diff --git a/NOTES.md b/NOTES.md
index 317f95e3648abc060083ce61250a3742b72f57f9..f3dccc818aee6284d7c74fe75ab019a7fb728d5c 100644
--- a/NOTES.md
+++ b/NOTES.md
@@ -24,8 +24,11 @@ sqlite trigger tracing: `.trace stdout --row --profile --stmt --expanded --plain
 ## Things to do
 
   * Implement each command.
-    * Next: folder commands - ~~CREATE~~, ~~REMOVE~~, MODIFY, INDEX, SELECT
-    * Messages: ADD, CURRENT, DIRECTORY
+    * Next: folder commands - ~~CREATE~~, ~~REMOVE~~, MODIFY, ~~INDEX~~, SELECT
+    * Messages: ADD, CURRENT, DIRECTORY, BACK, CHANGE, FIRST, REMOVE, NEXT, READ
+    * Messages edit: CHANGE, REPLY, FORWARD
+    * Moving messages: COPY, MOVE
+    * Mail: MAIL, FORWARD, 
   * Editor - need an embedded editor
     * An EDT inspired [editor](https://sourceforge.net/projects/edt-text-editor/)
     * [gkilo](https://github.com/vcnovaes/gkilo)
diff --git a/folders/folders.go b/folders/folders.go
index bfafdd21806ff73a81b141a33327fd86d0001953..04b69a13ca5d24aefecbe0dfa7284dc2689dbc09 100644
--- a/folders/folders.go
+++ b/folders/folders.go
@@ -102,19 +102,32 @@ func (s *Store) ListFolder(user string, _ FolderListOptions) ([]FolderListRow, e
 	return flr, nil
 }
 
+// IsFolderAccess checks if a user can access a folder.
+func (s *Store) IsFolderAccess(name, user string) bool {
+	found := 0
+	s.db.Get(&found,
+		`SELECT 1 FROM folders AS f LEFT JOIN co_owners AS c ON f.name = c.folder
+		   WHERE f.name = $1 AND
+			       (f.visibility = "public"
+						  OR (f.owner = $2 OR c.OWNER = $2))`,
+		name, user)
+	return found == 1
+}
+
 // IsFolderOwner checks if a user is a folder owner.
 func (s *Store) IsFolderOwner(name, user string) bool {
 	found := 0
 	s.db.Get(&found,
 		`SELECT 1 FROM folders AS f LEFT JOIN co_owners AS c
 	   ON f.name = c.folder
-		 WHERE f.name = $1 (f.owner = '$2' OR c.OWNER = '$2')`,
+		 WHERE f.name = $1 AND (f.owner = '$2' OR c.OWNER = '$2')`,
 		name, user)
 	return found == 1
 }
 
 // DeleteFolder creates a new folder.
 func (s *Store) DeleteFolder(name string) error {
+	// TODO: make sure user can delete this table.
 	results, err := s.db.Exec("DELETE FROM folders WHERE name=$1", name)
 	// TODO: process this error a bit more to give a better error message.
 	if err != nil {
diff --git a/repl/folders.go b/repl/folders.go
index bfa3bdfb11bed7761f75b581f054cd80892622d4..2d9351f2bb65560b167fb1a9574becb64c1a1ee2 100644
--- a/repl/folders.go
+++ b/repl/folders.go
@@ -82,7 +82,9 @@ func ActionCreate(cmd *dclish.Command) error {
 
 // ActionSelect handles the `SELECT` command.  This selects a folder.
 func ActionSelect(cmd *dclish.Command) error {
-	fmt.Printf("TODO: implement SELECT:\n%s\n\n", cmd.Description)
+	if accounts.User.Folders.IsFolderAccess(cmd.Args[0], accounts.User.Login) {
+		accounts.User.CurrentFolder = cmd.Args[0]
+	}
 	return nil
 }