--- loncom/auth/lonauth.pm	2003/06/06 02:24:49	1.52
+++ loncom/auth/lonauth.pm	2003/07/17 15:24:46	1.54
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # User Authentication Module
 #
-# $Id: lonauth.pm,v 1.52 2003/06/06 02:24:49 www Exp $
+# $Id: lonauth.pm,v 1.54 2003/07/17 15:24:46 www Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -107,6 +107,12 @@ sub success {
 	$FORM{'interface'}=$userenv{'interface'};
     }
     $ENV{'environment.remote'}=$userenv{'remote'};
+# --------------- Do not trust query string to be put directly into environment
+    foreach ('imagesuppress','appletsuppress',
+	     'embedsuppress','fontenhance','blackwhite',
+	     'interface','localpath','localres') {
+	$FORM{$_}=~s/[\n\r\=]//gs;
+    }
 # --------------------------------------------------------- Write first profile
 
     {
@@ -126,6 +132,10 @@ sub success {
 	print $idf "browser.mathml=$clientmathml\n";
 	print $idf "browser.unicode=$clientunicode\n";
 	print $idf "browser.os=$clientos\n";
+        if ($FORM{'localpath'}) {
+           print $idf "browser.localpath=$FORM{'localpath'}\n";
+           print $idf "browser.localres=$FORM{'localres'}\n";
+        }
 	print $idf "request.course.fn=\n";
 	print $idf "request.course.uri=\n";
 	print $idf "request.course.sec=\n";