--- loncom/publisher/lonupload.pm	2004/02/17 15:23:53	1.25
+++ loncom/publisher/lonupload.pm	2004/05/14 14:53:31	1.27
@@ -2,7 +2,7 @@
 # The LearningOnline Network with CAPA
 # Handler to upload files into construction space
 #
-# $Id: lonupload.pm,v 1.25 2004/02/17 15:23:53 raeburn Exp $
+# $Id: lonupload.pm,v 1.27 2004/05/14 14:53:31 www Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -165,7 +165,7 @@ sub phasetwo {
 #     target is the full filesystem path of the destination file.
 	my $base = &File::Basename::basename($fn);
 	my $path = &File::Basename::dirname($fn);
-	$base    = &HTML::Entities::encode($base);
+	$base    = &HTML::Entities::encode($base,'<>&"');
 	my $url  = $path."/".$base; 
 	&Debug($r, "URL is now ".$url);
 	my $datatoken=$ENV{'form.datatoken'};
@@ -180,6 +180,8 @@ sub phasetwo {
 			  '<input type="submit" name="override" value="'.&mt('Yes').'" /></form>');
 	    } else {
 		my $source=$r->dir_config('lonDaemons').'/tmp/'.$datatoken.'.tmp';
+		my $dirpath=$path.'/';
+		$dirpath=~s/\/+/\//g;
 		# Check for bad extension and disallow upload
 		if ($fn=~/\.(\w+)$/ && 
 		    (&Apache::loncommon::fileembstyle($1) eq 'hdn')) {
@@ -188,7 +190,7 @@ sub phasetwo {
 			      '<font color="red">'.
 			      &mt('The extension on this file is reserved internally by LON-CAPA.').
 			      '</font>');
-		    $r->print('<br /><font size=+2><a href="'.$path.'">'.
+		    $r->print('<br /><font size=+2><a href="'.$dirpath.'">'.
 			      &mt('Back to Directory').'</a></font>');
 		} elsif ($fn=~/\.(\w+)$/ && 
 			 !defined(&Apache::loncommon::fileembstyle($1))) {
@@ -197,14 +199,14 @@ sub phasetwo {
 			      '<font color="red">'.
 			      &mt('The extension on this file is not recognized by LON-CAPA.').
 			      '</font>');
-		    $r->print('<br /><font size="+2"><a href="'.$path.'">'.
+		    $r->print('<br /><font size="+2"><a href="'.$dirpath.'">'.
 			      &mt('Back to Directory').'</a></font>');
 		} elsif (-d $target) {
 		    $r->print('File <tt>'.$fn.'</tt> could not be copied.<br />'.
 			      '<font color="red">'.
 			      &mt('The target is an existing directory.').
 			      '</font><br />');
-		    $r->print('<font size="+2"><a href="'.$path.'">'.
+		    $r->print('<font size="+2"><a href="'.$dirpath.'">'.
 			      &mt('Back to Directory').'</a></font>');
 		} elsif (copy($source,$target)) {
 		    chmod(0660, $target); # Set permissions to rw-rw---.
@@ -215,7 +217,7 @@ sub phasetwo {
                         $r->print(&mt('File copied.'));
 		        $r->print('<br /><font size="+2"><a href="'.$url.'">'.
 			      &mt('View file').'</a></font>');
-		        $r->print('<br /><font size="+2"><a href="'.$path.'">'.
+		        $r->print('<br /><font size="+2"><a href="'.$dirpath.'">'.
 			      &mt('Back to Directory').'</a></font><br />');
                     }
 		} else {