diff --git a/app/controllers/admin/trusted_sites_controller.rb b/app/controllers/admin/trusted_sites_controller.rb
new file mode 100644
index 0000000..76d1115
--- /dev/null
+++ b/app/controllers/admin/trusted_sites_controller.rb
@@ -0,0 +1,82 @@
+class TrustedSitesController < AdminController
+  protect 'manage_environment_trusted_sites', :environment
+
+  def index
+    @sites = environment.trusted_sites_for_iframe
+  end
+
+  def new
+    @site = ""
+  end
+
+  def create
+    if add_trusted_site(params[:site])
+      session[:notice] = _('New trusted site added.')
+      redirect_to :action => 'index'
+    else
+      session[:notice] = _('Failed to add trusted site.')
+      render :action => 'new'
+    end
+  end
+
+  def edit
+    if is_trusted_site? params[:site]
+      @site = params[:site]
+    else
+      session[:notice] = _('Trusted site was not found')
+      redirect_to :action => 'index'
+    end
+  end
+
+  def update
+    site = params[:site]
+    orig_site = params[:orig_site]
+    if rename_trusted_site(orig_site, site)
+      redirect_to :action => 'edit', :site => @site
+    else
+      session[:notice] = _('Failed to edit trusted site.')
+      render :action => 'edit'
+    end
+  end
+
+  def destroy
+    if delete_trusted_site(params[:site])
+      session[:notice] = _('Trusted site removed')
+    else
+      session[:notice] = _('Trusted site could not be removed')
+    end
+    redirect_to :action => 'index'
+  end
+
+  protected
+  def add_trusted_site (site)
+    trusted_sites = environment.trusted_sites_for_iframe
+    trusted_sites << site
+    environment.trusted_sites_for_iframe = trusted_sites
+    environment.save
+  end
+
+  def rename_trusted_site(orig_site, site)
+    trusted_sites = environment.trusted_sites_for_iframe
+    i = trusted_sites.index orig_site
+    if i.nil?
+      return false
+    else
+      trusted_sites[i] = site
+      environment.trusted_sites_for_iframe = trusted_sites
+      environment.save
+    end
+  end
+
+
+  def delete_trusted_site (site)
+    trusted_sites = environment.trusted_sites_for_iframe
+    trusted_sites.delete site
+    environment.trusted_sites_for_iframe = trusted_sites
+    environment.save
+  end
+
+  def is_trusted_site? (site)
+    environment.trusted_sites_for_iframe.include? site
+  end
+end
diff --git a/app/models/environment.rb b/app/models/environment.rb
index 129a831..00a43c1 100644
--- a/app/models/environment.rb
+++ b/app/models/environment.rb
@@ -26,6 +26,7 @@ class Environment < ActiveRecord::Base
     'manage_environment_users' => N_('Manage environment users'),
     'manage_environment_templates' => N_('Manage environment templates'),
     'manage_environment_licenses' => N_('Manage environment licenses'),
+    'manage_environment_trusted_sites' => N_('Manage_environment_trusted_sites')
   }
 
   module Roles
diff --git a/app/views/admin_panel/index.rhtml b/app/views/admin_panel/index.rhtml
index cac3be8..8f69b87 100644
--- a/app/views/admin_panel/index.rhtml
+++ b/app/views/admin_panel/index.rhtml
@@ -9,6 +9,7 @@
   <tr><td><%= link_to _('Sideboxes'), :controller => 'environment_design'%></td></tr>
   <tr><td><%= link_to _('Homepage'), :action => 'set_portal_community' %></td></tr>
   <tr><td><%= link_to _('Licenses'), :controller =>'licenses' %></td></tr>
+  <tr><td><%= link_to _('Trusted sites'), :controller =>'trusted_sites' %></td></tr>
 </table>
 
 <h2><%= _('Profiles') %></h2>
diff --git a/app/views/trusted_sites/edit.rhtml b/app/views/trusted_sites/edit.rhtml
new file mode 100644
index 0000000..5834a2b
--- /dev/null
+++ b/app/views/trusted_sites/edit.rhtml
@@ -0,0 +1,15 @@
+<h2> <%= _("Editing trusted site") %> </h2>
+
+<% form_tag :action => :update do %>
+
+  <%= text_field_tag :site, @site %>
+  <%= hidden_field_tag :orig_site, @site %>
+
+  <% button_bar do %>
+    <%= submit_button('save', _('Save changes'), :cancel => {:action => 'index'} ) %>
+  <% end %>
+<% end %>
+
+<script>
+  jQuery(function() { jQuery('input#site').focus(); } );
+</script>
diff --git a/app/views/trusted_sites/index.rhtml b/app/views/trusted_sites/index.rhtml
new file mode 100644
index 0000000..353daeb
--- /dev/null
+++ b/app/views/trusted_sites/index.rhtml
@@ -0,0 +1,28 @@
+<h1><%= _('Manage trusted sites') %></h1>
+
+<p>
+<%=  _('Here you can manage the list of trusted sites of your environment. A trusted site is a site that you consider safe enough to incorporate their content through <em>iframes</em>.') %>
+</p>
+
+<table>
+  <tr>
+    <th><%= _('Site') %></th>
+    <th><%= _('Actions') %></th>
+  </tr>
+  <% @sites.each do |site| %>
+    <tr>
+      <td>
+        <%= link_to site, :action => 'show', :site => site %>
+      </td>
+      <td style='white-space: nowrap;'>
+        <%= button_without_text :edit, _('Edit'), :action => 'edit', :site => site %>
+        <%= button_without_text :remove,  _('Remove'), {:action => :destroy, :site => site}, :method => :delete, :confirm => _('Are you sure you want to remove this site from the list of trusted sites?') %>
+      </td>
+    </tr>
+  <% end %>
+</table>
+
+<% button_bar do %>
+  <%= button :add, _('Add a trusted site'), :action => 'new' %>
+  <%= button :back, _('Back to admin panel'), :controller => 'admin_panel' %>
+<% end %>
diff --git a/app/views/trusted_sites/new.rhtml b/app/views/trusted_sites/new.rhtml
new file mode 100644
index 0000000..d64c8ab
--- /dev/null
+++ b/app/views/trusted_sites/new.rhtml
@@ -0,0 +1,14 @@
+<h2> <%= _("Add a new trusted site") %> </h2>
+
+<% form_tag :action => :create do %>
+
+  <%= text_field_tag :site, @site %>
+
+  <% button_bar do %>
+    <%= submit_button('save', _('Add trusted site'), :cancel => {:action => 'index'} ) %>
+  <% end %>
+<% end %>
+
+<script>
+  jQuery(function() { jQuery('input#site').focus(); } );
+</script>
diff --git a/test/factories.rb b/test/factories.rb
index ecaa9aa..c395abb 100644
--- a/test/factories.rb
+++ b/test/factories.rb
@@ -55,7 +55,7 @@ module Noosfero::Factory
   ###### old stuff to be rearranged
   def create_admin_user(env)
     admin_user = User.find_by_login('adminuser') || create_user('adminuser', :email => 'adminuser@noosfero.org', :password => 'adminuser', :password_confirmation => 'adminuser', :environment => env)
-    admin_role = Role.find_by_name('admin_role') || Role.create!(:name => 'admin_role', :permissions => ['view_environment_admin_panel','edit_environment_features', 'edit_environment_design', 'manage_environment_categories', 'manage_environment_roles', 'manage_environment_validators', 'manage_environment_users', 'manage_environment_templates', 'manage_environment_licenses'])
+    admin_role = Role.find_by_name('admin_role') || Role.create!(:name => 'admin_role', :permissions => ['view_environment_admin_panel','edit_environment_features', 'edit_environment_design', 'manage_environment_categories', 'manage_environment_roles', 'manage_environment_trusted_sites', 'manage_environment_validators', 'manage_environment_users', 'manage_environment_templates', 'manage_environment_licenses'])
     RoleAssignment.create!(:accessor => admin_user.person, :role => admin_role, :resource => env) unless admin_user.person.role_assignments.map{|ra|[ra.role, ra.accessor, ra.resource]}.include?([admin_role, admin_user, env])
     admin_user.login
   end
diff --git a/test/fixtures/roles.yml b/test/fixtures/roles.yml
index 4d01b92..8795023 100644
--- a/test/fixtures/roles.yml
+++ b/test/fixtures/roles.yml
@@ -30,6 +30,7 @@ four:
    - edit_environment_design
    - manage_environment_categories
    - manage_environment_roles
+   - manage_environment_trusted_sites
    - manage_environment_validators
    - moderate_comments
    - perform_task
@@ -85,6 +86,7 @@ environment_administrator:
    - edit_environment_design
    - manage_environment_categories
    - manage_environment_roles
+   - manage_environment_trusted_sites
    - manage_environment_validators
    - moderate_comments
    - manage_environment_users
diff --git a/test/functional/trusted_sites_controller_test.rb b/test/functional/trusted_sites_controller_test.rb
new file mode 100644
index 0000000..07c0e94
--- /dev/null
+++ b/test/functional/trusted_sites_controller_test.rb
@@ -0,0 +1,79 @@
+require File.dirname(__FILE__) + '/../test_helper'
+require 'trusted_sites_controller'
+
+# Re-raise errors caught by the controller.
+class TrustedSitesController; def rescue_action(e) raise e end; end
+
+class TrustedSitesControllerTest < ActionController::TestCase
+  all_fixtures
+
+  def setup
+    @controller = TrustedSitesController.new
+    @request    = ActionController::TestRequest.new
+    @response   = ActionController::TestResponse.new
+    @role = Role.find(:first)
+    @environment = Environment.default
+    @environment.trusted_sites_for_iframe = ['existing.site.com']
+    @environment.save!
+
+    login_as(:ze)
+  end
+
+  should 'get index' do
+    get :index
+    assert_response :success
+    assert_not_nil assigns(:sites)
+  end
+
+  should 'get new' do
+    get :new
+    assert_response :success
+  end
+
+  should 'create site' do
+    post :create, :site => 'new.site.com'
+    assert_redirected_to :action => :index
+    assert @controller.environment.trusted_sites_for_iframe.include?('new.site.com'), 'Site was not included in the trusted_sites'
+  end
+
+  should 'fail creation gracefully' do
+    @controller.stubs(:add_trusted_site).returns(false)
+    post :create, :site => 'new.site.com'
+    assert_response :success # it actually failed, but was not redirected
+    assert !@controller.environment.trusted_sites_for_iframe.include?('new.site.com'), 'Site was included in the trusted_sites!?'
+  end
+
+  should 'destroy site' do
+    post :create, :site => 'todel.site.com'
+    delete :destroy, :site => 'todel.site.com'
+    assert_redirected_to :action => :index
+    assert ! @controller.environment.trusted_sites_for_iframe.include?('todel.site.com'), 'Site was not removed from trusted_sites'
+  end
+
+  should "get edit" do
+    get :edit, :site => 'existing.site.com'
+    assert_response :success
+  end
+
+  should "not get edit" do
+    get :edit, :site => 'nonexistent.site.com'
+    assert_redirected_to :action => :index
+  end
+
+  should 'update site' do
+    post :create, :site => 'toedit.site.com'
+    post :update, :orig_site => 'toedit.site.com', :site => 'edited.site.com'
+    assert_redirected_to :action => :edit
+    assert ! @controller.environment.trusted_sites_for_iframe.include?('toedit.site.com'), 'Original site found. Site was not updated?'
+    assert @controller.environment.trusted_sites_for_iframe.include?('edited.site.com'), 'New name for site not found. Site was not updated?'
+  end
+
+  should 'fail update gracefully' do
+    @controller.stubs(:rename_trusted_site).returns(false)
+    post :create, :site => 'toedit.site.com'
+    post :update, :orig_site => 'toedit.site.com', :site => 'edited.site.com'
+    assert_response :success # it actually failed, but was not redirected
+    assert @controller.environment.trusted_sites_for_iframe.include?('toedit.site.com'), 'Original site not found. Site was updated?'
+    assert !@controller.environment.trusted_sites_for_iframe.include?('edited.site.com'), 'New name for site found. Site was updated?'
+  end
+end
--
libgit2 0.21.2