--- loncom/interface/lonbulletin.pm	2006/07/17 21:59:24	1.37
+++ loncom/interface/lonbulletin.pm	2006/08/28 13:02:24	1.40
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # Bulletin Board Handler
 #
-# $Id: lonbulletin.pm,v 1.37 2006/07/17 21:59:24 raeburn Exp $
+# $Id: lonbulletin.pm,v 1.40 2006/08/28 13:02:24 albertel Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -36,6 +36,7 @@ use Apache::lontexconvert;
 use Apache::lonfeedback;
 use Apache::lonlocal;
 use Apache::lonhtmlcommon;
+use HTML::Entities();
 use LONCAPA;
 
 sub handler {
@@ -197,8 +198,15 @@ sub handler {
 	      if ($syllabus{'uploaded.photourl'}) {
 		  &Apache::lonnet::removeuploadedurl($syllabus{'uploaded.photourl'});
 	      }
-	      $syllabus{'uploaded.photourl'}=
-		  &Apache::lonnet::userfileupload('uploaddoc',1,'bulletin');
+              if ($group ne '') {
+	          $syllabus{'uploaded.photourl'}=
+		      &Apache::lonnet::userfileupload('uploaddoc',1,
+                                                      'bulletin/'.$group.'/'.$marker);
+              } else {
+                  $syllabus{'uploaded.photourl'}=
+                      &Apache::lonnet::userfileupload('uploaddoc',1,
+                                                      'bulletin/'.$marker);
+              }
  	  }
           $syllabus{'uploaded.lastmodified'}=time;
           &Apache::lonnet::put('bulletinpage_'.$marker,\%syllabus,$dom,$crs);
@@ -257,7 +265,7 @@ sub handler {
 		}
                  if ($allowed) {
                 $r->print('<br /><textarea cols="80" rows="10" name="'.$_.'">'.
-			   $syllabus{$_}.
+			  &HTML::Entites::encode($syllabus{$_},'&"<>').
            '</textarea><input type="submit" name="storesyl" value="'.&mt('Store').'" />');
 	        }
 	    } else {
@@ -269,7 +277,7 @@ sub handler {
                 if ($allowed) {
                  $r->print(
                 '<br />'.&mt('Topic').'<br /><textarea cols="80" rows="2" name="'.$_.'">'.
-			   $syllabus{$_}.
+			  &HTML::Entites::encode($syllabus{$_},'&"<>').
            '</textarea><input type="submit" name="storesyl" value="'.&mt('Store').'" />');
                 }
             }