--- loncom/interface/lonbulletin.pm	2006/07/17 21:59:24	1.37
+++ loncom/interface/lonbulletin.pm	2006/10/23 18:48:47	1.42
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # Bulletin Board Handler
 #
-# $Id: lonbulletin.pm,v 1.37 2006/07/17 21:59:24 raeburn Exp $
+# $Id: lonbulletin.pm,v 1.42 2006/10/23 18:48:47 albertel Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -36,6 +36,7 @@ use Apache::lontexconvert;
 use Apache::lonfeedback;
 use Apache::lonlocal;
 use Apache::lonhtmlcommon;
+use HTML::Entities();
 use LONCAPA;
 
 sub handler {
@@ -197,18 +198,25 @@ sub handler {
 	      if ($syllabus{'uploaded.photourl'}) {
 		  &Apache::lonnet::removeuploadedurl($syllabus{'uploaded.photourl'});
 	      }
-	      $syllabus{'uploaded.photourl'}=
-		  &Apache::lonnet::userfileupload('uploaddoc',1,'bulletin');
+              if ($group ne '') {
+	          $syllabus{'uploaded.photourl'}=
+		      &Apache::lonnet::userfileupload('uploaddoc',1,
+                                                      'bulletin/'.$group.'/'.$marker);
+              } else {
+                  $syllabus{'uploaded.photourl'}=
+                      &Apache::lonnet::userfileupload('uploaddoc',1,
+                                                      'bulletin/'.$marker);
+              }
  	  }
           $syllabus{'uploaded.lastmodified'}=time;
           &Apache::lonnet::put('bulletinpage_'.$marker,\%syllabus,$dom,$crs);
        }
        if (($allowed) && ($env{'form.storesyl'})) {
-	   foreach (keys %syllabusfields) {
-               my $field=$env{'form.'.$_};
+	   foreach my $syl_field (keys(%syllabusfields)) {
+               my $field=$env{'form.'.$syl_field};
                $field=~s/\s+$//s;
                $field=&Apache::lonfeedback::clear_out_html($field,1);
-	       $syllabus{$_}=$field;
+	       $syllabus{$syl_field}=$field;
            }
            $syllabus{'uploaded.lastmodified'}=time;
            &Apache::lonnet::put('bulletinpage_'.$marker,\%syllabus,$dom,$crs);
@@ -231,9 +239,9 @@ sub handler {
          '<input type="submit" name="storeupl" value="'.&mt('Upload').'">'.
 	 '</form><form method="post">');
        }
-       foreach (sort keys %syllabusfields) {
-          if (($syllabus{$_}) || ($allowed)) {
-              my $message=$syllabus{$_};
+       foreach my $field (sort(keys(%syllabusfields))) {
+          if (($syllabus{$field}) || ($allowed)) {
+              my $message=$syllabus{$field};
 	      &Apache::lonfeedback::newline_to_br(\$message);
 	      $message
         =~s/(https*\:\/\/[^\s]+)/\<a href=\"$1\"\>\<tt\>$1\<\/tt\>\<\/a\>/g;
@@ -241,12 +249,12 @@ sub handler {
 		  $message=&Apache::lonspeller::markeduptext($message);
 	      }
 	      $message=&Apache::lontexconvert::msgtexconverted($message);
-	      unless ($_ eq 'aaa_title') {
-		if (($_ ne 'bbb_content') || ($allowed)) {
+	      unless ($field eq 'aaa_title') {
+		if (($field ne 'bbb_content') || ($allowed)) {
 		    if ($target ne 'tex') {
-			$r->print('<h3>'.$syllabusfields{$_}.'</h3>');
+			$r->print('<h3>'.$syllabusfields{$field}.'</h3>');
 		    } else {
-			$r->print('\\\\\textbf{'.$syllabusfields{$_}.'}\\\\');
+			$r->print('\\\\\textbf{'.$syllabusfields{$field}.'}\\\\');
 		    }
 		}
 		if ($target ne 'tex') {
@@ -256,8 +264,8 @@ sub handler {
 		    $r->print(' '.&Apache::lonxml::xmlparse($r,'tex',$message).' ');
 		}
                  if ($allowed) {
-                $r->print('<br /><textarea cols="80" rows="10" name="'.$_.'">'.
-			   $syllabus{$_}.
+                $r->print('<br /><textarea cols="80" rows="10" name="'.$field.'">'.
+			  &HTML::Entities::encode($syllabus{$field},'&"<>').
            '</textarea><input type="submit" name="storesyl" value="'.&mt('Store').'" />');
 	        }
 	    } else {
@@ -268,8 +276,8 @@ sub handler {
 		}
                 if ($allowed) {
                  $r->print(
-                '<br />'.&mt('Topic').'<br /><textarea cols="80" rows="2" name="'.$_.'">'.
-			   $syllabus{$_}.
+                '<br />'.&mt('Topic').'<br /><textarea cols="80" rows="2" name="'.$field.'">'.
+			  &HTML::Entities::encode($syllabus{$field},'&"<>').
            '</textarea><input type="submit" name="storesyl" value="'.&mt('Store').'" />');
                 }
             }