--- loncom/interface/portfolio.pm	2017/05/19 23:41:52	1.254.2.2
+++ loncom/interface/portfolio.pm	2017/08/12 01:32:14	1.259
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # portfolio browser
 #
-# $Id: portfolio.pm,v 1.254.2.2 2017/05/19 23:41:52 raeburn Exp $
+# $Id: portfolio.pm,v 1.259 2017/08/12 01:32:14 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -112,13 +112,17 @@ sub display_common {
 END
         }
 
+        # Find space available before uploading
+        my $free_space = &free_space($group);
+
         # Upload File
         $r->print('<div class="LC_left_float">'
                  .'<form method="post" enctype="multipart/form-data" action="'.$escuri.'">'
                  .'<fieldset>'
                  .'<legend>'.$lt{'upload_label'}.'</legend>'
                  .$groupitem 
-                 .'<input name="uploaddoc" type="file" />'
+                 .'<input name="uploaddoc" type="file" class="flUpload" />'
+                 .'<input type="hidden" id="free_space" value="'.$free_space.'" />'
                  .'<input type="hidden" name="currentpath" value="'.$current_path.'" />'
                  .'<input type="hidden" name="action" value="'.$env{"form.action"}.'" />'
                  .'<input type="hidden" name="symb" value="'.$env{"form.symb"}.'" />'
@@ -233,7 +237,7 @@ sub display_directory_line {
 	if ($lock_info) {
 	    my %anchor_fields = ('lockinfo' => $fullpath);
 	    if ($versions) { # hold the folder open
-	        my ($fname,$version,$extension) = &Apache::grades::file_name_version_ext($fullpath);
+	        my ($fname,$version,$extension) = &Apache::lonnet::file_name_version_ext($fullpath);
 	        $fname =~ s|^/||;
 	        $anchor_fields{'showversions'} = $fname.'.'.$extension;
 	    }
@@ -366,7 +370,7 @@ sub display_directory {
 		          } (@{$dir_list})) {
     	    my ($filename,$dom,undef,$testdir,undef,undef,undef,undef,$size,undef,$mtime,undef,undef,undef,$obs,undef)=split(/\&/,$dir_line,16); 
     	    $filename =~ s/\s+$//;
-    	    my ($fname,$version,$extension) = &Apache::grades::file_name_version_ext($filename);
+    	    my ($fname,$version,$extension) = &Apache::lonnet::file_name_version_ext($filename);
     	    if ($version) {
 	        my $fullpath = &prepend_group($current_path.$fname.'.'.$extension);
     	        push(@{ $versioned{$fullpath} },
@@ -379,7 +383,7 @@ sub display_directory {
     my $zerobyte;
     foreach my $dir_line (@dir_lines) {
         my ($filename,$dom,$testdir,$size,$mtime,$obs) = @$dir_line;
-        my ($fname,$version,$extension) = &Apache::grades::file_name_version_ext($filename);
+        my ($fname,$version,$extension) = &Apache::lonnet::file_name_version_ext($filename);
     	if (($filename ne '.') && ($filename ne '..') && ($filename !~ /\.meta$/ ) && ($filename !~ /(.*)\.(\d+)\.([^\.]*)$/)) {
     	    my $version_flag;
     	    my $show_versions;
@@ -2598,6 +2602,58 @@ STATE
     return $state;
 }
 
+# Find space available in a user's portfolio (convert to bytes)
+sub free_space {
+    my ($group) = @_;
+    my $disk_quota = &get_quota($group); # Expressed in kB
+    my ($uname,$udom) = &get_name_dom($group);
+    my $portfolio_root = &get_portfolio_root();
+    my $getpropath = 1;
+    my $current_disk_usage = &Apache::lonnet::diskusage($udom, $uname,
+                             $portfolio_root, $getpropath); # Expressed in kB
+    my $free_space = 1024 * ($disk_quota - $current_disk_usage);
+    return $free_space;
+}
+
+sub valid_container {
+    my ($uname,$udom,$group) = @_;
+    my $container_prefix;
+    if ($group ne '') {
+        $container_prefix = "/uploaded/$udom/$uname/groups/$group/portfolio";
+    } else {
+        $container_prefix = "/uploaded/$udom/$uname/portfolio";
+    }
+    if ($env{'form.currentpath'}) {
+        $container_prefix .= $env{'form.currentpath'};
+    } else {
+        $container_prefix .= '/';
+    }
+    if ($env{'form.container'} =~ m{^\Q$container_prefix\E(.+)$}) {
+        my $filename = $1;
+        if ($filename eq &Apache::lonnet::clean_filename($filename)) {
+            return 1;
+        }
+    }
+    return;
+}
+
+sub invalid_parms {
+    my ($r,$url,$currentpath) = @_;
+    my $escpath = &HTML::Entities::encode($currentpath,'&<>"');
+    my $rtnlink = '<a href="'.$url;
+    if ($url =~ /\?/) {
+        $rtnlink .= '&';
+    } else {
+        $rtnlink .= '?';
+    }
+    $rtnlink .= 'currentpath='.$escpath;
+    $rtnlink .= '">'.&mt('Return to directory').'</a>';
+    $r->print('<h3>'.&mt('Action disallowed').'</h3>');
+    $r->print(&mt('Some of the data included with this request were invalid'));
+    $r->print('<br />'.$rtnlink);
+    return;
+}
+
 sub handler {
     # this handles file management
     my $r = shift;
@@ -2685,16 +2741,19 @@ sub handler {
     # Give the LON-CAPA page header
     my $brcrum = [{href=>"/adm/portfolio",text=>"Portfolio Manager"}];
 
+    my $js = '<script type="text/javascript"
+                src="/res/adm/includes/file_upload.js"></script>';
+    
     if ($env{"form.mode"} eq 'selectfile'){
-        $r->print(&Apache::loncommon::start_page($title,undef,
+        $r->print(&Apache::loncommon::start_page($title, $js,
 						 {'only_body' => 1}));
     } elsif ($env{'form.action'} eq 'rolepicker') {
-        $r->print(&Apache::loncommon::start_page('New role-based condition',undef,
+        $r->print(&Apache::loncommon::start_page('New role-based condition', $js,
                                                  {'no_nav_bar'  => 1, }));
     } elsif ($caller eq 'coursegrp_portfolio') {
-        $r->print(&Apache::loncommon::start_page($title));
+        $r->print(&Apache::loncommon::start_page($title, $js));
     } else {
-        $r->print(&Apache::loncommon::start_page($title,undef,
+        $r->print(&Apache::loncommon::start_page($title, $js,
                                                  {'bread_crumbs' => $brcrum}));
         if (!&Apache::lonnet::usertools_access($uname,$udom,'portfolio')) {
             $r->print('<h2>'.&mt('No user portfolio available') .'</h2>'.
@@ -2743,6 +2802,21 @@ sub handler {
             $r->print(&Apache::loncommon::end_page());
             return OK;
         }
+    }
+    if (($env{'form.currentpath'}) && ($env{'form.currentpath'} ne '/')) {
+        my $clean_currentpath = '/'.&Apache::loncommon::clean_path($env{'form.currentpath'}).'/';
+        unless ($env{'form.currentpath'} eq $clean_currentpath) {
+            &invalid_parms($r,$url);
+            $r->print(&Apache::loncommon::end_page());
+            return OK;
+        }
+    }
+    if ($env{'form.container'}) {
+        unless (&valid_container($uname,$udom,$group)) {
+            &invalid_parms($r,$url,$env{'form.currentpath'});
+            $r->print(&Apache::loncommon::end_page());
+            return OK;
+        }
     }
     if (($env{'form.storeupl'}) & (!$env{'form.uploaddoc.filename'})){
    	$r->print(