--- loncom/interface/lonsupportreq.pm	2012/04/18 17:30:24	1.67
+++ loncom/interface/lonsupportreq.pm	2013/01/04 19:07:17	1.67.2.1
@@ -1,5 +1,5 @@
 #
-# $Id: lonsupportreq.pm,v 1.67 2012/04/18 17:30:24 raeburn Exp $
+# $Id: lonsupportreq.pm,v 1.67.2.1 2013/01/04 19:07:17 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -38,7 +38,7 @@ use Apache::lonlocal;
 use Apache::lonacc();
 use Apache::courseclassifier;
 use LONCAPA qw(:DEFAULT :match);
- 
+use HTML::Entities;
 
 sub handler {
     my ($r) = @_;
@@ -56,8 +56,19 @@ sub handler {
     if ($r->uri eq '/adm/helpdesk') {
         &Apache::lonacc::get_posted_cgi($r);
     }
-    my $function = $env{'form.function'};
+    my $function;
+    if ($env{'form.function'}) {
+        if (($env{'form.function'} eq 'norole')  ||
+            ($env{'form.function'} eq 'student') ||
+            ($env{'form.function'} eq 'admin')   ||
+            ($env{'form.function'} eq 'author')) {
+            $function = $env{'form.function'};
+        }
+    }
     my $origurl = $env{'form.origurl'};
+    $origurl =~ s{^https?://}{};
+    $origurl =~ s/(`)//g;
+    $origurl =~ s/\$/\(\$\)/g;
     my $command = $env{'form.command'};
 
     if ($command eq 'process') {
@@ -101,13 +112,9 @@ sub print_request_form {
     }
     $formname = 'logproblem';
     my $machine = &Apache::lonnet::absolute_url();
-    if ($origurl =~ m-^https?://-) {
-        $server = $origurl;
-    } else {
-        $server = $machine.$origurl;
-    }
-    my $showserver = $server;
-    $showserver =~ s/\?.*$//;
+    my $sourceurl = $machine.$origurl;
+    $server = $machine.&cleanup_html($origurl);
+    $server =~ s/\?.*$//;
     my %lt = &Apache::lonlocal::texthash (
                   email => 'The e-mail address you entered',
                   notv => 'is not a valid e-mail address',
@@ -357,8 +364,8 @@ ENDJS
     $num ++;
     $i = $num%2;
     $output .= &Apache::lonhtmlcommon::row_title("$lt{'urlp'}",undef,$css[$i]).
-               $showserver."\n".'<input type="hidden" name="sourceurl" value="'.
-               &HTML::Entities::encode($server,'"<>&').'" />'."\n".
+               $server."\n".'<input type="hidden" name="sourceurl" value="'.
+               &HTML::Entities::encode($sourceurl,'"<>&').'" />'."\n".
                &Apache::lonhtmlcommon::row_closure().
                &Apache::lonhtmlcommon::row_title("$lt{'phon'}",undef,'LC_evenrow_value').
                '<input type="text" size="15" name="phone" /><br />'."\n".
@@ -631,10 +638,11 @@ sub print_request_receipt {
            $okcclist = join(', ',@ok_ccs); 
         } 
         if (@bad_ccs == 1) {
-            $badccmsg .= '<br />'.&mt('The following Cc e-mail address is invalid: ').$bad_ccs[0];
+            if ($bad_ccs[0] ne '') {
+                $badccmsg .= '<br />'.&mt('The following Cc e-mail address is invalid: ').&cleanup_html($bad_ccs[0]);
+            }
         } elsif (@bad_ccs > 1) {
-            my $bad_cc_string = join(', ',@bad_ccs);
-            $badccmsg .= '<br />'.&mt('The following Cc e-mail addresses are invalid: ').$bad_cc_string;
+            $badccmsg .= '<br />'.&mt('The following Cc e-mail addresses are invalid: '). &cleanup_html(join(', ',@bad_ccs));
         }
     }
     $env{'form.user'} = "'".$env{'form.uname'}.':'.$env{'form.udom'}."'";
@@ -670,9 +678,12 @@ END
                     '<span class="LC_helpform_receipt_cat">'.
                     "$lt{$item}</span>: $showurl<br />\n";
             } elsif ($item eq 'cc') {
-                $displaymsg .=
-                    '<span class="LC_helpform_receipt_cat">'.
-                    "$lt{$item}</span>: $okcclist<br />\n";
+                if ($okcclist) {
+                    my $showcclist = &cleanup_html($okcclist);
+                    $displaymsg .=
+                        '<span class="LC_helpform_receipt_cat">'.
+                        "$lt{$item}</span>: $showcclist<br />\n";
+                }
             } else {
                 my $showitem = $env{'form.'.$item};
                 $showitem = &cleanup_html($showitem);
@@ -912,8 +923,11 @@ sub print_header {
     } else {
         $reviewtext = &mt('Please review the information in "Log-in help" if you are unable to log-in.');
     }
+    my $linkback;
     if ($origurl eq '') {
-        $origurl = 'javascript:history.go(-1)';
+        $linkback = 'javascript:history.go(-1)';
+    } else {
+        $linkback = &HTML::Entities::encode($origurl,'"<>&');
     }
     $r->print(<<"END");
 <table width="620" border="0" cellspacing="0" cellpadding="0" style="height: 55px;">
@@ -929,7 +943,7 @@ sub print_header {
    <tr>
     <td align="center"><span class="LC_nobreak"><img src="$location/help/help.png" border="0" alt="($lt{'login'})" style="vertical-align:middle" />&nbsp;<b><a href="/adm/loginproblems.html">$lt{'login'}</a></b>&nbsp;</span></td>
     <td align="center"><span class="LC_nobreak">&nbsp;<b>$helpdesk_link<img src="$location/lonIcons/helpdesk.gif" border="0" alt="($lt{'ask'})" style="vertical-align:middle" />&nbsp;$lt{'ask'}</a></b>&nbsp;</span></td>$getstartlink
-    <td align="center"><span class="LC_nobreak">&nbsp;<b><a href="$origurl" target="_top"><img src="$location/lonIcons/move_up.gif" border="0" alt="($lt{'back'})" style="vertical-align:middle" />&nbsp;$lt{'back'}</a></b>&nbsp;</span></td>
+    <td align="center"><span class="LC_nobreak">&nbsp;<b><a href="$linkback" target="_top"><img src="$location/lonIcons/move_up.gif" border="0" alt="($lt{'back'})" style="vertical-align:middle" />&nbsp;$lt{'back'}</a></b>&nbsp;</span></td>
    </tr>
  </table>
 </fieldset>
@@ -962,8 +976,11 @@ END
 sub get_domain {
     my $codedom;
     if (exists($env{'form.codedom'})) {
-        $codedom = $env{'form.codedom'};
-    } elsif ($env{'request.course.id'}) {
+        if (&Apache::lonnet::domain($env{'form.codedom'}) ne '') {
+            return $env{'form.codedom'};
+        }
+    }
+    if ($env{'request.course.id'}) {
         $codedom = $env{'course.'.$env{'request.course.id'}.'.domain'};
     } elsif ($env{'request.role.domain'}) {
         $codedom = $env{'request.role.domain'};
@@ -978,6 +995,7 @@ sub cleanup_html {
     my $outgoing;
     if ($incoming ne '') {
         $outgoing = $incoming;
+        $outgoing =~ s/;/&#059;/g;
         $outgoing =~ s/\#/&#035;/g;
         $outgoing =~ s/\&/&#038;/g;
         $outgoing =~ s/</&#060;/g;
@@ -987,6 +1005,9 @@ sub cleanup_html {
         $outgoing =~ s/"/&#034;/g;
         $outgoing =~ s/'/&#039;/g;
         $outgoing =~ s/\$/&#036;/g;
+        $outgoing =~ s{/}{&#047;}g;
+        $outgoing =~ s/=/&#061;/g;
+        $outgoing =~ s/\\/&#092;/g
     }
     return $outgoing;
 }