--- loncom/interface/portfolio.pm	2006/06/22 15:56:03	1.112
+++ loncom/interface/portfolio.pm	2006/06/22 16:51:00	1.113
@@ -31,7 +31,7 @@ use Apache::lonfeedback;
 use Apache::lonlocal;
 use Apache::lonnet;
 use Apache::longroup;
-use lib '/home/httpd/lib/perl';
+use HTML::Entities;
 use LONCAPA;
 
 # receives a file name and path stub from username/userfiles/portfolio/
@@ -40,9 +40,9 @@ sub make_anchor {
     my ($url, $filename, $current_path, $current_mode, $field_name,
         $continue_select,$group) = @_;
     if ($continue_select ne 'true') {$continue_select = 'false'};
-    my $anchor = '<a href="'.$url.'?selectfile='.$filename.'&currentpath='.$current_path.'&mode='.$current_mode.'&continue='.$continue_select.'&fieldname='.$field_name;
+    my $anchor = '<a href="'.$url.'?selectfile='.$filename.'&amp;currentpath='.$current_path.'&amp;mode='.$current_mode.'&amp;continue='.$continue_select.'&amp;fieldname='.$field_name;
     if (defined($group)) {
-        $anchor .= '&group='.$group;
+        $anchor .= '&amp;group='.$group;
     }
     $anchor .= '">'.$filename.'</a>';
     return $anchor;
@@ -63,38 +63,39 @@ sub display_common {
 					 'createdir' => 'Create Subdirectory',
 					 'createdir_label' => 
 					 'Create subdirectory in current directory:');
+    my $escuri = &HTML::Entities::encode($r->uri,'&<>"');
     $r->print(<<"TABLE"); 
 <table border="0" cellspacing="2" cellpadding="2">
-  <form method="post" enctype="multipart/form-data">
-    <tr valign="middle">
-      <td bgcolor="#ccddaa" align="right">
-        $text{'upload_label'}
-      </td>
-      <td bgcolor="#ccddaa" align="left">$groupitem
+  <tr valign="middle">
+    <td bgcolor="#ccddaa" align="right">
+      $text{'upload_label'}
+    </td>
+    <td bgcolor="#ccddaa" align="left">$groupitem
+      <form method="post" enctype="multipart/form-data" action="$escuri">
         <input name="uploaddoc" type="file" />
 	<input type="hidden" name="currentpath" value="$current_path" />
 	<input type="hidden" name="action" value="$env{"form.action"}" />
 	<input type="hidden" name="fieldname" value="$env{"form.fieldname"}" />
 	<input type="hidden" name="mode" value="$env{"form.mode"}" />
 	<input type="submit" name="storeupl" value="$text{'upload'}" />
-      </td>
-    </tr>
-  </form>
-  <form method="post">
-    <tr>
-      <td bgcolor="#ccddaa" align="right">
-        $text{'createdir_label'}
-      </td>
-      <td bgcolor="#ccddaa" align="left">
+      </form>
+    </td>
+  </tr>
+  <tr>
+    <td bgcolor="#ccddaa" align="right">
+      $text{'createdir_label'}
+    </td>
+    <td bgcolor="#ccddaa" align="left">
+      <form method="post" action="$escuri">
         <input name="newdir" type="input" />$groupitem
         <input type="hidden" name="currentpath" value="$current_path" />
         <input type="hidden" name="action" value="$env{"form.action"}" />
         <input type="hidden" name="fieldname" value="$env{"form.fieldname"}" />
         <input type="hidden" name="mode" value="$env{"form.mode"}" />
         <input type="submit" name="createdir" value="$text{'createdir'}" />
-      </td>
-    </tr>
-  </form>
+      </form>
+    </td>
+  </tr>
 </table>
 TABLE
     my @tree = split (/\//,$current_path);
@@ -108,9 +109,9 @@ TABLE
     }
     $r->print('</font>');
     &Apache::lonhtmlcommon::store_recent($namespace,$current_path,$current_path);
-    $r->print('<br /><form method=post action="'.$url.'?mode='.$env{"form.mode"}.'&fieldname='.$env{"form.fieldname"});
+    $r->print('<br /><form method="post" action="'.$url.'?mode='.$env{"form.mode"}.'&amp;fieldname='.$env{"form.fieldname"});
     if (defined($group)) {
-        $r->print('&group='.$group);
+        $r->print('&amp;group='.$group);
     }
     $r->print('">'.
 	      &Apache::lonhtmlcommon::select_recent($namespace,'currentpath',
@@ -153,13 +154,13 @@ sub display_directory {
 	return;
     }
     if ($select_mode eq 'true') {
+        $r->print('<form method="post" name="checkselect" action="'.$url.'">');
         $r->print('<table border="0" cellspacing="2" cellpadding="2">'.
             '<tr><th>Select</th><th>&nbsp;</th><th>Name</th><th>Size</th><th>Last Modified</th></tr>');
-        $r->print('<form method="post" name="checkselect" action="'.$url.'">');
     } else {
+        $r->print('<form method="post" action="'.$url.'">');
         $r->print('<table border="0" cellspacing="2" cellpadding="2">'.
             '<tr><th colspan="2">Actions</th><th>&nbsp;</th><th>Name</th><th>Size</th><th>Last Modified</th><th>Current Access Status</th></tr>');
-        $r->print('<form method="post" action="'.$url.'">');
     }
     if (defined($group)) {
         $r->print("\n".$groupitem."\n");
@@ -190,9 +191,9 @@ sub display_directory {
     	if (($filename ne '.') && ($filename ne '..') && ($filename !~ /\.meta$/ ) && ($filename !~ /(.*)\.(\d+)\.([^\.]*)$/)) {
             if ($dirptr&$testdir) {
                 if ($select_mode eq 'true'){
-                    $r->print('<tr bgcolor="#FFAA99"><td><img src="'.$iconpath.'folder_closed.gif"></td>');
+                    $r->print('<tr bgcolor="#FFAA99"><td><img alt="'.&mt('open folder').'" src="'.$iconpath.'folder_closed.gif" /></td>');
                 } else {
-                    $r->print('<tr bgcolor="#FFAA99"><td colspan="2"><img src="'.$iconpath.'folder_closed.gif"></td>');
+                    $r->print('<tr bgcolor="#FFAA99"><td colspan="2"><img alt="'.&mt('closed folder').'" src="'.$iconpath.'folder_closed.gif" /></td>');
                 }
                 $r->print('<td>Go to ...</td>');
                 $r->print('<td>'.&make_anchor($url,$filename.'/',$current_path.$filename.'/',$env{'form.mode'},$env{"form.fieldname"},$env{'form.continue'},$group).'</td>'); 
@@ -256,7 +257,7 @@ sub display_directory {
                     }
                     $curr_access = join('+ ',@allaccesses);
                 }
-                $r->print('<td><img src="'.&Apache::loncommon::icon($filename).'"></td>');
+                $r->print('<td><img alt="" src="'.&Apache::loncommon::icon($filename).'" /></td>');
                 $r->print('<td><a href="'.$href_location.$filename.'">'.
 			    $filename.'</a></td>'); 
                 $r->print('<td>'.$size.'</td>');
@@ -693,7 +694,7 @@ sub update_access {
         &close_form($r,$url,$group);
     } else {
         $r->print('<br /><a href="'.$url.'?access='.$env{'form.selectfile'}.
-                  '&currentpath='.$env{'form.currentpath'}.'">'.
+                  '&amp;currentpath='.$env{'form.currentpath'}.'">'.
                    &mt('Display all access settings for this file').'</a>');
     }
     return;
@@ -1277,7 +1278,7 @@ sub select_files {
         $java_files.=',';
     }
     my $javascript =(<<ENDSMP);
-        <script language='javascript'>
+        <script type="text/javascript">
         function finishSelect() {
 ENDSMP
     $javascript .= 'fileList = "'.$java_files.'";';