diff --git a/addons/website/controllers/main.py b/addons/website/controllers/main.py
index 8956c59e034..abc539e84f5 100644
--- a/addons/website/controllers/main.py
+++ b/addons/website/controllers/main.py
@@ -1,12 +1,20 @@
 # -*- coding: utf-8 -*-
+import base64
+import json
+import logging
 import urllib
+import cStringIO
+
+from PIL import Image, ImageOps
 
 import openerp
 from openerp.addons.web import http
 from openerp.addons.web.controllers.main import manifest_list
 from openerp.addons.web.http import request
+import werkzeug.exceptions
+import werkzeug.wrappers
 
-
+logger = logging.getLogger(__name__)
 
 def template_values():
     script = "\n".join(['<script type="text/javascript" src="%s"></script>' % i for i in manifest_list('js', db=request.db)])
@@ -89,4 +97,48 @@ class Website(openerp.addons.web.controllers.main.Home):
             html = request.registry.get("ir.ui.view").render(request.cr, uid, 'website.404', values, context)
         return html
 
+    @http.route('/website/attach', type='http', auth='admin') # FIXME: auth
+    def attach(self, CKEditorFuncNum, CKEditor, langCode, upload):
+        req = request.httprequest
+        if req.method != 'POST':
+            return werkzeug.exceptions.MethodNotAllowed(valid_methods=['POST'])
+
+        url = message = None
+        try:
+            attachment_id = request.registry['ir.attachment'].create(request.cr, request.uid, {
+                'name': upload.filename,
+                'datas': base64.encodestring(upload.read()),
+                'datas_fname': upload.filename,
+                'res_model': 'ir.ui.view',
+            }, request.context)
+            # FIXME: auth=user... no good.
+            url = '/website/attachment/%d' % attachment_id
+        except Exception, e:
+            logger.exception("Failed to upload image to attachment")
+            message = str(e)
+
+        return """<script type='text/javascript'>
+            window.parent.CKEDITOR.tools.callFunction(%d, %s, %s);
+        </script>""" % (int(CKEditorFuncNum), json.dumps(url), json.dumps(message))
+
+    @http.route('/website/attachment/<int:id>', type='http', auth="admin")
+    def attachment(self, id):
+        # FIXME: can't use Binary.image because auth=user and website attachments need to be public
+        attachment = request.registry['ir.attachment'].browse(
+            request.cr, request.uid, id, request.context)
+
+        buf = cStringIO.StringIO(base64.decodestring(attachment.datas))
+
+        image = Image.open(buf)
+        image.thumbnail((1024, 768), Image.ANTIALIAS)
+
+        response = werkzeug.wrappers.Response(status=200, mimetype={
+            'PNG': 'image/png',
+            'JPEG': 'image/jpeg',
+            'GIF': 'image/gif',
+        }[image.format])
+        image.save(response.stream, image.format)
+
+        return response
+
 # vim:expandtab:tabstop=4:softtabstop=4:shiftwidth=4:
diff --git a/addons/website/static/src/js/website.js b/addons/website/static/src/js/website.js
index 9a274c6b99d..541f9e36e37 100644
--- a/addons/website/static/src/js/website.js
+++ b/addons/website/static/src/js/website.js
@@ -234,6 +234,12 @@ instance.website.RTE = instance.web.Widget.extend({
         [Command, "\uf0c1", 'link'],
         [Command, "\uf127", 'unlink'],
         [Command, "\uf10d", 'blockquote'],
+        // 'image' uses either filebrowserImageUploadUrl or
+        // filebrowserUploadUrl, and provides a `link` tab. imagebutton only
+        // uses filebrowserImageUploadUrl and does not provide a `link` tab to
+        // hotlink an image from the internets.
+        [Command, "\uf03e", 'image'],
+        // [Command, "\uf030", 'imagebutton'],
         [Group, "\uf0ca", [
             [Command, "\uf0ca", 'bulletedlist'],
             [Command, "\uf0cb", 'numberedlist'],
@@ -327,8 +333,8 @@ instance.website.RTE = instance.web.Widget.extend({
         return {
             // Don't load ckeditor's style rules
             stylesSet: [],
-            // Remove toolbar entirely
-            removePlugins: 'toolbar,elementspath,resize',
+            // Remove toolbar entirely, also custom context menu
+            removePlugins: 'toolbar,elementspath,resize,contextmenu,tabletools,liststyle',
             uiColor: '',
             // Ensure no config file is loaded
             customConfig: '',
@@ -336,6 +342,7 @@ instance.website.RTE = instance.web.Widget.extend({
             allowedContent: true,
             // Don't insert paragraphs around content in e.g. <li>
             autoParagraph: false,
+            filebrowserImageUploadUrl: "/website/attach",
         };
     },
     // TODO clean