--- modules\upload_old.module	2006-06-15 23:42:19.781250000 +1000
+++ modules\upload.module	2006-07-20 00:07:22.843750000 +1000
@@ -85,7 +85,7 @@ function upload_admin() {
 
   $group .= form_textfield(t('Maximum total file size'), 'upload_maxsize_total', variable_get('upload_maxsize_total', 0), 10, 10, t('The maximum size of a file a user can upload in megabytes. Enter 0 for unlimited.'));
   $group .= form_textfield(t('Maximum resolution for uploaded images'), 'upload_max_resolution', variable_get('upload_max_resolution', 0), 10, 10, t('The maximum allowed image size expressed as WIDTHxHEIGHT (e.g. 640x480). Set to 0 for no restriction.'));
-
+  $group .= form_checkbox(t('Convert to web-friendly filenames?'), "upload_web_friendly_urls", variable_get("upload_web_friendly_urls", 1), TRUE);
   $output = form_group(t('General settings'), $group);
 
   $roles = user_roles(0, 'upload files');
@@ -177,6 +177,11 @@ function upload_nodeapi(&$node, $op, $ar
           break;
         }
 
+        // remove dubious file name characters
+        $munged_filename = upload_mksafe_filename($file->filename);
+        $file->filename = $munged_filename;
+        $file->description = $munged_filename;
+
         // Don't do any checks for uid #1.
         if ($user->uid != 1) {
           // here, something.php.pps becomes something.php_.pps
@@ -392,6 +397,26 @@ function upload_unmunge_filename($filena
   return str_replace('_.', '.', $filename);
 }
 
+/**
+ * Replace potentially troublesome characters, eg. [ ], ['], [&].
+ */
+function upload_mksafe_filename($filename) {
+
+  $original = $filename;
+
+  if(variable_get('upload_web_friendly_urls', 1)) {
+    $filename = strtolower($filename);
+    $filename = str_replace(' ',  '-', $filename);
+    $filename = str_replace('#',  '',  $filename);
+    $filename = str_replace('?',  '',  $filename);
+    $filename = str_replace('&',  '',  $filename);
+    $filename = str_replace('\'', '',  $filename);
+    $filename = str_replace('+',  '-', $filename);
+  }
+  if ($original != $filename) {
+    drupal_set_message(t('Your file has been renamed to conform to site policy.'));
+  }
+  return $filename;
+}
+
 function upload_save($node) {
   foreach ((array)$node->files as $key => $file) {
     if ($file->source && !$file->remove) {