--- loncom/interface/londocs.pm	2007/06/29 23:25:30	1.281
+++ loncom/interface/londocs.pm	2007/07/02 23:43:36	1.282
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # Documents
 #
-# $Id: londocs.pm,v 1.281 2007/06/29 23:25:30 albertel Exp $
+# $Id: londocs.pm,v 1.282 2007/07/02 23:43:36 albertel Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -379,7 +379,7 @@ sub exportcourse {
                 }
                 $display .= ' />'."\n";
                 for (my $i=0; $i<$depth; $i++) {
-                    $display .= '<img src="/adm/lonIcons/whitespace1.gif" width="25" height="1" alt="" border="0" /><img src="/adm/lonIcons/whitespace1.gif" width="25" height="1" alt="" border="0" />'."\n";
+                    $display .= '<img src="/adm/lonIcons/whitespace1.gif" class="LC_docs_spacer" /><img src="/adm/lonIcons/whitespace1.gif" class="LC_docs_spacer" />'."\n";
                 }
                 if ($curRes->is_sequence()) {
                     $display .= '<img src="/adm/lonIcons/navmap.folder.open.gif">&nbsp;'."\n";
@@ -1577,7 +1577,7 @@ sub process_file_upload {
                 if ($total_embedded > 0) {
                     my $num = 0;
 		    my $state = '
-   <input type="hidden" name="folderpath" value="'.$env{'form.folderpath'}.'" />
+   <input type="hidden" name="folderpath" value="'.&HTML::Entities::encode($env{'form.folderpath'},'<>&"').'" />
    <input type="hidden" name="cmd" value="upload_embedded" />
    <input type="hidden" name="newidx" value="'.$newidx.'" />
    <input type="hidden" name="primaryurl" value="'.&escape($url).'" />
@@ -1720,12 +1720,14 @@ sub entryline {
     if ($env{'form.folderpath'}) {
 	$type = 'folder';
         $container = 'sequence';
-	$esc_path=&escape($path = $env{'form.folderpath'});
+	$esc_path=&escape($env{'form.folderpath'});
+	$path = &HTML::Entities::encode($env{'form.folderpath'},'<>&"');
 	# $htmlfoldername=&HTML::Entities::encode($env{'form.foldername'},'<>&"');
     }
     if ($env{'form.pagepath'}) {
         $type = $container = 'page';
         $esc_path=&escape($path = $env{'form.pagepath'});
+	$path = &HTML::Entities::encode($env{'form.pagepath'},'<>&"');
         $symb=&escape($env{'form.pagesymb'});
     }
     my $cpinfo='';
@@ -1799,12 +1801,12 @@ ENDCUT
    <table border='0' cellspacing='2' cellpadding='0'>
       <tr>
          <td bgcolor="#DDDDDD">
-            <a href='/adm/coursedocs?cmd=up_$index&${type}path=$esc_path&${type}symb=$symb$cpinfo'><img src="${iconpath}move_up.gif" alt='$lt{'up'}' border='0' /></a>
+            <a href='/adm/coursedocs?cmd=up_$index&amp;${type}path=$esc_path&amp;${type}symb=$symb$cpinfo'><img src="${iconpath}move_up.gif" alt='$lt{'up'}' class="LC_icon" /></a>
          </td>
       </tr>
       <tr>
         <td bgcolor="#DDDDDD">
-           <a href='/adm/coursedocs?cmd=down_$index&${type}path=$esc_path&${type}symb=$symb$cpinfo'><img src="${iconpath}move_down.gif" alt='$lt{'dw'}' border='0' /></a>
+           <a href='/adm/coursedocs?cmd=down_$index&amp;${type}path=$esc_path&amp;${type}symb=$symb$cpinfo'><img src="${iconpath}move_down.gif" alt='$lt{'dw'}' class="LC_icon" /></a>
         </td>
       </tr>
     </table>
@@ -1921,10 +1923,10 @@ END
 					       $path.$pagearg.'.page');
 	}
 	$url.='pagepath='.&escape($pagepath).
-	    '&pagesymb='.&escape($symb).$cpinfo;
+	    '&amp;pagesymb='.&escape($symb).$cpinfo;
     }
     $line.='<td bgcolor="#FFFFBB"><a href="'.$url.'"><img src="'.$icon.
-	'" border="0"></a></td>'.
+	'" class="LC_icon" /></a></td>'.
         "<td bgcolor='#FFFFBB'>".($url?"<a href=\"$url\">":'').$title.
         ($url?'</a>':' <font size="-2">'.&mt('(re-initialize course to access)').'</font>')."</td>";
     if (($allowed) && ($folder!~/^supplemental/)) {
@@ -2492,8 +2494,8 @@ sub handler {
         $env{'form.folder'}=pop(@pagepath);
         $containertag = '<input type="hidden" name="pagepath" value="" />'.
 	    '<input type="hidden" name="pagesymb" value="" />';
-        $uploadtag = '<input type="hidden" name="pagepath" value="'.$env{'form.pagepath'}.'" />'.
-	    '<input type="hidden" name="pagesymb" value="'.$env{'form.pagesymb'}.'" />';
+        $uploadtag = '<input type="hidden" name="pagepath" value="'.&HTML::Entities::encode($env{'form.pagepath'},'<>&"').'" />'.
+	    '<input type="hidden" name="pagesymb" value="'.&HTML::Entities::encode($env{'form.pagesymb'},'<>&"').'" />';
     }
     if ($r->uri=~/^\/adm\/coursedocs\/showdoc\/(.*)$/) {
        $showdoc='/'.$1;
@@ -2675,7 +2677,7 @@ sub handler {
        }
        unless ($env{'form.pagepath'}) {
            $containertag = '<input type="hidden" name="folderpath" value="" />';
-           $uploadtag = '<input type="hidden" name="folderpath" value="'.$folderpath.'" />';
+           $uploadtag = '<input type="hidden" name="folderpath" value="'.&HTML::Entities::encode($folderpath,'<>&"').'" />';
        }
 
        $r->print(<<ENDCOURSEVERIFY);
@@ -2785,10 +2787,10 @@ $help{'Importing_LON-CAPA_Resource'}
 <p>
 <hr />
 $lt{'copm'}<br />
-<input type="text" size="40" name="importmap"><br />
+<input type="text" size="40" name="importmap" /><br />
 <nobr><input type=button 
 onClick="javascript:openbrowser('simpleeditdefault','importmap','sequence,page','')"
-value="$lt{'selm'}"> <input type="submit" name="loadmap" value="$lt{'load'}">
+value="$lt{'selm'}" /> <input type="submit" name="loadmap" value="$lt{'load'}" />
 $help{'Load_Map'}</nobr>
 </p>
 </form>
@@ -2811,15 +2813,15 @@ value="$lt{'extr'}" /> $help{'Adding_Ext
 <br /><form action="/adm/imsimportdocs" method="post" name="ims">
 <input type="hidden" name="folder" value="$folder" />
 <input name="imsimport" type="button" value="$lt{'imsf'}" onClick="javascript:makeims();" />
-</nobr>
 </form>
 ENDFORM
        }
        $r->print('</td><td bgcolor="#DDDDDD">');
        unless ($env{'form.pagepath'}) {
+	   my $path = &HTML::Entities::encode($env{'form.folderpath'},'<>&"');
            $r->print(<<ENDFORM);
 <br /><form action="/adm/coursedocs" method="post" name="newfolder">
-<input type="hidden" name="folderpath" value="$env{'form.folderpath'}" />
+<input type="hidden" name="folderpath" value="$path" />
 <input type="hidden" name="importdetail" value="" />
 <nobr>
 <input name="newfolder" type="button"
@@ -2828,7 +2830,7 @@ value="$lt{'newf'}" />$help{'Adding_Fold
 </nobr>
 </form>
 <br /><form action="/adm/coursedocs" method="post" name="newpage">
-<input type="hidden" name="folderpath" value="$env{'form.folderpath'}" />
+<input type="hidden" name="folderpath" value="$path" />
 <input type="hidden" name="importdetail" value="" />
 <nobr>
 <input name="newpage" type="button"
@@ -2965,11 +2967,12 @@ ENDBLOCK
        }
        &editor($r,$coursenum,$coursedom,$folder,$allowed);
        if ($allowed) {
-       my $folderseq=
-                  '/uploaded/'.$coursedom.'/'.$coursenum.'/supplemental_'.time.
-                     '.sequence';
+	   my $folderseq=
+	       '/uploaded/'.$coursedom.'/'.$coursenum.'/supplemental_'.time.
+	       '.sequence';
 
-          $r->print(<<ENDSUPFORM);
+	   my $path = &HTML::Entities::encode($env{'form.folderpath'},'<>&"');
+	   $r->print(<<ENDSUPFORM);
 <table cellspacing=4 cellpadding=4><tr>
 <th bgcolor="#DDDDDD">$lt{'upls'}</th>
 <th bgcolor="#DDDDDD">$lt{'spec'}</th>
@@ -2989,7 +2992,7 @@ $lt{'comment'}:<br />
 <textarea cols=50 rows=4 name='comment'>
 </textarea>
 <br />
-<input type="hidden" name="folderpath" value="$env{'form.folderpath'}" />
+<input type="hidden" name="folderpath" value="$path" />
 <input type="hidden" name="cmd" value="upload_supplemental">
 <nobr>
 <input type="submit" value="$lt{'upld'}">
@@ -2999,7 +3002,7 @@ $lt{'comment'}:<br />
 </td>
 <td bgcolor="#DDDDDD">
 <form action="/adm/coursedocs" method="post" name="supnewfolder">
-<input type="hidden" name="folderpath" value="$env{'form.folderpath'}" />
+<input type="hidden" name="folderpath" value="$path" />
 <input type="hidden" name="importdetail" value="" />
 <nobr>
 <input name="newfolder" type="button"
@@ -3008,7 +3011,7 @@ value="$lt{'newf'}" /> $help{'Adding_Fol
 </nobr>
 </form>
 <br /><form action="/adm/coursedocs" method="post" name="supnewext">
-<input type="hidden" name="folderpath" value="$env{'form.folderpath'}" />
+<input type="hidden" name="folderpath" value="$path" />
 <input type="hidden" name="importdetail" value="" />
 <nobr>
 <input name="newext" type="button" 
@@ -3017,7 +3020,7 @@ value="$lt{'extr'}" /> $help{'Adding_Ext
 </nobr>
 </form>
 <br /><form action="/adm/coursedocs" method="post" name="supnewsyl">
-<input type="hidden" name="folderpath" value="$env{'form.folderpath'}" />
+<input type="hidden" name="folderpath" value="$path" />
 <input type="hidden" name="importdetail" 
 value="Syllabus=/public/$coursedom/$coursenum/syllabus" />
 <nobr>
@@ -3026,7 +3029,7 @@ $help{'Syllabus'}
 </nobr>
 </form>
 <br /><form action="/adm/coursedocs" method="post" name="subnewaboutme">
-<input type="hidden" name="folderpath" value="$env{'form.folderpath'}" />
+<input type="hidden" name="folderpath" value="$path" />
 <input type="hidden" name="importdetail" 
 value="$plainname=/adm/$udom/$uname/aboutme" />
 <nobr>