diff --git sources/imce.inc sources/imce.inc
index 7890112..ec3f25b 100644
--- sources/imce.inc
+++ sources/imce.inc
@@ -65,10 +65,28 @@ function filefield_source_imce_theme() {
 function filefield_source_imce_settings($op, $field) {
   $return = array();
 
-  // Add settings to the FileField widget form.
+  if ($op == 'form') {
+    $return['sources_imce'] = array(
+      '#title' => t('IMCE file browser settings'),
+      '#type' => 'fieldset',
+      '#collapsible' => TRUE,
+      '#collapsed' => TRUE,
+    );
+    $return['sources_imce']['filefield_source_imce_mode'] = array(
+      '#type' => 'radios', 
+      '#title' => t('File browser mode'),
+      '#options' => array(
+        0 => t('Restricted: Users can only browse the field directory. No file operations are allowed.'),
+        1 => t('Full: Browsable directories are defined by <a href="!imce-admin-url">IMCE configuration profiles</a>. File operations are allowed for IMCE 6.x-2.x or above.', array('!imce-admin-url' => url('admin/settings/imce'))),
+      ),
+      '#default_value' => isset($field['filefield_source_imce_mode']) ? $field['filefield_source_imce_mode'] : 0,
+    );
+  }
+  elseif ($op == 'save') {
+    $return[] = 'filefield_source_imce_mode';
+  }
 
   return $return;
-
 }
 
 /**
@@ -162,21 +180,23 @@ function filefield_source_imce_page($content_type, $field_name) {
   global $conf;
 
   // Check access.
-  if (!module_exists('imce') || !imce_access() || !content_fields($field_name, $content_type)) {
+  if (!module_exists('imce') || !imce_access() || !($field = content_fields($field_name, $content_type))) {
     return drupal_access_denied();
   }
-  // Set custom directory scan.
-  $conf['imce_custom_scan'] = 'filefield_source_imce_custom_scan';
+
+  // Full mode
+  if (isset($field['widget']['filefield_source_imce_mode']) && $field['widget']['filefield_source_imce_mode'] == 1) {
+    $conf['imce_custom_scan'] = 'filefield_source_imce_custom_scan_full';
+  }
+  // Restricted mode
+  else {
+    $conf['imce_custom_scan'] = 'filefield_source_imce_custom_scan_restricted';
+    $conf['imce_custom_field'] = $field;
+  }
 
   // Disable absolute URLs.
   $conf['imce_settings_absurls'] = 0;
 
-  // Set custom post-process to disable undesired features.
-  if (empty($conf['imce_custom_process'])) {
-    $conf['imce_custom_process'] = array();
-  }
-  $conf['imce_custom_process'] += array('filefield_source_imce_custom_process' => 1);
-
   // IMCE 6.x-2.x.
   if (module_hook('imce', 'file_references')) {
     module_load_include('inc', 'imce', 'inc/imce.page');
@@ -190,16 +210,16 @@ function filefield_source_imce_page($content_type, $field_name) {
 }
 
 /**
- * Scan directory and return file list, subdirectories, and total size.
+ * Scan directory and return file list, subdirectories, and total size for Full Mode.
  */
-function filefield_source_imce_custom_scan($dirname) {
+function filefield_source_imce_custom_scan_full($dirname, &$imce) {
   // Get a list of files in the database for this directory.
   $sql_dir_name = $dirname == '.' ? file_directory_path() : file_directory_path() .'/'. $dirname;
 
-  $result = db_query("SELECT filename FROM {files} WHERE filepath LIKE '%s' AND filepath NOT LIKE '%s'", $sql_dir_name .'/%', $sql_dir_name .'/%/%');
+  $result = db_query("SELECT filepath FROM {files} WHERE filepath LIKE '%s' AND filepath NOT LIKE '%s'", $sql_dir_name .'/%', $sql_dir_name .'/%/%');
   $db_files = array();
   while ($row = db_fetch_object($result)) {
-    $db_files[$row->filename] = $row->filename;
+    $db_files[basename($row->filepath)] = 1;
   }
 
   // Get the default IMCE directory scan, then filter down to database files.
@@ -211,17 +231,64 @@ function filefield_source_imce_custom_scan($dirname) {
     }
   }
 
+  // Disable file operations for IMCE 6.x-1.x
+  if (!module_hook('imce', 'file_references')) {
+    filefield_source_imce_disable_perms($imce, array('browse', 'subnav'));
+  }
+
+  return $directory;
+}
+
+/**
+ * Scan directory and return file list, subdirectories, and total size for Restricted Mode.
+ */
+function filefield_source_imce_custom_scan_restricted($dirname, &$imce) {
+  $field = $GLOBALS['conf']['imce_custom_field'];
+  $fdp = file_directory_path();
+  $field_path = $field['widget']['file_path'] == '' ? $fdp : filefield_widget_file_path($field);
+  $db_info = content_database_info($field);
+
+  // Get field files
+  $result = db_query("SELECT f.* FROM {" . $db_info['table'] . "} c INNER JOIN {files} f ON c." . $db_info['columns']['fid']['column'] . " = f.fid WHERE f.status = 1 AND f.filepath LIKE '%s' AND f.filepath NOT LIKE '%s'", $field_path .'/%', $field_path .'/%/%');
+
+  // Create directory info
+  $directory = array('dirsize' => 0, 'files' => array(), 'subdirectories' => array(), 'error' => FALSE);
+  while ($file = db_fetch_object($result)) {
+    // Get real name
+    $name = basename($file->filepath);
+    // Get dimensions
+    $width = $height = 0;
+    if ($img = imce_image_info($file->filepath)) {
+      $width = $img['width'];
+      $height = $img['height'];
+    }
+    $directory['files'][$name] = array(
+      'name' => $name,
+      'size' => $file->filesize,
+      'width' => $width,
+      'height' => $height,
+      'date' => $file->timestamp,
+    );
+    $directory['dirsize'] += $file->filesize;
+  }
+
+  // Process IMCE. Make field directory the only accessible one.
+  $imce['dir'] = $field_path == $fdp ? '.' : substr($field_path, strlen($fdp) + 1);
+  $imce['directories'] = array();
+  filefield_source_imce_disable_perms($imce, array('browse'));
+
   return $directory;
 }
 
 /**
- * Post process IMCE profile.
+ * Disable IMCE profile permissions.
  */
-function filefield_source_imce_custom_process(&$imce) {
-  // Disable file operations.
+function filefield_source_imce_disable_perms(&$imce, $exceptions = array()) {
+  $disable_all = empty($exceptions);
   foreach ($imce['perm'] as $name => $val) {
-    if ($name != 'browse' && $name != 'subnav') {
+    if ($disable_all || !in_array($name, $exceptions)) {
       $imce['perm'][$name] = 0;
     }
   }
+  $imce['directories'][$imce['dir']] = array('name' => $imce['dir']) + $imce['perm'];
 }