use custom escape function

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Wasted Audio
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

code/handlers/latesthandler.lua

@@ -18,7 +18,7 @@ local function Latesthandler(self)
         local file_data = {}
 
         file_data["name"] = latest_name[i]
-        file_data["url"] = data_path .. escape(file)
+        file_data["url"] = data_path .. file
 
         table.insert(latest_json["files"], file_data)
     end

code/handlers/roothandler.lua

@@ -1,4 +1,3 @@
-local to_json = require("lapis.util").to_json
 local autoload = require("lapis.util").autoload
 local config = require("lapis.config")
 local hotmixes = autoload("hotmixes")
@@ -17,6 +16,7 @@ local function Roothandler(self)
     self.images = stuff.images
     self.latestpath = latest_path
     self.latestname = latest_name
+    self.functions = { hotesc = hotmixes.utils.hotesc }
 
     if self.titles['url'] == "panamaracing.club" then
         return { render = "root", layout = require "views.prc_layout" }

code/hotmixes/utils.lua

@@ -1,5 +1,6 @@
 local lfs = require 'lfs_ffi'
 local config = require("lapis.config").get()
+local escape = require("lapis.util").escape
 
 
 -- setup
@@ -14,7 +15,7 @@ end
 
 local request_path
 if request_uri ~= '/' then
-    request_path = request_uri .. '/'
+    request_path = request_uri  .. '/'
 else
     request_path = request_uri
 end
@@ -29,6 +30,10 @@ local type_allowed = { jpg=true, jpeg=true, png=true, gif=true, mp3=true, flac=t
 
 local utils =  {}
 
+local function hotesc ( str )
+    return escape(str):gsub("%%2f", "/"):gsub("%%2d", "-"):gsub("%%2e", ".")
+end
+
 utils['request_path'] = request_path
 utils['data_path'] = data_path
 
@@ -83,12 +88,17 @@ utils['these_files'] = function( path )
     return stuff
 end
 
+utils['hotesc'] = function( str )
+    return hotesc(str)
+end
+
 utils['these_latest'] = function( path )
     -- list last 10 modified files in our directory
     local latest_path, latest_name = {}, {}
 
     for i, file_path in ipairs( utils.latest_files( path ) ) do
-        table.insert( latest_path, file_path)
+        local escpath = hotesc(file_path)
+        table.insert( latest_path, escpath )
 
         local temp = ""
         local result = ""

code/views/layout.etlua

@@ -31,7 +31,7 @@
                 <br>
                 <h1 class="h1">Latest uploads:</h1>
             <% for i, file in ipairs(latestpath) do %>
-                <a class="amixlink" href="<%= '/data/' .. titles.url .. '/' .. file:gsub("#", "%%23") %>">
+                <a class="amixlink" href="<%= '/data/' .. titles.url .. '/' .. file %>">
                     <span class="mixlink"><%= latestname[i] %></span>
                 </a>
                 </br>

code/views/root.etlua

@@ -10,13 +10,13 @@
 
 <% for i, dir in ipairs(dirs) do %>
     <br>
-        <a href="<%= uri .. dir %>" class="djsection"><span><%= dir %></span></a>
+        <a href="<%- functions.hotesc(uri .. dir) %>" class="djsection"><span><%= dir %></span></a>
     <br>
 <% end %>
     <br>
 
 <% for i, file in ipairs(files) do %>
-    <a class="amixlink" href="<%= path .. file:gsub("#", "%%23") %>">
+    <a class="amixlink" href="<%- functions.hotesc(path .. file) %>">
         <span class="mixlink"><%= file %></span>
     </a>
     <br>