diff --git a/Admin/Routes/Web/Api.php b/Admin/Routes/Web/Api.php
index d691c8b..653d899 100755
--- a/Admin/Routes/Web/Api.php
+++ b/Admin/Routes/Web/Api.php
@@ -22,6 +22,7 @@ return [
         [
             'dest'       => '\Modules\Media\Controller\ApiController:apiMediaUpload',
             'verb'       => RouteVerb::PUT,
+            'csrf'       => true,
             'permission' => [
                 'module' => ApiController::NAME,
                 'type'   => PermissionType::CREATE,
@@ -31,6 +32,7 @@ return [
         [
             'dest'       => '\Modules\Media\Controller\ApiController:apiMediaUpdate',
             'verb'       => RouteVerb::SET,
+            'csrf'       => true,
             'permission' => [
                 'module' => ApiController::NAME,
                 'type'   => PermissionType::CREATE,
@@ -42,6 +44,7 @@ return [
         [
             'dest'       => '\Modules\Media\Controller\ApiController:apiMediaCreate',
             'verb'       => RouteVerb::PUT,
+            'csrf'       => true,
             'permission' => [
                 'module' => ApiController::NAME,
                 'type'   => PermissionType::CREATE,
@@ -53,6 +56,7 @@ return [
         [
             'dest'       => '\Modules\Media\Controller\ApiController:apiMediaExport',
             'verb'       => RouteVerb::GET,
+            'csrf'       => true,
             'permission' => [
                 'module' => ApiController::NAME,
                 'type'   => PermissionType::READ,
@@ -64,6 +68,7 @@ return [
         [
             'dest'       => '\Modules\Media\Controller\ApiController:apiCollectionCreate',
             'verb'       => RouteVerb::PUT,
+            'csrf'       => true,
             'permission' => [
                 'module' => ApiController::NAME,
                 'type'   => PermissionType::CREATE,
diff --git a/Controller/ApiController.php b/Controller/ApiController.php
index fd40d65..510ad14 100755
--- a/Controller/ApiController.php
+++ b/Controller/ApiController.php
@@ -1015,7 +1015,7 @@ final class ApiController extends Controller
             $childCollection->setVirtualPath('/'. \ltrim($virtual, '/'));
 
             // We assume that the new path is real path of the first found parent directory + the new virtual path
-            $childCollection->setPath($real . '/' . \ltrim($newVirtual, '/'));
+            $childCollection->setPath(\rtrim($real, '/') . '/' . \ltrim($newVirtual, '/'));
 
             $this->createModel($account, $childCollection, CollectionMapper::class, 'collection', '127.0.0.1');
             $this->createModelRelation(
diff --git a/Models/MediaMapper.php b/Models/MediaMapper.php
index 14ca5b8..3b231ab 100755
--- a/Models/MediaMapper.php
+++ b/Models/MediaMapper.php
@@ -190,8 +190,12 @@ class MediaMapper extends DataMapperFactory
      */
     public static function getParentCollection(string $path = '/') : ReadMapper
     {
-        $virtualPath = '/' . \trim(\substr($path, 0, \strripos($path, '/') + 1), '/');
-        $name        = \substr($path, \strripos($path, '/') + 1);
+        $path = \dirname($path);
+        $name = \basename($path);
+        $virtualPath = '/' . \trim(\dirname($path), '/');
+
+        //$virtualPath = '/' . \trim(\substr($path, 0, \strripos($path, '/') + 1), '/');
+        //$name        = \substr($path, \strripos($path, '/') + 1);
 
         return CollectionMapper::get()
             ->with('sources')
diff --git a/Theme/Backend/Components/Media/invalidPassword.tpl.php b/Theme/Backend/Components/Media/invalidPassword.tpl.php
index 79f826d..6ed0807 100755
--- a/Theme/Backend/Components/Media/invalidPassword.tpl.php
+++ b/Theme/Backend/Components/Media/invalidPassword.tpl.php
@@ -18,7 +18,7 @@ use phpOMS\Uri\UriFactory;
 
 <section id="mediaFile" class="portlet">
     <div class="portlet-body">
-        <form id="mediaPassword" method="GET" action="<?= UriFactory::build('{%}'); ?>">
+        <form id="mediaPassword" method="GET" action="<?= UriFactory::build('{%}&csrf={$CSRF}'); ?>">
             <div class="form-group">
                 <label for="iPassword"><?= $this->getHtml('Password'); ?></label>
                 <input id="iPassword" type="password" name="password">
diff --git a/Theme/Backend/Components/Media/list.tpl.php b/Theme/Backend/Components/Media/list.tpl.php
index 4524682..7a3443d 100755
--- a/Theme/Backend/Components/Media/list.tpl.php
+++ b/Theme/Backend/Components/Media/list.tpl.php
@@ -58,8 +58,10 @@ $next = empty($this->media)
         <?php endif; ?>
     </table>
     </div>
+    <!--
     <div class="portlet-foot">
         <a tabindex="0" class="button" href="<?= UriFactory::build($previous); ?>"><?= $this->getHtml('Previous', '0', '0'); ?></a>
         <a tabindex="0" class="button" href="<?= UriFactory::build($next); ?>"><?= $this->getHtml('Next', '0', '0'); ?></a>
     </div>
+    -->
 </div>
\ No newline at end of file
diff --git a/Theme/Backend/Components/Upload/upload-list.tpl.php b/Theme/Backend/Components/Upload/upload-list.tpl.php
index cc6572b..1f850e9 100755
--- a/Theme/Backend/Components/Upload/upload-list.tpl.php
+++ b/Theme/Backend/Components/Upload/upload-list.tpl.php
@@ -99,7 +99,7 @@ use phpOMS\Uri\UriFactory;
                                         <input id="iFile-<?= $file->id; ?>" type="radio" name="media_file" value="<?= $file->id; ?>"<?= \end($this->files)->id === $file->id ? ' checked' : ''; ?>>
                                         <span class="checkmark"></span>
                                     </label>
-                                <td data-tpl-text="/id" data-tpl-value="/id" data-value=""><?= $this->printHtml((string) $file->id); ?></td>
+                                <td data-tpl-text="/id" data-tpl-value="/id" data-value=""><?= $file->id; ?></td>
                                 <td data-tpl-text="/name" data-tpl-value="/name" data-value=""><?= $this->printHtml($file->name); ?></td>
                                 <td><a href="<?= $url; ?>"><i class="g-icon">attachment</i></a>
                         <?php endforeach; ?>
diff --git a/Theme/Backend/media-collection-create.tpl.php b/Theme/Backend/media-collection-create.tpl.php
index de72501..3b75393 100755
--- a/Theme/Backend/media-collection-create.tpl.php
+++ b/Theme/Backend/media-collection-create.tpl.php
@@ -22,14 +22,14 @@ use phpOMS\Uri\UriFactory;
 <div class="row">
     <div class="col-xs-12">
         <div class="box">
-            <a tabindex="0" class="button" href="<?= UriFactory::build('{/base}/media/list?path={?path}'); ?>"><?= $this->getHtml('Back', '0', '0'); ?></a>
+            <a tabindex="0" class="button" href="<?= UriFactory::build('{/base}/media/list?path={?path}&csrf={$CSRF}'); ?>"><?= $this->getHtml('Back', '0', '0'); ?></a>
         </div>
     </div>
 </div>
 
 <div class="row">
     <div class="col-xs-12 col-md-6">
-        <form method="PUT" id="media-uploader" action="<?= UriFactory::build('{/api}media/collection'); ?>">
+        <form method="PUT" id="media-uploader" action="<?= UriFactory::build('{/api}media/collection?csrf={$CSRF}'); ?>">
             <div class="portlet">
                 <div class="portlet-head"><?= $this->getHtml('CreateCollection'); ?></div>
                 <div class="portlet-body">
diff --git a/Theme/Backend/media-file-create.tpl.php b/Theme/Backend/media-file-create.tpl.php
index bde3e11..7ef4bb3 100755
--- a/Theme/Backend/media-file-create.tpl.php
+++ b/Theme/Backend/media-file-create.tpl.php
@@ -75,7 +75,7 @@ use phpOMS\Uri\UriFactory;
                                     <option>
                                 </select>
                         <tr><td colspan="2"><label><?= $this->getHtml('GroupUser'); ?></label>
-                        <tr><td><input id="iPermission" name="group" type="text" placeholder=""><td><button><?= $this->getHtml('Add'); ?></button>
+                        <tr><td><input id="iPermission" name="group" type="text"><td><button><?= $this->getHtml('Add'); ?></button>
                     </table>
                 </form>
             </div>
diff --git a/Theme/Backend/media-upload.tpl.php b/Theme/Backend/media-upload.tpl.php
index 1977cb3..3412b6b 100755
--- a/Theme/Backend/media-upload.tpl.php
+++ b/Theme/Backend/media-upload.tpl.php
@@ -29,7 +29,7 @@ use phpOMS\Uri\UriFactory;
 
 <div class="row">
     <div class="col-xs-12 col-md-6">
-        <form method="PUT" id="media-uploader" action="<?= UriFactory::build('{/api}media'); ?>">
+        <form method="PUT" id="media-uploader" action="<?= UriFactory::build('{/api}media?csrf={$CSRF}'); ?>">
             <div class="portlet">
                 <div class="portlet-head"><?= $this->getHtml('Upload'); ?></div>
                 <div class="portlet-body">