--- loncom/interface/lonextresedit.pm	2013/05/21 18:57:40	1.6
+++ loncom/interface/lonextresedit.pm	2016/11/29 16:28:16	1.8.2.1
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # Documents
 #
-# $Id: lonextresedit.pm,v 1.6 2013/05/21 18:57:40 raeburn Exp $
+# $Id: lonextresedit.pm,v 1.8.2.1 2016/11/29 16:28:16 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -59,9 +59,9 @@ sub handler {
     my ($supplementalflag,$updated,$output,$errormsg,$residx,$url,$title,$symb);
     if (($env{'form.folderpath'} =~ /^supplemental/) && ($env{'form.suppurl'})) {
         $supplementalflag = 1;
-    } 
+    }
     if (($supplementalflag) || ($env{'form.symb'} =~ /^uploaded/)) {
-        ($updated,$output,$errormsg,$residx,$url,$title,$symb) = 
+        ($updated,$output,$errormsg,$residx,$url,$title,$symb) =
             &process_changes($supplementalflag,$cdom,$cnum,$chome);
         if ($supplementalflag) {
             if ($url ne $env{'form.suppurl'}) {
@@ -201,7 +201,7 @@ sub process_changes {
 }
 
 sub extedit_form {
-    my ($supplementalflag,$residx,$orig_url,$orig_title,$pathitem,$helpitem,$caller,$symb) = @_;
+    my ($supplementalflag,$residx,$orig_url,$orig_title,$pathitem,$helpitem,$caller,$symb,$disabled) = @_;
     my %lt = &Apache::lonlocal::texthash(
         ex => 'External Resource',
         ed => 'Edit',
@@ -263,7 +263,7 @@ sub extedit_form {
         $residx = 0;
         $orig_url = 'http://';
         $orig_title = $lt{'ex'};
-        $preview = '<input type="button" name="view" value="'.$lt{'pr'}.'" onclick="javascript:extUrlPreview('."'$urlid'".');" />';
+        $preview = '<input type="button" name="view" value="'.$lt{'pr'}.'" onclick="javascript:extUrlPreview('."'$urlid'".');"'.$disabled.' />';
         $save = $lt{'al'};
         $pathitem .= '<br />';
     }
@@ -274,17 +274,17 @@ $legend
 $active
 <span$srcclass>
 $extsrc
-<input type="text" size="$size" name="exturl" id="$urlid" value="$orig_url" />
+<input type="text" size="$size" name="exturl" id="$urlid" value="$orig_url" $disabled />
 $preview
 </span> 
 <br />
 <span$srcclass>
 $title
-<input type="text" size="$size" name="exttitle" value="$orig_title" />
+<input type="text" size="$size" name="exttitle" value="$orig_title" $disabled />
 <input type="hidden" name="importdetail" value="" />
 $pathitem
 $hiddenelem
-<input type="button" value="$save" onclick="javascript:setExternal(this.form,'$residx');" />
+<input type="button" value="$save" onclick="javascript:setExternal(this.form,'$residx');" $disabled />
 </span>
 </fieldset>
 </form>
@@ -298,7 +298,7 @@ ENDFORM
 
 sub display_editor {
     my ($url,$folderpath,$symb,$idx) = @_;
-    my ($residx,$supplementalflag,$title,$pathitem,$output);
+    my ($residx,$supplementalflag,$title,$pathitem,$output,$js,$navmap);
     if ($folderpath =~ /^supplemental/) {
         $supplementalflag = 1;
         $residx = $idx;
@@ -308,10 +308,10 @@ sub display_editor {
         (my $map,$residx,my $res) =
             &Apache::lonnet::decode_symb($symb);
         $title = &Apache::lonnet::gettitle($symb);
-        my $path = &Apache::loncommon::symb_to_docspath($symb);
+        my $path = &Apache::loncommon::symb_to_docspath($symb,\$navmap);
         $pathitem = '<input type="hidden" name="folderpath" value="'.&HTML::Entities::encode($path,'<>&"').'" />';
     }
-    my $js = &Apache::lonhtmlcommon::scripttag(&extedit_javascript());
+    $js = &Apache::lonhtmlcommon::scripttag(&extedit_javascript());
     my $args = { 'force_register' => $env{'form.register'} };
     return &Apache::loncommon::start_page('External Resource Editor',$js,$args).
            '<div class="LC_left_float">'.
@@ -321,10 +321,11 @@ sub display_editor {
 }
 
 sub extedit_javascript {
-    my %lt = &Apache::lonlocal::texthash(
+    my %js_lt = &Apache::lonlocal::texthash(
         invurl  => 'Invalid URL',
         titbl   => 'Title is blank',
     );
+    &js_escape(\%js_lt);
 
     my $urlregexp = <<'ENDREGEXP';
 /^([a-z]([a-z]|\d|\+|-|\.)*):(\/\/(((([a-z]|\d|-|\.|_|~|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])|(%[\da-f]{2})|[!\$&'\(\)\*\+,;=]|:)*@)?((\[(|(v[\da-f]{1,}\.(([a-z]|\d|-|\.|_|~)|[!\$&'\(\)\*\+,;=]|:)+))\])|((\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])\.(\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])\.(\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])\.(\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5]))|(([a-z]|\d|-|\.|_|~|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])|(%[\da-f]{2})|[!\$&'\(\)\*\+,;=])*)(:\d*)?)(\/(([a-z]|\d|-|\.|_|~|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])|(%[\da-f]{2})|[!\$&'\(\)\*\+,;=]|:|@)*)*|(\/((([a-z]|\d|-|\.|_|~|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])|(%[\da-f]{2})|[!\$&'\(\)\*\+,;=]|:|@)+(\/(([a-z]|\d|-|\.|_|~|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])|(%[\da-f]{2})|[!\$&'\(\)\*\+,;=]|:|@)*)*)?)|((([a-z]|\d|-|\.|_|~|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])|(%[\da-f]{2})|[!\$&'\(\)\*\+,;=]|:|@)+(\/(([a-z]|\d|-|\.|_|~|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])|(%[\da-f]{2})|[!\$&'\(\)\*\+,;=]|:|@)*)*)|((([a-z]|\d|-|\.|_|~|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])|(%[\da-f]{2})|[!\$&'\(\)\*\+,;=]|:|@)){0})(\?((([a-z]|\d|-|\.|_|~|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])|(%[\da-f]{2})|[!\$&'\(\)\*\+,;=]|:|@)|[\uE000-\uF8FF]|\/|\?)*)?(\#((([a-z]|\d|-|\.|_|~|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])|(%[\da-f]{2})|[!\$&'\(\)\*\+,;=]|:|@)|\/|\?)*)?$/i
@@ -340,19 +341,20 @@ function setExternal(extform,residx) {
         String.prototype.trim = function() {return this.replace(\/^\\s+|\\s+$\/g, "");};    }
     var url=extform.exturl.value;
     if (title == null || title.trim()=="") {
-        alert("$lt{'titbl'}");
+        alert("$js_lt{'titbl'}");
         extform.exttitle.focus();
         return;
     }
     if (regexp.test(url)) {
         url = escape(url);
+        title = escape(title);
         if (residx > 0) {
             eval("extform.importdetail.value=title+'='+url+'='+residx;extform.submit();");
         } else {
             eval("extform.importdetail.value=title+'='+url;extform.submit();");
         }
     } else {
-        alert("$lt{'invurl'}");
+        alert("$js_lt{'invurl'}");
         extform.exturl.focus();
         return;
     }
@@ -378,7 +380,7 @@ function extUrlPreview(caller) {
         if (regexp.test(url)) {
             openMyModal(url,500,400,'yes');
         } else {
-            alert("$lt{'invurl'}");
+            alert("$js_lt{'invurl'}");
         }
     }
 }