Fix remaining code review issues

- Use addActionWarning() in dialog open callback to remove duplication
- Fix HTML entity display in breadcrumb and share link
  Literal ampersands (foo&bar) were displayed as foo&bar
- Add global escapeHtml() utility function for consistent HTML escaping

Author: mgutt

README.md

@@ -19,3 +19,25 @@ We recommend using VS Code with the following plugins:
 * Install [DavidAnson.vscode-markdownlint](https://marketplace.visualstudio.com/items?itemName=DavidAnson.vscode-markdownlint) and when reasonable, implement its recommendations for markdown code.
 * Install [foxundermoon.shell-format](https://marketplace.visualstudio.com/items?itemName=foxundermoon.shell-format) and [timonwong.shellcheck](https://marketplace.visualstudio.com/items?itemName=timonwong.shellcheck) and when reasonable, implement their recommendations when making changes to bash scripts.
 * Install [esbenp.prettier-vscode](https://marketplace.visualstudio.com/items?itemName=esbenp.prettier-vscode) and when reasonable, use it for formatting files.
+
+## Known Issues / Future Ideas
+
+### File Manager - Accurate Total Size Calculation
+
+**Current Implementation:**
+The file manager calculates total transfer size by averaging multiple rsync progress measurements. Since rsync truncates percentages (47.9% shows as 47%), this introduces ~2% error per measurement point. We average 5 samples at different progress levels to improve accuracy and show an approximate total (prefixed with `~`).
+
+**Proposed Improvement:**
+After collecting initial samples, run `timeout 60 du -sb $source` in the background to get exact byte count:
+- Parse source paths from `/var/tmp/file.manager.active` JSON
+- Start `du` asynchronously once estimation completes
+- Replace estimated size with exact size when `du` finishes
+- Use timeout to prevent hangs on very large directories
+
+**Challenge:**
+For move operations using rsync copy-delete, source files get deleted during transfer. Running `du` after the operation starts would return incomplete results. Would need to:
+- Start `du` before rsync starts (adds delay)
+- Or accept that move operations keep using estimation
+- Or detect rsync-rename moves (same filesystem) where source remains until completion
+
+**Decision:** Document for future consideration. Current estimation method is reasonable trade-off between accuracy and complexity.

emhttp/plugins/dynamix/Browse.page

@@ -59,6 +59,13 @@ function autoscale(value) {
   return ((Math.round(scale*data)/scale)+' '+unit[base]).replace('.','<?=$display['number'][0]?>')+'/s';
 }
 
+// HTML-escape function to preserve literal &amp; and other entities
+function escapeHtml(text) {
+  var div = document.createElement('div');
+  div.textContent = text;
+  return div.innerHTML;
+}
+
 // Add warning to dialog buttonpane based on action type
 function addActionWarning(action, isBulk) {
   var warningTexts = isBulk ? {
@@ -1063,21 +1070,7 @@ function doActions(action, title) {
       $('.ui-dfm').off('mousedown.dfmFileTree');
     },
     open: function() {
-      // Add warning to buttonpane for all relevant actions (bulk operations)
-      var warningTexts = {
-        0: "<?=_("This creates a folder at the current level")?>",
-        1: "<?=_("This deletes all selected sources")?>",
-        2: "<?=_("This renames the selected source")?>",
-        3: "<?=_("This copies all the selected sources")?>",
-        4: "<?=_("This moves all the selected sources")?>",
-        11: "<?=_("This changes the owner of the source recursively")?>",
-        12: "<?=_("This changes the permission of the source recursively")?>"
-      };
-      var warningText = warningTexts[action];
-      if (warningText) {
-        var $warning = $('<div class="dfm-warning">').html('<i class="fa fa-warning dfm"></i> ' + warningText);
-        $('.ui-dfm .ui-dialog-buttonset').prepend($warning);
-      }
+      addActionWarning(action, true);
     },
     buttons: {
       "_(Start)_": function(){
@@ -1356,10 +1349,11 @@ function loadList() {
 
 function xlink(link) {
   var path = decodeURIComponent(link).trim();
+  var escapedPath = escapeHtml(path);
 
   // Always show dialog with selectable textarea (better mobile support)
   var inputId = 'dfm_path_input_' + Date.now();
-  var inputHtml = '<textarea id="' + inputId + '" class="dfm-path-textarea text-center font-mono" readonly>' + path + '</textarea>';
+  var inputHtml = '<textarea id="' + inputId + '" class="dfm-path-textarea text-center font-mono" readonly>' + escapedPath + '</textarea>';
 
   swal({
     title: '',
@@ -1418,7 +1412,8 @@ $(function(){
   if (dirs.length > 1) {
     for (var n=1; n < dirs.length; n++) {
       var subdir = dirs.slice(1,n+1);
-      url.push('<a class="none" href="/<?=$path?>?dir=/'+encodeURIComponent(subdir.join('/'))+'" oncontextmenu="xlink(\'/' + encodeURIComponent(subdir.join('/')) + '\');return false">'+(n == 1 ? '<i class="fa fa-home"></i>' : dirs[n])+'</a>');
+      var displayText = n == 1 ? '<i class="fa fa-home"></i>' : escapeHtml(dirs[n]);
+      url.push('<a class="none" href="/<?=$path?>?dir=/'+encodeURIComponent(subdir.join('/'))+'" oncontextmenu="xlink(\'/' + encodeURIComponent(subdir.join('/')) + '\');return false">'+displayText+'</a>');
     }
   } else {
     url.push('<i class="fa fa-home red-text"></i>');