--- loncom/xml/lonxml.pm	2001/08/09 20:32:36	1.108
+++ loncom/xml/lonxml.pm	2001/08/11 20:16:10	1.111
@@ -13,7 +13,7 @@
 # 6/12,6/13 H. K. Ng
 # 6/16 Gerd Kortemeyer
 # 7/27 H. K. Ng
-# 8/7,8/9 Gerd Kortemeyer
+# 8/7,8/9,8/10,8/11 Gerd Kortemeyer
 
 package Apache::lonxml; 
 use vars 
@@ -97,6 +97,12 @@ sub xmlbegin {
 sub xmlend {
     my $discussion='';
     if ($ENV{'request.course.id'}) {
+       my $crs='/'.$ENV{'request.course.id'};
+       if ($ENV{'request.course.sec'}) {
+          $crs.='_'.$ENV{'request.course.sec'};
+       }                 
+       $crs=~s/\_/\//g;
+       my $seeid=&Apache::lonnet::allowed('rin',$crs);
        my $symb=&Apache::lonnet::symbread();
        if ($symb) {
           my %contrib=&Apache::lonnet::restore($symb,$ENV{'request.course.id'},
@@ -107,13 +113,37 @@ sub xmlend {
                   '<address><hr /><h2>Course Discussion of Resource</h2>';
               my $idx;
               for ($idx=1;$idx<=$contrib{'version'};$idx++) {
-                  my $message=$contrib{$idx.':message'};
-                  $message=~s/\n/\<br \/\>/g;
-		  $discussion.='<p><b>'.$contrib{$idx.':sendername'}.' at '.
-		      $contrib{$idx.':senderdomain'}.'</b> ('.
+		my $hidden=($contrib{'hidden'}=~/\.$idx\./);
+		unless (($hidden) && (!$seeid)) {
+                 my $message=$contrib{$idx.':message'};
+                 $message=~s/\n/\<br \/\>/g;
+                 if ($message) {
+                  if ($hidden) {
+		      $message='<font color="#888888">'.$message.'</font>';
+                  }
+                  my $sender='Anonymous';
+                  if ((!$contrib{$idx.':anonymous'}) || ($seeid)) {
+                      $sender=$contrib{$idx.':sendername'}.' at '.
+		      $contrib{$idx.':senderdomain'};
+                      if ($contrib{$idx.':anonymous'}) {
+			  $sender.=' (anonymous)';
+                      }
+                      if ($seeid) {
+			  if ($hidden) {
+                             $sender.=' <a href="/adm/feedback?unhide='.
+				 $symb.':::'.$idx.'">Make Visible</a>';
+                          } else {
+                             $sender.=' <a href="/adm/feedback?hide='.
+				 $symb.':::'.$idx.'">Hide</a>';
+			  }
+                      }                   
+                  }
+		  $discussion.='<p><b>'.$sender.'</b> ('.
                       localtime($contrib{$idx.':timestamp'}).
                       '):<blockquote>'.$message.
-                      '</blockquote></p>'; 
+                      '</blockquote></p>';
+	        }
+               } 
               }
               $discussion.='</address>';
           }
@@ -295,8 +325,8 @@ sub htmlclean {
 
     my $output= $tree->as_HTML(undef,' ');
      
-    $output=~s/\<(br|hr|img)([^\>\/]*)\>/\<$1$2 \/\>/gis;
-    $output=~s/\<\/(br|hr|img)\>//gis;
+    $output=~s/\<(br|hr|img|meta|allow)([^\>\/]*)\>/\<$1$2 \/\>/gis;
+    $output=~s/\<\/(br|hr|img|meta|allow)\>//gis;
     unless ($full) {
        $output=~s/\<[\/]*(body|head|html)\>//gis;
     }
@@ -747,6 +777,9 @@ sub parstring {
 
 sub writeallows {
     my $thisurl='/res/'.&Apache::lonnet::declutter(shift);
+    if ($ENV{'httpref.'.$thisurl}) {
+	$thisurl=$ENV{'httpref.'.$thisurl};
+    }
     my $thisdir=$thisurl;
     $thisdir=~s/\/[^\/]+$//;
     my %httpref=();