--- loncom/interface/lonsupportreq.pm	2012/04/18 17:30:24	1.67
+++ loncom/interface/lonsupportreq.pm	2013/01/04 18:35:12	1.72
@@ -1,5 +1,5 @@
 #
-# $Id: lonsupportreq.pm,v 1.67 2012/04/18 17:30:24 raeburn Exp $
+# $Id: lonsupportreq.pm,v 1.72 2013/01/04 18:35:12 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -36,9 +36,10 @@ use Apache::lonhtmlcommon;
 use Apache::lonnet;
 use Apache::lonlocal;
 use Apache::lonacc();
+use Apache::lonauth();
 use Apache::courseclassifier;
 use LONCAPA qw(:DEFAULT :match);
- 
+use HTML::Entities;
 
 sub handler {
     my ($r) = @_;
@@ -56,8 +57,19 @@ sub handler {
     if ($r->uri eq '/adm/helpdesk') {
         &Apache::lonacc::get_posted_cgi($r);
     }
-    my $function = $env{'form.function'};
+    my $function;
+    if ($env{'form.function'}) {
+        if (($env{'form.function'} eq 'norole')  ||
+            ($env{'form.function'} eq 'student') ||
+            ($env{'form.function'} eq 'admin')   ||
+            ($env{'form.function'} eq 'author')) {
+            $function = $env{'form.function'};
+        }
+    }
     my $origurl = $env{'form.origurl'};
+    $origurl =~ s{^https?://}{};
+    $origurl =~ s/(`)//g;
+    $origurl =~ s/\$/\(\$\)/g;
     my $command = $env{'form.command'};
 
     if ($command eq 'process') {
@@ -101,13 +113,9 @@ sub print_request_form {
     }
     $formname = 'logproblem';
     my $machine = &Apache::lonnet::absolute_url();
-    if ($origurl =~ m-^https?://-) {
-        $server = $origurl;
-    } else {
-        $server = $machine.$origurl;
-    }
-    my $showserver = $server;
-    $showserver =~ s/\?.*$//;
+    my $sourceurl = $machine.$origurl;
+    $server = $machine.&cleanup_html($origurl);
+    $server =~ s/\?.*$//;
     my %lt = &Apache::lonlocal::texthash (
                   email => 'The e-mail address you entered',
                   notv => 'is not a valid e-mail address',
@@ -357,8 +365,8 @@ ENDJS
     $num ++;
     $i = $num%2;
     $output .= &Apache::lonhtmlcommon::row_title("$lt{'urlp'}",undef,$css[$i]).
-               $showserver."\n".'<input type="hidden" name="sourceurl" value="'.
-               &HTML::Entities::encode($server,'"<>&').'" />'."\n".
+               $server."\n".'<input type="hidden" name="sourceurl" value="'.
+               &HTML::Entities::encode($sourceurl,'"<>&').'" />'."\n".
                &Apache::lonhtmlcommon::row_closure().
                &Apache::lonhtmlcommon::row_title("$lt{'phon'}",undef,'LC_evenrow_value').
                '<input type="text" size="15" name="phone" /><br />'."\n".
@@ -487,6 +495,18 @@ ENDJS
             $num ++;
             $i = $num%2;
         }
+    } else {
+        my $lonhost = $r->dir_config('lonHostID');
+        my ($captchaform,$error) = 
+            &Apache::loncommon::captcha_display('login',$lonhost);
+        if ($captchaform) {
+            $output .= &Apache::lonhtmlcommon::row_title(&mt('Validation'),undef,
+                                                         $css[$i])."\n".
+                       $captchaform."\n".
+                       &Apache::lonhtmlcommon::row_closure();
+            $num ++;
+            $i = $num%2;
+        }
     }
     $output .= &Apache::lonhtmlcommon::row_title($lt{'fini'},undef,$css[$i]);
     $output .= <<END;
@@ -516,6 +536,32 @@ END
 
 sub print_request_receipt {
     my ($r,$url,$function) = @_;
+    my $public;
+    if (($env{'user.name'} eq 'public') && ($env{'user.domain'} eq 'public')) {
+        $public = 1;
+    }
+    unless (($env{'user.name'} =~ /^$match_username$/) && (!$public)) {
+        my $lonhost = $r->dir_config('lonHostID');
+        my ($captcha_chk,$captcha_error) = 
+            &Apache::loncommon::captcha_response('login',$lonhost);
+        if ($captcha_chk != 1) {
+            $r->print(&Apache::loncommon::start_page('Support request failed',undef,
+                                       {'function'    => $function,
+                                        'add_entries' => {
+                                            topmargin    => "0",
+                                            marginheight => "0",
+                                        },
+                                        'only_body'   => 1,}));
+            if ($r->uri eq '/adm/helpdesk') {
+                &print_header($r,$url,'process');
+            }
+            $r->print('<h3>'.&mt('Support request failed').'</h3>'.
+                      '<span class="LC_error">'.
+                      &mt('Validation of the code you entered failed.').
+                      &Apache::loncommon::end_page());
+            return;
+        }
+    }
     my @ENVvars = ('HTTP_HOST','HTTP_USER_AGENT','REMOTE_ADDR','SERVER_ADDR','SERVER_NAME');
     my @envvars = ('browser.os','browser.type','browser.version','user.home','request.role');
     my @loncvars = ('user.name','user.domain','request.course.sec','request.course.id');
@@ -595,10 +641,8 @@ sub print_request_receipt {
                  adin        => 'Additional information recorded',
     );
 
-    my (@ok_ccs,@bad_ccs,$badccmsg,$okcclist,$public,$homeserver);
-    if (($env{'user.name'} eq 'public') && ($env{'user.domain'} eq 'public')) {
-        $public = 1;
-    } else {
+    my (@ok_ccs,@bad_ccs,$badccmsg,$okcclist,$homeserver);
+    unless ($public) {
         if (($env{'user.name'} ne '') && ($env{'user.domain'} ne '')) {
             $homeserver = &Apache::lonnet::homeserver($env{'user.name'},
                                                       $env{'user.domain'});
@@ -631,10 +675,11 @@ sub print_request_receipt {
            $okcclist = join(', ',@ok_ccs); 
         } 
         if (@bad_ccs == 1) {
-            $badccmsg .= '<br />'.&mt('The following Cc e-mail address is invalid: ').$bad_ccs[0];
+            if ($bad_ccs[0] ne '') {
+                $badccmsg .= '<br />'.&mt('The following Cc e-mail address is invalid: ').&cleanup_html($bad_ccs[0]);
+            }
         } elsif (@bad_ccs > 1) {
-            my $bad_cc_string = join(', ',@bad_ccs);
-            $badccmsg .= '<br />'.&mt('The following Cc e-mail addresses are invalid: ').$bad_cc_string;
+            $badccmsg .= '<br />'.&mt('The following Cc e-mail addresses are invalid: '). &cleanup_html(join(', ',@bad_ccs));
         }
     }
     $env{'form.user'} = "'".$env{'form.uname'}.':'.$env{'form.udom'}."'";
@@ -670,9 +715,12 @@ END
                     '<span class="LC_helpform_receipt_cat">'.
                     "$lt{$item}</span>: $showurl<br />\n";
             } elsif ($item eq 'cc') {
-                $displaymsg .=
-                    '<span class="LC_helpform_receipt_cat">'.
-                    "$lt{$item}</span>: $okcclist<br />\n";
+                if ($okcclist) {
+                    my $showcclist = &cleanup_html($okcclist);
+                    $displaymsg .=
+                        '<span class="LC_helpform_receipt_cat">'.
+                        "$lt{$item}</span>: $showcclist<br />\n";
+                }
             } else {
                 my $showitem = $env{'form.'.$item};
                 $showitem = &cleanup_html($showitem);
@@ -766,8 +814,7 @@ END
 
     my $attachmentpath = '';
     my $attachmentsize = '';
-    if ((defined($env{'user.name'})) && ($env{'user.name'} ne 'public')
-        && ($env{'user.domain'} ne 'public')) {
+    if ((defined($env{'user.name'})) && (!$public)) {
         if ($homeserver && $env{'form.screenshot.filename'}) {
             $attachmentsize = length($env{'form.screenshot'});
             if ($attachmentsize > 131072) {
@@ -912,8 +959,15 @@ sub print_header {
     } else {
         $reviewtext = &mt('Please review the information in "Log-in help" if you are unable to log-in.');
     }
+    my $linkback;
     if ($origurl eq '') {
-        $origurl = 'javascript:history.go(-1)';
+        $linkback = 'javascript:history.go(-1)';
+    } else {
+        $linkback = &HTML::Entities::encode($origurl,'"<>&');
+    }
+    my $loginhelp = &Apache::lonauth::loginhelpdisplay();
+    if ($loginhelp eq '') {
+        $loginhelp = '/adm/loginproblems.html';
     }
     $r->print(<<"END");
 <table width="620" border="0" cellspacing="0" cellpadding="0" style="height: 55px;">
@@ -927,9 +981,9 @@ sub print_header {
       </legend>
  <table id="LC_helpmenu_links">
    <tr>
-    <td align="center"><span class="LC_nobreak"><img src="$location/help/help.png" border="0" alt="($lt{'login'})" style="vertical-align:middle" />&nbsp;<b><a href="/adm/loginproblems.html">$lt{'login'}</a></b>&nbsp;</span></td>
+    <td align="center"><span class="LC_nobreak"><img src="$location/help/help.png" border="0" alt="($lt{'login'})" style="vertical-align:middle" />&nbsp;<b><a href="$loginhelp">$lt{'login'}</a></b>&nbsp;</span></td>
     <td align="center"><span class="LC_nobreak">&nbsp;<b>$helpdesk_link<img src="$location/lonIcons/helpdesk.gif" border="0" alt="($lt{'ask'})" style="vertical-align:middle" />&nbsp;$lt{'ask'}</a></b>&nbsp;</span></td>$getstartlink
-    <td align="center"><span class="LC_nobreak">&nbsp;<b><a href="$origurl" target="_top"><img src="$location/lonIcons/move_up.gif" border="0" alt="($lt{'back'})" style="vertical-align:middle" />&nbsp;$lt{'back'}</a></b>&nbsp;</span></td>
+    <td align="center"><span class="LC_nobreak">&nbsp;<b><a href="$linkback" target="_top"><img src="$location/lonIcons/move_up.gif" border="0" alt="($lt{'back'})" style="vertical-align:middle" />&nbsp;$lt{'back'}</a></b>&nbsp;</span></td>
    </tr>
  </table>
 </fieldset>
@@ -962,8 +1016,11 @@ END
 sub get_domain {
     my $codedom;
     if (exists($env{'form.codedom'})) {
-        $codedom = $env{'form.codedom'};
-    } elsif ($env{'request.course.id'}) {
+        if (&Apache::lonnet::domain($env{'form.codedom'}) ne '') {
+            return $env{'form.codedom'};
+        }
+    }
+    if ($env{'request.course.id'}) {
         $codedom = $env{'course.'.$env{'request.course.id'}.'.domain'};
     } elsif ($env{'request.role.domain'}) {
         $codedom = $env{'request.role.domain'};
@@ -978,6 +1035,7 @@ sub cleanup_html {
     my $outgoing;
     if ($incoming ne '') {
         $outgoing = $incoming;
+        $outgoing =~ s/;/&#059;/g;
         $outgoing =~ s/\#/&#035;/g;
         $outgoing =~ s/\&/&#038;/g;
         $outgoing =~ s/</&#060;/g;
@@ -987,6 +1045,9 @@ sub cleanup_html {
         $outgoing =~ s/"/&#034;/g;
         $outgoing =~ s/'/&#039;/g;
         $outgoing =~ s/\$/&#036;/g;
+        $outgoing =~ s{/}{&#047;}g;
+        $outgoing =~ s/=/&#061;/g;
+        $outgoing =~ s/\\/&#092;/g
     }
     return $outgoing;
 }