--- loncom/lond	2015/06/14 00:46:35	1.489.2.18
+++ loncom/lond	2016/08/11 09:52:39	1.489.2.20
@@ -2,7 +2,7 @@
 # The LearningOnline Network
 # lond "LON Daemon" Server (port "LOND" 5663)
 #
-# $Id: lond,v 1.489.2.18 2015/06/14 00:46:35 raeburn Exp $
+# $Id: lond,v 1.489.2.20 2016/08/11 09:52:39 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -61,7 +61,7 @@ my $DEBUG = 0;		       # Non zero to ena
 my $status='';
 my $lastlog='';
 
-my $VERSION='$Revision: 1.489.2.18 $'; #' stupid emacs
+my $VERSION='$Revision: 1.489.2.20 $'; #' stupid emacs
 my $remoteVERSION;
 my $currenthostid="default";
 my $currentdomainid;
@@ -2445,11 +2445,20 @@ sub remove_user_file_handler {
 	    if (-e $file) {
 		#
 		#   If the file is a regular file unlink is fine...
-		#   However it's possible the client wants a dir.
-		#   removed, in which case rmdir is more approprate:
+		#   However it's possible the client wants a dir
+		#   removed, in which case rmdir is more appropriate
+	        #   Note: rmdir will only remove an empty directory.
 		#
 	        if (-f $file){
 		    unlink($file);
+                    # for html files remove the associated .bak file
+                    # which may have been created by the editor.
+                    if ($ufile =~ m{^((docs|supplemental)/(?:\d+|default)/\d+(?:|/.+)/)[^/]+\.x?html?$}i) {
+                        my $path = $1;
+                        if (-e $file.'.bak') {
+                            unlink($file.'.bak');
+                        }
+                    }
 		} elsif(-d $file) {
 		    rmdir($file);
 		}
@@ -5286,7 +5295,9 @@ sub retrieve_auto_file_handler {
     my ($filename)   = split(/:/, $tail);
 
     my $source = $perlvar{'lonDaemons'}.'/tmp/'.$filename;
-    if ( (-e $source) && ($filename ne '') ) {
+    if ($filename =~m{/\.\./}) {
+        &Failure($client, "refused\n", $userinput);
+    } elsif ( (-e $source) && ($filename ne '') ) {
 	my $reply = '';
 	if (open(my $fh,$source)) {
 	    while (<$fh>) {