diff --git a/copyparty/httpcli.py b/copyparty/httpcli.py
index 312404aa..eea1873d 100644
--- a/copyparty/httpcli.py
+++ b/copyparty/httpcli.py
@@ -284,10 +284,11 @@ class HttpCli(object):
                 msg = str(ex) if pex == ex else min_ex()
                 self.log("{}\033[0m, {}".format(msg, self.vpath), 3)
 
-                msg = "<pre>{}\r\nURL: {}\r\n".format(str(ex), self.vpath)
+                msg = "{}\r\nURL: {}\r\n".format(str(ex), self.vpath)
                 if self.hint:
                     msg += "hint: {}\r\n".format(self.hint)
 
+                msg = "<pre>" + html_escape(msg)
                 self.reply(msg.encode("utf-8", "replace"), status=pex.code, volsan=True)
                 return self.keepalive
             except Pebkac:
@@ -1879,7 +1880,7 @@ class HttpCli(object):
         if self.args.no_stack:
             raise Pebkac(403, "the stackdump feature is disabled in server config")
 
-        ret = "<pre>{}\n{}".format(time.time(), alltrace())
+        ret = "<pre>{}\n{}".format(time.time(), html_escape(alltrace()))
         self.reply(ret.encode("utf-8"))
 
     def tx_tree(self):
diff --git a/copyparty/web/up2k.js b/copyparty/web/up2k.js
index 185422a5..31851a79 100644
--- a/copyparty/web/up2k.js
+++ b/copyparty/web/up2k.js
@@ -1811,11 +1811,8 @@ function up2k_init(subtle) {
                     tasker();
                     return;
                 }
-                toast.err(0, "server broke; hs-err {0} on file [{1}]:\n".format(
-                    xhr.status, t.name) + (
-                        (xhr.response && xhr.response.err) ||
-                        (xhr.responseText && xhr.responseText) ||
-                        "no further information"));
+                err = t.t_uploading ? "finalize upload" : t.srch ? "perform search" : "initiate upload";
+                xhrchk(xhr, "server rejected the request to " + err + ";\n\nfile: " + t.name + "\n\nerror ", "404, target folder not found");
             }
         }
         xhr.onload = function (e) {
@@ -1874,8 +1871,7 @@ function up2k_init(subtle) {
                 console.log("ignoring dupe-segment error", t);
             }
             else {
-                toast.err(0, "server broke; cu-err {0} on file [{1}]:\n".format(
-                    xhr.status, t.name) + (txt || "no further information"));
+                xhrchk(xhr, "server rejected upload (chunk {0} of {1});\n\nfile: {2}\n\nerror ".format(npart, Math.ceil(t.size / chunksize), t.name), "404, target folder not found (???)");
 
                 chill(t);
             }
@@ -1904,7 +1900,7 @@ function up2k_init(subtle) {
                     return;
 
                 if (!toast.visible)
-                    toast.warn(9.98, "failed to upload a chunk;\nprobably harmless, continuing\n\n" + t.name);
+                    toast.warn(9.98, "failed to upload chunk {0} of {1};\nprobably harmless, continuing\n\nfile: {2}".format(npart, Math.ceil(t.size / chunksize), t.name));
 
                 console.log('chunkpit onerror,', ++tries, t);
                 orz2(xhr);
diff --git a/copyparty/web/util.js b/copyparty/web/util.js
index 19f758e9..799f7ffc 100644
--- a/copyparty/web/util.js
+++ b/copyparty/web/util.js
@@ -1402,5 +1402,6 @@ function xhrchk(xhr, prefix, e404) {
     if (xhr.status == 404)
         return toast.err(0, prefix + e404);
 
-    return toast.err(0, prefix + xhr.status + ": " + xhr.responseText);
+    return toast.err(0, prefix + xhr.status + ": " + (
+        (xhr.response && xhr.response.err) || xhr.responseText));
 }