--- loncom/interface/lonsyllabus.pm	2020/01/20 17:21:08	1.138.2.5.2.2
+++ loncom/interface/lonsyllabus.pm	2025/03/16 21:04:09	1.157
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # Syllabus
 #
-# $Id: lonsyllabus.pm,v 1.138.2.5.2.2 2020/01/20 17:21:08 raeburn Exp $
+# $Id: lonsyllabus.pm,v 1.157 2025/03/16 21:04:09 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -40,6 +40,7 @@ use Apache::lonannounce;
 use Apache::lonlocal;
 use Apache::lonhtmlcommon;
 use Apache::lonspeller();
+use Apache::lonwrapper();
 use HTML::Entities();
 
 sub handler {
@@ -152,8 +153,20 @@ sub handler {
                     &Apache::structuretags::reset_problem_globals();
                     my $oldfile = $env{'request.filename'};
                     $env{'request.filename'} = $item;
+                    my $oldinhibit;
+                    if ($env{'form.only_body'}) {
+                        $oldinhibit = $env{'form.inhibitmenu'};
+                        $env{'form.inhibitmenu'} = 'yes';
+                    }
                     my $result = &Apache::lonxml::xmlparse($r,$target,$filecontents,
                                                            '',%mystyle);
+                    if ($env{'form.only_body'}) {
+                        if ($oldinhibit ne '') {
+                            $env{'form.inhibitmenu'} = $oldinhibit;
+                        } else {
+                            delete($env{'form.inhibitmenu'});
+                        }
+                    }
                     &Apache::structuretags::reset_problem_globals();
                     &Apache::lonhomework::finished_parsing();
                     $env{'request.filename'} = $oldfile;
@@ -170,6 +183,7 @@ sub handler {
                 } else {
                     my $brcrum;
                     if ($env{'form.folderpath'} =~ /^supplemental/) {
+                        &Apache::loncommon::validate_folderpath(1,'',$cnum,$cdom);
                         my $title = $env{'form.title'};
                         if ($title eq '') {
                             $title = &mt('Syllabus');
@@ -187,7 +201,8 @@ sub handler {
         unless ($allowed && $forceedit) {
             if (($env{'user.name'} eq 'public') && ($env{'user.domain'} eq 'public') &&
                 ($ENV{'SERVER_PORT'} == 443) && ($external =~ m{^http://}) && !($env{'form.usehttp'})) {
-                unless (&Apache::lonnet::uses_sts()) {
+                my $hostname = $r->hostname();
+                unless ((&Apache::lonnet::uses_sts()) || (&Apache::lonnet::waf_allssl($hostname))) {
                     &redirect_to_http($r);
                     return OK;
                 }
@@ -204,10 +219,12 @@ sub handler {
                     $is_pdf = 1;
                 }
                 if ($env{'form.folderpath'} =~ /^supplemental/) {
+                    &Apache::loncommon::validate_folderpath(1,'',$cnum,$cdom);
                     my $title = $env{'form.title'};
                     if ($title eq '') {
                         $title = &mt('Syllabus');
                     }
+                    $title = &HTML::Entities::encode($title,'\'"<>&');
                     $brcrum =
                         &Apache::lonhtmlcommon::docs_breadcrumbs(undef,$crstype,undef,$title,1);
                 }
@@ -313,10 +330,8 @@ sub handler {
     if ($allowed) {
 #---------------------------------- Print External URL Syllabus Info if editing
         if ($target ne 'tex') {
-            my $hostname = &Apache::lonnet::hostname($homeserver);
-            my $protocol = $Apache::lonnet::protocol{$homeserver};
-            $protocol = 'http' if ($protocol ne 'https');
-            my $link = $protocol.'://'.$hostname.$r->uri;
+            my $link = &Apache::lonnet::url_prefix($r,$cdom,$homeserver,'web').
+                       $r->uri;
             $r->print('<div class="LC_left_float">'
                      .'<span class="LC_help_open_topic LC_info">'
                      .'<span class="LC_info">'
@@ -325,7 +340,7 @@ sub handler {
                      .'</span>'
                      .'</div><div style="padding:0;clear:both;margin:0;border:0"></div>'."\n");
             my $lonhost = $r->dir_config('lonHostID');
-            $r->print(&chooser($external,$uploaded,$minimal,$cdom,$cnum,$lonhost,
+            $r->print(&chooser($r,$external,$uploaded,$minimal,$cdom,$cnum,$lonhost,
                                \%syllabusfields,\%syllabus));
         }
     } else {
@@ -433,7 +448,7 @@ sub handler {
                                                        'box_111_showrssfeeds',$display);
             my ($numfeeds,$hiddenfeeds,$rsslinktext);
             my $feeds=&Apache::lonrss::advertisefeeds($cnum,$cdom,$forceedit,\$numfeeds,
-                                                      \$hiddenfeeds);
+                                                      \$hiddenfeeds,1);
             if ($numfeeds) {
                 $r->print($feeds);
                 $rsslinktext = &mt('New RSS Feed or Blog');
@@ -461,7 +476,7 @@ sub handler {
             &Apache::lontemplate::print_end_template($r);
         } else {
             unless ($hidefeeds) {
-                my $feeds = &Apache::lonrss::advertisefeeds($cnum,$cdom,$forceedit);
+                my $feeds = &Apache::lonrss::advertisefeeds($cnum,$cdom,$forceedit,'','',1);
                 if ($feeds ne '') {
                     &Apache::lontemplate::print_start_template($r,&mt('RSS Feeds and Blogs'),'LC_Box');
                     $r->print($feeds);
@@ -506,7 +521,7 @@ sub handler {
 				 $r->print($urls);
 				 $r->print("<br /><div>");
 				 &Apache::lontemplate::print_textarea_template($r, $data{$field},
-					$field, Apache::lontemplate->RICH_TEXT_ALWAYS_OFF);
+					$field, $fields{$field}, Apache::lontemplate->RICH_TEXT_ALWAYS_OFF);
 				 &Apache::lontemplate::print_saveall_template($r);                         
 				 $r->print("</div>");
 				 &Apache::lontemplate::print_end_template($r);
@@ -764,6 +779,7 @@ sub get_breadcrumbs{
     my ($cdom,$cnum,$crstype,$args) = @_;
     return unless (ref($args) eq 'HASH');
     if ($env{'form.folderpath'} =~ /^supplemental/) {
+        &Apache::loncommon::validate_folderpath(1,'',$cnum,$cdom);
         my $title = $env{'form.title'};
         if ($title eq '') {
             $title = &mt('Syllabus');
@@ -772,6 +788,7 @@ sub get_breadcrumbs{
             &Apache::lonhtmlcommon::docs_breadcrumbs(undef,$crstype,undef,$title,1);
         if (ref($brcrum) eq 'ARRAY') {
             $args->{'bread_crumbs'} = $brcrum;
+            $args->{'bread_crumbs_nomenu'} = 1;
         }
     } else {
         if ((&Apache::lonnet::is_on_map("public/$cdom/$cnum/syllabus"))
@@ -788,7 +805,7 @@ sub get_breadcrumbs{
 }
 
 sub chooser {
-    my ($external,$uploaded,$minimal,$cdom,$cnum,$lonhost,$fields,$values) = @_;
+    my ($r,$external,$uploaded,$minimal,$cdom,$cnum,$lonhost,$fields,$values) = @_;
     my %lt = &Apache::lonlocal::texthash(
                  'type'          => 'Syllabus Type',
                  'url'           => 'External URL',
@@ -843,30 +860,31 @@ sub chooser {
         $output .= '<label><input type="radio" name="choice" value="'.$item.'" '.$checked{$item}.' onclick="toggleEditor('."'$item'".')" />'.
                    $lt{$item}.'</label><br />';
     }
+    my $urllabeltext = &HTML::Entities::encode(&mt('Enter URL'),'"&<>');
     $output .= '</fieldset></div>'."\n".
                '<div id="url" class="LC_left_float" style="display: '.$display{'url'}.'">'."\n".
                '<fieldset><legend>'.$lt{'chourl'}.'</legend><span class="LC_nobreak">'."\n".
                '<a href="javascript:extUrlPreview('."'syllabusurl','$protocol'".');">'.$lt{'pr'}.'</a></span>&nbsp;'."\n".
-               '<input type="text" id="syllabusurl" name="externalsyllabus" value="'.$external.'" size="55" />'."\n".
+               '<input type="text" id="syllabusurl" name="externalsyllabus" value="'.$external.'" size="55" aria-label="'.$urllabeltext.'" />'."\n".
                '&nbsp;<input type="submit" name="storeurl" value="'.$lt{'save'}.'" />'."\n".
                '</fieldset></div>'."\n".
                '<div id="minimal" class="LC_left_float" style="display: '.$display{'minimal'}.'">'."\n".
                '<fieldset><legend>'.$lt{'minimal'}.'</legend>';
     if ($minimal) {
-        my ($absurl,$filename,$depbutton) = &syllabus_file_info($minimal,$cnum,$cdom,$lonhost,'minimal');
+        my ($absurl,$filename,$depbutton) = &syllabus_file_info($r,$minimal,$cnum,$cdom,$lonhost,'minimal');
         $output .= '<a href="javascript:extUrlPreview('."'currminimal'".');">'.$lt{'pr'}.'</a>'.
                    '<input type="hidden" name="minimalfile" value="'.&HTML::Entities::encode($absurl).'?inhibitmenu=yes" id="currminimal" />'.
                    $depbutton;
     } else {
-        $output .= &mt('Title of Syllabus Page:').'&nbsp;'.
-                   '<input type="text" id="minimaltitle" name="syllabustitle" value="'.&mt('Syllabus').'" size="30" />'."\n".
+        $output .= '<label>'.&mt('Title of Syllabus Page:').'&nbsp;'.
+                   '<input type="text" id="minimaltitle" name="syllabustitle" value="'.&mt('Syllabus').'" size="30" /></label>'."\n".
                    '&nbsp;<input type="submit" name="storeminimal" value="'.$lt{'sved'}.'" />'."\n";
     }
     $output .= '</fieldset></div>'."\n".
                '<div id="file" class="LC_left_float" style="display: '.$display{'file'}.'">'."\n".
                '<fieldset><legend>'.$lt{'file'}.'</legend>';
     if ($uploaded) {
-        my ($absurl,$filename,$depbutton) = &syllabus_file_info($uploaded,$cnum,$cdom,$lonhost,'file');
+        my ($absurl,$filename,$depbutton) = &syllabus_file_info($r,$uploaded,$cnum,$cdom,$lonhost,'file');
         $output .= '<span class="LC_nobreak">'.$lt{'curr'}.'&nbsp;'.
                    '<input type="hidden" name="uploadedfile" value="'.&HTML::Entities::encode($absurl).'?inhibitmenu=yes" id="currfile" />'.
                    '<a href="javascript:extUrlPreview('."'currfile'".');">'.$filename.'</a></span>'.$depbutton.
@@ -874,9 +892,10 @@ sub chooser {
     } else {
         $output .= $lt{'upl'};
     }
+    my $labeltext = &HTML::Entities::encode(&mt('Choose syllabus file'),'"&<>');
     $output .= '<br />'."\n".
                '<span class="LC_nobreak">'.
-               '<input type="file" name="syllabusfile" size="55" />'."\n".
+               '<input type="file" name="syllabusfile" size="55" aria-label="'.$labeltext.'" />'."\n".
                '&nbsp;<input type="submit" name="storefile" value="'.$lt{'save'}.'" />'.
                '</span><br />'.
                '<label>'.
@@ -901,10 +920,12 @@ sub chooser {
 }
 
 sub syllabus_file_info {
-    my ($item,$cnum,$cdom,$lonhost,$context) = @_;
+    my ($r,$item,$cnum,$cdom,$lonhost,$context) = @_;
     my $hostname = &Apache::lonnet::hostname($lonhost);
     my $protocol = $Apache::lonnet::protocol{$lonhost};
     $protocol = 'http' if ($protocol ne 'https');
+    my $alias = &Apache::lonnet::use_proxy_alias($r,$lonhost);
+    $hostname = $alias if ($alias ne '');
     my $absurl = $protocol.'://'.$hostname.$item;
     my ($filename) = ($item =~ m{([^/]+)$});
     my $file=&Apache::lonnet::filelocation("",$item);
@@ -1038,7 +1059,7 @@ sub get_personnel {
         if ($allowed) {
             $r->print(&Apache::loncommon::start_data_table().
                       &Apache::loncommon::start_data_table_header_row().
-                      '<th>'.&mt('Role hidden?').'</th><th>'.&mt('Role').'</th>'.
+                      '<th>'.&mt('Role (hidden if checked)').'</th>'.
                       '<th>'.&mt('Personnel (hidden if checked)').'</th>'.
                       &Apache::loncommon::end_data_table_header_row());
         } else {
@@ -1070,10 +1091,9 @@ sub get_personnel {
                     $checked = ' checked="checked"';
                 }
                 $r->print(&Apache::loncommon::start_data_table_row().
-                          '<td>'.
+                          '<td><span class="LC_nobreak"><label>'.
                           '<input type="checkbox" name="hiderole" value="'.$element.'" '.
-                          $checked.' />'.
-                          '</td><td>'.$roletext.'</td><td>');
+                          $checked.' />'.$roletext.'</label></span></td><td>');
             } else {
                 $r->print(&Apache::lonhtmlcommon::row_title($roletext));
             }
@@ -1315,8 +1335,8 @@ sub save_changes {
                               &mt('An error occurred storing the external URL: [_1]',$putres).
                               '</div>';
                 }
-                $is_ext = $external;
             }
+            $is_ext = $external;
         } else {
             $output = '<div class="LC_error">'.
                       &mt('External URL not saved -- invalid URL.').