diff --git a/src/includes/common.php b/src/includes/common.php
index fab3b26..a753047 100644
--- a/src/includes/common.php
+++ b/src/includes/common.php
@@ -80,6 +80,21 @@ function formatDate3($format, $ay, $am, $ad, $lang)
 	return strtr($format, array('Y'=>$Y, 'y'=>$y, 'F'=>$F, 'M'=>$M, 'n'=>$n, 'm'=>$m, 'd'=>$d, 'j'=>$j));
 }
 
+function getRequestUri()
+{
+	// Do not use HTTP_X_REWRITE_URL due to CVE-2018-14773
+	// SCRIPT_NAME or PATH_INFO ?
+	if (isset($_SERVER['REQUEST_URI'])) {
+		return $_SERVER['REQUEST_URI'];
+	}
+	else if (isset($_SERVER['ORIG_PATH_INFO']))  // IIS 5.0 CGI
+	{
+		$uri = $_SERVER['ORIG_PATH_INFO']; //has no query
+		if (!empty($_SERVER['QUERY_STRING'])) $uri .= '?'. $_SERVER['QUERY_STRING'];
+		return $uri;
+	}
+}
+
 function url_dir($url, $onlyPath = 1)
 {
 	if (false !== $p = strpos($url, '?')) {
diff --git a/src/init.php b/src/init.php
index 0116190..e101c8e 100644
--- a/src/init.php
+++ b/src/init.php
@@ -266,21 +266,6 @@ function reset_mttinfo($key)
 	unset( $_mttinfo[$key] );
 }
 
-function getRequestUri()
-{
-	// Do not use HTTP_X_REWRITE_URL due to CVE-2018-14773
-	// SCRIPT_NAME or PATH_INFO ?
-	if (isset($_SERVER['REQUEST_URI'])) {
-		return $_SERVER['REQUEST_URI'];
-	}
-	else if (isset($_SERVER['ORIG_PATH_INFO']))  // IIS 5.0 CGI
-	{
-		$uri = $_SERVER['ORIG_PATH_INFO']; //has no query
-		if (!empty($_SERVER['QUERY_STRING'])) $uri .= '?'. $_SERVER['QUERY_STRING'];
-		return $uri;
-	}
-}
-
 function jsonExit($data)
 {
 	header('Content-type: application/json; charset=utf-8');
diff --git a/src/setup.php b/src/setup.php
index 617f972..8718290 100644
--- a/src/setup.php
+++ b/src/setup.php
@@ -172,7 +172,7 @@ else
 	}
 }
 
-echo "Done<br><br> <b>Attention!</b> Delete this file for security reasons. <br><br> Go to <a href='index.php'>homepage</a>.";
+echo "Done<br><br> <b>Attention!</b> Delete this file for security reasons. <br><br> Go to <a href='". htmlspecialchars(url_dir(getRequestUri())). "'>homepage</a>.";
 printFooter();