--- loncom/cgi/loncgi.pm	2014/10/14 19:54:00	1.14
+++ loncom/cgi/loncgi.pm	2016/08/01 15:19:05	1.15
@@ -1,7 +1,7 @@
 #
 # LON-CAPA helpers for cgi-bin scripts
 #
-# $Id: loncgi.pm,v 1.14 2014/10/14 19:54:00 raeburn Exp $
+# $Id: loncgi.pm,v 1.15 2016/08/01 15:19:05 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -200,7 +200,9 @@ END
 
 =cgi_getitems()
 
-Inputs: $query (the CGI query string), and $getitems, a reference to a hash 
+Inputs: $query - the CGI query string (required)
+        $getitems - reference to a hash (required)
+        $possname - permitted names of keys (optional)
 
 Returns: nothing
 
@@ -213,10 +215,13 @@ Side Effects: populates $getitems hash r
 #############################################
 #############################################
 sub cgi_getitems {
-    my ($query,$getitems)= @_;
+    my ($query,$getitems,$possnames)= @_;
     foreach (split(/&/,$query)) {
         my ($name, $value) = split(/=/,$_);
         $name = &unescape($name);
+        if (ref($possnames) eq 'ARRAY') {
+            next unless (grep(/^\Q$name\E$/,@{$possnames}));
+        }
         $value =~ tr/+/ /;
         $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg;
         push(@{$$getitems{$name}},$value);