diff --git a/assets/src/components/Header.vue b/assets/src/components/Header.vue
index aa30a5d5..9f9b2a77 100644
--- a/assets/src/components/Header.vue
+++ b/assets/src/components/Header.vue
@@ -38,6 +38,7 @@
       <div id="file-selection" v-if="isMobile && req.kind === 'listing'">
         <span v-if="selectedCount > 0">{{ selectedCount }} selected</span>
         <rename-button v-show="showRenameButton"></rename-button>
+        <copy-button v-show="showMoveButton"></copy-button>
         <move-button v-show="showMoveButton"></move-button>
         <delete-button v-show="showDeleteButton"></delete-button>
       </div>
@@ -46,6 +47,7 @@
       <div id="dropdown" :class="{ active: showMore }">
         <div v-if="!isListing || !isMobile">
           <rename-button v-show="showRenameButton"></rename-button>
+          <copy-button v-show="showMoveButton"></copy-button>
           <move-button v-show="showMoveButton"></move-button>
           <delete-button v-show="showDeleteButton"></delete-button>
         </div>
@@ -88,6 +90,7 @@ import UploadButton from './buttons/Upload'
 import DownloadButton from './buttons/Download'
 import SwitchButton from './buttons/SwitchView'
 import MoveButton from './buttons/Move'
+import CopyButton from './buttons/Copy'
 import {mapGetters, mapState} from 'vuex'
 import api from '@/utils/api'
 import buttons from '@/utils/buttons'
@@ -100,6 +103,7 @@ export default {
     DeleteButton,
     RenameButton,
     DownloadButton,
+    CopyButton,
     UploadButton,
     SwitchButton,
     MoveButton
diff --git a/assets/src/components/Listing.vue b/assets/src/components/Listing.vue
index 1f7158ae..c2d69e24 100644
--- a/assets/src/components/Listing.vue
+++ b/assets/src/components/Listing.vue
@@ -82,7 +82,7 @@ export default {
   name: 'listing',
   components: { Item },
   computed: {
-    ...mapState(['req']),
+    ...mapState(['req', 'selected']),
     nameSorted () {
       return (this.req.sort === 'name')
     },
@@ -130,17 +130,69 @@ export default {
         return
       }
 
-      if (String.fromCharCode(event.which).toLowerCase() !== 'f') {
-        return
-      }
+      let key = String.fromCharCode(event.which).toLowerCase()
 
-      event.preventDefault()
-      this.$store.commit('showHover', 'search')
+      switch (key) {
+        case 'f':
+          event.preventDefault()
+          this.$store.commit('showHover', 'search')
+          break
+        case 'c':
+        case 'x':
+          this.copyCut(event, key)
+          break
+        case 'v':
+          this.paste(event)
+          break
+      }
     },
     preventDefault (event) {
       // Wrapper around prevent default.
       event.preventDefault()
     },
+    copyCut (event, key) {
+      event.preventDefault()
+      let items = []
+
+      for (let i of this.selected) {
+        items.push({
+          from: this.req.items[i].url,
+          name: encodeURIComponent(this.req.items[i].name)
+        })
+      }
+
+      this.$store.commit('updateClipboard', {
+        key: key,
+        items: items
+      })
+    },
+    paste (event) {
+      event.preventDefault()
+
+      let items = []
+
+      for (let item of this.$store.state.clipboard.items) {
+        items.push({
+          from: item.from,
+          to: this.$route.path + item.name
+        })
+      }
+
+      if (this.$store.state.clipboard.key === 'x') {
+        api.move(items).then(() => {
+          this.$store.commit('setReload', true)
+        }).catch(error => {
+          this.$store.commit('showError', error)
+        })
+        return
+      }
+
+      api.copy(items).then(() => {
+        this.$store.commit('setReload', true)
+      }).catch(error => {
+        this.$store.commit('showError', error)
+      })
+    },
     resizeEvent () {
       // Update the columns size based on the window width.
       let columns = Math.floor(document.querySelector('main').offsetWidth / 300)
diff --git a/assets/src/components/ListingItem.vue b/assets/src/components/ListingItem.vue
index 52f05444..20f13db2 100644
--- a/assets/src/components/ListingItem.vue
+++ b/assets/src/components/ListingItem.vue
@@ -92,16 +92,16 @@ export default {
 
       if (this.selectedCount === 0) return
 
-      let promises = []
+      let items = []
 
       for (let i of this.selected) {
-        let url = this.req.items[i].url
-        let name = this.req.items[i].name
-
-        promises.push(api.move(url, this.url + encodeURIComponent(name)))
+        items.push({
+          from: this.req.items[i].url,
+          to: this.url + encodeURIComponent(this.req.items[i].name)
+        })
       }
 
-      Promise.all(promises)
+      api.move(items)
         .then(() => {
           this.$store.commit('setReload', true)
         })
diff --git a/assets/src/components/buttons/Copy.vue b/assets/src/components/buttons/Copy.vue
new file mode 100644
index 00000000..9ee554a4
--- /dev/null
+++ b/assets/src/components/buttons/Copy.vue
@@ -0,0 +1,17 @@
+<template>
+  <button @click="show" aria-label="Copy" title="Copy" class="action" id="copy-button">
+    <i class="material-icons">content_copy</i>
+    <span>Copy file</span>
+  </button>
+</template>
+
+<script>
+export default {
+  name: 'copy-button',
+  methods: {
+    show: function (event) {
+      this.$store.commit('showHover', 'copy')
+    }
+  }
+}
+</script>
diff --git a/assets/src/components/prompts/Copy.vue b/assets/src/components/prompts/Copy.vue
new file mode 100644
index 00000000..184182f6
--- /dev/null
+++ b/assets/src/components/prompts/Copy.vue
@@ -0,0 +1,58 @@
+<template>
+  <div class="prompt">
+    <h3>Copy</h3>
+    <p>Choose the place to copy your files:</p>
+
+    <file-list @update:selected="val => dest = val"></file-list>
+
+    <div>
+      <button class="ok" @click="copy">Copy</button>
+      <button class="cancel" @click="$store.commit('closeHovers')">Cancel</button>
+    </div>
+  </div>
+</template>
+
+<script>
+import { mapState } from 'vuex'
+import FileList from './FileList'
+import api from '@/utils/api'
+import buttons from '@/utils/buttons'
+
+export default {
+  name: 'copy',
+  components: { FileList },
+  data: function () {
+    return {
+      current: window.location.pathname,
+      dest: null
+    }
+  },
+  computed: mapState(['req', 'selected']),
+  methods: {
+    copy: function (event) {
+      event.preventDefault()
+      buttons.loading('copy')
+      let items = []
+
+      // Create a new promise for each file.
+      for (let item of this.selected) {
+        items.push({
+          from: this.req.items[item].url,
+          to: this.dest + encodeURIComponent(this.req.items[item].name)
+        })
+      }
+
+      // Execute the promises.
+      api.copy(items)
+        .then(() => {
+          buttons.done('copy')
+          this.$router.push({ path: this.dest })
+        })
+        .catch(error => {
+          buttons.done('copy')
+          this.$store.commit('showError', error)
+        })
+    }
+  }
+}
+</script>
diff --git a/assets/src/components/prompts/FileList.vue b/assets/src/components/prompts/FileList.vue
new file mode 100644
index 00000000..52864096
--- /dev/null
+++ b/assets/src/components/prompts/FileList.vue
@@ -0,0 +1,137 @@
+<template>
+  <div>
+    <ul class="file-list">
+      <li @click="select"
+        @touchstart="touchstart"
+        @dblclick="next"
+        :aria-selected="selected == item.url"
+        :key="item.name" v-for="item in items"
+        :data-url="item.url">{{ item.name }}</li>
+    </ul>
+
+    <p>Currently navigating on: <code>{{ nav }}</code>.</p>
+  </div>
+</template>
+
+<script>
+import { mapState } from 'vuex'
+import url from '@/utils/url'
+import api from '@/utils/api'
+
+export default {
+  name: 'file-list',
+  data: function () {
+    return {
+      items: [],
+      touches: {
+        id: '',
+        count: 0
+      },
+      selected: null,
+      current: window.location.pathname
+    }
+  },
+  computed: {
+    ...mapState(['req']),
+    nav () {
+      return decodeURIComponent(this.current)
+    }
+  },
+  mounted () {
+    // If we're showing this on a listing,
+    // we can use the current request object
+    // to fill the move options.
+    if (this.req.kind === 'listing') {
+      this.fillOptions(this.req)
+      return
+    }
+
+    // Otherwise, we must be on a preview or editor
+    // so we fetch the data from the previous directory.
+    api.fetch(url.removeLastDir(this.$route.path))
+      .then(this.fillOptions)
+      .catch(this.showError)
+  },
+  methods: {
+    fillOptions (req) {
+      // Sets the current path and resets
+      // the current items.
+      this.current = req.url
+      this.items = []
+
+      this.$emit('update:selected', this.current)
+
+      // If the path isn't the root path,
+      // show a button to navigate to the previous
+      // directory.
+      if (req.url !== '/files/') {
+        this.items.push({
+          name: '..',
+          url: url.removeLastDir(req.url) + '/'
+        })
+      }
+
+      // If this folder is empty, finish here.
+      if (req.items === null) return
+
+      // Otherwise we add every directory to the
+      // move options.
+      for (let item of req.items) {
+        if (!item.isDir) continue
+
+        this.items.push({
+          name: item.name,
+          url: item.url
+        })
+      }
+    },
+    next: function (event) {
+      // Retrieves the URL of the directory the user
+      // just clicked in and fill the options with its
+      // content.
+      let uri = event.currentTarget.dataset.url
+
+      api.fetch(uri)
+        .then(this.fillOptions)
+        .catch(this.showError)
+    },
+    touchstart (event) {
+      let url = event.currentTarget.dataset.url
+
+      // In 300 milliseconds, we shall reset the count.
+      setTimeout(() => {
+        this.touches.count = 0
+      }, 300)
+
+      // If the element the user is touching
+      // is different from the last one he touched,
+      // reset the count.
+      if (this.touches.id !== url) {
+        this.touches.id = url
+        this.touches.count = 1
+        return
+      }
+
+      this.touches.count++
+
+      // If there is more than one touch already,
+      // open the next screen.
+      if (this.touches.count > 1) {
+        this.next(event)
+      }
+    },
+    select: function (event) {
+      // If the element is already selected, unselect it.
+      if (this.selected === event.currentTarget.dataset.url) {
+        this.selected = null
+        this.$emit('update:selected', this.current)
+        return
+      }
+
+      // Otherwise select the element.
+      this.selected = event.currentTarget.dataset.url
+      this.$emit('update:selected', this.selected)
+    }
+  }
+}
+</script>
diff --git a/assets/src/components/prompts/Move.vue b/assets/src/components/prompts/Move.vue
index 122b0d4e..ebfb7ad2 100644
--- a/assets/src/components/prompts/Move.vue
+++ b/assets/src/components/prompts/Move.vue
@@ -3,16 +3,7 @@
     <h3>Move</h3>
     <p>Choose new house for your file(s)/folder(s):</p>
 
-    <ul class="file-list">
-      <li @click="select"
-        @touchstart="touchstart"
-        @dblclick="next"
-        :aria-selected="moveTo == item.url"
-        :key="item.name" v-for="item in items"
-        :data-url="item.url">{{ item.name }}</li>
-    </ul>
-
-    <p>Currently navigating on: <code>{{ current }}</code>.</p>
+    <file-list @update:selected="val => dest = val"></file-list>
 
     <div>
       <button class="ok" @click="move">Move</button>
@@ -23,145 +14,46 @@
 
 <script>
 import { mapState } from 'vuex'
-import url from '@/utils/url'
+import FileList from './FileList'
 import api from '@/utils/api'
 import buttons from '@/utils/buttons'
 
 export default {
   name: 'move',
+  components: { FileList },
   data: function () {
     return {
-      items: [],
-      touches: {
-        id: '',
-        count: 0
-      },
       current: window.location.pathname,
-      moveTo: null
+      dest: null
     }
   },
-  computed: mapState(['req', 'selected', 'baseURL']),
-  mounted () {
-    // If we're showing this on a listing,
-    // we can use the current request object
-    // to fill the move options.
-    if (this.req.kind === 'listing') {
-      this.fillOptions(this.req)
-      return
-    }
-
-    // Otherwise, we must be on a preview or editor
-    // so we fetch the data from the previous directory.
-    api.fetch(url.removeLastDir(this.$rute.path))
-      .then(this.fillOptions)
-      .catch(this.showError)
-  },
+  computed: mapState(['req', 'selected']),
   methods: {
     move: function (event) {
       event.preventDefault()
-
-      // Set the destination and create the promises array.
-      let promises = []
-      let dest = (this.moveTo === null) ? this.current : this.moveTo
       buttons.loading('move')
+      let items = []
 
       // Create a new promise for each file.
       for (let item of this.selected) {
-        let from = this.req.items[item].url
-        let to = dest + '/' + encodeURIComponent(this.req.items[item].name)
-        to = to.replace('//', '/')
-
-        promises.push(api.move(from, to))
+        items.push({
+          from: this.req.items[item].url,
+          to: this.dest + encodeURIComponent(this.req.items[item].name)
+        })
       }
 
       // Execute the promises.
-      Promise.all(promises)
+      api.move(items)
         .then(() => {
           buttons.done('move')
-          this.$router.push({ path: dest })
+          this.$router.push({ path: this.dest })
         })
         .catch(error => {
           buttons.done('move')
           this.$store.commit('showError', error)
         })
-    },
-    fillOptions (req) {
-      // Sets the current path and resets
-      // the current items.
-      this.current = req.url
-      this.items = []
 
-      // If the path isn't the root path,
-      // show a button to navigate to the previous
-      // directory.
-      if (req.url !== '/files/') {
-        this.items.push({
-          name: '..',
-          url: url.removeLastDir(req.url) + '/'
-        })
-      }
-
-      // If this folder is empty, finish here.
-      if (req.items === null) return
-
-      // Otherwise we add every directory to the
-      // move options.
-      for (let item of req.items) {
-        if (!item.isDir) continue
-
-        this.items.push({
-          name: item.name,
-          url: item.url
-        })
-      }
-    },
-    showError (error) {
-      this.$store.commit('showError', error)
-    },
-    next: function (event) {
-      // Retrieves the URL of the directory the user
-      // just clicked in and fill the options with its
-      // content.
-      let uri = event.currentTarget.dataset.url
-
-      api.fetch(uri)
-        .then(this.fillOptions)
-        .catch(this.showError)
-    },
-    touchstart (event) {
-      let url = event.currentTarget.dataset.url
-
-      // In 300 milliseconds, we shall reset the count.
-      setTimeout(() => {
-        this.touches.count = 0
-      }, 300)
-
-      // If the element the user is touching
-      // is different from the last one he touched,
-      // reset the count.
-      if (this.touches.id !== url) {
-        this.touches.id = url
-        this.touches.count = 1
-        return
-      }
-
-      this.touches.count++
-
-      // If there is more than one touch already,
-      // open the next screen.
-      if (this.touches.count > 1) {
-        this.next(event)
-      }
-    },
-    select: function (event) {
-      // If the element is already selected, unselect it.
-      if (this.moveTo === event.currentTarget.dataset.url) {
-        this.moveTo = null
-        return
-      }
-
-      // Otherwise select the element.
-      this.moveTo = event.currentTarget.dataset.url
+      event.preventDefault()
     }
   }
 }
diff --git a/assets/src/components/prompts/Prompts.vue b/assets/src/components/prompts/Prompts.vue
index f6206eee..a78e3c78 100644
--- a/assets/src/components/prompts/Prompts.vue
+++ b/assets/src/components/prompts/Prompts.vue
@@ -8,6 +8,7 @@
     <delete v-else-if="showDelete"></delete>
     <info v-else-if="showInfo"></info>
     <move v-else-if="showMove"></move>
+    <copy v-else-if="showCopy"></copy>
     <error v-else-if="showError"></error>
     <success v-else-if="showSuccess"></success>
 
@@ -42,6 +43,7 @@ import Delete from './Delete'
 import Rename from './Rename'
 import Download from './Download'
 import Move from './Move'
+import Copy from './Copy'
 import Error from './Error'
 import Success from './Success'
 import NewFile from './NewFile'
@@ -60,6 +62,7 @@ export default {
     Download,
     Success,
     Move,
+    Copy,
     NewFile,
     NewDir,
     Help
@@ -83,6 +86,7 @@ export default {
     showDelete: function () { return this.show === 'delete' },
     showRename: function () { return this.show === 'rename' },
     showMove: function () { return this.show === 'move' },
+    showCopy: function () { return this.show === 'copy' },
     showNewFile: function () { return this.show === 'newFile' },
     showNewDir: function () { return this.show === 'newDir' },
     showDownload: function () { return this.show === 'download' },
diff --git a/assets/src/components/prompts/Rename.vue b/assets/src/components/prompts/Rename.vue
index bfaee700..2e0bbd92 100644
--- a/assets/src/components/prompts/Rename.vue
+++ b/assets/src/components/prompts/Rename.vue
@@ -53,7 +53,7 @@ export default {
       this.name = encodeURIComponent(this.name)
       newLink = url.removeLastDir(oldLink) + '/' + this.name
 
-      api.move(oldLink, newLink)
+      api.move([{ from: oldLink, to: newLink }])
         .then(() => {
           if (this.req.kind !== 'listing') {
             this.$router.push({ path: newLink })
diff --git a/assets/src/css/mobile.css b/assets/src/css/mobile.css
index 50748467..5fd57a8d 100644
--- a/assets/src/css/mobile.css
+++ b/assets/src/css/mobile.css
@@ -61,7 +61,7 @@
     background: #fff;
     box-shadow: rgba(0, 0, 0, 0.06) 0px 1px 3px, rgba(0, 0, 0, 0.12) 0px 1px 2px;
     width: 95%;
-    max-width: 16em;
+    max-width: 18em;
   }
   #file-selection .action {
     border-radius: 50%;
diff --git a/assets/src/css/prompts.css b/assets/src/css/prompts.css
index 6badde1a..01c3802d 100644
--- a/assets/src/css/prompts.css
+++ b/assets/src/css/prompts.css
@@ -49,7 +49,7 @@
   word-wrap: break-word;
 }
 
-.prompt div {
+.prompt div:last-of-type {
   margin-top: 1em;
   display: flex;
   justify-content: flex-start;
diff --git a/assets/src/store/index.js b/assets/src/store/index.js
index 18c79717..6d851b91 100644
--- a/assets/src/store/index.js
+++ b/assets/src/store/index.js
@@ -9,6 +9,10 @@ const state = {
   user: {},
   req: {},
   plugins: window.plugins || [],
+  clipboard: {
+    key: '',
+    items: []
+  },
   baseURL: document.querySelector('meta[name="base"]').getAttribute('content'),
   jwt: '',
   loading: false,
diff --git a/assets/src/store/mutations.js b/assets/src/store/mutations.js
index 505f0806..6797ef2c 100644
--- a/assets/src/store/mutations.js
+++ b/assets/src/store/mutations.js
@@ -40,6 +40,14 @@ const mutations = {
   },
   updateRequest: (state, value) => {
     state.req = value
+  },
+  updateClipboard: (state, value) => {
+    state.clipboard.key = value.key
+    state.clipboard.items = value.items
+  },
+  resetClipboard: (state) => {
+    state.clipboard.key = ''
+    state.clipboard.items = []
   }
 }
 
diff --git a/assets/src/utils/api.js b/assets/src/utils/api.js
index 0828c670..6a47e3b8 100644
--- a/assets/src/utils/api.js
+++ b/assets/src/utils/api.js
@@ -99,27 +99,45 @@ function put (url, content = '') {
   })
 }
 
-function move (oldLink, newLink) {
-  oldLink = removePrefix(oldLink)
-  newLink = removePrefix(newLink)
+function moveCopy (items, copy = false) {
+  let promises = []
 
-  return new Promise((resolve, reject) => {
-    let request = new window.XMLHttpRequest()
-    request.open('PATCH', `${store.state.baseURL}/api/resource${oldLink}`, true)
-    request.setRequestHeader('Authorization', `Bearer ${store.state.jwt}`)
-    request.setRequestHeader('Destination', newLink)
+  for (let item of items) {
+    let from = removePrefix(item.from)
+    let to = removePrefix(item.to)
 
-    request.onload = () => {
-      if (request.status === 200) {
-        resolve(request.responseText)
-      } else {
-        reject(request.responseText)
+    promises.push(new Promise((resolve, reject) => {
+      let request = new window.XMLHttpRequest()
+      request.open('PATCH', `${store.state.baseURL}/api/resource${from}`, true)
+      request.setRequestHeader('Authorization', `Bearer ${store.state.jwt}`)
+      request.setRequestHeader('Destination', to)
+
+      if (copy) {
+        request.setRequestHeader('Action', 'copy')
       }
-    }
 
-    request.onerror = (error) => reject(error)
-    request.send()
-  })
+      request.onload = () => {
+        if (request.status === 200) {
+          resolve(request.responseText)
+        } else {
+          reject(request.responseText)
+        }
+      }
+
+      request.onerror = (error) => reject(error)
+      request.send()
+    }))
+  }
+
+  return Promise.all(promises)
+}
+
+function move (items) {
+  return moveCopy(items)
+}
+
+function copy (items) {
+  return moveCopy(items, true)
 }
 
 function checksum (url, algo) {
@@ -425,6 +443,7 @@ export default {
   checksum,
   move,
   put,
+  copy,
   post,
   command,
   search,
diff --git a/caddy/hugo/rice-box.go b/caddy/hugo/rice-box.go
deleted file mode 100644
index 3b84fc7b..00000000
--- a/caddy/hugo/rice-box.go
+++ /dev/null
@@ -1,69 +0,0 @@
-package hugo
-
-import (
-	"github.com/GeertJohan/go.rice/embedded"
-	"time"
-)
-
-func init() {
-
-	// define files
-	file2 := &embedded.EmbeddedFile{
-		Filename:    `README.md`,
-		FileModTime: time.Unix(1500389874, 0),
-		Content:     string("# hugo - a caddy plugin\n\n[![community](https://img.shields.io/badge/community-forum-ff69b4.svg?style=flat-square)](https://caddy.community)\n\nhugo fills the gap between Hugo and the browser. [Hugo][6] is an easy and fast static website generator. This plugin fills the gap between Hugo and the end-user, providing you a web interface to manage the whole website.\n\nUsing this plugin, you won't need to have your own computer to edit posts, neither regenerate your static website, because you can do all of that just through your browser. It is an implementation of [hacdias/filemanager][1] library.\n\n**Requirements:** you need to have the hugo executable in your PATH. You can download it from its [official page][6].\n\n## Get Started\n\nTo start using this plugin you just need to go to the [download Caddy page][3] and choose `http.hugo` in the directives section. For further information on how Caddy works refer to [its documentation][4].\n\nThe default credentials are `admin` for both the user and the password. It is highy recommended to change them after logging in for the first time and to use HTTPS. You can create more users and define their own permissions using the web interface.\n\n## Syntax\n\n```\nhugo [directory] [admin] {\n    database path\n}\n```\n\n+ `directory` is the path, relative or absolute to the directory of your Hugo files. Defaults to `./`.\n+ `admin` is the URL path where you will access the admin interface. Defaults to `/admin`.\n+ `path` is the database path where the settings will be stored. By default, the settings will be stored on [`.caddy`][5] folder.\n\n## Database\n\nBy default the database will be stored on [`.caddy`][5] directory, in a sub-directory called `hugo`. Each file name is an hash of the combination of the host and the base URL.\n\nIf you don't set a database path, you will receive a warning like this:\n\n> [WARNING] A database is going to be created for your File Manager instace at ~/.caddy/hugo/xxx.db. It is highly recommended that you set the 'database' option to 'xxx.db'\n\nWhy? If you don't set a database path and you change the host or the base URL, your settings will be reseted. So it is *highly* recommended to set this option.\n\nWhen you set a relative path, such as `xxxxxxxxxx.db`, it will always be relative to `.caddy/hugo` directory. Although, you may also use an absolute path if you wish to store the database in other place.\n\n## Examples\n\nManage the current working directory's Hugo website at `/admin` and display the ```public``` folder to the user.\n\n```\nroot public\nhugo {\n  database myinstance.db\n}\n```\n\nManage the Hugo website located at `/var/www/mysite` at `/admin` and display the ```public``` folder to the user.\n\n```\nroot /var/www/mysite/public\nhugo /var/www/mysite {\n  database myinstance.db\n}\n```\n\nManage the Hugo website located at `/var/www/mysite` at `/private` and display the ```public``` folder to the user.\n\n```\nroot /var/www/mysite/public\nhugo /var/www/mysite /private {\n  database myinstance.db\n}\n```\n\n## Known Issues\n\nIf you are having troubles **handling large files** you might need to check out the [`timeouts`][2] plugin, which can be used to change the default HTTP Timeouts.\n\n[1]:https://github.com/hacdias/filemanager\n[2]:https://caddyserver.com/docs/timeouts\n[3]:https://caddyserver.com/download\n[4]:https://caddyserver.com/docs\n[5]:https://caddyserver.com/docs/automatic-https#dot-caddy\n[6]:http://gohugo.io\n"),
-	}
-	file3 := &embedded.EmbeddedFile{
-		Filename:    `hugo.go`,
-		FileModTime: time.Unix(1500977545, 0),
-		Content:     string("package hugo\n\nimport (\n\t\"log\"\n\t\"net/http\"\n\t\"os\"\n\t\"path/filepath\"\n\t\"strings\"\n\t\"time\"\n\n\trice \"github.com/GeertJohan/go.rice\"\n\t\"github.com/hacdias/filemanager\"\n\t\"github.com/hacdias/filemanager/variables\"\n\t\"github.com/robfig/cron\"\n)\n\ntype hugo struct {\n\t// Website root\n\tRoot string `description:\"The relative or absolute path to the place where your website is located.\"`\n\t// Public folder\n\tPublic string `description:\"The relative or absolute path to the public folder.\"`\n\t// Hugo executable path\n\tExe string `description:\"The absolute path to the Hugo executable or the command to execute.\"`\n\t// Hugo arguments\n\tArgs []string `description:\"The arguments to run when running Hugo\"`\n\t// Indicates if we should clean public before a new publish.\n\tCleanPublic bool `description:\"Indicates if the public folder should be cleaned before publishing the website.\"`\n\n\t// TODO: admin interface to cgange options\n}\n\nfunc (h hugo) BeforeAPI(c *filemanager.RequestContext, w http.ResponseWriter, r *http.Request) (int, error) {\n\t// If we are using the 'magic url' for the settings, we should redirect the\n\t// request for the acutual path.\n\tif r.URL.Path == \"/settings/\" || r.URL.Path == \"/settings\" {\n\t\tvar frontmatter string\n\t\tvar err error\n\n\t\tif _, err = os.Stat(filepath.Join(h.Root, \"config.yaml\")); err == nil {\n\t\t\tfrontmatter = \"yaml\"\n\t\t}\n\n\t\tif _, err = os.Stat(filepath.Join(h.Root, \"config.json\")); err == nil {\n\t\t\tfrontmatter = \"json\"\n\t\t}\n\n\t\tif _, err = os.Stat(filepath.Join(h.Root, \"config.toml\")); err == nil {\n\t\t\tfrontmatter = \"toml\"\n\t\t}\n\n\t\tr.URL.Path = \"/config.\" + frontmatter\n\t\treturn 0, nil\n\t}\n\n\t// From here on, we only care about 'hugo' router so we can bypass\n\t// the others.\n\tif c.Router != \"hugo\" {\n\t\treturn 0, nil\n\t}\n\n\t// If we are not using HTTP Post, we shall return Method Not Allowed\n\t// since we are only working with this method.\n\tif r.Method != http.MethodPost {\n\t\treturn http.StatusMethodNotAllowed, nil\n\t}\n\n\t// If we are creating a file built from an archetype.\n\tif r.Header.Get(\"Archetype\") != \"\" {\n\t\tif !c.User.AllowNew {\n\t\t\treturn http.StatusForbidden, nil\n\t\t}\n\n\t\tfilename := filepath.Join(string(c.User.FileSystem), r.URL.Path)\n\t\tfilename = strings.TrimPrefix(filename, \"/\")\n\t\tarchetype := r.Header.Get(\"archetype\")\n\n\t\text := filepath.Ext(filename)\n\n\t\t// If the request isn't for a markdown file, we can't\n\t\t// handle it.\n\t\tif ext != \".markdown\" && ext != \".md\" {\n\t\t\treturn http.StatusBadRequest, errUnsupportedFileType\n\t\t}\n\n\t\t// Tries to create a new file based on this archetype.\n\t\targs := []string{\"new\", filename, \"--kind\", archetype}\n\t\tif err := Run(h.Exe, args, h.Root); err != nil {\n\t\t\treturn http.StatusInternalServerError, err\n\t\t}\n\n\t\t// Writes the location of the new file to the Header.\n\t\tw.Header().Set(\"Location\", \"/files/content/\"+filename)\n\t\treturn http.StatusCreated, nil\n\t}\n\n\t// If we are trying to regenerate the website.\n\tif r.Header.Get(\"Regenerate\") == \"true\" {\n\t\tif !c.User.Permissions[\"allowPublish\"] {\n\t\t\treturn http.StatusForbidden, nil\n\t\t}\n\n\t\tfilename := filepath.Join(string(c.User.FileSystem), r.URL.Path)\n\t\tfilename = strings.TrimPrefix(filename, \"/\")\n\n\t\t// Before save command handler.\n\t\tif err := c.FM.Runner(\"before_publish\", filename); err != nil {\n\t\t\treturn http.StatusInternalServerError, err\n\t\t}\n\n\t\t// We only run undraft command if it is a file.\n\t\tif !strings.HasSuffix(filename, \"/\") {\n\t\t\targs := []string{\"undraft\", filename}\n\t\t\tif err := Run(h.Exe, args, h.Root); err != nil {\n\t\t\t\treturn http.StatusInternalServerError, err\n\t\t\t}\n\t\t}\n\n\t\t// Regenerates the file\n\t\th.run(false)\n\n\t\t// Executed the before publish command.\n\t\tif err := c.FM.Runner(\"before_publish\", filename); err != nil {\n\t\t\treturn http.StatusInternalServerError, err\n\t\t}\n\n\t\treturn http.StatusOK, nil\n\t}\n\n\tif r.Header.Get(\"Schedule\") != \"\" {\n\t\tif !c.User.Permissions[\"allowPublish\"] {\n\t\t\treturn http.StatusForbidden, nil\n\t\t}\n\n\t\treturn h.schedule(c, w, r)\n\t}\n\n\treturn http.StatusNotFound, nil\n}\n\nfunc (h hugo) AfterAPI(c *filemanager.RequestContext, w http.ResponseWriter, r *http.Request) (int, error) {\n\treturn 0, nil\n}\n\nfunc (h hugo) JavaScript() string {\n\treturn rice.MustFindBox(\"./\").MustString(\"hugo.js\")\n}\n\n// run runs Hugo with the define arguments.\nfunc (h hugo) run(force bool) {\n\t// If the CleanPublic option is enabled, clean it.\n\tif h.CleanPublic {\n\t\tos.RemoveAll(h.Public)\n\t}\n\n\t// Prevent running if watching is enabled\n\tif b, pos := variables.StringInSlice(\"--watch\", h.Args); b && !force {\n\t\tif len(h.Args) > pos && h.Args[pos+1] != \"false\" {\n\t\t\treturn\n\t\t}\n\n\t\tif len(h.Args) == pos+1 {\n\t\t\treturn\n\t\t}\n\t}\n\n\tif err := Run(h.Exe, h.Args, h.Root); err != nil {\n\t\tlog.Println(err)\n\t}\n}\n\n// schedule schedules a post to be published later.\nfunc (h hugo) schedule(c *filemanager.RequestContext, w http.ResponseWriter, r *http.Request) (int, error) {\n\tt, err := time.Parse(\"2006-01-02T15:04\", r.Header.Get(\"Schedule\"))\n\tpath := filepath.Join(string(c.User.FileSystem), r.URL.Path)\n\tpath = filepath.Clean(path)\n\n\tif err != nil {\n\t\treturn http.StatusInternalServerError, err\n\t}\n\n\tscheduler := cron.New()\n\tscheduler.AddFunc(t.Format(\"05 04 15 02 01 *\"), func() {\n\t\targs := []string{\"undraft\", path}\n\t\tif err := Run(h.Exe, args, h.Root); err != nil {\n\t\t\tlog.Printf(err.Error())\n\t\t\treturn\n\t\t}\n\n\t\th.run(false)\n\t})\n\n\tscheduler.Start()\n\treturn http.StatusOK, nil\n}\n"),
-	}
-	file4 := &embedded.EmbeddedFile{
-		Filename:    `hugo.js`,
-		FileModTime: time.Unix(1500387945, 0),
-		Content:     string("'use strict';\r\n\r\n(function () {\r\n  if (window.plugins === undefined || window.plugins === null) {\r\n    window.plugins = []\r\n  }\r\n\r\n  let regenerate = function (data, url) {\r\n    url = data.api.removePrefix(url)\r\n\r\n    return new Promise((resolve, reject) => {\r\n      let request = new window.XMLHttpRequest()\r\n      request.open('POST', `${data.store.state.baseURL}/api/hugo${url}`, true)\r\n      request.setRequestHeader('Authorization', `Bearer ${data.store.state.jwt}`)\r\n      request.setRequestHeader('Regenerate', 'true')\r\n\r\n      request.onload = () => {\r\n        if (request.status === 200) {\r\n          resolve()\r\n        } else {\r\n          reject(request.responseText)\r\n        }\r\n      }\r\n\r\n      request.onerror = (error) => reject(error)\r\n      request.send()\r\n    })\r\n  }\r\n\r\n  let newArchetype = function (data, url, type) {\r\n    url = data.api.removePrefix(url)\r\n\r\n    return new Promise((resolve, reject) => {\r\n      let request = new window.XMLHttpRequest()\r\n      request.open('POST', `${data.store.state.baseURL}/api/hugo${url}`, true)\r\n      request.setRequestHeader('Authorization', `Bearer ${data.store.state.jwt}`)\r\n      request.setRequestHeader('Archetype', encodeURIComponent(type))\r\n\r\n      request.onload = () => {\r\n        if (request.status === 200) {\r\n          resolve(request.getResponseHeader('Location'))\r\n        } else {\r\n          reject(request.responseText)\r\n        }\r\n      }\r\n\r\n      request.onerror = (error) => reject(error)\r\n      request.send()\r\n    })\r\n  }\r\n\r\n  let schedule = function (data, file, date) {\r\n    file = data.api.removePrefix(file)\r\n\r\n    return new Promise((resolve, reject) => {\r\n      let request = new window.XMLHttpRequest()\r\n      request.open('POST', `${data.store.state.baseURL}/api/hugo${file}`, true)\r\n      request.setRequestHeader('Authorization', `Bearer ${data.store.state.jwt}`)\r\n      request.setRequestHeader('Schedule', date)\r\n\r\n      request.onload = () => {\r\n        if (request.status === 200) {\r\n          resolve(request.getResponseHeader('Location'))\r\n        } else {\r\n          reject(request.responseText)\r\n        }\r\n      }\r\n\r\n      request.onerror = (error) => reject(error)\r\n      request.send()\r\n    })\r\n  }\r\n\r\n  window.plugins.push({\r\n    name: 'hugo',\r\n    credits: 'With a flavour of <a rel=\"noopener noreferrer\" href=\"https://github.com/hacdias/caddy-hugo\">Hugo</a>.',\r\n    header: {\r\n      visible: [\r\n        {\r\n          if: function (data, route) {\r\n            return (data.store.state.req.kind === 'editor' &&\r\n              !data.store.state.loading &&\r\n              data.store.state.req.metadata !== undefined &&\r\n              data.store.state.req.metadata !== null &&\r\n              data.store.state.user.allowEdit &\r\n              data.store.state.user.permissions.allowPublish)\r\n          },\r\n          click: function (event, data, route) {\r\n            event.preventDefault()\r\n            document.getElementById('save-button').click()\r\n            // TODO: wait for save to finish?\r\n            data.buttons.loading('publish')\r\n\r\n            regenerate(data, route.path)\r\n              .then(() => {\r\n                data.buttons.done('publish')\r\n                data.store.commit('showSuccess', 'Post published!')\r\n                data.store.commit('setReload', true)\r\n              })\r\n              .catch((error) => {\r\n                data.buttons.done('publish')\r\n                data.store.commit('showError', error)\r\n              })\r\n          },\r\n          id: 'publish-button',\r\n          icon: 'send',\r\n          name: 'Publish'\r\n        }\r\n      ],\r\n      hidden: [\r\n        {\r\n          if: function (data, route) {\r\n            return (data.store.state.req.kind === 'editor' &&\r\n              !data.store.state.loading &&\r\n              data.store.state.req.metadata !== undefined &&\r\n              data.store.state.req.metadata !== null &&\r\n              data.store.state.user.permissions.allowPublish)\r\n          },\r\n          click: function (event, data, route) {\r\n            document.getElementById('save-button').click()\r\n            data.store.commit('showHover', 'schedule')\r\n          },\r\n          id: 'schedule-button',\r\n          icon: 'alarm',\r\n          name: 'Schedule'\r\n        }\r\n      ]\r\n    },\r\n    sidebar: [\r\n      {\r\n        click: function (event, data, route) {\r\n          data.router.push({ path: '/files/settings' })\r\n        },\r\n        icon: 'settings',\r\n        name: 'Hugo Settings'\r\n      },\r\n      {\r\n        click: function (event, data, route) {\r\n          data.store.commit('showHover', 'new-archetype')\r\n        },\r\n        if: function (data, route) {\r\n          return data.store.state.user.allowNew\r\n        },\r\n        icon: 'merge_type',\r\n        name: 'Hugo New'\r\n      } /* ,\r\n      {\r\n        click: function (event, data, route) {\r\n          console.log('evt')\r\n        },\r\n        icon: 'remove_red_eye',\r\n        name: 'Preview'\r\n      } */\r\n    ],\r\n    prompts: [\r\n      {\r\n        name: 'new-archetype',\r\n        title: 'New file',\r\n        description: 'Create a new post based on an archetype. Your file will be created on content folder.',\r\n        inputs: [\r\n          {\r\n            type: 'text',\r\n            name: 'file',\r\n            placeholder: 'File name'\r\n          },\r\n          {\r\n            type: 'text',\r\n            name: 'archetype',\r\n            placeholder: 'Archetype'\r\n          }\r\n        ],\r\n        ok: 'Create',\r\n        submit: function (event, data, route) {\r\n          event.preventDefault()\r\n\r\n          let file = event.currentTarget.querySelector('[name=\"file\"]').value\r\n          let type = event.currentTarget.querySelector('[name=\"archetype\"]').value\r\n          if (type === '') type = 'default'\r\n\r\n          data.store.commit('closeHovers')\r\n\r\n          newArchetype(data, '/' + file, type)\r\n            .then((url) => {\r\n              data.router.push({ path: url })\r\n            })\r\n            .catch(error => {\r\n              data.store.commit('showError', error)\r\n            })\r\n        }\r\n      },\r\n      {\r\n        name: 'schedule',\r\n        title: 'Schedule',\r\n        description: 'Pick a date and time to schedule the publication of this post.',\r\n        inputs: [\r\n          {\r\n            type: 'datetime-local',\r\n            name: 'date',\r\n            placeholder: 'Date'\r\n          }\r\n        ],\r\n        ok: 'Schedule',\r\n        submit: function (event, data, route) {\r\n          event.preventDefault()\r\n          data.buttons.loading('schedule')\r\n\r\n          let date = event.currentTarget.querySelector('[name=\"date\"]').value\r\n          if (date === '') {\r\n            data.buttons.done('schedule')\r\n            data.store.commit('showError', 'The date must not be empty.')\r\n            return\r\n          }\r\n\r\n          schedule(data, route.path, date)\r\n            .then(() => {\r\n              data.buttons.done('schedule')\r\n              data.store.commit('showSuccess', 'Post scheduled!')\r\n            })\r\n            .catch((error) => {\r\n              data.buttons.done('schedule')\r\n              data.store.commit('showError', error)\r\n            })\r\n        }\r\n      }\r\n    ]\r\n  })\r\n})()\r\n"),
-	}
-	file5 := &embedded.EmbeddedFile{
-		Filename:    `setup.go`,
-		FileModTime: time.Unix(1500977558, 0),
-		Content:     string("package hugo\n\nimport (\n\t\"crypto/md5\"\n\t\"encoding/hex\"\n\t\"errors\"\n\t\"fmt\"\n\t\"net/http\"\n\t\"os\"\n\t\"os/exec\"\n\t\"path/filepath\"\n\t\"strings\"\n\n\t\"github.com/hacdias/filemanager\"\n\t\"github.com/mholt/caddy\"\n\t\"github.com/mholt/caddy/caddyhttp/httpserver\"\n\t\"golang.org/x/net/webdav\"\n)\n\nvar (\n\terrHugoNotFound        = errors.New(\"It seems that tou don't have 'hugo' on your PATH\")\n\terrUnsupportedFileType = errors.New(\"The type of the provided file isn't supported for this action\")\n)\n\n// setup configures a new FileManager middleware instance.\nfunc setup(c *caddy.Controller) error {\n\tconfigs, err := parse(c)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\thttpserver.GetConfig(c).AddMiddleware(func(next httpserver.Handler) httpserver.Handler {\n\t\treturn plugin{Configs: configs, Next: next}\n\t})\n\n\treturn nil\n}\n\nfunc parse(c *caddy.Controller) ([]*filemanager.FileManager, error) {\n\tvar (\n\t\tconfigs []*filemanager.FileManager\n\t)\n\n\tfor c.Next() {\n\t\t// hugo [directory] [admin] {\n\t\t// \t\tdatabase path\n\t\t// }\n\t\tdirectory := \".\"\n\t\tadmin := \"/admin\"\n\t\tdatabase := \"\"\n\n\t\t// Get the baseURL and baseScope\n\t\targs := c.RemainingArgs()\n\n\t\tif len(args) == 1 {\n\t\t\tdirectory = args[0]\n\t\t}\n\n\t\tif len(args) > 1 {\n\t\t\tadmin = args[1]\n\t\t}\n\n\t\tfor c.NextBlock() {\n\t\t\tswitch c.Val() {\n\t\t\tcase \"database\":\n\t\t\t\tif !c.NextArg() {\n\t\t\t\t\treturn nil, c.ArgErr()\n\t\t\t\t}\n\n\t\t\t\tdatabase = c.Val()\n\t\t\t}\n\t\t}\n\n\t\tcaddyConf := httpserver.GetConfig(c)\n\n\t\tpath := filepath.Join(caddy.AssetsPath(), \"hugo\")\n\t\terr := os.MkdirAll(path, 0700)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\t// if there is a database path and it is not absolute,\n\t\t// it will be relative to \".caddy\" folder.\n\t\tif !filepath.IsAbs(database) && database != \"\" {\n\t\t\tdatabase = filepath.Join(path, database)\n\t\t}\n\n\t\t// If there is no database path on the settings,\n\t\t// store one in .caddy/hugo/{name}.db.\n\t\tif database == \"\" {\n\t\t\t// The name of the database is the hashed value of a string composed\n\t\t\t// by the host, address path and the baseurl of this File Manager\n\t\t\t// instance.\n\t\t\thasher := md5.New()\n\t\t\thasher.Write([]byte(caddyConf.Addr.Host + caddyConf.Addr.Path + admin))\n\t\t\tsha := hex.EncodeToString(hasher.Sum(nil))\n\t\t\tdatabase = filepath.Join(path, sha+\".db\")\n\n\t\t\tfmt.Println(\"[WARNING] A database is going to be created for your Hugo instace at \" + database +\n\t\t\t\t\". It is highly recommended that you set the 'database' option to '\" + sha + \".db'\\n\")\n\t\t}\n\n\t\tm, err := filemanager.New(database, filemanager.User{\n\t\t\tAllowCommands: true,\n\t\t\tAllowEdit:     true,\n\t\t\tAllowNew:      true,\n\t\t\tPermissions:   map[string]bool{},\n\t\t\tCommands:      []string{\"git\", \"svn\", \"hg\"},\n\t\t\tRules: []*filemanager.Rule{{\n\t\t\t\tRegex:  true,\n\t\t\t\tAllow:  false,\n\t\t\t\tRegexp: &filemanager.Regexp{Raw: \"\\\\/\\\\..+\"},\n\t\t\t}},\n\t\t\tCSS:        \"\",\n\t\t\tFileSystem: webdav.Dir(directory),\n\t\t})\n\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\t// Initialize the default settings for Hugo.\n\t\thugo := &hugo{\n\t\t\tRoot:        directory,\n\t\t\tPublic:      filepath.Join(directory, \"public\"),\n\t\t\tArgs:        []string{},\n\t\t\tCleanPublic: true,\n\t\t}\n\n\t\t// Try to find the Hugo executable path.\n\t\tif hugo.Exe, err = exec.LookPath(\"hugo\"); err != nil {\n\t\t\treturn nil, errHugoNotFound\n\t\t}\n\n\t\terr = m.RegisterPlugin(\"hugo\", hugo)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\terr = m.RegisterEventType(\"before_publish\")\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\terr = m.RegisterEventType(\"after_publish\")\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\terr = m.RegisterPermission(\"allowPublish\", true)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\tm.SetBaseURL(admin)\n\t\tm.SetPrefixURL(strings.TrimSuffix(caddyConf.Addr.Path, \"/\"))\n\t\tconfigs = append(configs, m)\n\t}\n\n\treturn configs, nil\n}\n\n// ServeHTTP determines if the request is for this plugin, and if all prerequisites are met.\nfunc (p plugin) ServeHTTP(w http.ResponseWriter, r *http.Request) (int, error) {\n\tfor i := range p.Configs {\n\t\t// Checks if this Path should be handled by File Manager.\n\t\tif !httpserver.Path(r.URL.Path).Matches(p.Configs[i].BaseURL) {\n\t\t\tcontinue\n\t\t}\n\n\t\tp.Configs[i].ServeHTTP(w, r)\n\t\treturn 0, nil\n\t}\n\n\treturn p.Next.ServeHTTP(w, r)\n}\n\nfunc init() {\n\tcaddy.RegisterPlugin(\"hugo\", caddy.Plugin{\n\t\tServerType: \"http\",\n\t\tAction:     setup,\n\t})\n}\n\ntype plugin struct {\n\tNext    httpserver.Handler\n\tConfigs []*filemanager.FileManager\n}\n"),
-	}
-	file6 := &embedded.EmbeddedFile{
-		Filename:    `utils.go`,
-		FileModTime: time.Unix(1500981861, 0),
-		Content:     string("package hugo\n\nimport (\n\t\"errors\"\n\t\"os/exec\"\n)\n\n// Run executes an external command\nfunc Run(command string, args []string, path string) error {\n\tcmd := exec.Command(command, args...)\n\tcmd.Dir = path\n\tout, err := cmd.CombinedOutput()\n\n\tif err != nil {\n\t\treturn errors.New(string(out))\n\t}\n\n\treturn nil\n}\n"),
-	}
-
-	// define dirs
-	dir1 := &embedded.EmbeddedDir{
-		Filename:   ``,
-		DirModTime: time.Unix(1501000775, 0),
-		ChildFiles: []*embedded.EmbeddedFile{
-			file2, // README.md
-			file3, // hugo.go
-			file4, // hugo.js
-			file5, // setup.go
-			file6, // utils.go
-
-		},
-	}
-
-	// link ChildDirs
-	dir1.ChildDirs = []*embedded.EmbeddedDir{}
-
-	// register embeddedBox
-	embedded.RegisterEmbeddedBox(`./`, &embedded.EmbeddedBox{
-		Name: `./`,
-		Time: time.Unix(1501000775, 0),
-		Dirs: map[string]*embedded.EmbeddedDir{
-			"": dir1,
-		},
-		Files: map[string]*embedded.EmbeddedFile{
-			"README.md": file2,
-			"hugo.go":   file3,
-			"hugo.js":   file4,
-			"setup.go":  file5,
-			"utils.go":  file6,
-		},
-	})
-}
diff --git a/dir/dir.go b/dir/dir.go
index d86dbe48..1e5ed0b1 100644
--- a/dir/dir.go
+++ b/dir/dir.go
@@ -109,7 +109,11 @@ func (d Dir) Copy(src, dst string) error {
 		return os.ErrInvalid
 	}
 
-	info, err := d.Stat(src)
+	if dst == src {
+		return os.ErrInvalid
+	}
+
+	info, err := os.Stat(src)
 	if err != nil {
 		return err
 	}
diff --git a/file.go b/file.go
index 7534c531..4030229f 100644
--- a/file.go
+++ b/file.go
@@ -82,7 +82,7 @@ func getInfo(url *url.URL, c *FileManager, u *User) (*file, error) {
 	var err error
 
 	i := &file{
-		URL:         "/files" + url.Path,
+		URL:         "/files" + url.String(),
 		VirtualPath: url.Path,
 		Path:        filepath.Join(string(u.FileSystem), url.Path),
 	}
@@ -127,6 +127,11 @@ func (i *file) getListing(c *RequestContext, r *http.Request) error {
 		dirCount, fileCount int
 	)
 
+	baseurl, err := url.PathUnescape(i.URL)
+	if err != nil {
+		return err
+	}
+
 	for _, f := range files {
 		name := f.Name()
 		allowed := c.User.Allowed("/" + name)
@@ -143,7 +148,7 @@ func (i *file) getListing(c *RequestContext, r *http.Request) error {
 		}
 
 		// Absolute URL
-		url := url.URL{Path: i.URL + name}
+		url := url.URL{Path: baseurl + name}
 
 		i := &file{
 			Name:        f.Name(),
diff --git a/resource.go b/resource.go
index b3b5c749..8626aeda 100644
--- a/resource.go
+++ b/resource.go
@@ -13,11 +13,18 @@ import (
 	"github.com/hacdias/filemanager/dir"
 )
 
-func resourceHandler(c *RequestContext, w http.ResponseWriter, r *http.Request) (int, error) {
-	r.URL.Path = dir.SlashClean(r.URL.Path)
-	if !c.User.Allowed(r.URL.Path) {
-		return http.StatusForbidden, nil
+// sanitizeURL sanitizes the URL to prevent path transversal
+// using dir.SlashClean and adds the trailing slash bar.
+func sanitizeURL(url string) string {
+	path := dir.SlashClean(url)
+	if strings.HasSuffix(url, "/") && path != "/" {
+		return path + "/"
 	}
+	return path
+}
+
+func resourceHandler(c *RequestContext, w http.ResponseWriter, r *http.Request) (int, error) {
+	r.URL.Path = sanitizeURL(r.URL.Path)
 
 	switch r.Method {
 	case http.MethodGet:
diff --git a/rice-box.go.REMOVED.git-id b/rice-box.go.REMOVED.git-id
deleted file mode 100644
index b8cd2509..00000000
--- a/rice-box.go.REMOVED.git-id
+++ /dev/null
@@ -1 +0,0 @@
-17ca832c4f21ad3498dc9929167ddc6d372b3df1
\ No newline at end of file