diff --git a/seahub/api2/endpoints/share_links.py b/seahub/api2/endpoints/share_links.py
index bda9c18594..e59fa78605 100644
--- a/seahub/api2/endpoints/share_links.py
+++ b/seahub/api2/endpoints/share_links.py
@@ -19,6 +19,7 @@ from pysearpc import SearpcError
 from seahub.api2.utils import api_error
 from seahub.api2.authentication import TokenAuthentication
 from seahub.api2.throttling import UserRateThrottle
+from seahub.api2.permissions import CanGenerateShareLink
 
 from seahub.share.models import FileShare, OrgFileShare
 from seahub.utils import gen_shared_link, is_org_context
@@ -75,13 +76,9 @@ def get_share_link_info(fileshare):
 class ShareLinks(APIView):
 
     authentication_classes = (TokenAuthentication, SessionAuthentication)
-    permission_classes = (IsAuthenticated,)
+    permission_classes = (IsAuthenticated, CanGenerateShareLink)
     throttle_classes = (UserRateThrottle,)
 
-    def _can_generate_shared_link(self, request):
-
-        return request.user.permissions.can_generate_shared_link()
-
     def _generate_obj_id_and_type_by_path(self, repo_id, path):
 
         file_id = seafile_api.get_file_id_by_path(repo_id, path)
@@ -101,10 +98,6 @@ class ShareLinks(APIView):
         1. default(NOT guest) user;
         """
 
-        if not self._can_generate_shared_link(request):
-            error_msg = 'Permission denied.'
-            return api_error(status.HTTP_403_FORBIDDEN, error_msg)
-
         # get all share links
         username = request.user.username
         fileshares = FileShare.objects.filter(username=username)
@@ -219,10 +212,6 @@ class ShareLinks(APIView):
             return api_error(status.HTTP_404_NOT_FOUND, error_msg)
 
         # permission check
-        if not self._can_generate_shared_link(request):
-            error_msg = 'Permission denied.'
-            return api_error(status.HTTP_403_FORBIDDEN, error_msg)
-
         if not check_folder_permission(request, repo_id, path):
             error_msg = 'Permission denied.'
             return api_error(status.HTTP_403_FORBIDDEN, error_msg)
@@ -250,13 +239,9 @@ class ShareLinks(APIView):
 class ShareLink(APIView):
 
     authentication_classes = (TokenAuthentication, SessionAuthentication)
-    permission_classes = (IsAuthenticated,)
+    permission_classes = (IsAuthenticated, CanGenerateShareLink)
     throttle_classes = (UserRateThrottle,)
 
-    def _can_generate_shared_link(self, request):
-
-        return request.user.permissions.can_generate_shared_link()
-
     def get(self, request, token):
         """ Get a special share link info.
 
@@ -264,10 +249,6 @@ class ShareLink(APIView):
         1. default(NOT guest) user;
         """
 
-        if not self._can_generate_shared_link(request):
-            error_msg = 'Permission denied.'
-            return api_error(status.HTTP_403_FORBIDDEN, error_msg)
-
         try:
             fs = FileShare.objects.get(token=token)
         except FileShare.DoesNotExist:
@@ -285,10 +266,6 @@ class ShareLink(APIView):
         2. link owner;
         """
 
-        if not self._can_generate_shared_link(request):
-            error_msg = 'Permission denied.'
-            return api_error(status.HTTP_403_FORBIDDEN, error_msg)
-
         try:
             fs = FileShare.objects.get(token=token)
         except FileShare.DoesNotExist:
diff --git a/seahub/api2/endpoints/upload_links.py b/seahub/api2/endpoints/upload_links.py
index c12b6dff49..e2c68aaa6e 100644
--- a/seahub/api2/endpoints/upload_links.py
+++ b/seahub/api2/endpoints/upload_links.py
@@ -17,6 +17,7 @@ from pysearpc import SearpcError
 from seahub.api2.utils import api_error
 from seahub.api2.authentication import TokenAuthentication
 from seahub.api2.throttling import UserRateThrottle
+from seahub.api2.permissions import CanGenerateUploadLink
 
 from seahub.share.models import UploadLinkShare
 from seahub.utils import gen_shared_upload_link
@@ -28,13 +29,9 @@ logger = logging.getLogger(__name__)
 class UploadLinks(APIView):
 
     authentication_classes = (TokenAuthentication, SessionAuthentication)
-    permission_classes = (IsAuthenticated,)
+    permission_classes = (IsAuthenticated, CanGenerateUploadLink)
     throttle_classes = (UserRateThrottle, )
 
-    def _can_generate_shared_link(self, request):
-
-        return request.user.permissions.can_generate_shared_link()
-
     def _get_upload_link_info(self, uls):
         data = {}
         token = uls.token
@@ -76,10 +73,6 @@ class UploadLinks(APIView):
         1. default(NOT guest) user;
         """
 
-        if not self._can_generate_shared_link(request):
-            error_msg = 'Permission denied.'
-            return api_error(status.HTTP_403_FORBIDDEN, error_msg)
-
         # get all upload links
         username = request.user.username
         upload_link_shares = UploadLinkShare.objects.filter(username=username)
@@ -166,11 +159,6 @@ class UploadLinks(APIView):
             error_msg = 'folder %s not found.' % path
             return api_error(status.HTTP_404_NOT_FOUND, error_msg)
 
-        # permission check
-        if not self._can_generate_shared_link(request):
-            error_msg = 'Permission denied.'
-            return api_error(status.HTTP_403_FORBIDDEN, error_msg)
-
         if check_folder_permission(request, repo_id, path) != 'rw':
             error_msg = 'Permission denied.'
             return api_error(status.HTTP_403_FORBIDDEN, error_msg)
@@ -187,13 +175,9 @@ class UploadLinks(APIView):
 class UploadLink(APIView):
 
     authentication_classes = (TokenAuthentication, SessionAuthentication)
-    permission_classes = (IsAuthenticated,)
+    permission_classes = (IsAuthenticated, CanGenerateUploadLink)
     throttle_classes = (UserRateThrottle, )
 
-    def _can_generate_shared_link(self, request):
-
-        return request.user.permissions.can_generate_shared_link()
-
     def get(self, request, token):
         """ Get upload link info.
 
@@ -201,10 +185,6 @@ class UploadLink(APIView):
         1. default(NOT guest) user;
         """
 
-        if not self._can_generate_shared_link(request):
-            error_msg = 'Permission denied.'
-            return api_error(status.HTTP_403_FORBIDDEN, error_msg)
-
         try:
             uls = UploadLinkShare.objects.get(token=token)
         except UploadLinkShare.DoesNotExist:
@@ -222,10 +202,6 @@ class UploadLink(APIView):
         2. link owner;
         """
 
-        if not self._can_generate_shared_link(request):
-            error_msg = 'Permission denied.'
-            return api_error(status.HTTP_403_FORBIDDEN, error_msg)
-
         try:
             uls = UploadLinkShare.objects.get(token=token)
         except UploadLinkShare.DoesNotExist:
diff --git a/seahub/api2/permissions.py b/seahub/api2/permissions.py
index 492d45d9e4..e307ed0d4b 100644
--- a/seahub/api2/permissions.py
+++ b/seahub/api2/permissions.py
@@ -26,7 +26,7 @@ class IsRepoWritable(BasePermission):
         if user and check_permission(repo_id, user) == 'rw':
             return True
         return False
-    
+
 class IsRepoAccessible(BasePermission):
     """
     Check whether user has Read or Write permission to a repo.
@@ -64,3 +64,15 @@ class CanInviteGuest(BasePermission):
     def has_permission(self, request, *args, **kwargs):
         return settings.ENABLE_GUEST_INVITATION and \
                 request.user.permissions.can_invite_guest()
+
+class CanGenerateShareLink(BasePermission):
+    """Check user has permission to generate share link.
+    """
+    def has_permission(self, request, *args, **kwargs):
+        return request.user.permissions.can_generate_share_link()
+
+class CanGenerateUploadLink(BasePermission):
+    """Check user has permission to generate upload link.
+    """
+    def has_permission(self, request, *args, **kwargs):
+        return request.user.permissions.can_generate_upload_link()
diff --git a/seahub/api2/serializers.py b/seahub/api2/serializers.py
index 03bdb66e25..6e520abcbd 100644
--- a/seahub/api2/serializers.py
+++ b/seahub/api2/serializers.py
@@ -1,11 +1,17 @@
 # Copyright (c) 2012-2016 Seafile Ltd.
+import logging
+
 from rest_framework import serializers
 
 from seahub.auth import authenticate
-from seahub.api2.models import Token, TokenV2, DESKTOP_PLATFORMS
+from seahub.api2.models import DESKTOP_PLATFORMS
 from seahub.api2.utils import get_token_v1, get_token_v2
 from seahub.profile.models import Profile
-from seahub.utils.two_factor_auth import has_two_factor_auth, two_factor_auth_enabled, verify_two_factor_token
+from seahub.utils.two_factor_auth import has_two_factor_auth, \
+        two_factor_auth_enabled, verify_two_factor_token
+from seahub.utils.user_permissions import populate_user_permissions
+
+logger = logging.getLogger(__name__)
 
 def all_none(values):
     for value in values:
@@ -72,6 +78,20 @@ class AuthTokenSerializer(serializers.Serializer):
         else:
             raise serializers.ValidationError('Must include "username" and "password"')
 
+        populate_user_permissions(user)
+
+        if platform in DESKTOP_PLATFORMS:
+            if not user.permissions.can_connect_with_desktop_clients():
+                raise serializers.ValidationError('Not allowed to connect to desktop client.')
+        elif platform == 'android':
+            if not user.permissions.can_connect_with_android_clients():
+                raise serializers.ValidationError('Not allowed to connect to android client.')
+        elif platform == 'ios':
+            if not user.permissions.can_connect_with_ios_clients():
+                raise serializers.ValidationError('Not allowed to connect to ios client.')
+        else:
+            logger.info('%s: unrecognized device' % login_id)
+
         self._two_factor_auth(self.context['request'], user)
 
         # Now user is authenticated
diff --git a/seahub/base/accounts.py b/seahub/base/accounts.py
index 4bc1fc1742..6bd428ce3c 100644
--- a/seahub/base/accounts.py
+++ b/seahub/base/accounts.py
@@ -110,8 +110,11 @@ class UserPermissions(object):
     def can_add_group(self):
         return get_enabled_role_permissions_by_role(DEFAULT_USER)['can_add_group']
 
-    def can_generate_shared_link(self):
-        return get_enabled_role_permissions_by_role(DEFAULT_USER)['can_generate_shared_link']
+    def can_generate_share_link(self):
+        return get_enabled_role_permissions_by_role(DEFAULT_USER)['can_generate_share_link']
+
+    def can_generate_upload_link(self):
+        return get_enabled_role_permissions_by_role(DEFAULT_USER)['can_generate_upload_link']
 
     def can_use_global_address_book(self):
         return get_enabled_role_permissions_by_role(DEFAULT_USER)['can_use_global_address_book']
diff --git a/seahub/role_permissions/settings.py b/seahub/role_permissions/settings.py
index d3bb3bcf59..94219cae5f 100644
--- a/seahub/role_permissions/settings.py
+++ b/seahub/role_permissions/settings.py
@@ -14,7 +14,8 @@ DEFAULT_ENABLED_ROLE_PERMISSIONS = {
         'can_add_group': True,
         'can_view_org': True,
         'can_use_global_address_book': True,
-        'can_generate_shared_link': True,
+        'can_generate_share_link': True,
+        'can_generate_upload_link': True,
         'can_invite_guest': False,
         # followings are not implemented yet
         'can_drag_drop_folder_to_sync': True,
diff --git a/seahub/settings.py b/seahub/settings.py
index 26d2020efa..a8f98f033d 100644
--- a/seahub/settings.py
+++ b/seahub/settings.py
@@ -517,15 +517,6 @@ ENABLE_FOLDER_PERM = False
 ####################
 # Role permissions #
 ####################
-# default permissions:
-# 'default': {
-#     'can_add_repo': True,
-#     'can_add_group': True,
-#     'can_view_org': True,
-#     'can_user_global_address_book': True,
-#     'can_generate_shared_link': True,
-#     'can_invite_guest': False,
-# }
 from seahub.constants import GUEST_USER
 ENABLED_ROLE_PERMISSIONS = {
     GUEST_USER: {
@@ -533,8 +524,12 @@ ENABLED_ROLE_PERMISSIONS = {
         'can_add_group': False,
         'can_view_org': False,
         'can_use_global_address_book': False,
-        'can_generate_shared_link': False,
+        'can_generate_share_link': False,
+        'can_generate_upload_link': False,
         'can_invite_guest': False,
+        'can_connect_with_android_clients': False,
+        'can_connect_with_ios_clients': False,
+        'can_connect_with_desktop_clients': False,
     },
 }
 
diff --git a/seahub/templates/js/templates.html b/seahub/templates/js/templates.html
index b75d423076..ae698ccddb 100644
--- a/seahub/templates/js/templates.html
+++ b/seahub/templates/js/templates.html
@@ -50,7 +50,7 @@
                     <% if (encrypted && enc_version == 2) { %>
                     <li><a class="op js-repo-change-password" href="#">{% trans "Change Password" %}</a></li>
                     <% } %>
-                    <% if (!encrypted) { %>
+                    <% if (!encrypted && (can_generate_share_link || can_generate_upload_link)) { %>
                     <li><a class="op js-popup-share-link-admin" href="#">{% trans "Share Links" %}</a></li>
                     <% } %>
                     <% if (app.pageOptions.folder_perm_enabled) { %>
@@ -134,7 +134,7 @@
     <button id="add-new-file" class="op-btn">{% trans "New File" %}</button>
     <% } %>
 
-    <% if (!encrypted && can_generate_shared_link) { %>
+    <% if (!encrypted) { %>
     <button class="op-btn" id="share-cur-dir">{% trans "Share" %}</button>
     <% } %>
     </div><!-- div#cur-dir-ops ends here -->
@@ -214,7 +214,7 @@
 
                 <a class="op-icon download sf2-icon-download sf2-x vh download-dir" href="#" title="{% trans "Download" %}" aria-label="{% trans "Download" %}"></a>
 
-                <% if (!repo_encrypted && can_generate_shared_link) { %>
+                <% if (!repo_encrypted) { %>
                     <a href="#" class="op-icon share sf2-icon-share sf2-x vh" title="{% trans "Share" %}" aria-label="{% trans "Share" %}"></a>
                 <% } %>
                 <% if (dirent.perm == 'rw') { %>
@@ -297,7 +297,7 @@
         <div class="op-container">
             <div class="displayed-op">
                 <a class="op-icon download sf2-icon-download sf2-x vh" href="<%= download_url %>" title="{% trans "Download" %}" aria-label="{% trans "Download" %}"></a>
-                <% if (!repo_encrypted && can_generate_shared_link) { %>
+                <% if (!repo_encrypted && can_generate_share_link) { %>
                 <a href="#" class="op-icon share sf2-icon-share sf2-x vh" title="{% trans "Share" %}" aria-label="{% trans "Share" %}"></a>
                 <% } %>
                 <% if (dirent.perm == 'rw') { %>
@@ -378,7 +378,7 @@
 <script type="text/template" id="grid-view-file-op-tmpl">
     <ul class="grid-item-op sf-dropdown-menu">
         <li><a class="op download" href="<%= download_url %>">{% trans "Download" %}</a></li>
-        <% if (!repo_encrypted && can_generate_shared_link) { %>
+        <% if (!repo_encrypted && can_generate_share_link) { %>
         <li><a class="op share" href="#">{% trans "Share" %}</a></li>
         <% } %>
         <% if (dirent.perm == 'rw') { %>
@@ -404,7 +404,7 @@
 <script type="text/template" id="grid-view-dir-op-tmpl">
     <ul class="grid-item-op sf-dropdown-menu">
         <li><a class="op download" href="<%= download_url %>">{% trans "Download" %}</a></li>
-        <% if (!repo_encrypted && can_generate_shared_link) { %>
+        <% if (!repo_encrypted) { %>
         <li><a class="op share" href="#">{% trans "Share" %}</a></li>
         <% } %>
         <% if (dirent.perm == 'rw') { %>
@@ -424,11 +424,11 @@
     <h3 class="hd" id="dialogTitle"><%= title %></h3>
     <div id="share-tabs" class="left-right-tabs ovhd">
         <ul class="left-right-tabs-nav fleft">
-            <% if (!repo_encrypted) { %>
+            <% if (!repo_encrypted && can_generate_share_link) { %>
             <li class="tab"><a href="#download-link-share" class="a">{% trans "Download Link" %}</a></li>
             <% } %>
             <% if (is_dir) { %>
-                <% if (user_perm == 'rw' && !repo_encrypted) { %>
+                <% if (user_perm == 'rw' && !repo_encrypted && can_generate_upload_link) { %>
             <li class="tab"><a href="#dir-upload-link-share" class="a">{% trans "Upload Link" %}</a></li>
                 <% } %>
             <% if (!is_virtual && is_repo_owner) { %> {# dir private share #}
@@ -440,7 +440,7 @@
 
         <div class="fright">
             <span class="loading-icon loading-tip"></span>
-            <% if (!repo_encrypted) { %>
+            <% if (!repo_encrypted && can_generate_share_link) { %>
             <div id="download-link-share" class="tabs-panel">
                 <form id="generate-download-link-form" action="" class="hide">
                     <label class="checkbox-label">
@@ -494,7 +494,7 @@
             <% } %>
 
             <% if (is_dir) { %>
-                <% if (user_perm == 'rw' && !repo_encrypted) { %>
+                <% if (user_perm == 'rw' && !repo_encrypted && can_generate_upload_link) { %>
             <div id="dir-upload-link-share" class="tabs-panel hide">
                 <p class="tip">{% trans "You can share the generated link to others and then they can upload files to this directory via the link." %}</p>
                 <form id="generate-upload-link-form" action="" class="hide">
@@ -711,9 +711,15 @@
             <a href="{{ SITE_ROOT }}#share-admin-folders/"><span aria-hidden="true" class="sf2-icon-folder"></span>{% trans "Folders" %}</a>
         </li>
         <% } %>
+        <% if (can_generate_share_link) { %>
         <li class="tab<% if (cur_tab == 'share-admin-links') { %> tab-cur<% } %>">
             <a href="{{ SITE_ROOT }}#share-admin-share-links/"><span aria-hidden="true" class="sf2-icon-link"></span>{% trans "Links" %}</a>
         </li>
+        <% } else if (can_generate_upload_link) { %>
+        <li class="tab<% if (cur_tab == 'share-admin-links') { %> tab-cur<% } %>">
+            <a href="{{ SITE_ROOT }}#share-admin-upload-links/"><span aria-hidden="true" class="sf2-icon-link"></span>{% trans "Links" %}</a>
+        </li>
+        <% } %>
     </ul>
     </div>
     <div class="side-nav-footer ovhd" role="contentinfo">
@@ -1219,11 +1225,16 @@
     <h3 id="dialogTitle"><%= title %></h3>
     <div id="repo-shared-links" class="left-right-tabs js-tabs ovhd">
         <ul class="left-right-tabs-nav fleft">
+            <% if (can_generate_share_link) { %>
             <li class="tab"><a href="#js-download-links" class="a">{% trans "Download Links" %}</a></li>
+            <% } %>
+            <% if (can_generate_upload_link) { %>
             <li class="tab"><a href="#js-upload-links" class="a">{% trans "Upload Links" %}</a></li>
+            <% } %>
         </ul>
 
         <div class="fright">
+            <% if (can_generate_share_link) { %>
             <div id="js-download-links" class="tabs-panel">
                 <table>
                     <thead>
@@ -1241,6 +1252,8 @@
                 <span class="loading-icon loading-tip"></span>
                 <p class="error hide"></p>
             </div>
+            <% } %>
+            <% if (can_generate_upload_link) { %>
             <div id="js-upload-links" class="tabs-panel hide">
                 <table>
                     <thead>
@@ -1258,6 +1271,7 @@
                 <span class="loading-icon loading-tip"></span>
                 <p class="error hide"></p>
             </div>
+            <% } %>
         </div>
     </div>
 </script>
@@ -1586,9 +1600,11 @@
             <li class="tab ui-state-active">
                 <a href="#share-admin-share-links/" class="a">{% trans "Download Links" %}</a>
             </li>
+            <% if (can_generate_upload_link) { %>
             <li class="tab">
                 <a href="#share-admin-upload-links/" class="a">{% trans "Upload Links" %}</a>
             </li>
+            <% } %>
         </ul>
     </div>
     <span class="loading-icon loading-tip"></span>
@@ -1616,9 +1632,11 @@
 <script type="text/template" id="share-admin-upload-links-tmpl">
     <div class="hd ovhd">
         <ul class="tab-tabs-nav fleft">
+            <% if (can_generate_share_link) { %>
             <li class="tab">
                 <a href="#share-admin-share-links/" class="a">{% trans "Download Links" %}</a>
             </li>
+            <% } %>
             <li class="tab ui-state-active">
                 <a href="#share-admin-upload-links/" class="a">{% trans "Upload Links" %}</a>
             </li>
@@ -1652,7 +1670,7 @@
     <td><%= view_cnt %></td>
     <% if (expire_date) { %>
         <% if (is_expired) { %>
-        <td class='error'><%= time %></td>
+        <td class="error"><%= time %></td>
         <% } else { %>
         <td><%= time %></td>
         <% } %>
diff --git a/seahub/templates/libraries.html b/seahub/templates/libraries.html
index 4e3801fba1..6d21802c2c 100644
--- a/seahub/templates/libraries.html
+++ b/seahub/templates/libraries.html
@@ -241,7 +241,8 @@ app["pageOptions"] = {
     contact_email: "{{ request.user.username|email2contact_email|escapejs }}",
     events_enabled: {% if events_enabled %} true {% else %} false {% endif %},
     can_add_repo: {% if user.permissions.can_add_repo %} true {% else %} false {% endif %},
-    can_generate_shared_link: {% if user.permissions.can_generate_shared_link %} true {% else %} false {% endif %},
+    can_generate_share_link: {% if user.permissions.can_generate_share_link %} true {% else %} false {% endif %},
+    can_generate_upload_link: {% if user.permissions.can_generate_upload_link %} true {% else %} false {% endif %},
     is_staff: {% if request.user.is_staff %} true {% else %} false {% endif %},
     repo_password_min_length: {{ repo_password_min_length }},
     share_link_password_min_length: {{ share_link_password_min_length }},
diff --git a/seahub/templates/view_file_base.html b/seahub/templates/view_file_base.html
index df48f9a435..61be0ba9a3 100644
--- a/seahub/templates/view_file_base.html
+++ b/seahub/templates/view_file_base.html
@@ -65,7 +65,7 @@
             {% endif %}
 
             {% if not repo.encrypted %}
-            {% if request.user.permissions.can_generate_shared_link %}
+            {% if request.user.permissions.can_generate_share_link %}
             <button id="share" class="sf-btn-group-btn op-icon sf2-icon-share" data-link="{{ file_shared_link }}" data-token="{{ fileshare.token }}" title="{% trans "Share" %}"></button>
             {% endif %}
             {% endif %}
diff --git a/seahub/views/sysadmin.py b/seahub/views/sysadmin.py
index 19fac02df2..406e6f3dff 100644
--- a/seahub/views/sysadmin.py
+++ b/seahub/views/sysadmin.py
@@ -1482,10 +1482,10 @@ def user_search(request):
         _populate_user_quota_usage(user)
 
         # check user's role
-        if user.role == GUEST_USER:
-            user.is_guest = True
-        else:
-            user.is_guest = False
+        user.is_guest = True if get_user_role(user) == GUEST_USER else False
+        user.is_default = True if get_user_role(user) == DEFAULT_USER else False
+        extra_user_roles = [x for x in get_available_roles()
+                            if x not in get_basic_user_roles()]
 
         # populate user last login time
         user.last_login = None
@@ -1504,6 +1504,7 @@ def user_search(request):
             'default_user': DEFAULT_USER,
             'guest_user': GUEST_USER,
             'is_pro': is_pro_version(),
+            'extra_user_roles': extra_user_roles,
             }, context_instance=RequestContext(request))
 
 @login_required
diff --git a/static/scripts/app/views/dialogs/repo-share-link-admin.js b/static/scripts/app/views/dialogs/repo-share-link-admin.js
index e1c83dcba8..c5fde5d356 100644
--- a/static/scripts/app/views/dialogs/repo-share-link-admin.js
+++ b/static/scripts/app/views/dialogs/repo-share-link-admin.js
@@ -35,18 +35,25 @@ define([
             uploadLinks.link_type = 'upload';
             this.$uploadLinksPanel = this.$('#js-upload-links');
 
-            this.renderLinksPanel({
-                links: downloadLinks,
-                $panel: this.$downloadLinksPanel
-            });
-            this.renderLinksPanel({
-                links: uploadLinks,
-                $panel: this.$uploadLinksPanel
-            });
+            if (app.pageOptions.can_generate_share_link) {
+                this.renderLinksPanel({
+                    links: downloadLinks,
+                    $panel: this.$downloadLinksPanel
+                });
+            }
+
+            if (app.pageOptions.can_generate_upload_link) {
+                this.renderLinksPanel({
+                    links: uploadLinks,
+                    $panel: this.$uploadLinksPanel
+                });
+            }
         },
 
         render: function() {
             this.$el.html(this.template({
+                can_generate_share_link: app.pageOptions.can_generate_share_link,
+                can_generate_upload_link: app.pageOptions.can_generate_upload_link,
                 title: gettext("{placeholder} Share Links")
                     .replace('{placeholder}',
                     '<span class="op-target ellipsis ellipsis-op-target" title="'
@@ -71,6 +78,7 @@ define([
                 },
                 error: function(collection, response, opts) {
                     $loadingTip.hide();
+                    var err_msg;
                     if (response.responseText) {
                         if (response['status'] == 401 || response['status'] == 403) {
                             err_msg = gettext("Permission error");
diff --git a/static/scripts/app/views/dir.js b/static/scripts/app/views/dir.js
index a3aa3df724..28d440ace1 100644
--- a/static/scripts/app/views/dir.js
+++ b/static/scripts/app/views/dir.js
@@ -439,7 +439,6 @@ define([
                     path: dir.path,
                     repo_id: dir.repo_id,
                     site_root: app.pageOptions.site_root,
-                    can_generate_shared_link: app.pageOptions.can_generate_shared_link,
                     enable_upload_folder: app.pageOptions.enable_upload_folder
                 })));
             },
diff --git a/static/scripts/app/views/dirent-grid.js b/static/scripts/app/views/dirent-grid.js
index aa5920e4a8..48589b88db 100644
--- a/static/scripts/app/views/dirent-grid.js
+++ b/static/scripts/app/views/dirent-grid.js
@@ -52,7 +52,6 @@ define([
                 category: dir.category,
                 repo_id: dir.repo_id,
                 is_repo_owner: dir.is_repo_owner,
-                can_generate_shared_link: app.pageOptions.can_generate_shared_link,
                 is_pro: app.pageOptions.is_pro,
                 repo_encrypted: dir.encrypted
             }));
@@ -114,7 +113,7 @@ define([
                 category: dir.category,
                 repo_id: dir.repo_id,
                 is_repo_owner: dir.is_repo_owner,
-                can_generate_shared_link: app.pageOptions.can_generate_shared_link,
+                can_generate_share_link: app.pageOptions.can_generate_share_link,
                 is_pro: app.pageOptions.is_pro,
                 repo_encrypted: dir.encrypted
             });
diff --git a/static/scripts/app/views/dirent.js b/static/scripts/app/views/dirent.js
index 2f1a57a8ee..7913c3d3c1 100644
--- a/static/scripts/app/views/dirent.js
+++ b/static/scripts/app/views/dirent.js
@@ -53,7 +53,7 @@ define([
                 category: dir.category,
                 repo_id: dir.repo_id,
                 is_repo_owner: dir.is_repo_owner,
-                can_generate_shared_link: app.pageOptions.can_generate_shared_link,
+                can_generate_share_link: app.pageOptions.can_generate_share_link,
                 is_pro: is_pro,
                 file_audit_enabled: file_audit_enabled,
                 repo_encrypted: dir.encrypted
diff --git a/static/scripts/app/views/repo.js b/static/scripts/app/views/repo.js
index 5b5047aac0..2aa519e935 100644
--- a/static/scripts/app/views/repo.js
+++ b/static/scripts/app/views/repo.js
@@ -45,7 +45,9 @@ define([
             var icon_url = this.model.getIconUrl(icon_size);
             _.extend(obj, {
                 'icon_url': icon_url,
-                'icon_title': this.model.getIconTitle()
+                'icon_title': this.model.getIconTitle(),
+                'can_generate_share_link': app.pageOptions.can_generate_share_link,
+                'can_generate_upload_link': app.pageOptions.can_generate_upload_link
             });
             this.$el.html(this.template(obj));
             this.dropdown = new DropdownView({
@@ -59,7 +61,7 @@ define([
             var repo_name = this.model.get('name');
             var popupTitle = gettext("Delete Library");
             var popupContent = gettext("Are you sure you want to delete %s ?").replace('%s', '<span class="op-target ellipsis ellipsis-op-target">' + Common.HTMLescape(repo_name) + '</span>');
-            var yesCallback = function() { 
+            var yesCallback = function() {
                 $.ajax({
                     url: Common.getUrl({'name':'repo', 'repo_id': _this.model.get('id')}),
                     type: 'DELETE',
diff --git a/static/scripts/app/views/share-admin-share-links.js b/static/scripts/app/views/share-admin-share-links.js
index db550d5452..b0df314524 100644
--- a/static/scripts/app/views/share-admin-share-links.js
+++ b/static/scripts/app/views/share-admin-share-links.js
@@ -108,7 +108,7 @@ define([
         },
 
         render: function() {
-            this.$el.html(this.template());
+            this.$el.html(this.template({'can_generate_upload_link': app.pageOptions.can_generate_upload_link}));
             this.$table = this.$('table');
             this.$sortByNameIcon = this.$('.by-name .sort-icon');
             this.$sortByTimeIcon = this.$('.by-time .sort-icon');
@@ -145,10 +145,10 @@ define([
                             err_msg = gettext("Permission error");
                         } else {
                             err_msg = gettext("Error");
-                        }   
+                        }
                     } else {
                         err_msg = gettext('Please check the network.');
-                    }   
+                    }
                     $error.html(err_msg).show();
                 }
             });
diff --git a/static/scripts/app/views/share-admin-upload-links.js b/static/scripts/app/views/share-admin-upload-links.js
index 405539bc50..c0a32302bc 100644
--- a/static/scripts/app/views/share-admin-upload-links.js
+++ b/static/scripts/app/views/share-admin-upload-links.js
@@ -24,7 +24,7 @@ define([
         },
 
         render: function() {
-            this.$el.html(this.template());
+            this.$el.html(this.template({'can_generate_share_link': app.pageOptions.can_generate_share_link}));
             this.$table = this.$('table');
             this.$tableBody = $('tbody', this.$table);
             this.$loadingTip = this.$('.loading-tip');
@@ -59,10 +59,10 @@ define([
                             err_msg = gettext("Permission error");
                         } else {
                             err_msg = gettext("Error");
-                        }   
+                        }
                     } else {
                         err_msg = gettext('Please check the network.');
-                    }   
+                    }
                     $error.html(err_msg).show();
                 }
             });
diff --git a/static/scripts/app/views/share.js b/static/scripts/app/views/share.js
index 2857297af6..a00c8008db 100644
--- a/static/scripts/app/views/share.js
+++ b/static/scripts/app/views/share.js
@@ -29,11 +29,11 @@ define([
 
             this.$("#share-tabs").tabs();
 
-            if (!this.repo_encrypted) {
+            if (!this.repo_encrypted && app.pageOptions.can_generate_share_link) {
                 this.downloadLinkPanelInit();
             }
             if (this.is_dir) {
-                if (this.user_perm == 'rw' && !this.repo_encrypted) {
+                if (this.user_perm == 'rw' && !this.repo_encrypted && app.pageOptions.can_generate_upload_link) {
                     this.uploadLinkPanelInit();
                 }
                 if (!this.is_virtual && this.is_repo_owner) {
@@ -61,6 +61,8 @@ define([
                 is_virtual: this.is_virtual,
                 user_perm: this.user_perm,
                 repo_id: this.repo_id,
+                can_generate_share_link: app.pageOptions.can_generate_share_link,
+                can_generate_upload_link: app.pageOptions.can_generate_upload_link,
                 repo_encrypted: this.repo_encrypted
             }));
 
diff --git a/static/scripts/app/views/side-nav.js b/static/scripts/app/views/side-nav.js
index f6fde9f692..c0af3cb7c4 100644
--- a/static/scripts/app/views/side-nav.js
+++ b/static/scripts/app/views/side-nav.js
@@ -25,7 +25,9 @@ define([
                 'show_group_list': this.group_expanded, // when cur_tab is not 'group'
                 'groups': app.pageOptions.groups,
                 'mods_enabled': app.pageOptions.user_mods_enabled,
-                'can_add_repo': app.pageOptions.can_add_repo
+                'can_add_repo': app.pageOptions.can_add_repo,
+                'can_generate_share_link': app.pageOptions.can_generate_share_link,
+                'can_generate_upload_link': app.pageOptions.can_generate_upload_link
             };
             var _this = this;
             $('#js-toggle-side-nav').click(function() {
diff --git a/tests/api/apitestbase.py b/tests/api/apitestbase.py
index 597c406580..6b3dd553b0 100644
--- a/tests/api/apitestbase.py
+++ b/tests/api/apitestbase.py
@@ -206,6 +206,9 @@ def get_auth_token(username, password):
     data = {
         'username': username,
         'password': password,
+        'platform': 'linux',
+        'device_id': '701143c1238e6736b61c20e73de82fc95989c413',
+        'device_name': 'test',
     }
     res = requests.post(TOKEN_URL, data=data)
     assert_equal(res.status_code, 200)
diff --git a/tests/api/endpoints/test_share_links.py b/tests/api/endpoints/test_share_links.py
index 2b2bf91abf..1750f5b0be 100644
--- a/tests/api/endpoints/test_share_links.py
+++ b/tests/api/endpoints/test_share_links.py
@@ -5,7 +5,7 @@ from mock import patch
 from django.core.urlresolvers import reverse
 from seahub.test_utils import BaseTestCase
 from seahub.share.models import FileShare
-from seahub.api2.endpoints.share_links import ShareLinks, ShareLink
+from seahub.api2.permissions import CanGenerateShareLink
 
 try:
     from seahub.settings import LOCAL_PRO_DEV_ENV
@@ -79,10 +79,10 @@ class ShareLinksTest(BaseTestCase):
 
         self._remove_share_link(token)
 
-    @patch.object(ShareLinks, '_can_generate_shared_link')
-    def test_get_link_with_invalid_user_role_permission(self, mock_can_generate_shared_link):
+    @patch.object(CanGenerateShareLink, 'has_permission')
+    def test_get_link_with_invalid_user_role_permission(self, mock_has_permission):
         self.login_as(self.user)
-        mock_can_generate_shared_link.return_value = False
+        mock_has_permission.return_value = False
 
         resp = self.client.get(self.url)
         self.assertEqual(403, resp.status_code)
@@ -174,10 +174,10 @@ class ShareLinksTest(BaseTestCase):
         resp = self.client.post(self.url, data)
         self.assertEqual(200, resp.status_code)
 
-    @patch.object(ShareLinks, '_can_generate_shared_link')
-    def test_create_link_with_invalid_urer_role_permission(self, mock_can_generate_shared_link):
+    @patch.object(CanGenerateShareLink, 'has_permission')
+    def test_create_link_with_invalid_user_role_permission(self, mock_has_permission):
         self.login_as(self.user)
-        mock_can_generate_shared_link.return_value = False
+        mock_has_permission.return_value = False
 
         resp = self.client.post(self.url, {'path': self.folder_path, 'repo_id': self.repo_id})
         self.assertEqual(403, resp.status_code)
@@ -210,12 +210,12 @@ class ShareLinksTest(BaseTestCase):
         resp = self.client.delete(url, {}, 'application/x-www-form-urlencoded')
         self.assertEqual(403, resp.status_code)
 
-    @patch.object(ShareLink, '_can_generate_shared_link')
-    def test_delete_link_with_invalid_user_repo_permission(self, mock_can_generate_shared_link):
+    @patch.object(CanGenerateShareLink, 'has_permission')
+    def test_delete_link_with_invalid_user_repo_permission(self, mock_has_permission):
         token = self._add_file_share_link()
 
         self.login_as(self.user)
-        mock_can_generate_shared_link.return_value = False
+        mock_has_permission.return_value = False
 
         url = reverse('api-v2.1-share-link', args=[token])
         resp = self.client.delete(url, {}, 'application/x-www-form-urlencoded')
diff --git a/tests/api/endpoints/test_upload_links.py b/tests/api/endpoints/test_upload_links.py
index 5bb0e59348..c8d15777df 100644
--- a/tests/api/endpoints/test_upload_links.py
+++ b/tests/api/endpoints/test_upload_links.py
@@ -5,7 +5,7 @@ from mock import patch
 from django.core.urlresolvers import reverse
 from seahub.test_utils import BaseTestCase
 from seahub.share.models import UploadLinkShare
-from seahub.api2.endpoints.upload_links import UploadLinks, UploadLink
+from seahub.api2.permissions import CanGenerateUploadLink
 
 try:
     from seahub.settings import LOCAL_PRO_DEV_ENV
@@ -51,10 +51,10 @@ class UploadLinksTest(BaseTestCase):
 
         self._remove_upload_link(token)
 
-    @patch.object(UploadLinks, '_can_generate_shared_link')
-    def test_get_link_with_invalid_user_role_permission(self, mock_can_generate_shared_link):
+    @patch.object(CanGenerateUploadLink, 'has_permission')
+    def test_get_link_with_invalid_user_role_permission(self, mock_has_permission):
         self.login_as(self.user)
-        mock_can_generate_shared_link.return_value = False
+        mock_has_permission.return_value = False
 
         resp = self.client.get(self.url)
         self.assertEqual(403, resp.status_code)
@@ -74,10 +74,10 @@ class UploadLinksTest(BaseTestCase):
 
         self._remove_upload_link(json_resp['token'])
 
-    @patch.object(UploadLinks, '_can_generate_shared_link')
-    def test_create_link_with_invalid_user_role_permission(self, mock_can_generate_shared_link):
+    @patch.object(CanGenerateUploadLink, 'has_permission')
+    def test_create_link_with_invalid_user_role_permission(self, mock_has_permission):
         self.login_as(self.user)
-        mock_can_generate_shared_link.return_value = False
+        mock_has_permission.return_value = False
 
         resp = self.client.post(self.url, {'path': self.folder_path, 'repo_id': self.repo_id})
         self.assertEqual(403, resp.status_code)
@@ -145,12 +145,12 @@ class UploadLinksTest(BaseTestCase):
         json_resp = json.loads(resp.content)
         assert json_resp['success'] is True
 
-    @patch.object(UploadLink, '_can_generate_shared_link')
-    def test_delete_link_with_invalid_user_role_permission(self, mock_can_generate_shared_link):
+    @patch.object(CanGenerateUploadLink, 'has_permission')
+    def test_delete_link_with_invalid_user_role_permission(self, mock_has_permission):
         token = self._add_upload_link()
 
         self.login_as(self.user)
-        mock_can_generate_shared_link.return_value = False
+        mock_has_permission.return_value = False
 
         url = reverse('api-v2.1-upload-link', args=[token])
         resp = self.client.delete(url, {}, 'application/x-www-form-urlencoded')
diff --git a/tests/api/test_obtain_auth_token.py b/tests/api/test_obtain_auth_token.py
index 771c7798aa..8d62ee913b 100644
--- a/tests/api/test_obtain_auth_token.py
+++ b/tests/api/test_obtain_auth_token.py
@@ -15,6 +15,9 @@ class ObtainAuthTokenTest(BaseTestCase):
         resp = self.client.post(TOKEN_URL, {
             'username': self.user.username,
             'password': self.user_password,
+            'platform': 'linux',
+            'device_id': '701143c1238e6736b61c20e73de82fc95989c413',
+            'device_name': 'test',
         })
 
         json_resp = json.loads(resp.content)
@@ -26,6 +29,9 @@ class ObtainAuthTokenTest(BaseTestCase):
         resp = self.client.post(TOKEN_URL, {
             'username': self.p.login_id,
             'password': self.user_password,
+            'platform': 'linux',
+            'device_id': '701143c1238e6736b61c20e73de82fc95989c413',
+            'device_name': 'test',
         })
 
         json_resp = json.loads(resp.content)
diff --git a/tests/api/test_serializers.py b/tests/api/test_serializers.py
index 70098c6d8a..237b640e95 100644
--- a/tests/api/test_serializers.py
+++ b/tests/api/test_serializers.py
@@ -9,6 +9,9 @@ class AuthTokenSerializerTest(BaseTestCase):
         s = AuthTokenSerializer(data={
             'username': self.user.username,
             'password': self.user_password,
+            'platform': 'linux',
+            'device_id': '701143c1238e6736b61c20e73de82fc95989c413',
+            'device_name': 'test',
         }, context={'request': self.fake_request})
         assert s.is_valid() is True
 
@@ -19,5 +22,8 @@ class AuthTokenSerializerTest(BaseTestCase):
         s = AuthTokenSerializer(data={
             'username': self.user.username,
             'password': self.user_password,
+            'platform': 'linux',
+            'device_id': '701143c1238e6736b61c20e73de82fc95989c413',
+            'device_name': 'test',
         }, context={'request': self.fake_request})
         assert s.is_valid() is True
diff --git a/tests/seahub/base/test_accounts.py b/tests/seahub/base/test_accounts.py
index 89b81d583a..fd84c23353 100644
--- a/tests/seahub/base/test_accounts.py
+++ b/tests/seahub/base/test_accounts.py
@@ -21,7 +21,8 @@ class UserPermissionsTest(BaseTestCase):
     def test_permissions(self):
         assert self.user.permissions.can_add_repo() is True
         assert self.user.permissions.can_add_group() is True
-        assert self.user.permissions.can_generate_shared_link() is True
+        assert self.user.permissions.can_generate_share_link() is True
+        assert self.user.permissions.can_generate_upload_link() is True
         assert self.user.permissions.can_use_global_address_book() is True
         assert self.user.permissions.can_view_org() is True
         assert self.user.permissions.can_drag_drop_folder_to_sync() is True