diff -ruN e-smith-backup-2.4.0.old/root/etc/e-smith/events/actions/workstation-backup-dar e-smith-backup-2.4.0/root/etc/e-smith/events/actions/workstation-backup-dar
--- e-smith-backup-2.4.0.old/root/etc/e-smith/events/actions/workstation-backup-dar	2013-07-07 21:03:58.000000000 -0700
+++ e-smith-backup-2.4.0/root/etc/e-smith/events/actions/workstation-backup-dar	2013-07-07 21:52:12.000000000 -0700
@@ -29,6 +29,7 @@
 use File::Path;
 use File::Find;
 use POSIX ":sys_wait_h";
+use File::Glob qw(bsd_glob);
 use esmith::ConfigDB;
 
 sub ldie;
@@ -175,7 +176,7 @@
         } 
     }
 
-    system("/bin/mkdir -p /$smbshare");
+    system("/bin/mkdir", "-p", "/$smbshare");
 
     $err = qx(/bin/mount $device "/$smbshare" 2>&1);
     if ($err) {ldie("Error while mounting $device /$smbshare : \n" . $err)};
@@ -193,6 +193,7 @@
 open FD, '/proc/mounts';
 while (<FD>)
 {
+    s/\\040/ /g; # /proc/mount returns spaces as \040 which causes problems in matching
     next unless /\s$mntdir\s/;
     $err++;
 }
@@ -279,6 +281,8 @@
 	# removing .dar extension
 	$ref =~ s/\..*\.dar$//;
 	$ref = "--ref " . $setdirname . "/" . $ref;
+	$ref = "--ref|" . $setdirname . "/" . $ref; # | will be used to split this string in run_backup()
+
 	$bkname = "inc-" . sprintf("%03d", $incnum) . "-". $bkname;
     }
 }
@@ -326,7 +330,7 @@
 
 $report .= "Moving backup files to target directory $setdirname \n"; 
 
-foreach (<$tmpdir/$id/$bkname*>)
+foreach (bsd_glob("$tmpdir/$id/$bkname*"))
 {
     ldie("Error while moving backup file $_ from temporary dir $tmpdir/$id to $setdirname : $!")
 	unless move($_, $setdirname);
@@ -374,7 +296,8 @@
 my @bknum;
 my @setd;
 my @bkname;
-open(DAR_LIST, "/usr/bin/dar_manager -Q -B $catalog -l |");
+open(DAR_LIST, "/usr/bin/dar_manager -Q -B \"$catalog\" -l |");
+
 while (<DAR_LIST>)
 {
 	next unless ($_ =~ /set/);
@@ -426,8 +426,8 @@
 }
 
 # Check free disk space
-my $df = qx(/bin/df -Ph $mntdir);
-if ($df =~ /^\S+\s+(\S+)\s+(\S+)\s+(\S+)\s+(\d*%)/mi)
+my $df = qx(/bin/df -Ph \"$mntdir\");
+if ($df =~ /(\S+)\s+(\S+)\s+(\S+)\s+(\d*%)/)
 {
 	$report .= "Disk usage $2, $4 full, $3 available\n";
 }
@@ -513,7 +517,7 @@
     my $killerpid = undef;
 
     eval {
-         		($pid = open INPUT, "-|", "/usr/bin/dar", "-Q", "--create", "$tmpdir/$id/$bkname", split(/\s+/,$ref),  "-B", "/etc/dar/$job.dcf") or ldie("cannot start : $!" );
+         		($pid = open INPUT, "-|", "/usr/bin/dar", "-Q", "--create", "$tmpdir/$id/$bkname", split(/\|/,$ref),  "-B", "/etc/dar/$job.dcf") or ldie("cannot start : $!" );
 
          if ($pid) {
             $killerpid = start_dar_killer($pid, $timeout);         }
diff -ruN e-smith-backup-2.2.0.old/root/etc/e-smith/web/functions/backup e-smith-backup-2.2.0/root/etc/e-smith/web/functions/backup
--- e-smith-backup-2.2.0.old/root/etc/e-smith/web/functions/backup	2013-07-06 08:13:49.000000000 -0700
+++ e-smith-backup-2.2.0/root/etc/e-smith/web/functions/backup	2013-07-06 11:57:19.000000000 -0700
@@ -1783,7 +1783,7 @@
 
     # Finding existing backups
     
-    find { wanted => \&$setbackuplist, untaint => 1 }, $mntbkdir ;
+    find { wanted => \&$setbackuplist, untaint => 1, untaint_pattern => qr|^([-+@\w\s./]+)$|}, $mntbkdir ;
 
     my %blabels = ();
     my @blabels;
@@ -1936,7 +1936,7 @@
 	# find list of available backups and verify
 	# it contains all backups needed for full restore
 
-	find { wanted => \&$backupsetlist, untaint => 1 }, $set ;
+	find { wanted => \&$backupsetlist, untaint => 1, untaint_pattern => qr|^([-+@\w\s./]+)$| }, $set ;
     
 	my $key;
 	my $num = 0;
@@ -2185,7 +2185,7 @@
 
     # Finding existing backups
     
-    find { wanted => \&$setbackupflist, untaint => 1 }, $mntbkdir ;
+    find { wanted => \&$setbackupflist, untaint => 1, untaint_pattern => qr|^([-+@\w\s./]+)$| }, $mntbkdir ;
 
     my %blabels = ();
     my @blabels;
@@ -2343,7 +2343,7 @@
      # finding list of available backups
     # and verifying all needed backup files are available
     
-    find { wanted => \&$backupsetlist, untaint => 1 }, $set ;
+    find { wanted => \&$backupsetlist, untaint => 1, untaint_pattern => qr|^([-+@\w\s./]+)$| }, $set ;
     
     my $key;
     my $num = 0;
@@ -2985,11 +2985,11 @@
 	
 	if ($when) 
 	{
-	    $restorerr = system ("/usr/bin/dar_manager -B $mntbkdir/dar-catalog -w $when -e '-N -R / -w' -r @restorelist");
+	    $restorerr = system ("/usr/bin/dar_manager -B \"$mntbkdir/dar-catalog\" -w $when -e '-N -R / -w' -r @restorelist");
 	}
 	else 
 	{
-	    $restorerr = system ("/usr/bin/dar_manager -B $mntbkdir/dar-catalog -e '-N -R / -w' -r @restorelist");
+	    $restorerr = system ("/usr/bin/dar_manager -B \"$mntbkdir/dar-catalog\" -e '-N -R / -w' -r @restorelist");
 	}
 	    
         if ($mounted)