--- docman.php	2000/09/13 08:27:43	1.21
+++ docman.php	2001/03/27 10:54:02	1.38
@@ -35,22 +35,14 @@
 /*             existent address after file modifications.       */
 
 /*
-	2000-07-25 Dobrica Pavlinusic <dpavlin@rot13.org>
 
-	nuked exec calls (unsecure)
-	nuked writeable function (replaced by php is_writeable)
-	added support for https (tested with apache+mod_ssl)
-	added users file
-	date format user-selectable
-	cycle backup files in bak directory
-	support links as directoryes (for now)
-	support of file history logging
-	undelete capabilities (delete moves to .del directory)
+	This project is now called Directory Manager.
 
-	2000-07-26 DbP
+	For more info, please see web pages at
+	http://www.rot13.org/~dpavlin/docman.html
 
-	added more checking on entered filename (when creating file/dir)
-	added rename option
+	It's relased under GPL by
+	Dobrica Pavlinusic <dpavlin@rot13.org>
 
 
 IMPORTANT INSTALLATION NOTE:
@@ -59,15 +51,14 @@
 	deleted files!
 
 	.htusers is in form:
-	login:Real Name:md5(loginpassword)
+	login:Real Name:[md5(loginpassword)|auth_*]:email@host.dom
 
 
 TODO:
 	mixed file/directory output (add type to each entry,
 		real support for links)
-	retrieve old versions of files (overwritten)
-	show last lock date
-	
+	access controll
+
 */
 
 //////////////////////////////////////////////////////////////////
@@ -80,45 +71,24 @@
 
 // GLOBAL PARAMETERS
 // =================
-// Make modifications here to suit siteman to your needs
+// Make modifications here to suit docman to your needs
 
 // 	error_reporting(4) ;		// how verbose ?
 
+	// from where to include auth_*.php modules?
+	$gblIncDir = "/home/httpd/docman";
+
 	// username/password should not be system 
 	// usernames/passwords !!
 
-//	$gblPw    = "hash_of_your_username_and_password" ;
-
-//	$gblAuth  = false ;             // use builtin authentication
-	$gblAuth  = true ;             // use builtin authentication
-        $gblHash  = "md5" ;             // hash function to use
-
 	$gblPw    = "";
 
-	if ($gblAuth) {
-		$htusers_file=dirname($SCRIPT_FILENAME)."/.htusers";
-		if (! file_exists($htusers_file)) {
-			$htusers=fopen($htusers_file,"a+");
-			fputs($htusers,"# Change owner of $htusers_file to root !!\n");
-			fputs($htusers,"demo:full name:md5_hash\n");
-			fclose($htusers);
-		}
-		$htusers=fopen($htusers_file,"r");
-		while($user = fgetcsv($htusers,255,":")) {
-			if ($user[0] == $GLOBALS["PHP_AUTH_USER"]) {
-				$gblUserName=$user[1];
-				$gblPw=$user[2];
-				$gblEmail=$user[3];
-				continue ;
-			}
-		}
-		fclose($htusers);
-	}
-
+	// date format
 //	$gblDateFmt="D, F d, Y";
-//	$gblTimeFmt="g:i:sA";
-
 	$gblDateFmt="Y-m-d";
+
+	// time format
+//	$gblTimeFmt="g:i:sA";
 	$gblTimeFmt="H:i:s";
 
 	// Number of backup files to keep
@@ -130,12 +100,12 @@
 	// choose GifIcon below unless you have the M$
 	// WingDings font installed on your system
 
-	$gblIcon = "GifIcon" ;		// MockIcon or GifIcon
+	$gblIcon="GifIcon";		// MockIcon or GifIcon
 
 	// the directory below should be /icons/ or /icons/small/ 
 	// on Apache; a set of icons is included in the distribution
 
-	$gblIconLocation = "/icons/" ; 
+	$gblIconLocation="/icons/"; 
 
 	// files you want to be able to edit in text mode
 	// and view with (primitive) syntax highlighting
@@ -154,7 +124,7 @@
 
 function StartHTML($title,$text="") {
 
-	$title = "Site Manager " . $title ;
+	$title = "Document Manager " . $title ;
 	$host  = $GLOBALS["HTTP_HOST"] ;
 	$self  = $GLOBALS["PHP_SELF"] ;
 ?>
@@ -233,7 +203,7 @@
 
 function DetailPage($fsRoot,$relDir,$fn) {
 	
-	global $gblEditable, $gblImages ;
+	global $gblEditable, $gblImages, $webRoot ;
 	$self = $GLOBALS["PHP_SELF"] ;
 
 	$relPath  = $relDir . "/" . $fn ;
@@ -252,7 +222,11 @@
 		Error("Creation denied",$relDir) ;
 
 	$text  = "Use this page to view, modify or " ;
-	$text .= "delete a single document on this " ;
+	if (is_dir($fsPath)) {
+		$text .="delete a directory on this " ;
+	} else {
+		$text .= "delete a single document on this " ;
+	};
 	$text .= "web site." ;	
 	$title = "(Detail Page)" ;
 	StartHTML($title, $text) ;
@@ -262,18 +236,23 @@
 		$fsize = filesize($fsPath) ; 
 		$fmodified = date("$GLOBALS[gblDateFmt] $GLOBALS[gblTimeFmt]", filemtime($fsPath)) ;
 		$faccessed = date("$GLOBALS[gblDateFmt] $GLOBALS[gblTimeFmt]", fileatime($fsPath)) ;
-		echo "<PRE>    file size: " . $fsize . " Bytes<BR>" ;
+		$fuid=fileowner($fsPath);
+		$fgid=filegroup($fsPath);
+		$userinfo = posix_getpwuid($fuid);
+		$grpinfo = posix_getgrgid($fgid);
+		echo "<PRE>";
+		if (!is_dir($fsPath)) echo "    file size: " . $fsize . " Bytes<BR>" ;
 		echo "last modified: <B>" . $fmodified . "</B><BR>" ;
 		echo "last accessed: <B>" . $faccessed . "</B><BR>" ;
-		echo "        owner: <B>" . fileowner($fsPath) . "</B><BR>" ;
-		echo "        group: <B>" . filegroup($fsPath) . "</B><BR>" ;
+		echo "        owner: <B>" . $userinfo["name"] . " [$fuid]</B><BR>" ;
+		echo "        group: <B>" . $grpinfo["name"] . " [$fgid]</B><BR>" ;
 		echo "  permissions: <B>" ; 
 		echo printf( "%o", fileperms($fsPath) ) . "</B>" ;
 		echo "</PRE>" ;
 
 	}
 
-	if ( $editable && ($writable || !$exists) && !$file_lock ) { 
+	if ( !is_dir($fsPath) && $editable && ($writable || !$exists) && !$file_lock ) { 
 		$fh = fopen($fsPath,"a+") ;
 		rewind($fh) ;
 		$fstr = fread($fh,filesize($fsPath)) ;
@@ -301,7 +280,7 @@
 	}
 	if ( !$file_lock && $ext!="" && strstr(join(' ',$gblImages),$ext) ) {  
 		$info  = getimagesize($fsPath) ;
-		$tstr = "<IMG SRC=\"".urlpath($relPath)."\" BORDER=0 " ;
+		$tstr = "<IMG SRC=\"$webRoot".urlpath($relPath)."\" BORDER=0 " ;
 		$tstr .= $info[3] . " ALT=\"" . $fn . " - " ;
 		$tstr .= (int)(($fsize+1023)/1024) . "Kb\">" ;
 //		echo htmlentities($tstr) . "<BR><BR>" . $tstr ;
@@ -367,25 +346,30 @@
 </FORM>
 
 <?php
-	
+
 	$name=basename("$fsDir/$fn");
 	$logname=dirname("$fsDir/$fn")."/.log/$name";
 	$bakdir=dirname("$fsDir/$fn")."/.bak";
 	if (file_exists($logname)) {
 		$log=fopen($logname,"r");
-		$cl1=" class=lst"; $cl2="";
+		$cl1=" class=LST"; $cl2="";
 		$logarr = array();
 		while($line = fgetcsv($log,255,"\t")) {
 			$cl=$cl1; $cl1=$cl2; $cl2=$cl;
 			array_unshift($logarr,array($cl,$line[0],$line[1],$line[2],$line[3]));
 		}
 		fclose($log);
-		print "<hr><br><b>CHANGES TO THIS FILE</b><br><table border=0 width=100%>\n";
+		if (is_dir("$fsDir/$fn")) {
+			$whatis="DIRECTORY";
+		} else {
+			$whatis="FILE";
+		}
+		print "<hr><br><b>CHANGES TO THIS $whatis</b><br><table border=0 width=100%>\n";
 		$bakcount = 0;	// start from 0, skip fist backup (it's current)
 		while ($e = array_shift($logarr)) {
 			if (strstr($e[4],"upload")) {
 				if (file_exists("$bakdir/$bakcount/$name")) {
-					$e[4]="<a href=\"".dirname($relPath)."/.bak/$bakcount/$name\">$e[4]</a>";
+					$e[4]="<a href=\"$webRoot".urlpath(dirname($relPath)."/.bak/$bakcount/$name")."\">$e[4]</a>";
 				}
 				$bakcount++;
 			}
@@ -646,15 +630,11 @@
 
 function Navigate($fsRoot,$relDir) {
 
-	global $gblEditable, $gblIcon, $gblModDays ;
+	global $gblEditable, $gblIcon, $gblModDays, $webRoot ;
 
 	$self     = $GLOBALS["PHP_SELF"] ;
-	if (isset($GLOBALS["HTTPS"]) && $GLOBALS["HTTPS"] == "on") {
-		$webRoot  = "https://" . $GLOBALS["SERVER_NAME"] ;
-	} else {
-		$webRoot  = "http://" . $GLOBALS["SERVER_NAME"] ;
-	}
-	$fsDir    = $fsRoot . $relDir . "/" ; // current directory
+
+	$fsDir = $fsRoot . $relDir . "/" ; // current directory
 
 	if (!is_dir($fsDir)) Error("Dir not found",$relDir) ; 
 
@@ -719,18 +699,23 @@
 		sort($dirList) ; 
 ?>
 
-<TR><TD></TD><TD COLSPAN=5 CLASS=TOP><HR>DIRECTORY NAME</TD></TR>
+<TR><TD></TD><TD COLSPAN=2 CLASS=TOP>DIRECTORY NAME</TD><TD COLSPAN=3 CLASS=TOP>DIRECTORY NOTE</TR>
 
 <?php
 		while (list($key,$dir) = each($dirList)) {
 
+			$info_url=$self."?A=E&F=".urlencode($dir)."&D=".urlencode($relDir);
 			$tstr = "<A HREF=\"" . $self . "?D=" ; 
 			$tstr .= urlencode($relDir."/".$dir) ;
 			$tstr .= "\">" . $dir . "/</A>" ;
+			$note_html="<a href=\"$info_url#note\">".$gblIcon("note")."</a>".ReadNote($fsDir.$dir);
 ?>
 
-<TR><TD><?= $gblIcon("fldr") ?></TD>
-<TD COLSPAN=5 CLASS=LST><?= $tstr ?></TD></TR>
+<TR><TD>
+<A HREF="<?= $info_url ?>" TITLE="View/Edit">
+<?= $gblIcon("fldr") ?></A></TD>
+<TD COLSPAN=2 CLASS=LST><?= $tstr ?></TD>
+<TD COLSPAN=3 CLASS=LST><?= $note_html ?></TD></TR>
 
 <?php
 		}  // iterate over dirs
@@ -829,7 +814,13 @@
 
 <?php
 	  }  // iterate over files
-	}  // end if no files
+	} else {  // end if no files
+?>
+ <TR><TD></TD><TD COLSPAN=5 CLASS=LST>
+  No files in this directory
+ </TD></TR>
+<?
+	}
 
 	if ($emptyDir) {
 ?>
@@ -849,15 +840,14 @@
 
 <TR><TD></TD><TD COLSPAN=5><HR></TD></TR>
 
-<TR><TD></TD><TD COLSPAN=5>
 <?
 if (file_exists(".info.inc")) {
+	print "<TR><TD></TD><TD COLSPAN=5>";
 	include(".info.inc");
+	print "</TD></TR>
+	<TR><TD></TD><TD COLSPAN=5><HR></TD></TR>";
 }
 ?>
-</TD></TR>
-
-<TR><TD></TD><TD COLSPAN=5><HR></TD></TR>
 
 <FORM METHOD="POST" ACTION="<?= $self ?>">
 <TR><TD></TD><TD COLSPAN=5 CLASS=BAR>CREATE NEW
@@ -879,7 +869,7 @@
 
 //////////////////////////////////////////////////////////////////
 
-function UploadPage($fsRoot, $relDir, $filename) {
+function UploadPage($fsRoot, $relDir, $filename="") {
 
 	$self = $GLOBALS["PHP_SELF"] ;
 	if ($relDir == "") $relDir = "/" ; 
@@ -889,7 +879,7 @@
 <FORM ENCTYPE="multipart/form-data" METHOD="POST" 
  ACTION="<?= $self ?>">
 DESTINATION DIRECTORY:<B><?= " " . $relDir ?></B>
-<? if (isset($filename)) { ?>
+<? if (isset($filename) && $filename!="") { ?>
 <br>DESTINATION FILE:<B><?= " " . $filename ?></B>
 <INPUT TYPE="HIDDEN" NAME="FILENAME" VALUE="<?= $filename ?>">
 <? } ?>
@@ -924,29 +914,6 @@
 
 //////////////////////////////////////////////////////////////////
 
-function CreateHash($user, $pw) {
-
-	global $gblHash ;  // hash function to use 
-
-	if ($user == "" || $pw == "") {
-		$text = "either no password or no username supplied" ;
-		Error("Create Hash",$text) ;
-	}
-	$title = "(Create Hash)" ;
-	StartHTML($title) ;
-	echo "<P ALIGN=center>" ;
-	echo "<BLOCKQUOTE>Copy the value below and paste it " ;
-	echo "into the<BR>value for \$gblPw in the source of " ;
-	echo "this file<BR><BR><B>" . $gblHash($user.$pw) ;
-	echo "</B><BR><BR>Hash function: " . $gblHash ;
-	echo "</BLOCKQUOTE></P>" ;
-	EndHTML() ;
-	exit ;
-
-} // end function CreateHash
-
-//////////////////////////////////////////////////////////////////
-
 function NoEntry() {
 
 	$user = $GLOBALS["PHP_AUTH_USER"] ;
@@ -956,20 +923,7 @@
 	$title = "(401 Unauthorized)" ;
 	$text  = "No trespassing !" ;
 	StartHTML($title,$text) ;
-?>
-
-<FORM ACTION="<?= $self ?>?HASH=create" METHOD="POST">
-<INPUT TYPE="HIDDEN" NAME="USER" VALUE="<?= $user ?>">
-<INPUT TYPE="HIDDEN" NAME="PW" VALUE="<?= $pw ?>">
-
-<BLOCKQUOTE><B>If you are a site administrator:</B><BR><BR>
-Click below to <B>generate a password hash</B><BR>from 
-the username-password pair you just<BR>entered. Then include the hash in 
-the source<BR>of this file.<BR><BR>
-<INPUT TYPE="SUBMIT" VALUE="CREATE HASH">
-</BLOCKQUOTE></FORM>
 
-<?php
 	EndHTML() ;
 	exit ;
 }
@@ -978,7 +932,6 @@
 
 function LogIt($target,$msg) {
 
-	$target=stripSlashes($target);
 	$dir=dirname($target);
 	if (! file_exists($dir."/.log")) {
 		mkdir($dir."/.log",0700);
@@ -1104,12 +1057,40 @@
 
 //////////////////////////////////////////////////////////////////
 
-function safe_rename($from,$to) {
-	if (file_exists($from) && is_writable(dirname($to))) {
-		rename($from,$to);
+function safe_rename($fromdir,$fromfile,$tofile) {
+	function try_rename($from,$to) {
+		print "$from -> $to\n";
+		if (file_exists($from) && is_writeable(dirname($to))) {
+			rename($from,$to);
+		}
+	}
+
+	function try_dir($todir) {
+		if (! file_exists($todir)) {
+			mkdir($todir,0700);
+	        }
+	}
+
+	$to="$fromdir/$tofile";
+	$todir=dirname($to);
+	$tofile=basename($to);
+
+	print "<pre>$fromdir / $fromfile -> $todir / $tofile\n\n";
+
+	try_rename("$fromdir/$fromfile","$todir/$tofile");
+	try_dir("$todir/.log");
+	try_rename("$fromdir/.log/$fromfile","$todir/.log/$tofile");
+	try_dir("$todir/.note");
+	try_rename("$fromdir/.note/$fromfile","$todir/.note/$tofile");
+	try_dir("$todir/.lock");
+	try_rename("$fromdir/.lock/$fromfile","$todir/.lock/$tofile");
+	try_dir("$todir/.bak");
+	for($i=0;$i<=$GLOBALS[gblNumBackups];$i++) {
+		try_rename("$fromdir/.bak/$i/$fromfile","$todir/.bak/$i/$tofile");
 	}
 }
 
+
 //////////////////////////////////////////////////////////////////
 
 // recursivly delete directory
@@ -1148,12 +1129,12 @@
 	$log=fopen("$gblFsRoot/.changelog","r");
 	$logarr = array();
 	while($line = fgetcsv($log,255,"\t")) {
-		if ($day!=1 || ($day==1 && (time()-$line[0] < 24*60))) {
+		if ($day!=1 || ($day==1 && (time()-$line[0] < 24*60*60))) {
 			array_unshift($logarr,array($line[0],$line[1],$line[2],$line[3]));
 		}
 	}
 	fclose($log);
-	$cl1=" class=lst"; $cl2="";
+	$cl1=" class=LST"; $cl2="";
 	print "<table border=0 width=100%>\n";
 	while ($e = array_shift($logarr)) {
 		$cl=$cl1; $cl1=$cl2; $cl2=$cl;
@@ -1184,15 +1165,44 @@
 	// forks before authentication: style sheet and hash
 	// creation if password not yet set.
 	if ($STYLE == "get") { CSS() ; exit ; }
-	if ($HASH != "") { 
-		CreateHash($USER, $PW) ; 
-		exit ; 
+
+	$htusers_file=dirname($SCRIPT_FILENAME)."/.htusers";
+	if (! file_exists($htusers_file)) {
+		if (is_writeable(dirname($SCRIPT_FILENAME))) {
+			$htusers=fopen($htusers_file,"a+");
+			fputs($htusers,"# Change owner of $htusers_file to root !!\n");
+			fputs($htusers,"demo:full name:[md5_hash|auth_*]:e-mail\n");
+			fclose($htusers);
+			Error("Proto user file created!","Please edit <tt>$htusers_file</tt> and set it correct permissions (<B>not writable by web server as it is now!</b>). You can add users using <tt>adduser.pl</tt> script!");
+			exit;
+		} else {
+			Error("Can't create proto user file!","Please make directory <tt>".dirname($htusers_file)."</tt> writable or create <tt>.htusers</tt> file by hand using <tt>adduser.pl</tt> script!");
+			exit;
+		}
 	}
+	$htusers=fopen($htusers_file,"r");
+	while($user = fgetcsv($htusers,255,":")) {
+		if ($user[0] == $GLOBALS["PHP_AUTH_USER"]) {
+			$gblUserName=$user[1];
+			$gblPw=$user[2];
+			if (substr($gblPw,0,5) == "auth_" && file_exists("$gblIncDir/$gblPw.php")) {
+				require("$gblIncDir/$gblPw.php");
+				if ($gblPw($user)) {
+					$gblPw=md5($PHP_AUTH_USER.$PHP_AUTH_PW);
+				} else {
+					$gblPw="error".md5($PHP_AUTH_USER.$PHP_AUTH_PW);
+				}
+			}
+			$gblEmail=$user[3];
+			continue ;
+		}
+	}
+	fclose($htusers);
 
-	// authentication if $gblAuth == true
-	if ( $gblAuth && $gblHash($PHP_AUTH_USER.$PHP_AUTH_PW) != $gblPw ||
+	// authentication failure
+	if ( md5($PHP_AUTH_USER.$PHP_AUTH_PW) != $gblPw ||
 		isset($relogin) && $gblPw == $relogin ) {
-		header("WWW-authenticate: basic realm=\"$SERVER_NAME\"") ;
+		header("WWW-authenticate: basic realm=\"$HTTP_HOST\"") ;
 		header("HTTP/1.0 401 Unauthorized") ;
 		NoEntry() ;
 		exit ;
@@ -1204,6 +1214,8 @@
 		$relDir = urldecode($D) ;  // then use GET
 	}	
 
+	$relDir=stripSlashes($relDir);
+
 	if ($relDir == "/") $relDir = "" ; 	
 	// default : website root = ""
 
@@ -1215,18 +1227,33 @@
 	// i.e. below $gblFsRoot.
 
 	$relScriptDir = dirname($SCRIPT_NAME) ;  	
-	// i.e. /siteman
+	// i.e. /docman
 
 	$fsScriptDir  = dirname($SCRIPT_FILENAME) ; 	
-	// i.e. /home/httpd/html/siteman
+	// i.e. /home/httpd/html/docman
 
-	$gblFsRoot = substr($fsScriptDir,0,
-	  strlen($fsScriptDir)-strlen($relScriptDir)) ;
+	// start on server root
+//	$gblFsRoot = substr($fsScriptDir,0, strlen($fsScriptDir)-strlen($relScriptDir)) ;
+	// or on script root
+	$gblFsRoot = $fsScriptDir;
 	// i.e. /home/httpd/html
 
 	$fsDir = $gblFsRoot . $relDir ; // current directory
 	if ( !is_dir($fsDir) ) Error("Dir not found",$relDir) ;
-	
+
+	if (isset($GLOBALS["HTTPS"]) && $GLOBALS["HTTPS"] == "on") {
+		$webRoot  = "https://";
+	} else {
+		$webRoot  = "http://";
+	}
+	$webRoot .= $GLOBALS["HTTP_HOST"] . $relScriptDir;
+
+	$FN=stripSlashes($FN);
+
+	if (file_exists("$fsScriptDir/.docman.conf")) {
+		include("$fsScriptDir/.docman.conf");
+	}
+
 	switch ($POSTACTION) {
 	case "UPLOAD" :
 		if (!is_writeable($fsDir)) Error("Write denied",$relDir) ;
@@ -1235,6 +1262,9 @@
 		// TODO : should rather check for escapeshellcmds
 		// but maybe RFC 18xx asserts safe filenames ....
 		$source = $FN ;
+		if (! file_exists($source)) {
+			Error("You must select file with browse to upload it!");
+		}
 		if (! isset($FILENAME)) { 	// from update file
 			$target = "$fsDir/$FN_name" ;
 		} else {
@@ -1267,6 +1297,7 @@
 
 	case "SAVE" :
 		$path = $gblFsRoot . $RELPATH ;
+		$path=stripSlashes($path);
 		$writable = is_writeable($path) ;
 		$legaldir = is_writeable(dirname($path)) ;
 		$exists   = (file_exists($path)) ? 1 : 0 ; 
@@ -1274,6 +1305,7 @@
 	 	if (!($writable || (!$exists && $legaldir))) 
 			Error("Write denied",$RELPATH) ;
 		$fh = fopen($path, "w") ;
+		$FILEDATA=stripSlashes($FILEDATA);
 		fwrite($fh,$FILEDATA) ;
 		fclose($fh) ;
 		clearstatcache() ;
@@ -1297,7 +1329,7 @@
 // this functionality is doubled in DetailView().
 // better keep it here altogether
 // chmod perms to $gblFilePerms
-			if ( file_exists($path) && !is_writable($path) ) 
+			if ( file_exists($path) && !is_writeable($path) ) 
 				Error("File not writable", $relPath) ;
 			$fh = fopen($path, "w+") ;
 			if ($fh) {
@@ -1369,14 +1401,7 @@
 		if ( $CONFIRM != "on" ) break ;
 
 		Logit("$fsDir/$FN","renamed $FN to $NEWNAME");
-		safe_rename("$fsDir/$FN","$fsDir/$NEWNAME");
-		safe_rename("$fsDir/.log/$FN","$fsDir/.log/$NEWNAME");
-		safe_rename("$fsDir/.note/$FN","$fsDir/.note/$NEWNAME");
-		safe_rename("$fsDir/.lock/$FN","$fsDir/.lock/$NEWNAME");
-		for($i=0;$i<=$GLOBALS[gblNumBackups];$i++) {
-			safe_rename("$fsDir/.bak/$i/$FN","$fsDir/.bak/$i/$NEWNAME");
-		}
-
+		safe_rename($fsDir,$FN,$NEWNAME);
 		break ;
 
 	case "NOTE" :  
@@ -1408,24 +1433,24 @@
 	// $A=V : view file (do nothing except log)
 	// default : display directory $D
 
-	$F=stripSlashes($F);
-
 	switch ($A) {
 	case "U" :
 		// upload to $relDir
 		if (!is_writeable($gblFsRoot . $relDir)) 
 			Error("Write access denied",$relDir) ;
 		$text  = "Use this page to upload a single " ;
-		$text .= "file to <B>$SERVER_NAME</B>." ;
+		$text .= "file to <B>$HTTP_HOST</B>." ;
 		StartHTML("(Upload Page)", $text) ;
 		UploadPage($gblFsRoot, $relDir) ;
 		EndHTML() ;
 		exit ;
 	case "E" :
+		$F=stripSlashes($F);
 		// detail of $relDir/$F
-		if (is_file("$gblFsRoot/$relDir/$F")) DetailPage($gblFsRoot, $relDir, $F) ;
+		if (is_file("$gblFsRoot/$relDir/$F") || is_dir("$gblFsRoot/$relDir/$F")) DetailPage($gblFsRoot, $relDir, $F) ;
 		exit ;
 	case "C" :
+		$F=stripSlashes($F);
 		// listing of $relDir/$F 
 		DisplayCode($gblFsRoot, $relDir, $F) ;
 		exit ;
@@ -1433,14 +1458,15 @@
 		// checkout
 		Lock("$gblFsRoot/$relDir/$F");
 		header("Content-Disposition: attachment; filename=$F" );
-		Header("Location: ".urlpath("$relDir/$F"));
+		Header("Location: $webRoot".urlpath("$relDir/$F"));
 		exit;
 	case "Ci" :
+		$F=stripSlashes($F);
 		// upload && update to $relDir
 		if (!is_writeable($gblFsRoot . $relDir)) 
 			Error("Write access denied",$relDir) ;
 		$text  = "Use this page to update a single " ;
-		$text .= "file to <B>$SERVER_NAME</B>." ;
+		$text .= "file to <B>$HTTP_HOST</B>." ;
 		StartHTML("(Update file Page)", $text) ;
 		UploadPage($gblFsRoot, $relDir, $F) ;
 		EndHTML() ;
@@ -1449,7 +1475,7 @@
 		// view
 		LogIt("$gblFsRoot/$relDir/$F","viewed");
 		header("Content-Disposition: attachment; filename=$F" );
-		Header("Location: ".urlpath("$relDir/$F"));
+		Header("Location: $webRoot".urlpath("$relDir/$F"));
 		exit;
 	case "Ch" :
 		StartHTML("(File changes)","All changes chronologicaly...");