diff --git a/CONTROL/control b/CONTROL/control
index 48dc749..3644b80 100644
--- a/CONTROL/control
+++ b/CONTROL/control
@@ -1,7 +1,7 @@
 Package: webif
 Priority: optional
 Section: web
-Version: 1.3.4-13
+Version: 1.3.4-14
 Architecture: mipsel
 Maintainer: af123@hpkg.tv
 Depends: tcpfix,webif-channelicons(>=1.1.24),lighttpd(>=1.4.39-1),jim(>=0.77),jim-oo(>=0.77),jim-sqlite3(>=0.76),jim-cgi(>=0.7-1),jim-binary(>=0.76),service-control(>=2.3),busybox(>=1.20.2-1),lsof(>=4.87),epg(>=1.2.5),hmt(>=2.0.10),ssmtp,cron-daemon(>=1.18.3-3),at(>=3.1.18),anacron,trm(>=1.1),openssl-command,nicesplice,id3v2,file,rsvsync(>=1.1.9),webif-charts(>=1.2-1),stripts(>=1.2.5-3),tmenu(>=1.08),ffmpeg,id3v2,multienv(>=1.6),tcpping(>=1.1),e2fsprogs,wireless-tools(>=29-1),dbupdate,recmon(>=2.0.7),hwctl,nugget(>=0.95),sqlite3(>=3.15.1)
diff --git a/webif/html/browse/join/execute.jim b/webif/html/browse/join/execute.jim
index b27c203..01e73a6 100755
--- a/webif/html/browse/join/execute.jim
+++ b/webif/html/browse/join/execute.jim
@@ -11,7 +11,7 @@ cgi_input 1
 set joinstart [clock milliseconds]
 
 set cmd {/mod/bin/nicesplice}
-set dst [file rootname [cgi_get dest "joined"]]
+set dst [file rootname [cgi_unquote_input [cgi_get dest "joined"]]]
 
 foreach file [split [cgi_get files] ","] {
 	set file [cgi_unquote_input $file]
diff --git a/webif/html/browse/join/join.jim b/webif/html/browse/join/join.jim
index dada9f6..449d1ca 100755
--- a/webif/html/browse/join/join.jim
+++ b/webif/html/browse/join/join.jim
@@ -46,7 +46,7 @@ Name for joined file:
 <button id=dojoin>Join</button>
 </div>
 <button id=back
-    dir=\"[cgi_quote_url $dir]\"
+    dir=\"[cgi_quote_html $dir]\"
     esize=\"$esize\">Back to media list</button>
 
 <div id=progressdiv style=\"display: none\">
diff --git a/webif/html/browse/join/join.js b/webif/html/browse/join/join.js
index fc49fb3..714a422 100755
--- a/webif/html/browse/join/join.js
+++ b/webif/html/browse/join/join.js
@@ -8,10 +8,10 @@ var handle = 0;
 
 function update()
 {
-	$.get('progress.jim'
-	    + '?esize=' + $('#back').attr('esize')
-	    + '&file=' + $('#back').attr('dir') + '/' + $('#dest').val(),
-	    function(data) {
+	$.get('progress.jim', {
+		esize: $('#back').attr('esize'),
+		file: $('#back').attr('dir') + '/' + $('#dest').val()
+	    }, function(data) {
 		if (handle)
 			$('#progressbar').reportprogress(data);
 	});
@@ -22,7 +22,8 @@ $(document).ready(function() {
 $('#progressbar').reportprogress(0);
 
 $('#back').button().click(function() {
-	window.location = '/go/browse?dir=' + $(this).attr('dir');
+	window.location = '/go/browse?dir=' +
+	    encodeURIComponent($(this).attr('dir'));
 });
 
 $('#filelist').sortable().disableSelection();
@@ -41,7 +42,7 @@ $('#dojoin').button().attr('disabled', true).addClass('ui-state-disabled')
 
 	$('#output').text('Please do not interrupt...')
 	    .load('execute.jim?files=' +
-	    sfiles.join() + '&dest=' + $('#dest').val(),
+	    sfiles.join() + '&dest=' + encodeURIComponent($('#dest').val()),
 	    function() {
 		clearInterval(handle);
 		handle = 0;
diff --git a/webif/html/browse/join/progress.jim b/webif/html/browse/join/progress.jim
index e767d5b..7a6f81e 100755
--- a/webif/html/browse/join/progress.jim
+++ b/webif/html/browse/join/progress.jim
@@ -6,7 +6,10 @@ source /mod/webif/lib/setup
 httpheader
 
 set expected [cgi_get esize 1]
-set file [file normalize [cgi_get file]]
+if {[catch {set file [file normalize [cgi_get file]]}]} {
+	puts "12"
+	exit
+}
 
 if {![file exists $file]} {
 	puts "0"
diff --git a/webif/html/browse/script.js b/webif/html/browse/script.js
index 3e84d28..cc8ac20 100755
--- a/webif/html/browse/script.js
+++ b/webif/html/browse/script.js
@@ -899,16 +899,13 @@ $confirm = $('#confirm').dialog({
 	draggable: false, resizable: false
 });
 
-// Load iconset
-//update_diriconset();
-
 // Load folder sizes
 $.getJSON('/browse/sizes.jim', {dir: dir}, folder_size_callback);
 
 // Flag folders with unwatched items
 $.getJSON('/browse/newdir.jim', {dir: dir}, new_folder_callback);
 
-// Populate MP�3 icons (if any found)
+// Populate MP3 icons (if any found)
 if ($('img.mp3icon'))
 {
 	$.getJSON('/browse/mp3.jim', {dir: dir}, function(data, status, xhr) {
diff --git a/webif/html/play/play.jim b/webif/html/play/play.jim
index 67d9fe6..8e5fc48 100755
--- a/webif/html/play/play.jim
+++ b/webif/html/play/play.jim
@@ -43,3 +43,12 @@ puts {
 </fieldset>
 }
 
+puts "
+<div class=cleft>
+<button id=back dir=\"[cgi_quote_html [file dirname $rfile]]\">
+Back to media browser</button>
+</div>
+"
+
+footer
+
diff --git a/webif/html/play/play.js b/webif/html/play/play.js
index e5ec279..a2fcff2 100644
--- a/webif/html/play/play.js
+++ b/webif/html/play/play.js
@@ -1,6 +1,11 @@
 
+$(function() {
 
-$(document).ready(function() {
+$('#back').button({icons: {primary: "ui-icon-arrowreturnthick-1-w"}})
+    .on('click', function() {
+	window.location = '/go/browse?dir=' +
+	    encodeURIComponent($(this).attr('dir'));
+});
 
 var url = $('#url').text();
 var duration = $('#duration').text();