diff --git a/plugins/dynamix/Browse.page b/plugins/dynamix/Browse.page
index 47e4d226e..59934e3a9 100644
--- a/plugins/dynamix/Browse.page
+++ b/plugins/dynamix/Browse.page
@@ -15,8 +15,20 @@ Markdown="false"
  */
 ?>
 <?
-[$root,$main,$rest] = my_explode('/',substr($dir,1),3);
-$user = ($root=='mnt' && ($main=='user'|| $main=='user0')) ? 1 : 0;
+function cap($dir,$p) {
+  return mb_substr($dir,$p,1)=='/' ? '/' : '';
+}
+function truepath($dir) {
+  $dir  = preg_replace('://+:','/',htmlspecialchars_decode($dir));
+  $bits = array_filter(explode('/',$dir),'mb_strlen');
+  $path = [];
+  foreach ($bits as $bit) {
+    if ($bit=='.') continue;
+    if ($bit=='..') array_pop($path); else $path[] = $bit;
+  }
+  return cap($dir,0).implode('/',$path);
+}
+$dir = htmlspecialchars(str_replace('\\','\\\\',truepath($dir)));
 ?>
 <style>
 .loc{text-align:left!important;padding-left:0!important}
@@ -25,7 +37,7 @@ $user = ($root=='mnt' && ($main=='user'|| $main=='user0')) ? 1 : 0;
 <script>
 $(function(){
   timers.browse = setTimeout(function(){$('div.spinner.fixed').show('slow');},500);
-  $.get('/webGui/include/Browse.php',{dir:encodeURIComponent("<?=$dir?>"),path:"<?=$path?>",user:<?=$user?>},function(data){
+  $.get('/webGui/include/Browse.php',{dir:encodeURIComponent("<?=$dir?>"),path:"<?=$path?>"},function(data){
     clearTimeout(timers.browse);
     var table = $('table.indexer');
     var col = $.cookie('col')||1;
diff --git a/plugins/dynamix/include/Browse.php b/plugins/dynamix/include/Browse.php
index ede38c0c5..3f6da043b 100644
--- a/plugins/dynamix/include/Browse.php
+++ b/plugins/dynamix/include/Browse.php
@@ -42,23 +42,23 @@ function my_devs(&$devs) {
 }
 extract(parse_plugin_cfg('dynamix',true));
 $disks = parse_ini_file('state/disks.ini',true);
-$dir   = urldecode($_GET['dir']??'');
-$path  = unscript($_GET['path']??'');
-$user  = unscript($_GET['user']??'');
-$all   = $docroot.preg_replace('/([\'" &()[\]\\\\])/','\\\\$1',$dir).'/*';
-$fix   = substr($dir,0,4)=='/mnt' ? (explode('/',trim_slash($dir))[2] ?: '---') : _('flash');
+$dir   = realpath(htmlspecialchars_decode(rawurldecode($_GET['dir'])));
+$path  = unscript($_GET['path']);
+[$root,$main,$rest] = my_explode('/',mb_substr($dir,1),3);
+$fix   = $root=='mnt' ? ($main ?: '---') : ($root=='boot' ? _('flash') : '---');
+$user  = $root=='mnt' && in_array($main,['user','user0']);
 $fmt   = "%F {$display['time']}";
 $dirs  = $files = [];
 $total = $i = 0;
 
 if ($user) {
   $tag = implode('|',array_merge(['disk'],pools_filter($disks)));
-  $set = explode(';',str_replace(',;',',',preg_replace("/($tag)/",';$1',exec("shopt -s dotglob; getfattr --no-dereference --absolute-names --only-values -n system.LOCATIONS $all 2>/dev/null"))));
+  $set = explode(';',str_replace(',;',',',preg_replace("/($tag)/",';$1',exec("shopt -s dotglob; getfattr --no-dereference --absolute-names --only-values -n system.LOCATIONS ".escapeshellarg($dir)."/* 2>/dev/null"))));
 }
-$stat = popen("shopt -s dotglob; stat -L -c'%F|%n|%s|%Y' $all",'r');
+$stat = popen("shopt -s dotglob; stat -L -c'%F|%n|%s|%Y' ".escapeshellarg($dir)."/* 2>/dev/null",'r');
 while (($row = fgets($stat))!==false) {
   $row .= $user ? "|{$set[++$i]}" : "|$fix";
-  if (substr($row,0,3)=='dir') $dirs[] = $row; else $files[] = $row;
+  if ($row[0]=='d') $dirs[] = $row; else $files[] = $row;
 }
 pclose($stat);
 
@@ -74,8 +74,8 @@ foreach ($dirs as $row) {
   $devs = explode(',',$set);
   echo "<tr>";
   echo "<td data=''><div class='icon-dir'></div></td>";
-  echo "<td><a href=\"/$path?dir=".rawurlencode($full)."\">".htmlspecialchars($name)."</a></td>";
-  echo "<td data='0'>&lt;FOLDER&gt;</td>";
+  echo "<td><a href=\"/$path?dir=".rawurlencode(htmlspecialchars($full))."\">".htmlspecialchars($name)."</a></td>";
+  echo "<td data='0'>&lt;"._('FOLDER')."&gt;</td>";
   echo "<td data='$time'>".my_time($time,$fmt)."</td>";
   echo "<td class='loc'>".my_devs($devs)."</td>";
   echo "</tr>";
@@ -103,7 +103,7 @@ echo "</tbody>";
 $dirs  = count($dirs);
 $files = count($files);
 $objs  = $dirs + $files;
-if ($objs==0 && !exec("find \"$dir\" -maxdepth 0 -empty -exec echo 1 \;")) {
+if ($objs==0 && !exec("find ".escapeshellarg($dir)." -maxdepth 0 -empty -exec echo 1 \;")) {
   echo "<tfoot><tr><td></td><td colspan='4'>"._('No listing: Too many files')."</td></tr></tfoot>";
 } else {
   $total = ' ('.my_scale($total,$unit).' '.$unit.' '._('total').')';
diff --git a/plugins/dynamix/nchan/parity_list b/plugins/dynamix/nchan/parity_list
index 3e19380a9..b90207650 100755
--- a/plugins/dynamix/nchan/parity_list
+++ b/plugins/dynamix/nchan/parity_list
@@ -94,7 +94,7 @@ while (true) {
         $idle = []; while (count($synced)>1) $idle[] = array_pop($synced) - array_pop($synced);
         $duration = $var['sbSynced2'] - ($sbSynced?:$var['sbSynced']);
         $status   = $var['sbSyncExit'];
-        $speed    = $status==0 ? my_scale($var['mdResyncSize']*1024/($duration+array_sum($idle)),$unit,1)." $unit/s" : 0;
+        $speed    = $status==0 ? my_scale($var['mdResyncSize']*1024/($duration-array_sum($idle)),$unit,1)." $unit/s" : 0;
         $error    = $var['sbSyncErrs'];
         $year     = date('Y',$var['sbSynced2']);
         if ($status==0||file_exists($log)) file_put_contents($log,"$year $timestamp|$duration|$speed|$status|$error\n",FILE_APPEND);
diff --git a/plugins/dynamix/scripts/monitor b/plugins/dynamix/scripts/monitor
index 3a44dd170..5bd0b304c 100755
--- a/plugins/dynamix/scripts/monitor
+++ b/plugins/dynamix/scripts/monitor
@@ -281,7 +281,7 @@ if ($var['mdResyncPos']) {
     $idle = []; while (count($synced)>1) $idle[] = array_pop($synced) - array_pop($synced);
     $duration = $var['sbSynced2'] - ($sbSynced?:$var['sbSynced']);
     $status   = $var['sbSyncExit'];
-    $speed    = $status==0 ? my_scale($var['mdResyncSize']*1024/($duration+array_sum($idle)),$unit,1)." $unit/s" : 0;
+    $speed    = $status==0 ? my_scale($var['mdResyncSize']*1024/($duration-array_sum($idle)),$unit,1)." $unit/s" : 0;
     [$entry,$duration,$speed,$status,$error] = explode('|', read_write_parity_log($var['sbSynced2'],$duration,$speed,$status,$var['sbSyncErrs']));
     $info = $status==0 ? "Duration: ".my_check($duration, $speed) : ($status==-4 ? "Canceled" : "Error code: $status");
     $level = ($status==0 && $var['sbSyncErrs']==0) ? "normal" : "warning";