URL encoding to allow some non-portable characters in file names1.1.0

5 files changed, 76 insertions, 64 deletions

diff --git a/dialogs.c b/dialogs.c
index c17549f..6ebad0d 100644
--- a/dialogs.c
+++ b/dialogs.c
@@ -246,6 +246,7 @@ void about(void) {
             "Server Side RFC 1321 implementation by L. Peter Deutsch<BR>\n"
             "Client Side RFC 1321 implementation by Paul Johnston<BR>\n"
             "Icons by Yusuke Kamiyamane<BR>\n"
+            "URL Encoding routines by Fred Bulback<BR>\n"
             "Copyright &copy; 1994-2016 by Antoni Sawicki<BR>\n"
             "Copyright &copy; 1996-2011 by Thomas Boutell and Boutell.Com, Inc.<BR>\n"
             "Copyright &copy; 2002 by Aladdin Enterprises<BR>\n"
@@ -318,7 +319,7 @@ void login_ui(void) {
 
     if(js>=2) fprintf(cgiOut,
         "onClick=\"self.location='%s?directory=%s&amp;login=client&amp;token=' + hex_md5('%s:' + document.wfm.username.value + ':' + document.wfm.password.value); return false;\"",
-        cgiScriptName, virt_dirname, cgiRemoteAddr);
+        cgiScriptName, virt_dirname_urlencoded, cgiRemoteAddr);
 
     fputs(
         ">\n"
diff --git a/dir.c b/dir.c
index a2af6e8..8cd4f89 100644
--- a/dir.c
+++ b/dir.c
@@ -63,7 +63,7 @@ void dirlist(void) {
     char rtime[64], mtime[64], atime[64];
     char *stime;
     char sortby[64]={0};
-    char *name, *icon, *linecolor;
+    char *name, *name_urlencoded, *icon, *linecolor;
 	int nentr=0, e=0, n=1;
     int editable;
     int upload_id=0;
@@ -74,7 +74,7 @@ void dirlist(void) {
     if(upload_id<1)
         upload_id=now; // holy shit
 
-    cgiFormStringNoNewlines("highlight", highlight, VIRT_FILENAME_SIZE-1);
+    cgiFormStringNoNewlines("highlight", highlight, VIRT_FILENAME_SIZE-1); //TODO: urlencode ?
     cgiFormStringNoNewlines("sortby", sortby, 63);
     if(strlen(sortby)<4)
         snprintf(sortby, 63, "name");
@@ -189,8 +189,7 @@ void dirlist(void) {
                 "<TD NOWRAP  WIDTH=\"100%%\" BGCOLOR=\"#0072c6\" VALIGN=\"MIDDLE\" ALIGN=\"LEFT\" STYLE=\"color:#FFFFFF; font-weight:bold;\">\n"
                 "&nbsp;<IMG SRC=\"%s%s\" ALIGN=\"MIDDLE\" ALT=\"WFM\">\n"
                 "%s : %c%s \n"
-                "<TD NOWRAP  BGCOLOR=\"#F1F1F1\" VALIGN=\"MIDDLE\" ALIGN=\"RIGHT\" STYLE=\"color:#000000; font-weight:bold;  white-space:nowrap\">\n"
-                ,
+                "<TD NOWRAP  BGCOLOR=\"#F1F1F1\" VALIGN=\"MIDDLE\" ALIGN=\"RIGHT\" STYLE=\"color:#000000; font-weight:bold;  white-space:nowrap\">\n",
             ICONSURL, FAVICON, TAGLINE, (strlen(virt_dirname)>0) ? ' ' : '/', virt_dirname 
     );
 
@@ -200,24 +199,21 @@ void dirlist(void) {
         fprintf(cgiOut, 
             "<A HREF=\"%s?action=login&amp;directory=%s\">"
             "&nbsp;<IMG SRC=\"%s%s.gif\" ALIGN=\"MIDDLE\" BORDER=\"0\" ALT=\"Access\"></A>&nbsp;%s\n",  
-            cgiScriptName, virt_dirname, ICONSURL, access_string[access_level], access_string[access_level]);
+            cgiScriptName, virt_dirname_urlencoded, ICONSURL, access_string[access_level], access_string[access_level]);
     else
         fprintf(cgiOut, 
             "<A HREF=\"%s?directory=%s\"><IMG SRC=\"%s%s.gif\" BORDER=\"0\" ALIGN=\"MIDDLE\" ALT=\"Access\">"
             "</A>&nbsp;%s&nbsp;<IMG SRC=\"%suser.gif\" ALIGN=\"MIDDLE\" ALT=\"User\">&nbsp;%s&nbsp;\n",
-            cgiScriptName, virt_dirname, ICONSURL, access_string[access_level], access_string[access_level], ICONSURL, loggedinuser);
+            cgiScriptName, virt_dirname_urlencoded, ICONSURL, access_string[access_level], access_string[access_level], ICONSURL, loggedinuser);
 
     // about / version
     fprintf(cgiOut, 
-            //"</TD><TD NOWRAP  BGCOLOR=\"#F1F1F1\" VALIGN=\"MIDDLE\" ALIGN=\"RIGHT\" STYLE=\"color:#000000; font-weight:bold;  white-space:nowrap\">"
-            "&nbsp;<IMG SRC=\"%snet.gif\" ALIGN=\"MIDDLE\" ALT=\"Client IP\">&nbsp;%s&nbsp;"//</TD>"
-            //"<TD NOWRAP  BGCOLOR=\"#F1F1F1\" VALIGN=\"MIDDLE\" ALIGN=\"RIGHT\" STYLE=\"color:#000000; font-weight:bold;  white-space:nowrap\">"
+            "&nbsp;<IMG SRC=\"%snet.gif\" ALIGN=\"MIDDLE\" ALT=\"Client IP\">&nbsp;%s&nbsp;"
             "<A HREF=\"%s?action=about&amp;directory=%s&amp;token=%s\"><IMG BORDER=\"0\" SRC=\"%sver.gif\" ALIGN=\"MIDDLE\" ALT=\"Version\"></A>&nbsp;v%s&nbsp;"
             "</TD>\n"\
             "</TR>\n"\
             "</TABLE>\n",
-            ICONSURL, cgiRemoteAddr, cgiScriptName, virt_dirname, token, ICONSURL, VERSION
-    );
+            ICONSURL, cgiRemoteAddr, cgiScriptName, virt_dirname_urlencoded, token, ICONSURL, VERSION);
 
 
 
@@ -234,7 +230,7 @@ void dirlist(void) {
                     "<IMG SRC=\"%sdir_up.gif\" BORDER=0 ALIGN=\"MIDDLE\" WIDTH=\"16\" HEIGHT=\"16\" ALT=\"Dir Up\">&nbsp;Up"
                  "</A>\n"
                 "</TD>\n",
-                cgiScriptName, sortby, virt_parent, token, ICONSURL);
+                cgiScriptName, sortby, virt_parent_urlencoded, token, ICONSURL);
 
     fprintf(cgiOut,                 
                 "<!-- HOME -->\n"
@@ -252,7 +248,7 @@ void dirlist(void) {
                          "<IMG SRC=\"%sreload.gif\" BORDER=0 ALIGN=\"MIDDLE\" ALT=\"Reload\">&nbsp;Refresh"
                      "</A>\n"
                 "</TD>\n",
-                cgiScriptName, sortby, virt_dirname, token, ICONSURL);
+                cgiScriptName, sortby, virt_dirname_urlencoded, token, ICONSURL);
 
     fprintf(cgiOut,                 
                 "<!-- MULTI DELETE -->\n"\
@@ -277,7 +273,7 @@ void dirlist(void) {
                             "<IMG SRC=\"%smkdir.gif\" BORDER=0 ALIGN=\"MIDDLE\" ALT=\"New Folder\">&nbsp;New Folder\n"
                      "</A>\n"
                 "</TD>\n",
-                cgiScriptName, virt_dirname, token, ICONSURL);
+                cgiScriptName, virt_dirname_urlencoded, token, ICONSURL);
                 
 
     fprintf(cgiOut,                                 
@@ -287,7 +283,7 @@ void dirlist(void) {
                             "<IMG SRC=\"%smkfile.gif\" BORDER=0 ALIGN=\"MIDDLE\" ALT=\"New File\">&nbsp;New File"
                      "</A>\n"
                 "</TD>\n",
-                cgiScriptName, virt_dirname, token, ICONSURL);
+                cgiScriptName, virt_dirname_urlencoded, token, ICONSURL);
 
 
                 
@@ -308,33 +304,33 @@ void dirlist(void) {
     // SORT BY
     //
     if(strcmp(sortby, "size")==0) {
-        snprintf(namepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=name\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Filename</A>", cgiScriptName, virt_dirname, token);
-        snprintf(sizepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=rsize\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Size</A>&nbsp;%s", cgiScriptName, virt_dirname, token, ADNIMG);
-        snprintf(datepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=date\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Modified</A>", cgiScriptName, virt_dirname, token);
+        snprintf(namepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=name\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Filename</A>", cgiScriptName, virt_dirname_urlencoded, token);
+        snprintf(sizepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=rsize\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Size</A>&nbsp;%s", cgiScriptName, virt_dirname_urlencoded, token, ADNIMG);
+        snprintf(datepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=date\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Modified</A>", cgiScriptName, virt_dirname_urlencoded, token);
     } else if(strcmp(sortby, "rsize")==0) {
-        snprintf(namepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=name\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Filename</A>", cgiScriptName, virt_dirname, token);
-        snprintf(sizepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=size\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Size</A>&nbsp;%s", cgiScriptName, virt_dirname, token, AUPIMG);
-        snprintf(datepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=date\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Modified</A>", cgiScriptName, virt_dirname, token);
+        snprintf(namepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=name\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Filename</A>", cgiScriptName, virt_dirname_urlencoded, token);
+        snprintf(sizepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=size\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Size</A>&nbsp;%s", cgiScriptName, virt_dirname_urlencoded, token, AUPIMG);
+        snprintf(datepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=date\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Modified</A>", cgiScriptName, virt_dirname_urlencoded, token);
     } else if(strcmp(sortby, "date")==0) {
-        snprintf(namepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=name\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Filename</A>", cgiScriptName, virt_dirname, token);
-        snprintf(sizepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=size\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Size</A>", cgiScriptName, virt_dirname, token);
-        snprintf(datepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=rdate\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Modified</A>&nbsp;%s", cgiScriptName, virt_dirname, token, ADNIMG);
+        snprintf(namepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=name\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Filename</A>", cgiScriptName, virt_dirname_urlencoded, token);
+        snprintf(sizepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=size\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Size</A>", cgiScriptName, virt_dirname_urlencoded, token);
+        snprintf(datepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=rdate\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Modified</A>&nbsp;%s", cgiScriptName, virt_dirname_urlencoded, token, ADNIMG);
     } else if(strcmp(sortby, "rdate")==0) {
-        snprintf(namepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=name\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Filename</A>", cgiScriptName, virt_dirname, token);
-        snprintf(sizepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=size\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Size</A>", cgiScriptName, virt_dirname, token);
-        snprintf(datepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=date\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Modified</A>&nbsp;%s", cgiScriptName, virt_dirname, token, AUPIMG);
+        snprintf(namepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=name\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Filename</A>", cgiScriptName, virt_dirname_urlencoded, token);
+        snprintf(sizepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=size\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Size</A>", cgiScriptName, virt_dirname_urlencoded, token);
+        snprintf(datepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=date\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Modified</A>&nbsp;%s", cgiScriptName, virt_dirname_urlencoded, token, AUPIMG);
     } else if(strcmp(sortby, "name")==0) {
-        snprintf(namepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=rname\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Filename</A>&nbsp;%s", cgiScriptName, virt_dirname, token, ADNIMG);
-        snprintf(sizepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=size\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Size</A>", cgiScriptName, virt_dirname, token);
-        snprintf(datepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=date\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Modified</A>", cgiScriptName, virt_dirname, token);
+        snprintf(namepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=rname\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Filename</A>&nbsp;%s", cgiScriptName, virt_dirname_urlencoded, token, ADNIMG);
+        snprintf(sizepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=size\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Size</A>", cgiScriptName, virt_dirname_urlencoded, token);
+        snprintf(datepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=date\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Modified</A>", cgiScriptName, virt_dirname_urlencoded, token);
     } else if(strcmp(sortby, "rname")==0) {
-        snprintf(namepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=name\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Filename</A>&nbsp;%s", cgiScriptName, virt_dirname, token, AUPIMG);
-        snprintf(sizepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=size\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Size</A>", cgiScriptName, virt_dirname, token);
-        snprintf(datepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=date\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Modified</A>", cgiScriptName, virt_dirname, token);
+        snprintf(namepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=name\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Filename</A>&nbsp;%s", cgiScriptName, virt_dirname_urlencoded, token, AUPIMG);
+        snprintf(sizepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=size\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Size</A>", cgiScriptName, virt_dirname_urlencoded, token);
+        snprintf(datepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=date\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Modified</A>", cgiScriptName, virt_dirname_urlencoded, token);
     } else {
-        snprintf(namepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=name\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Filename</A>", cgiScriptName, virt_dirname, token);
-        snprintf(sizepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=size\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Size</A>", cgiScriptName, virt_dirname, token);
-        snprintf(datepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=date\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Modified</A>", cgiScriptName, virt_dirname, token);
+        snprintf(namepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=name\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Filename</A>", cgiScriptName, virt_dirname_urlencoded, token);
+        snprintf(sizepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=size\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Size</A>", cgiScriptName, virt_dirname_urlencoded, token);
+        snprintf(datepfx, 1024, "&nbsp;<A HREF=\"%s?directory=%s&amp;token=%s&amp;sortby=date\" STYLE=\"text-decoration: none; color:#FFFFFF;\">Modified</A>", cgiScriptName, virt_dirname_urlencoded, token);
     }
 
 
@@ -376,8 +372,9 @@ void dirlist(void) {
             "<!-- End of Header -->\n\n",
             namepfx, sizepfx, datepfx);
 
-
-    // Directories
+    //
+    // Enumerate Directories
+    //
     for(e=0; e<nentr; e++) {
         if(!S_ISDIR(direntry[e].type)) 
             continue;
@@ -385,6 +382,8 @@ void dirlist(void) {
             continue; 
             
         name=direntry[e].name;
+        name_urlencoded=url_encode(name);
+
         if(recursive_du) {
             snprintf(phys_filename, PHYS_FILENAME_SIZE, "%s/%s", phys_dirname, direntry[e].name);
             size=du(phys_filename);
@@ -448,7 +447,7 @@ void dirlist(void) {
             "<TD NOWRAP  ALIGN=\"RIGHT\"><SPAN TITLE=\"Created:%s\n Modified:%s\n Accessed:%s\n\">%s&nbsp;%s</FONT></SPAN></TD>\n"\
             "<TD NOWRAP >&nbsp;</TD>"\
             "<TD NOWRAP  ALIGN=\"LEFT\">",
-        cgiScriptName, sortby, (strcmp(virt_dirname, "/")==0) ? "" : virt_dirname, name,  token, icon, name,  
+        cgiScriptName, sortby, (strcmp(virt_dirname, "/")==0) ? "" : virt_dirname_urlencoded, name_urlencoded,  token, icon, name,  
         buprintf(size, TRUE), rtime, mtime, atime, stime, mtime);
 
         // rename
@@ -456,14 +455,14 @@ void dirlist(void) {
             "<A HREF=\"%s?action=rename_prompt&amp;directory=%s&amp;filename=%s&amp;token=%s\" TITLE=\"Rename '%s'\">\n"\
             "<IMG SRC=\"%srename.gif\" BORDER=0 WIDTH=16 HEIGHT=16 ALT=\"Rename File\">\n"\
             "</A>\n",
-            cgiScriptName, virt_dirname, name, token, name, ICONSURL);
+            cgiScriptName, virt_dirname_urlencoded, name_urlencoded, token, name, ICONSURL);
 
         // move
         fprintf(cgiOut, "\n"\
             "<A HREF=\"%s?action=move_prompt&amp;directory=%s&amp;filename=%s&amp;token=%s\" TITLE=\"Move '%s'\">\n"\
             "<IMG SRC=\"%smove.gif\" BORDER=0 WIDTH=16 HEIGHT=16 ALT=\"Move File\">\n"\
             "</A>\n",
-        cgiScriptName, virt_dirname, name, token, name, ICONSURL);
+        cgiScriptName, virt_dirname_urlencoded, name_urlencoded, token, name, ICONSURL);
 
         // delete
         fprintf(cgiOut, "\n"\
@@ -472,7 +471,7 @@ void dirlist(void) {
             "</A>\n"\
             "</TD>\n"\
             "</TR>\n\n\n",
-        cgiScriptName, virt_dirname, name, token, name, ICONSURL);
+        cgiScriptName, virt_dirname_urlencoded, name_urlencoded, token, name, ICONSURL);
                   
         totalsize+=size;
         n++;
@@ -487,6 +486,7 @@ void dirlist(void) {
             continue; 
 
         name=direntry[e].name;
+        name_urlencoded=url_encode(name);
         size=direntry[e].size;
 
         ctime_r(&direntry[e].atime, atime);
@@ -545,7 +545,7 @@ void dirlist(void) {
         fprintf(cgiOut,
             ">\n<TD NOWRAP  ALIGN=\"LEFT\"><INPUT TYPE=\"CHECKBOX\" NAME=\"multiselect_filename\" STYLE=\"border: none;\" VALUE=\"%s\">"
             "<A HREF=\"%s?action=%s&amp;directory=%s&amp;filename=%s&amp;token=%s\" TITLE=\"Open '%s'\">%s %s</A></TD>\n",
-        name, cgiScriptName, (edit_by_default && editable) ? "edit" : "sendfile", virt_dirname, name, token, name, icon, name);
+        name, cgiScriptName, (edit_by_default && editable) ? "edit" : "sendfile", virt_dirname_urlencoded, name_urlencoded, token, name, icon, name);
 
 
         // size / date
@@ -565,7 +565,7 @@ void dirlist(void) {
             "<A HREF=\"%s?action=rename_prompt&amp;directory=%s&amp;filename=%s&amp;token=%s\" TITLE=\"Rename '%s'\">\n"
             "<IMG SRC=\"%srename.gif\" BORDER=0 WIDTH=16 HEIGHT=16 ALT=\"Rename File\">\n"
             "</A>\n",
-            cgiScriptName, virt_dirname, name, token, name, ICONSURL);
+            cgiScriptName, virt_dirname_urlencoded, name_urlencoded, token, name, ICONSURL);
 
         // move
         fprintf(cgiOut, 
@@ -573,7 +573,7 @@ void dirlist(void) {
             "<A HREF=\"%s?action=move_prompt&amp;directory=%s&amp;filename=%s&amp;token=%s\" TITLE=\"Move '%s'\">"
             "<IMG SRC=\"%smove.gif\" BORDER=0 WIDTH=16 HEIGHT=16  ALT=\"Move '%s'\">\n"
             "</A>\n",
-            cgiScriptName, virt_dirname, name, token, name,  ICONSURL, name);
+            cgiScriptName, virt_dirname_urlencoded, name_urlencoded, token, name,  ICONSURL, name);
 
         // delete
         fprintf(cgiOut, 
@@ -582,7 +582,7 @@ void dirlist(void) {
             "TITLE=\"Remove '%s'\"> \n"
             "<IMG SRC=\"%sdelete.gif\" BORDER=0 WIDTH=16 HEIGHT=16 ALT=\"Delete File\">\n"
             "</A>\n",
-            cgiScriptName, virt_dirname, name, token, name, ICONSURL);
+            cgiScriptName, virt_dirname_urlencoded, name_urlencoded, token, name, ICONSURL);
 
 
         // view
@@ -605,7 +605,7 @@ void dirlist(void) {
                     "</A>\n"
                     "</TD>\n"
                     "</TR>\n\n",
-                cgiScriptName, virt_dirname, name, token, name, ICONSURL);
+                cgiScriptName, virt_dirname_urlencoded, name_urlencoded, token, name, ICONSURL);
             else
                 fprintf(cgiOut, 
                     "\n"
@@ -614,7 +614,7 @@ void dirlist(void) {
                     "</A>\n"
                     "</TD>\n"
                     "</TR>\n\n",
-                cgiScriptName, virt_dirname, name, token, name, ICONSURL);
+                cgiScriptName, virt_dirname_urlencoded, name_urlencoded, token, name, ICONSURL);
         }
         else {
             fprintf(cgiOut, 
diff --git a/fileio.c b/fileio.c
index 2b6d65d..c2efecd 100644
--- a/fileio.c
+++ b/fileio.c
@@ -82,7 +82,7 @@ void receivefile(void) {
     cgiFormFileClose(input);
     fclose(output);
     
-    redirect("%s?highlight=%s&directory=%s&token=%s", cgiScriptName, virt_filename, virt_dirname, token);
+    redirect("%s?highlight=%s&directory=%s&token=%s", cgiScriptName, virt_filename_urlencoded, virt_dirname_urlencoded, token);
 
 }
 
@@ -102,7 +102,8 @@ void mkfile(void) {
 
     fclose(output);
     
-    redirect("%s?highlight=%s&directory=%s&token=%s", cgiScriptName, virt_filename, virt_dirname, token);
+    redirect("%s?highlight=%s&directory=%s&token=%s", cgiScriptName, virt_filename_urlencoded, virt_dirname_urlencoded
+        , token);
 
 }
 
@@ -117,7 +118,7 @@ void newdir(void) {
     if(mkdir(phys_filename, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH )!=0)
         error("Unable to create directory.<BR>%s", strerror(errno));
     
-    redirect("%s?highlight=%s&directory=%s&token=%s", cgiScriptName, virt_filename, virt_dirname, token);
+    redirect("%s?highlight=%s&directory=%s&token=%s", cgiScriptName, virt_filename_urlencoded, virt_dirname_urlencoded, token);
 
 }
 
@@ -201,7 +202,7 @@ void edit_save(void) {
 
     free(buff);
 
-    redirect("%s?highlight=%s&directory=%s&token=%s", cgiScriptName, virt_filename, virt_dirname, token);
+    redirect("%s?highlight=%s&directory=%s&token=%s", cgiScriptName, virt_filename_urlencoded, virt_dirname_urlencoded, token);
 }
 
 //
@@ -286,7 +287,7 @@ void delete(void) {
         }
     }           
 
-    redirect("%s?directory=%s&token=%s", cgiScriptName, virt_dirname, token);
+    redirect("%s?directory=%s&token=%s", cgiScriptName, virt_dirname_urlencoded, token);
 }
 
 //
@@ -331,7 +332,7 @@ void move(void) {
         }
     }           
 
-    redirect("%s?highlight=%s&directory=%s&token=%s", cgiScriptName, virt_destination, virt_dirname, token);
+    redirect("%s?highlight=%s&directory=%s&token=%s", cgiScriptName, url_encode(virt_destination), virt_dirname_urlencoded, token);
 }
 
 
diff --git a/wfm.c b/wfm.c
index d91d4d1..516116f 100644
--- a/wfm.c
+++ b/wfm.c
@@ -101,7 +101,7 @@ void login(void) {
     
     if(strlen(username)) {
         snprintf(token_inp, sizeof(token_inp), "%s:%s:%s", cgiRemoteAddr, username, password);
-        redirect("%s?directory=%s&login=server&token=%s", cgiScriptName, virt_dirname, mktoken(token_inp));  // generate MD5 as if it was the client
+        redirect("%s?directory=%s&login=server&token=%s", cgiScriptName, virt_dirname_urlencoded, mktoken(token_inp));  // generate MD5 as if it was the client
     }
     else
         login_ui(); // display actual login page, which normally generates token in JavaScript
@@ -203,17 +203,19 @@ void checkfilename(char *inp_filename) {
 
     strncpy(temp_dirname, phys_filename, PHYS_FILENAME_SIZE);
     if(strlen(dirname(temp_dirname)) < strlen(HOMEDIR)) error("Invalid directory name.");
+
+    virt_filename_urlencoded=url_encode(virt_filename);
 }
 
 //
 // Check destination
-// Only used by move()
+// Only called by move()
 //
 void checkdestination(void) {
     int absolute_destination;
     
     cgiFormStringNoNewlines("destination", virt_destination, VIRT_DESTINATION_SIZE);
-    strip(virt_destination, VIRT_DESTINATION_SIZE, VALIDCHRS_DST);
+    strip(virt_destination, VIRT_DESTINATION_SIZE, VALIDCHRS_DIR);
     cgiFormInteger("absdst", &absolute_destination, 0);  // move operation relies on absolute paths
     if(absolute_destination)
         snprintf(phys_destination, PHYS_DESTINATION_SIZE, "%s/%s", HOMEDIR, virt_destination);
@@ -228,13 +230,13 @@ void checkdestination(void) {
 
 //
 // Check directory
-// Only used by cgiMain during initialization
+// Only called by cgiMain during initialization
 //
 void checkdirectory(void) {
     char temp[VIRT_DIRNAME_SIZE]={0};
     
     cgiFormStringNoNewlines("directory", virt_dirname, VIRT_DIRNAME_SIZE);
-    strip(virt_dirname, VIRT_DIRNAME_SIZE, VALIDCHRS_DST);
+    strip(virt_dirname, VIRT_DIRNAME_SIZE, VALIDCHRS_DIR);
     snprintf(phys_dirname, PHYS_DIRNAME_SIZE, "%s/%s", HOMEDIR, virt_dirname);
 
     if(strlen(phys_dirname)<2 || strlen(phys_dirname)>(PHYS_DIRNAME_SIZE-2)) 
@@ -245,9 +247,12 @@ void checkdirectory(void) {
 
     if(!strlen(virt_dirname)) strcpy(virt_dirname, "/");
 
+    virt_dirname_urlencoded=url_encode(virt_dirname);
+
     // parent
     strncpy(temp, virt_dirname, VIRT_DIRNAME_SIZE);
     strncpy(virt_parent, dirname(temp), VIRT_DIRNAME_SIZE);
+    virt_parent_urlencoded=url_encode(virt_parent);
 }
 
 
@@ -440,6 +445,7 @@ int cgiMain(void) {
     if(!strlen(FAVICON))
         strcpy(FAVICON, "wfmicon.gif");
 
+    snprintf(VALIDCHRS_DIR, sizeof(VALIDCHRS_DIR), "%s/", VALIDCHRS);
     checkdirectory();
 
     // JavaScript check
diff --git a/wfm.h b/wfm.h
index fec3add..17c38db 100644
--- a/wfm.h
+++ b/wfm.h
@@ -1,4 +1,4 @@
-#define VERSION "1.0.5"
+#define VERSION "1.1.0"
 #define copyright "<!-- WFM Version " VERSION ", Mountain View, CA, " __DATE__ " [" __TIME__ "] -->\n<!-- Copyright (c) 1994-2016 by Antoni Sawicki -->\n"
 
 #define CSS_STYLE         \
@@ -52,8 +52,8 @@
 #include "cgic.h"
 #include "wfmiconres.h"
 
-#define VALIDCHRS "anu-_."
-#define VALIDCHRS_DST "anu-_./"
+#define VALIDCHRS "an ()[]{}-_.,!@#$%^&=+;"
+char VALIDCHRS_DIR[256]; // above + /
 
 
 #define P1024_1 1024.0f
@@ -71,12 +71,15 @@
 #define PHYS_DESTINATION_SIZE 1280
 
 char virt_dirname[VIRT_DIRNAME_SIZE];
+char *virt_dirname_urlencoded;
 char phys_dirname[PHYS_DIRNAME_SIZE]; 
 char virt_filename[VIRT_FILENAME_SIZE]; 
+char *virt_filename_urlencoded; 
 char phys_filename[PHYS_FILENAME_SIZE];
 char virt_destination[VIRT_DESTINATION_SIZE]; 
 char phys_destination[PHYS_DESTINATION_SIZE];
 char virt_parent[VIRT_DIRNAME_SIZE];
+char *virt_parent_urlencoded;
 
 char ICONSURL[1024];
 char HOMEDIR[1024];
@@ -144,4 +147,5 @@ void login_ui(void);
 void tstop(void);
 void html_title(char *);
 void singleprompt_ui(char *);
-
+char *url_encode(char *);
+char *url_decode(char *);