diff --git a/code/rest/alien_controller.go b/code/rest/alien_controller.go
index 81671ee..a2a22c3 100644
--- a/code/rest/alien_controller.go
+++ b/code/rest/alien_controller.go
@@ -236,7 +236,7 @@ func (this *AlienController) Upload(writer http.ResponseWriter, request *http.Re
 		panic(result.BadRequest("file size doesn't the one in uploadToken"))
 	}
 
-	dirMatter := this.matterDao.CheckWithRootByUuid(uploadToken.FolderUuid, user, space)
+	dirMatter := this.matterDao.CheckWithRootByUuid(uploadToken.FolderUuid, space)
 
 	matter := this.matterService.Upload(request, file, user, space, dirMatter, uploadToken.Filename, uploadToken.Privacy)
 
@@ -273,7 +273,7 @@ func (this *AlienController) CrawlToken(writer http.ResponseWriter, request *htt
 	user := this.userDao.CheckByUuid(uploadToken.UserUuid)
 	space := this.spaceDao.CheckByUuid(user.SpaceUuid)
 
-	dirMatter := this.matterDao.CheckWithRootByUuid(uploadToken.FolderUuid, user, space)
+	dirMatter := this.matterDao.CheckWithRootByUuid(uploadToken.FolderUuid, space)
 
 	matter := this.matterService.AtomicCrawl(request, url, uploadToken.Filename, user, space, dirMatter, uploadToken.Privacy)
 
diff --git a/code/rest/base_controller.go b/code/rest/base_controller.go
index fcbd54d..790ca26 100644
--- a/code/rest/base_controller.go
+++ b/code/rest/base_controller.go
@@ -13,9 +13,10 @@ import (
 
 type BaseController struct {
 	BaseBean
-	userDao    *UserDao
-	spaceDao   *SpaceDao
-	sessionDao *SessionDao
+	userDao      *UserDao
+	spaceDao     *SpaceDao
+	spaceService *SpaceService
+	sessionDao   *SessionDao
 }
 
 func (this *BaseController) Init() {
@@ -27,6 +28,16 @@ func (this *BaseController) Init() {
 		this.userDao = b
 	}
 
+	b = core.CONTEXT.GetBean(this.spaceDao)
+	if b, ok := b.(*SpaceDao); ok {
+		this.spaceDao = b
+	}
+
+	b = core.CONTEXT.GetBean(this.spaceService)
+	if b, ok := b.(*SpaceService); ok {
+		this.spaceService = b
+	}
+
 	b = core.CONTEXT.GetBean(this.sessionDao)
 	if b, ok := b.(*SessionDao); ok {
 		this.sessionDao = b
diff --git a/code/rest/dav_service.go b/code/rest/dav_service.go
index 5ed6936..3db51bb 100644
--- a/code/rest/dav_service.go
+++ b/code/rest/dav_service.go
@@ -413,7 +413,7 @@ func (this *DavService) HandleMkcol(writer http.ResponseWriter, request *http.Re
 		panic(result.CustomWebResult(result.METHOD_NOT_ALLOWED, fmt.Sprintf("%s file already exists", dirPath)))
 	}
 
-	this.matterService.AtomicCreateDirectory(request, dirMatter, thisDirName, user)
+	this.matterService.AtomicCreateDirectory(request, dirMatter, thisDirName, user, space)
 
 }
 
diff --git a/code/rest/matter_controller.go b/code/rest/matter_controller.go
index 97bc172..b4e7dab 100644
--- a/code/rest/matter_controller.go
+++ b/code/rest/matter_controller.go
@@ -5,8 +5,8 @@ import (
 	"github.com/eyebluecn/tank/code/tool/builder"
 	"github.com/eyebluecn/tank/code/tool/i18n"
 	"github.com/eyebluecn/tank/code/tool/result"
+	"github.com/eyebluecn/tank/code/tool/util"
 	"net/http"
-	"strconv"
 	"strings"
 )
 
@@ -76,6 +76,8 @@ func (this *MatterController) Init() {
 func (this *MatterController) RegisterRoutes() map[string]func(writer http.ResponseWriter, request *http.Request) {
 
 	routeMap := make(map[string]func(writer http.ResponseWriter, request *http.Request))
+	routeMap["/api/matter/detail"] = this.Wrap(this.Detail, USER_ROLE_USER)
+	routeMap["/api/matter/page"] = this.Wrap(this.Page, USER_ROLE_GUEST)
 
 	routeMap["/api/matter/create/directory"] = this.Wrap(this.CreateDirectory, USER_ROLE_USER)
 	routeMap["/api/matter/upload"] = this.Wrap(this.Upload, USER_ROLE_USER)
@@ -90,8 +92,6 @@ func (this *MatterController) RegisterRoutes() map[string]func(writer http.Respo
 	routeMap["/api/matter/rename"] = this.Wrap(this.Rename, USER_ROLE_USER)
 	routeMap["/api/matter/change/privacy"] = this.Wrap(this.ChangePrivacy, USER_ROLE_USER)
 	routeMap["/api/matter/move"] = this.Wrap(this.Move, USER_ROLE_USER)
-	routeMap["/api/matter/detail"] = this.Wrap(this.Detail, USER_ROLE_USER)
-	routeMap["/api/matter/page"] = this.Wrap(this.Page, USER_ROLE_GUEST)
 
 	//mirror local files.
 	routeMap["/api/matter/mirror"] = this.Wrap(this.Mirror, USER_ROLE_USER)
@@ -102,15 +102,14 @@ func (this *MatterController) RegisterRoutes() map[string]func(writer http.Respo
 
 func (this *MatterController) Detail(writer http.ResponseWriter, request *http.Request) *result.WebResult {
 
-	uuid := request.FormValue("uuid")
-	if uuid == "" {
-		panic(result.BadRequest("uuid cannot be null"))
-	}
+	uuid := util.ExtractRequestString(request, "uuid")
+	user := this.checkUser(request)
+	spaceUuid := util.ExtractRequestOptionalString(request, "spaceUuid", user.SpaceUuid)
+	space := this.spaceService.CheckWritableByUuid(request, user, spaceUuid)
 
 	matter := this.matterService.Detail(request, uuid)
 
-	user := this.checkUser(request)
-	if matter.UserUuid != user.Uuid {
+	if matter.SpaceUuid != space.Uuid {
 		panic(result.UNAUTHORIZED)
 	}
 
@@ -120,29 +119,32 @@ func (this *MatterController) Detail(writer http.ResponseWriter, request *http.R
 
 func (this *MatterController) Page(writer http.ResponseWriter, request *http.Request) *result.WebResult {
 
-	pageStr := request.FormValue("page")
-	pageSizeStr := request.FormValue("pageSize")
-	orderCreateTime := request.FormValue("orderCreateTime")
-	orderUpdateTime := request.FormValue("orderUpdateTime")
-	orderDeleteTime := request.FormValue("orderDeleteTime")
-	orderSort := request.FormValue("orderSort")
-	orderTimes := request.FormValue("orderTimes")
+	page := util.ExtractRequestOptionalInt(request, "page", 0)
+	pageSize := util.ExtractRequestOptionalInt(request, "pageSize", 200)
+	orderCreateTime := util.ExtractRequestOptionalString(request, "orderCreateTime", "")
+	orderUpdateTime := util.ExtractRequestOptionalString(request, "orderUpdateTime", "")
+	orderDeleteTime := util.ExtractRequestOptionalString(request, "orderDeleteTime", "")
+	orderSort := util.ExtractRequestOptionalString(request, "orderSort", "")
+	orderTimes := util.ExtractRequestOptionalString(request, "orderTimes", "")
+	puuid := util.ExtractRequestOptionalString(request, "puuid", "")
+	name := util.ExtractRequestOptionalString(request, "name", "")
+	dir := util.ExtractRequestOptionalString(request, "dir", "")
+	deleted := util.ExtractRequestOptionalString(request, "deleted", "")
+	orderDir := util.ExtractRequestOptionalString(request, "orderDir", "")
+	orderSize := util.ExtractRequestOptionalString(request, "orderSize", "")
+	orderName := util.ExtractRequestOptionalString(request, "orderName", "")
+	extensionsStr := util.ExtractRequestOptionalString(request, "extensions", "")
+	//auth by shareUuid.
+	shareUuid := util.ExtractRequestOptionalString(request, "shareUuid", "")
+	shareCode := util.ExtractRequestOptionalString(request, "shareCode", "")
+	shareRootUuid := util.ExtractRequestOptionalString(request, "shareRootUuid", "")
 
-	puuid := request.FormValue("puuid")
-	name := request.FormValue("name")
-	dir := request.FormValue("dir")
-	deleted := request.FormValue("deleted")
-	orderDir := request.FormValue("orderDir")
-	orderSize := request.FormValue("orderSize")
-	orderName := request.FormValue("orderName")
-	extensionsStr := request.FormValue("extensions")
+	user := this.checkUser(request)
+	spaceUuid := util.ExtractRequestOptionalString(request, "spaceUuid", user.SpaceUuid)
+	space := this.spaceService.CheckReadableByUuid(request, user, spaceUuid)
 
 	var userUuid string
 
-	//auth by shareUuid.
-	shareUuid := request.FormValue("shareUuid")
-	shareCode := request.FormValue("shareCode")
-	shareRootUuid := request.FormValue("shareRootUuid")
 	if shareUuid != "" {
 
 		if puuid == "" {
@@ -166,19 +168,6 @@ func (this *MatterController) Page(writer http.ResponseWriter, request *http.Req
 
 	}
 
-	var page int
-	if pageStr != "" {
-		page, _ = strconv.Atoi(pageStr)
-	}
-
-	pageSize := 200
-	if pageSizeStr != "" {
-		tmp, err := strconv.Atoi(pageSizeStr)
-		if err == nil {
-			pageSize = tmp
-		}
-	}
-
 	var extensions []string
 	if extensionsStr != "" {
 		extensions = strings.Split(extensionsStr, ",")
@@ -219,29 +208,33 @@ func (this *MatterController) Page(writer http.ResponseWriter, request *http.Req
 		},
 	}
 
-	pager := this.matterDao.Page(page, pageSize, puuid, userUuid, name, dir, deleted, extensions, sortArray)
+	pager := this.matterDao.Page(page, pageSize, puuid, userUuid, space.Uuid, name, dir, deleted, extensions, sortArray)
 
 	return this.Success(pager)
 }
 
 func (this *MatterController) CreateDirectory(writer http.ResponseWriter, request *http.Request) *result.WebResult {
 
-	puuid := request.FormValue("puuid")
-	name := request.FormValue("name")
-
+	puuid := util.ExtractRequestString(request, "puuid")
+	name := util.ExtractRequestString(request, "name")
 	user := this.checkUser(request)
-	space := this.spaceDao.CheckByUuid(user.SpaceUuid)
+	spaceUuid := util.ExtractRequestOptionalString(request, "spaceUuid", user.SpaceUuid)
+	space := this.spaceService.CheckWritableByUuid(request, user, spaceUuid)
 
-	var dirMatter = this.matterDao.CheckWithRootByUuid(puuid, user, space)
+	var dirMatter = this.matterDao.CheckWithRootByUuid(puuid, space)
 
-	matter := this.matterService.AtomicCreateDirectory(request, dirMatter, name, user)
+	matter := this.matterService.AtomicCreateDirectory(request, dirMatter, name, user, space)
 	return this.Success(matter)
 }
 
 func (this *MatterController) Upload(writer http.ResponseWriter, request *http.Request) *result.WebResult {
+	puuid := util.ExtractRequestString(request, "puuid")
+	privacy := util.ExtractRequestOptionalBool(request, "privacy", true)
+
+	user := this.checkUser(request)
+	spaceUuid := util.ExtractRequestOptionalString(request, "spaceUuid", user.SpaceUuid)
+	space := this.spaceService.CheckWritableByUuid(request, user, spaceUuid)
 
-	puuid := request.FormValue("puuid")
-	privacyStr := request.FormValue("privacy")
 	file, handler, err := request.FormFile("file")
 	this.PanicError(err)
 	defer func() {
@@ -249,15 +242,10 @@ func (this *MatterController) Upload(writer http.ResponseWriter, request *http.R
 		this.PanicError(err)
 	}()
 
-	user := this.checkUser(request)
-	space := this.spaceDao.CheckByUuid(user.SpaceUuid)
-
-	privacy := privacyStr == TRUE
-
 	err = request.ParseMultipartForm(32 << 20)
 	this.PanicError(err)
 
-	//for IE browser. filename may contains filepath.
+	//for IE browser. filename may contain filepath.
 	fileName := handler.Filename
 	pos := strings.LastIndex(fileName, "\\")
 	if pos != -1 {
@@ -268,7 +256,7 @@ func (this *MatterController) Upload(writer http.ResponseWriter, request *http.R
 		fileName = fileName[pos+1:]
 	}
 
-	dirMatter := this.matterDao.CheckWithRootByUuid(puuid, user, space)
+	dirMatter := this.matterDao.CheckWithRootByUuid(puuid, space)
 
 	//support upload simultaneously
 	matter := this.matterService.Upload(request, file, user, space, dirMatter, fileName, privacy)
@@ -279,22 +267,20 @@ func (this *MatterController) Upload(writer http.ResponseWriter, request *http.R
 // crawl a file by url.
 func (this *MatterController) Crawl(writer http.ResponseWriter, request *http.Request) *result.WebResult {
 
-	url := request.FormValue("url")
-	destPath := request.FormValue("destPath")
-	filename := request.FormValue("filename")
+	url := util.ExtractRequestString(request, "url")
+	destPath := util.ExtractRequestString(request, "destPath")
+	filename := util.ExtractRequestString(request, "filename")
 
 	user := this.checkUser(request)
-	space := this.spaceDao.CheckByUuid(user.SpaceUuid)
+	spaceUuid := util.ExtractRequestOptionalString(request, "spaceUuid", user.SpaceUuid)
+	space := this.spaceService.CheckWritableByUuid(request, user, spaceUuid)
+
 	dirMatter := this.matterService.CreateDirectories(request, user, space, destPath)
 
 	if url == "" || (!strings.HasPrefix(url, "http://") && !strings.HasPrefix(url, "https://")) {
 		panic(" url must start with  http:// or https://")
 	}
 
-	if filename == "" {
-		panic("filename cannot be null")
-	}
-
 	matter := this.matterService.AtomicCrawl(request, url, filename, user, space, dirMatter, true)
 
 	return this.Success(matter)
@@ -303,16 +289,14 @@ func (this *MatterController) Crawl(writer http.ResponseWriter, request *http.Re
 // soft delete.
 func (this *MatterController) SoftDelete(writer http.ResponseWriter, request *http.Request) *result.WebResult {
 
-	uuid := request.FormValue("uuid")
-	if uuid == "" {
-		panic(result.BadRequest("uuid cannot be null"))
-	}
-
-	matter := this.matterDao.CheckByUuid(uuid)
+	uuid := util.ExtractRequestString(request, "uuid")
 
 	user := this.checkUser(request)
-	space := this.spaceDao.CheckByUuid(user.SpaceUuid)
-	if matter.UserUuid != user.Uuid {
+	spaceUuid := util.ExtractRequestOptionalString(request, "spaceUuid", user.SpaceUuid)
+	space := this.spaceService.CheckWritableByUuid(request, user, spaceUuid)
+
+	matter := this.matterDao.CheckByUuid(uuid)
+	if matter.SpaceUuid != space.Uuid {
 		panic(result.UNAUTHORIZED)
 	}
 
@@ -323,12 +307,11 @@ func (this *MatterController) SoftDelete(writer http.ResponseWriter, request *ht
 
 func (this *MatterController) SoftDeleteBatch(writer http.ResponseWriter, request *http.Request) *result.WebResult {
 
-	uuids := request.FormValue("uuids")
-	if uuids == "" {
-		panic(result.BadRequest("uuids cannot be null"))
-	}
+	uuids := util.ExtractRequestString(request, "uuids")
+
 	user := this.checkUser(request)
-	space := this.spaceDao.CheckByUuid(user.SpaceUuid)
+	spaceUuid := util.ExtractRequestOptionalString(request, "spaceUuid", user.SpaceUuid)
+	space := this.spaceService.CheckWritableByUuid(request, user, spaceUuid)
 
 	uuidArray := strings.Split(uuids, ",")
 
@@ -359,15 +342,15 @@ func (this *MatterController) SoftDeleteBatch(writer http.ResponseWriter, reques
 // recovery delete.
 func (this *MatterController) Recovery(writer http.ResponseWriter, request *http.Request) *result.WebResult {
 
-	uuid := request.FormValue("uuid")
-	if uuid == "" {
-		panic(result.BadRequest("uuid cannot be null"))
-	}
+	uuid := util.ExtractRequestString(request, "uuid")
+
+	user := this.checkUser(request)
+	spaceUuid := util.ExtractRequestOptionalString(request, "spaceUuid", user.SpaceUuid)
+	space := this.spaceService.CheckWritableByUuid(request, user, spaceUuid)
 
 	matter := this.matterDao.CheckByUuid(uuid)
 
-	user := this.checkUser(request)
-	if matter.UserUuid != user.Uuid {
+	if matter.SpaceUuid != space.Uuid {
 		panic(result.UNAUTHORIZED)
 	}
 
@@ -378,11 +361,11 @@ func (this *MatterController) Recovery(writer http.ResponseWriter, request *http
 
 // recovery batch.
 func (this *MatterController) RecoveryBatch(writer http.ResponseWriter, request *http.Request) *result.WebResult {
+	uuids := util.ExtractRequestString(request, "uuids")
 
-	uuids := request.FormValue("uuids")
-	if uuids == "" {
-		panic(result.BadRequest("uuids cannot be null"))
-	}
+	user := this.checkUser(request)
+	spaceUuid := util.ExtractRequestOptionalString(request, "spaceUuid", user.SpaceUuid)
+	space := this.spaceService.CheckWritableByUuid(request, user, spaceUuid)
 
 	uuidArray := strings.Split(uuids, ",")
 
@@ -395,8 +378,7 @@ func (this *MatterController) RecoveryBatch(writer http.ResponseWriter, request
 			continue
 		}
 
-		user := this.checkUser(request)
-		if matter.UserUuid != user.Uuid {
+		if matter.SpaceUuid != space.Uuid {
 			panic(result.UNAUTHORIZED)
 		}
 
@@ -410,16 +392,14 @@ func (this *MatterController) RecoveryBatch(writer http.ResponseWriter, request
 // complete delete.
 func (this *MatterController) Delete(writer http.ResponseWriter, request *http.Request) *result.WebResult {
 
-	uuid := request.FormValue("uuid")
-	if uuid == "" {
-		panic(result.BadRequest("uuid cannot be null"))
-	}
-
-	matter := this.matterDao.CheckByUuid(uuid)
+	uuid := util.ExtractRequestString(request, "uuid")
 
 	user := this.checkUser(request)
-	space := this.spaceDao.CheckByUuid(user.SpaceUuid)
-	if matter.UserUuid != user.Uuid {
+	spaceUuid := util.ExtractRequestOptionalString(request, "spaceUuid", user.SpaceUuid)
+	space := this.spaceService.CheckWritableByUuid(request, user, spaceUuid)
+
+	matter := this.matterDao.CheckByUuid(uuid)
+	if matter.SpaceUuid != space.Uuid {
 		panic(result.UNAUTHORIZED)
 	}
 
@@ -430,14 +410,13 @@ func (this *MatterController) Delete(writer http.ResponseWriter, request *http.R
 
 func (this *MatterController) DeleteBatch(writer http.ResponseWriter, request *http.Request) *result.WebResult {
 
-	uuids := request.FormValue("uuids")
-	if uuids == "" {
-		panic(result.BadRequest("uuids cannot be null"))
-	}
+	uuids := util.ExtractRequestString(request, "uuids")
+
+	user := this.checkUser(request)
+	spaceUuid := util.ExtractRequestOptionalString(request, "spaceUuid", user.SpaceUuid)
+	space := this.spaceService.CheckWritableByUuid(request, user, spaceUuid)
 
 	uuidArray := strings.Split(uuids, ",")
-	user := this.checkUser(request)
-	space := this.spaceDao.CheckByUuid(user.SpaceUuid)
 	matters := make([]*Matter, 0)
 	for _, uuid := range uuidArray {
 
@@ -448,7 +427,7 @@ func (this *MatterController) DeleteBatch(writer http.ResponseWriter, request *h
 			continue
 		}
 
-		if matter.UserUuid != user.Uuid {
+		if matter.SpaceUuid != space.Uuid {
 			panic(result.UNAUTHORIZED)
 		}
 
@@ -473,14 +452,16 @@ func (this *MatterController) CleanExpiredDeletedMatters(writer http.ResponseWri
 
 func (this *MatterController) Rename(writer http.ResponseWriter, request *http.Request) *result.WebResult {
 
-	uuid := request.FormValue("uuid")
-	name := request.FormValue("name")
+	uuid := util.ExtractRequestString(request, "uuid")
+	name := util.ExtractRequestString(request, "name")
 
 	user := this.checkUser(request)
-	space := this.spaceDao.CheckByUuid(user.SpaceUuid)
+	spaceUuid := util.ExtractRequestOptionalString(request, "spaceUuid", user.SpaceUuid)
+	space := this.spaceService.CheckWritableByUuid(request, user, spaceUuid)
+
 	matter := this.matterDao.CheckByUuid(uuid)
 
-	if matter.UserUuid != user.Uuid {
+	if matter.SpaceUuid != space.Uuid {
 		panic(result.UNAUTHORIZED)
 	}
 
@@ -490,12 +471,13 @@ func (this *MatterController) Rename(writer http.ResponseWriter, request *http.R
 }
 
 func (this *MatterController) ChangePrivacy(writer http.ResponseWriter, request *http.Request) *result.WebResult {
-	uuid := request.FormValue("uuid")
-	privacyStr := request.FormValue("privacy")
-	privacy := false
-	if privacyStr == TRUE {
-		privacy = true
-	}
+
+	uuid := util.ExtractRequestString(request, "uuid")
+	privacy := util.ExtractRequestOptionalBool(request, "privacy", false)
+
+	user := this.checkUser(request)
+	spaceUuid := util.ExtractRequestOptionalString(request, "spaceUuid", user.SpaceUuid)
+	space := this.spaceService.CheckWritableByUuid(request, user, spaceUuid)
 
 	matter := this.matterDao.CheckByUuid(uuid)
 
@@ -507,8 +489,7 @@ func (this *MatterController) ChangePrivacy(writer http.ResponseWriter, request
 		panic(result.BadRequest("not changed. Invalid operation."))
 	}
 
-	user := this.checkUser(request)
-	if matter.UserUuid != user.Uuid {
+	if matter.SpaceUuid != space.Uuid {
 		panic(result.UNAUTHORIZED)
 	}
 
@@ -519,25 +500,21 @@ func (this *MatterController) ChangePrivacy(writer http.ResponseWriter, request
 }
 
 func (this *MatterController) Move(writer http.ResponseWriter, request *http.Request) *result.WebResult {
-
-	srcUuidsStr := request.FormValue("srcUuids")
-	destUuid := request.FormValue("destUuid")
+	srcUuidsStr := util.ExtractRequestString(request, "srcUuids")
+	destUuid := util.ExtractRequestString(request, "destUuid")
+	user := this.checkUser(request)
+	spaceUuid := util.ExtractRequestOptionalString(request, "spaceUuid", user.SpaceUuid)
+	space := this.spaceService.CheckWritableByUuid(request, user, spaceUuid)
 
 	var srcUuids []string
-	if srcUuidsStr == "" {
-		panic(result.BadRequest("srcUuids cannot be null"))
-	} else {
-		srcUuids = strings.Split(srcUuidsStr, ",")
-	}
+	srcUuids = strings.Split(srcUuidsStr, ",")
 
-	user := this.checkUser(request)
-	space := this.spaceDao.CheckByUuid(user.SpaceUuid)
-	var destMatter = this.matterDao.CheckWithRootByUuid(destUuid, user, space)
+	var destMatter = this.matterDao.CheckWithRootByUuid(destUuid, space)
 	if !destMatter.Dir {
 		panic(result.BadRequest("destination is not a directory"))
 	}
 
-	if destMatter.UserUuid != user.Uuid {
+	if destMatter.SpaceUuid != space.Uuid {
 		panic(result.UNAUTHORIZED)
 	}
 
@@ -579,21 +556,13 @@ func (this *MatterController) Move(writer http.ResponseWriter, request *http.Req
 // mirror local files to EyeblueTank
 func (this *MatterController) Mirror(writer http.ResponseWriter, request *http.Request) *result.WebResult {
 
-	srcPath := request.FormValue("srcPath")
-	destPath := request.FormValue("destPath")
-	overwriteStr := request.FormValue("overwrite")
+	srcPath := util.ExtractRequestString(request, "srcPath")
+	destPath := util.ExtractRequestString(request, "destPath")
+	overwrite := util.ExtractRequestOptionalBool(request, "overwrite", false)
 
-	if srcPath == "" {
-		panic(result.BadRequest("srcPath cannot be null"))
-	}
-
-	overwrite := false
-	if overwriteStr == TRUE {
-		overwrite = true
-	}
-
-	user := this.userDao.checkUser(request)
-	space := this.spaceDao.CheckByUuid(user.SpaceUuid)
+	user := this.checkUser(request)
+	spaceUuid := util.ExtractRequestOptionalString(request, "spaceUuid", user.SpaceUuid)
+	space := this.spaceService.CheckWritableByUuid(request, user, spaceUuid)
 
 	this.matterService.AtomicMirror(request, srcPath, destPath, overwrite, user, space)
 
@@ -603,11 +572,10 @@ func (this *MatterController) Mirror(writer http.ResponseWriter, request *http.R
 
 // download zip.
 func (this *MatterController) Zip(writer http.ResponseWriter, request *http.Request) *result.WebResult {
-
-	uuids := request.FormValue("uuids")
-	if uuids == "" {
-		panic(result.BadRequest("uuids cannot be null"))
-	}
+	uuids := util.ExtractRequestString(request, "uuids")
+	user := this.checkUser(request)
+	spaceUuid := util.ExtractRequestOptionalString(request, "spaceUuid", user.SpaceUuid)
+	space := this.spaceService.CheckWritableByUuid(request, user, spaceUuid)
 
 	uuidArray := strings.Split(uuids, ",")
 
@@ -623,11 +591,10 @@ func (this *MatterController) Zip(writer http.ResponseWriter, request *http.Requ
 		}
 	}
 
-	user := this.checkUser(request)
 	puuid := matters[0].Puuid
 
 	for _, m := range matters {
-		if m.UserUuid != user.Uuid {
+		if m.SpaceUuid != space.Uuid {
 			panic(result.UNAUTHORIZED)
 		} else if m.Puuid != puuid {
 			panic(result.BadRequest("puuid not same"))
diff --git a/code/rest/matter_dao.go b/code/rest/matter_dao.go
index 221063a..c14b7af 100644
--- a/code/rest/matter_dao.go
+++ b/code/rest/matter_dao.go
@@ -56,7 +56,7 @@ func (this *MatterDao) CheckByUuid(uuid string) *Matter {
 }
 
 // find by uuid. if uuid=root, then return the Root Matter
-func (this *MatterDao) CheckWithRootByUuid(uuid string, user *User, space *Space) *Matter {
+func (this *MatterDao) CheckWithRootByUuid(uuid string, space *Space) *Matter {
 
 	if uuid == "" {
 		panic(result.BadRequest("uuid cannot be null."))
@@ -64,10 +64,10 @@ func (this *MatterDao) CheckWithRootByUuid(uuid string, user *User, space *Space
 
 	var matter *Matter
 	if uuid == MATTER_ROOT {
-		if user == nil {
+		if space == nil {
 			panic(result.BadRequest("user cannot be null."))
 		}
-		matter = NewRootMatter(user, space)
+		matter = NewRootMatter(space)
 	} else {
 		matter = this.CheckByUuid(uuid)
 	}
@@ -85,7 +85,7 @@ func (this *MatterDao) CheckWithRootByPath(path string, user *User, space *Space
 	}
 
 	if path == "" || path == "/" {
-		matter = NewRootMatter(user, space)
+		matter = NewRootMatter(space)
 	} else {
 		matter = this.checkByUserUuidAndPath(user.Uuid, path)
 	}
@@ -103,7 +103,7 @@ func (this *MatterDao) FindWithRootByPath(path string, user *User, space *Space)
 	}
 
 	if path == "" || path == "/" {
-		matter = NewRootMatter(user, space)
+		matter = NewRootMatter(space)
 	} else {
 		matter = this.findByUserUuidAndPath(user.Uuid, path)
 	}
@@ -290,6 +290,7 @@ func (this *MatterDao) PlainPage(
 	pageSize int,
 	puuid string,
 	userUuid string,
+	spaceUuid string,
 	name string,
 	dir string,
 	deleted string,
@@ -307,6 +308,10 @@ func (this *MatterDao) PlainPage(
 		wp = wp.And(&builder.WherePair{Query: "user_uuid = ?", Args: []interface{}{userUuid}})
 	}
 
+	if spaceUuid != "" {
+		wp = wp.And(&builder.WherePair{Query: "space_uuid = ?", Args: []interface{}{spaceUuid}})
+	}
+
 	if name != "" {
 		wp = wp.And(&builder.WherePair{Query: "name LIKE ?", Args: []interface{}{"%" + name + "%"}})
 	}
@@ -350,9 +355,9 @@ func (this *MatterDao) PlainPage(
 
 	return int(count), matters
 }
-func (this *MatterDao) Page(page int, pageSize int, puuid string, userUuid string, name string, dir string, deleted string, extensions []string, sortArray []builder.OrderPair) *Pager {
+func (this *MatterDao) Page(page int, pageSize int, puuid string, userUuid string, spaceUuid string, name string, dir string, deleted string, extensions []string, sortArray []builder.OrderPair) *Pager {
 
-	count, matters := this.PlainPage(page, pageSize, puuid, userUuid, name, dir, deleted, nil, extensions, sortArray)
+	count, matters := this.PlainPage(page, pageSize, puuid, userUuid, spaceUuid, name, dir, deleted, nil, extensions, sortArray)
 	pager := NewPager(page, pageSize, count, matters)
 
 	return pager
@@ -362,6 +367,7 @@ func (this *MatterDao) Page(page int, pageSize int, puuid string, userUuid strin
 func (this *MatterDao) PageHandle(
 	puuid string,
 	userUuid string,
+	spaceUuid string,
 	name string,
 	dir string,
 	deleted string,
@@ -379,13 +385,13 @@ func (this *MatterDao) PageHandle(
 		}
 	}
 
-	count, _ := this.PlainPage(0, pageSize, puuid, userUuid, name, dir, deleted, deleteTimeBefore, nil, sortArray)
+	count, _ := this.PlainPage(0, pageSize, puuid, userUuid, spaceUuid, name, dir, deleted, deleteTimeBefore, nil, sortArray)
 	if count > 0 {
 		var totalPages = int(math.Ceil(float64(count) / float64(pageSize)))
 
 		var page int
 		for page = 0; page < totalPages; page++ {
-			_, matters := this.PlainPage(0, pageSize, puuid, userUuid, name, dir, deleted, deleteTimeBefore, nil, sortArray)
+			_, matters := this.PlainPage(0, pageSize, puuid, userUuid, spaceUuid, name, dir, deleted, deleteTimeBefore, nil, sortArray)
 			for _, matter := range matters {
 				fun(matter)
 			}
diff --git a/code/rest/matter_model.go b/code/rest/matter_model.go
index f67cbf9..95f86e4 100644
--- a/code/rest/matter_model.go
+++ b/code/rest/matter_model.go
@@ -64,16 +64,17 @@ func (this *Matter) MimeType() string {
 }
 
 // Create a root matter. It's convenient for copy and move
-func NewRootMatter(user *User, space *Space) *Matter {
+func NewRootMatter(space *Space) *Matter {
 	matter := &Matter{}
 	matter.Uuid = MATTER_ROOT
-	matter.UserUuid = user.Uuid
+	matter.UserUuid = space.UserUuid
+	matter.SpaceUuid = space.Uuid
 	matter.SpaceName = space.Name
 	matter.Dir = true
 	matter.Path = ""
-	matter.CreateTime = user.CreateTime
-	matter.UpdateTime = user.UpdateTime
-	matter.VisitTime = user.UpdateTime
+	matter.CreateTime = space.CreateTime
+	matter.UpdateTime = space.UpdateTime
+	matter.VisitTime = space.UpdateTime
 
 	return matter
 }
diff --git a/code/rest/matter_service.go b/code/rest/matter_service.go
index 591e4d6..08e29ac 100644
--- a/code/rest/matter_service.go
+++ b/code/rest/matter_service.go
@@ -438,6 +438,7 @@ func (this *MatterService) createNonDirMatter(dirMatter *Matter, filename string
 		Puuid:     dirMatter.Uuid,
 		UserUuid:  user.Uuid,
 		SpaceName: space.Name,
+		SpaceUuid: space.Uuid,
 		Dir:       false,
 		Name:      filename,
 		Md5:       "",
@@ -513,7 +514,7 @@ func (this *MatterService) ComputeAllDirSize(user *User, space *Space) {
 
 	this.logger.Info("Compute all dir's size for user %s %s", user.Uuid, user.Username)
 
-	rootMatter := NewRootMatter(user, space)
+	rootMatter := NewRootMatter(space)
 	this.ComputeDirSize(rootMatter, user, space)
 }
 
@@ -553,7 +554,7 @@ func (this *MatterService) ComputeDirSize(dirMatter *Matter, user *User, space *
 }
 
 // inner create directory.
-func (this *MatterService) createDirectory(request *http.Request, dirMatter *Matter, name string, user *User) *Matter {
+func (this *MatterService) createDirectory(request *http.Request, dirMatter *Matter, name string, user *User, space *Space) *Matter {
 
 	if dirMatter == nil {
 		panic(result.BadRequest("dirMatter cannot be nil"))
@@ -567,9 +568,9 @@ func (this *MatterService) createDirectory(request *http.Request, dirMatter *Mat
 		panic(result.BadRequest("Dir has been deleted. Cannot create dir under it."))
 	}
 
-	if dirMatter.UserUuid != user.Uuid {
+	if dirMatter.SpaceUuid != space.Uuid {
 
-		panic(result.BadRequest("file's user not the same"))
+		panic(result.BadRequest("file's space not the same"))
 	}
 
 	name = strings.TrimSpace(name)
@@ -599,7 +600,7 @@ func (this *MatterService) createDirectory(request *http.Request, dirMatter *Mat
 		panic(result.BadRequestI18n(request, i18n.MatterDepthExceedLimit, len(parts), MATTER_NAME_MAX_DEPTH))
 	}
 
-	absolutePath := GetSpaceMatterRootDir(user.Username) + dirMatter.Path + "/" + name
+	absolutePath := GetSpaceMatterRootDir(space.Name) + dirMatter.Path + "/" + name
 
 	relativePath := dirMatter.Path + "/" + name
 
@@ -611,6 +612,7 @@ func (this *MatterService) createDirectory(request *http.Request, dirMatter *Mat
 	matter = &Matter{
 		Puuid:     dirMatter.Uuid,
 		UserUuid:  user.Uuid,
+		SpaceUuid: space.Uuid,
 		SpaceName: user.Username,
 		Dir:       true,
 		Name:      name,
@@ -623,7 +625,7 @@ func (this *MatterService) createDirectory(request *http.Request, dirMatter *Mat
 	return matter
 }
 
-func (this *MatterService) AtomicCreateDirectory(request *http.Request, dirMatter *Matter, name string, user *User) *Matter {
+func (this *MatterService) AtomicCreateDirectory(request *http.Request, dirMatter *Matter, name string, user *User, space *Space) *Matter {
 
 	if dirMatter.Deleted {
 		panic(result.BadRequest("Dir has been deleted. Cannot create sub dir under it."))
@@ -632,7 +634,7 @@ func (this *MatterService) AtomicCreateDirectory(request *http.Request, dirMatte
 	this.userService.MatterLock(user.Uuid)
 	defer this.userService.MatterUnlock(user.Uuid)
 
-	matter := this.createDirectory(request, dirMatter, name, user)
+	matter := this.createDirectory(request, dirMatter, name, user, space)
 
 	return matter
 }
@@ -999,7 +1001,7 @@ func (this *MatterService) mirror(request *http.Request, srcPath string, destDir
 		srcDirMatter := this.matterDao.FindByUserUuidAndPuuidAndDirAndName(user.Uuid, destDirMatter.Uuid, TRUE, fileStat.Name())
 
 		if srcDirMatter == nil {
-			srcDirMatter = this.createDirectory(request, destDirMatter, fileStat.Name(), user)
+			srcDirMatter = this.createDirectory(request, destDirMatter, fileStat.Name(), user, space)
 		}
 
 		fileInfos, err := ioutil.ReadDir(srcPath)
@@ -1046,7 +1048,7 @@ func (this *MatterService) CreateDirectories(request *http.Request, user *User,
 	dirPath = path.Clean(dirPath)
 
 	if dirPath == "/" {
-		return NewRootMatter(user, space)
+		return NewRootMatter(space)
 	}
 
 	//ignore the last slash.
@@ -1071,11 +1073,11 @@ func (this *MatterService) CreateDirectories(request *http.Request, user *User,
 
 		//ignore the first element.
 		if k == 0 {
-			dirMatter = NewRootMatter(user, space)
+			dirMatter = NewRootMatter(space)
 			continue
 		}
 
-		dirMatter = this.createDirectory(request, dirMatter, name, user)
+		dirMatter = this.createDirectory(request, dirMatter, name, user, space)
 	}
 
 	return dirMatter
@@ -1190,7 +1192,7 @@ func (this *MatterService) DeleteByPhysics(request *http.Request, user *User, sp
 	}
 
 	//scan user's file. scan level by level.
-	rootMatter := NewRootMatter(user, space)
+	rootMatter := NewRootMatter(space)
 	this.deleteFolderByPhysics(request, rootMatter, user, space)
 
 }
@@ -1198,7 +1200,7 @@ func (this *MatterService) DeleteByPhysics(request *http.Request, user *User, sp
 func (this *MatterService) deleteFolderByPhysics(request *http.Request, dirMatter *Matter, user *User, space *Space) {
 
 	//scan user's file. scan level by level.
-	this.matterDao.PageHandle(dirMatter.Uuid, user.Uuid, "", "", "", nil, nil, func(matter *Matter) {
+	this.matterDao.PageHandle(dirMatter.Uuid, "", space.Uuid, "", "", "", nil, nil, func(matter *Matter) {
 
 		if matter.Dir {
 			//delete children first.
@@ -1232,7 +1234,7 @@ func (this *MatterService) ScanPhysics(request *http.Request, user *User, space
 		panic(result.BadRequest("cannot get root file info."))
 	}
 
-	rootMatter := NewRootMatter(user, space)
+	rootMatter := NewRootMatter(space)
 	this.scanPhysicsFolder(request, rootFileInfo, rootMatter, user, space)
 }
 
@@ -1242,7 +1244,7 @@ func (this *MatterService) scanPhysicsFolder(request *http.Request, dirInfo os.F
 	}
 
 	//fetch all matters under this folder.
-	_, matters := this.matterDao.PlainPage(0, 1000, dirMatter.Uuid, user.Uuid, "", "", "", nil, nil, nil)
+	_, matters := this.matterDao.PlainPage(0, 1000, dirMatter.Uuid, "", space.Uuid, "", "", "", nil, nil, nil)
 	nameMatterMap := make(map[string]*Matter)
 	for _, m := range matters {
 		nameMatterMap[m.Name] = m
@@ -1286,7 +1288,7 @@ func (this *MatterService) scanPhysicsFolder(request *http.Request, dirInfo os.F
 			if fileInfo.IsDir() {
 
 				//create folder.
-				matter = this.createDirectory(request, dirMatter, name, user)
+				matter = this.createDirectory(request, dirMatter, name, user, space)
 
 				//recursive scan this folder.
 				this.scanPhysicsFolder(request, fileInfo, matter, user, space)
@@ -1321,7 +1323,7 @@ func (this *MatterService) CleanExpiredDeletedMatters() {
 		}
 
 		//first remove all the matter(not dir).
-		this.matterDao.PageHandle("", "", "", FALSE, TRUE, &thenDate, nil, func(matter *Matter) {
+		this.matterDao.PageHandle("", "", "", "", FALSE, TRUE, &thenDate, nil, func(matter *Matter) {
 			this.Delete(request, matter, user, space)
 		})
 
@@ -1333,7 +1335,7 @@ func (this *MatterService) CleanExpiredDeletedMatters() {
 		}
 
 		//remove all the deleted directories. sort by path.
-		this.matterDao.PageHandle("", "", "", TRUE, TRUE, &thenDate, sortArray, func(matter *Matter) {
+		this.matterDao.PageHandle("", "", "", "", TRUE, TRUE, &thenDate, sortArray, func(matter *Matter) {
 			this.Delete(request, matter, user, space)
 		})
 
diff --git a/code/rest/space_controller.go b/code/rest/space_controller.go
index 3a05ab8..33ddfaf 100644
--- a/code/rest/space_controller.go
+++ b/code/rest/space_controller.go
@@ -70,9 +70,9 @@ func (this *SpaceController) RegisterRoutes() map[string]func(writer http.Respon
 
 func (this *SpaceController) Create(writer http.ResponseWriter, request *http.Request) *result.WebResult {
 	//space's name
-	name := util.ExtractRequestString(request, "name", "name is required")
-	sizeLimit := util.ExtractRequestInt64(request, "sizeLimit", "space's limit size is required")
-	totalSizeLimit := util.ExtractRequestInt64(request, "totalSizeLimit", "space's total limit size is required")
+	name := util.ExtractRequestString(request, "name")
+	sizeLimit := util.ExtractRequestInt64(request, "sizeLimit")
+	totalSizeLimit := util.ExtractRequestInt64(request, "totalSizeLimit")
 
 	//create related space.
 	space := this.spaceService.CreateSpace(request, name, nil, sizeLimit, totalSizeLimit, SPACE_TYPE_SHARED)
@@ -82,9 +82,9 @@ func (this *SpaceController) Create(writer http.ResponseWriter, request *http.Re
 
 func (this *SpaceController) Edit(writer http.ResponseWriter, request *http.Request) *result.WebResult {
 	//space's name
-	uuid := util.ExtractRequestString(request, "uuid", "uuid is required")
-	sizeLimit := util.ExtractRequestInt64(request, "sizeLimit", "space's limit size is required")
-	totalSizeLimit := util.ExtractRequestInt64(request, "totalSizeLimit", "space's total limit size is required")
+	uuid := util.ExtractRequestString(request, "uuid")
+	sizeLimit := util.ExtractRequestInt64(request, "sizeLimit")
+	totalSizeLimit := util.ExtractRequestInt64(request, "totalSizeLimit")
 
 	space := this.spaceDao.CheckByUuid(uuid)
 
@@ -99,7 +99,7 @@ func (this *SpaceController) Edit(writer http.ResponseWriter, request *http.Requ
 func (this *SpaceController) Delete(writer http.ResponseWriter, request *http.Request) *result.WebResult {
 
 	//space's name
-	uuid := util.ExtractRequestString(request, "uuid", "uuid is required")
+	uuid := util.ExtractRequestString(request, "uuid")
 	space := this.spaceDao.CheckByUuid(uuid)
 
 	//when space has members, cannot delete.
@@ -118,7 +118,7 @@ func (this *SpaceController) Delete(writer http.ResponseWriter, request *http.Re
 
 func (this *SpaceController) Detail(writer http.ResponseWriter, request *http.Request) *result.WebResult {
 
-	uuid := util.ExtractRequestString(request, "uuid", "uuid is required")
+	uuid := util.ExtractRequestString(request, "uuid")
 
 	user := this.checkUser(request)
 	space := this.spaceDao.CheckByUuid(uuid)
diff --git a/code/rest/space_member_controller.go b/code/rest/space_member_controller.go
index b292354..5d95086 100644
--- a/code/rest/space_member_controller.go
+++ b/code/rest/space_member_controller.go
@@ -69,9 +69,9 @@ func (this *SpaceMemberController) RegisterRoutes() map[string]func(writer http.
 
 func (this *SpaceMemberController) Create(writer http.ResponseWriter, request *http.Request) *result.WebResult {
 
-	spaceUuid := util.ExtractRequestString(request, "spaceUuid", "spaceUuid is required")
-	userUuid := util.ExtractRequestString(request, "userUuid", "userUuid is required")
-	spaceRole := util.ExtractRequestString(request, "spaceRole", "spaceRole is required")
+	spaceUuid := util.ExtractRequestString(request, "spaceUuid")
+	userUuid := util.ExtractRequestString(request, "userUuid")
+	spaceRole := util.ExtractRequestString(request, "spaceRole")
 
 	if spaceRole != SPACE_MEMBER_ROLE_READ_ONLY && spaceRole != SPACE_MEMBER_ROLE_READ_WRITE && spaceRole != SPACE_MEMBER_ROLE_ADMIN {
 		panic("spaceRole is not correct")
@@ -99,8 +99,8 @@ func (this *SpaceMemberController) Create(writer http.ResponseWriter, request *h
 }
 
 func (this *SpaceMemberController) Edit(writer http.ResponseWriter, request *http.Request) *result.WebResult {
-	uuid := util.ExtractRequestString(request, "uuid", "uuid is required")
-	spaceRole := util.ExtractRequestString(request, "spaceRole", "spaceRole is required")
+	uuid := util.ExtractRequestString(request, "uuid")
+	spaceRole := util.ExtractRequestString(request, "spaceRole")
 
 	if spaceRole != SPACE_MEMBER_ROLE_READ_ONLY && spaceRole != SPACE_MEMBER_ROLE_READ_WRITE && spaceRole != SPACE_MEMBER_ROLE_ADMIN {
 		panic("spaceRole is not correct")
@@ -121,7 +121,7 @@ func (this *SpaceMemberController) Edit(writer http.ResponseWriter, request *htt
 }
 
 func (this *SpaceMemberController) Delete(writer http.ResponseWriter, request *http.Request) *result.WebResult {
-	uuid := util.ExtractRequestString(request, "uuid", "uuid is required")
+	uuid := util.ExtractRequestString(request, "uuid")
 
 	spaceMember := this.spaceMemberDao.CheckByUuid(uuid)
 	user := this.checkUser(request)
@@ -137,7 +137,7 @@ func (this *SpaceMemberController) Delete(writer http.ResponseWriter, request *h
 
 func (this *SpaceMemberController) Detail(writer http.ResponseWriter, request *http.Request) *result.WebResult {
 
-	uuid := util.ExtractRequestString(request, "uuid", "uuid is required")
+	uuid := util.ExtractRequestString(request, "uuid")
 
 	spaceMember := this.spaceMemberDao.CheckByUuid(uuid)
 
@@ -156,7 +156,7 @@ func (this *SpaceMemberController) Page(writer http.ResponseWriter, request *htt
 	page := util.ExtractRequestOptionalInt(request, "page", 0)
 	pageSize := util.ExtractRequestOptionalInt(request, "pageSize", 20)
 	orderCreateTime := util.ExtractRequestOptionalString(request, "orderCreateTime", "")
-	spaceUuid := util.ExtractRequestString(request, "spaceUuid", "spaceUuid is required")
+	spaceUuid := util.ExtractRequestString(request, "spaceUuid")
 
 	user := this.checkUser(request)
 	canRead := this.spaceMemberService.canRead(user, spaceUuid)
diff --git a/code/rest/space_service.go b/code/rest/space_service.go
index 3908855..e3ab36a 100644
--- a/code/rest/space_service.go
+++ b/code/rest/space_service.go
@@ -11,10 +11,11 @@ import (
 // @Service
 type SpaceService struct {
 	BaseBean
-	spaceDao  *SpaceDao
-	matterDao *MatterDao
-	bridgeDao *BridgeDao
-	userDao   *UserDao
+	spaceDao           *SpaceDao
+	spaceMemberService *SpaceMemberService
+	matterDao          *MatterDao
+	bridgeDao          *BridgeDao
+	userDao            *UserDao
 }
 
 func (this *SpaceService) Init() {
@@ -25,6 +26,11 @@ func (this *SpaceService) Init() {
 		this.spaceDao = b
 	}
 
+	b = core.CONTEXT.GetBean(this.spaceMemberService)
+	if b, ok := b.(*SpaceMemberService); ok {
+		this.spaceMemberService = b
+	}
+
 	b = core.CONTEXT.GetBean(this.matterDao)
 	if b, ok := b.(*MatterDao); ok {
 		this.matterDao = b
@@ -98,3 +104,33 @@ func (this *SpaceService) CreateSpace(
 	return space
 
 }
+
+// checkout a writable space.
+func (this *SpaceService) CheckWritableByUuid(request *http.Request, user *User, spaceUuid string) *Space {
+	space := this.spaceDao.CheckByUuid(spaceUuid)
+	if space.Type == SPACE_TYPE_PRIVATE && user.Uuid == space.UserUuid {
+		return space
+	}
+
+	manage := this.spaceMemberService.canManage(user, spaceUuid)
+	if !manage {
+		panic(result.BadRequestI18n(request, i18n.PermissionDenied))
+	}
+
+	return space
+}
+
+// checkout a readable space.
+func (this *SpaceService) CheckReadableByUuid(request *http.Request, user *User, spaceUuid string) *Space {
+	space := this.spaceDao.CheckByUuid(spaceUuid)
+	if space.Type == SPACE_TYPE_PRIVATE && user.Uuid == space.UserUuid {
+		return space
+	}
+
+	manage := this.spaceMemberService.canRead(user, spaceUuid)
+	if !manage {
+		panic(result.BadRequestI18n(request, i18n.PermissionDenied))
+	}
+
+	return space
+}
diff --git a/code/rest/user_controller.go b/code/rest/user_controller.go
index abab182..3c79e96 100644
--- a/code/rest/user_controller.go
+++ b/code/rest/user_controller.go
@@ -193,8 +193,8 @@ func (this *UserController) Create(writer http.ResponseWriter, request *http.Req
 	password := request.FormValue("password")
 	role := request.FormValue("role")
 
-	sizeLimit := util.ExtractRequestInt64(request, "sizeLimit", "space's limit size is required")
-	totalSizeLimit := util.ExtractRequestInt64(request, "totalSizeLimit", "space's total limit size is required")
+	sizeLimit := util.ExtractRequestInt64(request, "sizeLimit")
+	totalSizeLimit := util.ExtractRequestInt64(request, "totalSizeLimit")
 
 	//validation work.
 	if m, _ := regexp.MatchString(USERNAME_PATTERN, username); !m {
diff --git a/code/tool/util/util_params.go b/code/tool/util/util_params.go
index 9b2a9ad..007f77e 100644
--- a/code/tool/util/util_params.go
+++ b/code/tool/util/util_params.go
@@ -1,12 +1,23 @@
 package util
 
 import (
+	"fmt"
 	"net/http"
 	"strconv"
 )
 
 // param is required. when missing, panic error.
-func ExtractRequestString(request *http.Request, key string, errorHint string) string {
+func ExtractRequestString(request *http.Request, key string) string {
+	str := request.FormValue(key)
+	if str == "" {
+		panic(fmt.Sprintf("%s is required", key))
+	} else {
+		return str
+	}
+}
+
+// param is required. when missing, panic error.
+func ExtractRequestStringWithErrorHint(request *http.Request, key string, errorHint string) string {
 	str := request.FormValue(key)
 	if str == "" {
 		panic(errorHint)
@@ -16,7 +27,24 @@ func ExtractRequestString(request *http.Request, key string, errorHint string) s
 }
 
 // param is required. when missing, panic error.
-func ExtractRequestInt64(request *http.Request, key string, errorHint string) int64 {
+func ExtractRequestInt64(request *http.Request, key string) int64 {
+	keyStr := request.FormValue(key)
+
+	var num int64 = 0
+	if keyStr == "" {
+		panic(fmt.Sprintf("%s is required", key))
+	} else {
+		intVal, err := strconv.Atoi(keyStr)
+		if err != nil {
+			panic(err)
+		}
+		num = int64(intVal)
+		return num
+	}
+}
+
+// param is required. when missing, panic error.
+func ExtractRequestInt64WithErrorHint(request *http.Request, key string, errorHint string) int64 {
 	keyStr := request.FormValue(key)
 
 	var num int64 = 0
@@ -55,3 +83,13 @@ func ExtractRequestOptionalString(request *http.Request, key string, defaultValu
 		return str
 	}
 }
+
+// param is required. when missing, panic error.
+func ExtractRequestOptionalBool(request *http.Request, key string, defaultValue bool) bool {
+	str := request.FormValue(key)
+	if str == "" {
+		return defaultValue
+	} else {
+		return str == "true"
+	}
+}