use custom escape function

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Wasted Audio
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

code/handlers/roothandler.lua

@@ -1,4 +1,3 @@
-local to_json = require("lapis.util").to_json
 local autoload = require("lapis.util").autoload
 local config = require("lapis.config")
 local hotmixes = autoload("hotmixes")
@@ -17,6 +16,7 @@ local function Roothandler(self)
     self.images = stuff.images
     self.latestpath = latest_path
     self.latestname = latest_name
+    self.functions = { hotesc = hotmixes.utils.hotesc }
 
     if self.titles['url'] == "panamaracing.club" then
         return { render = "root", layout = require "views.prc_layout" }

code/hotmixes/utils.lua

@@ -15,7 +15,7 @@ end
 
 local request_path
 if request_uri ~= '/' then
-    request_path = request_uri .. '/'
+    request_path = request_uri  .. '/'
 else
     request_path = request_uri
 end
@@ -30,6 +30,10 @@ local type_allowed = { jpg=true, jpeg=true, png=true, gif=true, mp3=true, flac=t
 
 local utils =  {}
 
+local function hotesc ( str )
+    return escape(str):gsub("%%2f", "/"):gsub("%%2d", "-"):gsub("%%2e", ".")
+end
+
 utils['request_path'] = request_path
 utils['data_path'] = data_path
 
@@ -64,17 +68,17 @@ utils['these_files'] = function( path )
                 if utils.match_ext( file, type_image ) then
                     table.insert( images, file )
                 elseif utils.match_ext( file, type_media ) then
-                    table.insert( files, {sane=escape(file), file=file} )
+                    table.insert( files, file )
                 end
             elseif lfs.attributes( path .. file, "mode" ) == "directory" then
-                table.insert( dirs, {sane=escape(file), dir=file} )
+                table.insert( dirs, file )
             end
         end
     end
 
     table.sort( images )
-    -- table.sort( files )
-    -- table.sort( dirs )
+    table.sort( files )
+    table.sort( dirs )
 
     local stuff = {
         files = files,
@@ -84,12 +88,17 @@ utils['these_files'] = function( path )
     return stuff
 end
 
+utils['hotesc'] = function( str )
+    return hotesc(str)
+end
+
 utils['these_latest'] = function( path )
     -- list last 10 modified files in our directory
     local latest_path, latest_name = {}, {}
 
     for i, file_path in ipairs( utils.latest_files( path ) ) do
-        table.insert( latest_path, escape(file_path))
+        local escpath = hotesc(file_path)
+        table.insert( latest_path, escpath )
 
         local temp = ""
         local result = ""

code/views/root.etlua

@@ -10,14 +10,14 @@
 
 <% for i, dir in ipairs(dirs) do %>
     <br>
-        <a href="<%= uri .. dir["sane"] %>" class="djsection"><span><%= dir["dir"] %></span></a>
+        <a href="<%- functions.hotesc(uri .. dir) %>" class="djsection"><span><%= dir %></span></a>
     <br>
 <% end %>
     <br>
 
 <% for i, file in ipairs(files) do %>
-    <a class="amixlink" href="<%= path .. file["sane"] %>">
-        <span class="mixlink"><%= file["file"] %></span>
+    <a class="amixlink" href="<%- functions.hotesc(path .. file) %>">
+        <span class="mixlink"><%= file %></span>
     </a>
     <br>
 <% end %>