--- loncom/homework/grades.pm	2014/01/14 17:49:30	1.711
+++ loncom/homework/grades.pm	2014/02/11 14:29:10	1.720
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # The LON-CAPA Grading handler
 #
-# $Id: grades.pm,v 1.711 2014/01/14 17:49:30 bisitz Exp $
+# $Id: grades.pm,v 1.720 2014/02/11 14:29:10 kruse Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -330,6 +330,8 @@ sub cleanRecord {
     my $grayFont = '<span class="LC_internal_info">';
     if ($response =~ /^(option|rank)$/) {
 	my %answer=&Apache::lonnet::str2hash($answer);
+        my @answer = %answer;
+        %answer = map {&HTML::Entities::encode($_, '"<>&')}  @answer;
 	my %grading=&Apache::lonnet::str2hash($record->{$version."resource.$partid.$respid.submissiongrading"});
 	my ($toprow,$bottomrow);
 	foreach my $foil (@$order) {
@@ -346,6 +348,8 @@ sub cleanRecord {
 	    $bottomrow.'</tr></table></blockquote>';
     } elsif ($response eq 'match') {
 	my %answer=&Apache::lonnet::str2hash($answer);
+        my @answer = %answer;
+        %answer = map {&HTML::Entities::encode($_, '"<>&')}  @answer;
 	my %grading=&Apache::lonnet::str2hash($record->{$version."resource.$partid.$respid.submissiongrading"});
 	my @items=&Apache::lonnet::str2array($record->{$version."resource.$partid.$respid.submissionitems"});
 	my ($toprow,$middlerow,$bottomrow);
@@ -368,6 +372,8 @@ sub cleanRecord {
 	    $bottomrow.'</tr></table></blockquote>';
     } elsif ($response eq 'radiobutton') {
 	my %answer=&Apache::lonnet::str2hash($answer);
+        my @answer = %answer;
+        %answer = map {&HTML::Entities::encode($_, '"<>&')}  @answer;
 	my ($toprow,$bottomrow);
 	my $correct = 
 	    &get_radiobutton_correct_foil($partid,$respid,$symb,$uname,$udom,$type,$trial,$rndseed);
@@ -401,9 +407,10 @@ sub cleanRecord {
 	    $env{'form.'.$symb} = 1; # so that we don't have to read it from disk for multiple sub of the same prob.
 	}
 	$answer =~ s-\n-<br />-g;
-	return '<br /><br /><blockquote><tt>'.&keywords_highlight($answer).'</tt></blockquote>';
+	return '<br /><br /><blockquote><tt>'.&keywords_highlight(&HTML::Entities::encode($answer, '"<>&')).'</tt></blockquote>';
+
     } elsif ( $response eq 'organic') {
-	my $result='Smile representation: "<tt>'.$answer.'</tt>"';
+	my $result='Smile representation: "<tt>'.HTML::Entities::encode($answer, '"<>&').'</tt>"';
 	my $jme=$record->{$version."resource.$partid.$respid.molecule"};
 	$result.=&Apache::chemresponse::jme_img($jme,$answer,400);
 	return $result;
@@ -437,12 +444,14 @@ sub cleanRecord {
 	    $result.='</ul>';
 	    return $result;
 	}
-    } elsif ( $response =~ m/(?:numerical|formula)/) {
+    } elsif ( $response =~ m/(?:numerical|formula|custom)/) {
+        # Respect multiple input fields, see Bug #5409
 	$answer = 
 	    &Apache::loncommon::format_previous_attempt_value('submission',
 							      $answer);
+	return $answer;
     }
-    return $answer;
+    return &HTML::Entities::encode($answer, '"<>&');
 }
 
 #-- A couple of common js functions
@@ -1431,6 +1440,15 @@ INNERJS
                 txtc => 'Text Color',
                 font => 'Font Size',
                 fnst => 'Font Style',
+                col1 => 'red',
+                col2 => 'green',
+                col3 => 'blue',
+                siz1 => 'normal',
+                siz2 => '+1',
+                siz3 => '+2',
+                sty1 => 'normal',
+                sty2 => 'italic',
+                sty3 => 'bold',
              );
     $request->print(&Apache::lonhtmlcommon::scripttag(<<SUBJAVASCRIPT));
 
@@ -1594,25 +1612,34 @@ INNERJS
     var redsel = "";
     var grnsel = "";
     var blusel = "";
-    if (kwclr=="red")   {var redsel="checked"};
-    if (kwclr=="green") {var grnsel="checked"};
-    if (kwclr=="blue")  {var blusel="checked"};
+    var txtcol1 = "$lt{'col1'}";
+    var txtcol2 = "$lt{'col2'}";
+    var txtcol3 = "$lt{'col3'}";
+    var txtsiz1 = "$lt{'siz1'}";
+    var txtsiz2 = "$lt{'siz2'}";
+    var txtsiz3 = "$lt{'siz3'}";
+    var txtsty1 = "$lt{'sty1'}";
+    var txtsty2 = "$lt{'sty2'}";
+    var txtsty3 = "$lt{'sty3'}";
+    if (kwclr=="red")   {var redsel="checked='checked'"};
+    if (kwclr=="green") {var grnsel="checked='checked'"};
+    if (kwclr=="blue")  {var blusel="checked='checked'"};
     var sznsel = "";
     var sz1sel = "";
     var sz2sel = "";
-    if (kwsize=="0")  {var sznsel="checked"};
-    if (kwsize=="+1") {var sz1sel="checked"};
-    if (kwsize=="+2") {var sz2sel="checked"};
+    if (kwsize=="0")  {var sznsel="checked='checked'"};
+    if (kwsize=="+1") {var sz1sel="checked='checked'"};
+    if (kwsize=="+2") {var sz2sel="checked='checked'"};
     var synsel = "";
     var syisel = "";
     var sybsel = "";
-    if (kwstyle=="")    {var synsel="checked"};
-    if (kwstyle=="<i>") {var syisel="checked"};
-    if (kwstyle=="<b>") {var sybsel="checked"};
+    if (kwstyle=="")    {var synsel="checked='checked'"};
+    if (kwstyle=="<i>") {var syisel="checked='checked'"};
+    if (kwstyle=="<b>") {var sybsel="checked='checked'"};
     highlightCentral();
-    highlightbody('red','red',redsel,'0','normal',sznsel,'','normal',synsel);
-    highlightbody('green','green',grnsel,'+1','+1',sz1sel,'<i>','italic',syisel);
-    highlightbody('blue','blue',blusel,'+2','+2',sz2sel,'<b>','bold',sybsel);
+    highlightbody('red',txtcol1,redsel,'0',txtsiz1,sznsel,'',txtsty1,synsel);
+    highlightbody('green',txtcol2,grnsel,'+1',txtsiz2,sz1sel,'<i>',txtsty2,syisel);
+    highlightbody('blue',txtcol3,blusel,'+2',txtsiz3,sz2sel,'<b>',txtsty3,sybsel);
     highlightend();
     return;
   }
@@ -1630,31 +1657,29 @@ INNERJS
     hDoc.$docopen;
     hDoc.write('$start_page_highlight_central');
     hDoc.write("<form action=\\"inactive\\" name=\\"hlCenter\\">");
-    hDoc.write("<h3><span class=\\"LC_info\\">&nbsp;$lt{'kehi'}<\\/span><\\/h3><br /><br />");
+    hDoc.write("<h1>$lt{'kehi'}<\\/h1>");
 
-    hDoc.write('<table border="0" width="100%"><tr><td bgcolor="#777777">');
-    hDoc.write('<table border="0" width="100%"><tr bgcolor="#DDFFFF">');
-    hDoc.write("<td><b>$lt{'txtc'}<\\/b><\\/td><td><b>$lt{'font'}<\\/b><\\/td><td><b>$lt{'fnst'}<\\/td><\\/tr>");
+    hDoc.write('<table border="0" width="100%"><tr style="background-color:#A1D676">');
+    hDoc.write("<th>$lt{'txtc'}<\\/th><th>$lt{'font'}<\\/th><th>$lt{'fnst'}<\\/th><\\/tr>");
   }
 
   function highlightbody(clrval,clrtxt,clrsel,szval,sztxt,szsel,syval,sytxt,sysel) { 
     var hDoc = hwdWin.document;
-    hDoc.write("<tr bgcolor=\\"#ffffdd\\">");
+    hDoc.write("<tr>");
     hDoc.write("<td align=\\"left\\">");
-    hDoc.write("<input name=\\"kwdclr\\" type=\\"radio\\" value=\\""+clrval+"\\" "+clrsel+">&nbsp;"+clrtxt+"<\\/td>");
+    hDoc.write("<input name=\\"kwdclr\\" type=\\"radio\\" value=\\""+clrval+"\\" "+clrsel+" \\/>&nbsp;"+clrtxt+"<\\/td>");
     hDoc.write("<td align=\\"left\\">");
-    hDoc.write("<input name=\\"kwdsize\\" type=\\"radio\\" value=\\""+szval+"\\" "+szsel+">&nbsp;"+sztxt+"<\\/td>");
+    hDoc.write("<input name=\\"kwdsize\\" type=\\"radio\\" value=\\""+szval+"\\" "+szsel+" \\/>&nbsp;"+sztxt+"<\\/td>");
     hDoc.write("<td align=\\"left\\">");
-    hDoc.write("<input name=\\"kwdstyle\\" type=\\"radio\\" value=\\""+syval+"\\" "+sysel+">&nbsp;"+sytxt+"<\\/td>");
+    hDoc.write("<input name=\\"kwdstyle\\" type=\\"radio\\" value=\\""+syval+"\\" "+sysel+" \\/>&nbsp;"+sytxt+"<\\/td>");
     hDoc.write("<\\/tr>");
   }
 
   function highlightend() { 
     var hDoc = hwdWin.document;
-    hDoc.write("<\\/table>");
-    hDoc.write("<\\/td><\\/tr><\\/table>&nbsp;");
-    hDoc.write("<input type=\\"button\\" value=\\"$lt{'save'}\\" onclick=\\"javascript:updateChoice(1)\\">&nbsp;&nbsp;");
-    hDoc.write("<input type=\\"button\\" value=\\"$lt{'canc'}\\" onclick=\\"self.close()\\"><br /><br />");
+    hDoc.write("<\\/table><br \\/>");
+    hDoc.write("<input type=\\"button\\" value=\\"$lt{'save'}\\" onclick=\\"javascript:updateChoice(1)\\" \\/>&nbsp;&nbsp;");
+    hDoc.write("<input type=\\"button\\" value=\\"$lt{'canc'}\\" onclick=\\"self.close()\\" \\/><br /><br />");
     hDoc.write("<\\/form>");
     hDoc.write('$end_page_highlight_central');
     hDoc.close();
@@ -1942,9 +1967,12 @@ sub submission {
     if ($symb eq '') { $request->print("Unable to handle ambiguous references:."); return ''; }
 
     if (!&canview($usec)) {
-	$request->print('<span class="LC_warning">Unable to view requested student.('.
-			$uname.':'.$udom.' in section '.$usec.' in course id '.
-			$env{'request.course.id'}.')</span>');
+        $request->print(
+            '<span class="LC_warning">'.
+            &mt('Unable to view requested student.').
+            ' '.&mt('([_1] in section [_2] in course id [_3])',
+                        $uname.':'.$udom,$usec,$env{'request.course.id'}).
+            '</span>');
 	return;
     }
 
@@ -2041,6 +2069,7 @@ sub submission {
         if (1) {
 
             my %lt = &Apache::lonlocal::texthash(
+                          keyh => 'Keyword Highlighting for Essays',
                           keyw => 'Keyword Options',
                           list => 'List',
                           past => 'Paste Selection to List',
@@ -2049,13 +2078,18 @@ sub submission {
 #
 # Print out the keyword options line
 #
-	    $request->print(<<KEYWORDS);
-<br /><b>$lt{'keyw'}:</b>&nbsp;
-<a href="javascript:keywords(document.SCORE);" target="_self">$lt{'list'}</a>&nbsp; &nbsp;
-<a href="#" onmousedown="javascript:getSel(); return false"
- class="page">$lt{'past'}</a>&nbsp; &nbsp;
-<a href="javascript:kwhighlight();" target="_self">$lt{'high'}</a><br /><br />
-KEYWORDS
+	    $request->print(
+                '<div class="LC_columnSection">'
+               .'<fieldset><legend>'.$lt{'keyh'}.'</legend>'
+               .&Apache::lonhtmlcommon::funclist_from_array(
+                    ['<a href="javascript:keywords(document.SCORE);" target="_self">'.$lt{'list'}.'</a>',
+                     '<a href="#" onmousedown="javascript:getSel(); return false"
+ class="page">'.$lt{'past'}.'</a>',
+                     '<a href="javascript:kwhighlight();" target="_self">'.$lt{'high'}.'</a>'],
+                    {legend => $lt{'keyw'}})
+               .'</fieldset></div>'
+            );
+
 #
 # Load the other essays for similarity check
 #
@@ -2276,6 +2310,7 @@ KEYWORDS
     if ($env{'form.lastSub'} eq 'datesub') {
         my ($parts,$handgrade,$responseType) = &response_type($symb,\$res_error);
 	$request->print(&displaySubByDates($symb,\%record,$parts,$responseType,$checkIcon,$uname,$udom));
+  
     } 
     if ($env{'form.lastSub'} =~ /^(last|all)$/) {
         $request->print(&Apache::loncommon::get_previous_attempt($symb,$uname,$udom,
@@ -2510,8 +2545,11 @@ sub get_last_submission {
             }
 	    my ($partid,$foo) = split(/submission$/,$key);
 	    my $draft  = $lasthash{$partid.'awarddetail'} eq 'DRAFT' ?
-		'<span class="LC_warning">Draft Copy</span> ' : '';
-	    push(@string, join(':', $key, $hide, $draft.$lasthash{$key}));
+		'<span class="LC_warning">'.&mt('Draft Copy').'</span> ' : '';
+	    #push(@string, join(':', $key, $hide, $draft.$lasthash{$key}));
+            push(@string, join(':', $key, $hide, $draft.(
+                ref($lasthash{$key}) eq 'ARRAY' ?
+                    join(',', @{$lasthash{$key}}) : $lasthash{$key}) ));
 	}
     }
     if (!@string) {
@@ -2539,16 +2577,21 @@ sub keywords_highlight {
 sub show_previous_task_version {
     my ($request,$symb) = @_;
     if ($symb eq '') {
-        $request->print("Unable to handle ambiguous references.");
-
+        $request->print(
+            '<span class="LC_error">'.
+            &mt('Unable to handle ambiguous references.').
+            '</span>');
         return '';
     }
     my ($uname,$udom) = ($env{'form.student'},$env{'form.userdom'});
     my $usec = &Apache::lonnet::getsection($udom,$uname,$env{'request.course.id'});
     if (!&canview($usec)) {
-        $request->print('<span class="LC_warning">Unable to view previous version for requested student.('.
-                        $uname.':'.$udom.' in section '.$usec.' in course id '.
-                        $env{'request.course.id'}.')</span>');
+        $request->print(
+            '<span class="LC_warning">'.
+            &mt('Unable to view previous version for requested student.').
+            ' '.&mt('([_1] in section [_2] in course id [_3])',
+                    $uname.':'.$udom,$usec,$env{'request.course.id'}).
+            '</span>');
         return;
     }
     my $mode = 'both';
@@ -4613,8 +4656,12 @@ sub displayPage {
     &Apache::lonnet::clear_EXT_cache_status();
 
     if (!&canview($usec)) {
-	$request->print('<span class="LC_warning">'.&mt('Unable to view requested student. ([_1])',$env{'form.student'}).'</span>');
-	return;
+        $request->print(
+            '<span class="LC_warning">'.
+            &mt('Unable to view requested student. ([_1])',
+                    $env{'form.student'}).
+            '</span>');
+        return;
     }
     my $result='<h3><span class="LC_info">&nbsp;'.$env{'form.title'}.'</span></h3>';
     $result.='<h3>&nbsp;'.&mt('Student: [_1]',&nameUserString(undef,$$fullname{$env{'form.student'}},$uname,$udom)).
@@ -7579,7 +7626,7 @@ sub prompt_for_corrections {
             }
         } else {
             $responsenum = $question-1;
-            $first = $first_bubble_line{$responsenum} + 1;
+            $first = $first_bubble_line{$responsenum};
         }
         $current_line = $first + 1 ;
         my @subans = split(/,/,$subdivided_bubble_lines{$responsenum});
@@ -10352,7 +10399,7 @@ described at http://www.lon-capa.org.
 =head1 OVERVIEW
 
 Do an ssi with retries:
-While I'd love to factor out this with the vesrion in lonprintout,
+While I'd love to factor out this with the version in lonprintout,
 that would either require a data coupling between modules, which I refuse to perpetuate (there's quite enough of that already), or would require the invention of another infrastructure
 I'm not quite ready to invent (e.g. an ssi_with_retry object).
 
@@ -10363,11 +10410,11 @@ At least the logic that drives this has
 ssi_with_retries - Does the server side include of a resource.
                      if the ssi call returns an error we'll retry it up to
                      the number of times requested by the caller.
-                     If we still have a proble, no text is appended to the
+                     If we still have a problem, no text is appended to the
                      output and we set some global variables.
                      to indicate to the caller an SSI error occurred.  
                      All of this is supposed to deal with the issues described
-                     in LonCAPA BZ 5631 see:
+                     in LON-CAPA BZ 5631 see:
                      http://bugs.lon-capa.org/show_bug.cgi?id=5631
                      by informing the user that this happened.