--- loncom/auth/lonroles.pm	2021/11/30 14:16:13	1.358
+++ loncom/auth/lonroles.pm	2022/02/24 15:06:48	1.362
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # User Roles Screen
 #
-# $Id: lonroles.pm,v 1.358 2021/11/30 14:16:13 raeburn Exp $
+# $Id: lonroles.pm,v 1.362 2022/02/24 15:06:48 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -181,7 +181,8 @@ ENDREDIR
 
 sub finish_loading_course {
     my ($r,$msg,$url) = @_;
-    my $link = '<div id="LC_course_loaded" style="display:none"><a href="'.$url.'">'.&mt('Continue').'</a></div>';
+    my $link = '<div id="LC_course_loaded" style="display:none"><a href="'.
+               &HTML::Entities::encode($url,'"<>&').'">'.&mt('Continue').'</a></div>';
     my $end_page = &Apache::loncommon::end_page();
     my $js_url = &js_escape($url);
     $r->print(<<END);
@@ -195,6 +196,7 @@ $msg
     var url = "$js_url";
     \$(location).attr('href',url);
 });
+// ]]>
 </script>
 $link
 $end_page
@@ -277,7 +279,8 @@ sub handler {
         $update = $then;
     }
 
-    my ($norolelist,$blocked_by_ip,$blocked_type,$blocked_ipaddr);
+    my ($norolelist,$blocked_by_ip,$blocked_type,$clientip);
+    $clientip = &Apache::lonnet::get_requestor_ip($r);
     if (($env{'request.course.id'}) && ($env{'request.deeplink.login'})) {
         my $cnum = $env{'course.'.$env{'request.course.id'}.'.num'};
         my $cdom = $env{'course.'.$env{'request.course.id'}.'.domain'};
@@ -358,13 +361,12 @@ sub handler {
                         $ipaccessref = &Apache::lonnet::do_cache_new('ipaccess',$cdom,$domconfig{'ipaccess'},1800);
                     }
                     if (ref($ipaccessref) eq 'HASH') {
-                        my $remote_ip = &Apache::lonnet::get_requestor_ip();
                         foreach my $id (keys(%{$ipaccessref})) {
                             if (ref($ipaccessref->{$id}) eq 'HASH') {
                                 my $range = $ipaccessref->{$id}->{'ip'};
                                 if ($range) {
                                     my $type = 'exclude';
-                                    if (&Apache::lonnet::ip_match($remote_ip,$range)) {
+                                    if (&Apache::lonnet::ip_match($clientip,$range)) {
                                         $type = 'include';
                                     }
                                     if (ref($ipaccessref->{$id}->{'courses'}) eq 'HASH') {
@@ -386,9 +388,6 @@ sub handler {
                                 }
                             }
                         }
-                        unless ($showrole) {
-                            $blocked_ipaddr = $remote_ip;
-                        }
                     }
                 }
             }
@@ -783,7 +782,7 @@ ENDCLOSE
                         $r->rflush();
                         my ($msg,$blockcrit,$critmsg_check);
                         $critmsg_check = 1;
-                        $blockcrit = &Apache::loncommon::blocking_status('alert',$cnum,$cdom,undef,1);
+                        $blockcrit = &Apache::loncommon::blocking_status('alert',$clientip,$cnum,$cdom,undef,1);
                         if ($blockcrit) {
                             my $checkrole = "cm./$cdom/$cnum";
                             if ($csec ne '') {
@@ -1354,7 +1353,7 @@ ENDHEADER
             }
             $r->print('<h3><span class="LC_error">'.
                       &mt('The [_1] you selected is not available for access with a [_2] role from your current IP address: [_3].',
-                          lc($blocked_type),$blocked_role,$blocked_ipaddr).
+                          lc($blocked_type),$blocked_role,$clientip).
                       '</span></h3>');
         }
     }
@@ -1994,7 +1993,7 @@ sub findcourse_advice {
     } else {
         $r->print('<p>'.&mt('If you were expecting to see an active role listed for a particular course, that course may not have been created yet.').'</p>');
         if ($elapsed > 600) {
-            $r->print('<p>'.&mt('You may also have been assigned to a course in the time since you last logged-in, or checked for changes').
+            $r->print('<p>'.&mt('You may also have been assigned to a course in the time since you last logged-in, or checked for changes.').
                       '<br />'.
                       &mt('If that is the case you can use the "Check for changes" link in the gray Functions bar to update the list of your available course roles.').'</p>');
         }