Index: wiki/src/main/resources/XWiki/AllAttachmentsResults.xml
===================================================================
--- wiki/src/main/resources/XWiki/AllAttachmentsResults.xml	(revision 23911)
+++ wiki/src/main/resources/XWiki/AllAttachmentsResults.xml	(working copy)
@@ -27,9 +27,7 @@
 ## ============================================================================================
 ## This page is called from live grids via Ajax with the argument xpage=plain. It returns a
 ## set of results serialized in JSON.
-## @programming This service page needs to be saved by a user with the programming access level
-## to work as expected
-## ============================================================================================
+## ==================================================================================
 #if ($request.get("xpage") && $request.get("xpage") == "plain")
 #set( $offset = $util.parseInt( $request.get( "offset" ) ) )
 ## offset starts from 0 in velocity and 1 in javascript
@@ -40,38 +38,48 @@
 #set($space = $request.get("doc.space"))
 #set($filename = $request.filename)
 #set($formatDate = "yyyy MMMM dd, HH:mm")
+#set($sqlProps = [])
 #if($title)
   #set($title = $title.trim().toLowerCase())
-  #set($sql = "and lower(doc.fullName) like '%${title}%' ")
-#else #set($sql = "and lower(doc.fullName) <> '' ") #end
+  #set($sql = "lower(doc.fullName) like ? ")
+  #set($devNull = $sqlProps.add("%${title}%"))
+#else #set($sql = "lower(doc.fullName) <> '' ") #end
 #if($author)
   #set($author = $author.trim().toLowerCase())
-  #set($sql = $sql + "and lower(attach.author) like '%${author}%' ")
+  #set($sql = $sql + "and lower(attach.author) like ? ")
+  #set($devNull = $sqlProps.add("%${author}%"))
 #end
 #if($filename)
   #set($filename = $filename.trim().toLowerCase())
-  #set($sql = $sql + "and lower(attach.filename) like '%${filename}%' ")
+  #set($sql = $sql + "and lower(attach.filename) like ? ")
+  #set($devNull = $sqlProps.add("%${filename}%"))
 #end
 #if($space)
   #set($space = $space.trim().toLowerCase())
-  #set($sql = $sql + "and lower(doc.space) like '%${space}%' ")
+  #set($sql = $sql + "and lower(doc.space) like ? ")
+  #set($devNull = $sqlProps.add("%${space}%"))
 #end
 ## 
 ## Exclude Blacklisted spaces ($blacklistedSpaces is set in xwikivars.vm)
 ##
 #foreach ($blacklistedSpace in $blacklistedSpaces)
-  #set ($sql = "${sql} and doc.space <> '$blacklistedSpace'")
+  #set ($sql = "${sql} and doc.space <> ? ")
+  #set($devNull = $sqlProps.add($blacklistedSpace))
 #end
-#if("$!request.sort" != "") #set($order = $request.sort) #else #set($order="attach.filename") #end
-#if($order == "filename") #set($order = "attach.filename") #end
-#if("$!request.dir" != "") #set($dir = $request.dir) #else #set($dir = "asc") #end
-#set($sql = "select doc.fullName, attach from XWikiDocument as doc, XWikiAttachment as attach where attach.docId=doc.id " + $sql + " order by $order $dir")
-#set($items = $xwiki.search($sql, $limit, $off))
-#set($totalItems = $xwiki.search($sql).size())
+#if("$!request.sort" != "" && "$!request.sort" != "filename")
+  #set($order = $request.sort) 
+#else
+  #set($order="attach.filename")
+#end
+#if($!request.dir.toLowerCase() != "desc") #set($dir = "asc") #else #set($dir = "desc") #end
+#set($totalItems = $xwiki.countAttachments($sql, $sqlProps))
+#set($sql = $sql + " order by $order $dir")
+#set($items = $xwiki.searchAttachments($sql, $limit, $off, $sqlProps))
 #set($returnedItems = $items.size())
 ## ==============================================
 ## json starts
 ## ==============================================
+#set($i = 1)
 {
 "totalrows": $totalItems,
 "returnedrows": #if($returnedItems < $limit) $returnedItems #else $limit #end,
@@ -79,16 +87,11 @@
 "reqNo": $request.reqNo,
 "rows": [
 #foreach($item in $items)
-  #foreach($element in $item)
-    #if($velocityCount==1) 
-      #set($docName=$element) 
-      #set($acclev = $xwiki.hasAccessLevel("view", $context.user, $docName)) 
-    #else 
-      #set($attachment=$element) 
-    #end
-  #end
-  #set($document = $xwiki.getDocument($docName))  
-  #if($velocityCount > 1) , #end
+  #set($document = $item.getDocument())
+  #set($docName = $document.getFullName())
+  #set($acclev = $xwiki.hasAccessLevel("view", $context.user, $docName)) 
+  #set($attachment=$item) 
+##
   {"acclev"    : $acclev,     
      "page"  : "$document.name",
      "space" : "$document.space",
@@ -101,9 +104,11 @@
      "author" : "$attachment.author",
      "authorname" : "$xwiki.getDocument($attachment.author).name",
      "authorurl" : "$xwiki.getURL($attachment.author,'view')",
-     "type" : "$attachment.getMimeType($context.context)"
+     "type" : "$attachment.getMimeType()"
    #end ## acclev
-   }  
+   }
+   #if($i < $returnedItems) , #end
+   #set($i = $mathtool.add($i,1))
 #end
 ]}
 ## ==============================================
@@ -111,4 +116,4 @@
 ## ==============================================
 #end
 {{/velocity}}</content>
-</xwikidoc>
\ No newline at end of file
+</xwikidoc>