--- loncom/interface/lonmenu.pm	2022/07/08 16:08:05	1.369.2.83.2.4
+++ loncom/interface/lonmenu.pm	2023/01/23 05:40:00	1.369.2.83.2.7
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Routines to control the menu
 #
-# $Id: lonmenu.pm,v 1.369.2.83.2.4 2022/07/08 16:08:05 raeburn Exp $
+# $Id: lonmenu.pm,v 1.369.2.83.2.7 2023/01/23 05:40:00 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -871,12 +871,8 @@ sub innerregister {
                     @mapcrumbs = $navmap->recursed_crumbs($mapurl,$restitle);
                 }
             }
-            unless (($forcereg) && 
-                    ($env{'request.noversionuri'} eq '/adm/navmaps') &&
-                    ($mapurl eq $env{'course.'.$env{'request.course.id'}.'.url'})) {
-                @crumbs = ({text  => $crstype.' Contents', 
-                            href  => "Javascript:gopost('/adm/navmaps','')"});
-            }
+            @crumbs = ({text  => $crstype.' Contents', 
+                        href  => "Javascript:gopost('/adm/navmaps','')"});
             if ($mapurl ne $env{'course.'.$env{'request.course.id'}.'.url'}) { 
                 if (@mapcrumbs) {
                     push(@crumbs,@mapcrumbs);
@@ -916,16 +912,22 @@ sub innerregister {
                 if ($env{'form.title'}) {
                     $title = $env{'form.title'};
                 }
-                my $trail;
+                my ($trail,$cnum,$cdom);
+                if ($env{'form.folderpath'}) {
+                    $cnum = $env{'course.'.$env{'request.course.id'}.'.num'};
+                    $cdom = $env{'course.'.$env{'request.course.id'}.'.domain'};
+                    &Apache::loncommon::validate_folderpath(1,'',$cnum,$cdom);
+                }
                 if ($env{'form.folderpath'}) {
                     &prepare_functions($resurl,$forcereg,$group,undef,undef,1,$hostname);
+                    $title = &HTML::Entities::encode($title,'\'"<>&');
                     ($trail) =
                         &Apache::lonhtmlcommon::docs_breadcrumbs(undef,$crstype,undef,$title,1,1);
                 } else {
                     &Apache::lonhtmlcommon::add_breadcrumb(
                     {text  => "Supplemental $crstype Content",
                      href  => "javascript:gopost('/adm/supplemental','')"});
-                    $title = &mt('View Resource');
+                    $title = &HTML::Entities::encode(&mt('View Resource'),'\'"<>&');
                     ($trail) =
                         &Apache::lonhtmlcommon::docs_breadcrumbs(undef,$crstype,undef,$title,1,1);
                 }
@@ -937,7 +939,7 @@ sub innerregister {
                 &Apache::lonhtmlcommon::clear_breadcrumbs();
                 &prepare_functions('/public'.$courseurl."/syllabus",
                                    $forcereg,$group,undef,undef,1,$hostname);
-                $title = &mt('Syllabus File');
+                $title = &HTML::Entities::encode(&mt('Syllabus File'),'\'"<>&');  
                 my ($trail) =
                     &Apache::lonhtmlcommon::docs_breadcrumbs(undef,$crstype,undef,$title,1,1);
                 if (ref($showncrumbsref)) {
@@ -1605,8 +1607,12 @@ sub get_editbutton {
         if ($env{'form.folderpath'}) {
             $suppanchor = $env{'form.anchor'};
         }
+        my $shownsymb;
+        if ($env{'request.symb'}) {
+            $shownsymb = &Apache::lonenc::check_encrypt($env{'request.symb'});
+        }
         $jscall = &Apache::lonhtmlcommon::jump_to_editres($cfile,$home,$switchserver,
-                                                $forceedit,$forcereg,$env{'request.symb'},
+                                                $forceedit,$forcereg,$env{'request.symb'},$shownsymb,
                                                 &escape($env{'form.folderpath'}),
                                                 &escape($env{'form.title'}),$hostname,
                                                 $env{'form.idx'},&escape($env{'form.suppurl'}),