--- loncom/homework/grades.pm	2013/12/20 17:18:42	1.710
+++ loncom/homework/grades.pm	2014/02/11 14:29:10	1.720
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # The LON-CAPA Grading handler
 #
-# $Id: grades.pm,v 1.710 2013/12/20 17:18:42 bisitz Exp $
+# $Id: grades.pm,v 1.720 2014/02/11 14:29:10 kruse Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -330,6 +330,8 @@ sub cleanRecord {
     my $grayFont = '<span class="LC_internal_info">';
     if ($response =~ /^(option|rank)$/) {
 	my %answer=&Apache::lonnet::str2hash($answer);
+        my @answer = %answer;
+        %answer = map {&HTML::Entities::encode($_, '"<>&')}  @answer;
 	my %grading=&Apache::lonnet::str2hash($record->{$version."resource.$partid.$respid.submissiongrading"});
 	my ($toprow,$bottomrow);
 	foreach my $foil (@$order) {
@@ -346,6 +348,8 @@ sub cleanRecord {
 	    $bottomrow.'</tr></table></blockquote>';
     } elsif ($response eq 'match') {
 	my %answer=&Apache::lonnet::str2hash($answer);
+        my @answer = %answer;
+        %answer = map {&HTML::Entities::encode($_, '"<>&')}  @answer;
 	my %grading=&Apache::lonnet::str2hash($record->{$version."resource.$partid.$respid.submissiongrading"});
 	my @items=&Apache::lonnet::str2array($record->{$version."resource.$partid.$respid.submissionitems"});
 	my ($toprow,$middlerow,$bottomrow);
@@ -368,6 +372,8 @@ sub cleanRecord {
 	    $bottomrow.'</tr></table></blockquote>';
     } elsif ($response eq 'radiobutton') {
 	my %answer=&Apache::lonnet::str2hash($answer);
+        my @answer = %answer;
+        %answer = map {&HTML::Entities::encode($_, '"<>&')}  @answer;
 	my ($toprow,$bottomrow);
 	my $correct = 
 	    &get_radiobutton_correct_foil($partid,$respid,$symb,$uname,$udom,$type,$trial,$rndseed);
@@ -401,9 +407,10 @@ sub cleanRecord {
 	    $env{'form.'.$symb} = 1; # so that we don't have to read it from disk for multiple sub of the same prob.
 	}
 	$answer =~ s-\n-<br />-g;
-	return '<br /><br /><blockquote><tt>'.&keywords_highlight($answer).'</tt></blockquote>';
+	return '<br /><br /><blockquote><tt>'.&keywords_highlight(&HTML::Entities::encode($answer, '"<>&')).'</tt></blockquote>';
+
     } elsif ( $response eq 'organic') {
-	my $result='Smile representation: "<tt>'.$answer.'</tt>"';
+	my $result='Smile representation: "<tt>'.HTML::Entities::encode($answer, '"<>&').'</tt>"';
 	my $jme=$record->{$version."resource.$partid.$respid.molecule"};
 	$result.=&Apache::chemresponse::jme_img($jme,$answer,400);
 	return $result;
@@ -437,12 +444,14 @@ sub cleanRecord {
 	    $result.='</ul>';
 	    return $result;
 	}
-    } elsif ( $response =~ m/(?:numerical|formula)/) {
+    } elsif ( $response =~ m/(?:numerical|formula|custom)/) {
+        # Respect multiple input fields, see Bug #5409
 	$answer = 
 	    &Apache::loncommon::format_previous_attempt_value('submission',
 							      $answer);
+	return $answer;
     }
-    return $answer;
+    return &HTML::Entities::encode($answer, '"<>&');
 }
 
 #-- A couple of common js functions
@@ -1431,6 +1440,15 @@ INNERJS
                 txtc => 'Text Color',
                 font => 'Font Size',
                 fnst => 'Font Style',
+                col1 => 'red',
+                col2 => 'green',
+                col3 => 'blue',
+                siz1 => 'normal',
+                siz2 => '+1',
+                siz3 => '+2',
+                sty1 => 'normal',
+                sty2 => 'italic',
+                sty3 => 'bold',
              );
     $request->print(&Apache::lonhtmlcommon::scripttag(<<SUBJAVASCRIPT));
 
@@ -1594,25 +1612,34 @@ INNERJS
     var redsel = "";
     var grnsel = "";
     var blusel = "";
-    if (kwclr=="red")   {var redsel="checked"};
-    if (kwclr=="green") {var grnsel="checked"};
-    if (kwclr=="blue")  {var blusel="checked"};
+    var txtcol1 = "$lt{'col1'}";
+    var txtcol2 = "$lt{'col2'}";
+    var txtcol3 = "$lt{'col3'}";
+    var txtsiz1 = "$lt{'siz1'}";
+    var txtsiz2 = "$lt{'siz2'}";
+    var txtsiz3 = "$lt{'siz3'}";
+    var txtsty1 = "$lt{'sty1'}";
+    var txtsty2 = "$lt{'sty2'}";
+    var txtsty3 = "$lt{'sty3'}";
+    if (kwclr=="red")   {var redsel="checked='checked'"};
+    if (kwclr=="green") {var grnsel="checked='checked'"};
+    if (kwclr=="blue")  {var blusel="checked='checked'"};
     var sznsel = "";
     var sz1sel = "";
     var sz2sel = "";
-    if (kwsize=="0")  {var sznsel="checked"};
-    if (kwsize=="+1") {var sz1sel="checked"};
-    if (kwsize=="+2") {var sz2sel="checked"};
+    if (kwsize=="0")  {var sznsel="checked='checked'"};
+    if (kwsize=="+1") {var sz1sel="checked='checked'"};
+    if (kwsize=="+2") {var sz2sel="checked='checked'"};
     var synsel = "";
     var syisel = "";
     var sybsel = "";
-    if (kwstyle=="")    {var synsel="checked"};
-    if (kwstyle=="<i>") {var syisel="checked"};
-    if (kwstyle=="<b>") {var sybsel="checked"};
+    if (kwstyle=="")    {var synsel="checked='checked'"};
+    if (kwstyle=="<i>") {var syisel="checked='checked'"};
+    if (kwstyle=="<b>") {var sybsel="checked='checked'"};
     highlightCentral();
-    highlightbody('red','red',redsel,'0','normal',sznsel,'','normal',synsel);
-    highlightbody('green','green',grnsel,'+1','+1',sz1sel,'<i>','italic',syisel);
-    highlightbody('blue','blue',blusel,'+2','+2',sz2sel,'<b>','bold',sybsel);
+    highlightbody('red',txtcol1,redsel,'0',txtsiz1,sznsel,'',txtsty1,synsel);
+    highlightbody('green',txtcol2,grnsel,'+1',txtsiz2,sz1sel,'<i>',txtsty2,syisel);
+    highlightbody('blue',txtcol3,blusel,'+2',txtsiz3,sz2sel,'<b>',txtsty3,sybsel);
     highlightend();
     return;
   }
@@ -1630,31 +1657,29 @@ INNERJS
     hDoc.$docopen;
     hDoc.write('$start_page_highlight_central');
     hDoc.write("<form action=\\"inactive\\" name=\\"hlCenter\\">");
-    hDoc.write("<h3><span class=\\"LC_info\\">&nbsp;$lt{'kehi'}<\\/span><\\/h3><br /><br />");
+    hDoc.write("<h1>$lt{'kehi'}<\\/h1>");
 
-    hDoc.write('<table border="0" width="100%"><tr><td bgcolor="#777777">');
-    hDoc.write('<table border="0" width="100%"><tr bgcolor="#DDFFFF">');
-    hDoc.write("<td><b>$lt{'txtc'}<\\/b><\\/td><td><b>$lt{'font'}<\\/b><\\/td><td><b>$lt{'fnst'}<\\/td><\\/tr>");
+    hDoc.write('<table border="0" width="100%"><tr style="background-color:#A1D676">');
+    hDoc.write("<th>$lt{'txtc'}<\\/th><th>$lt{'font'}<\\/th><th>$lt{'fnst'}<\\/th><\\/tr>");
   }
 
   function highlightbody(clrval,clrtxt,clrsel,szval,sztxt,szsel,syval,sytxt,sysel) { 
     var hDoc = hwdWin.document;
-    hDoc.write("<tr bgcolor=\\"#ffffdd\\">");
+    hDoc.write("<tr>");
     hDoc.write("<td align=\\"left\\">");
-    hDoc.write("<input name=\\"kwdclr\\" type=\\"radio\\" value=\\""+clrval+"\\" "+clrsel+">&nbsp;"+clrtxt+"<\\/td>");
+    hDoc.write("<input name=\\"kwdclr\\" type=\\"radio\\" value=\\""+clrval+"\\" "+clrsel+" \\/>&nbsp;"+clrtxt+"<\\/td>");
     hDoc.write("<td align=\\"left\\">");
-    hDoc.write("<input name=\\"kwdsize\\" type=\\"radio\\" value=\\""+szval+"\\" "+szsel+">&nbsp;"+sztxt+"<\\/td>");
+    hDoc.write("<input name=\\"kwdsize\\" type=\\"radio\\" value=\\""+szval+"\\" "+szsel+" \\/>&nbsp;"+sztxt+"<\\/td>");
     hDoc.write("<td align=\\"left\\">");
-    hDoc.write("<input name=\\"kwdstyle\\" type=\\"radio\\" value=\\""+syval+"\\" "+sysel+">&nbsp;"+sytxt+"<\\/td>");
+    hDoc.write("<input name=\\"kwdstyle\\" type=\\"radio\\" value=\\""+syval+"\\" "+sysel+" \\/>&nbsp;"+sytxt+"<\\/td>");
     hDoc.write("<\\/tr>");
   }
 
   function highlightend() { 
     var hDoc = hwdWin.document;
-    hDoc.write("<\\/table>");
-    hDoc.write("<\\/td><\\/tr><\\/table>&nbsp;");
-    hDoc.write("<input type=\\"button\\" value=\\"$lt{'save'}\\" onclick=\\"javascript:updateChoice(1)\\">&nbsp;&nbsp;");
-    hDoc.write("<input type=\\"button\\" value=\\"$lt{'canc'}\\" onclick=\\"self.close()\\"><br /><br />");
+    hDoc.write("<\\/table><br \\/>");
+    hDoc.write("<input type=\\"button\\" value=\\"$lt{'save'}\\" onclick=\\"javascript:updateChoice(1)\\" \\/>&nbsp;&nbsp;");
+    hDoc.write("<input type=\\"button\\" value=\\"$lt{'canc'}\\" onclick=\\"self.close()\\" \\/><br /><br />");
     hDoc.write("<\\/form>");
     hDoc.write('$end_page_highlight_central');
     hDoc.close();
@@ -1942,9 +1967,12 @@ sub submission {
     if ($symb eq '') { $request->print("Unable to handle ambiguous references:."); return ''; }
 
     if (!&canview($usec)) {
-	$request->print('<span class="LC_warning">Unable to view requested student.('.
-			$uname.':'.$udom.' in section '.$usec.' in course id '.
-			$env{'request.course.id'}.')</span>');
+        $request->print(
+            '<span class="LC_warning">'.
+            &mt('Unable to view requested student.').
+            ' '.&mt('([_1] in section [_2] in course id [_3])',
+                        $uname.':'.$udom,$usec,$env{'request.course.id'}).
+            '</span>');
 	return;
     }
 
@@ -2041,6 +2069,7 @@ sub submission {
         if (1) {
 
             my %lt = &Apache::lonlocal::texthash(
+                          keyh => 'Keyword Highlighting for Essays',
                           keyw => 'Keyword Options',
                           list => 'List',
                           past => 'Paste Selection to List',
@@ -2049,13 +2078,18 @@ sub submission {
 #
 # Print out the keyword options line
 #
-	    $request->print(<<KEYWORDS);
-<br /><b>$lt{'keyw'}:</b>&nbsp;
-<a href="javascript:keywords(document.SCORE);" target="_self">$lt{'list'}</a>&nbsp; &nbsp;
-<a href="#" onmousedown="javascript:getSel(); return false"
- class="page">$lt{'past'}</a>&nbsp; &nbsp;
-<a href="javascript:kwhighlight();" target="_self">$lt{'high'}</a><br /><br />
-KEYWORDS
+	    $request->print(
+                '<div class="LC_columnSection">'
+               .'<fieldset><legend>'.$lt{'keyh'}.'</legend>'
+               .&Apache::lonhtmlcommon::funclist_from_array(
+                    ['<a href="javascript:keywords(document.SCORE);" target="_self">'.$lt{'list'}.'</a>',
+                     '<a href="#" onmousedown="javascript:getSel(); return false"
+ class="page">'.$lt{'past'}.'</a>',
+                     '<a href="javascript:kwhighlight();" target="_self">'.$lt{'high'}.'</a>'],
+                    {legend => $lt{'keyw'}})
+               .'</fieldset></div>'
+            );
+
 #
 # Load the other essays for similarity check
 #
@@ -2276,6 +2310,7 @@ KEYWORDS
     if ($env{'form.lastSub'} eq 'datesub') {
         my ($parts,$handgrade,$responseType) = &response_type($symb,\$res_error);
 	$request->print(&displaySubByDates($symb,\%record,$parts,$responseType,$checkIcon,$uname,$udom));
+  
     } 
     if ($env{'form.lastSub'} =~ /^(last|all)$/) {
         $request->print(&Apache::loncommon::get_previous_attempt($symb,$uname,$udom,
@@ -2510,8 +2545,11 @@ sub get_last_submission {
             }
 	    my ($partid,$foo) = split(/submission$/,$key);
 	    my $draft  = $lasthash{$partid.'awarddetail'} eq 'DRAFT' ?
-		'<span class="LC_warning">Draft Copy</span> ' : '';
-	    push(@string, join(':', $key, $hide, $draft.$lasthash{$key}));
+		'<span class="LC_warning">'.&mt('Draft Copy').'</span> ' : '';
+	    #push(@string, join(':', $key, $hide, $draft.$lasthash{$key}));
+            push(@string, join(':', $key, $hide, $draft.(
+                ref($lasthash{$key}) eq 'ARRAY' ?
+                    join(',', @{$lasthash{$key}}) : $lasthash{$key}) ));
 	}
     }
     if (!@string) {
@@ -2539,16 +2577,21 @@ sub keywords_highlight {
 sub show_previous_task_version {
     my ($request,$symb) = @_;
     if ($symb eq '') {
-        $request->print("Unable to handle ambiguous references.");
-
+        $request->print(
+            '<span class="LC_error">'.
+            &mt('Unable to handle ambiguous references.').
+            '</span>');
         return '';
     }
     my ($uname,$udom) = ($env{'form.student'},$env{'form.userdom'});
     my $usec = &Apache::lonnet::getsection($udom,$uname,$env{'request.course.id'});
     if (!&canview($usec)) {
-        $request->print('<span class="LC_warning">Unable to view previous version for requested student.('.
-                        $uname.':'.$udom.' in section '.$usec.' in course id '.
-                        $env{'request.course.id'}.')</span>');
+        $request->print(
+            '<span class="LC_warning">'.
+            &mt('Unable to view previous version for requested student.').
+            ' '.&mt('([_1] in section [_2] in course id [_3])',
+                    $uname.':'.$udom,$usec,$env{'request.course.id'}).
+            '</span>');
         return;
     }
     my $mode = 'both';
@@ -4613,8 +4656,12 @@ sub displayPage {
     &Apache::lonnet::clear_EXT_cache_status();
 
     if (!&canview($usec)) {
-	$request->print('<span class="LC_warning">'.&mt('Unable to view requested student. ([_1])',$env{'form.student'}).'</span>');
-	return;
+        $request->print(
+            '<span class="LC_warning">'.
+            &mt('Unable to view requested student. ([_1])',
+                    $env{'form.student'}).
+            '</span>');
+        return;
     }
     my $result='<h3><span class="LC_info">&nbsp;'.$env{'form.title'}.'</span></h3>';
     $result.='<h3>&nbsp;'.&mt('Student: [_1]',&nameUserString(undef,$$fullname{$env{'form.student'}},$uname,$udom)).
@@ -5585,7 +5632,7 @@ sub scantron_selectphase {
 
 =item get_scantron_config
 
-   Parse and return the scantron configuration line selected as a
+   Parse and return the bubblesheet configuration line selected as a
    hash of configuration file fields.
 
  Arguments:
@@ -5869,12 +5916,12 @@ sub digits_to_letters {
 
 =item scantron_parse_scanline
 
-  Decodes a scanline from the selected scantron file
+  Decodes a scanline from the selected bubblesheet file
 
  Arguments:
-    line             - The text of the scantron file line to process
+    line             - The text of the bubblesheet file line to process
     whichline        - Line number
-    scantron_config  - Hash describing the format of the scantron lines.
+    scantron_config  - Hash describing the format of the bubblesheet lines.
     scan_data        - Hash of extra information about the scanline
                        (see scantron_getfile for more information)
     just_header      - True if should not process question answers but only
@@ -7579,7 +7626,7 @@ sub prompt_for_corrections {
             }
         } else {
             $responsenum = $question-1;
-            $first = $first_bubble_line{$responsenum} + 1;
+            $first = $first_bubble_line{$responsenum};
         }
         $current_line = $first + 1 ;
         my @subans = split(/,/,$subdivided_bubble_lines{$responsenum});
@@ -8863,7 +8910,7 @@ sub scantron_download_scantron_data {
     &Apache::lonnet::allowuploaded('/adm/grades',$skipped);
     $r->print('
     <p>
-	'.&mt('[_1]Original[_2] file as uploaded by the scantron office.',
+	'.&mt('[_1]Original[_2] file as uploaded by the bubblesheet office.',
 	      '<a href="'.$orig.'">','</a>').'
     </p>
     <p>
@@ -10352,7 +10399,7 @@ described at http://www.lon-capa.org.
 =head1 OVERVIEW
 
 Do an ssi with retries:
-While I'd love to factor out this with the vesrion in lonprintout,
+While I'd love to factor out this with the version in lonprintout,
 that would either require a data coupling between modules, which I refuse to perpetuate (there's quite enough of that already), or would require the invention of another infrastructure
 I'm not quite ready to invent (e.g. an ssi_with_retry object).
 
@@ -10363,11 +10410,11 @@ At least the logic that drives this has
 ssi_with_retries - Does the server side include of a resource.
                      if the ssi call returns an error we'll retry it up to
                      the number of times requested by the caller.
-                     If we still have a proble, no text is appended to the
+                     If we still have a problem, no text is appended to the
                      output and we set some global variables.
                      to indicate to the caller an SSI error occurred.  
                      All of this is supposed to deal with the issues described
-                     in LonCAPA BZ 5631 see:
+                     in LON-CAPA BZ 5631 see:
                      http://bugs.lon-capa.org/show_bug.cgi?id=5631
                      by informing the user that this happened.