Index: openacs-4/packages/file-storage/tcl/file-storage-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/file-storage/tcl/file-storage-procs.tcl,v
diff -u -N -r1.20 -r1.21
--- openacs-4/packages/file-storage/tcl/file-storage-procs.tcl	29 Jul 2002 03:53:15 -0000	1.20
+++ openacs-4/packages/file-storage/tcl/file-storage-procs.tcl	6 Aug 2002 13:27:15 -0000	1.21
@@ -307,6 +307,25 @@
         return [db_string select_object_name {} -default $object_id]
     }
 
+    ad_proc -public get_file_system_safe_object_name {
+        {-object_id:required}
+    } {
+        get the name of a file storage object and make it safe for writing to
+        the file system
+    } {
+        return [remove_special_file_system_characters -string [get_object_name -object_id $object_id]]
+    }
+
+    ad_proc -public remove_special_file_system_characters {
+        {-string:required}
+    } {
+        remove unsafe file system characters. useful if you want to use $string
+        as the name of an object to write to disk.
+    } {
+        regsub -all {[<>:\"|/\\]} $string {_} string
+        return $string
+    }
+
     ad_proc -public folder_p {
         {-object_id:required}
     } {
@@ -396,9 +415,9 @@
 
         db_1row select_object_info {}
 
-        if {[string match folder $type]} {
+        if {[string equal folder $type]} {
             set result [publish_folder_to_file_system -folder_id $object_id -path $path -folder_name $name -user_id $user_id]
-        } elseif {[string match url $type]} {
+        } elseif {[string equal url $type]} {
             set result [publish_simple_object_to_file_system -object_id $object_id -path $path -file_name $file_name]
         } else {
             set result [publish_versioned_object_to_file_system -object_id $object_id -path $path]
@@ -422,15 +441,16 @@
         if {[empty_string_p $folder_name]} {
             set folder_name [get_object_name -object_id $folder_id]
         }
+        set folder_name [remove_special_file_system_characters -string $folder_name]
 
-        set dir "${path}/${folder_name}"
+        set dir [file join ${path} ${folder_name}]
         file mkdir $dir
 
         foreach object [get_folder_contents -folder_id $folder_id -user_id $user_id] {
             publish_object_to_file_system \
                 -object_id [ns_set get $object object_id] \
                 -path $dir \
-                -file_name [ns_set get $object name] \
+                -file_name [remove_special_file_system_characters -string [ns_set get $object name]] \
                 -user_id $user_id
         }
 
@@ -474,12 +494,13 @@
         if {[empty_string_p $file_name]} {
             set file_name [ns_set get $object name]
         }
+        set file_name [remove_special_file_system_characters -string $file_name]
 
-        set fp [open "${path}/${file_name}" w]
+        set fp [open [file join ${path} ${file_name}] w]
         puts $fp [ns_set get $object url]
         close $fp
 
-        return "${path}/${file_name}"
+        return [file join ${path} ${file_name}]
     }
 
     ad_proc -public publish_versioned_object_to_file_system {
@@ -499,16 +520,17 @@
         if {[empty_string_p $file_name]} {
             set file_name $title
         }
+        set file_name [remove_special_file_system_characters -string $file_name]
 
         switch $storage_type {
             lob {
                 # FIXME: db_blob_get_file is failing when i use bind variables
-                db_blob_get_file select_object_content {} -file "${path}/${file_name}"
+                db_blob_get_file select_object_content {} -file [file join ${path} ${file_name}]
             }
             text {
                 set content [db_string select_object_content {}]
 
-                set fp [open "${path}/${file_name}" w]
+                set fp [open [file join ${path} ${file_name}] w]
                 puts $fp $content
                 close $fp
             }
@@ -517,7 +539,7 @@
                 set cr_file_name [db_string select_file_name {}]
 
                 set ifp [open "${cr_path}${cr_file_name}" r]
-                set ofp [open "${path}/${file_name}" w]
+                set ofp [open [file join ${path} ${file_name}] w]
 
                 ns_cpfp $ifp $ofp
 
@@ -526,7 +548,7 @@
             }
         }
 
-        return "${path}/${file_name}"
+        return [file join ${path} ${file_name}]
     }
 
     ad_proc -public get_archive_command {
Index: openacs-4/packages/file-storage/www/download-archive/index.vuh
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/file-storage/www/download-archive/index.vuh,v
diff -u -N -r1.3 -r1.4
--- openacs-4/packages/file-storage/www/download-archive/index.vuh	31 May 2002 19:06:23 -0000	1.3
+++ openacs-4/packages/file-storage/www/download-archive/index.vuh	6 Aug 2002 13:27:15 -0000	1.4
@@ -11,7 +11,7 @@
 }
 
 if {[exists_and_not_null object_id]} {
-    set download_name [fs::get_object_name -object_id $object_id]
+    set download_name [fs::get_file_system_safe_object_name -object_id $object_id]
     set ext [fs::get_archive_extension]
     if {![empty_string_p $ext]} {
         append download_name ".${ext}"
@@ -45,7 +45,7 @@
 set out_path [ns_tmpnam]
 file mkdir $out_path
 
-set out_file "${out_path}/${download_name}"
+set out_file [file join ${out_path} ${download_name}]
 
 # get the archive command
 set cmd [fs::get_archive_command -in_file $file_name -out_file $out_file]