diff --git a/.travis.yml b/.travis.yml
index 72a55f5ad..3edfc71ff 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -27,4 +27,5 @@ script:
 - if [ $(phpenv version-name) != "5.3" ]; then ./vendor/bin/codecept run -d --fail-fast --env travis; fi
 notifications:
   slack:
-    secure: 0HhwktIb65zfge56E4yMfYj0Xj4GeYIaxvh/Obb13BK1/C8RdWBy6u213N5MQ2UHsxYk8wXXzynaCh4psegi2iPy9dbKmkdAdEQMzYoKE2xYVSqZveeVQm0sqFVXAlzggpgs/j5vtvKYjRkQKtTrz0C+p0uJ0bkLcyWGezWTpGc=
+    secure: jpoMjtkveVuPZM4JXJETAPv8QUCtTbI/ZTixdS9HUgxSb9tD2DkoekMaRzXYnXA82Les/gGxTC0fQFcFrls6Ypkbvp1udBPggmAdLiBHubBIz+yd1BGIf/l4I6MY1QmGe1Lx4xlnVlEgLnKXHn+W+ENep4/MzpCEaR9Vw8wfGqY=
+    secure: "gPv4qFmGcXimNlI/OeVk5n4VtRCWbAe7VUtw7Inb3A/ZZaVDo11gtMNkwo/JVKSnXqFkaCQYebcNpj2D9Rb2ZCwgjMSX6wxvpA4/8OLOZpbWqFW6Hz2RKNggubXlnalXkIwFcsvj70rKctbcJFk2C1G9rVvYWdVGD9X4/ozQtAc="
diff --git a/classes/context/Context.class.php b/classes/context/Context.class.php
index cd4265b1f..c2ea46405 100644
--- a/classes/context/Context.class.php
+++ b/classes/context/Context.class.php
@@ -666,9 +666,20 @@ class Context
 			{
 				$url = base64_decode(self::get('default_url'));
 				$url_info = parse_url($url);
+
+				$oModuleModel = getModel('module');
+				$site_info = $oModuleModel->getSiteInfoByDomain($url_info['host']);
+				if(!$site_info->site_srl) {
+					$oModuleObject = new ModuleObject();
+					$oModuleObject->stop('msg_invalid_request');
+
+					return false;
+				}
+
 				$url_info['query'].= ($url_info['query'] ? '&' : '') . 'SSOID=' . session_id();
 				$redirect_url = sprintf('%s://%s%s%s?%s', $url_info['scheme'], $url_info['host'], $url_info['port'] ? ':' . $url_info['port'] : '', $url_info['path'], $url_info['query']);
 				header('location:' . $redirect_url);
+
 				return FALSE;
 			}
 			// for sites requesting SSO validation
diff --git a/classes/module/ModuleHandler.class.php b/classes/module/ModuleHandler.class.php
index 4f6b67fe2..9fadc71aa 100644
--- a/classes/module/ModuleHandler.class.php
+++ b/classes/module/ModuleHandler.class.php
@@ -116,7 +116,6 @@ class ModuleHandler extends Handler
 	 * */
 	function init()
 	{
-		
 		$oModuleModel = getModel('module');
 		$site_module_info = Context::get('site_module_info');
 
@@ -317,13 +316,13 @@ class ModuleHandler extends Handler
 	function procModule()
 	{
 		$oModuleModel = getModel('module');
+		$display_mode = Mobile::isFromMobilePhone() ? 'mobile' : 'view';
 
 		// If error occurred while preparation, return a message instance
 		if($this->error)
 		{
 			$this->_setInputErrorToContext();
-			$type = Mobile::isFromMobilePhone() ? 'mobile' : 'view';
-			$oMessageObject = ModuleHandler::getModuleInstance('message', $type);
+			$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);
 			$oMessageObject->setError(-1);
 			$oMessageObject->setMessage($this->error);
 			$oMessageObject->dispMessage();
@@ -359,8 +358,7 @@ class ModuleHandler extends Handler
 			$this->httpStatusCode = '404';
 
 			$this->_setInputErrorToContext();
-			$type = Mobile::isFromMobilePhone() ? 'mobile' : 'view';
-			$oMessageObject = ModuleHandler::getModuleInstance('message', $type);
+			$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);
 			$oMessageObject->setError(-1);
 			$oMessageObject->setMessage($this->error);
 			$oMessageObject->dispMessage();
@@ -397,7 +395,7 @@ class ModuleHandler extends Handler
 			if(!in_array(strtoupper($_SERVER['REQUEST_METHOD']), $allowedMethodList))
 			{
 				$this->error = "msg_invalid_request";
-				$oMessageObject = ModuleHandler::getModuleInstance('message', 'view');
+				$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);
 				$oMessageObject->setError(-1);
 				$oMessageObject->setMessage($this->error);
 				$oMessageObject->dispMessage();
@@ -410,13 +408,24 @@ class ModuleHandler extends Handler
 			Mobile::setMobile(FALSE);
 		}
 
-		// Admin ip
 		$logged_info = Context::get('logged_info');
+
+		// check CSRF for admin actions
+		if($kind === 'admin' && Context::getRequestMethod() === 'POST' && !checkCSRF()) {
+			$this->error = 'msg_invalid_request';
+			$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);
+			$oMessageObject->setError(-1);
+			$oMessageObject->setMessage($this->error);
+			$oMessageObject->dispMessage();
+			return $oMessageObject;
+		}
+
+		// Admin ip
 		if($kind == 'admin' && $_SESSION['denied_admin'] == 'Y')
 		{
 			$this->_setInputErrorToContext();
 			$this->error = "msg_not_permitted_act";
-			$oMessageObject = ModuleHandler::getModuleInstance('message', $type);
+			$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);
 			$oMessageObject->setError(-1);
 			$oMessageObject->setMessage($this->error);
 			$oMessageObject->dispMessage();
@@ -446,8 +455,7 @@ class ModuleHandler extends Handler
 		if(!is_object($oModule))
 		{
 			$this->_setInputErrorToContext();
-			$type = Mobile::isFromMobilePhone() ? 'mobile' : 'view';
-			$oMessageObject = ModuleHandler::getModuleInstance('message', $type);
+			$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);
 			$oMessageObject->setError(-1);
 			$oMessageObject->setMessage($this->error);
 			$oMessageObject->dispMessage();
@@ -466,7 +474,7 @@ class ModuleHandler extends Handler
 			{
 				$this->_setInputErrorToContext();
 				$this->error = 'msg_invalid_request';
-				$oMessageObject = ModuleHandler::getModuleInstance('message', $type);
+				$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);
 				$oMessageObject->setError(-1);
 				$oMessageObject->setMessage($this->error);
 				$oMessageObject->dispMessage();
@@ -495,7 +503,7 @@ class ModuleHandler extends Handler
 				else
 				{
 					$this->error = 'msg_invalid_request';
-					$oMessageObject = ModuleHandler::getModuleInstance('message', 'view');
+					$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);
 					$oMessageObject->setError(-1);
 					$oMessageObject->setMessage($this->error);
 					$oMessageObject->dispMessage();
@@ -537,9 +545,8 @@ class ModuleHandler extends Handler
 
 				if(!is_object($oModule))
 				{
-					$type = Mobile::isFromMobilePhone() ? 'mobile' : 'view';
 					$this->_setInputErrorToContext();
-					$oMessageObject = ModuleHandler::getModuleInstance('message', $type);
+					$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);
 					$oMessageObject->setError(-1);
 					$oMessageObject->setMessage('msg_module_is_not_exists');
 					$oMessageObject->dispMessage();
@@ -569,7 +576,7 @@ class ModuleHandler extends Handler
 						$this->_setInputErrorToContext();
 
 						$this->error = 'msg_is_not_administrator';
-						$oMessageObject = ModuleHandler::getModuleInstance('message', $type);
+						$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);
 						$oMessageObject->setError(-1);
 						$oMessageObject->setMessage($this->error);
 						$oMessageObject->dispMessage();
@@ -583,7 +590,7 @@ class ModuleHandler extends Handler
 					{
 						$this->_setInputErrorToContext();
 						$this->error = 'msg_is_not_manager';
-						$oMessageObject = ModuleHandler::getModuleInstance('message', 'view');
+						$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);
 						$oMessageObject->setError(-1);
 						$oMessageObject->setMessage($this->error);
 						$oMessageObject->dispMessage();
@@ -595,7 +602,7 @@ class ModuleHandler extends Handler
 						{
 							$this->_setInputErrorToContext();
 							$this->error = 'msg_is_not_administrator';
-							$oMessageObject = ModuleHandler::getModuleInstance('message', 'view');
+							$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode);
 							$oMessageObject->setError(-1);
 							$oMessageObject->setMessage($this->error);
 							$oMessageObject->dispMessage();
diff --git a/config/config.inc.php b/config/config.inc.php
index 3eb89230b..828c4925e 100644
--- a/config/config.inc.php
+++ b/config/config.inc.php
@@ -29,7 +29,7 @@ define('__ZBXE__', __XE__);
 /**
  * Display XE's full version.
  */
-define('__XE_VERSION__', '1.8.8');
+define('__XE_VERSION__', '1.8.9');
 define('__XE_VERSION_ALPHA__', (stripos(__XE_VERSION__, 'alpha') !== false));
 define('__XE_VERSION_BETA__', (stripos(__XE_VERSION__, 'beta') !== false));
 define('__XE_VERSION_RC__', (stripos(__XE_VERSION__, 'rc') !== false));
diff --git a/modules/document/document.controller.php b/modules/document/document.controller.php
index bc25a71f2..0076f69df 100644
--- a/modules/document/document.controller.php
+++ b/modules/document/document.controller.php
@@ -274,6 +274,7 @@ class documentController extends document
 			$obj->homepage = $logged_info->homepage;
 		}
 		// If the tile is empty, extract string from the contents.
+		$obj->title = htmlspecialchars($obj->title);
 		settype($obj->title, "string");
 		if($obj->title == '') $obj->title = cut_str(trim(strip_tags(nl2br($obj->content))),20,'...');
 		// If no tile extracted from the contents, leave it untitled.