diff --git a/plemp.rb b/plemp.rb
index 62ce18b..3ad862b 100644
--- a/plemp.rb
+++ b/plemp.rb
@@ -6,8 +6,14 @@ require "pathname"
 Camping.goes :Plemp
 
 Markaby::Builder.set(:indent, 2)
-PUBLIC_DIR = Pathname.new(__FILE__).dirname + "public"
-UPLOAD_DIR = Pathname.new(__FILE__).dirname + "upload"
+unless defined? BASE_DIR
+  BASE_DIR = Pathname.new(__FILE__).dirname
+  PUBLIC_DIR = BASE_DIR + "public"
+  UPLOAD_DIR = BASE_DIR + "upload"
+
+  Positions = Hash.new
+end
+
 
 module Plemp::Controllers
 
@@ -17,15 +23,17 @@ module Plemp::Controllers
     end
   end
 
- class PublicX
-    MIME_TYPES = {'.css' => 'text/css',
-                  '.js'  => 'text/javascript', 
-                  '.jpg' => 'image/jpeg'}
+ class StaticXX
+    MIME_TYPES = {'.css'  => 'text/css',
+                  '.js'   => 'text/javascript', 
+                  '.jpeg' => 'image/jpeg',
+                  '.jpg'  => 'image/jpeg',
+                  '.png'  => 'image/png'}
 
-    def get(path)
+    def get(type, path)
       @headers['Content-Type'] = MIME_TYPES[path[/\.\w+$/, 0]] || "text/plain"
-      unless path.include? ".." # prevent directory traversal attacks
-        @headers['X-Sendfile'] = "#{PUBLIC_DIR}/#{path}"
+      unless path.include? ".." or not ["public", "upload"].include? type
+        @headers['X-Sendfile'] = (BASE_DIR + type + path).to_s
       else
         @status = "403"
         "403 - Invalid path"
@@ -35,14 +43,16 @@ module Plemp::Controllers
 
   class SaveposXXX
     def post(id, top, left)
-      $stderr.puts("Got: top: #{top}, left: #{left}")
+      $stderr.puts("Got: id: #{id} -> top: #{top}, left: #{left}")
+      Positions[id] = [top, left]
+      $stderr.puts Positions.inspect
       ""
     end
   end
 
   class Upload
     def post
-      orig_ext = File.extname(@input.file[:filename])
+      orig_ext = File.extname(@input.file[:filename]).downcase
       new_file = UPLOAD_DIR + Time.now.strftime("%Y%m%d%H%M%S#{orig_ext}")
       new_file.open("w") do |f|
         f.write(@input.file[:tempfile].read)
@@ -60,7 +70,8 @@ module Plemp::Views
       head do
         title "Plemp!"
         ['drag', 'prototype', 'effects', 'controls'].each do |js|
-          script :src => R(PublicX, "#{js}.js"), :type => "text/javascript"
+          script :src => R(StaticXX, "public", "#{js}.js"), 
+                 :type => "text/javascript"
         end
       end
       body do
@@ -77,18 +88,28 @@ module Plemp::Views
         input :type => "submit", :value => "Upload!"
       end
     end
-    div.first!  :style => "position:absolute;top:120px;left:100px",
-                :onmousedown => "drag(event)" do "First" end
-    div.second! :style => "position:absolute;top:170px;left:300px",
-                :onmousedown => "drag(event)",
-                :onmouseup => _savepos do "Second" end
+    UPLOAD_DIR.entries.select { |f| (UPLOAD_DIR + f).file? }.each do |f|
+      file = UPLOAD_DIR + f
+      id = file.basename.to_s
+      if Positions.has_key? id
+        top, left = Positions[id]
+      else
+        top, left = ["#{rand(800)}px", "#{rand(400)}px"]
+        Positions[id] = [top, left]
+      end
+      img :id => id,
+          :src => R(StaticXX, "upload", file.basename),
+          :alt => file.basename,
+          :style => "position:fixed;top:#{top};left:#{left};border:thin solid black;padding:15px;background-color:white;width:300px",
+          :onmousedown => "drag(event)",
+          :onmouseup => _savepos
+    end
   end
 
-  def _savepos
-    "new Ajax.Request('http://localhost:3301/savepos/' + " +
-    "this.id + '/' + this.style.top + '/' + this.style.left); " +
-    "return false;"
+  def _savepos(id = nil)
+    "new Ajax.Request('http://almaz.spacelabs.nl:3301/savepos/' + " +
+      "this.id + '/' + this.style.top + '/' + this.style.left); " +
+      "return false;"
   end
 
-
 end