csv
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     file = params[:imp_file]
     mode = params[:mode]
     enc = params[:enc]
     book = params[:filter_book]
     book = Address::BOOK_PRIVATE unless @login_user.admin?(User::AUTH_ADDRESSBOOK)
@@ -434,11 +445,11 @@ class AddressbookController < ApplicationController
   #
   #Filter method to check if current User is owner of specified Item.
   #
   def check_owner
 
-    return if (params[:id].nil? or params[:id].empty? or @login_user.nil?)
+    return if (params[:id].blank? or @login_user.nil?)
 
     address = Address.find(params[:id])
 
     if !@login_user.admin?(User::AUTH_ADDRESSBOOK) and address.owner_id != @login_user.id
       Log.add_check(request, '[check_owner]'+request.to_s)
diff --git a/app/controllers/config_controller.rb b/app/controllers/config_controller.rb
index 66e3cb89..ab0c987a 100644
--- a/app/controllers/config_controller.rb
+++ b/app/controllers/config_controller.rb
@@ -1,11 +1,11 @@
 #
 #= ConfigController
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
 #The Action-Controller about Configuration of Thetis.
 #
@@ -37,17 +37,19 @@ class ConfigController < ApplicationController
   #Updates configuration by Ajax.
   #
   def update_by_ajax
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     cat_h = {:desktop => User::AUTH_DESKTOP, :user => User::AUTH_USER, :log => User::AUTH_LOG}
 
     yaml = ApplicationHelper.get_config_yaml
 
     cat_h.keys.each do |cat|
 
-      next if params[cat].nil? or params[cat].empty?
+      next if params[cat].blank?
 
       unless @login_user.admin?(cat_h[cat])
         render(:text => t('msg.need_to_be_admin'))
         return
       end
@@ -69,10 +71,12 @@ class ConfigController < ApplicationController
   #Updates configuration.
   #
   def update
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     categories = [:general, :menu, :topic, :note, :smtp, :feed, :user, :log]
 
     yaml = ApplicationHelper.get_config_yaml
 
     categories.each do |cat|
@@ -147,10 +151,12 @@ class ConfigController < ApplicationController
   #Destroys the specified header menu.
   #
   def destroy_header_menu
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @yaml = ApplicationHelper.get_config_yaml
 
     unless params[:org_name].nil? or @yaml[:general]['header_menus'].nil?
       @yaml[:general]['header_menus'].each do |header_menu|
         if header_menu[0] == params[:org_name]
@@ -170,10 +176,12 @@ class ConfigController < ApplicationController
   #Updates the specified header menu.
   #
   def update_header_menu
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @yaml = ApplicationHelper.get_config_yaml
 
     @yaml[:general]['header_menus'] = [] if @yaml[:general]['header_menus'].nil?
 
     entry = [params[:header_menu]['name'], params[:header_menu]['target'], params[:header_menu]['url']]
@@ -219,10 +227,12 @@ class ConfigController < ApplicationController
   #Updates header menus' order.
   #
   def update_header_menus_order
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     header_menus = params[:header_menus_order]
 
     yaml = ApplicationHelper.get_config_yaml
 
     unless yaml[:general]['header_menus'].nil?
diff --git a/app/controllers/desktop_controller.rb b/app/controllers/desktop_controller.rb
index 4987aa15..5e77ae75 100644
--- a/app/controllers/desktop_controller.rb
+++ b/app/controllers/desktop_controller.rb
@@ -1,11 +1,11 @@
 #
 #= DesktopController
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
 #The Action-Controller about Desktop.
 #
@@ -34,10 +34,12 @@ class DesktopController < ApplicationController
   #Drops a file on desktop.
   #
   def drop_file
     Log.add_info(request, '')   # Not to show passwords.
 
+    return unless request.post?
+
     if params[:file].nil? or params[:file].size <= 0
       render(:text => '')
       return
     end
 
@@ -124,10 +126,12 @@ class DesktopController < ApplicationController
   #Updates Desktop preference.
   #
   def update_pref
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     desktop = Desktop.get_for(@login_user, true)
 
     params[:desktop].delete(:user_id)
 
     desktop.update_attributes(params.require(:desktop).permit(Desktop::PERMIT_BASE))
@@ -143,13 +147,15 @@ class DesktopController < ApplicationController
   #Updates Desktop configuration.
   #
   def update_config
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @yaml = ApplicationHelper.get_config_yaml
 
-    unless params[:desktop].nil? or params[:desktop].empty?
+    unless params[:desktop].blank?
       @yaml[:desktop] = Hash.new if @yaml[:desktop].nil?
 
       params[:desktop].each do |key, val|
         @yaml[:desktop][key] = val
       end
@@ -292,10 +298,12 @@ class DesktopController < ApplicationController
   #Receives dropped event on the desktop by Ajax.
   #
   def drop_on_desktop
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     if @login_user.nil?
       t = Time.now
       render(:text => (t.hour.to_s + t.min.to_s + t.sec.to_s))
       return
     end
@@ -317,10 +325,12 @@ class DesktopController < ApplicationController
   #Adds Toy on the desktop by Ajax.
   #
   def add_toy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     if @login_user.nil?
       render(:text => '0')
       return
     end
 
@@ -341,10 +351,13 @@ class DesktopController < ApplicationController
   #Receives dropped event on the recyclebox by Ajax.
   #
   def drop_on_recyclebox
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
+    SqlHelper.validate_token([params[:id]])
     unless @login_user.nil?
       Toy.destroy(params[:id])
     end
 
     render(:text => params[:id])
@@ -356,14 +369,17 @@ class DesktopController < ApplicationController
   #Saves toys' new position by Ajax.
   #
   def on_toys_moved
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     unless @login_user.nil?
       begin
         toy = Toy.find(params[:id])
       rescue
+        toy = nil
       end
 
       unless toy.nil?
         attrs = ActionController::Parameters.new({x: params[:x], y: params[:y]})
         toy.update_attributes(attrs.permit(Toy::PERMIT_BASE))
@@ -379,10 +395,12 @@ class DesktopController < ApplicationController
   #Creates a label as Toy instance.
   #
   def create_label
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     if params[:thetisBoxEdit].empty?
       render(:partial => 'ajax_label', :layout => false)
       return
     end
 
@@ -409,10 +427,12 @@ class DesktopController < ApplicationController
   #Updates the label.
   #
   def update_label
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     msg = params[:thetisBoxEdit]
 
     if params[:thetisBoxEdit].empty?
       render(:partial => 'ajax_label', :layout => false)
       return
@@ -453,10 +473,12 @@ class DesktopController < ApplicationController
   #Posts a label to specified users.
   #
   def post_label
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     if params[:txaPostLabel].empty? or params[:post_to].empty?
       render(:text => '')
       return
     end
 
diff --git a/app/controllers/equipment_controller.rb b/app/controllers/equipment_controller.rb
index e63d4006..2ad8de4c 100644
--- a/app/controllers/equipment_controller.rb
+++ b/app/controllers/equipment_controller.rb
@@ -1,11 +1,11 @@
 #
 #= EquipmentController
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
 #The Action-Controller about Equipment.
 #
@@ -40,10 +40,14 @@ class EquipmentController < ApplicationController
   #Creates Equipment.
   #
   def create
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
+    SqlHelper.validate_token([params[:groups], params[:teams]])
+
     if params[:groups].blank?
       params[:equipment][:groups] = nil
     else
       params[:equipment][:groups] = '|' + params[:groups].join('|') + '|'
     end
@@ -99,19 +103,23 @@ class EquipmentController < ApplicationController
   #Updates Equipment information.
   #
   def update
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
+    SqlHelper.validate_token([params[:groups], params[:teams]])
+
     @equipment = Equipment.find(params[:id])
 
-    if (params[:groups].nil? or params[:groups].empty?)
+    if params[:groups].blank?
       params[:equipment][:groups] = nil
     else
       params[:equipment][:groups] = '|' + params[:groups].join('|') + '|'
     end
 
-    if (params[:teams].nil? or params[:teams].empty?)
+    if params[:teams].blank?
       params[:equipment][:teams] = nil
     else
       params[:equipment][:teams] = '|' + params[:teams].join('|') + '|'
     end
 
@@ -176,18 +184,21 @@ class EquipmentController < ApplicationController
   #Deletes Equipment.
   #
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     if params[:check_equipment].nil?
       list
       render(:action => 'list')
       return
     end
 
     count = 0
     params[:check_equipment].each do |equipment_id, value|
+      SqlHelper.validate_token([equipment_id])
       if value == '1'
         Equipment.delete(equipment_id)
 
         count += 1
       end
@@ -203,11 +214,11 @@ class EquipmentController < ApplicationController
   #
   def schedule_all
     Log.add_info(request, params.inspect)
 
     date_s = params[:date]
-    if date_s.nil? or date_s.empty?
+    if date_s.blank?
       @date = Date.today
     else
       @date = Date.parse(date_s)
     end
 
diff --git a/app/controllers/folders_controller.rb b/app/controllers/folders_controller.rb
index 8c1ef685..e3bbe6c6 100644
--- a/app/controllers/folders_controller.rb
+++ b/app/controllers/folders_controller.rb
@@ -1,11 +1,11 @@
 #
 #= FoldersController
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
 #The Action-Controller about Folders.
 #
@@ -68,19 +68,21 @@ class FoldersController < ApplicationController
   #Receives Folder name from ThetisBox.
   #
   def create
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     parent_id = params[:selectedFolderId]
 
     unless Folder.check_user_auth(parent_id, @login_user, 'w', true)
       flash[:notice] = 'ERROR:' + t('folder.need_auth_to_modify')
       render(:partial => 'ajax_folder_entry', :layout => false)
       return
     end
 
-    if params[:thetisBoxEdit].nil? or params[:thetisBoxEdit].empty?
+    if params[:thetisBoxEdit].blank?
       @folder = nil
     else
       @folder = Folder.new
       @folder.name = params[:thetisBoxEdit]
       @folder.xorder = Folder.get_order_max(parent_id) + 1
@@ -98,19 +100,21 @@ class FoldersController < ApplicationController
   #Receives Folder name from ThetisBox.
   #
   def rename
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @folder = Folder.find(params[:id])
 
     unless Folder.check_user_auth(@folder.id, @login_user, 'w', true)
       flash[:notice] = 'ERROR:' + t('folder.need_auth_to_modify')
       render(:partial => 'ajax_folder_name', :layout => false)
       return
     end
 
-    unless params[:thetisBoxEdit].nil? or params[:thetisBoxEdit].empty?
+    unless params[:thetisBoxEdit].blank?
       @folder.name = params[:thetisBoxEdit]
       @folder.save
     end
     render(:partial => 'ajax_folder_name', :layout => false)
   end
@@ -121,10 +125,12 @@ class FoldersController < ApplicationController
   #Deletes Folder.
   #
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @folder = Folder.find(params[:id])
 
     unless Folder.check_user_auth(@folder.id, @login_user, 'w', true)
       flash[:notice] = 'ERROR:' + t('folder.need_auth_to_modify')
       render(:partial => 'common/flash_notice', :layout => false)
@@ -149,10 +155,12 @@ class FoldersController < ApplicationController
   #params[:thetisBoxSelKeeper] keeps selected ID of <a>-tag like "thetisBoxSelKeeper-1:<selected-id>". 
   #
   def move
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @folder = Folder.find(params[:id])
 
     if params[:thetisBoxSelKeeper].blank?
       redirect_to(:action => 'show_tree')
       return
@@ -196,17 +204,18 @@ class FoldersController < ApplicationController
   #Gets path-string of specified Folder.
   #
   def get_path
     Log.add_info(request, params.inspect)
 
-    if params[:thetisBoxSelKeeper].nil? or params[:thetisBoxSelKeeper].empty?
+    if params[:thetisBoxSelKeeper].blank?
       @folder_path = '/' + t('paren.unknown')
       render(:partial => 'ajax_folder_path', :layout => false)
       return
     end
 
     @selected_id = params[:thetisBoxSelKeeper].split(':').last
+    SqlHelper.validate_token([@selected_id])
 
     @folder_path = Folder.get_path(@selected_id)
 
     render(:partial => 'ajax_folder_path', :layout => false)
   end
@@ -220,10 +229,11 @@ class FoldersController < ApplicationController
     if params[:action] == 'get_items'
       Log.add_info(request, params.inspect)
     end
 
     @folder_id = params[:id]
+    SqlHelper.validate_token([@folder_id])
 
     if Folder.check_user_auth(@folder_id, @login_user, 'r', true)
 =begin
 #      if !@login_user.nil? and @login_user.admin?(User::AUTH_ITEM)
 #        @items = Folder.get_items_admin(@folder_id)
@@ -237,10 +247,11 @@ class FoldersController < ApplicationController
       @sort_type = params[:sort_type]
 
       if @sort_col.blank? or @sort_type.blank?
         @sort_col, @sort_type = FoldersHelper.get_sort_params(@folder_id)
       end
+      SqlHelper.validate_token([@sort_col, @sort_type])
 
       folder_ids = nil
       add_con = nil
 
       if @folder_id.nil? and params[:find_in] != Item::FOLDER_ALL
@@ -290,15 +301,17 @@ class FoldersController < ApplicationController
   #
   def get_items_order
     Log.add_info(request, params.inspect)
 
     @folder_id = params[:id]
+    SqlHelper.validate_token([@folder_id])
 
     if @folder_id != '0'
       begin
         @folder = Folder.find(@folder_id)
       rescue => evar
+        @folder = nil
         Log.add_error(request, evar)
       end
     end
 
     if Folder.check_user_auth(@folder_id, @login_user, 'r', true)
@@ -320,10 +333,12 @@ class FoldersController < ApplicationController
   #Updates Items' order by Ajax.
   #
   def update_items_order
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     folder_id = params[:id]
 
     if Folder.check_user_auth(folder_id, @login_user, 'w', true)
 
       order_ary = params[:items_order]
@@ -351,10 +366,11 @@ class FoldersController < ApplicationController
   def get_folders_order
     Log.add_info(request, params.inspect)
 
     @folder_id = params[:id]
     @group_id = params[:group_id]
+    SqlHelper.validate_token([@folder_id, @group_id])
 
     if @folder_id != '0'
       @folder = Folder.find(@folder_id)
     end
 
@@ -380,10 +396,12 @@ class FoldersController < ApplicationController
   #Updates folders' order by Ajax.
   #
   def update_folders_order
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     order_ary = params[:folders_order]
 
     folders = Folder.get_childs(params[:id], nil, false, true, false)
     # folders must be ordered by xorder ASC.
 
@@ -405,10 +423,11 @@ class FoldersController < ApplicationController
       begin
         folder = Folder.find(folder_id)
         folder.update_attribute(:xorder, idx)
         idx += 1
       rescue => evar
+        folder = nil
         Log.add_error(request, evar)
       end
     end
 
     render(:text => '')
@@ -420,19 +439,22 @@ class FoldersController < ApplicationController
   #Gets display control of specified Folder.
   #
   def get_disp_ctrl
     Log.add_info(request, params.inspect)
 
-    if params[:id] != '0'
+    folder_id = params[:id]
+    SqlHelper.validate_token([folder_id])
+
+    if folder_id != '0'
       begin
-        @folder = Folder.find(params[:id])
+        @folder = Folder.find(folder_id)
       rescue => evar
         @folder = nil
       end
     end
 
-    session[:folder_id] = params[:id]
+    session[:folder_id] = folder_id
 
     render(:partial => 'ajax_disp_ctrl', :layout => false)
   end
 
   #=== set_disp_ctrl
@@ -441,11 +463,14 @@ class FoldersController < ApplicationController
   #Sets display control of specified Folder.
   #
   def set_disp_ctrl
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     folder_id = params[:id]
+    SqlHelper.validate_token([folder_id])
 
     if Folder.check_user_auth(folder_id, @login_user, 'w', true)
 
       @folder = Folder.find(folder_id)
 
@@ -480,19 +505,22 @@ class FoldersController < ApplicationController
   #Gets authorities of specified Folder.
   #
   def get_auth_users
     Log.add_info(request, params.inspect)
 
+    folder_id = params[:id]
+    SqlHelper.validate_token([folder_id])
+
     begin
-      @folder = Folder.find(params[:id])
+      @folder = Folder.find(folder_id)
     rescue
       @folder = nil
     end
 
     @users = []
 
-    session[:folder_id] = params[:id]
+    session[:folder_id] = folder_id
 
     if !@login_user.nil? and (@login_user.admin?(User::AUTH_FOLDER) or (!@folder.nil? and @folder.in_my_folder_of?(@login_user.id)))
       render(:partial => 'ajax_auth_users', :layout => false)
     else
       render(:partial => 'ajax_auth_disp', :layout => false)
@@ -509,10 +537,11 @@ class FoldersController < ApplicationController
 
     SqlHelper.validate_token([params[:id]])
     begin
       @folder = Folder.find(params[:id])
     rescue => evar
+      @folder = nil
       Log.add_error(request, evar)
     end
 
     @group_id = nil
     if !params[:thetisBoxSelKeeper].nil?
@@ -533,10 +562,12 @@ class FoldersController < ApplicationController
   #Sets authorities of specified Folder.
   #
   def set_auth_users
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @folder = Folder.find(params[:id])
 
     if Folder.check_user_auth(@folder.id, @login_user, 'w', true)
 
       read_users = []
@@ -557,23 +588,25 @@ class FoldersController < ApplicationController
 
       user_id = @folder.get_my_folder_owner
       if !user_id.nil? and (!read_users.include?(user_id.to_s) or !write_users.include?(user_id.to_s))
         flash[:notice] = 'ERROR:' + t('folder.my_folder_without_auth_owner')
       else
-        @folder.set_read_users read_users
-        @folder.set_write_users write_users
+        @folder.set_read_users(read_users)
+        @folder.set_write_users(write_users)
 
         @folder.save
 
         flash[:notice] = t('msg.register_success')
       end
     else
       flash[:notice] = 'ERROR:' + t('folder.need_auth_to_modify')
     end
 
     @group_id = params[:group_id]
-    if @group_id.nil? or @group_id.empty?
+    SqlHelper.validate_token([@group_id])
+
+    if @group_id.blank?
       @users = []
     else
       @users = Group.get_users(@group_id)
     end
     render(:partial => 'ajax_auth_users', :layout => false)
@@ -589,19 +622,22 @@ class FoldersController < ApplicationController
   #Gets authorities of specified Folder.
   #
   def get_auth_groups
     Log.add_info(request, params.inspect)
 
+    folder_id = params[:id]
+    SqlHelper.validate_token([folder_id])
+
     begin
-      @folder = Folder.find(params[:id])
+      @folder = Folder.find(folder_id)
     rescue
       @folder = nil
     end
 
     @groups = Group.where(nil).to_a
 
-    session[:folder_id] = params[:id]
+    session[:folder_id] = folder_id
 
     render(:partial => 'ajax_auth_groups', :layout => false)
   end
 
   #=== set_auth_groups
@@ -610,10 +646,12 @@ class FoldersController < ApplicationController
   #Sets authorities of specified Folder.
   #
   def set_auth_groups
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @folder = Folder.find(params[:id])
 
     if Folder.check_user_auth(@folder.id, @login_user, 'w', true)
       read_groups = []
       write_groups = []
@@ -629,12 +667,12 @@ class FoldersController < ApplicationController
             write_groups << user_id
           end
         end
       end
 
-      @folder.set_read_groups read_groups
-      @folder.set_write_groups write_groups
+      @folder.set_read_groups(read_groups)
+      @folder.set_write_groups(write_groups)
 
       @folder.save
 
       flash[:notice] = t('msg.register_success')
     else
@@ -655,20 +693,23 @@ class FoldersController < ApplicationController
   #Gets authorities of specified Folder.
   #
   def get_auth_teams
     Log.add_info(request, params.inspect)
 
+    folder_id = params[:id]
+    SqlHelper.validate_token([folder_id])
+
     begin
-      @folder = Folder.find(params[:id])
+      @folder = Folder.find(folder_id)
     rescue
       @folder = nil
     end
 
     target_user_id = (@login_user.admin?(User::AUTH_TEAM))?(nil):(@login_user.id)
     @teams = Team.get_for(target_user_id, true)
 
-    session[:folder_id] = params[:id]
+    session[:folder_id] = folder_id
 
     render(:partial => 'ajax_auth_teams', :layout => false)
   end
 
   #=== set_auth_teams
@@ -677,10 +718,12 @@ class FoldersController < ApplicationController
   #Sets authorities of specified Folder.
   #
   def set_auth_teams
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @folder = Folder.find(params[:id])
 
     if Folder.check_user_auth(@folder.id, @login_user, 'w', true)
       read_teams = []
       write_teams = []
@@ -696,12 +739,12 @@ class FoldersController < ApplicationController
             write_teams << user_id
           end
         end
       end
 
-      @folder.set_read_teams read_teams
-      @folder.set_write_teams write_teams
+      @folder.set_read_teams(read_teams)
+      @folder.set_write_teams(write_teams)
 
       @folder.save
 
       flash[:notice] = t('msg.register_success')
     else
@@ -723,12 +766,10 @@ class FoldersController < ApplicationController
   #Deletes specified Items.
   #
   def ajax_delete_items
     Log.add_info(request, params.inspect)
 
-    folder_id = params[:id]
-
     unless params[:check_item].blank?
       is_admin = @login_user.admin?(User::AUTH_ITEM)
 
       count = 0
       params[:check_item].each do |item_id, value|
@@ -739,10 +780,11 @@ class FoldersController < ApplicationController
             next if !is_admin and item.user_id != @login_user.id
 
             item.destroy
 
           rescue => evar
+            item = nil
             Log.add_error(request, evar)
           end
 
           count += 1
         end
@@ -760,10 +802,11 @@ class FoldersController < ApplicationController
   #
   def ajax_move_items
     Log.add_info(request, params.inspect)
 
     folder_id = params[:thetisBoxSelKeeper].split(':').last
+    SqlHelper.validate_token([folder_id])
 
     unless Folder.check_user_auth(folder_id, @login_user, 'w', true)
       flash[:notice] = 'ERROR:' + t('folder.need_auth_to_write_in')
       get_items
       return
@@ -781,10 +824,11 @@ class FoldersController < ApplicationController
             next if !is_admin and item.user_id != @login_user.id
 
             item.update_attribute(:folder_id, folder_id)
 
           rescue => evar
+            item = nil
             Log.add_error(request, evar)
           end
 
           count += 1
         end
diff --git a/app/controllers/groups_controller.rb b/app/controllers/groups_controller.rb
index 7dc095f2..e2c8f91c 100644
--- a/app/controllers/groups_controller.rb
+++ b/app/controllers/groups_controller.rb
@@ -66,13 +66,15 @@ class GroupsController < ApplicationController
   #<Ajax>
   #Creates Group.
   #Receives Group name from ThetisBox.
   #
   def create
-     Log.add_info(request, params.inspect)
+    Log.add_info(request, params.inspect)
+
+    return unless request.post?
 
-    if params[:thetisBoxEdit].nil? or params[:thetisBoxEdit].empty?
+    if params[:thetisBoxEdit].blank?
       @group = nil
     else
       @group = Group.new
       @group.name = params[:thetisBoxEdit]
       @group.parent_id = params[:selectedGroupId]
@@ -90,13 +92,15 @@ class GroupsController < ApplicationController
   #Receives Group name from ThetisBox.
   #
   def rename
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @group = Group.find(params[:id])
-    unless params[:thetisBoxEdit].nil? or params[:thetisBoxEdit].empty?
-      @group.rename params[:thetisBoxEdit]
+    unless params[:thetisBoxEdit].blank?
+      @group.rename(params[:thetisBoxEdit])
     end
     render(:partial => 'ajax_group_name', :layout => false)
 
   rescue => evar
     Log.add_error(request, evar)
@@ -109,10 +113,13 @@ class GroupsController < ApplicationController
   #Deletes Group.
   #
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
+    SqlHelper.validate_token([params[:id]])
     begin
       Group.destroy(params[:id])
     rescue => evar
       Log.add_error(request, evar)
     end
@@ -126,10 +133,12 @@ class GroupsController < ApplicationController
   #params[:thetisBoxSelKeeper] keeps selected id of <a>-tag like "thetisBoxSelKeeper-1:<selected-id>". 
   #
   def move
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @group = Group.find(params[:id])
 
     unless params[:thetisBoxSelKeeper].blank?
 
       parent_id = params[:thetisBoxSelKeeper].split(':').last
@@ -158,17 +167,18 @@ class GroupsController < ApplicationController
   #Gets path-string of group specified by id in access-path.
   #
   def get_path
     Log.add_info(request, params.inspect)
 
-    if params[:thetisBoxSelKeeper].nil? or params[:thetisBoxSelKeeper].empty?
+    if params[:thetisBoxSelKeeper].blank?
       @group_path = '/' + t('paren.unknown')
       render(:partial => 'ajax_group_path', :layout => false)
       return
     end
 
     @selected_id = params[:thetisBoxSelKeeper].split(':').last
+    SqlHelper.validate_token([@selected_id])
 
     @group_path = Group.get_path(@selected_id)
 
     render(:partial => 'ajax_group_path', :layout => false)
   end
@@ -179,11 +189,14 @@ class GroupsController < ApplicationController
   #Excludes specified Users.
   #
   def ajax_exclude_users
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     group_id = params[:id]
+    SqlHelper.validate_token([group_id])
 
     unless params[:check_user].blank?
       count = 0
       params[:check_user].each do |user_id, value|
         if value == '1'
@@ -191,10 +204,11 @@ class GroupsController < ApplicationController
           begin
             user = User.find(user_id)
             user.exclude_from(group_id)
             user.save!
           rescue => evar
+            user = nil
             Log.add_error(request, evar)
           end
 
           count += 1
         end
@@ -211,12 +225,15 @@ class GroupsController < ApplicationController
   #Moves specified Users.
   #
   def ajax_move_users
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     org_group_id = params[:id]
     group_id = params[:thetisBoxSelKeeper].split(':').last
+    SqlHelper.validate_token([org_group_id, group_id])
 
     unless params[:check_user].blank?
 
       count = 0
       params[:check_user].each do |user_id, value|
@@ -226,10 +243,11 @@ class GroupsController < ApplicationController
             user = User.find(user_id)
             user.exclude_from(org_group_id)
             user.add_to(group_id)
             user.save!
           rescue => evar
+            user = nil
             Log.add_error(request, evar)
           end
 
           count += 1
         end
@@ -249,10 +267,11 @@ class GroupsController < ApplicationController
     if params[:action] == 'get_users'
       Log.add_info(request, params.inspect)
     end
 
     @group_id = params[:id]
+    SqlHelper.validate_token([@group_id])
 
 =begin
 #    @users = Group.get_users(params[:id])
 =end
 
@@ -321,10 +340,11 @@ class GroupsController < ApplicationController
   #
   def get_groups_order
     Log.add_info(request, params.inspect)
 
     @group_id = params[:id]
+    SqlHelper.validate_token([@group_id])
 
     if @group_id != '0'
       @group = Group.find(@group_id)
     end
 
@@ -346,10 +366,12 @@ class GroupsController < ApplicationController
   #Updates groups' order by Ajax.
   #
   def update_groups_order
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     order_ary = params[:groups_order]
 
     groups = Group.get_childs(params[:id], false, false)
     # groups must be ordered by xorder ASC.
 
@@ -371,10 +393,11 @@ class GroupsController < ApplicationController
       begin
         group = Group.find(group_id)
         group.update_attribute(:xorder, idx)
         idx += 1
       rescue => evar
+        group = nil
         Log.add_error(request, evar)
       end
     end
 
     render(:text => '')
@@ -387,10 +410,11 @@ class GroupsController < ApplicationController
   #
   def get_official_titles
     Log.add_info(request, params.inspect)
 
     @group_id = (params[:id] || '0')  # '0' for ROOT
+    SqlHelper.validate_token([@group_id])
 
     session[:group_id] = params[:id]
     session[:group_option] = 'official_title'
 
     render(:partial => 'ajax_official_titles', :layout => false)
@@ -403,10 +427,11 @@ class GroupsController < ApplicationController
   #
   def get_workflows
     Log.add_info(request, params.inspect)
 
     @group_id = (params[:id] || '0')  # '0' for ROOT
+    SqlHelper.validate_token([@group_id])
 
     ary = TemplatesHelper.get_tmpl_folder
 
     unless ary.nil? or ary.empty?
       @tmpl_workflows_folder = ary[2]
@@ -425,10 +450,11 @@ class GroupsController < ApplicationController
   #
   def get_map
     Log.add_info(request, params.inspect)
 
     @group_id = (params[:id] || '0')  # '0' for ROOT
+    SqlHelper.validate_token([@group_id])
 
     @office_map = OfficeMap.get_for_group(@group_id)
 
     session[:group_id] = params[:id]
     session[:group_option] = 'office_map'
diff --git a/app/controllers/items_controller.rb b/app/controllers/items_controller.rb
index aa273488..7991f799 100644
--- a/app/controllers/items_controller.rb
+++ b/app/controllers/items_controller.rb
@@ -1,11 +1,11 @@
 #
 #= ItemsController
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
 #The Action-Controller about Items.
 #
@@ -81,10 +81,11 @@ class ItemsController < ApplicationController
       end
     elsif params[:folder_id].blank?
     else
       @folder_id = params[:folder_id]
     end
+    SqlHelper.validate_token([@folder_id])
 
     unless @folder_id.nil?
       session[:folder_id] = @folder_id
 
       unless Folder.check_user_auth(@folder_id, @login_user, 'r', true)
@@ -139,19 +140,19 @@ class ItemsController < ApplicationController
   #Does same as list-action except rendered rhtml.
   #
   def search
     Log.add_info(request, params.inspect)
 
-    unless params[:select_sorting].nil? or params[:select_sorting].empty?
+    unless params[:select_sorting].blank?
       sort_a = params[:select_sorting].split(' ')
       params[:sort_col] = sort_a.first
       params[:sort_type] = sort_a.last
     end
 
     list
 
-    if params[:keyword].nil? or params[:keyword].empty?
+    if params[:keyword].blank?
       if params[:from_action].nil? or params[:from_action] == 'bbs'
         render(:action => 'bbs')
       else
         render(:action => 'list')
       end
@@ -164,11 +165,11 @@ class ItemsController < ApplicationController
   #Does same as list-action except rendered rhtml.
   #
   def bbs
     Log.add_info(request, params.inspect)
 
-    if !params[:select_sorting].nil?
+    unless params[:select_sorting].nil?
       sort_a = params[:select_sorting].split(' ')
       params[:sort_col] = sort_a.first
       params[:sort_type] = sort_a.last
     end
 
@@ -216,11 +217,11 @@ class ItemsController < ApplicationController
   #Shows page to create a new Item.
   #
   def new
 
     @item = Item.new
-    if params[:folder_id].nil? or params[:folder_id].empty?
+    if params[:folder_id].blank?
       my_folder = @login_user.get_my_folder
       if my_folder.nil?
         @item.folder_id = 0
       else
         @item.folder_id = my_folder.id
@@ -242,10 +243,11 @@ class ItemsController < ApplicationController
     Log.add_info(request, params.inspect)
 
     begin
       @item = Item.find(params[:id])
     rescue => evar
+      @item = nil
       Log.add_error(request, evar)
     end
   end
 
   #=== move
@@ -254,10 +256,12 @@ class ItemsController < ApplicationController
   #Moves Item to the specified Folder.
   #
   def move
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @item = Item.find(params[:id])
 
     unless params[:thetisBoxSelKeeper].nil?
 
       folder_id = params[:thetisBoxSelKeeper].split(':').last
@@ -285,19 +289,22 @@ class ItemsController < ApplicationController
   #Moves multiple Items.
   #
   def move_multi
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     if params[:check_item].nil? or params[:thetisBoxSelKeeper].nil?
       list
       render(:action => 'list')
       return
     end
 
     is_admin = @login_user.admin?(User::AUTH_ITEM)
 
     folder_id = params[:thetisBoxSelKeeper].split(':').last
+    SqlHelper.validate_token([folder_id])
 
     unless Folder.check_user_auth(folder_id, @login_user, 'w', true)
       flash[:notice] = 'ERROR:' + t('folder.need_auth_to_write_in')
 
       list
@@ -314,10 +321,11 @@ class ItemsController < ApplicationController
           next if !is_admin and item.user_id != @login_user.id
 
           item.update_attribute(:folder_id, folder_id)
 
         rescue => evar
+          item = nil
           Log.add_error(request, evar)
         end
 
         count += 1
       end
@@ -333,10 +341,12 @@ class ItemsController < ApplicationController
   #Deletes Item.
   #
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     begin
       Item.destroy(params[:id])
     rescue => evar
       Log.add_error(request, evar)
     end
@@ -358,10 +368,12 @@ class ItemsController < ApplicationController
   #Deletes multiple Items.
   #
   def destroy_multi
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     if params[:check_item].nil?
       list
       render(:action => 'list')
       return
     end
@@ -398,10 +410,12 @@ class ItemsController < ApplicationController
   #Duplicates Item.
   #
   def duplicate
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     copies_folder = ItemsHelper.get_copies_folder(@login_user.id)
 
     item = Item.find(params[:id])
     if item.is_a_copy?
       flash[:notice] = 'ERROR:' + t('msg.system_error')
@@ -427,10 +441,12 @@ class ItemsController < ApplicationController
   #Registers Workflow information of the Item.
   #
   def set_workflow
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @item = Item.find(params[:id])
 
     orders_hash = params.dup
     orders_hash.reject! { |key, value|
       key.index(/order-/) != 0
@@ -439,12 +455,14 @@ class ItemsController < ApplicationController
       key.split('-').last.to_i
     }
 
     orders = []
     orders_hash.each do |key, value|
+      user_ids = value.split(',')
+      SqlHelper.validate_token([user_ids])
 
-      orders << '|' + value.split(',').join('|') + '|'
+      orders << '|' + user_ids.join('|') + '|'
     end
     @item.workflow.update_attribute(:users, orders.join(','))
 
     render(:partial => 'ajax_item_workflow', :layout => false)
 
@@ -464,10 +482,12 @@ class ItemsController < ApplicationController
   #Registers basic information of the Item.
   #
   def set_basic
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     if params[:item][:xtype] == Item::XTYPE_ZEPTAIR_DIST \
         and !@login_user.admin?(User::AUTH_ZEPTAIR)
       render(:text => t('msg.need_to_be_admin'))
       return
     end
@@ -578,11 +598,13 @@ class ItemsController < ApplicationController
   #Registers desctiption of the Item.
   #
   def set_description
     Log.add_info(request, params.inspect)
 
-    if params[:id].nil? or params[:id].empty?
+    return unless request.post?
+
+    if params[:id].blank?
       @item = Item.new_info(0)
       @item.attributes = params.require(:item).permit(Item::PERMIT_BASE)
       @item.user_id = @login_user.id
       @item.title = t('paren.no_title')
       @item.save
@@ -623,15 +645,17 @@ class ItemsController < ApplicationController
   #Registers images of the Item.
   #
   def set_image
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     created = false
 
-    if params[:id].nil? or params[:id].empty?
+    if params[:id].blank?
       @item = Item.new_info(0)
-      @item.attributes = params[:item]
+      @item.attributes = params.require(:item).permit(Item::PERMIT_BASE)
       @item.user_id = @login_user.id
       @item.title = t('paren.no_title')
 
       [:image0, :image1].each do |img|
 
@@ -707,10 +731,12 @@ class ItemsController < ApplicationController
   #Deletes Image.
   #
   def delete_image
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     begin
       image = Image.find(params[:image_id])
 
       @item = Item.find(image.item_id)
 
@@ -757,10 +783,12 @@ class ItemsController < ApplicationController
   #Updates Image information.
   #
   def update_image_info
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     image = Image.find(params[:image_id])
 
     # Getting Item at first for the case of resetting the db connection by an error.
     @item = Item.find(image.item_id)
 
@@ -797,10 +825,12 @@ class ItemsController < ApplicationController
   #Updates Images' order by Ajax.
   #
   def update_images_order
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     order_ary = params[:images_order]
 
     item = Item.find(params[:id])
 
     item.images_without_content.each do |img|
@@ -809,11 +839,11 @@ class ItemsController < ApplicationController
       end
 
       img.update_attribute(:xorder, order_ary.index(img.id.to_s) + 1)
 
       class << img
-        remove_method :record_timestamps
+        remove_method(:record_timestamps)
       end
     end
 
     render(:text => '')
 
@@ -832,15 +862,17 @@ class ItemsController < ApplicationController
   #Registers attachment-files of the Item.
   #
   def set_attachment
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     created = false
 
-    if params[:id].nil? or params[:id].empty?
+    if params[:id].blank?
       @item = Item.new_info(0)
-      @item.attributes = params[:item]
+      @item.attributes = params.require(:item).permit(Item::PERMIT_BASE)
       @item.user_id = @login_user.id
       @item.title = t('paren.no_title')
 
       [:attachment0, :attachment1].each do |attach|
 
@@ -892,11 +924,11 @@ class ItemsController < ApplicationController
     if attach.nil?
       redirect_to(THETIS_RELATIVE_URL_ROOT + '/404.html')
       return
     end
 
-    parent_item = attach.item || ((attach.comment.nil?) ? nil : attach.comment.item)
+    parent_item = (attach.item || ((attach.comment.nil?) ? nil : attach.comment.item))
     if parent_item.nil? or !parent_item.check_user_auth(@login_user, 'r', true)
       Log.add_check(request, '[Item.check_user_auth]'+request.to_s)
       redirect_to(:controller => 'frames', :action => 'http_error', :id => '401')
       return
     end
@@ -934,10 +966,12 @@ class ItemsController < ApplicationController
   #Deletes Attachment.
   #
   def delete_attachment
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     begin
       attach = Attachment.find(params[:attachment_id])
 
       @item = Item.find(attach.item_id)
 
@@ -984,10 +1018,12 @@ class ItemsController < ApplicationController
   #Updates Attachment information.
   #
   def update_attachment_info
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     attachment = Attachment.find(params[:attachment_id])
 
     # Getting Item at first for the case of resetting the db connection by an error.
     @item = Item.find(attachment.item_id)
 
@@ -1024,10 +1060,12 @@ class ItemsController < ApplicationController
   #Updates Attachments' order by Ajax.
   #
   def update_attachments_order
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     order_ary = params[:attachments_order]
 
     item = Item.find(params[:id])
 
     item.attachments_without_content.each do |attach|
@@ -1036,11 +1074,11 @@ class ItemsController < ApplicationController
       end
 
       attach.update_attribute(:xorder, order_ary.index(attach.id.to_s) + 1)
 
       class << attach
-        remove_method :record_timestamps
+        remove_method(:record_timestamps)
       end
     end
 
     render(:text => '')
 
@@ -1059,10 +1097,12 @@ class ItemsController < ApplicationController
   #Adds a message to the Item.
   #
   def add_comment
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     unless params[:comment][:file].nil?
       attach_params = { :file => params[:comment][:file] }
       params[:comment].delete(:file)
     end
 
@@ -1108,10 +1148,12 @@ class ItemsController < ApplicationController
   #Updates a message of the Item.
   #
   def update_comment
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     unless params[:thetisBoxEdit].empty?
       @comment = Comment.find(params[:comment_id])
       if @comment.nil?
         redirect_to(THETIS_RELATIVE_URL_ROOT + '/404.html' )
         return
@@ -1130,10 +1172,12 @@ class ItemsController < ApplicationController
   #Deletes a message of the Item.
   #
   def destroy_comment
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     comment = Comment.find(params[:comment_id])
     @item = comment.item
 
     unless @login_user.admin?(User::AUTH_ITEM) or \
               comment.user_id == @login_user.id or \
@@ -1166,10 +1210,12 @@ class ItemsController < ApplicationController
   #Attaches a file to the Comment.
   #
   def add_comment_attachment
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     unless params[:comment_file].nil?
       attach_params = { :file => params[:comment_file] }
       params.delete(:comment_file)
     end
 
@@ -1189,10 +1235,12 @@ class ItemsController < ApplicationController
   #Deletes Attachment of the Comment.
   #
   def delete_comment_attachment
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     begin
       attachment = Attachment.find(params[:attachment_id])
       @comment = Comment.find(params[:comment_id])
 
       if attachment.comment_id == @comment.id
@@ -1233,11 +1281,13 @@ class ItemsController < ApplicationController
   #Issues specified Workflow.
   #
   def wf_issue
     Log.add_info(request, params.inspect)
 
-   begin
+    return unless request.post?
+
+    begin
       @item = Item.find(params[:id])
       @workflow = @item.workflow
     rescue => evar
       Log.add_error(request, evar)
     end
@@ -1256,21 +1306,22 @@ class ItemsController < ApplicationController
   #Organizes Team.
   #
   def team_organize
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     team_id = params[:team_id]
     unless team_id.blank?
       begin
         @team = Team.find(team_id)
       rescue
         @team = nil
-      ensure
-        if @team.nil?
-          flash[:notice] = t('msg.already_deleted', :name => Team.model_name.human)
-          return
-        end
+      end
+      if @team.nil?
+        flash[:notice] = t('msg.already_deleted', :name => Team.model_name.human)
+        return
       end
 
       users = @team.get_users_a
     end
 
@@ -1282,11 +1333,12 @@ class ItemsController < ApplicationController
 
     if team_members.nil? or team_members.empty?
 
       unless team_id.blank?
         # @team must not be nil.
-        @team.save if modified = @team.clear_users
+        modified = @team.clear_users
+        @team.save if modified
       end
 
     else
 
       if team_members != users
@@ -1298,13 +1350,11 @@ class ItemsController < ApplicationController
           created = true
           @team = Team.new
           @team.name = item.title
           @team.item_id = params[:id]
           @team.status = Team::STATUS_STANDBY
-
         else
-
           @team.clear_users
         end
 
         @team.add_users(team_members)
         @team.save
@@ -1336,10 +1386,12 @@ class ItemsController < ApplicationController
   #Moves the Item in the Team Folder.
   #
   def move_in_team_folder
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @item = Item.find(params[:id])
 
     team_folder = @item.team.get_team_folder
 
     @item.update_attribute(:folder_id, team_folder.id)
@@ -1359,10 +1411,12 @@ class ItemsController < ApplicationController
   #Changes status of the Team.
   #
   def change_team_status
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     SqlHelper.validate_token([params[:status]])
 
     team_id = params[:team_id]
     begin
       team = Team.find(team_id)
diff --git a/app/controllers/locations_controller.rb b/app/controllers/locations_controller.rb
index fff8e1d4..7342b80d 100644
--- a/app/controllers/locations_controller.rb
+++ b/app/controllers/locations_controller.rb
@@ -140,10 +140,12 @@ class LocationsController < ApplicationController
   #Updates OfficeMap.
   #
   def update_map
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     group_id = params[:group_id]
     SqlHelper.validate_token([group_id])
 
     @office_map = OfficeMap.get_for_group(group_id, true)
 
@@ -162,10 +164,12 @@ class LocationsController < ApplicationController
   #Deletes OfficeMap.
   #
   def delete_map
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     group_id = params[:group_id]
     SqlHelper.validate_token([group_id])
 
     @office_map = OfficeMap.get_for_group(group_id, false)
 
@@ -187,10 +191,14 @@ class LocationsController < ApplicationController
   #Receives dropped event on the exit by Ajax.
   #
   def drop_on_exit
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
+    SqlHelper.validate_token([params[:id]])
+
     unless @login_user.nil?
       Location.destroy(params[:id])
     end
 
     render(:text => params[:id])
@@ -202,28 +210,33 @@ class LocationsController < ApplicationController
   #Saves Locations' new position by Ajax.
   #
   def on_moved
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     location_id = params[:id]
+    SqlHelper.validate_token([location_id])
 
-    if location_id.nil? or location_id.empty?
+    if location_id.blank?
       location = Location.get_for(@login_user)
       if location.nil?
         location = Location.new
         location.user_id = @login_user.id
       end
     else
       begin
         location = Location.find(location_id)
       rescue
+        location = nil
       end
     end
 
     unless location.nil?
       group_id = params[:group_id]
       group_id = nil if group_id.empty?
+      SqlHelper.validate_token([group_id])
       attrs = ActionController::Parameters.new({group_id: group_id, x: params[:x], y: params[:y]})
       location.update_attributes(attrs.permit(Location::PERMIT_BASE))
     end
 
     render(:text => (location.nil?)?'':location.id.to_s)
@@ -233,11 +246,11 @@ class LocationsController < ApplicationController
   #=== check_owner
   #
   #Filter method to check if current User is owner of the specified Location.
   #
   def check_owner
-    return if params[:id].nil? or params[:id].empty? or @login_user.nil?
+    return if params[:id].blank? or @login_user.nil?
 
     begin
       owner_id = Location.find(params[:id]).user_id
     rescue
       owner_id = -1
diff --git a/app/controllers/login_controller.rb b/app/controllers/login_controller.rb
index 8232e337..ecc72b67 100644
--- a/app/controllers/login_controller.rb
+++ b/app/controllers/login_controller.rb
@@ -1,11 +1,11 @@
 #
 #= LoginController
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
 #The Action-Controller about LOGIN.
 #
@@ -35,11 +35,11 @@ class LoginController < ApplicationController
 
     if user.nil?
 
       flash[:notice] = '<span class=\'font_msg_bold\'>'+t('user.u_name')+'</span>'+t('msg.or')+'<span class=\'font_msg_bold\'>'+t('password.name')+'</span>'+t('msg.is_invalid')
 
-      if params[:fwd_controller].nil? or params[:fwd_controller].empty?
+      if params[:fwd_controller].blank?
 
         redirect_to(:controller => 'login', :action => 'index')
       else
 
         url_h = {:controller => 'login', :action => 'index', :fwd_controller => params[:fwd_controller], :fwd_action => params[:fwd_action]}
@@ -55,11 +55,11 @@ class LoginController < ApplicationController
 
     else
 
       @login_user = LoginHelper.on_login(user, session)
 
-      if params[:fwd_controller].nil? or params[:fwd_controller].empty?
+      if params[:fwd_controller].blank?
         prms = ApplicationHelper.get_fwd_params(params)
         prms.delete('user')
         prms[:controller] = 'desktop'
         prms[:action] = 'show'
         redirect_to(prms)
diff --git a/app/controllers/logs_controller.rb b/app/controllers/logs_controller.rb
index e9ad862f..710daf3f 100644
--- a/app/controllers/logs_controller.rb
+++ b/app/controllers/logs_controller.rb
@@ -110,10 +110,13 @@ class LogsController < ApplicationController
   #=== destroy
   #
   #Deletes Logs.
   #
   def destroy
+
+    return unless request.post?
+
     if params[:check_log].nil?
       list
       render(:action => 'list')
       return
     end
@@ -135,10 +138,12 @@ class LogsController < ApplicationController
   #
   #Deletes all Logs.
   #
   def destroy_all
 
+    return unless request.post?
+
     Log.delete_all
 
     flash[:notice] = t('msg.delete_success')
     redirect_to(:action => 'list')
   end
diff --git a/app/controllers/mail_accounts_controller.rb b/app/controllers/mail_accounts_controller.rb
index cc521265..1add46cb 100644
--- a/app/controllers/mail_accounts_controller.rb
+++ b/app/controllers/mail_accounts_controller.rb
@@ -1,11 +1,11 @@
 #
 #= MailAccountsController
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
 #== Note:
 #
@@ -32,10 +32,12 @@ class MailAccountsController < ApplicationController
   #Creates MailAccount.
   #
   def create
     Log.add_info(request, '')   # Not to show passwords.
 
+    return unless request.post?
+
     if params[:mail_account][:smtp_auth].nil? or params[:mail_account][:smtp_auth] != '1'
       params[:mail_account].delete(:smtp_username)
       params[:mail_account].delete(:smtp_password)
     end
 
@@ -88,10 +90,12 @@ class MailAccountsController < ApplicationController
   #Updates MailAccount information.
   #
   def update
     Log.add_info(request, '')   # Not to show passwords.
 
+    return unless request.post?
+
     @mail_account = MailAccount.find(params[:id])
 
     if params[:mail_account][:smtp_auth].nil? or params[:mail_account][:smtp_auth] != '1'
       params[:mail_account].delete(:smtp_username)
       params[:mail_account].delete(:smtp_password)
@@ -127,10 +131,11 @@ class MailAccountsController < ApplicationController
   #
   def show_summary
     Log.add_info(request, params.inspect)
 
     mail_account_id = params[:id]
+    SqlHelper.validate_token([mail_account_id])
 
     begin
       @mail_account = MailAccount.find(mail_account_id)
     rescue => evar
       Log.add_error(request, evar)
@@ -180,11 +185,11 @@ class MailAccountsController < ApplicationController
   #
   #Filter method to check if current User is owner of specified Item.
   #
   def check_owner
 
-    return if params[:id].nil? or params[:id].empty? or @login_user.nil?
+    return if params[:id].blank? or @login_user.nil?
 
     mail_account = MailAccount.find(params[:id])
 
     if !@login_user.admin?(User::AUTH_MAIL) and mail_account.user_id != @login_user.id
       Log.add_check(request, '[check_owner]'+request.to_s)
diff --git a/app/controllers/mail_filters_controller.rb b/app/controllers/mail_filters_controller.rb
index 76542940..3526bc15 100644
--- a/app/controllers/mail_filters_controller.rb
+++ b/app/controllers/mail_filters_controller.rb
@@ -1,11 +1,11 @@
 #
 #= MailFiltersController
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2012 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
 #The Action-Controller about MailFilters.
 #
@@ -129,10 +129,12 @@ class MailFiltersController < ApplicationController
   #Updates MailFilter information.
   #
   def update
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     attrs = params[:mail_filter]
     if attrs['and_or'] == 'none'
       attrs['and_or'] = nil
       attrs['conditions'] = nil
     else
@@ -192,10 +194,12 @@ class MailFiltersController < ApplicationController
   #Deletes MailFilters.
   #
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     if params[:check_filter].nil?
       list
       render(:action => 'list', :layout => !request.xhr?)
       return
     end
@@ -206,10 +210,11 @@ class MailFiltersController < ApplicationController
 
         begin
           filter = MailFilter.find(filter_id)
           filter.destroy if filter.editable?(@login_user)
         rescue => evar
+          filter = nil
           Log.add_error(request, evar)
         end
 
         count += 1
       end
@@ -226,10 +231,12 @@ class MailFiltersController < ApplicationController
   #Does execute MailFilters of the specified MailAccount.
   #
   def do_execute
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     mail_account = MailAccount.find(params[:mail_account_id])
     mail_folder = MailFolder.find(params[:mail_folder_id])
 
     if mail_account.user_id != @login_user.id \
         or mail_folder.user_id != @login_user.id
@@ -286,10 +293,12 @@ class MailFiltersController < ApplicationController
   #Updates folders' order by Ajax.
   #
   def update_order
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     mail_account_id = params[:mail_account_id]
     order_arr = params[:mail_filters_order]
 
     SqlHelper.validate_token([mail_account_id])
 
@@ -356,11 +365,11 @@ class MailFiltersController < ApplicationController
   #
   #Filter method to check if current User is owner of specified MailFilter.
   #
   def check_owner
 
-    return if (params[:id].nil? or params[:id].empty? or @login_user.nil?)
+    return if (params[:id].blank? or @login_user.nil?)
 
     mail_filter = MailFilter.find(params[:id])
 
     if !@login_user.admin?(User::AUTH_MAIL) and mail_filter.mail_account.user_id != @login_user.id
       Log.add_check(request, '[check_owner]'+request.to_s)
diff --git a/app/controllers/mail_folders_controller.rb b/app/controllers/mail_folders_controller.rb
index dd67e47f..78837360 100644
--- a/app/controllers/mail_folders_controller.rb
+++ b/app/controllers/mail_folders_controller.rb
@@ -1,11 +1,11 @@
 #
 #= MailFoldersController
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
 #== Note:
 #
@@ -74,13 +74,15 @@ class MailFoldersController < ApplicationController
   #Receives MailFolder name from ThetisBox.
   #
   def create
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     parent_id = params[:selectedFolderId]
 
-    if params[:thetisBoxEdit].nil? or params[:thetisBoxEdit].empty?
+    if params[:thetisBoxEdit].blank?
       @mail_folder = nil
     else
       @mail_folder = MailFolder.new
       @mail_folder.name = params[:thetisBoxEdit]
       @mail_folder.parent_id = parent_id
@@ -98,13 +100,15 @@ class MailFoldersController < ApplicationController
   #Receives MailFolder name from ThetisBox.
   #
   def rename
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @mail_folder = MailFolder.find(params[:id])
 
-    unless params[:thetisBoxEdit].nil? or params[:thetisBoxEdit].empty?
+    unless params[:thetisBoxEdit].blank?
       @mail_folder.name = params[:thetisBoxEdit]
       @mail_folder.save
     end
     render(:partial => 'ajax_folder_name', :layout => false)
   end
@@ -115,11 +119,14 @@ class MailFoldersController < ApplicationController
   #Deletes MailFolder.
   #
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     mail_account_id = params[:mail_account_id]
+    SqlHelper.validate_token([mail_account_id])
 
     mail_folder = MailFolder.find(params[:id])
     trash_folder = MailFolder.get_for(@login_user, mail_account_id, MailFolder::XTYPE_TRASH)
 
     if trash_folder.nil?
@@ -149,20 +156,23 @@ class MailFoldersController < ApplicationController
   #params[:thetisBoxSelKeeper] keeps selected ID of <a>-tag like "thetisBoxSelKeeper-1:<selected-id>". 
   #
   def move
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @mail_folder = MailFolder.find(params[:id])
 
     if params[:thetisBoxSelKeeper].blank?
       prms = ApplicationHelper.get_fwd_params(params)
       prms[:action] = 'show_tree'
       redirect_to(prms)
       return
     end
 
     parent_id = params[:thetisBoxSelKeeper].split(':').last
+    SqlHelper.validate_token([parent_id])
 
     if parent_id == '0'   # '0' for ROOT
       flash[:notice] = 'ERROR:' + t('mail_folder.root_cannot_have_folders')
     else
       # Check if specified parent is not one of subfolders.
@@ -196,14 +206,17 @@ class MailFoldersController < ApplicationController
     if params[:action] == 'get_mails'
       Log.add_info(request, params.inspect)
     end
 
     if !params[:pop].nil? and params[:pop] == 'true'
+
+      mail_account_id = params[:mail_account_id]
+      SqlHelper.validate_token([mail_account_id])
+
       begin
         new_arrivals_h = {}
 
-        mail_account_id = params[:mail_account_id]
         if mail_account_id.blank?
           mail_accounts = MailAccount.find_all("user_id=#{@login_user.id}")
           mail_accounts.each do |mail_account|
             emails = Email.do_pop(mail_account)
             unless emails.empty?
@@ -247,26 +260,24 @@ class MailFoldersController < ApplicationController
         Log.add_error(nil, evar)
       end
     end
 
     @folder_id = params[:id]
+    SqlHelper.validate_token([@folder_id])
+
     if @folder_id == TreeElement::ROOT_ID.to_s
       @emails = nil
     else
 =begin
 #      @emails = MailFolder.get_mails_to_show(@folder_id, @login_user)
 =end
 # FEATURE_PAGING_IN_TREE >>>
       @sort_col = (params[:sort_col] || 'sent_at')
       @sort_type = (params[:sort_type] || 'DESC')
+      SqlHelper.validate_token([@sort_col, @sort_type])
 
-      folder_ids = nil
-      add_con = nil
-
-      folder_ids = [@folder_id]
-
-      sql = EmailsHelper.get_list_sql(@login_user, params[:keyword], folder_ids, @sort_col, @sort_type, 0, add_con)
+      sql = EmailsHelper.get_list_sql(@login_user, params[:keyword], [@folder_id], @sort_col, @sort_type, 0, nil)
       @email_pages, @emails, @total_num = paginate_by_sql(Email, sql, 10)
 # FEATURE_PAGING_IN_TREE <<<
     end
 
     session[:mailfolder_id] = @folder_id
@@ -280,14 +291,14 @@ class MailFoldersController < ApplicationController
   #Gets Email content.
   #
   def get_mail_content
     Log.add_info(request, params.inspect)
 
-    mail_id = params[:id]
+    email_id = params[:id]
 
     begin
-      @email = Email.find(mail_id)
+      @email = Email.find(email_id)
       render(:partial => 'ajax_mail_content', :layout => false)
     rescue => evar
       Log.add_error(nil, evar)
       render(:text => '')
     end
@@ -398,18 +409,20 @@ class MailFoldersController < ApplicationController
   #Deletes all Emails in specified MailFolder.
   #
   def empty
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @folder_id = params[:id]
     mail_account_id = params[:mail_account_id]
-    SqlHelper.validate_token([mail_account_id])
+    SqlHelper.validate_token([@folder_id, mail_account_id])
 
     trash_folder = MailFolder.get_for(@login_user, mail_account_id, MailFolder::XTYPE_TRASH)
 
     mail_folder = MailFolder.find(@folder_id)
-    emails = MailFolder.get_mails(mail_folder.id, @login_user) || []
+    emails = (MailFolder.get_mails(mail_folder.id, @login_user) || [])
 
     if mail_folder.id == trash_folder.id \
         or mail_folder.get_parents(false).include?(trash_folder.id.to_s)
       emails.each do |email|
         email.destroy
@@ -431,12 +444,15 @@ class MailFoldersController < ApplicationController
   #Deletes specified Emails.
   #
   def ajax_delete_mails
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     folder_id = params[:id]
     mail_account_id = params[:mail_account_id]
+    SqlHelper.validate_token([folder_id, mail_account_id])
 
     unless params[:check_mail].blank?
       mail_folder = MailFolder.find(folder_id)
       trash_folder = MailFolder.get_for(@login_user, mail_account_id, MailFolder::XTYPE_TRASH)
 
@@ -479,10 +495,12 @@ class MailFoldersController < ApplicationController
   #Moves specified Emails.
   #
   def ajax_move_mails
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     folder_id = params[:thetisBoxSelKeeper].split(':').last
     SqlHelper.validate_token([folder_id])
     begin
       mail_folder = MailFolder.find(folder_id)
     rescue => evar
@@ -527,10 +545,11 @@ class MailFoldersController < ApplicationController
   #
   def get_folders_order
     Log.add_info(request, params.inspect)
 
     @folder_id = params[:id]
+    SqlHelper.validate_token([@folder_id])
 
     if @folder_id == '0'
       @folders = MailFolder.get_account_roots_for(@login_user)
     else
       mail_folder = MailFolder.find(@folder_id)
@@ -538,24 +557,22 @@ class MailFoldersController < ApplicationController
         @folders = MailFolder.get_childs(@folder_id, false, true)
       end
     end
 
     render(:partial => 'ajax_folders_order', :layout => false)
-
-  rescue => evar
-    Log.add_error(request, evar)
-    render(:partial => 'ajax_folders_order', :layout => false)
   end
 
   #=== update_folders_order
   #
   #<Ajax>
   #Updates folders' order by Ajax.
   #
   def update_folders_order
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     order_arr = params[:folders_order]
 
     SqlHelper.validate_token([params[:id]])
     folders = MailFolder.get_childs(params[:id], false, false)
     # folders must be ordered by xorder ASC.
@@ -603,10 +620,12 @@ class MailFoldersController < ApplicationController
   #Updates unread flag of the E-mail by Ajax.
   #
   def update_mail_unread
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     email_id = params[:email_id]
     unread = (params[:unread] == "1")
 
     begin
       email = Email.find(email_id)
@@ -651,11 +670,11 @@ class MailFoldersController < ApplicationController
   #=== check_mail_owner
   #
   #Filter method to check if current User is owner of the specified Email.
   #
   def check_mail_owner
-    return if params[:id].nil? or params[:id].empty? or @login_user.nil?
+    return if params[:id].blank? or @login_user.nil?
 
     begin
       owner_id = Email.find(params[:id]).user_id
     rescue
       owner_id = -1
diff --git a/app/controllers/official_titles_controller.rb b/app/controllers/official_titles_controller.rb
index 7e99ab0c..9cf5023d 100644
--- a/app/controllers/official_titles_controller.rb
+++ b/app/controllers/official_titles_controller.rb
@@ -1,11 +1,11 @@
 #
 #= OfficialTitlesController
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2013 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
 #The Action-Controller about OfficialTitles.
 #
@@ -25,12 +25,13 @@ class OfficialTitlesController < ApplicationController
   def show
     Log.add_info(request, params.inspect)
 
     @group_id = params[:group_id]
     official_title_id = params[:id]
+    SqlHelper.validate_token([@group_id, official_title_id])
 
-    unless official_title_id.nil? or official_title_id.empty?
+    unless official_title_id.blank?
       @official_title = OfficialTitle.find(official_title_id)
     end
 
     render(:layout => (!request.xhr?))
   end
@@ -42,12 +43,13 @@ class OfficialTitlesController < ApplicationController
   def edit
     Log.add_info(request, params.inspect)
 
     @group_id = params[:group_id]
     official_title_id = params[:id]
+    SqlHelper.validate_token([@group_id, official_title_id])
 
-    unless official_title_id.nil? or official_title_id.empty?
+    unless official_title_id.blank?
       @official_title = OfficialTitle.find(official_title_id)
     end
 
     render(:partial => 'ajax_official_title_form', :layout => (!request.xhr?))
   end
@@ -57,12 +59,15 @@ class OfficialTitlesController < ApplicationController
   #Updates OfficialTitle.
   #
   def update
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @group_id = params[:group_id]
     official_title_id = params[:id]
+    SqlHelper.validate_token([@group_id, official_title_id])
 
     if official_title_id.blank?
       @official_title = OfficialTitle.new(params.require(:official_title).permit(OfficialTitle::PERMIT_BASE))
       @official_title.group_id = @group_id
 
@@ -83,19 +88,22 @@ class OfficialTitlesController < ApplicationController
   #Destroys the specified OfficialTitle.
   #
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     begin
       OfficialTitle.destroy(params[:id])
     rescue => evar
       Log.add_error(nil, evar)
     end
 
     @group_id = params[:group_id]
+    SqlHelper.validate_token([@group_id])
 
-    if @group_id.nil? or @group_id.empty?
+    if @group_id.blank?
       @group_id = '0'   # '0' for ROOT
     end
 
     render(:partial => 'groups/ajax_group_official_titles', :layout => false)
   end
@@ -106,13 +114,17 @@ class OfficialTitlesController < ApplicationController
   #Updates OfficialTitles' order.
   #
   def update_order
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     order_ary = params[:official_titles_order]
 
     @group_id = params[:group_id]
+    SqlHelper.validate_token([@group_id])
+
     parent_titles = OfficialTitle.get_for(Group.find(@group_id).parent_id, true, true)
     order_offset = parent_titles.length
 
     @official_titles = OfficialTitle.get_for(@group_id, false, true)
 
diff --git a/app/controllers/paintmail_controller.rb b/app/controllers/paintmail_controller.rb
index 156cb846..40b39a44 100644
--- a/app/controllers/paintmail_controller.rb
+++ b/app/controllers/paintmail_controller.rb
@@ -31,10 +31,12 @@ class PaintmailController < ApplicationController
   #Shows PaintMail index page.
   #
   def save_conf
     Log.add_info(request, '')   # Not to show passwords.
 
+    return unless request.post?
+
     unless @login_user.nil?
 
       if @login_user.paintmail.nil?
         paintmail = Paintmail.new(params.require(:paintmail).permit(Paintmail::PERMIT_BASE))
         paintmail.user_id = @login_user.id
diff --git a/app/controllers/researches_controller.rb b/app/controllers/researches_controller.rb
index d2104e71..fde24e88 100644
--- a/app/controllers/researches_controller.rb
+++ b/app/controllers/researches_controller.rb
@@ -1,11 +1,11 @@
 #
 #= ResearchesController
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
 #The Action-Controller about Researches.
 #
@@ -94,10 +94,12 @@ class ResearchesController < ApplicationController
   #Creates a template in 'Research' Folder with default name.
   #
   def create_q_page
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @tmpl_folder, @tmpl_q_folder = TemplatesHelper.get_tmpl_subfolder(TemplatesHelper::TMPL_RESEARCH)
 
     unless @tmpl_q_folder.nil?
 
       @items = Folder.get_items_admin(@tmpl_q_folder.id, 'xorder ASC')
@@ -128,10 +130,12 @@ class ResearchesController < ApplicationController
   #Destroys specified research page template.
   #
   def destroy_q_page
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     begin
       Item.find(params[:id]).destroy
     rescue
     end
 
@@ -149,10 +153,12 @@ class ResearchesController < ApplicationController
   #Updates controls of choices.
   #
   def update_q_ctrl
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     item_id = params[:item_id]
     q_code = params[:q_code]
     q_param = params[:q_param]
     cap = params[:caption]
 
@@ -161,11 +167,11 @@ class ResearchesController < ApplicationController
     type = q_param.split(':').first
     vals = q_param[type.length+1 .. -1]
 
     yaml[q_code] = {:item_id => item_id, :type => type, :values => vals, :caption => cap.to_s }
 
-    Research.save_config_yaml yaml
+    Research.save_config_yaml(yaml)
 
     render(:text => '')
 
   rescue => evar
     Log.add_error(request, evar)
@@ -178,10 +184,12 @@ class ResearchesController < ApplicationController
   #Resets controls of choices.
   #
   def reset_q_ctrl
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     Research.trim_config_yaml nil
 
     settings
 
     render(:partial => 'ajax_q_ctrls')
@@ -214,27 +222,30 @@ class ResearchesController < ApplicationController
   #Adds Group for statistics.
   #
   def add_statistics_group
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     current_id = params[:current_id]
 
-    if !params[:thetisBoxSelKeeper].nil?
+    unless params[:thetisBoxSelKeeper].nil?
       group_id = params[:thetisBoxSelKeeper].split(':').last
     end
+    SqlHelper.validate_token([current_id, group_id])
 
-    if group_id.nil? or group_id.empty?
-      @group_ids = Research.get_statistics_groups 
+    if group_id.blank?
+      @group_ids = Research.get_statistics_groups
       render(:partial => 'ajax_statistics_groups', :layout => false)
       return
     end
 
-    unless current_id.nil? or current_id.empty?
-      Research.delete_statistics_group current_id
+    unless current_id.blank?
+      Research.delete_statistics_group(current_id)
     end
 
-    @group_ids = Research.add_statistics_group group_id
+    @group_ids = Research.add_statistics_group(group_id)
 
     render(:partial => 'ajax_statistics_groups', :layout => false)
   end
 
   #=== delete_statistics_group
@@ -243,19 +254,22 @@ class ResearchesController < ApplicationController
   #Deletes Group for statistics.
   #
   def delete_statistics_group
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     group_id = params[:group_id]
+    SqlHelper.validate_token([group_id])
 
-    if group_id.nil? or group_id.empty?
+    if group_id.blank?
       @group_ids = Research.get_statistics_groups 
       render(:partial => 'ajax_statistics_groups', :layout => false)
       return
     end
 
-    @group_ids = Research.delete_statistics_group group_id
+    @group_ids = Research.delete_statistics_group(group_id)
 
     render(:partial => 'ajax_statistics_groups', :layout => false)
   end
 
   #=== update_groups_order
@@ -264,13 +278,15 @@ class ResearchesController < ApplicationController
   #Updates Groups' order for statistics.
   #
   def update_groups_order
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     order_ary = params[:groups_order]
 
-    Research.set_statistics_groups order_ary
+    Research.set_statistics_groups(order_ary)
 
     render(:text => '')
   end
 
   #=== start
@@ -279,10 +295,12 @@ class ResearchesController < ApplicationController
   #Starts the questionnaire.
   #
   def start
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     tmpl_folder, tmpl_q_folder = TemplatesHelper.get_tmpl_subfolder(TemplatesHelper::TMPL_RESEARCH)
 
     if tmpl_q_folder.nil?
       ary = TemplatesHelper.setup_tmpl_folder
       tmpl_q_folder = ary[4]
@@ -343,10 +361,12 @@ class ResearchesController < ApplicationController
   #Stops the questionnaire.
   #
   def stop
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     ApplicationHelper.delete_file_safe(Research.get_pages)
     render(:text => '')
 
   rescue => evar
     Log.add_error(request, evar)
@@ -359,10 +379,12 @@ class ResearchesController < ApplicationController
   #Resets all Users' status.
   #
   def reset
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     Research.delete_all
 
     render(:text => '')
 
   rescue => evar
@@ -375,18 +397,21 @@ class ResearchesController < ApplicationController
   #Resets status of the selected Users.
   #
   def reset_users
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     count = 0
 
     unless params[:check_user].nil?
 
       params[:check_user].each do |user_id, value|
         if value == '1'
+          SqlHelper.validate_token([user_id])
           begin
-            Research.destroy_all('user_id=' + user_id.to_s)
+            Research.destroy_all("user_id=#{user_id.to_i}")
             count += 1
           rescue => evar
             Log.add_error(request, evar)
           end
         end
@@ -445,10 +470,12 @@ class ResearchesController < ApplicationController
   #Saves current page and shows next or receipt-page.
   #
   def save_page
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     # Next page
     pave_val = params[:page].to_i + 1
     @page = sprintf('%02d', pave_val)
 
     page_num = Dir.glob(File.join(Research.page_dir, "_q[0-9][0-9].html.erb")).length
@@ -521,10 +548,12 @@ class ResearchesController < ApplicationController
   #Receives User's confirmation and commit answers.
   #
   def do_confirm
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @research = Research.find(params[:research_id])
     @research.update_attribute(:status, Research::U_STATUS_COMMITTED)
 
     render(:action => 'show_receipt')
 
@@ -617,10 +646,12 @@ class ResearchesController < ApplicationController
   #Notifies message by E-mail to specified Users.
   #
   def notify
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     root_url = ApplicationHelper.root_url(request)
     count = UsersHelper.send_notification(params[:check_user], params[:thetisBoxEdit], root_url)
 
     if count > 0
       flash[:notice] = t('user.notification_sent')+ count.to_s + t('user.notification_sent_suffix')
diff --git a/app/controllers/schedules_controller.rb b/app/controllers/schedules_controller.rb
index c2d4a7e7..ea28823d 100644
--- a/app/controllers/schedules_controller.rb
+++ b/app/controllers/schedules_controller.rb
@@ -1,11 +1,11 @@
 #
 #= SchedulesController
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2013 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
 #The Action-Controller about Schedules.
 #
@@ -43,10 +43,12 @@ class SchedulesController < ApplicationController
   #Adds holidays.
   #
   def add_holidays
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     holidays = params[:thetisBoxEdit]
     unless holidays.nil?
       holidays.split("\n").each do |holiday|
         tokens = holiday.split(',')
         date = DateTime.parse(tokens.shift.strip)
@@ -81,12 +83,15 @@ class SchedulesController < ApplicationController
   #Deletes holidays.
   #
   def delete_holidays
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     holidays = params[:holidays]
     unless holidays.nil?
+      SqlHelper.validate_token([holidays])
       holidays.each do |schedule_id|
         Schedule.destroy(schedule_id)
       end
     end
 
@@ -113,10 +118,12 @@ class SchedulesController < ApplicationController
   #Saves the Schedule.
   #
   def save
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     date = Date.parse(params[:date])
 
     unless params[:id].blank?
       begin
         schedule = Schedule.find(params[:id])
@@ -147,10 +154,11 @@ class SchedulesController < ApplicationController
 
       nearest_day = schedule.get_nearest_day(date)
       schedule.destroy unless schedule.nil?
     else
       [:users, :groups, :teams, :items].each do |attr|
+        SqlHelper.validate_token([params[attr]])
         if params[attr].blank?
           params[:schedule][attr] = nil
         else
           params[:schedule][attr] = '|' + params[attr].join('|') + '|'
         end
@@ -161,11 +169,15 @@ class SchedulesController < ApplicationController
 
       if equipment_ids.empty?
         params[:schedule][:equipment] = nil
       else
         equipment_ids.each do |equipment_id|
-          equipment = Equipment.find(equipment_id)
+          begin
+            equipment = Equipment.find(equipment_id)
+          rescue => evar
+            equipment = nil
+          end
           if equipment.nil? or !equipment.is_accessible_by(@login_user)
             flash[:notice] = 'ERROR:' + t('msg.need_auth_to_access') + t('cap.suffix') + Equipment.get_name(equipment_id)
             redirect_to(:action => 'day', :date => params[:date])
             return
           end
@@ -201,11 +213,11 @@ class SchedulesController < ApplicationController
       check_schedule = Schedule.new(params.require(:schedule).permit(Schedule::PERMIT_BASE))
       nearest_day = check_schedule.get_nearest_day(date)
       if nearest_day.nil?
         check_schedule.id = params[:id].to_i unless params[:id].nil? or params[:id].empty?
         flash[:notice] = 'ERROR:' + t('schedule.no_day_in_rule')
-        if params[:fwd_controller].nil? or params[:fwd_controller].empty?
+        if params[:fwd_controller].blank?
           self.index
         else
           prms = ApplicationHelper.get_fwd_params(params)
           prms.delete('id')
           prms.delete('schedule')
@@ -323,10 +335,12 @@ class SchedulesController < ApplicationController
   #Destroys specified Schedule.
   #
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @date = Date.parse(params[:date])
 
     begin
       schedule = Schedule.find(params[:id])
     rescue => evar
@@ -511,11 +525,11 @@ class SchedulesController < ApplicationController
   def week
     Log.add_info(request, params.inspect)
 
     date_s = params[:date]
 
-    if date_s.nil? or date_s.empty?
+    if date_s.blank?
       @date = Date.today
     else
       @date = Date.parse(date_s)
     end
     params[:display] = 'week'
@@ -528,11 +542,11 @@ class SchedulesController < ApplicationController
   def day
     Log.add_info(request, params.inspect)
 
     date_s = params[:date]
 
-    if date_s.nil? or date_s.empty?
+    if date_s.blank?
       @date = Date.today
     else
       @date = Date.parse(date_s)
     end
 
@@ -602,17 +616,18 @@ class SchedulesController < ApplicationController
   #
   def group
     Log.add_info(request, params.inspect)
 
     date_s = params[:date]
-    if date_s.nil? or date_s.empty?
+    if date_s.blank?
       @date = Date.today
     else
       @date = Date.parse(date_s)
     end
 
     @group_id = params[:id]
+    SqlHelper.validate_token([@group_id, params[:id]])
     group_users = Group.get_users(params[:id])
 
     @user_schedule_hash = {}
     unless group_users.nil?
       @holidays = Schedule.get_holidays
@@ -630,11 +645,11 @@ class SchedulesController < ApplicationController
   #
   def team
     Log.add_info(request, params.inspect)
 
     date_s = params[:date]
-    if date_s.nil? or date_s.empty?
+    if date_s.blank?
       @date = Date.today
     else
       @date = Date.parse(date_s)
     end
 
@@ -735,11 +750,11 @@ class SchedulesController < ApplicationController
   #Gets Items in specified Folder.
   #
   def get_folder_items
     Log.add_info(request, params.inspect)
 
-    unless params[:thetisBoxSelKeeper].nil? or params[:thetisBoxSelKeeper].empty?
+    unless params[:thetisBoxSelKeeper].blank?
       @folder_id = params[:thetisBoxSelKeeper].split(':').last
     end
 
     begin
       if Folder.check_user_auth(@folder_id, @login_user, 'r', true)
diff --git a/app/controllers/send_mails_controller.rb b/app/controllers/send_mails_controller.rb
index bb6cbfcb..59cd357e 100644
--- a/app/controllers/send_mails_controller.rb
+++ b/app/controllers/send_mails_controller.rb
@@ -1,11 +1,11 @@
 #
 #= SendMailsController
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
 #The Action-Controller about Sending Emails.
 #
@@ -27,12 +27,13 @@ class SendMailsController < ApplicationController
   def new
     Log.add_info(request, params.inspect)
 
     mail_account_id = params[:mail_account_id]
 
-    if mail_account_id.nil? or mail_account_id.empty?
+    if mail_account_id.blank?
       account_xtype = params[:mail_account_xtype]
+      SqlHelper.validate_token([account_xtype])
       @mail_account = MailAccount.get_default_for(@login_user.id, account_xtype)
     else
       @mail_account = MailAccount.find(mail_account_id)
       if @mail_account.user_id != @login_user.id
         flash[:notice] = 'ERROR:' + t('msg.need_to_be_owner')
@@ -169,10 +170,12 @@ class SendMailsController < ApplicationController
   #Does send E-mail.
   #
   def do_send
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     begin
       email = Email.find(params[:id])
 
       if email.status != Email::STATUS_DRAFT
         # Ignore clicked Send button twice or more at once.
@@ -205,10 +208,12 @@ class SendMailsController < ApplicationController
   #Saves draft Email.
   #
   def save
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     unless params[:attach_file].nil?
       attach_attrs = { :file => params[:attach_file] }
       params.delete(:attach_file)
     end
 
@@ -256,10 +261,12 @@ class SendMailsController < ApplicationController
   #Attaches a file to the Email.
   #
   def add_attachment
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     unless params[:attach_file].nil?
       attach_attrs = ActionController::Parameters.new({file: params[:attach_file]})
       params.delete(:attach_file)
     end
 
@@ -330,10 +337,12 @@ class SendMailsController < ApplicationController
   #Deletes MailAttachment of the Email.
   #
   def delete_attachment
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     begin
       attachment = MailAttachment.find(params[:attachment_id])
       @email = Email.find(params[:id])
 
       if attachment.email_id == @email.id
diff --git a/app/controllers/teams_controller.rb b/app/controllers/teams_controller.rb
index 9284ab62..8b9f285c 100644
--- a/app/controllers/teams_controller.rb
+++ b/app/controllers/teams_controller.rb
@@ -1,11 +1,11 @@
 #
 #= TeamsController
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
 #The Action-Controller about Teams.
 #
@@ -98,10 +98,12 @@ class TeamsController < ApplicationController
   #Deletes the specified Team.
   #
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     begin
       team = Team.find(params[:id])
       Item.destroy(team.item_id)
     rescue => evar
       Log.add_error(request, evar)
@@ -117,11 +119,11 @@ class TeamsController < ApplicationController
   #
   #Filter method to check if current User is member of specified Team.
   #
   def check_member
 
-    return if params[:id].nil? or params[:id].empty? or @login_user.nil?
+    return if params[:id].blank? or @login_user.nil?
 
     if Item.find(params[:id]).user_id != @login_user.id
       Log.add_check(request, '[check_member]'+request.to_s)
 
       flash[:notice] = t('team.need_to_be_member')
diff --git a/app/controllers/templates_controller.rb b/app/controllers/templates_controller.rb
index 122df145..eb226c46 100644
--- a/app/controllers/templates_controller.rb
+++ b/app/controllers/templates_controller.rb
@@ -1,11 +1,11 @@
 #
 #= FoldersController
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
 #The Action-Controller about templates of Items.
 #
@@ -46,15 +46,18 @@ class TemplatesController < ApplicationController
   #Creates a template in 'Workflows' Folder with default name.
   #
   def create_workflow
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @tmpl_folder, @tmpl_workflows_folder = TemplatesHelper.get_tmpl_subfolder(TemplatesHelper::TMPL_WORKFLOWS)
 
     @group_id = params[:group_id]
+    SqlHelper.validate_token([@group_id])
 
-    if @group_id.nil? or @group_id.empty?
+    if @group_id.blank?
       @group_id = '0'   # '0' for ROOT
     elsif @group_id == '0'
       ;
     else
       group = nil
@@ -97,17 +100,20 @@ class TemplatesController < ApplicationController
   #Destroys specified Workflow.
   #
   def destroy_workflow
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     Item.find(params[:id]).destroy
 
     @tmpl_folder, @tmpl_workflows_folder = TemplatesHelper.get_tmpl_subfolder(TemplatesHelper::TMPL_WORKFLOWS)
 
     @group_id = params[:group_id]
+    SqlHelper.validate_token([@group_id])
 
-    if @group_id.nil? or @group_id.empty?
+    if @group_id.blank?
       @group_id = '0'   # '0' for ROOT
     end
 
     render(:partial => 'groups/ajax_group_workflows', :layout => false)
   end
@@ -118,10 +124,12 @@ class TemplatesController < ApplicationController
   #Creates a template in 'Local' Folder with default name.
   #
   def create_local
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @tmpl_folder, @tmpl_local_folder = TemplatesHelper.get_tmpl_subfolder(TemplatesHelper::TMPL_LOCAL)
 
     unless @tmpl_local_folder.nil?
       item = Item.new_info(@tmpl_local_folder.id)
       item.title = t('template.new')
@@ -140,10 +148,12 @@ class TemplatesController < ApplicationController
   #Destroys specified local template.
   #
   def destroy_local
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     begin
       Item.find(params[:id]).destroy
     rescue
     end
 
@@ -158,10 +168,12 @@ class TemplatesController < ApplicationController
   #Copies Template.
   #
   def copy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     tmpl_id = params[:thetisBoxSelKeeper].split(':').last
     tmpl_item = Item.find(tmpl_id)
 
     item = tmpl_item.copy(@login_user.id, @login_user.get_my_folder.id)
     if item.public != false
diff --git a/app/controllers/timecards_controller.rb b/app/controllers/timecards_controller.rb
index de912944..f40c95b7 100644
--- a/app/controllers/timecards_controller.rb
+++ b/app/controllers/timecards_controller.rb
@@ -1,11 +1,11 @@
 #
 #= TimecardsController
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
 #The Action-Controller about Timecards.
 #
@@ -53,20 +53,20 @@ class TimecardsController < ApplicationController
 
     year_begins_from, month_begins_at = TimecardsHelper.get_fiscal_params
 
     date_s = params[:date]
 
-    if date_s.nil? or date_s.empty?
+    if date_s.blank?
       date = Date.today
     else
       date_params = date_s.split('-')
       if date_params.length == 2
         @year = date_params.first.to_i
         @month = date_params.last.to_i
         date = TimecardsHelper.get_first_day_in_fiscal_month(@year, @month, month_begins_at)
       else
-        date = Date.parse date_s
+        date = Date.parse(date_s)
       end
     end
 
     @fiscal_year = TimecardsHelper.get_fiscal_year(date, year_begins_from, month_begins_at)
     fiscal_month = TimecardsHelper.get_fiscal_month(date, month_begins_at)
@@ -150,11 +150,13 @@ class TimecardsController < ApplicationController
   #Updates timecard.
   #
   def update
     Log.add_info(request, params.inspect)
 
-    if params[:id].nil? or params[:id].empty?
+    return unless request.post?
+
+    if params[:id].blank?
       @timecard = Timecard.new
     else
       @timecard = Timecard.find(params[:id])
     end
 
@@ -163,13 +165,13 @@ class TimecardsController < ApplicationController
       params[:timecard]['options'] = nil
     else
       params[:timecard]['options'] = '|' + options.join('|') + '|'
     end
 
-    if params[:user_id].nil? or params[:user_id].empty?
+    if params[:user_id].blank?
       @selected_user = @login_user
-    elsif @login_user.id.to_s == params[:user_id]
+    elsif (@login_user.id.to_s == params[:user_id])
       @selected_user = @login_user
     else
       unless @login_user.admin?(User::AUTH_TIMECARD)
         Log.add_check(request, '[User::AUTH_TIMECARD]'+request.to_s)
         redirect_to(:controller => 'frames', :action => 'http_error', :id => '401')
@@ -187,16 +189,16 @@ class TimecardsController < ApplicationController
 
       breaks = @timecard.get_breaks_a
       unless breaks.empty?
         check_error = false
 
-        unless params[:timecard]['start'].nil? or params[:timecard]['start'].empty?
+        unless params[:timecard]['start'].blank?
           start_t = UtilDateTime.parse(params[:timecard]['start']).to_time
           check_error = true if breaks.first.first < start_t
         end
 
-        unless params[:timecard]['end'].nil? or params[:timecard]['end'].empty?
+        unless params[:timecard]['end'].blank?
           end_t = UtilDateTime.parse(params[:timecard]['end']).to_time
           check_error = true if end_t < breaks.last.last
         end
 
         if check_error
@@ -235,10 +237,12 @@ class TimecardsController < ApplicationController
   #Deletes timecard.
   #
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     begin
       timecard = Timecard.find(params[:id])
 
       if timecard.user_id != @login_user.id and !@login_user.admin?(User::AUTH_TIMECARD)
         Log.add_check(request, '[User::AUTH_TIMECARD]'+request.to_s)
@@ -281,10 +285,12 @@ class TimecardsController < ApplicationController
   #Updates break.
   #
   def update_break
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     unless params[:user_id].nil?
       @selected_user = User.find(params[:user_id])
 
       if @selected_user.id != @login_user.id and !@login_user.admin?(User::AUTH_TIMECARD)
         Log.add_check(request, '[User::AUTH_TIMECARD]'+request.to_s)
@@ -346,10 +352,12 @@ class TimecardsController < ApplicationController
   #Deletes break.
   #
   def delete_break
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @timecard = Timecard.find(params[:id])
 
     if params[:org_start].nil?
       org_start = nil
     else
@@ -378,22 +386,23 @@ class TimecardsController < ApplicationController
   def group
     Log.add_info(request, params.inspect)
 
     date_s = params[:date]
 
-    if date_s.nil? or date_s.empty?
+    if date_s.blank?
       @date = Date.today
       date_s = @date.strftime(Schedule::SYS_DATE_FORM)
     else
-      @date = Date.parse date_s
+      @date = Date.parse(date_s)
     end
 
     if params[:display] == 'mine'
       redirect_to(:action => 'month')
     else
       display_type = params[:display].split('_').first
       display_id = params[:display].split('_').last
+      SqlHelper.validate_token([display_id])
 
       @selected_users = Group.get_users(display_id)
       @group_id = display_id
 
       if !@login_user.get_groups_a.include?(@group_id.to_s) and !@login_user.admin?(User::AUTH_TIMECARD)
@@ -508,10 +517,12 @@ class TimecardsController < ApplicationController
   #Updates number of paid holidays of specified User and year.
   #
   def paidhld_update
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     year = params[:year].to_i
     num = params[:num].to_f
 
     user = User.find(params[:user_id])
 
@@ -534,15 +545,19 @@ class TimecardsController < ApplicationController
   #Updates number of paid holidays of specified Users.
   #
   def paidhld_update_multi
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     year = params[:year].to_i
     num = params[:num].to_f
 
     group_id = params[:group_id]
     users_hash = (params[:check_user] || {})
+    SqlHelper.validate_token([group_id, users_hash.keys])
+
     done = false
     users_hash.each do |user_id, value|
       if value == '1'
         PaidHoliday.update_for(user_id, year, num)
         done = true
@@ -602,13 +617,15 @@ class TimecardsController < ApplicationController
   #Updates configuration about timecards.
   #
   def update_config
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     yaml = ApplicationHelper.get_config_yaml
 
-    unless params[:timecard].nil? or params[:timecard].empty?
+    unless params[:timecard].blank?
       yaml[:timecard] = Hash.new if yaml[:timecard].nil?
       
       params[:timecard].each do |key, val|
         yaml[:timecard][key] = val
       end
@@ -628,10 +645,12 @@ class TimecardsController < ApplicationController
   #Updates default break.
   #
   def update_default_break
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     start_t = Time.local(2000, 1, 1, params[:start_hour].to_i, params[:start_min].to_i)
     end_t = Time.local(2000, 1, 1, params[:end_hour].to_i, params[:end_min].to_i)
 
     if start_t == end_t
       flash[:notice] = 'ERROR:' + t('timecard.break_without_span')
@@ -688,10 +707,12 @@ class TimecardsController < ApplicationController
   #Deletes default break.
   #
   def delete_default_break
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     unless params[:org_start].nil?
       org_start = UtilDateTime.parse(params[:org_start]).to_time
 
       yaml = ApplicationHelper.get_config_yaml
 
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index b12a3f94..2e73f8a2 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -1,11 +1,11 @@
 #
 #= UsersController
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
 #The Action-Controller about Users.
 #
@@ -46,10 +46,12 @@ class UsersController < ApplicationController
   #Creates User.
   #
   def create
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     attrs = _process_user_attrs(nil, params[:user])
     password = attrs[:password]
     attrs.delete(:password)
 
     @user = UsersHelper.get_initialized_user(attrs.permit(User::PERMIT_BASE))
@@ -112,10 +114,12 @@ class UsersController < ApplicationController
   #Updates User information.
   #
   def update
     Log.add_info(request, '')   # Not to show passwords.
 
+    return unless request.post?
+
     @user = User.find(params[:id])
 
     attrs = _process_user_attrs(@user, params[:user])
     attrs.delete(:password)
 
@@ -233,20 +237,22 @@ class UsersController < ApplicationController
   #Deletes Users.
   #
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     if params[:check_user].nil?
       list
       render(:action => 'list')
       return
     end
 
     count = 0
     params[:check_user].each do |user_id, value|
       if value == '1'
-
+        SqlHelper.validate_token([user_id])
         begin
           User.destroy(user_id)
         rescue => evar
           Log.add_error(request, evar)
         end
@@ -286,10 +292,12 @@ class UsersController < ApplicationController
   #Add OfficialTitles to the User.
   #
   def add_official_titles
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @user = User.find(params[:user_id])
 
     unless params[:official_titles].nil?
       params[:official_titles].each do |official_title_id|
         if @user.user_titles.index{|user_title| user_title.official_title_id.to_s == official_title_id}.nil?
@@ -311,10 +319,12 @@ class UsersController < ApplicationController
   #Add OfficialTitles to the User.
   #
   def remove_official_titles
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     @user = User.find(params[:user_id])
 
     unless params[:official_titles].nil?
       params[:official_titles].each do |official_title_id|
         idx = @user.user_titles.index{|user_title| user_title.official_title_id.to_s == official_title_id}
@@ -333,10 +343,12 @@ class UsersController < ApplicationController
   #Notifies message by E-mail to specified Users.
   #
   def notify
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     root_url = ApplicationHelper.root_url(request)
     count = UsersHelper.send_notification(params[:check_user], params[:thetisBoxEdit], root_url)
 
     if count > 0
       flash[:notice] = t('user.notification_sent')+ count.to_s + t('user.notification_sent_suffix')
@@ -368,52 +380,42 @@ class UsersController < ApplicationController
       unless auth_selected.nil? or auth_selected.empty?
         auth = '|' + auth_selected.join('|') + '|'
       end
 
       if auth_selected.nil? or !auth_selected.include?(User::AUTH_USER)
-
         user_admin_err = false
-
         user_admins = User.where("auth like '%|#{User::AUTH_USER}|%' or auth='#{User::AUTH_ALL}'").to_a
 
         if user_admins.nil? or user_admins.empty?
-
           user_admin_err = true
-
         elsif user_admins.length == 1
-
           if user_admins.first.id.to_s == params[:id]
             user_admin_err = true
           end
-
         end
 
         if user_admin_err
           render(:text => t('user.no_user_auth'))
           return
         end
       end
-
     end
 
     begin
       user = User.find(params[:id])
     rescue => evar
       Log.add_error(request, evar)
     end
 
     if user.nil?
-
       render(:text => t('msg.already_deleted', :name => User.model_name.human))
     else
-
       user.update_attribute(:auth, auth)
 
       if user.id == @login_user.id
         @login_user = user
       end
-
       render(:text => '')
     end
   end
 
   #=== add_to_group
@@ -424,11 +426,13 @@ class UsersController < ApplicationController
   #that is, excludes User from current_id, then adds it to specified Group.
   #
   def add_to_group
     Log.add_info(request, params.inspect)
 
-    if params[:thetisBoxSelKeeper].nil? or params[:thetisBoxSelKeeper].empty?
+    return unless request.post?
+
+    if params[:thetisBoxSelKeeper].blank?
       render(:partial => 'ajax_groups', :layout => false)
       return
     end
 
     group_id = params[:thetisBoxSelKeeper].split(':').last
@@ -454,20 +458,19 @@ class UsersController < ApplicationController
     unless @user.nil?
 
       is_modified = false
 
       # Change, not simply Add
-      unless params[:current_id] == nil or params[:current_id].empty?
+      unless params[:current_id].blank?
         if @user.exclude_from(params[:current_id])
           is_modified = true
         end
       end
 
       is_modified = true if @user.add_to(group_id)
 
       if is_modified == true
-#        @user.update_attribute(:groups, @user.groups)
         @user.save!
 
         if @user.id == @login_user.id
           @login_user = @user
         end
@@ -483,11 +486,13 @@ class UsersController < ApplicationController
   #Excludes User from specified Group.
   #
   def exclude_from_group
     Log.add_info(request, params.inspect)
 
-    if params[:group_id].nil? or params[:group_id].empty?
+    return unless request.post?
+
+    if params[:group_id].blank?
       render(:partial => 'ajax_groups', :layout => false)
       return
     end
 
     group_id = params[:group_id]
@@ -516,10 +521,12 @@ class UsersController < ApplicationController
   #Creates Profile-sheet ("About Me").
   #
   def create_profile_sheet
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     user_id = params[:id]
     @user = User.find(user_id)
 
     @item = @user.create_profile_sheet
 
@@ -534,10 +541,12 @@ class UsersController < ApplicationController
   #Destroys Profile-sheet ("About Me").
   #
   def destroy_profile_sheet
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     user_id = params[:id]
     @user = User.find(user_id)
     item_id = @user.item_id
 
     @user.update_attribute(:item_id, nil)
@@ -571,10 +580,12 @@ class UsersController < ApplicationController
   #Imports Users' list as a CSV file.
   #
   def import_csv
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     file = params[:imp_file]
     mode = params[:mode]
     enc = params[:enc]
 
     all_users = User.find_all
@@ -632,18 +643,14 @@ class UsersController < ApplicationController
         end
       end
     end
 
     if users.empty?
-
       @imp_errs[0] = [t('user.nothing_to_import')]
     else
-
       if mode == 'update'
-
         if found_update
-
           user_admin = users.find do |user|
             user.admin?(User::AUTH_USER)
           end
           if user_admin.nil?
             @imp_errs[0] = [t('user.no_user_auth_import')]
@@ -732,14 +739,16 @@ class UsersController < ApplicationController
   #<Ajax>
   #Creates a title with default name.
   #
   def create_title
 
+    return unless request.post?
+
     titles = User.get_config_titles
     titles = [] if titles.nil?
     titles << t('user.new_title')
-    User.save_config_titles titles
+    User.save_config_titles(titles)
 
     render(:partial => 'ajax_title', :layout => false)
   end
 
   #=== destroy_title
@@ -748,10 +757,12 @@ class UsersController < ApplicationController
   #Destroys the specified title.
   #
   def destroy_title
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     title = params[:title]
 
     titles = User.get_config_titles
     unless titles.nil?
       titles.delete(title)
@@ -776,10 +787,12 @@ class UsersController < ApplicationController
   #Renames the specified title.
   #
   def rename_title
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     org_title = params[:org_title]
     new_title = params[:new_title]
 
     if org_title.nil? or new_title.nil? or org_title == new_title
       render(:partial => 'ajax_title', :layout => false)
@@ -787,19 +800,16 @@ class UsersController < ApplicationController
     end
 
     titles = User.get_config_titles
     unless titles.nil?
       if titles.include?(new_title)
-
         flash[:notice] = 'ERROR:' + t('user.title_duplicated')
-
       else
-
         idx = titles.index(org_title)
         unless idx.nil?
           titles[idx] = new_title
-          User.save_config_titles titles
+          User.save_config_titles(titles)
 
           User.rename_title(org_title, new_title)
           User.update_xorder(new_title, idx)
         end
       end
@@ -814,10 +824,12 @@ class UsersController < ApplicationController
   #Updates titles' order.
   #
   def update_titles_order
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     titles = params[:titles_order]
 
     org_order = User.get_config_titles
     org_order = [] if org_order.nil?
 
@@ -839,10 +851,12 @@ class UsersController < ApplicationController
   #Updates availability of Zeptair VPN Connection for User.
   #
   def update_zept_allowed
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     user = User.find(params[:id])
     zept_allowed = params[:zept_allowed]
 
     if zept_allowed == 'true'
       unless user.allowed_zept_connect?
@@ -882,11 +896,11 @@ class UsersController < ApplicationController
 
     if !attrs[:name].nil? or !attrs[:password].nil?
       user_name = attrs[:name]
       user_name ||= user.name unless user.nil?
       password = attrs[:password]
-      if password.nil? or password.empty?
+      if password.blank?
         password = UsersHelper.generate_password
         attrs[:password] = password
       end
       attrs[:pass_md5] = UsersHelper.generate_digest_pass(user_name, password)
     end
diff --git a/app/controllers/workflows_controller.rb b/app/controllers/workflows_controller.rb
index 9d415ea0..451b4f3f 100644
--- a/app/controllers/workflows_controller.rb
+++ b/app/controllers/workflows_controller.rb
@@ -1,11 +1,11 @@
 #
 #= WorkflowsController
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
 #The Action-Controller about Workflows.
 #
@@ -46,10 +46,12 @@ class WorkflowsController < ApplicationController
   #Creates a Workflow Item in 'My Folder/$Workflows'.
   #
   def create
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     my_wf_folder = WorkflowsHelper.get_my_wf_folder(@login_user.id)
 
     tmpl_item = Item.find(params[:select_workflow])
 
     item = tmpl_item.copy(@login_user.id, my_wf_folder.id)
@@ -75,10 +77,12 @@ class WorkflowsController < ApplicationController
   #Destroys specified local template.
   #
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     workflow = Workflow.find(params[:id])
 
     begin
       workflow.item.destroy
     rescue => evar
@@ -99,10 +103,12 @@ class WorkflowsController < ApplicationController
   #Moves Workflow to the specified Folder.
   #
   def move
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     unless params[:thetisBoxSelKeeper].nil?
       folder_id = params[:thetisBoxSelKeeper].split(':').last
       SqlHelper.validate_token([folder_id])
 
       workflow = Workflow.find(params[:id])
@@ -130,11 +136,11 @@ class WorkflowsController < ApplicationController
   #=== check_owner
   #
   #Filter method to check if the current User is owner of the specified Workflow.
   #
   def check_owner
-    return if params[:id].nil? or params[:id].empty? or @login_user.nil?
+    return if params[:id].blank? or @login_user.nil?
 
     begin
       owner_id = Workflow.find(params[:id]).user_id
     rescue
       owner_id = -1
diff --git a/app/controllers/zeptair_dist_controller.rb b/app/controllers/zeptair_dist_controller.rb
index c3db5635..bba45f8d 100644
--- a/app/controllers/zeptair_dist_controller.rb
+++ b/app/controllers/zeptair_dist_controller.rb
@@ -1,11 +1,11 @@
 #
 #= ZeptairDistController
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
 #The Action-Controller about Zeptair Distribution feature.
 #
@@ -127,14 +127,16 @@ class ZeptairDistController < ApplicationController
   #Their status may be 'saved' or 'canceled' for each attachment file.
   #
   def reply
     Log.add_info(request, '')   # Not to show passwords.
 
-    unless params[:attach_id].nil? or params[:attach_id].empty?
+    return unless request.post?
+
+    unless params[:attach_id].blank?
       target = Attachment.find(params[:attach_id])
     end
-    unless params[:cmd_id].nil? or params[:cmd_id].empty?
+    unless params[:cmd_id].blank?
       target = ZeptairCommand.find(params[:cmd_id])
     end
     if target.nil? or target.item.nil? \
         or target.item.xtype != Item::XTYPE_ZEPTAIR_DIST
       render(:text => 'ERROR:' + t('msg.system_error'))
diff --git a/app/controllers/zeptair_post_controller.rb b/app/controllers/zeptair_post_controller.rb
index f2a12b66..e1611432 100644
--- a/app/controllers/zeptair_post_controller.rb
+++ b/app/controllers/zeptair_post_controller.rb
@@ -1,11 +1,11 @@
 #
 #= ZeptairPostController
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
 #The Action-Controller about ZeptairPost.
 #
@@ -25,10 +25,12 @@ class ZeptairPostController < ApplicationController
   #Uploads a attachment file.
   #
   def upload
     Log.add_info(request, '')   # Not to show passwords.
 
+    return unless request.post?
+
     if params[:file].nil? or params[:file].size <= 0
       render(:text => '')
       return
     end
 
@@ -132,10 +134,12 @@ class ZeptairPostController < ApplicationController
   #Deletes Attachment.
   #
   def delete_attachment
     Log.add_info(request, '')   # Not to show passwords.
 
+    return unless request.post?
+
     target_user = nil
 
     user_id = params[:user_id]
     zeptair_id = params[:zeptair_id]
     attachment_id = params[:attachment_id]
@@ -156,11 +160,10 @@ class ZeptairPostController < ApplicationController
       end
     end
 
     if target_user.nil?
       if attachment_id.blank?
-
         query
         unless @post_items.nil?
           @post_items.each do |post_item|
             post_item.attachments_without_content.each do |attach|
               attach.destroy
diff --git a/app/controllers/zeptair_xlogs_controller.rb b/app/controllers/zeptair_xlogs_controller.rb
index 1c85fbee..c2428a5b 100644
--- a/app/controllers/zeptair_xlogs_controller.rb
+++ b/app/controllers/zeptair_xlogs_controller.rb
@@ -1,11 +1,11 @@
 #
 #= ZeptairXlogsController
 #
 #Original by::   Sysphonic
 #Authors::   MORITA Shintaro
-#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
+#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
 #License::   New BSD License (See LICENSE file)
 #URL::   {http&#58;//sysphonic.com/}[http://sysphonic.com/]
 #
 #The Action-Controller about ZeptairXlogs.
 #
@@ -99,17 +99,20 @@ class ZeptairXlogsController < ApplicationController
   #Deletes ZeptairXlogs.
   #
   def destroy
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     if params[:check_xlog].nil?
       list
       render(:action => 'list')
       return
     end
 
     count = 0
+    SqlHelper.validate_token([params[:check_xlog].keys])
     params[:check_xlog].each do |key, value|
       if value == '1'
         ZeptairXlog.delete(key)
         count += 1
       end
@@ -125,10 +128,12 @@ class ZeptairXlogsController < ApplicationController
   #Deletes all ZeptairXlogs.
   #
   def destroy_all
     Log.add_info(request, params.inspect)
 
+    return unless request.post?
+
     ZeptairXlog.delete_all
 
     flash[:notice] = t('msg.delete_success')
     redirect_to(:action => 'list')
   end
diff --git a/app/helpers/addressbook_helper.rb b/app/helpers/addressbook_helper.rb
index b5a66629..a20f70a4 100644
--- a/app/helpers/addressbook_helper.rb
+++ b/app/helpers/addressbook_helper.rb
@@ -26,10 +26,12 @@ module AddressbookHelper
   #_team_ids_:: Team-IDs to set to the Address.
   #return:: Target Address.
   #
   def self.arrange_per_scope(address, user, scope, group_ids, team_ids)
 
+    SqlHelper.validate_token([group_ids, team_ids])
+
     case scope
      when 'private'
       address.owner_id = user.id
       address.groups = nil
       address.teams = nil
diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index 2c9128f9..d3a29436 100644
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -17,10 +17,28 @@ module ApplicationHelper
   require ::Rails.root.to_s+'/lib/util/sym_hash'
   require 'tempfile'
   require 'uri'     # for URI.extract()
 
 
+  #=== self.stacktrace
+  #
+  #Gets backtrace.
+  #
+  #return:: Backtrace.
+  #
+  def self.stacktrace
+    begin
+      raise('')
+    rescue => evar
+      paths = Rails.root.split('/')
+      paths.delete('')
+      stacktrace = evar.backtrace.select {|line| !(line.match(paths.last).nil?)}.join("\n")
+      stacktrace.pop  # Remove current stack.
+    end
+    return stacktrace
+  end
+
   #=== self.split_preserving_quot
   #
   #Splits string preserving quotations.
   #
   #_str_:: Target String.
diff --git a/app/models/research.rb b/app/models/research.rb
index 95fb54f6..240d1892 100644
--- a/app/models/research.rb
+++ b/app/models/research.rb
@@ -239,11 +239,11 @@ class Research < ActiveRecord::Base
     yaml = Hash.new if yaml.nil?
 
     if group_ids.nil?
 
       unless yaml[:statistics].nil?
-        yaml[:statistics].delete :groups
+        yaml[:statistics].delete(:groups)
       end
 
     else
 
       if yaml[:statistics].nil?
@@ -251,11 +251,11 @@ class Research < ActiveRecord::Base
       end
 
       yaml[:statistics][:groups] = group_ids.join('|')
     end
 
-    Research.save_config_yaml yaml
+    Research.save_config_yaml(yaml)
 
     return ary
   end
 
   #=== self.add_statistics_group
@@ -286,16 +286,16 @@ class Research < ActiveRecord::Base
 
       ary = groups.split('|')
       ary << group_id
 
       ary.compact!
-      ary.delete ''
+      ary.delete('')
 
       yaml[:statistics][:groups] = ary.join('|')
     end
 
-    Research.save_config_yaml yaml
+    Research.save_config_yaml(yaml)
 
     return ary
   end
 
   #=== self.delete_statistics_group
@@ -319,15 +319,15 @@ class Research < ActiveRecord::Base
 
     ary = groups.split('|')
     ary.delete group_id.to_s
 
     ary.compact!
-    ary.delete ''
+    ary.delete('')
 
     yaml[:statistics][:groups] = ary.join('|')
 
-    Research.save_config_yaml yaml
+    Research.save_config_yaml(yaml)
 
     return ary
  end
 
   #=== self.get_status
@@ -404,17 +404,15 @@ class Research < ActiveRecord::Base
       q_codes.each do |q_code_a|
 
         q_code = q_code_a.first
 
         if all.include?(q_code)
-          
           if yaml[q_code].nil?
             q_hash[q_code] = nil
           else
             q_hash[q_code] = Marshal.load(Marshal.dump(yaml[q_code]))
           end
-
         end
       end
     end
 
     return q_hash

Vulnerable code:     return if (params[:id].nil? or params[:id].empty? or @login_user.nil?)
#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
      next if params[cat].nil? or params[cat].empty?
#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
    unless params[:desktop].nil? or params[:desktop].empty?
#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
    if (params[:groups].nil? or params[:groups].empty?)
    if (params[:teams].nil? or params[:teams].empty?)
    if date_s.nil? or date_s.empty?
#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
    if params[:thetisBoxEdit].nil? or params[:thetisBoxEdit].empty?
    unless params[:thetisBoxEdit].nil? or params[:thetisBoxEdit].empty?
    if params[:thetisBoxSelKeeper].nil? or params[:thetisBoxSelKeeper].empty?
    if params[:id] != '0'
        @folder = Folder.find(params[:id])
    session[:folder_id] = params[:id]
      @folder = Folder.find(params[:id])
    session[:folder_id] = params[:id]
        @folder.set_read_users read_users
        @folder.set_write_users write_users
    if @group_id.nil? or @group_id.empty?
      @folder = Folder.find(params[:id])
    session[:folder_id] = params[:id]
      @folder.set_read_groups read_groups
      @folder.set_write_groups write_groups
      @folder = Folder.find(params[:id])
    session[:folder_id] = params[:id]
      @folder.set_read_teams read_teams
      @folder.set_write_teams write_teams
    folder_id = params[:id]

     Log.add_info(request, params.inspect)
    if params[:thetisBoxEdit].nil? or params[:thetisBoxEdit].empty?
    unless params[:thetisBoxEdit].nil? or params[:thetisBoxEdit].empty?
      @group.rename params[:thetisBoxEdit]
    if params[:thetisBoxSelKeeper].nil? or params[:thetisBoxSelKeeper].empty?
#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
    unless params[:select_sorting].nil? or params[:select_sorting].empty?
    if params[:keyword].nil? or params[:keyword].empty?
    if !params[:select_sorting].nil?
    if params[:folder_id].nil? or params[:folder_id].empty?
      orders << '|' + value.split(',').join('|') + '|'
    if params[:id].nil? or params[:id].empty?
    if params[:id].nil? or params[:id].empty?
      @item.attributes = params[:item]
        remove_method :record_timestamps
    if params[:id].nil? or params[:id].empty?
      @item.attributes = params[:item]
    parent_item = attach.item || ((attach.comment.nil?) ? nil : attach.comment.item)
        remove_method :record_timestamps
   begin
      ensure
        if @team.nil?
          flash[:notice] = t('msg.already_deleted', :name => Team.model_name.human)
          return
        end
        @team.save if modified = @team.clear_users


    if location_id.nil? or location_id.empty?
    return if params[:id].nil? or params[:id].empty? or @login_user.nil?
#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
      if params[:fwd_controller].nil? or params[:fwd_controller].empty?
      if params[:fwd_controller].nil? or params[:fwd_controller].empty?
#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
    return if params[:id].nil? or params[:id].empty? or @login_user.nil?
#Copyright:: Copyright (c) 2007-2012 MORITA Shintaro, Sysphonic. All rights reserved.
    return if (params[:id].nil? or params[:id].empty? or @login_user.nil?)
#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
    if params[:thetisBoxEdit].nil? or params[:thetisBoxEdit].empty?
    unless params[:thetisBoxEdit].nil? or params[:thetisBoxEdit].empty?
        mail_account_id = params[:mail_account_id]
      folder_ids = nil
      add_con = nil

      folder_ids = [@folder_id]

      sql = EmailsHelper.get_list_sql(@login_user, params[:keyword], folder_ids, @sort_col, @sort_type, 0, add_con)
    mail_id = params[:id]
      @email = Email.find(mail_id)
    SqlHelper.validate_token([mail_account_id])
    emails = MailFolder.get_mails(mail_folder.id, @login_user) || []

  rescue => evar
    Log.add_error(request, evar)
    render(:partial => 'ajax_folders_order', :layout => false)
    return if params[:id].nil? or params[:id].empty? or @login_user.nil?
#Copyright:: Copyright (c) 2007-2013 MORITA Shintaro, Sysphonic. All rights reserved.
    unless official_title_id.nil? or official_title_id.empty?
    unless official_title_id.nil? or official_title_id.empty?
    if @group_id.nil? or @group_id.empty?
#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
    Research.save_config_yaml yaml
    if !params[:thetisBoxSelKeeper].nil?
    if group_id.nil? or group_id.empty?
      @group_ids = Research.get_statistics_groups 
    unless current_id.nil? or current_id.empty?
      Research.delete_statistics_group current_id
    @group_ids = Research.add_statistics_group group_id
    if group_id.nil? or group_id.empty?
    @group_ids = Research.delete_statistics_group group_id
    Research.set_statistics_groups order_ary
            Research.destroy_all('user_id=' + user_id.to_s)
#Copyright:: Copyright (c) 2007-2013 MORITA Shintaro, Sysphonic. All rights reserved.
          equipment = Equipment.find(equipment_id)
        if params[:fwd_controller].nil? or params[:fwd_controller].empty?
    if date_s.nil? or date_s.empty?
    if date_s.nil? or date_s.empty?
    if date_s.nil? or date_s.empty?
    if date_s.nil? or date_s.empty?
    unless params[:thetisBoxSelKeeper].nil? or params[:thetisBoxSelKeeper].empty?
#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
    if mail_account_id.nil? or mail_account_id.empty?
#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
    return if params[:id].nil? or params[:id].empty? or @login_user.nil?
#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
    if @group_id.nil? or @group_id.empty?
    if @group_id.nil? or @group_id.empty?
#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
    if date_s.nil? or date_s.empty?
        date = Date.parse date_s
    if params[:id].nil? or params[:id].empty?
    if params[:user_id].nil? or params[:user_id].empty?
    elsif @login_user.id.to_s == params[:user_id]
        unless params[:timecard]['start'].nil? or params[:timecard]['start'].empty?
        unless params[:timecard]['end'].nil? or params[:timecard]['end'].empty?
    if date_s.nil? or date_s.empty?
      @date = Date.parse date_s
    unless params[:timecard].nil? or params[:timecard].empty?
#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.











    if params[:thetisBoxSelKeeper].nil? or params[:thetisBoxSelKeeper].empty?
      unless params[:current_id] == nil or params[:current_id].empty?
#        @user.update_attribute(:groups, @user.groups)
    if params[:group_id].nil? or params[:group_id].empty?




    User.save_config_titles titles



          User.save_config_titles titles
      if password.nil? or password.empty?
#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
    return if params[:id].nil? or params[:id].empty? or @login_user.nil?
#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
    unless params[:attach_id].nil? or params[:attach_id].empty?
    unless params[:cmd_id].nil? or params[:cmd_id].empty?
#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.

#Copyright:: Copyright (c) 2007-2011 MORITA Shintaro, Sysphonic. All rights reserved.
        yaml[:statistics].delete :groups
    Research.save_config_yaml yaml
      ary.delete ''
    Research.save_config_yaml yaml
    ary.delete ''
    Research.save_config_yaml yaml
          

Fixed code:     return unless request.post?

    return unless request.post?

      @address = nil
    return unless request.post?

    return unless request.post?

    return unless request.post?

    return if (params[:id].blank? or @login_user.nil?)
#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
    return unless request.post?

      next if params[cat].blank?
    return unless request.post?

    return unless request.post?

    return unless request.post?

    return unless request.post?

#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
    return unless request.post?

    return unless request.post?

    return unless request.post?

    unless params[:desktop].blank?
    return unless request.post?

    return unless request.post?

    return unless request.post?

    SqlHelper.validate_token([params[:id]])
    return unless request.post?

        toy = nil
    return unless request.post?

    return unless request.post?

    return unless request.post?

#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
    return unless request.post?

    SqlHelper.validate_token([params[:groups], params[:teams]])

    return unless request.post?

    SqlHelper.validate_token([params[:groups], params[:teams]])

    if params[:groups].blank?
    if params[:teams].blank?
    return unless request.post?

      SqlHelper.validate_token([equipment_id])
    if date_s.blank?
#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
    return unless request.post?

    if params[:thetisBoxEdit].blank?
    return unless request.post?

    unless params[:thetisBoxEdit].blank?
    return unless request.post?

    return unless request.post?

    if params[:thetisBoxSelKeeper].blank?
    SqlHelper.validate_token([@selected_id])
    SqlHelper.validate_token([@folder_id])
      SqlHelper.validate_token([@sort_col, @sort_type])
    SqlHelper.validate_token([@folder_id])
        @folder = nil
    return unless request.post?

    SqlHelper.validate_token([@folder_id, @group_id])
    return unless request.post?

        folder = nil
    folder_id = params[:id]
    SqlHelper.validate_token([folder_id])

    if folder_id != '0'
        @folder = Folder.find(folder_id)
    session[:folder_id] = folder_id
    return unless request.post?

    SqlHelper.validate_token([folder_id])
    folder_id = params[:id]
    SqlHelper.validate_token([folder_id])

      @folder = Folder.find(folder_id)
    session[:folder_id] = folder_id
      @folder = nil
    return unless request.post?

        @folder.set_read_users(read_users)
        @folder.set_write_users(write_users)
    SqlHelper.validate_token([@group_id])

    if @group_id.blank?
    folder_id = params[:id]
    SqlHelper.validate_token([folder_id])

      @folder = Folder.find(folder_id)
    session[:folder_id] = folder_id
    return unless request.post?

      @folder.set_read_groups(read_groups)
      @folder.set_write_groups(write_groups)
    folder_id = params[:id]
    SqlHelper.validate_token([folder_id])

      @folder = Folder.find(folder_id)
    session[:folder_id] = folder_id
    return unless request.post?

      @folder.set_read_teams(read_teams)
      @folder.set_write_teams(write_teams)
            item = nil
    SqlHelper.validate_token([folder_id])
            item = nil
    Log.add_info(request, params.inspect)

    return unless request.post?
    if params[:thetisBoxEdit].blank?
    return unless request.post?

    unless params[:thetisBoxEdit].blank?
      @group.rename(params[:thetisBoxEdit])
    return unless request.post?

    SqlHelper.validate_token([params[:id]])
    return unless request.post?

    if params[:thetisBoxSelKeeper].blank?
    SqlHelper.validate_token([@selected_id])
    return unless request.post?

    SqlHelper.validate_token([group_id])
            user = nil
    return unless request.post?

    SqlHelper.validate_token([org_group_id, group_id])
            user = nil
    SqlHelper.validate_token([@group_id])
    SqlHelper.validate_token([@group_id])
    return unless request.post?

        group = nil
    SqlHelper.validate_token([@group_id])
    SqlHelper.validate_token([@group_id])
    SqlHelper.validate_token([@group_id])
#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
    SqlHelper.validate_token([@folder_id])
    unless params[:select_sorting].blank?
    if params[:keyword].blank?
    unless params[:select_sorting].nil?
    if params[:folder_id].blank?
      @item = nil
    return unless request.post?

    return unless request.post?

    SqlHelper.validate_token([folder_id])
          item = nil
    return unless request.post?

    return unless request.post?

    return unless request.post?

    return unless request.post?

      user_ids = value.split(',')
      SqlHelper.validate_token([user_ids])
      orders << '|' + user_ids.join('|') + '|'
    return unless request.post?

    return unless request.post?

    if params[:id].blank?
    return unless request.post?

    if params[:id].blank?
      @item.attributes = params.require(:item).permit(Item::PERMIT_BASE)
    return unless request.post?

    return unless request.post?

    return unless request.post?

        remove_method(:record_timestamps)
    return unless request.post?

    if params[:id].blank?
      @item.attributes = params.require(:item).permit(Item::PERMIT_BASE)
    parent_item = (attach.item || ((attach.comment.nil?) ? nil : attach.comment.item))
    return unless request.post?

    return unless request.post?

    return unless request.post?

        remove_method(:record_timestamps)
    return unless request.post?

    return unless request.post?

    return unless request.post?

    return unless request.post?

    return unless request.post?

    return unless request.post?

    begin
    return unless request.post?

      end
      if @team.nil?
        flash[:notice] = t('msg.already_deleted', :name => Team.model_name.human)
        return
        modified = @team.clear_users
        @team.save if modified
    return unless request.post?

    return unless request.post?

    return unless request.post?

    return unless request.post?

    return unless request.post?

    SqlHelper.validate_token([params[:id]])

    return unless request.post?

    SqlHelper.validate_token([location_id])
    if location_id.blank?
        location = nil
      SqlHelper.validate_token([group_id])
    return if params[:id].blank? or @login_user.nil?
#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
      if params[:fwd_controller].blank?
      if params[:fwd_controller].blank?

    return unless request.post?

    return unless request.post?

#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
    return unless request.post?

    return unless request.post?

    SqlHelper.validate_token([mail_account_id])
    return if params[:id].blank? or @login_user.nil?
#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
    return unless request.post?

    return unless request.post?

          filter = nil
    return unless request.post?

    return unless request.post?

    return if (params[:id].blank? or @login_user.nil?)
#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
    return unless request.post?

    if params[:thetisBoxEdit].blank?
    return unless request.post?

    unless params[:thetisBoxEdit].blank?
    return unless request.post?

    SqlHelper.validate_token([mail_account_id])
    return unless request.post?

    SqlHelper.validate_token([parent_id])

      mail_account_id = params[:mail_account_id]
      SqlHelper.validate_token([mail_account_id])

    SqlHelper.validate_token([@folder_id])

      SqlHelper.validate_token([@sort_col, @sort_type])
      sql = EmailsHelper.get_list_sql(@login_user, params[:keyword], [@folder_id], @sort_col, @sort_type, 0, nil)
    email_id = params[:id]
      @email = Email.find(email_id)
    return unless request.post?

    SqlHelper.validate_token([@folder_id, mail_account_id])
    emails = (MailFolder.get_mails(mail_folder.id, @login_user) || [])
    return unless request.post?

    SqlHelper.validate_token([folder_id, mail_account_id])
    return unless request.post?

    SqlHelper.validate_token([@folder_id])
    return unless request.post?

    return unless request.post?

    return if params[:id].blank? or @login_user.nil?
#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
    SqlHelper.validate_token([@group_id, official_title_id])
    unless official_title_id.blank?
    SqlHelper.validate_token([@group_id, official_title_id])
    unless official_title_id.blank?
    return unless request.post?

    SqlHelper.validate_token([@group_id, official_title_id])
    return unless request.post?

    SqlHelper.validate_token([@group_id])
    if @group_id.blank?
    return unless request.post?

    SqlHelper.validate_token([@group_id])

    return unless request.post?

#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
    return unless request.post?

    return unless request.post?

    return unless request.post?

    Research.save_config_yaml(yaml)
    return unless request.post?

    return unless request.post?

    unless params[:thetisBoxSelKeeper].nil?
    SqlHelper.validate_token([current_id, group_id])
    if group_id.blank?
      @group_ids = Research.get_statistics_groups
    unless current_id.blank?
      Research.delete_statistics_group(current_id)
    @group_ids = Research.add_statistics_group(group_id)
    return unless request.post?

    SqlHelper.validate_token([group_id])
    if group_id.blank?
    @group_ids = Research.delete_statistics_group(group_id)
    return unless request.post?

    Research.set_statistics_groups(order_ary)
    return unless request.post?

    return unless request.post?

    return unless request.post?

    return unless request.post?

          SqlHelper.validate_token([user_id])
            Research.destroy_all("user_id=#{user_id.to_i}")
    return unless request.post?

    return unless request.post?

    return unless request.post?

#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
    return unless request.post?

    return unless request.post?

      SqlHelper.validate_token([holidays])
    return unless request.post?

        SqlHelper.validate_token([params[attr]])
          begin
            equipment = Equipment.find(equipment_id)
          rescue => evar
            equipment = nil
          end
        if params[:fwd_controller].blank?
    return unless request.post?

    if date_s.blank?
    if date_s.blank?
    if date_s.blank?
    SqlHelper.validate_token([@group_id, params[:id]])
    if date_s.blank?
    unless params[:thetisBoxSelKeeper].blank?
#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
    if mail_account_id.blank?
      SqlHelper.validate_token([account_xtype])
    return unless request.post?

    return unless request.post?

    return unless request.post?

    return unless request.post?

#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
    return unless request.post?

    return if params[:id].blank? or @login_user.nil?
#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
    return unless request.post?

    SqlHelper.validate_token([@group_id])
    if @group_id.blank?
    return unless request.post?

    SqlHelper.validate_token([@group_id])
    if @group_id.blank?
    return unless request.post?

    return unless request.post?

    return unless request.post?

#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
    if date_s.blank?
        date = Date.parse(date_s)
    return unless request.post?

    if params[:id].blank?
    if params[:user_id].blank?
    elsif (@login_user.id.to_s == params[:user_id])
        unless params[:timecard]['start'].blank?
        unless params[:timecard]['end'].blank?
    return unless request.post?

    return unless request.post?

    return unless request.post?

    if date_s.blank?
      @date = Date.parse(date_s)
      SqlHelper.validate_token([display_id])
    return unless request.post?

    return unless request.post?

    SqlHelper.validate_token([group_id, users_hash.keys])

    return unless request.post?

    unless params[:timecard].blank?
    return unless request.post?

    return unless request.post?

#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
    return unless request.post?

    return unless request.post?

    return unless request.post?

        SqlHelper.validate_token([user_id])
    return unless request.post?

    return unless request.post?

    return unless request.post?

    return unless request.post?

    if params[:thetisBoxSelKeeper].blank?
      unless params[:current_id].blank?
    return unless request.post?

    if params[:group_id].blank?
    return unless request.post?

    return unless request.post?

    return unless request.post?

    return unless request.post?

    User.save_config_titles(titles)
    return unless request.post?

    return unless request.post?

          User.save_config_titles(titles)
    return unless request.post?

    return unless request.post?

      if password.blank?
#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
    return unless request.post?

    return unless request.post?

    return unless request.post?

    return if params[:id].blank? or @login_user.nil?
#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
    return unless request.post?

    unless params[:attach_id].blank?
    unless params[:cmd_id].blank?
#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
    return unless request.post?

    return unless request.post?

#Copyright:: Copyright (c) 2007-2015 MORITA Shintaro, Sysphonic. All rights reserved.
    return unless request.post?

    SqlHelper.validate_token([params[:check_xlog].keys])
    return unless request.post?

    SqlHelper.validate_token([group_ids, team_ids])

  #=== self.stacktrace
  #
  #Gets backtrace.
  #
  #return:: Backtrace.
  #
  def self.stacktrace
    begin
      raise('')
    rescue => evar
      paths = Rails.root.split('/')
      paths.delete('')
      stacktrace = evar.backtrace.select {|line| !(line.match(paths.last).nil?)}.join("\n")
      stacktrace.pop  # Remove current stack.
    end
    return stacktrace
  end

        yaml[:statistics].delete(:groups)
    Research.save_config_yaml(yaml)
      ary.delete('')
    Research.save_config_yaml(yaml)
    ary.delete('')
    Research.save_config_yaml(yaml)