--- loncom/auth/lonauth.pm	2003/04/07 18:24:05	1.48
+++ loncom/auth/lonauth.pm	2003/07/17 15:24:46	1.54
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # User Authentication Module
 #
-# $Id: lonauth.pm,v 1.48 2003/04/07 18:24:05 www Exp $
+# $Id: lonauth.pm,v 1.54 2003/07/17 15:24:46 www Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -107,6 +107,12 @@ sub success {
 	$FORM{'interface'}=$userenv{'interface'};
     }
     $ENV{'environment.remote'}=$userenv{'remote'};
+# --------------- Do not trust query string to be put directly into environment
+    foreach ('imagesuppress','appletsuppress',
+	     'embedsuppress','fontenhance','blackwhite',
+	     'interface','localpath','localres') {
+	$FORM{$_}=~s/[\n\r\=]//gs;
+    }
 # --------------------------------------------------------- Write first profile
 
     {
@@ -126,6 +132,10 @@ sub success {
 	print $idf "browser.mathml=$clientmathml\n";
 	print $idf "browser.unicode=$clientunicode\n";
 	print $idf "browser.os=$clientos\n";
+        if ($FORM{'localpath'}) {
+           print $idf "browser.localpath=$FORM{'localpath'}\n";
+           print $idf "browser.localres=$FORM{'localres'}\n";
+        }
 	print $idf "request.course.fn=\n";
 	print $idf "request.course.uri=\n";
 	print $idf "request.course.sec=\n";
@@ -232,7 +242,7 @@ sub handler {
     my $r = shift;
 
     my $buffer;
-    $r->read($buffer,$r->header_in('Content-length'));
+    $r->read($buffer,$r->header_in('Content-length'),0);
     my @pairs=split(/&/,$buffer);
     my $pair; my $name; my $value;
     undef %FORM;