--- a/bin/once	Mon Jan 04 14:53:19 2016 +0100
+++ b/bin/once	Mon Jan 04 15:04:25 2016 +0100
@@ -68,6 +68,7 @@
 my $rxFILE = qr/[a-z\d]{6}-[a-z\d]+-[dme]/i;    # date-filehash-removalmode
 
 my %TT_CONFIG = (
+#  PROCESS => 'version.tt',
   INCLUDE_PATH =>
       [ (map { catfile($Bin, $_) } qw(templates templates.default) ),
 	#(map { catfile(dist_dir($DIST), $_) } qw(var templates.override templates)),
@@ -150,7 +151,11 @@
 
         # sanitize the filename
         my $filename = do {
-            $file =~ tr /\\/\//;
+	# FIXME: should we allow backslashes in filenames? It's totally legal for *nix,
+	# but may confuse win* users, for now we play safe and convert \ to _
+	# OTOH, then we should convert other problematic chars too.
+            $file =~ tr /\\/\//;	# convert \ to /
+	    $file =~ s/.*\///;          # poor man's basename
             $file =~ /(.*)/;
             $1;
         };
@@ -212,7 +217,7 @@
             }
 
             $file{name}          = $file;
-            $file{link}          = "$ENV{PATH_INFO}/$dir$file";
+            $file{link}          = deslash "$ENV{PATH_INFO}/$dir$file";
             $file{size}          = humanize -s $_;
             $file{uploaded}      = (stat _)[9];
             $file{removal}{type} = $d;
@@ -222,9 +227,9 @@
         }
 
     }
-    $tt->process('inventory.html', \%tt) or die sprintf "template: %s\nINCLUDE_PATH:\n%s\n",
-	$tt->error(),
-	join "\n", @{$TT_CONFIG{INCLUDE_PATH}};
+    $tt->process('inventory.html', \%tt) or 
+	die sprintf "template: %s\nINCLUDE_PATH:\n%s\n", $tt->error(),
+		join "\n", map { "'$_'" } @{$TT_CONFIG{INCLUDE_PATH}};
     return 0;
 }
 
@@ -336,8 +341,12 @@
     my $file  = deslash realpath catfile $VAR, $+{path};
     my $base  = $+{base};
 
-    unless (-f $file) {
-        print header('text/plain', '404 Not found'), 'Not found';
+    if (not -f $file) {
+	    my $tt = Template->new(\%TT_CONFIG)
+		      or die $Template::ERROR;
+            my %tt = ( file => { name => $base });
+	    
+	$tt->process('not-found.html', \%tt) or die $tt->error();
         exit 0;
     }
 

--- a/configs/apache.conf	Mon Jan 04 14:53:19 2016 +0100
+++ b/configs/apache.conf	Mon Jan 04 15:04:25 2016 +0100
@@ -10,26 +10,26 @@
     # This directory needs to be r/w by the web server user 
     # (wwwrun, www-data, who ever), but it must not be
     # accessible via HTTP(s)
-    <Directory $var>
+    <Directory "$var">
 	Require all denied
     </Directory>
 
     Action	once-handler	    /once-handler/once.cgi virtual
     ScriptAlias /once-handler/	    $lib/
-    Alias	$location/public    $lib/public
+    Alias	$location/static    $lib/static
 
     # Order of location blocks matters!
     # We handle requests to our script, with the exception (see below)
-    # for …/public/… requests. These should be answered from a simple
+    # for …/static/… requests. These should be answered from a simple
     # static directory for style sheets and similiar
     <Location "$location">
 	    SetHandler once-handler
     </Location>
-    <Location "$location/public">
+    <Location "$location/static">
 	    SetHandler none
     </Location>
 
-    <Directory "$lib/public">
+    <Directory "$lib/static">
 	Require all granted
 	Allow from all
     </Directory>

--- a/lib/version.PL	Mon Jan 04 14:53:19 2016 +0100
+++ b/lib/version.PL	Mon Jan 04 15:04:25 2016 +0100
@@ -1,14 +1,16 @@
 #! /usr/bin/perl
 my $outfile = shift;
 
+my $now = localtime;
 chomp(my $version = `hg log -r . --template '{latesttag}-{latesttagdistance}-{node|short}\n'`);
-my $now = localtime;
 
-open(my $output, '>',  $_ = $outfile) or die "Can't open $_: $!\n";
+if (defined $outfile) {
+	open(STDOUT, '>',  $_ = $outfile) or die "Can't open $_: $!\n";
+}
 
-print {$output} <<_;
+print <<_;
 [%# autogenerated at $now by $0 %]
 [% vcs.version = "$version"; %]
 _
 
-utime 0, 0 => $outfile;
+utime 0, 0 => $outfile

--- a/templates/README	Mon Jan 04 14:53:19 2016 +0100
+++ b/templates/README	Mon Jan 04 15:04:25 2016 +0100
@@ -1,2 +1,5 @@
 Do not overwrite the files here. If you want to modify something,
-put your versions to ../template.override/
+put your versions to "templates" in your lib directory.
+
+	/usr/local/lib/once/templates/		for your modifications
+	/usr/local/lib/once/templates.default   for default templates

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/templates/not-found.html	Mon Jan 04 15:04:25 2016 +0100
@@ -0,0 +1,4 @@
+[% WRAPPER once.tt %]
+<h1>Sorry</h1>
+Das File <em>[% file.name %]</em> existiert (nicht) mehr.
+[% END %]

--- a/templates/once.tt	Mon Jan 04 14:53:19 2016 +0100
+++ b/templates/once.tt	Mon Jan 04 15:04:25 2016 +0100
@@ -3,7 +3,6 @@
 <html>
 [%-
     USE date;
-    PROCESS version.tt;
 -%]
 <head>
 <title>Once</title>
@@ -11,10 +10,12 @@
 <style type="text/css">
     th { text-align: left; }
 </style>
-<link rel="stylesheet" href="once/public/once.css">
+<link rel="stylesheet" href="once/static/once.css">
 </head>
 <body>
+
 [% content %]
+
 <hr />
 <div align="right">
     <font size=1>[% vcs.version %] | Scripting: Matthias Förste, Heiko Schlittermann</font>