diff --git a/xCAT-web-exp/functions.php b/xCAT-web-exp/functions.php
new file mode 100644
index 000000000..b1bddd0d5
--- /dev/null
+++ b/xCAT-web-exp/functions.php
@@ -0,0 +1,316 @@
+<?php
+# cat client-key.pem client-cert.pem ca.pem >>certchain.pem
+$version = "0.1";
+#$cert = ".xcat/client-cred.pem";
+$msg;
+$xcathost = "localhost";
+$port = "3001";
+
+#if(! file_exists($cert)){
+#	echo "$cert does not exist.  Please run xcatwebsetup first";
+#}
+
+
+$xcatcmds = array(
+	"rpower" => array("on","off","reset","stat","state","boot","off","cycle"),
+	"rvitals" => array("all","temp","wattage","voltage","fanspeed","power","leds","state"),
+	"reventlog" => array("all", "clear"),
+	"rinv" => array("all", "model", "serial", "vpd", "mprom", "deviceid", "uuid", "guid", "firm", "bios", "diag", "mprom", "sprom", "mparom", "mac", "mtm"),
+	"resetboot" => array("net", "hd", "cd", "def", "stat")
+);
+
+#function to enable password storage to split between cookie and session variable
+function xorcrypt($data,$key) {
+    $datalen=strlen($data);
+    $keylen=strlen($key);
+    for ($i=0;$i<$datalen;$i++) {
+        $data[$i]=chr(ord($data[$i])^ord($key[$i]));
+    }
+    return $data;
+}
+
+function getpassword() {
+    if (isset($GLOBALS['xcatauthsecret'])) {
+        $cryptext=$GLOBALS['xcatauthsecret'];
+    } else if (isset($_COOKIE["xcatauthsecret"])) {
+        $cryptext = $_COOKIE["xcatauthsecret"];
+    } else {
+        return false;
+    }
+    return xorcrypt($_SESSION["secretkey"],base64_decode($cryptext));
+}
+
+#remembers the password, splitting knowledge between server and client side
+#persistant storage
+#Caller should regenerate session id when contemplating a new user/password,
+#to preclude session fixation, though fixation is limited without the secret.
+function setpassword($password) {
+    $randlen=strlen($password);
+    $key=getrandchars($randlen);
+    $cryptext=xorcrypt($password,$key);
+    $cryptext=base64_encode($cryptext); #non-ascii chars, base64 it
+#Not bothering with explicit expiration, as time sync would be too hairy
+#should go away when browser closes.  Any timeout will be handled server 
+#side.  If the session id invalidates and the one-time key discarded,
+#the cookie contents are worthless anyway
+#nevertheless, when logout happens, cookie should be reaped
+    setcookie("xcatauthsecret",$cryptext);
+    $GLOBALS["xcatauthsecret"]=$cryptext; #May need it sooner, prefer globals
+    $_SESSION["secretkey"]=$key;
+}
+
+function getrandchars($length) {
+    $charset='0123456789abcdefghijklmnopqrstuvwxyz!@#$%^&*';
+    $charsize=strlen($charset);
+    srand();
+    $chars='';
+    for ($i=0;$i<$length;$i++) {
+        $num=rand()%$charsize;
+        $chars=$chars.substr($charset,$num,1);
+    }
+    return $chars;
+}
+        
+    
+    
+
+
+#functions for editing tables
+function savexCATchanges($file, $tab){
+	$request = simplexml_load_string('<xcatrequest></xcatrequest>');
+	$request->addChild('command','tabrestore');
+	$fh = fopen($file, 'r') or die("can't open $file");
+	while(!feof($fh)){
+		$line = fgets($fh,4096);
+		if(empty($line)){
+			continue;	
+		}
+		$line = str_replace("\"\"", "",$line);
+		$line = str_replace("\"", "&quot;",$line);
+		$request->addChild('data', $line);
+	}
+	fclose($fh);
+	$request->addChild('table',$tab);
+	$resp = submit_request($request, 1);
+	# 0 means it didn't work
+	return($resp);
+}
+
+function splitTableFields($arr){
+	$fields = array();
+	$fields = explode(',', $arr);
+	$rf = array();
+
+	# now we have to do damage control for fields that look like this:
+  # "idplx15","idplx,ipmi,compute,all",,,
+	$inc = '';
+	foreach($fields as $f){
+		#if(ereg("\"[a-zA-Z0-9\-\.\:\!\| ]+\"", $f)){
+		if(ereg("\"[^\"]+\"", $f)){
+			$rf[] = $f;
+			continue;
+		}
+		#if(ereg("^[a-zA-Z0-9\-\. ]+\"", $f)){
+		if(ereg("[^\"]+\"", $f)){
+			$inc .= ",$f";
+			$rf[] = $inc;
+			$inc = '';
+			continue;
+		}
+		#if(ereg("\"[a-zA-Z0-9\-\. ]+", $f)){
+		if(ereg("\"[^\"]+", $f)){
+			$inc .= $f;	
+			continue;
+		}
+		#if(ereg("[a-zA-Z0-9\-\. ]+", $f)){
+		if(ereg("[a-zA-Z0-9\-\. ]+", $f)){
+			$inc .= ",$f";
+			continue;
+		}
+		$rf[] = "";
+	}
+	return $rf;
+}
+
+
+function getTabNames() {
+	$xml = docmd('tabdump','','');
+	$tabs = $xml->xcatresponse->children();
+	return $tabs;
+}
+
+function getTabHeaders($tab){
+	$arr = $tab->xcatresponse->children();
+	$line = $arr[0];
+	$headers = array();
+	$headers = explode(',', $line);
+	return $headers;
+
+}
+
+
+# get the keys of the hash table.
+function keysByNodeName($ht) {
+	$nh = array();
+	foreach($ht->xcatresponse as $v){
+		$node = (string) $v->node->name;
+		if(!array_key_exists($node, $nh)){
+			$nh[$node] = array();
+		}
+		$desc = (string) $v->node->data->desc;
+		$cont = (string) $v->node->data->contents;
+		$nh[$node][$desc] = $cont;
+	}
+	return($nh);	
+}
+
+function attributesOfNodes($ht) {
+	$arr = array();
+	foreach($ht->xcatresponse as $v){
+		foreach($v->node as $va){
+			$val = (string) $va->data->desc;
+			if($val == ""){
+				$val = (string) $va->data->contents;
+			}
+			$arr[] = $val;
+		}
+	}
+	$arr = array_unique($arr);
+	return($arr);	
+}
+
+function parseNodeGroups ($groups){
+	# groups is an array that may have duplicate commas in them.
+	$arr = array();	
+	foreach($groups as $gline){
+		$newg = explode(',', $gline);
+		foreach($newg as $g){
+			if(empty($g)){ continue; }
+			if(!array_key_exists($g, $arr)){
+				$arr[] = $g;
+			}
+		}		
+	}
+	return array_unique($arr);
+}
+
+# this is a kluge... should make better data structures.
+# but too lazy right now...
+function addNodesToGroups($groups, $node){
+	$arr = array();
+	foreach($groups as $g){
+		$arr[$g] = array();
+		foreach($node->xcatresponse	as $v){
+			foreach($v->node as $n){
+				$na = (string) $n->data->contents;	
+				$nag = explode(',', $na);
+				foreach($nag as $foo){
+					if(strcmp($foo,$g) == 0){
+						$name = (string) $n->name;
+						$arr[$g][] =  $name;
+						continue;
+					}
+				}
+			}
+		}
+	}
+	return $arr;
+}
+
+function is_logged() {
+    if (isset($_SESSION["username"]) and !is_bool(getpassword())) {
+        return true;
+    } else {
+        return false;
+    }
+}
+function logout() {
+    #clear the secret cookie from browser.
+    #expire cookie a week ago, server time, may not work if client clock way off, but the value will be cleared at least.
+    if (isset($_COOKIE["xcatauthsecret"])) {
+        setcookie("xcatauthsecret",'',time()-86400*7); #NOTE: though firefox doesn't seem to zap it dynamically from cookie store in
+    #the client side dialog, firefox does stop submitting the value.  The sensitivity of the 'stale' cookie even if compromised
+    #is negligible, as the session id will be invalidated and the one-time-key needed to decrypt the password is destroyed on the server
+    }
+    #expire the sesion cookie
+    if (isset($_COOKIE[session_name()])) {
+        setcookie(session_name(),"",time()-86400*7,"/");
+    }
+    #clear server store of data
+    $_SESSION=array();
+    session_destroy();
+}
+function docmd($cmd, $nr, $arg){
+	$request = simplexml_load_string('<xcatrequest></xcatrequest>');
+    $usernode=$request->addChild('becomeuser');
+    $usernode->addChild('username',$_SESSION["username"]);
+    $usernode->addChild('password',getpassword());
+	$request->addChild('command',$cmd);
+	if(!empty($arg)){
+		$request->addChild('arg',$arg);
+	}
+	#$request->addChild('noderange', 'all');
+	if(!empty($nr)){
+		$request->addChild('noderange',$nr);
+	}
+	#echo $request->asXML();	
+	$nodes = submit_request($request,0);
+	return($nodes);
+}
+
+function submit_request($req, $skipVerify){
+	global $cert,$port,$xcathost;
+	$fp; 
+	$rsp = '';
+	$pos;
+	$response = '';
+	$cleanexit=0;
+    $moreresponses=1;
+	$context = stream_context_create(); #array('ssl'=>array('local_cert' => $cert)));
+	if($fp = stream_socket_client('ssl://'.$xcathost.':'.$port,$errno,$errstr,30,
+                STREAM_CLIENT_CONNECT,$context)){
+		fwrite($fp,$req->asXML());
+		while($moreresponses and $fp and !feof($fp)){
+            $currline=fgets($fp);
+			$response .= $currline;
+			$response = preg_replace('/\n/','', $response);
+			#$pattern = "<xcatresponse><serverdone></serverdone></xcatresponse>";
+			$pattern = "<serverdone>";
+			$pos	= strpos($response,$pattern);
+			if($pos){
+				$cleanexit = 1;
+            }
+            if ($cleanexit) {
+                $pattern = "</xcatresponse>";
+                $pos = strpos($currline,$pattern);
+            }
+            if (is_numeric($pos)) {
+				#$response = substr($response, 0, $pos);
+                #var_dump($response);
+				$response = "<xcat>$response</xcat>";
+				#$response = preg_replace('/<xcatresponse>\s+<\/xcat>/','', $response);
+				#$response .= "</xcat>";
+				#echo htmlentities($response);
+				$rsp = simplexml_load_string($response,'SimpleXMLElement', LIBXML_NOCDATA);
+                $moreresponses=0;
+                break;
+			}
+		}
+		fclose($fp);
+	}else{
+		echo "xCAT Submit request ERROR: $errno - $errstr<br/>\n";
+	}
+	if(! $cleanexit){
+		if(!$skipVerify){
+			echo "Error in xCAT response<br>";
+			$rsp = 0;
+		}
+	}
+	return $rsp;
+}
+
+
+
+
+
+?>
diff --git a/xCAT-web-exp/login.php b/xCAT-web-exp/login.php
new file mode 100644
index 000000000..e4ca5b3f8
--- /dev/null
+++ b/xCAT-web-exp/login.php
@@ -0,0 +1,79 @@
+<?php
+    session_start();
+    include "functions.php";
+    $attemptedlogin=0;
+    $successfullogin=0;
+    if (isset($_GET["logout"])) {
+        logout();
+    }
+    if (isset($_POST["password"])) {
+        $_SESSION=array(); #Clear data from session. prevent session data from migrating in a hijacking?
+        session_regenerate_id(true);#Zap existing session entirely..
+        setpassword($_POST["password"]);
+    }
+    if (isset($_POST["username"])) {
+        $_SESSION["username"]=$_POST["username"];
+        $attemptedlogin=1;
+    }
+    if (is_logged()) {
+        $testcred=docmd("authcheck","","");
+        if (isset($testcred->{xcatresponse}->{data})) {
+            $result="".$testcred->{xcatresponse}->{data};
+            if (is_numeric(strpos("Authenticated",$result))) {
+                $successfullogin=1;
+            }
+        }
+    }
+?>
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
+<html>
+<head>
+<title>xCAT WebUI</title>
+<script type="text/javascript" src="jquery.js"></script>
+<script type="text/javascript">
+    $(document).ready(function() {
+    <? if (isset($_SESSION["username"])) { ?>
+        $("#password").focus();
+    <? } else { ?>
+        $("#username").focus();
+    <? } ?>
+    $("#username").keydown(function(event) {
+        if (event.keyCode==13) {
+            $("#password").focus();
+        }
+    });
+    $("#password").keydown(function(event) {
+        if (event.keyCode==13) {
+            $("#loginform").submit();
+        }
+    });
+    $("#login").click(function(event) {
+            $("#loginform").submit();
+    });
+        
+            
+        
+    });
+
+</script>
+</head>
+<body>
+<?
+    if ($successfullogin != 1) {
+        if ($attemptedlogin) {
+            ?>Login Failed<?
+        }
+        ?>
+        <form id="loginform" method="post" action="login.php">
+        Username:<input id="username" type="text" name="username"<?if (isset($_SESSION["username"])) { echo 'value="'.$_SESSION["username"].'"'; } ?>><BR>
+        Password:<input id="password" type="password" name="password">
+        <button id="login" type="button" name="Login" value="Login">Login</button>
+        </form>
+        <?
+    } else {
+        echo "Login Success <a href=\"login.php?logout=1\">Logout</a>";
+    }
+
+?>
+</body>
+</html>
diff --git a/xCAT-web-exp/noderangesource.php b/xCAT-web-exp/noderangesource.php
new file mode 100644
index 000000000..1a6663f83
--- /dev/null
+++ b/xCAT-web-exp/noderangesource.php
@@ -0,0 +1,47 @@
+<?php
+    session_start();
+    include "functions.php";
+    if (isset($_GET['id'])) {
+        $id = $_GET['id'];
+    }
+    if ($id == "0") {
+        $id = '/.*';
+    } else {
+        $id=preg_replace('/^,/','',$id);
+    }
+    $rvals=docmd('extnoderange',$id,'subgroups');
+    $parents=array();
+    $root=1;
+    if ($id == '/.*') {
+        $id=',';
+    } else {
+        $parents=split("@",$id);
+        $id=",$id@";
+        $root=0;
+    }
+    unset($rvals->xcatresponse->serverdone[0]);
+    $numsubgroups=count($rvals->xcatresponse->intersectinggroups);
+    $numnodes=count($rvals->xcatresponse->node);
+    $jdata=array();
+    if ($numnodes >= $numsubgroups) { #If there are few enough subgroups to be helpful filters, add them in
+        foreach ($rvals->xcatresponse->intersectinggroups as $group) {
+            if (! in_array("$group",$parents)) {
+            $jdata[]= array("data"=>"$group",
+                            "attributes"=>array("id"=>"$id$group",
+                                                "rel"=>'group'),
+                            "state"=>'closed');
+                            }
+            
+        }
+    } #If there were more groups than nodes, leave the signal to noise ratio down
+    if ($root==0) {
+    foreach ($rvals->xcatresponse->node as $node) {
+        $jdata[] = array("data"=>"$node",
+                         "attributes"=>array("id"=>",$node",
+                                             "rel"=>'node'));
+    }
+    }
+#    header('Content-type: text/html');
+    echo json_encode($jdata);
+?>
+
diff --git a/xCAT-web-exp/test.html b/xCAT-web-exp/test.html
new file mode 100644
index 000000000..3ee047088
--- /dev/null
+++ b/xCAT-web-exp/test.html
@@ -0,0 +1,68 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title>xCAT web UI experiments</title>
+<link rel="stylesheet" type="text/css" href="tree_component.css" />
+<script type="text/javascript" src="css.js"></script>
+<script type="text/javascript" src="jquery.js"></script>
+<script type="text/javascript" src="jquery.listen.js"></script>
+<script type="text/javascript" src="tree_component.js"></script>
+<script type="text/javascript">
+    $(function() {
+        var nrtree = new tree_component();
+        nrtree.init($("#nrlist"),{
+            rules: {
+                multiple: "Ctrl"
+            },
+            ui: {
+                animation: 250
+            },
+            callback : {
+                onchange : printtree
+                },
+            data : {
+                type : "json",
+                async : "true",
+                url: "noderangesource.php",
+            }
+        });
+     });
+
+      function printtree (node,nrtree) {
+        myselection=nrtree.selected_arr;
+        var noderange="";
+        for (node in myselection) {
+            noderange+=myselection[node][0].id;
+        }
+        $("#rangedisplay").text("Noderange: "+noderange.substring(1));
+     }
+</script>
+            
+</head>
+<body>
+<div id="rangedisplay">
+</div>
+<hr>
+<div class="demo">
+<div id="nrlist" class="dots"></div>
+</div>
+<hr>
+<!-- <div class="demo">
+<div id="htlist" class="dots">
+<ul>
+<li id="storage"><a>storage</a>
+    <ul>
+        <li id="node1"><a>node1</a></li>
+        <li id="node2"><a>node2</a></li>
+    </ul>
+<li id="compute" class="open"><a>compute</a>
+    <ul>
+        <li id="node3"><a>node3</a></li>
+        <li id="node4"><a>node4</a></li>
+        <li id="node5"><a>node5</a></li>
+    </ul>
+</li>
+</ul>
+</div>
+</div> -->
+</body>
+</html>