diff --git a/seahub/api2/views.py b/seahub/api2/views.py
index 0f53373079..9dd398fea2 100644
--- a/seahub/api2/views.py
+++ b/seahub/api2/views.py
@@ -4240,6 +4240,12 @@ class ThumbnailView(APIView):
         if size is None:
             return api_error(status.HTTP_400_BAD_REQUEST, 'Size is missing.')
 
+        try:
+            size = int(size)
+        except ValueError as e:
+            logger.error(e)
+            return api_error(status.HTTP_400_BAD_REQUEST, 'Invalid size.')
+
         obj_id = get_file_id_by_path(repo_id, path)
         if path is None or obj_id is None:
             return api_error(status.HTTP_400_BAD_REQUEST, 'Wrong path.')
diff --git a/seahub/templates/js/templates.html b/seahub/templates/js/templates.html
index 0304822a54..5dd99a12b1 100644
--- a/seahub/templates/js/templates.html
+++ b/seahub/templates/js/templates.html
@@ -250,8 +250,8 @@
     </td>
     <td class="dirent-icon">
         <% if (dirent.is_img) { %>
-            <% if (dirent.thumbnail_src) { %>
-            <img src="{{ SITE_ROOT }}<% print(encodeURIComponent(dirent.thumbnail_src)) %>" alt="" />
+            <% if (dirent.encoded_thumbnail_src) { %>
+            <img src="{{ SITE_ROOT }}<%- dirent.encoded_thumbnail_src %>" alt="" />
             <% } else { %>
             <img src="{{ MEDIA_URL }}img/file/<%= dirent.file_icon %>" alt="" />
             <% } %>
diff --git a/seahub/templates/view_shared_dir.html b/seahub/templates/view_shared_dir.html
index 2c45a1ebfe..335534ba64 100644
--- a/seahub/templates/view_shared_dir.html
+++ b/seahub/templates/view_shared_dir.html
@@ -57,8 +57,8 @@
                 {% for dirent in file_list %}
                 <tr class="file-item" data-name="{{dirent.obj_name}}" >
                     {% if dirent.allow_generate_thumbnail %}
-                        {% if dirent.thumbnail_src %}
-                            <td class="dirent-icon"><img class="thumbnail" src="{{SITE_ROOT}}{{ dirent.thumbnail_src|urlencode }}" alt="{% trans "File"%}" /></td>
+                        {% if dirent.encoded_thumbnail_src %}
+                            <td class="dirent-icon"><img class="thumbnail" src="{{ SITE_ROOT }}{{ dirent.encoded_thumbnail_src }}" alt="{% trans "File"%}" /></td>
                         {% else %}
                             <td class="dirent-icon"><img class="not-thumbnail" src="{{ MEDIA_URL }}img/file/{{ dirent.obj_name|file_icon_filter }}" alt="{% trans "File"%}" /></td>
                         {% endif %}
@@ -138,7 +138,7 @@ $(function() {
             dataType: 'json',
             success: function(data) {
                 if (data) {
-                    img_icon.attr("src", '{{SITE_ROOT}}' + e(data.thumbnail_src)).load(function() {
+                    img_icon.attr("src", '{{ SITE_ROOT }}' + data.encoded_thumbnail_src).load(function() {
                         $(this).removeClass("not-thumbnail").addClass("thumbnail");
                     });
                 }
diff --git a/seahub/thumbnail/utils.py b/seahub/thumbnail/utils.py
index 108894884e..2a59c8dbe4 100644
--- a/seahub/thumbnail/utils.py
+++ b/seahub/thumbnail/utils.py
@@ -37,34 +37,34 @@ def allow_generate_thumbnail(request, repo_id, path):
     repo = get_repo(repo_id)
     file_size = get_file_size(repo.store_id, repo.version, file_id)
 
-    if not repo.encrypted and file_type == IMAGE and ENABLE_THUMBNAIL:
-        # check image compressed size limit
-        if file_size < THUMBNAIL_IMAGE_COMPRESSED_SIZE_LIMIT * 1024**2:
+    if repo.encrypted or file_type != IMAGE or not ENABLE_THUMBNAIL:
+        return False
+
+    # check image compressed size limit
+    if file_size < THUMBNAIL_IMAGE_COMPRESSED_SIZE_LIMIT * 1024**2:
+        return True
+
+    # get image memory cost
+    token = seafile_api.get_fileserver_access_token(repo_id, file_id, 'view',
+                                                    '', use_onetime = False)
+
+    inner_path = gen_inner_file_get_url(token, obj_name)
+    try:
+        image_file = urllib2.urlopen(inner_path)
+        f = StringIO(image_file.read())
+        image = Image.open(f)
+        width, height = image.size
+
+        # check image memory cost size limit
+        # use RGBA as default mode(4x8-bit pixels, true colour with transparency mask)
+        # every pixel will cost 4 byte in RGBA mode
+        image_memory_cost = width * height * 4 / 1024 / 1024
+        if image_memory_cost < THUMBNAIL_IMAGE_ORIGINAL_SIZE_LIMIT:
             return True
 
-        # get image memory cost
-        token = seafile_api.get_fileserver_access_token(repo_id, file_id, 'view',
-                                                        '', use_onetime = False)
-
-        inner_path = gen_inner_file_get_url(token, obj_name)
-        try:
-            image_file = urllib2.urlopen(inner_path)
-            f = StringIO(image_file.read())
-            image = Image.open(f)
-            width, height = image.size
-
-            # check image memory cost size limit
-            # use RGBA as default mode(4x8-bit pixels, true colour with transparency mask)
-            # every pixel will cost 4 byte in RGBA mode
-            image_memory_cost = width * height * 4 / 1024 / 1024
-            if image_memory_cost < THUMBNAIL_IMAGE_ORIGINAL_SIZE_LIMIT:
-                return True
-
-        except Exception as e:
-            logger.error(e)
-            return False
-
-    return False
+    except Exception as e:
+        logger.error(e)
+        return False
 
 def generate_thumbnail(request, repo_id, size, path):
     """ generate and save thumbnail if not exist
@@ -77,21 +77,22 @@ def generate_thumbnail(request, repo_id, size, path):
     file_id = get_file_id_by_path(repo_id, path)
     thumbnail_file = os.path.join(thumbnail_dir, file_id)
 
-    if not os.path.exists(thumbnail_file):
-        token = seafile_api.get_fileserver_access_token(repo_id, file_id, 'view',
-                                                        '', use_onetime = False)
+    if os.path.exists(thumbnail_file):
+        return True
 
-        inner_path = gen_inner_file_get_url(token, os.path.basename(path))
-        try:
-            image_file = urllib2.urlopen(inner_path)
-            f = StringIO(image_file.read())
-            image = Image.open(f)
-            if image.mode not in ["1", "L", "P", "RGB", "RGBA"]:
-                image = image.convert("RGB")
-            image.thumbnail((size, size), Image.ANTIALIAS)
-            image.save(thumbnail_file, THUMBNAIL_EXTENSION)
-        except Exception as e:
-            logger.error(e)
-            return False
+    token = seafile_api.get_fileserver_access_token(repo_id, file_id, 'view',
+                                                    '', use_onetime = False)
 
-    return True
+    inner_path = gen_inner_file_get_url(token, os.path.basename(path))
+    try:
+        image_file = urllib2.urlopen(inner_path)
+        f = StringIO(image_file.read())
+        image = Image.open(f)
+        if image.mode not in ["1", "L", "P", "RGB", "RGBA"]:
+            image = image.convert("RGB")
+        image.thumbnail((size, size), Image.ANTIALIAS)
+        image.save(thumbnail_file, THUMBNAIL_EXTENSION)
+        return True
+    except Exception as e:
+        logger.error(e)
+        return False
diff --git a/seahub/thumbnail/views.py b/seahub/thumbnail/views.py
index d72c9fad31..22cbdf8f52 100644
--- a/seahub/thumbnail/views.py
+++ b/seahub/thumbnail/views.py
@@ -5,6 +5,7 @@ import posixpath
 import datetime
 
 from django.utils.translation import ugettext as _
+from django.utils.http import urlquote
 from django.http import HttpResponse
 from django.views.decorators.http import condition
 
@@ -57,7 +58,7 @@ def thumbnail_create(request, repo_id):
     size = request.GET.get('size', THUMBNAIL_DEFAULT_SIZE)
     if generate_thumbnail(request, repo_id, size, path):
         src = get_thumbnail_src(repo_id, size, path)
-        result['thumbnail_src'] = src
+        result['encoded_thumbnail_src'] = urlquote(src)
         return HttpResponse(json.dumps(result), content_type=content_type)
     else:
         err_msg = _('Failed to create thumbnail.')
@@ -145,7 +146,7 @@ def share_link_thumbnail_create(request, token):
     size = request.GET.get('size', THUMBNAIL_DEFAULT_SIZE)
     if generate_thumbnail(request, repo_id, size, real_path):
         src = get_share_link_thumbnail_src(token, size, req_path)
-        result['thumbnail_src'] = src
+        result['encoded_thumbnail_src'] = urlquote(src)
         return HttpResponse(json.dumps(result), content_type=content_type)
     else:
         err_msg = _('Failed to create thumbnail.')
diff --git a/seahub/views/ajax.py b/seahub/views/ajax.py
index babcd45eb3..0ecef675be 100644
--- a/seahub/views/ajax.py
+++ b/seahub/views/ajax.py
@@ -301,7 +301,8 @@ def list_dir(request, repo_id):
         if allow_generate_thumbnail(request, repo_id, file_path):
             f.allow_generate_thumbnail = True
             if os.path.exists(os.path.join(THUMBNAIL_ROOT, str(THUMBNAIL_DEFAULT_SIZE), f.obj_id)):
-                f.thumbnail_src = get_thumbnail_src(repo.id, THUMBNAIL_DEFAULT_SIZE, file_path)
+                src = get_thumbnail_src(repo.id, THUMBNAIL_DEFAULT_SIZE, file_path)
+                f.encoded_thumbnail_src = urlquote(src)
 
     ctx = {
         'repo': repo,
@@ -391,7 +392,8 @@ def list_dir_more(request, repo_id):
         if allow_generate_thumbnail(request, repo_id, file_path):
             f.allow_generate_thumbnail = True
             if os.path.exists(os.path.join(THUMBNAIL_ROOT, str(THUMBNAIL_DEFAULT_SIZE), f.obj_id)):
-                f.thumbnail_src = get_thumbnail_src(repo.id, THUMBNAIL_DEFAULT_SIZE, file_path)
+                src = get_thumbnail_src(repo.id, THUMBNAIL_DEFAULT_SIZE, file_path)
+                f.encoded_thumbnail_src = urlquote(src)
 
     ctx = {
         'repo': repo,
@@ -487,7 +489,8 @@ def list_lib_dir(request, repo_id):
             if file_type == IMAGE:
                 f.is_img = True
                 if os.path.exists(os.path.join(THUMBNAIL_ROOT, str(size), f.obj_id)):
-                    f.thumbnail_src = get_thumbnail_src(repo_id, size, file_path)
+                    src = get_thumbnail_src(repo_id, size, file_path)
+                    f.encoded_thumbnail_src = urlquote(src)
 
     for f in file_list:
         f_ = {}
@@ -502,8 +505,8 @@ def list_lib_dir(request, repo_id):
         f_['perm'] = f.permission # perm for file in current dir
         if f.is_img:
             f_['is_img'] = f.is_img
-        if f.thumbnail_src:
-            f_['thumbnail_src'] = f.thumbnail_src
+        if f.encoded_thumbnail_src:
+            f_['encoded_thumbnail_src'] = f.encoded_thumbnail_src
         dirent_list.append(f_)
 
     result["dirent_list"] = dirent_list
diff --git a/seahub/views/repo.py b/seahub/views/repo.py
index 1c8fcfe35d..80340ca9b4 100644
--- a/seahub/views/repo.py
+++ b/seahub/views/repo.py
@@ -11,6 +11,7 @@ from django.shortcuts import render_to_response
 from django.template import RequestContext
 from django.template.loader import render_to_string
 from django.utils.translation import ugettext as _
+from django.utils.http import urlquote
 
 import seaserv
 from seaserv import seafile_api
@@ -246,7 +247,8 @@ def render_repo(request, repo):
         if allow_generate_thumbnail(request, repo.id, file_path):
              f.allow_generate_thumbnail = True
              if os.path.exists(os.path.join(THUMBNAIL_ROOT, str(THUMBNAIL_DEFAULT_SIZE), f.obj_id)):
-                f.thumbnail_src = get_thumbnail_src(repo.id, THUMBNAIL_DEFAULT_SIZE, file_path)
+                src = get_thumbnail_src(repo.id, THUMBNAIL_DEFAULT_SIZE, file_path)
+                f.encoded_thumbnail_src = urlquote(src)
 
     return render_to_response('repo.html', {
             'repo': repo,
@@ -483,7 +485,8 @@ def view_shared_dir(request, token):
              f.allow_generate_thumbnail = True
              if os.path.exists(os.path.join(THUMBNAIL_ROOT, str(THUMBNAIL_DEFAULT_SIZE), f.obj_id)):
                 req_image_path = posixpath.join(req_path, f.obj_name)
-                f.thumbnail_src = get_share_link_thumbnail_src(token, THUMBNAIL_DEFAULT_SIZE, req_image_path)
+                src = get_share_link_thumbnail_src(token, THUMBNAIL_DEFAULT_SIZE, req_image_path)
+                f.encoded_thumbnail_src = urlquote(src)
 
     return render_to_response('view_shared_dir.html', {
             'repo': repo,
diff --git a/static/scripts/app/views/dir.js b/static/scripts/app/views/dir.js
index a17974af90..acd43921c9 100644
--- a/static/scripts/app/views/dir.js
+++ b/static/scripts/app/views/dir.js
@@ -193,7 +193,7 @@ define([
             getImageThumbnail: function() {
                 var images_with_no_thumbnail = this.dir.filter(function(dirent) {
                     // 'dirent' is a model
-                    return dirent.get('is_img') && !dirent.get('thumbnail_src');
+                    return dirent.get('is_img') && !dirent.get('encoded_thumbnail_src');
                 });
                 if (images_with_no_thumbnail.length == 0) {
                     return ;
@@ -213,7 +213,7 @@ define([
                         dataType: 'json',
                         success: function(data) {
                             cur_img.set({
-                                'thumbnail_src': data.thumbnail_src
+                                'encoded_thumbnail_src': data.encoded_thumbnail_src
                             });
                         },
                         complete: function() {