diff --git a/web/index.php b/web/index.php
index 0ffe376..7b979df 100644
--- a/web/index.php
+++ b/web/index.php
@@ -91,10 +91,14 @@ function showToast(msg, type = 'success') {
 
 function buildTransferDropdown(sourceId, currentUsername) {
     const others = ALL_ACCOUNTS.filter(a => a.username !== currentUsername);
-    if (!others.length) return '';
+    if (!others.length) {
+        return `<button class="btn btn-sm btn-outline-secondary" disabled title="Aucun autre compte disponible">
+            <i class="bi bi-share"></i>
+        </button>`;
+    }
     const items = others.map(a =>
         `<li><a class="dropdown-item" href="#" onclick="doTransfer(event,${sourceId},${a.id},'${a.username}')">
-            <i class="bi bi-arrow-right-circle me-1 text-primary"></i>${a.username}${a.display_name ? ' <span class=text-muted>— '+a.display_name+'</span>' : ''}
+            <i class="bi bi-arrow-right-circle me-1 text-primary"></i>${escHtml(a.username)}${a.display_name ? ' <span class="text-muted">— '+escHtml(a.display_name)+'</span>' : ''}
         </a></li>`
     ).join('');
     return `<div class="btn-group">
@@ -151,11 +155,12 @@ function renderMails(rows) {
         });
         let filesHtml = '<span class="text-muted small">Aucune pièce jointe</span>';
         if (r.files_list && r.files_list.length) {
-            filesHtml = r.files_list.map(f =>
-                f.exists
-                    ? `<a href="/mail/download.php?id=${f.id}" class="badge bg-info text-decoration-none me-1"><i class="bi bi-download me-1"></i>${escHtml(f.name.substring(0,22))}</a>`
-                    : `<span class="badge bg-secondary me-1" title="Fichier introuvable">${escHtml(f.name.substring(0,22))}</span>`
-            ).join('');
+            filesHtml = r.files_list.map(f => {
+                const label = shortName(f.name);
+                return f.exists
+                    ? `<a href="/mail/download.php?id=${f.id}" class="badge bg-info text-decoration-none me-1" title="${escHtml(f.name)}"><i class="bi bi-download me-1"></i>${escHtml(label)}</a>`
+                    : `<span class="badge bg-secondary me-1" title="${escHtml(f.name)}">⚠ ${escHtml(label)}</span>`;
+            }).join('');
         }
         const transferBtn = buildTransferDropdown(r.id, r.username);
         return `<tr id="row-${r.id}">
@@ -181,6 +186,14 @@ function escHtml(s) {
     return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;');
 }
 
+function shortName(name) {
+    const dot = name.lastIndexOf('.');
+    const ext  = dot >= 0 ? name.substring(dot) : '';
+    const base = dot >= 0 ? name.substring(0, dot) : name;
+    if (name.length <= 24) return name;
+    return base.substring(0, 14) + '…' + ext;
+}
+
 function loadMails() {
     fetch('/api/mails.php')
         .then(r => r.json())