--- loncom/interface/londocs.pm	2022/10/27 20:30:11	1.685
+++ loncom/interface/londocs.pm	2022/10/29 14:47:00	1.687
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # Documents
 #
-# $Id: londocs.pm,v 1.685 2022/10/27 20:30:11 raeburn Exp $
+# $Id: londocs.pm,v 1.687 2022/10/29 14:47:00 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -3992,11 +3992,13 @@ sub entryline {
     my ($index,$title,$url,$folder,$allowed,$residx,$coursenum,$coursedom,
         $crstype,$pathitem,$supplementalflag,$container,$filtersref,$currgroups,
         $ltitoolsref,$canedit,$isencrypted,$ishidden,$navmapref,$hostname)=@_;
-    my ($foldertitle,$renametitle,$oldtitle);
+    my ($foldertitle,$renametitle,$oldtitle,$encodedtitle);
     if (&is_supplemental_title($title)) {
 	($title,$foldertitle,$renametitle) = &Apache::loncommon::parse_supplemental_title($title);
+        $encodedtitle=$title;
     } else {
 	$title=&HTML::Entities::encode($title,'"<>&\'');
+        $encodedtitle=$title;
 	$renametitle=$title;
 	$foldertitle=$title;
     }
@@ -4368,6 +4370,17 @@ END
                 }
                 $nomodal = 1;
             }
+        } elsif (($uploaded) && (!$allowed) && ($url ne '/adm/supplemental?')) {
+            my $embstyle=&Apache::loncommon::fileembstyle($extension);
+            unless ($embstyle eq 'ssi') {
+                if (($embstyle eq 'img')
+                 || ($embstyle eq 'emb')
+                 || ($embstyle eq 'wrp')) {
+                    $url='/adm/wrapper'.$url;
+                } elsif ($url !~ /\.(sequence|page)$/) {
+                    $url='/adm/coursedocs/showdoc'.$url;
+                }
+            }
         }
         unless ($allowed && $env{'request.role.adv'}) {
             if ($ishidden || (&LONCAPA::map::getparameter($orderidx,'parameter_hiddenresource'))[0]=~/^yes$/i) {
@@ -4472,7 +4485,7 @@ $form_end;
         $url .= ($url =~ /\?/) ? '&amp;':'?';
         $url .= 'folderpath='.&HTML::Entities::encode($esc_path,'<>&"');
         if ($title) {
-            $url .= '&amp;title='.&HTML::Entities::encode($renametitle,'<>&"');
+            $url .= '&amp;title='.$encodedtitle;
         }
         if ((($isexternal) || ($isexttool)) && $orderidx) {
             $url .= '&amp;idx='.$orderidx;
@@ -5773,7 +5786,7 @@ sub handler {
     }
 # If allowed and user's role is not advanced check folderpath is not hidden
     my $hidden_and_empty;
-    if (($allowed) && (!$env{'request.role.adv'}) && ($env{'form.folderpath'} ne '')) { 
+    if (($allowed) && (!$env{'request.role.adv'}) && ($env{'form.folderpath'} ne '')) {
         my ($folderurl,$foldername,$hiddenfolder);
         my @pathitems = split(/\&/,$env{'form.folderpath'});
         my $folder = $pathitems[-2];
@@ -5978,7 +5991,8 @@ sub handler {
     if ($showdoc) {
         my $args;
         if ($supplementalflag) {
-            my $brcrum = &Apache::lonhtmlcommon::docs_breadcrumbs(undef,$crstype,undef,$env{'form.title'},1);
+            my $title = &HTML::Entities::encode($env{'form.title'},'\'"<>&');
+            my $brcrum = &Apache::lonhtmlcommon::docs_breadcrumbs(undef,$crstype,undef,$title,1);
             $args = {'bread_crumbs' => $brcrum};
         } else {
             $args = {'force_register' => $showdoc};