diff --git webfm.install webfm.install
index aea97de..604458c 100755
--- webfm.install
+++ webfm.install
@@ -113,3 +113,21 @@ function webfm_update_1() {
   db_add_primary_key($ret, 'webfm_attach', array('nid', 'cid', 'fid'));
   return $ret;
 }
+
+function webfm_update_6200() {
+  if (variable_get('webfm_root_dir','')) {
+    $prefix = webfm_get_absolute_path();
+    $dirlen = strlen($prefix);
+    $sql = "UPDATE {webfm_file} SET fpath = SUBSTRING(fpath FROM $dirlen) WHERE fpath LIKE '${prefix}%'";
+    $ret = update_sql($sql);
+  }
+  else {
+    $ret['#abort'] =
+      array('success' => FALSE,
+	    'query' => t('Please visit %url to configure the WebFM root directory.',
+			 array('%url' => url('admin/settings/webfm'))
+			)
+	   );
+  }
+  return $ret;
+}
diff --git webfm.module webfm.module
index 7a6028d..d452465 100755
--- webfm.module
+++ webfm.module
@@ -273,14 +273,14 @@ function webfm_cron() {
   if (variable_get('webfm_cron', '')) {
     $result = db_query('SELECT fpath, fid FROM {webfm_file}');
     while ($f = db_fetch_array($result)) {
-      if (!(is_file($f['fpath']))) {
+      if (!(is_file(webfm_get_absolute_path($f['fpath'])))) {
         _webfm_dbdelete_file_fid($f['fid']);
       }
     }
   }
   if (variable_get("webfm_cron_insert", '')) {
     $err_arr[] = array();
-    $root_dir = file_directory_path() . webfm_get_root_path();
+    $root_dir = webfm_get_file_path();
     $result = webfm_insert_dir($root_dir, TRUE, $err_arr);
     if ($result->errcnt)
     watchdog('cron', 'WebFM file insertion errors.', $err_arr, WATCHDOG_ERROR);
@@ -459,7 +459,7 @@ function webfm_nodeapi(&$node, $op, $teaser) {
         if (og_is_group_type($node->type)) {
           // make the node title into a suitable directory name
           $group_directory = webfm_get_group_directory($node);
-          $group_root_dir = file_directory_path() . webfm_get_root_path() . '/' . $group_directory;
+          $group_root_dir = webfm_get_absolute_path($group_directory);
           file_check_directory($group_root_dir, FILE_CREATE_DIRECTORY, 'root_dir_group_' . $node->nid);
           variable_set('root_dir_group_' . $node->nid, $group_directory);
         }
@@ -840,7 +840,7 @@ function webfm_upload() {
   $json_data = array();
   $fid = '';
   if (isset($_POST['webfmuploadpath'])) {
-    $root_dir = (($user->uid == 1) || user_access('administer webfm'))? file_directory_path() : file_directory_path() . webfm_get_root_path();
+    $root_dir = (($user->uid == 1) || user_access('administer webfm'))? file_directory_path() : webfm_get_file_path();
     $dest = $root_dir . $_POST['webfmuploadpath'];
     // Save new file uploads to tmp dir.
     if (($file = file_save_upload('webfm_upload')) != FALSE) {
@@ -962,7 +962,7 @@ function webfm_ajax() {
     webfm_json(array('status' => FALSE, 'err' => t('WebFM root not set')));
     exit();
   }
-  $root_dir = ($webfm_perm == WEBFM_ADMIN) ? file_directory_path() : file_directory_path() . $webfm_root_path;
+  $root_dir = ($webfm_perm == WEBFM_ADMIN) ? file_directory_path() : webfm_get_file_path();
 
   if (isset($_POST["action"])) {
     switch (trim(drupal_strtolower($_POST["action"]))) {
@@ -2083,7 +2083,7 @@ function webfm_file_att_access($webfm_file) {
  */
 function webfm_path_access($path) {
   //admins don't call this routine so include webfm root path
-  $root_dir = file_directory_path() . webfm_get_root_path();
+  $root_dir = webfm_get_file_path();
   $webfm_roots = webfm_get_root_dirs();
   foreach ($webfm_roots as $key => $sub_root) {
     // The read path must be contained within a legitimate role root dir for this user
@@ -2154,7 +2154,7 @@ class webfm_build_dir_list {
     $_dirs = array();
     $_fils = array();
     // Admins do not have webfm root hidden
-    $root = ($perm == WEBFM_ADMIN)? file_directory_path() : file_directory_path() . webfm_get_root_path();
+    $root = ($perm == WEBFM_ADMIN)? file_directory_path() : webfm_get_file_path();
     if (drupal_substr($path, 0, 1) != '/') {
       $path = '/'. $path;
     }
@@ -2165,7 +2165,7 @@ class webfm_build_dir_list {
       $perm_flag = FALSE;
       if ($perm == WEBFM_ADMIN) {
         // WEBFM_ADMIN always has access
-        if (webfm_check_path($path, $webfm_root_path)) {
+        if (webfm_check_path($path, $root)) {
           $perm_flag = TRUE;
         }
       }
@@ -2372,6 +2372,7 @@ function webfm_get_attachments($nid, $selector = 'nid') {
   $files = array();
   $file_result = db_query("SELECT * FROM {webfm_file} f INNER JOIN {webfm_attach} a ON f.fid = a.fid WHERE a.%s = %d ORDER BY a.weight", $selector, $nid);
   while ($file_record = db_fetch_object($file_result)) {
+    $file_record->fpath = webfm_get_absolute_path($file_record->fpath);
     $_file = new webfm_fdesc($file_record);
     if ($_file->result == TRUE) {
       $files[] = $_file;
@@ -2394,6 +2395,7 @@ function webfm_get_temp_attachments($fids) {
 
   $file_result = db_query('SELECT * FROM {webfm_file} WHERE fid in ('. db_placeholders($fids_arr) .')', $fids_arr);
   while ($file_record = db_fetch_object($file_result)) {
+    $file_record->fpath = webfm_get_absolute_path($file_record->fpath);
     $_file = new webfm_fdesc($file_record);
     if ($_file->result == TRUE) {
       $files[] = $_file;
@@ -2687,7 +2689,7 @@ function _webfm_managed_by_webfm($fullfilepath) {
   }
 
   //create fullfilepath for webfm root
-  $webfmstoragepath = file_directory_path() . $webfm_root_path;
+  $webfmstoragepath = webfm_get_file_path();
 
   //if the webfm storage path is not part of the filepath we don't manage this file
   if (stripos($fullfilepath, $webfmstoragepath) !== FALSE) {
@@ -2753,7 +2755,7 @@ function webfm_dbinsert_file($file, &$error, $metadata = array()) {
     return FALSE;
   }
   else {
-    $metadata['fpath'] = $file->filepath;
+    $metadata['fpath'] = webfm_get_relative_path($file->filepath);
   }
 
   // always a new record
@@ -2824,7 +2826,7 @@ function webfm_dbinsert_file($file, &$error, $metadata = array()) {
   else {
     // return fid to calling routine
     $query = "SELECT fid FROM {webfm_file} WHERE fpath = '%s'";
-    $result = db_query($query, $file->filepath);
+    $result = db_query($query, $metadata['fpath']);
     if (($result !== FALSE) && ($row = db_fetch_object($result))) {
       _webfm_file_alias("insert", $metadata, $row->fid);
       return $row->fid;
@@ -2850,7 +2852,7 @@ function webfm_dbupdate_file($fid, $path = FALSE, $metadata = array()) {
   
   if ($path) {
     //add additional values to $metadata
-    $metadata['fpath'] = $path;
+    $metadata['fpath'] = webfm_get_relative_path($path);
   }
   
   $printfvalues = array();
@@ -3055,7 +3057,7 @@ function webfm_upload_validate($file, &$err_msg) {
  */
 function webfm_get_fid($path) {
   $query = "SELECT fid FROM {webfm_file} WHERE fpath = '%s'";
-  $result = db_query($query, $path);
+  $result = db_query($query, webfm_get_relative_path($path));
   if ($result !== FALSE) {
     if ($row = db_fetch_object($result)) {
       return $row->fid;
@@ -3076,14 +3078,16 @@ function webfm_get_file_record($fid = '', $path = '') {
     $query = "SELECT * FROM {webfm_file} WHERE fid = %d";
     if (($result = db_query($query, $fid)) !== FALSE) {
       if ($row = db_fetch_object($result)) {
+	$row->fpath = webfm_get_absolute_path($row->fpath);
         return $row;
       }
     }
   }
   elseif (is_string($path)) {
     $query = "SELECT * FROM {webfm_file} WHERE fpath = '%s'";
-    if (($result = db_query($query, $path)) !== FALSE) {
+    if (($result = db_query($query, webfm_get_relative_path($path))) !== FALSE) {
       if ($row = db_fetch_object($result)) {
+	$row->fpath = webfm_get_absolute_path($row->fpath);
         return $row;
       }
     }
@@ -3620,4 +3624,35 @@ function webfm_custom_layout($path = NULL, $displayTree = NULL, $displayDir = NU
     drupal_add_js($options, 'inline');
   }
   return $output;
-}
\ No newline at end of file
+}
+
+function webfm_get_file_path() {
+  static $webfm_path;
+  if (!isset($webfm_path)) {
+    $webfm_path = webfm_get_root_path();
+    if ($webfm_path == NULL) {
+      return NULL;
+    }
+    $webfm_path = rtrim(file_directory_path() . $webfm_path, '/');
+  }
+  return $webfm_path;
+}
+
+function webfm_get_absolute_path($fpath='') {
+  return webfm_get_file_path() . '/' . $fpath;
+}
+
+function webfm_get_relative_path($filepath) {
+  $filedir = webfm_get_file_path() . '/';
+  $dirlen = strlen($filedir);
+  if (substr($filepath,0,$dirlen) == $filedir) {
+    $filepath = substr($filepath,$dirlen);
+  }
+  else {
+    drupal_set_message(t('File %path is outside Webfm root dir %root.',
+			 array('%path' => $filepath,
+			       '%root' => webfm_get_file_path(),
+			      ),
+			 'Warning'));
+  }
+}