--- loncom/publisher/lonpubdir.pm	2005/07/12 14:56:36	1.85
+++ loncom/publisher/lonpubdir.pm	2005/07/12 15:55:58	1.86
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Construction Space Directory Lister
 #
-# $Id: lonpubdir.pm,v 1.85 2005/07/12 14:56:36 albertel Exp $
+# $Id: lonpubdir.pm,v 1.86 2005/07/12 15:55:58 albertel Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -521,7 +521,7 @@ sub putdirectory {
                       '<option value="editcat">'.&mt('Edit catalog information').'</option>'.
                       '<option value="printdir">'.&mt('Print directory').'</option>'.
                     '</select>'.
-                     '<input type="hidden" name="filename" value="'.$dirpath.'/'.$dirname.'/" />'.
+                     '<input type="hidden" name="filename" value="'.&HTML::Entities::encode($dirpath.'/'.$dirname,'<>&"').'/" />'.
                      '<input type="hidden" name="openname" value="'.$here.'/'.$dirname.'/" />'.
                      '<input type="hidden" name="postdata" value="" />'.
                    '</form>';
@@ -529,9 +529,9 @@ sub putdirectory {
         }
 	$r->print('<tr bgcolor="#CCCCFF">'.
 		  '<td><img src="'.
-		  $Apache::lonnet::perlvar{'lonIconsURL'}.'/folder_closed.gif" /></td>'.
+		  $Apache::lonnet::perlvar{'lonIconsURL'}.'/folder_closed.gif" alt="folder" /></td>'.
 		  '<td>'.$actionitem.'</td>'.
-		  '<td><font face="arial"><a href="'.$here.'/'.$dirname.'/" target="_parent">'.
+		  '<td><font face="arial"><a href="'.&HTML::Entities::encode($here.'/'.$dirname,'<>&"').'/" target="_parent">'.
 		  $disfilename.'</a></font></td>'.
 		        '<td colspan="2">'.($kaputt?&Apache::lonhtmlcommon::authorbombs($resdir.'/'.$disfilename.'/'):'').$Apache::lonpublisher::metadatafields{'title'}.' <i>'.
 		  $Apache::lonpublisher::metadatafields{'subject'}.'</i> '.
@@ -597,7 +597,7 @@ sub putresource {
 	    }
 	}
 	$title.="\n".'<br /><a href="/~'.$uname.$thisdisfn.'/'.$filename.'.meta">'. 
-	    ($$bombs{$targetdir.'/'.$filename}?'<img src="/adm/lonMisc/bomb.gif" border="0" />':'Edit Metadata').'</a>';
+	    ($$bombs{$targetdir.'/'.$filename}?'<img src="/adm/lonMisc/bomb.gif" border="0" alt="bomb" />':'Edit Metadata').'</a>';
 	$status.="\n".'<br /><a href="/adm/retrieve?filename=/~'.$uname.
 	    $thisdisfn.'/'.$filename.'" target="_parent">'.&mt('Retrieve').'</a>';
     }
@@ -622,7 +622,7 @@ sub putresource {
     &create_pubselect($r,\$pub_select,$udom,$uname,$thisdisfn,$filename,$resdir,$pubstatus,$publish_button,$numres);
     $r->print('<tr bgcolor="'.$bgcolor.'">'.
 	      '<td>'.($filename=~/[\#\~]$/?'&nbsp;':
-		      '<img src="'.&Apache::loncommon::icon($filename).'" /></td>').
+		      '<img src="'.&Apache::loncommon::icon($filename).'" alt="" />').'</td>'.
               '<td>'.$pub_select.'</td>'.
 	      '<td><font face="arial">'.
 	      '<a href="'.$linkdir.'/'.$filename.'" target="_parent">'.
@@ -663,7 +663,7 @@ sub create_pubselect {
 '<option value="print">'.&mt('Print').'</option>'.
 '</select>
 <input type="hidden" name="filename" value="/~'.
- $uname.$thisdisfn.'/'.$filename.'" /></form>';
+ &HTML::Entities::encode($uname.$thisdisfn.'/'.$filename,'<>&"').'" /></form>';
     $$numres ++;
 }