--- loncom/interface/lonwishlist.pm	2014/02/17 16:40:22	1.20
+++ loncom/interface/lonwishlist.pm	2014/12/20 15:35:40	1.24
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Utility-routines for wishlist
 #
-# $Id: lonwishlist.pm,v 1.20 2014/02/17 16:40:22 raeburn Exp $
+# $Id: lonwishlist.pm,v 1.24 2014/12/20 15:35:40 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -94,10 +94,10 @@ my $foldersOption;
 sub getWishlist {
     my @keys = &Apache::lonnet::getkeys('wishlist');
     my %wishlist = &Apache::lonnet::get('wishlist',\@keys);
-    foreach my $i ( keys %wishlist) {
+    foreach my $i (keys(%wishlist)) {
         #File not found. This appears at the first time using the wishlist
         #Create file and put 'root' into it
-       if ($i =~m/^error:No such file/) {
+       if ($i =~m/^\Qerror:No such file\E/) {
            &Apache::lonnet::logthis($i.'! Create file by putting in the "root" of the directory tree.');
            &Apache::lonnet::put('wishlist', {'root' => ''});
            my $options = '<option value="" selected="selected">('.&mt('Top level').')</option>';
@@ -113,7 +113,7 @@ sub getWishlist {
 
     # if we got no keys in hash returned by get(), return error.
     # wishlist will not be loaded, instead the user will be asked to try again later
-    if ((keys %wishlist) == 0) {
+    if ((keys(%wishlist)) == 0) {
         &Apache::lonnet::logthis('ERROR while attempting to get wishlist: no keys retrieved!');
         return 'error';
     }
@@ -197,7 +197,7 @@ sub newEntry() {
     my $date = gmtime();
     # Create Entry-Object
     my $entry = Entry->new(title => $title, path => $path, note => $note, date => $date);
-    # Create Tree-Object, this correspones a node in the wishlist-tree
+    # Create Tree-Object, this corresponds a node in the wishlist-tree
     my $tree = Tree->new($entry);
     # Add this node to wishlist-tree
     my $folderIndex = $env{'form.folders'};
@@ -1131,8 +1131,9 @@ sub wishlistView {
         }
         # entry is a link
         else {
+            my $quotable_link = &Apache::loncommon::escape_single($n->value()->path());
             $wishlistHTMLview .= '<td id="padd'.$index.'" style="padding-left:'.(($indent_view-$indentConst)<=0?$indentConst:$indent_view).'px; min-width: 220px;">'.
-                                 '<a href="javascript:preview('."'".$n->value()->path()."'".');">'.
+                                 '<a href="javascript:preview('."'".$quotable_link."'".');">'.
                                  '<img src="/res/adm/pages/wishlist-link.png" id="img'.$index.'" alt="link" />'.
                                  $n->value()->title().'</a></td>';
         }
@@ -1305,9 +1306,10 @@ sub wishlistMove {
                $highlight = 'style="color:red;"';
             }
             # link-image and title
+            my $quotable_link = &Apache::loncommon::escape_single($n->value()->path());
             $wishlistHTMLmove .= '<td></td>'.
                                  '<td id="padd'.$index.'" style="padding-left:'.(($indent_move-$indentConst)<=0?$indentConst:$indent_move).'px; min-width: 220px;">'.
-                                 '<a href="javascript:preview('."'".$n->value()->path()."'".');" '.$highlight.'>'.
+                                 '<a href="javascript:preview('."'".$quotable_link."'".');" '.$highlight.'>'.
                                  '<img src="/res/adm/pages/wishlist-link.png" id="img'.$index.'" alt="link"/>'.
                                  $n->value()->title().'</a></td>';
         }
@@ -1361,16 +1363,30 @@ sub wishlistImport {
 
     foreach my $n (@$nodes) {
         my $index = $n->value()->nindex();
+
+        #
+        # Determine which resources in stored links may be imported into a course/community.
+        # (a) Import of directories in /res space is not supported.
+        # (b) Import of a resource into a community requires user has 'bro' privilege for resource
+        #     (i.e., user has author or co-author role for corresponcding Authoring Space).
+        # (c) Import of a resource into a course requires user has 'be' privilege for resource.
+        #
+
         if ($n->value()->path() =~ m{^(/res/$match_domain/$match_username/)}) {
-            if ($is_community) {
-                unless (&Apache::lonnet::allowed('bro',$n->value()->path())) {
-                    $nopick{$n->value()->path()} = $n->value()->title();
-                    $$numskipped ++;
-                }
+            if ($n->value()->path() =~ m{/$}) {
+                $nopick{$n->value()->path()} = $n->value()->title();
+                $$numskipped ++;
             } else {
-                unless (&Apache::lonnet::allowed('bre',$n->value()->path())) {
-                    $nopick{$n->value()->path()} = $n->value()->title();
-                    $$numskipped ++;
+                if ($is_community) {
+                    unless (&Apache::lonnet::allowed('bro',$n->value()->path())) {
+                        $nopick{$n->value()->path()} = $n->value()->title();
+                        $$numskipped ++;
+                    }
+                } else {
+                    unless (&Apache::lonnet::allowed('bre',$n->value()->path())) {
+                        $nopick{$n->value()->path()} = $n->value()->title();
+                        $$numskipped ++;
+                    }
                 }
             }
         }
@@ -1411,7 +1427,8 @@ sub wishlistImport {
         else {
             $wishlistHTMLimport .= '<td id="padd'.$index.'" style="padding-left:'.(($indent_imp-$indentConst)<=0?$indentConst:$indent_imp).'px; min-width: 220px;">';
             unless ($nopick{$n->value()->path()}) {
-                $wishlistHTMLimport .= '<a href="javascript:preview('."'".$n->value()->path()."'".');">';
+                my $quotable_link = &Apache::loncommon::escape_single($n->value()->path());
+                $wishlistHTMLimport .= '<a href="javascript:preview('."'".$quotable_link."'".');">';
             }
             $wishlistHTMLimport .= '<img src="/res/adm/pages/'.$image.'" id="img'.$index.'" alt="link" />'.
                                    '<span '.$style.'>'.$n->value()->title().'</span></a></td>';
@@ -1855,13 +1872,13 @@ sub makePageImport {
     #FIXME Saved string containing all folders in wishlist.db-file (key 'folders') in first version of lonwishlist
     #After splitting lonwishlist into two modules, this is not necessary anymore. So, dependent from when the wishlist
     #was first called (i.e. when wishlist.db was created), there might be an entry 'folders' or not. Number of links in
-    #wishlist.db depends on wether this entry exists or not...JW  
+    #wishlist.db depends on whether this entry exists or not...JW  
     my $fnum;
     if (defined $wishlist{'folders'}) {
-        $fnum = (keys %wishlist)-2;
+        $fnum = (keys(%wishlist))-2;
     }
     else {
-        $fnum = (keys %wishlist)-1;
+        $fnum = (keys(%wishlist))-1;
     }
 
     $inner .= '<form method="post" name="groupsort" action="">'.
@@ -2111,7 +2128,7 @@ sub HashToTree {
     my @TreeNodes = ();
     my $root;
 
-    foreach my $key (keys %$TreeHash) {
+    foreach my $key (keys(%$TreeHash)) {
         if ($key eq 'root') {
             $root = Tree->new("root");
         }