--- loncom/interface/loncoursegroups.pm	2016/02/26 21:44:39	1.128
+++ loncom/interface/loncoursegroups.pm	2020/09/08 23:54:40	1.131
@@ -1,6 +1,6 @@
 # The LearningOnline Network with CAPA
 #
-# $Id: loncoursegroups.pm,v 1.128 2016/02/26 21:44:39 raeburn Exp $
+# $Id: loncoursegroups.pm,v 1.131 2020/09/08 23:54:40 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -37,6 +37,7 @@ use Apache::lonnavmaps();
 use Apache::longroup();
 use Apache::portfolio();
 use Apache::Constants qw(:common :http);
+use HTML::Entities;
 use LONCAPA::map();
 use lib '/home/httpd/lib/perl/';
 use LONCAPA;
@@ -135,7 +136,7 @@ function changeSort(caller) {
 }
 function openGroupRoster(group,status) {
     var url = '/adm/grouproster?';
-    url += 'group='+group+'&status='+status+'&ref=popup';
+    url += 'group='+group+'&status='+status+'&ref=popup';
     var title = 'Group_Membership';
     var options = 'scrollbars=1,resizable=1,menubar=0';
     options += ',width=700,height=600';
@@ -169,13 +170,13 @@ sub display_groups {
     my %curr_groups = ();
     my %grp_info = ();
     my %actionlinks = (
-      modify => '<a href="/adm/coursegroups?action=modify&refpage='.
-                         $env{'form.refpage'}.'&state=pick_task&groupname=',
-      view => '<a href="',
-      delete => '<a href="/adm/coursegroups?action=delete&refpage='.
-                         $env{'form.refpage'}.'&state=verify&groupname=',
-      reenable => '<a href="/adm/coursegroups?action=reenable&refpage='.
-                         $env{'form.refpage'}.'&state=verify&groupname=',
+      modify   => '/adm/coursegroups?action=modify&refpage='.
+                  $env{'form.refpage'}.'&state=pick_task&groupname=',
+      view     => '',
+      delete   => '/adm/coursegroups?action=delete&refpage='.
+                  $env{'form.refpage'}.'&state=verify&groupname=',
+      reenable => '/adm/coursegroups?action=reenable&refpage='.
+                  $env{'form.refpage'}.'&state=verify&groupname=',
     );
     my %lt = &Apache::lonlocal::texthash( 
                           modify => 'Modify',
@@ -226,7 +227,7 @@ sub display_groups {
             if (!defined($navmap)) {
                 $r->print('<div class="LC_error">'.
                           &mt('An error occurred retrieving information about resources in the course.').'<br />'.
-                          &mt('It is recommended that you [_1]re-initialize the course[_2] and then return to this page.','<a href="/adm/roles?selectrole=1&newrole='.$env{'request.role'}.'&orgurl=%2fadm%2fcoursegroups">','</a>').
+                          &mt('It is recommended that you [_1]re-initialize the course[_2] and then return to this page.','<a href="/adm/roles?selectrole=1&amp;newrole='.$env{'request.role'}.'&amp;orgurl=%2fadm%2fcoursegroups">','</a>').
                           '</div>');
                 return;
             }
@@ -249,7 +250,7 @@ sub display_groups {
         <th><a href="javascript:changeSort('creator')">$lt{'crea'}</a></th>
         <th><a href="javascript:changeSort('creation')">$lt{'crtd'}</a></th>
         <th><a href="javascript:changeSort('modified')">$lt{'last'}</a></th>
-        <th>$lt{'func'}</b></td>
+        <th>$lt{'func'}</th>
         <th><a href="javascript:changeSort('quota')">$lt{'quot'}</a></th>
         <th><a href="javascript:changeSort('totalmembers')">$lt{'memb'}</a></th>
         <th><a href="javascript:changeSort('totalfiles')">$lt{'file'}</a></th>
@@ -331,26 +332,28 @@ END
                     my $link;
                     if ($action eq 'modify' || $action eq 'delete' || 
                         $action eq 'reenable') {
-                        $link = $actionlinks{$action}.$group.'">'.$lt{$action}.'</a>';
+                        $link = '<a href="'.&HTML::Entities::encode($actionlinks{$action}.$group,'<>&"').
+                                '">'.$lt{$action}.'</a>';
                     } else {
                         $link =
-                            &Apache::longroup::get_group_link($cdom,$cnum,$group,$navmap,$view_permission);
-print STDERR "link is ||$link||\n";
+                            &Apache::longroup::get_group_link($cdom,$cnum,$group,$navmap,
+                                                              $view_permission);
                         if ($link) {
-                            $link = $actionlinks{$action}.$link;
+                            $link = '<a href="'.$link;
                             $link .= (($link=~/\?/)?'&amp;':'?').'ref=grouplist';
                             if (exists($env{'form.refpage'})) {
                                 $link .= '&amp;refpage='.$env{'form.refpage'};
                             }
                             $link .= '">'.$lt{$action}.'</a>';
-                        }  
+                        }
                     }
                     if ($action eq 'view') { 
                         if ($manage_permission) { 
-                            $link .= '&nbsp;&nbsp;'.$actionlinks{'modify'}.
-                                      $group.'">'.$lt{'modify'}.'</a>'.
-                                     '&nbsp;&nbsp;'.$actionlinks{'delete'}.
-                                      $group.'">'.$lt{'delete'}.'</a>';
+                            $link .= '&nbsp;&nbsp;<a href="'.
+                                      &HTML::Entities::encode($actionlinks{'modify'}.$group,'<>&"').
+                                      '">'.$lt{'modify'}.'</a>&nbsp;&nbsp;<a href="'.
+                                      &HTML::Entities::encode($actionlinks{'delete'}.$group,'<>&"').
+                                      '">'.$lt{'delete'}.'</a>';
                         }
                     }
                     $r->print(&Apache::loncommon::start_data_table_row('LC_data_table_dense').
@@ -406,7 +409,7 @@ print STDERR "link is ||$link||\n";
                 if (!defined($navmap)) {
                     $r->print('<div class="LC_error">'.
                               &mt('An error occurred retrieving information about resources in the course.').'<br />'.
-                              &mt('It is recommended that you [_1]re-initialize the course[_2] and then return to this page.','<a href="/adm/roles?selectrole=1&newrole='.$env{'request.role'}.'&orgurl=%2fadm%2fcoursegroups">','</a>').
+                              &mt('It is recommended that you [_1]re-initialize the course[_2] and then return to this page.','<a href="/adm/roles?selectrole=1&amp;newrole='.$env{'request.role'}.'&amp;orgurl=%2fadm%2fcoursegroups">','</a>').
                               '</div>');
                     return;
                 }
@@ -416,8 +419,8 @@ print STDERR "link is ||$link||\n";
                     my $description = &unescape(
                                         $group_info{description});
                     my ($link,$hidden) = 
-                        &Apache::longroup::get_group_link($cdom,$cnum,$group,$navmap,$view_permission);
-print STDERR "link is ||$link||\n";
+                        &Apache::longroup::get_group_link($cdom,$cnum,$group,$navmap,
+                                                          $view_permission);
                     if ($link) {
                         $link .= '&amp;ref=grouplist';
                         $r->print('<span style="font-size: larger"><a href="'.$link.'">'.
@@ -926,7 +929,7 @@ function changeSort(caller) {
           faq=>9,bug=>'Instructor Interface',});
         if ($action eq 'modify' || $action eq 'delete') {
             &Apache::lonhtmlcommon::add_breadcrumb
-            ({href=>"/adm/coursegroups?refpage=cusr&action=$action",
+            ({href=>"/adm/coursegroups?refpage=cusr&amp;action=$action",
               text=>"Groups",
               faq=>9,bug=>'Instructor Interface',});
         }
@@ -938,7 +941,8 @@ function changeSort(caller) {
         if ($env{'form.refpage'} eq 'grouplist') {
             &Apache::lonhtmlcommon::add_breadcrumb
              ({href=>"/adm/$cdom/$cnum/$env{'form.groupname'}/smppg?ref=grouplist",
-               text=>"Group: $description",});
+               text=>&mt('Group').": $description",
+               no_mt=>1});
         }
     }
 
@@ -3785,21 +3789,21 @@ sub modify_menu {
 	items => [
 
           { linktext => "Modify default $gpterm settings",
-            url => '/adm/coursegroups?action=modify&refpage='.$env{'form.refpage'}.'&groupname='.$groupname.'&state=change_settings&branch=settings',
+            url => '/adm/coursegroups?action=modify&amp;refpage='.$env{'form.refpage'}.'&amp;groupname='.$groupname.'&amp;state=change_settings&amp;branch=settings',
             icon => 'grp_settings.png',
             alttext => "Modify default $gpterm settings",
             permission => '1',
             help => 'Course_Modify_Group',            
             },
           { linktext => 'Modify access, tools and privileges for members',
-            url => '/adm/coursegroups?action=modify&refpage='.$env{'form.refpage'}.'&groupname='.$groupname.'&state=change_members&branch=members',
+            url => '/adm/coursegroups?action=modify&amp;refpage='.$env{'form.refpage'}.'&amp;groupname='.$groupname.'&amp;state=change_members&amp;branch=members',
             icon => 'grp_tools.png',
             alttext => 'Modify access, tools and privileges for members',
             permission => '1',
             help => 'Course_Modify_Group_Membership',
             },
           { linktext => "Add member(s) to the $gpterm",
-            url => '/adm/coursegroups?action=modify&refpage='.$env{'form.refpage'}.'&groupname='.$groupname.'&state=add_members&branch=adds',
+            url => '/adm/coursegroups?action=modify&amp;refpage='.$env{'form.refpage'}.'&amp;groupname='.$groupname.'&amp;state=add_members&amp;branch=adds',
             icon => 'grp_add.png',
             alttext =>  "Add member(s) to the $gpterm",
             permission => '1',