diff --git a/servers/UploadFilesServer/UploadFilesServer.py b/servers/UploadFilesServer/UploadFilesServer.py
index c61e9a3a..9ae2e263 100755
--- a/servers/UploadFilesServer/UploadFilesServer.py
+++ b/servers/UploadFilesServer/UploadFilesServer.py
@@ -91,6 +91,7 @@ register(AdminUploadFiles)
 class UploadFile(ObjectServerMixin, UploadFileCommon):
     def acquireNonCore(self, objectDirectoryPath = None,
                        dataDirectoryPath = None, parentSlot = None):
+        self.properties = []
         ObjectServerMixin.acquireNonCore(
             self, objectDirectoryPath = objectDirectoryPath,
             dataDirectoryPath = dataDirectoryPath, parentSlot = parentSlot)
@@ -131,7 +132,7 @@ class UploadFile(ObjectServerMixin, UploadFileCommon):
             property.kind.isTranslatable = 0
             property.kind.label = label
             self.values[name] = value
-            self.properties.append(property)
+            self.properties = self.properties[:]
 
         if self.isType('image') and PILImage and self.data:
             uploadFileFile = cStringIO.StringIO(self.data)
@@ -344,7 +345,10 @@ class UploadFilesServer(UploadFilesCommonMixin, ObjectsServer):
                     except IOError:
                         pass
                     else:
-                        objectObject.thumbnail((width, height))
+                        try:
+                            objectObject.thumbnail((width, height))
+                        except IOError:
+                            raise faults.UnresizableImage()
                         thumbnailFile = cStringIO.StringIO()
                         objectObject.save(
                             thumbnailFile, objectObject.format)
diff --git a/shared/common/faults.py b/shared/common/faults.py
index 8d8af398..90fa5e0e 100644
--- a/shared/common/faults.py
+++ b/shared/common/faults.py
@@ -119,6 +119,7 @@ faultCodeDuplicateSerial = 5004
 faultCodeWrongToken = 5005
 faultCodeDisabledAccount = 5006
 
+faultCodeUnresizableImage = 6000
 
 
 Fault = xmlrpclib.Fault
@@ -500,6 +501,13 @@ class DisabledAccount(BaseFault):
         return 'Disabled account'
 
 
+class UnresizableImage(BaseFault):
+    faultCode = faultCodeUnresizableImage
+
+    def makeFaultString(self):
+        return 'unresizable image'
+
+
 class UnknownStringDigest(BaseFault):
     faultCode = faultCodeUnknownStringDigest
 
diff --git a/shared/web/UploadFilesWeb.py b/shared/web/UploadFilesWeb.py
index b47d55de..0a21a582 100644
--- a/shared/web/UploadFilesWeb.py
+++ b/shared/web/UploadFilesWeb.py
@@ -204,7 +204,7 @@ class UploadFilesWeb(ObjectsWebMixin, UploadFilesProxy):
             id, ['modificationTime', 'dataFileName'])
         rememberObject(id)
 
-        if fileName and object.dataFileName != fileName:
+        if fileName and object.dataFileName != urllib.unquote(fileName):
             pageNotFound()
         if not fileName and object.dataFileName:
             uri = X.idUrl(id, 'download/%s' % object.dataFileName)
@@ -284,7 +284,10 @@ class UploadFilesWeb(ObjectsWebMixin, UploadFilesProxy):
             height = int(height)
         except ValueError:
             height = 128
-        object = self.getObjectThumbnail(id, width, height)
+        try:
+            object = self.getObjectThumbnail(id, width, height)
+        except faults.UnresizableImage:
+            return pageNotFound() # FIXME: why not HTTP_NOT_IMPLEMENTED
         rememberObject(id)
 
         req = context.getVar('req')