--- loncom/interface/lonsupportreq.pm	2012/08/27 06:28:06	1.69
+++ loncom/interface/lonsupportreq.pm	2013/07/15 16:13:21	1.73
@@ -1,5 +1,5 @@
 #
-# $Id: lonsupportreq.pm,v 1.69 2012/08/27 06:28:06 raeburn Exp $
+# $Id: lonsupportreq.pm,v 1.73 2013/07/15 16:13:21 bisitz Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -39,7 +39,7 @@ use Apache::lonacc();
 use Apache::lonauth();
 use Apache::courseclassifier;
 use LONCAPA qw(:DEFAULT :match);
- 
+use HTML::Entities;
 
 sub handler {
     my ($r) = @_;
@@ -57,8 +57,19 @@ sub handler {
     if ($r->uri eq '/adm/helpdesk') {
         &Apache::lonacc::get_posted_cgi($r);
     }
-    my $function = $env{'form.function'};
+    my $function;
+    if ($env{'form.function'}) {
+        if (($env{'form.function'} eq 'norole')  ||
+            ($env{'form.function'} eq 'student') ||
+            ($env{'form.function'} eq 'admin')   ||
+            ($env{'form.function'} eq 'author')) {
+            $function = $env{'form.function'};
+        }
+    }
     my $origurl = $env{'form.origurl'};
+    $origurl =~ s{^https?://}{};
+    $origurl =~ s/(`)//g;
+    $origurl =~ s/\$/\(\$\)/g;
     my $command = $env{'form.command'};
 
     if ($command eq 'process') {
@@ -102,13 +113,9 @@ sub print_request_form {
     }
     $formname = 'logproblem';
     my $machine = &Apache::lonnet::absolute_url();
-    if ($origurl =~ m-^https?://-) {
-        $server = $origurl;
-    } else {
-        $server = $machine.$origurl;
-    }
-    my $showserver = $server;
-    $showserver =~ s/\?.*$//;
+    my $sourceurl = $machine.$origurl;
+    $server = $machine.&cleanup_html($origurl);
+    $server =~ s/\?.*$//;
     my %lt = &Apache::lonlocal::texthash (
                   email => 'The e-mail address you entered',
                   notv => 'is not a valid e-mail address',
@@ -358,8 +365,8 @@ ENDJS
     $num ++;
     $i = $num%2;
     $output .= &Apache::lonhtmlcommon::row_title("$lt{'urlp'}",undef,$css[$i]).
-               $showserver."\n".'<input type="hidden" name="sourceurl" value="'.
-               &HTML::Entities::encode($server,'"<>&').'" />'."\n".
+               $server."\n".'<input type="hidden" name="sourceurl" value="'.
+               &HTML::Entities::encode($sourceurl,'"<>&').'" />'."\n".
                &Apache::lonhtmlcommon::row_closure().
                &Apache::lonhtmlcommon::row_title("$lt{'phon'}",undef,'LC_evenrow_value').
                '<input type="text" size="15" name="phone" /><br />'."\n".
@@ -634,10 +641,8 @@ sub print_request_receipt {
                  adin        => 'Additional information recorded',
     );
 
-    my (@ok_ccs,@bad_ccs,$badccmsg,$okcclist,$public,$homeserver);
-    if (($env{'user.name'} eq 'public') && ($env{'user.domain'} eq 'public')) {
-        $public = 1;
-    } else {
+    my (@ok_ccs,@bad_ccs,$badccmsg,$okcclist,$homeserver);
+    unless ($public) {
         if (($env{'user.name'} ne '') && ($env{'user.domain'} ne '')) {
             $homeserver = &Apache::lonnet::homeserver($env{'user.name'},
                                                       $env{'user.domain'});
@@ -670,10 +675,11 @@ sub print_request_receipt {
            $okcclist = join(', ',@ok_ccs); 
         } 
         if (@bad_ccs == 1) {
-            $badccmsg .= '<br />'.&mt('The following Cc e-mail address is invalid: ').$bad_ccs[0];
+            if ($bad_ccs[0] ne '') {
+                $badccmsg .= '<br />'.&mt('The following Cc e-mail address is invalid: ').&cleanup_html($bad_ccs[0]);
+            }
         } elsif (@bad_ccs > 1) {
-            my $bad_cc_string = join(', ',@bad_ccs);
-            $badccmsg .= '<br />'.&mt('The following Cc e-mail addresses are invalid: ').$bad_cc_string;
+            $badccmsg .= '<br />'.&mt('The following Cc e-mail addresses are invalid: '). &cleanup_html(join(', ',@bad_ccs));
         }
     }
     $env{'form.user'} = "'".$env{'form.uname'}.':'.$env{'form.udom'}."'";
@@ -709,9 +715,12 @@ END
                     '<span class="LC_helpform_receipt_cat">'.
                     "$lt{$item}</span>: $showurl<br />\n";
             } elsif ($item eq 'cc') {
-                $displaymsg .=
-                    '<span class="LC_helpform_receipt_cat">'.
-                    "$lt{$item}</span>: $okcclist<br />\n";
+                if ($okcclist) {
+                    my $showcclist = &cleanup_html($okcclist);
+                    $displaymsg .=
+                        '<span class="LC_helpform_receipt_cat">'.
+                        "$lt{$item}</span>: $showcclist<br />\n";
+                }
             } else {
                 my $showitem = $env{'form.'.$item};
                 $showitem = &cleanup_html($showitem);
@@ -735,7 +744,7 @@ END
 
     $r->print(<<"END");
 $start_page
-<form name="logproblem">
+<form name="logproblem" action="">
 <input type="hidden" name="command" value="result" />
 </form>
 END
@@ -805,8 +814,7 @@ END
 
     my $attachmentpath = '';
     my $attachmentsize = '';
-    if ((defined($env{'user.name'})) && ($env{'user.name'} ne 'public')
-        && ($env{'user.domain'} ne 'public')) {
+    if ((defined($env{'user.name'})) && (!$public)) {
         if ($homeserver && $env{'form.screenshot.filename'}) {
             $attachmentsize = length($env{'form.screenshot'});
             if ($attachmentsize > 131072) {
@@ -951,8 +959,11 @@ sub print_header {
     } else {
         $reviewtext = &mt('Please review the information in "Log-in help" if you are unable to log-in.');
     }
+    my $linkback;
     if ($origurl eq '') {
-        $origurl = 'javascript:history.go(-1)';
+        $linkback = 'javascript:history.go(-1)';
+    } else {
+        $linkback = &HTML::Entities::encode($origurl,'"<>&');
     }
     my $loginhelp = &Apache::lonauth::loginhelpdisplay();
     if ($loginhelp eq '') {
@@ -972,7 +983,7 @@ sub print_header {
    <tr>
     <td align="center"><span class="LC_nobreak"><img src="$location/help/help.png" border="0" alt="($lt{'login'})" style="vertical-align:middle" />&nbsp;<b><a href="$loginhelp">$lt{'login'}</a></b>&nbsp;</span></td>
     <td align="center"><span class="LC_nobreak">&nbsp;<b>$helpdesk_link<img src="$location/lonIcons/helpdesk.gif" border="0" alt="($lt{'ask'})" style="vertical-align:middle" />&nbsp;$lt{'ask'}</a></b>&nbsp;</span></td>$getstartlink
-    <td align="center"><span class="LC_nobreak">&nbsp;<b><a href="$origurl" target="_top"><img src="$location/lonIcons/move_up.gif" border="0" alt="($lt{'back'})" style="vertical-align:middle" />&nbsp;$lt{'back'}</a></b>&nbsp;</span></td>
+    <td align="center"><span class="LC_nobreak">&nbsp;<b><a href="$linkback" target="_top"><img src="$location/lonIcons/move_up.gif" border="0" alt="($lt{'back'})" style="vertical-align:middle" />&nbsp;$lt{'back'}</a></b>&nbsp;</span></td>
    </tr>
  </table>
 </fieldset>
@@ -1005,8 +1016,11 @@ END
 sub get_domain {
     my $codedom;
     if (exists($env{'form.codedom'})) {
-        $codedom = $env{'form.codedom'};
-    } elsif ($env{'request.course.id'}) {
+        if (&Apache::lonnet::domain($env{'form.codedom'}) ne '') {
+            return $env{'form.codedom'};
+        }
+    }
+    if ($env{'request.course.id'}) {
         $codedom = $env{'course.'.$env{'request.course.id'}.'.domain'};
     } elsif ($env{'request.role.domain'}) {
         $codedom = $env{'request.role.domain'};
@@ -1021,6 +1035,7 @@ sub cleanup_html {
     my $outgoing;
     if ($incoming ne '') {
         $outgoing = $incoming;
+        $outgoing =~ s/;/&#059;/g;
         $outgoing =~ s/\#/&#035;/g;
         $outgoing =~ s/\&/&#038;/g;
         $outgoing =~ s/</&#060;/g;
@@ -1030,6 +1045,9 @@ sub cleanup_html {
         $outgoing =~ s/"/&#034;/g;
         $outgoing =~ s/'/&#039;/g;
         $outgoing =~ s/\$/&#036;/g;
+        $outgoing =~ s{/}{&#047;}g;
+        $outgoing =~ s/=/&#061;/g;
+        $outgoing =~ s/\\/&#092;/g
     }
     return $outgoing;
 }