--- loncom/homework/grades.pm 2014/01/18 01:57:41 1.596.2.12.2.27 +++ loncom/homework/grades.pm 2016/10/24 22:31:06 1.596.2.12.2.38 @@ -1,7 +1,7 @@ # The LearningOnline Network with CAPA # The LON-CAPA Grading handler # -# $Id: grades.pm,v 1.596.2.12.2.27 2014/01/18 01:57:41 raeburn Exp $ +# $Id: grades.pm,v 1.596.2.12.2.38 2016/10/24 22:31:06 raeburn Exp $ # # Copyright Michigan State University Board of Trustees # @@ -391,6 +391,8 @@ sub cleanRecord { my $grayFont = ''; if ($response =~ /^(option|rank)$/) { my %answer=&Apache::lonnet::str2hash($answer); + my @answer = %answer; + %answer = map {&HTML::Entities::encode($_, '"<>&')} @answer; my %grading=&Apache::lonnet::str2hash($record->{$version."resource.$partid.$respid.submissiongrading"}); my ($toprow,$bottomrow); foreach my $foil (@$order) { @@ -407,6 +409,8 @@ sub cleanRecord { $bottomrow.''; } elsif ($response eq 'match') { my %answer=&Apache::lonnet::str2hash($answer); + my @answer = %answer; + %answer = map {&HTML::Entities::encode($_, '"<>&')} @answer; my %grading=&Apache::lonnet::str2hash($record->{$version."resource.$partid.$respid.submissiongrading"}); my @items=&Apache::lonnet::str2array($record->{$version."resource.$partid.$respid.submissionitems"}); my ($toprow,$middlerow,$bottomrow); @@ -461,10 +465,10 @@ sub cleanRecord { $env{'form.kwstyle'} = $keyhash{$loginuser.'_kwstyle'} ne '' ? $keyhash{$loginuser.'_kwstyle'} : ''; $env{'form.'.$symb} = 1; # so that we don't have to read it from disk for multiple sub of the same prob. } - $answer =~ s-\n-
-g; return '

'.&keywords_highlight($answer).'
'; } elsif ( $response eq 'organic') { - my $result='Smile representation: "'.$answer.'"'; + my $result=&mt('Smile representation: [_1]', + '"'.&HTML::Entities::encode($answer, '"<>&').'"'); my $jme=$record->{$version."resource.$partid.$respid.molecule"}; $result.=&Apache::chemresponse::jme_img($jme,$answer,400); return $result; @@ -498,12 +502,14 @@ sub cleanRecord { $result.=''; return $result; } - } elsif ( $response =~ m/(?:numerical|formula)/) { + } elsif ( $response =~ m/(?:numerical|formula|custom)/) { + # Respect multiple input fields, see Bug #5409 $answer = &Apache::loncommon::format_previous_attempt_value('submission', $answer); + return $answer; } - return $answer; + return &HTML::Entities::encode($answer, '"<>&'); } #-- A couple of common js functions @@ -908,10 +914,11 @@ sub listStudents { my ($table,undef,$hdgrade,$partlist,$handgrade) = &showResourceInfo($symb,$env{'form.probTitle'},($env{'form.showgrading'} eq 'yes')); - my %lt = &Apache::lonlocal::texthash ( + my %js_lt = &Apache::lonlocal::texthash ( 'multiple' => 'Please select a student or group of students before clicking on the Next button.', 'single' => 'Please select the student before clicking on the Next button.', ); + &js_escape(\%js_lt); $request->print(< function checkSelect(checkBox) { @@ -923,12 +930,12 @@ sub listStudents { ctr++; } } - sense = '$lt{'multiple'}'; + sense = '$js_lt{'multiple'}'; } else { if (checkBox.checked) { ctr = 1; } - sense = '$lt{'single'}'; + sense = '$js_lt{'single'}'; } if (ctr == 0) { alert(sense); @@ -1247,7 +1254,8 @@ sub processGroup { #--- Javascript to handle the submission page functionality --- sub sub_page_js { my $request = shift; - my $alertmsg = &mt('A number equal or greater than 0 is expected. Entered value = '); + my $alertmsg = &mt('A number equal or greater than 0 is expected. Entered value = '); + &js_escape(\$alertmsg); $request->print(< function updateRadio(formname,id,weight) { @@ -1366,10 +1374,8 @@ sub sub_page_js { } } } - } } - } if (val == "Grade Student") { formname.showgrading.value = "yes"; @@ -1503,10 +1509,21 @@ INNERJS my $docopen=&Apache::lonhtmlcommon::javascript_docopen(); $docopen=~s/^document\.//; - my %lt = &Apache::lonlocal::texthash( + my %js_lt = &Apache::lonlocal::texthash( keyw => 'Keywords list, separated by a space. Add/delete to list if desired.', plse => 'Please select a word or group of words from document and then click this link.', adds => 'Add selection to keyword list? Edit if desired.', + col1 => 'red', + col2 => 'green', + col3 => 'blue', + siz1 => 'normal', + siz2 => '+1', + siz3 => '+2', + sty1 => 'normal', + sty2 => 'italic', + sty3 => 'bold', + ); + my %html_js_lt = &Apache::lonlocal::texthash( comp => 'Compose Message for: ', incl => 'Include', type => 'Type', @@ -1520,12 +1537,15 @@ INNERJS font => 'Font Size', fnst => 'Font Style', ); + &js_escape(\%js_lt); + &html_escape(\%html_js_lt); + &js_escape(\%html_js_lt); $request->print(< //===================== Show list of keywords ==================== function keywords(formname) { - var nret = prompt("$lt{'keyw'}",formname.keywords.value); + var nret = prompt("$js_lt{'keyw'}",formname.keywords.value); if (nret==null) return; formname.keywords.value = nret; @@ -1552,10 +1572,10 @@ INNERJS else return; var cleantxt = txt.replace(new RegExp('([\\f\\n\\r\\t\\v ])+', 'g')," "); if (cleantxt=="") { - alert("$lt{'plse'}"); + alert("$js_lt{'plse'}"); return; } - var nret = prompt("$lt{'adds'}",cleantxt); + var nret = prompt("$js_lt{'adds'}",cleantxt); if (nret==null) return; document.SCORE.keywords.value = document.SCORE.keywords.value+" "+nret; if (document.SCORE.keywords.value != "") { @@ -1635,16 +1655,16 @@ INNERJS pDoc.write("
"); pDoc.write(""); - pDoc.write("

 $lt{'comp'}\"+fullname+\"<\\/span><\\/h3>

"); + pDoc.write("

 $html_js_lt{'comp'}\"+fullname+\"<\\/span><\\/h3>

"); pDoc.write('
'); pDoc.write(''); - pDoc.write(""); - pDoc.write(""); - pDoc.write("
$lt{'type'}<\\/b><\\/td>$lt{'incl'}<\\/b><\\/td>$lt{'mesa'}<\\/td><\\/tr>"); + pDoc.write("$html_js_lt{'type'}<\\/b><\\/td>$html_js_lt{'incl'}<\\/b><\\/td>$html_js_lt{'mesa'}<\\/td><\\/tr>"); } function displaySubject(msg,shwsel) { pDoc = pWin.document; pDoc.write("
$lt{'subj'}<\\/td>"); + pDoc.write("$html_js_lt{'subj'}<\\/td>"); pDoc.write("<\\/td>"); pDoc.write("<\\/td><\\/tr>"); } @@ -1660,7 +1680,7 @@ INNERJS function newMsg(newmsg,shwsel) { pDoc = pWin.document; pDoc.write("
$lt{'new'}<\\/td>"); + pDoc.write("$html_js_lt{'new'}<\\/td>"); pDoc.write("<\\/td>"); pDoc.write("