diff --git a/media/css/seahub.css b/media/css/seahub.css
index 7a5133d41a..5a6109ba7f 100644
--- a/media/css/seahub.css
+++ b/media/css/seahub.css
@@ -3516,7 +3516,7 @@ textarea:-moz-placeholder {/* for FF */
 
 /* user & group folder perm */
 #folder-perm-tabs .tabs-panel {
-    width:400px;
+    width:550px;
 }
 #folder-perm-tabs .perm-select {
     height:30px;
@@ -3531,3 +3531,13 @@ textarea:-moz-placeholder {/* for FF */
 #folder-perm-tabs table {
     margin-top:0;
 }
+.select2-result-label .text {
+    display:inline-block;
+}
+.select2-results .select2-result-label .avatar {
+    margin-right:10px;
+}
+.select2-result-label .avatar,
+.select2-result-label .text {
+    vertical-align:middle;
+}
diff --git a/seahub/templates/js/templates.html b/seahub/templates/js/templates.html
index 4c5b656573..8c4bc78e66 100644
--- a/seahub/templates/js/templates.html
+++ b/seahub/templates/js/templates.html
@@ -573,7 +573,7 @@
 <script type="text/template" id="folder-perm-item-tmpl">
     <% if (is_user_perm) { %>
     <td>
-        <a href="{{ SITE_ROOT }}profile/<% print(encodeURIComponent(user)); %>/" target="_blank"><%- user %></a>
+        <a href="{{ SITE_ROOT }}profile/<% print(encodeURIComponent(user)); %>/" target="_blank" title="<%- user %>"><%- user_name %></a>
     </td>
     <% } else { %>
     <td>
@@ -616,13 +616,13 @@
             <div id="user-folder-perm" class="tabs-panel">
                 <table>
                     <tr>
-                        <th width="50%">{% trans "User" %}</th>
-                        <th width="30%">{% trans "Permission" %}</th>
+                        <th width="55%">{% trans "User" %}</th>
+                        <th width="25%">{% trans "Permission" %}</th>
                         <th width="20%"></th>
                     </tr>
                     <tr id="add-user-folder-perm">
                         <td>
-                            <input name="email" placeholder="{% trans 'Enter or select one' %}" class="w100" />
+                            <input type="hidden" name="email" class="w100" />
                         </td>
                         <td>
                             <select name="permission" class="perm-select w100">
@@ -638,13 +638,13 @@
             <div id="group-folder-perm" class="tabs-panel">
                 <table>
                     <tr>
-                        <th width="50%">{% trans "Group" %}</th>
-                        <th width="30%">{% trans "Permission" %}</th>
+                        <th width="55%">{% trans "Group" %}</th>
+                        <th width="25%">{% trans "Permission" %}</th>
                         <th width="20%"></th>
                     </tr>
                     <tr id="add-group-folder-perm">
                         <td>
-                            <select name="group" placeholder="{% trans 'Select one' %}" class="w100" multiple="multiple"></select>
+                            <select name="group" class="w100" multiple="multiple"></select>
                         </td>
                         <td>
                             <select name="permission" class="perm-select w100">
diff --git a/seahub/utils/repo.py b/seahub/utils/repo.py
index a509c21bb9..532bdb85b6 100644
--- a/seahub/utils/repo.py
+++ b/seahub/utils/repo.py
@@ -17,63 +17,6 @@ def list_dir_by_path(cmmt, path):
     else:
         return seafile_api.list_dir_by_commit_and_path(cmmt.repo_id, cmmt.id, path)
 
-def check_user_folder_perm_args(from_user, repo_id, path, to_user, perm=None):
-    if not seafile_api.get_repo(repo_id):
-        return {'error': _(u'Library does not exist'), 'status': 400}
-
-    if from_user != seafile_api.get_repo_owner(repo_id):
-        return {'error': _('Permission denied'), 'status': 403}
-
-    if perm is not None:
-        # add or toggle folder perm
-        if perm != 'r' and perm != 'rw':
-            return {'error': _('Invalid folder permission, should be "rw" or "r"'), 'status': 400}
-
-    if not path.startswith('/'):
-        return {'error': _('Path should start with "/"'), 'status': 400}
-
-    if path != '/' and path.endswith('/'):
-        return {'error': _('Path should NOT ends with "/"'), 'status': 400}
-
-    if seafile_api.get_dir_id_by_path(repo_id, path) is None:
-        return {'error': _('Invalid path'), 'status': 400}
-
-    try:
-        user = User.objects.get(email = to_user)
-    except User.DoesNotExist:
-        user = None
-
-    if user is None:
-        return {'error': _('Invalid username, should be a user already registered'), 'status': 400}
-
-    return {'success': True}
-
-def check_group_folder_perm_args(from_user, repo_id, path, group_id, perm = None):
-    if not seafile_api.get_repo(repo_id):
-        return {'error': _(u'Library does not exist.'), 'status': 400}
-
-    if from_user != seafile_api.get_repo_owner(repo_id):
-        return {'error': _('Permission denied'), 'status': 403}
-
-    if perm is not None:
-        # add or toggle folder perm
-        if perm != 'r' and perm != 'rw':
-            return {'error': _('Invalid folder permission, should be "rw" or "r"'), 'status': 400}
-
-    if not path.startswith('/'):
-        return {'error': _('Path should start with "/"'), 'status': 400}
-
-    if path != '/' and path.endswith('/'):
-        return {'error': _('Path should NOT ends with "/"'), 'status': 400}
-
-    if seafile_api.get_dir_id_by_path(repo_id, path) is None:
-        return {'error': _('Invalid path'), 'status': 400}
-
-    if not seaserv.get_group(group_id):
-        return {'error': _('Invalid group'), 'status': 400}
-
-    return {'success': True}
-
 def get_sub_repo_abbrev_origin_path(repo_name, origin_path):
     """Return abbrev path for sub repo based on `repo_name` and `origin_path`.
 
diff --git a/seahub/views/ajax.py b/seahub/views/ajax.py
index 339be0e97c..302aec781b 100644
--- a/seahub/views/ajax.py
+++ b/seahub/views/ajax.py
@@ -37,7 +37,7 @@ from seahub.signals import upload_file_successful, repo_created, repo_deleted
 from seahub.views import get_repo_dirents_with_perm, validate_owner, \
     check_repo_access_permission, get_unencry_rw_repos_by_user, \
     get_system_default_repo_id, get_diff, group_events_data, \
-    get_owned_repo_list, check_folder_permission
+    get_owned_repo_list, check_folder_permission, is_registered_user
 from seahub.views.repo import get_nav_path, get_fileshare, get_dir_share_link, \
     get_uploadlink, get_dir_shared_upload_link
 from seahub.views.modules import get_enabled_mods_by_group, \
@@ -55,14 +55,14 @@ from seahub.utils import check_filename_with_rename, EMPTY_SHA1, \
     get_repo_last_modify, gen_file_upload_url, is_org_context, \
     get_org_user_events, get_user_events, get_file_type_and_ext, \
     is_valid_username, send_perm_audit_msg, get_origin_repo_info, is_pro_version
-from seahub.utils.repo import check_group_folder_perm_args, \
-    check_user_folder_perm_args, get_sub_repo_abbrev_origin_path
+from seahub.utils.repo import get_sub_repo_abbrev_origin_path
 from seahub.utils.star import star_file, unstar_file
 from seahub.base.accounts import User
 from seahub.thumbnail.utils import get_thumbnail_src, allow_generate_thumbnail
 from seahub.utils.file_types import IMAGE
 from seahub.thumbnail.utils import get_thumbnail_src
-from seahub.base.templatetags.seahub_tags import translate_seahub_time, file_icon_filter
+from seahub.base.templatetags.seahub_tags import translate_seahub_time, \
+        file_icon_filter, email2nickname
 from seahub.avatar.templatetags.group_avatar_tags import grp_avatar
 
 # Get an instance of a logger
@@ -1205,7 +1205,11 @@ def get_contacts(request):
         try:
             user = User.objects.get(email=c.contact_email)
             if user.is_active:
-                contact_list.append({"email": c.contact_email, "avatar": avatar(c.contact_email, 16)})
+                contact_list.append({
+                    "email": c.contact_email,
+                    "avatar": avatar(c.contact_email, 32),
+                    "name": email2nickname(c.contact_email),
+                    })
         except User.DoesNotExist:
             continue
 
@@ -2255,6 +2259,7 @@ def get_folder_perm_by_path(request, repo_id):
             user_result_perm = {
                 "perm": user_perm.permission,
                 "user": user_perm.user,
+                "user_name": email2nickname(user_perm.user),
             }
             user_result_perms.append(user_result_perm)
 
@@ -2284,7 +2289,7 @@ def set_user_folder_perm(request, repo_id):
     content_type = 'application/json; charset=utf-8'
 
     if not (is_pro_version() and ENABLE_FOLDER_PERM):
-        return HttpResponse(json.dumps({"error": True}),
+        return HttpResponse(json.dumps({"error": _(u"Permission denied")}),
                             status=403, content_type=content_type)
 
     user = request.POST.get('user', None)
@@ -2292,38 +2297,55 @@ def set_user_folder_perm(request, repo_id):
     perm = request.POST.get('perm', None)
     op_type = request.POST.get('type', None)
 
+    username = request.user.username
+
+    ## check params
     if not user or not path or not perm or \
         op_type != 'add' and op_type != 'modify' and op_type != 'delete':
         return HttpResponse(json.dumps({"error": _('Argument missing')}),
                             status=400, content_type=content_type)
 
-    result = check_user_folder_perm_args(request.user.username, repo_id, path, user, perm)
-    if 'error' in result:
-        return HttpResponse(json.dumps(result), status=result['status'],
-                            content_type=content_type)
+    if not seafile_api.get_repo(repo_id):
+        return HttpResponse(json.dumps({"error": _('Library does not exist')}),
+                            status=400, content_type=content_type)
+
+    if username != seafile_api.get_repo_owner(repo_id):
+        return HttpResponse(json.dumps({"error": _('Permission denied')}),
+                            status=403, content_type=content_type)
+
+    if perm is not None:
+        if perm != 'r' and perm != 'rw':
+            return HttpResponse(json.dumps({
+                "error": _('Invalid folder permission, should be "rw" or "r"')
+                }), status=400, content_type=content_type)
+
+    if not path.startswith('/'):
+        return HttpResponse(json.dumps({"error": _('Path should start with "/"')}),
+                            status=400, content_type=content_type)
+
+    if path != '/' and path.endswith('/'):
+        return HttpResponse(json.dumps({"error": _('Path should not end with "/"')}),
+                            status=400, content_type=content_type)
+
+    if seafile_api.get_dir_id_by_path(repo_id, path) is None:
+        return HttpResponse(json.dumps({"error": _('Invalid path')}),
+                            status=400, content_type=content_type)
+
+    ## add perm for user(s)
+    if op_type == 'add':
+        return add_user_folder_perm(request, repo_id, user, path, perm)
+
+    if not is_registered_user(user):
+        return HttpResponse(json.dumps({"error": _('Invalid user, should be registered')}),
+                            status=400, content_type=content_type)
 
     user_folder_perm = seafile_api.get_folder_user_perm(repo_id, path, user)
 
-    if op_type == 'add':
-        if not user_folder_perm:
-            try:
-                seafile_api.add_folder_user_perm(repo_id, path, perm, user)
-                send_perm_audit_msg('add-repo-perm', request.user.username,
-                                    user, repo_id, path, perm)
-            except SearpcError as e:
-                logger.error(e)
-                return HttpResponse(json.dumps({"error": _('Operation failed')}),
-                                    status=500, content_type=content_type)
-        else:
-            return HttpResponse(json.dumps({"error": _('Already add this folder permission')}),
-                                status=400, content_type=content_type)
-
     if op_type == 'modify':
         if user_folder_perm and user_folder_perm != perm:
             try:
                 seafile_api.set_folder_user_perm(repo_id, path, perm, user)
-                send_perm_audit_msg('modify-repo-perm', request.user.username,
-                                    user, repo_id, path, perm)
+                send_perm_audit_msg('modify-repo-perm', username, user, repo_id, path, perm)
             except SearpcError as e:
                 logger.error(e)
                 return HttpResponse(json.dumps({"error": _('Operation failed')}),
@@ -2336,8 +2358,7 @@ def set_user_folder_perm(request, repo_id):
         if user_folder_perm:
             try:
                 seafile_api.rm_folder_user_perm(repo_id, path, user)
-                send_perm_audit_msg('delete-repo-perm', request.user.username,
-                                    user, repo_id, path, perm)
+                send_perm_audit_msg('delete-repo-perm', username, user, repo_id, path, perm)
             except SearpcError as e:
                 logger.error(e)
                 return HttpResponse(json.dumps({"error": _('Operation failed')}),
@@ -2346,8 +2367,53 @@ def set_user_folder_perm(request, repo_id):
             return HttpResponse(json.dumps({"error": _('Please add folder permission first')}),
                                 status=400, content_type=content_type)
 
-    return HttpResponse(json.dumps({'success': True}),
-                        content_type=content_type)
+    return HttpResponse(json.dumps({'success': True}), content_type=content_type)
+
+def add_user_folder_perm(request, repo_id, users, path, perm):
+    """
+    Add folder permission for user(s)
+    """
+    content_type = 'application/json; charset=utf-8'
+
+    emails = users.split(',')
+
+    success, failed = [], []
+    username = request.user.username
+
+    for user in [e.strip() for e in emails if e.strip()]:
+        if not is_valid_username(user):
+            failed.append(user)
+            continue
+
+        if not is_registered_user(user):
+            failed.append(user)
+            continue
+
+        user_folder_perm = seafile_api.get_folder_user_perm(repo_id, path, user)
+
+        if user_folder_perm:
+            # Already add this folder permission
+            continue
+
+        try:
+            seafile_api.add_folder_user_perm(repo_id, path, perm, user)
+            send_perm_audit_msg('add-repo-perm', username, user, repo_id, path, perm)
+            success.append({
+                'user': user,
+                'user_name': email2nickname(user)
+                })
+        except SearpcError as e:
+            logger.error(e)
+            failed.append(user)
+
+    if len(success) > 0:
+        data = json.dumps({"success": success, "failed": failed})
+        return HttpResponse(data, content_type=content_type)
+    else:
+        data = json.dumps({
+            "error": _("Please check the email(s) you entered and the contacts you selected")
+            })
+        return HttpResponse(data, status=400, content_type=content_type)
 
 @login_required_ajax
 def set_group_folder_perm(request, repo_id):
@@ -2368,39 +2434,56 @@ def set_group_folder_perm(request, repo_id):
     perm = request.POST.get('perm', None)
     op_type = request.POST.get('type', None)
 
+    username = request.user.username
+
     if not group_id or not path or not perm or \
         op_type != 'add' and op_type != 'modify' and op_type != 'delete':
         return HttpResponse(json.dumps({"error": _('Argument missing')}),
                             status=400, content_type=content_type)
 
+    ## check params
+    if not seafile_api.get_repo(repo_id):
+        return HttpResponse(json.dumps({"error": _('Library does not exist')}),
+                            status=400, content_type=content_type)
+
+    if username != seafile_api.get_repo_owner(repo_id):
+        return HttpResponse(json.dumps({"error": _('Permission denied')}),
+                            status=403, content_type=content_type)
+
+    if perm is not None:
+        if perm != 'r' and perm != 'rw':
+            return HttpResponse(json.dumps({
+                "error": _('Invalid folder permission, should be "rw" or "r"')
+                }), status=400, content_type=content_type)
+
+    if not path.startswith('/'):
+        return HttpResponse(json.dumps({"error": _('Path should start with "/"')}),
+                            status=400, content_type=content_type)
+
+    if path != '/' and path.endswith('/'):
+        return HttpResponse(json.dumps({"error": _('Path should not end with "/"')}),
+                            status=400, content_type=content_type)
+
+    if seafile_api.get_dir_id_by_path(repo_id, path) is None:
+        return HttpResponse(json.dumps({"error": _('Invalid path')}),
+                            status=400, content_type=content_type)
+
+    ## add perm for group(s)
+    if op_type == 'add':
+        return add_group_folder_perm(request, repo_id, group_id, path, perm)
+
     group_id = int(group_id)
-    result = check_group_folder_perm_args(request.user.username, repo_id, path, group_id, perm)
-    if 'error' in result:
-        return HttpResponse(json.dumps(result), status=result['status'],
-                            content_type=content_type)
+    if not seaserv.get_group(group_id):
+        return HttpResponse(json.dumps({"error": _('Invalid group')}),
+                            status=400, content_type=content_type)
 
     group_folder_perm = seafile_api.get_folder_group_perm(repo_id, path, group_id)
 
-    if op_type == 'add':
-        if not group_folder_perm:
-            try:
-                seafile_api.add_folder_group_perm(repo_id, path, perm, group_id)
-                send_perm_audit_msg('add-repo-perm', request.user.username,
-                                    group_id, repo_id, path, perm)
-            except SearpcError as e:
-                logger.error(e)
-                return HttpResponse(json.dumps({"error": _('Operation failed')}),
-                                    status=500, content_type=content_type)
-        else:
-            return HttpResponse(json.dumps({"error": _('Already add this folder permission')}),
-                                status=400, content_type=content_type)
-
     if op_type == 'modify':
         if group_folder_perm and group_folder_perm != perm:
             try:
                 seafile_api.set_folder_group_perm(repo_id, path, perm, group_id)
-                send_perm_audit_msg('modify-repo-perm', request.user.username,
-                                    group_id, repo_id, path, perm)
+                send_perm_audit_msg('modify-repo-perm', username, group_id, repo_id, path, perm)
             except SearpcError as e:
                 logger.error(e)
                 return HttpResponse(json.dumps({"error": _('Operation failed')}),
@@ -2413,8 +2496,7 @@ def set_group_folder_perm(request, repo_id):
         if group_folder_perm:
             try:
                 seafile_api.rm_folder_group_perm(repo_id, path, group_id)
-                send_perm_audit_msg('delete-repo-perm', request.user.username,
-                                    group_id, repo_id, path, perm)
+                send_perm_audit_msg('delete-repo-perm', username, group_id, repo_id, path, perm)
             except SearpcError as e:
                 logger.error(e)
                 return HttpResponse(json.dumps({"error": _('Operation failed')}),
@@ -2423,8 +2505,47 @@ def set_group_folder_perm(request, repo_id):
             return HttpResponse(json.dumps({"error": _('Please add folder permission first')}),
                                 status=400, content_type=content_type)
 
-    return HttpResponse(json.dumps({'success': True}),
-                        content_type=content_type)
+    return HttpResponse(json.dumps({'success': True}), content_type=content_type)
+
+def add_group_folder_perm(request, repo_id, group_ids, path, perm):
+    """
+    Add folder permission for group(s)
+    """
+    content_type = 'application/json; charset=utf-8'
+
+    group_id_list = group_ids.split(',') # 'user'
+
+    success, failed = [], []
+    username = request.user.username
+
+    for group_id in group_id_list:
+        group_id = int(group_id)
+        if not seaserv.get_group(group_id):
+            failed.append(group_id)
+
+        group_folder_perm = seafile_api.get_folder_group_perm(repo_id, path, group_id)
+
+        if group_folder_perm:
+            #Already add this folder permission
+            continue
+
+        try:
+            seafile_api.add_folder_group_perm(repo_id, path, perm, group_id)
+            send_perm_audit_msg('add-repo-perm', username, group_id, repo_id, path, perm)
+            success.append({
+                'group_id': group_id,
+                "group_name": get_group(group_id).group_name,
+                })
+        except SearpcError as e:
+            logger.error(e)
+            failed.append(group_id)
+
+    if len(success) > 0:
+        data = json.dumps({"success": success, "failed": failed})
+        return HttpResponse(data, content_type=content_type)
+    else:
+        data = json.dumps({"error": _("Failed")})
+        return HttpResponse(data, status=400, content_type=content_type)
 
 @login_required_ajax
 def get_group_basic_info(request, group_id):
diff --git a/static/scripts/app/views/folder-perm.js b/static/scripts/app/views/folder-perm.js
index 03222162cc..712acad6b0 100644
--- a/static/scripts/app/views/folder-perm.js
+++ b/static/scripts/app/views/folder-perm.js
@@ -19,11 +19,7 @@ define([
             this.repo_id = options.repo_id;
             this.obj_name = options.obj_name;
             this.dir_path = options.dir_path;
-            if (this.dir_path === '/') {
-                this.path = this.dir_path + this.obj_name;
-            } else {
-                this.path = this.dir_path + '/' + this.obj_name;
-            }
+            this.path = Common.pathJoin([this.dir_path, this.obj_name])
 
             this.render();
 
@@ -94,16 +90,31 @@ define([
 
             // use select2 to 'user' input in 'add user perm'
             $('[name="email"]', $add_user_perm).select2({
-                maximumSelectionSize: 1,
+                placeholder: gettext("Enter emails or select contacts"),
                 tags: function () {
                     var contacts = app.pageOptions.contacts || [];
                     var contact_list = [];
                     for (var i = 0, len = contacts.length; i < len; i++) {
-                        contact_list.push(contacts[i].email);
+                        contact_list.push({ // 'id' & 'text' are required by the plugin
+                            "id": contacts[i].email,
+                            "text": contacts[i].email,
+                            "avatar": contacts[i].avatar,
+                            "name": contacts[i].name
+                        });
                     }
                     return contact_list;
                 },
                 tokenSeparators: [',', ' '],
+                formatResult: function(item) { // format items shown in the drop-down menu
+                    if (item.avatar) {
+                        return item.avatar + '<span class="text">' + item.name + '<br />' + item.text + '</span>';
+                    } else {
+                        return; // if no match, show nothing
+                    }
+                },
+                formatSelection: function(item) { // format selected item shown in the input
+                    return item.name || item.text; // if no name, show the email, i.e., when directly input, show the email
+                },
                 escapeMarkup: function(m) { return m; }
             });
 
@@ -114,7 +125,7 @@ define([
                 g_opts += '<option value="' + groups[i].id + '" data-index="' + i + '">' + groups[i].name + '</option>';
             }
             $('[name="group"]', $add_group_perm).html(g_opts).select2({
-                maximumSelectionSize: 1,
+                placeholder: gettext("Select groups"),
                 escapeMarkup: function(m) { return m; }
             });
         },
@@ -147,18 +158,22 @@ define([
                     'perm': perm
                 },
                 'after_op_success': function(data) {
-                    var perm_item = new FolderPermItemView({
-                        'repo_id': _this.repo_id,
-                        'path': _this.path,
-                        'item_data': {
-                            'user': email,
-                            'perm': perm,
-                            'is_user_perm': true
-                        }
+                    $(data.success).each(function(index, item) {
+                        var perm_item = new FolderPermItemView({
+                            'repo_id': _this.repo_id,
+                            'path': _this.path,
+                            'item_data': {
+                                'user': email,
+                                'user_name': item.user_name,
+                                'perm': perm,
+                                'is_user_perm': true
+                            }
+                        });
+                        form.after(perm_item.el);
                     });
-                    form.after(perm_item.el);
 
                     $('[name="email"]', form).select2("val", "");
+                    $('#user-folder-perm .error').addClass('hide');
                 },
                 'after_op_error': function(xhr) {
                     var err;
@@ -175,9 +190,8 @@ define([
         addGroupFolderPerm: function() {
             var _this = this;
             var form = this.$add_group_perm, // pseudo form
-                group_input = $('[name="group"]', form),
-                group_id = group_input.val()[0];
-            if (!group_id) {
+                group_ids = $('[name="group"]', form).val().join(',');
+            if (!group_ids) {
                 return false;
             }
 
@@ -192,21 +206,24 @@ define([
                 'post_data': {
                     'path': this.path,
                     'type': 'add',
-                    'group_id': group_id,
+                    'group_id': group_ids,
                     'perm': perm
                 },
                 'after_op_success': function(data) {
-                    var perm_item = new FolderPermItemView({
-                        'repo_id': _this.repo_id,
-                        'path': _this.path,
-                        'item_data': {
-                            'is_user_perm': false,
-                            'perm': perm,
-                            'group_id': group_id,
-                            'group_name': $('[name="group"]', form).select2('data')[0].text
-                        }
+                    $(data.success).each(function(index, item) {
+                        var perm_item = new FolderPermItemView({
+                            'repo_id': _this.repo_id,
+                            'path': _this.path,
+                            'item_data': {
+                                'is_user_perm': false,
+                                'perm': perm,
+                                'group_id': item.group_id,
+                                'group_name': item.group_name
+                            }
+                        });
+                        form.after(perm_item.el);
+                        $('#group-folder-perm .error').addClass('hide');
                     });
-                    form.after(perm_item.el);
 
                     $('[name="group"]', form).select2("val", "");
                 },
diff --git a/static/scripts/app/views/share.js b/static/scripts/app/views/share.js
index 944f10e1a4..fa8efd06be 100644
--- a/static/scripts/app/views/share.js
+++ b/static/scripts/app/views/share.js
@@ -409,19 +409,34 @@ define([
             var form = this.$('#file-private-share-form');
             loading_tip.show();
 
-            var contacts = app.pageOptions.contacts || [];
             $('[name="emails"]', form).select2({
-                placeholder: gettext("Select contacts or input"),
+                placeholder: gettext("Enter emails or select contacts"),
                 width: '400px',
                 // with 'tags', the user can directly enter, not just select
                 // tags need `<input type="hidden" />`, not `<select>`
                 tags: function () {
+                    var contacts = app.pageOptions.contacts || [];
                     var contact_list = [];
                     for (var i = 0, len = contacts.length; i < len; i++) {
-                        contact_list.push(contacts[i].email);
+                        contact_list.push({ // 'id' & 'text' are required by the plugin
+                            "id": contacts[i].email,
+                            "text": contacts[i].email,
+                            "avatar": contacts[i].avatar,
+                            "name": contacts[i].name
+                        });
                     }
                     return contact_list;
                 },
+                formatResult: function(item) { // format items shown in the drop-down menu
+                    if (item.avatar) {
+                        return item.avatar + '<span class="text">' + item.name + '<br />' + item.text + '</span>';
+                    } else {
+                        return; // if no match, show nothing
+                    }
+                },
+                formatSelection: function(item) { // format selected item shown in the input
+                    return item.name || item.text; // if no name, show the email, i.e., when directly input, show the email
+                },
                 tokenSeparators: [',', ' '],
                 escapeMarkup: function(m) { return m; }
             });
@@ -479,12 +494,28 @@ define([
                 placeholder: gettext("Select contacts or input"),
                 width: '400px',
                 tags: function () {
+                    var contacts = app.pageOptions.contacts || [];
                     var contact_list = [];
                     for (var i = 0, len = contacts.length; i < len; i++) {
-                        contact_list.push(contacts[i].email);
+                        contact_list.push({ // 'id' & 'text' are required by the plugin
+                            "id": contacts[i].email,
+                            "text": contacts[i].email,
+                            "avatar": contacts[i].avatar,
+                            "name": contacts[i].name
+                        });
                     }
                     return contact_list;
                 },
+                formatResult: function(item) { // format items shown in the drop-down menu
+                    if (item.avatar) {
+                        return item.avatar + '<span class="text">' + item.name + '<br />' + item.text + '</span>';
+                    } else {
+                        return; // if no match, show nothing
+                    }
+                },
+                formatSelection: function(item) { // format selected item shown in the input
+                    return item.name || item.text; // if no name, show the email, i.e., when directly input, show the email
+                },
                 tokenSeparators: [',', ' '],
                 escapeMarkup: function(m) { return m; }
             });