Don't provde the output filename to the upload tool if it's outside Galaxy's files_path, since this means we're only linking data and the output paths are not used (and may contain non-shell-safe characters). Fixes issue #533.

tools/data_source/upload.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
 
-<tool name="Upload File" id="upload1" version="1.1.2">
+<tool name="Upload File" id="upload1" version="1.1.3">
   <description>
     from your computer  
   </description>
@@ -11,7 +11,12 @@
     #while $varExists('output%i' % $outnum):
         #set $output = $getVar('output%i' % $outnum)
         #set $outnum += 1
-        ${output.dataset.dataset.id}:${output.files_path}:${output}
+        #set $file_name = $output.file_name
+        ## FIXME: This is not future-proof for other uses of external_filename (other than for use by the library upload's "link data" feature)
+        #if $output.dataset.dataset.external_filename:
+            #set $file_name = "None"
+        #end if
+        ${output.dataset.dataset.id}:${output.files_path}:${file_name}
     #end while
   </command>
   <inputs nginx_upload="true">