--- a/s4-funcs.sh	Tue Jun 23 12:47:34 2020 +0900
+++ b/s4-funcs.sh	Tue Jun 23 12:58:31 2020 +0900
@@ -729,7 +729,7 @@
 	user|skey) unset _$i ;;
       esac
     fi
-    query "DELETE FROM par WHERE var='$i';"
+    query "DELETE FROM par WHERE var='$i' AND sessid='$session';"
   done
 }
 replpar() {
@@ -2941,7 +2941,7 @@
 	fi
 	subj=`getpar subject`
 	afiles=""
-	for fn in `query "SELECT DISTINCT val FROM par WHERE var='files';"`
+	for fn in `query "SELECT DISTINCT val FROM par WHERE var='files' AND sessid='$session';"`
 	do
 	  f=$tmpd/$fn
 	  if [ -s $f ]; then
@@ -3978,7 +3978,7 @@
 	# sessID|address.1.22|string|Somewhere-x.y.z
 	sql=""
 ##err dots from query "select var from par where var like '$col.%';"
-        for v in `query "select var from par where var like '$col.%';"`; do
+        for v in `query "select var from par where var like '$col.%' AND sessid='$session';"`; do
 	  # v=address.1.22
 	  st_rowid=${v##*.}
 	  origcol=${v%%.*}	# original column derived from
@@ -4014,10 +4014,29 @@
 		  ;;
 		*)
 		  newsql="update $tb2 set val=(select val from par where var \
-like '$col.%.$st_rowid')"
+like '$col.%.$st_rowid' AND sessid='$session')"
 		  ;;
 	      esac
 	      ;;
+	    mv)
+	      # regularize filename and strip directory part
+	      newname=`getpar mv.$v|tr -d '":;#<>?^%$!'|tr -d "'"|tr ' ' _`
+	      newname=`basename $newname`
+	      err "newname($v)=$newname"
+	      newext="${newname##*.}"
+	      if test x"$newname" != x"$newext" \
+		  && echo "${file_accept#*=}" \
+		    | fgrep -w "$newext" >/dev/null 1>&2
+	      then
+		newsql="UPDATE $tb2 SET val='$newname'"
+	      else
+		html p<<-EOF
+		$newname は取り扱えないファイル名です。
+		空白を含まない名前で拡張子を正しくつけて下さい。
+		EOF
+		continue
+	      fi
+	      ;;
 	    *)			# maybe "keep", do not modify value
 	      continue
 	      ;;