Bugfix: upload() would allow upload of duplicate file to "invisible" dirs (e.g.

sysop or uploads dir) if the file was in the dir's database, but not on disk.
Cosmetic change: display unpadded filename in error strings.