--- loncom/lonnet/perl/lonnet.pm	2002/12/09 19:04:44	1.312
+++ loncom/lonnet/perl/lonnet.pm	2003/03/14 21:45:20	1.317.2.2
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # TCP networking package
 #
-# $Id: lonnet.pm,v 1.312 2002/12/09 19:04:44 www Exp $
+# $Id: lonnet.pm,v 1.317.2.2 2003/03/14 21:45:20 albertel Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -857,8 +857,15 @@ sub tokenwrapper {
 sub userfileupload {
     my ($formname,$coursedoc)=@_;
     my $fname=$ENV{'form.'.$formname.'.filename'};
+# Replace Windows backslashes by forward slashes
     $fname=~s/\\/\//g;
+# Get rid of everything but the actual filename
     $fname=~s/^.*\/([^\/]+)$/$1/;
+# Replace spaces by underscores
+    $fname=~s/\s+/\_/g;
+# Replace all other weird characters by nothing
+    $fname=~s/[^\w\.\-]//g;
+# See if there is anything left
     unless ($fname) { return 'error: no uploaded file'; }
     chop($ENV{'form.'.$formname});
 # Create the directory if not present
@@ -1864,6 +1871,12 @@ sub allowed {
        $thisallowed.=$1;
     }
 
+# URI is an uploaded document for this course
+
+    if (($priv eq 'bre') && 
+        ($uri=~/^uploaded\/$ENV{'course.'.$ENV{'request.course.id'}.'.domain'}\/$ENV{'course.'.$ENV{'request.course.id'}.'.num'}/)) {
+        return 'F';
+    }
 # Full access at system, domain or course-wide level? Exit.
 
     if ($thisallowed=~/F/) {
@@ -2350,10 +2363,15 @@ sub modifyuser {
        }
     }
 # -------------------------------------------------------------- Add names, etc
-    my %names=&get('environment',
+    my @tmp=&get('environment',
 		   ['firstname','middlename','lastname','generation'],
 		   $udom,$uname);
-    if ($names{'firstname'} =~ m/^error:.*/) { %names=(); }
+    my %names;
+    if ($tmp[0] =~ m/^error:.*/) { 
+        %names=(); 
+    } else {
+        %names = @tmp;
+    }
     if ($first)  { $names{'firstname'}  = $first; }
     if ($middle) { $names{'middlename'} = $middle; }
     if ($last)   { $names{'lastname'}   = $last; }
@@ -2748,14 +2766,14 @@ sub EXT {
     } else {
 	$courseid=$ENV{'request.course.id'};
     }
-
     my ($realm,$space,$qualifier,@therest)=split(/\./,$varname);
     my $rest;
-    if ($therest[0]) {
+    if (defined($therest[0])) {
        $rest=join('.',@therest);
     } else {
        $rest='';
     }
+
     my $qualifierrest=$qualifier;
     if ($rest) { $qualifierrest.='.'.$rest; }
     my $spacequalifierrest=$space;
@@ -3014,6 +3032,7 @@ sub metadata {
 			  $value.=' [Part: '.$part.']';
                       }
                       my $unikey='parameter'.$keyroot.'_'.$name;
+		      if ($subp eq 'default') { $unikey='parameter_0_'.$name; }
                       $metathesekeys{$unikey}=1;
                       $metacache{$uri.':'.$unikey.'.part'}=$part;
                       unless