Index: /extensions/AdminTools/include/events.inc.php
===================================================================
--- /extensions/AdminTools/include/events.inc.php	(revision 25844)
+++ /extensions/AdminTools/include/events.inc.php	(revision 25845)
@@ -8,79 +8,89 @@
 function admintools_add_public_controller()
 {
-  global $MultiView, $conf, $template, $page, $user;
-
-  if (!$MultiView->is_admin())
+  global $MultiView, $conf, $template, $page, $user, $picture;
+
+  $url_root = get_root_url();
+  $tpl_vars = array();
+
+  if ($MultiView->is_admin())
+  { // full options for admin
+    $tpl_vars['U_SITE_ADMIN'] =     $url_root . 'admin.php?page=';
+    $tpl_vars['MULTIVIEW'] =        $MultiView->get_data();
+    $tpl_vars['USER'] =             $MultiView->get_user();
+    $tpl_vars['CURRENT_USERNAME'] = $user['id']==$conf['guest_id'] ? l10n('guest') : $user['username'];
+    $tpl_vars['DELETE_CACHE'] =     isset($conf['multiview_invalidate_cache']);
+
+    include_once(PHPWG_ROOT_PATH . 'include/functions_mail.inc.php');
+    switch_lang_to(get_default_language());
+  }
+  else if (script_basename() == 'picture' and $picture['current']['added_by'] == $user['id'])
+  { // only "edit" button for photo owner
+  }
+  else
   {
     return;
   }
 
-  $url_root = get_root_url();
-
-  $tpl_vars = array(
-    'U_SITE_ADMIN' =>     $url_root . 'admin.php?page=',
-    'MULTIVIEW' =>        $MultiView->get_data(),
-    'U_SELF' =>           $MultiView->get_clean_url(true),
-    'USER' =>             $MultiView->get_user(),
-    'CURRENT_USERNAME' => $user['id']==$conf['guest_id'] ? l10n('guest') : $user['username'],
-    'PWG_TOKEN' =>        get_pwg_token(),
-    'DELETE_CACHE' =>     isset($conf['multiview_invalidate_cache']),
-    );
-
-  // switch_lang is in mail functions file
-  include_once(PHPWG_ROOT_PATH . 'include/functions_mail.inc.php');
-
-  switch_lang_to(get_default_language());
-
-  // TODO : param to allow owner modification
+  $tpl_vars['U_SELF'] = $MultiView->get_clean_url(true);
+
+  // photo page
   if (script_basename() == 'picture')
   {
-    global $picture;
-
-    include_once(PHPWG_ROOT_PATH . 'admin/include/functions.php');
-
     $url_self = duplicate_picture_url();
-
     $tpl_vars['IS_PICTURE'] = true;
 
-    $template->clear_assign(array(
-      'U_SET_AS_REPRESENTATIVE',
-      'U_PHOTO_ADMIN',
-      'U_CADDIE',
-      ));
-
-    $template->set_prefilter('picture', 'admintools_remove_privacy');
-
-    $query = '
+    // admin can add to caddie and set representattive
+    if ($MultiView->is_admin())
+    {
+      $template->clear_assign(array(
+        'U_SET_AS_REPRESENTATIVE',
+        'U_PHOTO_ADMIN',
+        'U_CADDIE',
+        ));
+
+      $template->set_prefilter('picture', 'admintools_remove_privacy');
+
+      $tpl_vars['U_CADDIE'] = add_url_params(
+        $url_self,
+        array('action'=>'add_to_caddie')
+        );
+
+      $query = '
 SELECT element_id FROM ' . CADDIE_TABLE . '
   WHERE element_id = ' . $page['image_id'] .'
 ;';
-    $tpl_vars['IS_IN_CADDIE'] = pwg_db_num_rows(pwg_query($query)) > 0;
-
-    if (isset($page['category']))
-    {
-      $tpl_vars['CATEGORY_ID'] = $page['category']['id'];
-
-      $tpl_vars['U_SET_REPRESENTATIVE'] = add_url_params(
-        $url_self,
-        array('action'=>'set_as_representative')
-        );
-
-      $query = '
+      $tpl_vars['IS_IN_CADDIE'] = pwg_db_num_rows(pwg_query($query)) > 0;
+
+      if (isset($page['category']))
+      {
+        $tpl_vars['CATEGORY_ID'] = $page['category']['id'];
+
+        $tpl_vars['U_SET_REPRESENTATIVE'] = add_url_params(
+          $url_self,
+          array('action'=>'set_as_representative')
+          );
+
+        $query = '
 SELECT id FROM ' . CATEGORIES_TABLE.'
   WHERE id = ' . $page['category']['id'] .'
     AND representative_picture_id = ' . $page['image_id'] .'
 ;';
-      $tpl_vars['IS_REPRESENTATIVE'] = pwg_db_num_rows(pwg_query($query)) > 0;
-    }
-
-    $tpl_vars['U_EDIT'] = $url_root . 'admin.php?page=photo-' . $page['image_id']
-      .(isset($page['category']) ? '&amp;cat_id=' . $page['category']['id'] : '');
-
-    $tpl_vars['U_CADDIE'] = add_url_params(
-      $url_self,
-      array('action'=>'add_to_caddie')
+        $tpl_vars['IS_REPRESENTATIVE'] = pwg_db_num_rows(pwg_query($query)) > 0;
+      }
+
+      $tpl_vars['U_ADMIN_EDIT'] = $url_root . 'admin.php?page=photo-' . $page['image_id']
+        .(isset($page['category']) ? '&amp;cat_id=' . $page['category']['id'] : '');
+    }
+
+    $tpl_vars['U_DELETE'] = add_url_params(
+      $url_self, array(
+        'delete'=>'',
+        'pwg_token'=>get_pwg_token()
+        )
       );
 
     // gets tags (full available list is loaded in ajax)
+    include_once(PHPWG_ROOT_PATH . 'admin/include/functions.php');
+
     $query = '
 SELECT id, name
@@ -102,5 +112,6 @@
       );
   }
-  else if (@$page['section'] == 'categories' and isset($page['category']))
+  // album page (admin only)
+  else if ($MultiView->is_admin() and @$page['section'] == 'categories' and isset($page['category']))
   {
     $url_self = duplicate_index_url();
@@ -114,5 +125,5 @@
       ));
 
-    $tpl_vars['U_EDIT'] = $url_root . 'admin.php?page=album-' . $page['category']['id'];
+    $tpl_vars['U_ADMIN_EDIT'] = $url_root . 'admin.php?page=album-' . $page['category']['id'];
 
     if (!empty($page['items']))
@@ -151,5 +162,8 @@
   $template->parse('ato_public_controller');
 
-  switch_lang_back();
+  if ($MultiView->is_admin())
+  {
+    switch_lang_back();
+  }
 }
 
@@ -170,7 +184,10 @@
 function admintools_save_picture()
 {
-  global $page, $conf, $MultiView;
-
-  if (!$MultiView->is_admin())
+  global $page, $conf, $MultiView, $user, $picture;
+
+  $query = 'SELECT added_by FROM '. IMAGES_TABLE .' WHERE id = '. $page['image_id'] .';';
+  list($added_by) = pwg_db_fetch_row(pwg_query($query));
+
+  if (!$MultiView->is_admin() && $user['id'] != $added_by)
   {
     return;
@@ -205,6 +222,10 @@
       'name' =>   $_POST['name'],
       'author' => $_POST['author'],
-      'level' =>  $_POST['level'],
-      );
+      );
+
+    if ($MultiView->is_admin())
+    {
+      $data['level'] = $_POST['level'];
+    }
 
     if ($conf['allow_html_descriptions'])
@@ -249,5 +270,5 @@
     return;
   }
-  
+
   if (@$_POST['action'] == 'quick_edit')
   {
@@ -270,5 +291,5 @@
       array('id' => $page['category']['id'])
       );
-      
+
     redirect(duplicate_index_url());
   }
Index: /extensions/AdminTools/main.inc.php
===================================================================
--- /extensions/AdminTools/main.inc.php	(revision 25844)
+++ /extensions/AdminTools/main.inc.php	(revision 25845)
@@ -39,4 +39,11 @@
 add_event_handler('register_user', array('MultiView', 'invalidate_cache'));
 
+if (!defined('IN_ADMIN'))
+{
+  add_event_handler('loc_after_page_header', 'admintools_add_public_controller');
+  add_event_handler('loc_begin_picture', 'admintools_save_picture');
+  add_event_handler('loc_begin_index', 'admintools_save_category');
+}
+
 
 // +-----------------------------------------------------------------------+
@@ -46,12 +53,5 @@
 {
   global $MultiView;
-  
-  if (!defined('IN_ADMIN') && $MultiView->is_admin())
-  {
-    add_event_handler('loc_after_page_header', 'admintools_add_public_controller');
-    add_event_handler('loc_begin_picture', 'admintools_save_picture');
-    add_event_handler('loc_begin_index', 'admintools_save_category');
-  }
-  
+
   load_language('plugin.lang', ADMINTOOLS_PATH);
 
@@ -61,5 +61,5 @@
   // $maintain = new AdminTools_maintain(ADMINTOOLS_ID);
   // $maintain->autoUpdate(ADMINTOOLS_VERSION, 'install');
-  
+
   // $conf['AdminTools'] = unserialize($conf['AdminTools']);
 }
Index: /extensions/AdminTools/template/public_controller.tpl
===================================================================
--- /extensions/AdminTools/template/public_controller.tpl	(revision 25844)
+++ /extensions/AdminTools/template/public_controller.tpl	(revision 25845)
@@ -33,4 +33,6 @@
 {footer_script require='admintools.controller'}
 AdminTools.urlWS = '{$ROOT_URL}ws.php?format=json&method=';
+
+{if isset($ato.MULTIVIEW)}
 AdminTools.multiView = {
   view_as: {$ato.MULTIVIEW.view_as},
@@ -38,4 +40,5 @@
   lang: '{$ato.MULTIVIEW.lang}'
 };
+{/if}
 
 {if $ato.DELETE_CACHE}
@@ -67,4 +70,5 @@
   <ul>
     <li><a href="#" class="icon-ato-cancel close-panel"></a></li>
+  {if isset($ato.U_SITE_ADMIN)}
     <li class="parent"><a href="#" class="icon-menu ato-hide-1">{'Administration'|translate}</a>
       <ul>
@@ -77,14 +81,20 @@
       </ul>
     </li>
-  {if isset($ato.U_EDIT)}
+  {/if}
+  {if isset($ato.U_ADMIN_EDIT)}
     <li class="parent"><a href="#" class="icon-pencil ato-hide-2">{'Edit'|translate}</a>
       <ul>
         <li><a href="#ato_quick_edit" class="icon-ato-flash edit-quick">{'Quick edit'|translate}</a></li>
-        <li><a class="icon-ato-doc-text-inv" href="{$ato.U_EDIT}">{'Properties page'|translate}</a></li>
-      {if isset($ato.IS_PICTURE)}
-				<li style="margin-top:1em;"><a class="icon-ato-cancel" href="{$ato.U_SELF}delete&amp;pwg_token={$ato.PWG_TOKEN}" onclick="return confirm('{'Are you sure?'|translate|escape:javascript}')">{'delete photo'|translate|ucfirst}</a></li>
+        <li><a class="icon-ato-doc-text-inv" href="{$ato.U_ADMIN_EDIT}">{'Properties page'|translate}</a></li>
+      {if isset($ato.U_DELETE)}
+				<li style="margin-top:1em;"><a class="icon-ato-cancel" href="{$ato.U_DELETE}" onclick="return confirm('{'Are you sure?'|translate|escape:javascript}')">{'delete photo'|translate|ucfirst}</a></li>
       {/if}
       </ul>
     </li>
+  {else if isset($ato.QUICK_EDIT)}
+    <li><a href="#ato_quick_edit" class="icon-pencil edit-quick ato-hide-2">{'Edit'|translate}</a></li>
+    {if isset($ato.U_DELETE)}
+      <li><a class="icon-ato-cancel ato-hide-2" href="{$ato.U_DELETE}" onclick="return confirm('{'Are you sure?'|translate|escape:javascript}')">{'delete photo'|translate|ucfirst}</a></li>
+    {/if}
   {/if}
   {if isset($ato.U_SET_REPRESENTATIVE)}
@@ -99,4 +109,5 @@
     <li class="saved"><span class="icon-ato-ok ato-hide-1">{'Saved'|translate}</span></li>
 
+  {if isset($ato.MULTIVIEW)}
     <li class="parent right multiview"><a class="icon-cog-alt ato-hide-1" href="#">{'Tools'|translate}</a>
       <ul>
@@ -118,9 +129,10 @@
       </ul>
     </li>
-  {if $ato.USER.id != $ato.MULTIVIEW.view_as}
+    {if $ato.USER.id != $ato.MULTIVIEW.view_as}
     <li class="right">
       &nbsp;&nbsp;{'Viewing as <b>%s</b>.'|translate:$ato.CURRENT_USERNAME}
       <a href="{$ato.U_SELF}ato_view_as={$ato.USER.id}">{'Revert'|translate}</a>
     </li>
+    {/if}
   {/if}
   </ul>
@@ -156,8 +168,10 @@
         </select>
 
+        {if isset($available_permission_levels)}
         <label for="quick_edit_level">{'Who can see this photo?'|@translate}</label>
         <select name="level" size="1">
           {html_options options=$available_permission_levels selected=$ato.QUICK_EDIT.level}
         </select>
+        {/if}
       {/if}
 
