diff --git a/copyparty/__version__.py b/copyparty/__version__.py
index 60dd9d37..ddfa7bb8 100644
--- a/copyparty/__version__.py
+++ b/copyparty/__version__.py
@@ -1,6 +1,6 @@
 # coding: utf-8
 
-VERSION = (0, 12, 4)
+VERSION = (0, 12, 5)
 CODENAME = "fil\033[33med"
 BUILD_DT = (2021, 7, 30)
 
diff --git a/copyparty/httpcli.py b/copyparty/httpcli.py
index 2b5986b1..72420d36 100644
--- a/copyparty/httpcli.py
+++ b/copyparty/httpcli.py
@@ -182,7 +182,7 @@ class HttpCli(object):
 
         self.uparam = uparam
         self.cookies = cookies
-        self.vpath = unquotep(vpath)
+        self.vpath = unquotep(vpath)  # not query, so + means +
 
         pwd = uparam.get("pw")
         self.uname = self.asrv.iacct.get(pwd, "*")
@@ -1310,11 +1310,9 @@ class HttpCli(object):
         else:
             fn = self.headers.get("host", "hey")
 
-        afn = "".join(
-            [x if x in (string.ascii_letters + string.digits) else "_" for x in fn]
-        )
-
-        bascii = unicode(string.ascii_letters + string.digits).encode("utf-8")
+        safe = (string.ascii_letters + string.digits).replace("%", "")
+        afn = "".join([x if x in safe.replace('"', "") else "_" for x in fn])
+        bascii = unicode(safe).encode("utf-8")
         ufn = fn.encode("utf-8", "xmlcharrefreplace")
         if PY2:
             ufn = [unicode(x) if x in bascii else "%{:02x}".format(ord(x)) for x in ufn]
@@ -1329,6 +1327,7 @@ class HttpCli(object):
 
         cdis = "attachment; filename=\"{}.{}\"; filename*=UTF-8''{}.{}"
         cdis = cdis.format(afn, fmt, ufn, fmt)
+        self.log(cdis)
         self.send_headers(None, mime=mime, headers={"Content-Disposition": cdis})
 
         fgen = vn.zipgen(rem, items, self.uname, dots, not self.args.no_scandir)
@@ -1621,6 +1620,9 @@ class HttpCli(object):
         if not dst:
             raise Pebkac(400, "need dst vpath")
 
+        # x-www-form-urlencoded (url query part) uses
+        # either + or %20 for 0x20 so handle both
+        dst = unquotep(dst.replace("+", " "))
         x = self.conn.hsrv.broker.put(
             True, "up2k.handle_mv", self.uname, self.vpath, dst
         )
diff --git a/copyparty/web/browser.js b/copyparty/web/browser.js
index 895c7641..d8d80496 100644
--- a/copyparty/web/browser.js
+++ b/copyparty/web/browser.js
@@ -1468,10 +1468,10 @@ var fileman = (function () {
 		if (r.clip === null)
 			r.clip = jread('fman_clip', []);
 
-		var sel = msel.getsel();
-		clmod(bren, 'en', sel.length == 1);
-		clmod(bdel, 'en', sel.length);
-		clmod(bcut, 'en', sel.length);
+		var nsel = msel.getsel().length;
+		clmod(bren, 'en', nsel == 1);
+		clmod(bdel, 'en', nsel);
+		clmod(bcut, 'en', nsel);
 		clmod(bpst, 'en', r.clip && r.clip.length);
 		bren.style.display = have_mv && has(perms, 'write') && has(perms, 'move') ? '' : 'none';
 		bdel.style.display = have_del && has(perms, 'delete') ? '' : 'none';
@@ -3367,8 +3367,13 @@ var msel = (function () {
 		ev(e);
 		var names = r.getsel(),
 			arg = ebi('selzip').getAttribute('fmt'),
-			txt = names.join('\n'),
-			frm = mknod('form');
+			frm = mknod('form'),
+			txt = [];
+
+		for (var a = 0; a < names.length; a++)
+			txt.push(names[a].name);
+
+		txt = txt.join('\n');
 
 		frm.setAttribute('action', '?' + arg);
 		frm.setAttribute('method', 'post');
diff --git a/docs/notes.sh b/docs/notes.sh
index a29314a7..254beaaa 100644
--- a/docs/notes.sh
+++ b/docs/notes.sh
@@ -44,7 +44,7 @@ avg() { awk 'function pr(ncsz) {if (nsmp>0) {printf "%3s %s\n", csz, sum/nsmp} c
 dirs=("$HOME/vfs/ほげ" "$HOME/vfs/ほげ/ぴよ" "$HOME/vfs/$(printf \\xed\\x91)" "$HOME/vfs/$(printf \\xed\\x91/\\xed\\x92)")
 mkdir -p "${dirs[@]}"
 for dir in "${dirs[@]}"; do for fn in ふが "$(printf \\xed\\x93)" 'qwe,rty;asd fgh+jkl%zxc&vbn <qwe>"rty'"'"'uio&asd&nbsp;fgh'; do echo "$dir" > "$dir/$fn.html"; done; done
-
+# qw er+ty%20ui%%20op<as>df&gh&amp;jk#zx'cv"bn`m=qw*er^ty?ui@op,as.df-gh_jk
 
 ##
 ## upload mojibake