--- loncom/interface/lonextresedit.pm	2013/02/13 04:41:35	1.5
+++ loncom/interface/lonextresedit.pm	2015/06/09 21:22:56	1.8
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # Documents
 #
-# $Id: lonextresedit.pm,v 1.5 2013/02/13 04:41:35 raeburn Exp $
+# $Id: lonextresedit.pm,v 1.8 2015/06/09 21:22:56 damieng Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -59,9 +59,9 @@ sub handler {
     my ($supplementalflag,$updated,$output,$errormsg,$residx,$url,$title,$symb);
     if (($env{'form.folderpath'} =~ /^supplemental/) && ($env{'form.suppurl'})) {
         $supplementalflag = 1;
-    } 
+    }
     if (($supplementalflag) || ($env{'form.symb'} =~ /^uploaded/)) {
-        ($updated,$output,$errormsg,$residx,$url,$title,$symb) = 
+        ($updated,$output,$errormsg,$residx,$url,$title,$symb) =
             &process_changes($supplementalflag,$cdom,$cnum,$chome);
         if ($supplementalflag) {
             if ($url ne $env{'form.suppurl'}) {
@@ -308,7 +308,7 @@ sub display_editor {
         (my $map,$residx,my $res) =
             &Apache::lonnet::decode_symb($symb);
         $title = &Apache::lonnet::gettitle($symb);
-        my $path = &Apache::lonnet::getdocspath($symb);
+        my $path = &Apache::loncommon::symb_to_docspath($symb);
         $pathitem = '<input type="hidden" name="folderpath" value="'.&HTML::Entities::encode($path,'<>&"').'" />';
     }
     my $js = &Apache::lonhtmlcommon::scripttag(&extedit_javascript());
@@ -321,10 +321,11 @@ sub display_editor {
 }
 
 sub extedit_javascript {
-    my %lt = &Apache::lonlocal::texthash(
+    my %js_lt = &Apache::lonlocal::texthash(
         invurl  => 'Invalid URL',
         titbl   => 'Title is blank',
     );
+    &js_escape(\%js_lt);
 
     my $urlregexp = <<'ENDREGEXP';
 /^([a-z]([a-z]|\d|\+|-|\.)*):(\/\/(((([a-z]|\d|-|\.|_|~|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])|(%[\da-f]{2})|[!\$&'\(\)\*\+,;=]|:)*@)?((\[(|(v[\da-f]{1,}\.(([a-z]|\d|-|\.|_|~)|[!\$&'\(\)\*\+,;=]|:)+))\])|((\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])\.(\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])\.(\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])\.(\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5]))|(([a-z]|\d|-|\.|_|~|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])|(%[\da-f]{2})|[!\$&'\(\)\*\+,;=])*)(:\d*)?)(\/(([a-z]|\d|-|\.|_|~|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])|(%[\da-f]{2})|[!\$&'\(\)\*\+,;=]|:|@)*)*|(\/((([a-z]|\d|-|\.|_|~|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])|(%[\da-f]{2})|[!\$&'\(\)\*\+,;=]|:|@)+(\/(([a-z]|\d|-|\.|_|~|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])|(%[\da-f]{2})|[!\$&'\(\)\*\+,;=]|:|@)*)*)?)|((([a-z]|\d|-|\.|_|~|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])|(%[\da-f]{2})|[!\$&'\(\)\*\+,;=]|:|@)+(\/(([a-z]|\d|-|\.|_|~|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])|(%[\da-f]{2})|[!\$&'\(\)\*\+,;=]|:|@)*)*)|((([a-z]|\d|-|\.|_|~|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])|(%[\da-f]{2})|[!\$&'\(\)\*\+,;=]|:|@)){0})(\?((([a-z]|\d|-|\.|_|~|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])|(%[\da-f]{2})|[!\$&'\(\)\*\+,;=]|:|@)|[\uE000-\uF8FF]|\/|\?)*)?(\#((([a-z]|\d|-|\.|_|~|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])|(%[\da-f]{2})|[!\$&'\(\)\*\+,;=]|:|@)|\/|\?)*)?$/i
@@ -340,19 +341,20 @@ function setExternal(extform,residx) {
         String.prototype.trim = function() {return this.replace(\/^\\s+|\\s+$\/g, "");};    }
     var url=extform.exturl.value;
     if (title == null || title.trim()=="") {
-        alert("$lt{'titbl'}");
+        alert("$js_lt{'titbl'}");
         extform.exttitle.focus();
         return;
     }
     if (regexp.test(url)) {
         url = escape(url);
+        title = escape(title);
         if (residx > 0) {
             eval("extform.importdetail.value=title+'='+url+'='+residx;extform.submit();");
         } else {
             eval("extform.importdetail.value=title+'='+url;extform.submit();");
         }
     } else {
-        alert("$lt{'invurl'}");
+        alert("$js_lt{'invurl'}");
         extform.exturl.focus();
         return;
     }
@@ -378,7 +380,7 @@ function extUrlPreview(caller) {
         if (regexp.test(url)) {
             openMyModal(url,500,400,'yes');
         } else {
-            alert("$lt{'invurl'}");
+            alert("$js_lt{'invurl'}");
         }
     }
 }