diff --git a/app/assets/javascripts/app/controllers/package.js.coffee b/app/assets/javascripts/app/controllers/package.js.coffee
new file mode 100644
index 000000000..e944e4dce
--- /dev/null
+++ b/app/assets/javascripts/app/controllers/package.js.coffee
@@ -0,0 +1,28 @@
+class Index extends App.Controller
+
+  constructor: ->
+    super
+
+    # check authentication
+    return if !@authenticate()
+
+    App.Com.ajax(
+      id:    'packages',
+      type:  'GET',
+      url:   '/api/packages',
+      processData: true,
+      success: (data) =>
+        @render(data)
+      )
+
+
+  render: (data) ->
+
+    @html App.view('package')(
+      head:     'Dashboard'
+      packages: data.packages
+    )
+
+
+App.Config.set( 'package', Index, 'Routes' )
+App.Config.set( 'Packages', { prio: 1800, parent: '#settings', name: 'Packages', target: '#package', role: ['Admin'] }, 'NavBar' )
diff --git a/app/assets/javascripts/app/controllers/settings.js.coffee b/app/assets/javascripts/app/controllers/settings.js.coffee
index 8bdb40518..b82c67739 100644
--- a/app/assets/javascripts/app/controllers/settings.js.coffee
+++ b/app/assets/javascripts/app/controllers/settings.js.coffee
@@ -62,4 +62,3 @@ App.Config.set( 'System', { prio: 1400, parent: '#settings', name: 'System', tar
 App.Config.set( 'Security', { prio: 1500, parent: '#settings', name: 'Security', target: '#settings/security', role: ['Admin'] }, 'NavBar' )
 App.Config.set( 'Ticket', { prio: 1600, parent: '#settings', name: 'Ticket', target: '#settings/ticket', role: ['Admin'] }, 'NavBar' )
 App.Config.set( 'Object', { prio: 1700, parent: '#settings', name: 'Objects', target: '#settings/objects', role: ['Admin'] }, 'NavBar' )
-App.Config.set( 'Packages', { prio: 1800, parent: '#settings', name: 'Packages', target: '#packages', role: ['Admin'] }, 'NavBar' )
diff --git a/app/assets/javascripts/app/views/package.jst.eco b/app/assets/javascripts/app/views/package.jst.eco
new file mode 100644
index 000000000..2f5c4d2d4
--- /dev/null
+++ b/app/assets/javascripts/app/views/package.jst.eco
@@ -0,0 +1,33 @@
+<div class="page-header">
+  <h1><%- @T( 'Package' ) %> <small><%- @T( 'Management' ) %></small></h1>
+</div>
+
+<div class="row">
+  <div class="span3">
+    <ul class="nav nav-tabs nav-stacked">
+      <li class=""><a data-type="" ><%- @T( 'Installed' ) %></a></li>
+      <li class=""><a data-type="" ><%- @T( 'Upload' ) %></a></li>
+    </ul>
+
+  </div>
+
+  <div class="span9">
+    <table class="table table-striped table-hover">
+      <thead>
+        <th><%- @T('Name') %></th>
+        <th><%- @T('Version') %></th>
+        <th><%- @T('Vendor') %></th>
+        <th><%- @T('Action') %></th>
+      </thead>
+      <tbody>
+      <% for item in @packages: %>
+        <tr><%= item.name %></tr>
+        <tr><%= item.version %></tr>
+        <tr><a href="<%- item.url %>" target="_blank"><%= item.vendor %></a></tr>
+        <tr>-</tr>
+      <% end %>
+      </tbody>
+    </table>
+  </div>
+
+</div>
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 26c6faddc..72451e8cd 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -167,6 +167,12 @@ class ApplicationController < ActionController::Base
     return false
   end
 
+  def is_not_role( role_name )
+    return false if is_role( role_name )
+    response_access_deny()
+    return true
+  end
+
   def response_access_deny
     render(
       :json => {},
diff --git a/app/controllers/channels_controller.rb b/app/controllers/channels_controller.rb
index 8d6f4a083..a11c2b103 100644
--- a/app/controllers/channels_controller.rb
+++ b/app/controllers/channels_controller.rb
@@ -149,6 +149,7 @@ curl http://localhost/api/channels.json -v -u #{login}:#{password} -H "Content-T
 =end
 
   def create
+    return if is_not_role('Admin')
     model_create_render(Channel, params)
   end
 
@@ -185,6 +186,7 @@ curl http://localhost/api/channels.json -v -u #{login}:#{password} -H "Content-T
 =end
 
   def update
+    return if is_not_role('Admin')
     model_update_render(Channel, params)
   end
 
@@ -202,6 +204,7 @@ curl http://localhost/api/channels.json -v -u #{login}:#{password} -H "Content-T
 =end
 
   def destroy
+    return if is_not_role('Admin')
     model_destory_render(Channel, params)
   end
 end
diff --git a/app/controllers/email_addresses_controller.rb b/app/controllers/email_addresses_controller.rb
index fb8545bfa..4acc40b70 100644
--- a/app/controllers/email_addresses_controller.rb
+++ b/app/controllers/email_addresses_controller.rb
@@ -95,6 +95,7 @@ curl http://localhost/api/email_addresses.json -v -u #{login}:#{password} -H "Co
 =end
 
   def create
+    return if is_not_role('Admin')
     model_create_render(EmailAddress, params)
   end
 
@@ -125,6 +126,7 @@ curl http://localhost/api/email_addresses.json -v -u #{login}:#{password} -H "Co
 =end
 
   def update
+    return if is_not_role('Admin')
     model_update_render(EmailAddress, params)
   end
 
@@ -139,6 +141,7 @@ Test:
 =end
 
   def destroy
+    return if is_not_role('Admin')
     model_destory_render(EmailAddress, params)
   end
 end
diff --git a/app/controllers/groups_controller.rb b/app/controllers/groups_controller.rb
index aecb67772..fed1656fb 100644
--- a/app/controllers/groups_controller.rb
+++ b/app/controllers/groups_controller.rb
@@ -99,6 +99,7 @@ curl http://localhost/api/groups.json -v -u #{login}:#{password} -H "Content-Typ
 =end
 
   def create
+    return if is_not_role('Admin')
     model_create_render(Group, params)
   end
 
@@ -130,6 +131,7 @@ curl http://localhost/api/groups.json -v -u #{login}:#{password} -H "Content-Typ
 =end
 
   def update
+    return if is_not_role('Admin')
     model_update_render(Group, params)
   end
 
@@ -144,6 +146,7 @@ Test:
 =end
 
   def destroy
+    return if is_not_role('Admin')
     model_destory_render(Group, params)
   end
 end
diff --git a/app/controllers/packages_controller.rb b/app/controllers/packages_controller.rb
new file mode 100644
index 000000000..176627bbe
--- /dev/null
+++ b/app/controllers/packages_controller.rb
@@ -0,0 +1,42 @@
+class PackagesController < ApplicationController
+  before_filter :authentication_check
+
+  # GET /api/packages
+  def index
+    return if is_not_role('Admin')
+    packages = Package.all
+    render :json => {
+      :packages => packages
+    }
+  end
+
+  # POST /api/packages
+  def create
+    return if is_not_role('Admin')
+
+    content_type = request[:content_type]
+    puts 'content_type: ' + content_type.inspect
+    if !content_type || content_type == 'application/octet-stream'
+      if MIME::Types.type_for(params[:qqfile]).first
+        content_type = MIME::Types.type_for(params[:qqfile]).first.content_type
+      else
+        content_type = 'application/octet-stream'
+      end
+    end
+    headers_store = {
+      'Content-Type' => content_type
+    }
+    Store.add(
+      :object      => 'PackageUploadCache',
+      :o_id        => params[:form_id],
+      :data        => request.body.read,
+      :filename    => params[:qqfile],
+      :preferences => headers_store
+    )
+
+    # return result
+    render :json => {
+      :success  => true,
+    }
+  end
+end
\ No newline at end of file
diff --git a/app/controllers/postmaster_filters_controller.rb b/app/controllers/postmaster_filters_controller.rb
index 0be921dcd..fb5d966f9 100644
--- a/app/controllers/postmaster_filters_controller.rb
+++ b/app/controllers/postmaster_filters_controller.rb
@@ -117,6 +117,7 @@ curl http://localhost/api/postmaster_filters.json -v -u #{login}:#{password} -H
 =end
 
   def create
+    return if is_not_role('Admin')
     model_create_render(PostmasterFilter, params)
   end
 
@@ -159,6 +160,7 @@ curl http://localhost/api/postmaster_filters.json -v -u #{login}:#{password} -H
 =end
 
   def update
+    return if is_not_role('Admin')
     model_update_render(PostmasterFilter, params)
   end
 
@@ -173,6 +175,7 @@ Test:
 =end
 
   def destroy
+    return if is_not_role('Admin')
     model_destory_render(PostmasterFilter, params)
   end
 end
diff --git a/app/controllers/roles_controller.rb b/app/controllers/roles_controller.rb
index a0b94bec1..232f0d682 100644
--- a/app/controllers/roles_controller.rb
+++ b/app/controllers/roles_controller.rb
@@ -93,6 +93,7 @@ curl http://localhost/api/roles.json -v -u #{login}:#{password} -H "Content-Type
 =end
 
   def create
+    return if is_not_role('Admin')
     model_create_render(Role, params)
   end
 
@@ -121,6 +122,7 @@ curl http://localhost/api/roles.json -v -u #{login}:#{password} -H "Content-Type
 =end
 
   def update
+    return if is_not_role('Admin')
     model_update_render(Role, params)
   end
 
@@ -135,6 +137,7 @@ Test:
 =end
 
   def destroy
+    return if is_not_role('Admin')
     model_destory_render(Role, params)
   end
 end
diff --git a/app/controllers/settings_controller.rb b/app/controllers/settings_controller.rb
index 1a067d40f..6ad1e2f29 100644
--- a/app/controllers/settings_controller.rb
+++ b/app/controllers/settings_controller.rb
@@ -13,16 +13,19 @@ class SettingsController < ApplicationController
 
   # POST /settings
   def create
+    return if is_not_role('Admin')
     model_create_render(Setting, params)
   end
 
   # PUT /settings/1
   def update
+    return if is_not_role('Admin')
     model_update_render(Setting, params)
   end
 
   # DELETE /settings/1
   def destroy
+    return if is_not_role('Admin')
     model_destory_render(Setting, params)
   end
 end
diff --git a/app/controllers/signatures_controller.rb b/app/controllers/signatures_controller.rb
index 8f7b5331f..72fad0b15 100644
--- a/app/controllers/signatures_controller.rb
+++ b/app/controllers/signatures_controller.rb
@@ -94,6 +94,7 @@ curl http://localhost/api/signatures.json -v -u #{login}:#{password} -H "Content
 =end
 
   def create
+    return if is_not_role('Admin')
     model_create_render(Signature, params)
   end
 
@@ -122,6 +123,7 @@ curl http://localhost/api/signatures.json -v -u #{login}:#{password} -H "Content
 =end
 
   def update
+    return if is_not_role('Admin')
     model_update_render(Signature, params)
   end
 
@@ -136,6 +138,7 @@ Test:
 =end
 
   def destroy
+    return if is_not_role('Admin')
     model_destory_render(Signature, params)
   end
 end
diff --git a/app/controllers/ticket_overviews_controller.rb b/app/controllers/ticket_overviews_controller.rb
index adf68def5..08ce63d8b 100644
--- a/app/controllers/ticket_overviews_controller.rb
+++ b/app/controllers/ticket_overviews_controller.rb
@@ -1,7 +1,7 @@
 class TicketOverviewsController < ApplicationController
   before_filter :authentication_check
 
-  # GET /tickets
+  # GET /api/tickets
   def show
 #sleep 2
 
diff --git a/app/controllers/ticket_priorities_controller.rb b/app/controllers/ticket_priorities_controller.rb
index 012ea24b6..2abf84327 100644
--- a/app/controllers/ticket_priorities_controller.rb
+++ b/app/controllers/ticket_priorities_controller.rb
@@ -13,16 +13,19 @@ class TicketPrioritiesController < ApplicationController
 
   # POST /ticket_priorities
   def create
+    return if is_not_role('Admin')
     model_create_render(Ticket::Priority, params)
   end
 
   # PUT /ticket_priorities/1
   def update
+    return if is_not_role('Admin')
     model_update_render(Ticket::Priority, params)
   end
 
   # DELETE /ticket_priorities/1
   def destroy
+    return if is_not_role('Admin')
     model_destory_render(Ticket::Priority, params)
   end
 end
diff --git a/app/controllers/ticket_states_controller.rb b/app/controllers/ticket_states_controller.rb
index 2af15a633..e3d968811 100644
--- a/app/controllers/ticket_states_controller.rb
+++ b/app/controllers/ticket_states_controller.rb
@@ -13,16 +13,19 @@ class TicketStatesController < ApplicationController
 
   # POST /ticket_states
   def create
+    return if is_not_role('Admin')
     model_create_render(Ticket::State, params)
   end
 
   # PUT /ticket_states/1
   def update
+    return if is_not_role('Admin')
     model_update_render(Ticket::State, params)
   end
 
   # DELETE /ticket_states/1
   def destroy
+    return if is_not_role('Admin')
     model_destory_render(Ticket::State, params)
   end
 end
diff --git a/app/models/application_model.rb b/app/models/application_model.rb
index 4fdcd4359..235f22f3a 100644
--- a/app/models/application_model.rb
+++ b/app/models/application_model.rb
@@ -39,4 +39,15 @@ class ApplicationModel < ActiveRecord::Base
     key = self.to_s + '::' + data_id.to_s
     Cache.get( key.to_s )
   end
+
+  def self.create_if_not_exists(data)
+    if data[:name]
+      record = self.where( :name => data[:name] ).first
+      return record if record
+    elsif data[:locale] && data[:source]
+      record = self.where( :locale => data[:locale], :source => data[:source] ).first
+      return record if record
+    end
+    self.create(data)
+  end
 end
diff --git a/config/routes/package.rb b/config/routes/package.rb
new file mode 100644
index 000000000..03f1343fd
--- /dev/null
+++ b/config/routes/package.rb
@@ -0,0 +1,10 @@
+module ExtraRoutes
+  def add(map)
+
+    # overviews
+    map.match '/api/packages',                        :to => 'packages#index',   :via => :get
+    map.match '/api/packages',                        :to => 'packages#create',  :via => :post
+
+  end
+  module_function :add
+end
\ No newline at end of file