--- loncom/homework/grades.pm	2014/02/05 15:09:30	1.719
+++ loncom/homework/grades.pm	2014/08/25 22:12:58	1.725
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # The LON-CAPA Grading handler
 #
-# $Id: grades.pm,v 1.719 2014/02/05 15:09:30 bisitz Exp $
+# $Id: grades.pm,v 1.725 2014/08/25 22:12:58 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -330,6 +330,8 @@ sub cleanRecord {
     my $grayFont = '<span class="LC_internal_info">';
     if ($response =~ /^(option|rank)$/) {
 	my %answer=&Apache::lonnet::str2hash($answer);
+        my @answer = %answer;
+        %answer = map {&HTML::Entities::encode($_, '"<>&')}  @answer;
 	my %grading=&Apache::lonnet::str2hash($record->{$version."resource.$partid.$respid.submissiongrading"});
 	my ($toprow,$bottomrow);
 	foreach my $foil (@$order) {
@@ -346,6 +348,8 @@ sub cleanRecord {
 	    $bottomrow.'</tr></table></blockquote>';
     } elsif ($response eq 'match') {
 	my %answer=&Apache::lonnet::str2hash($answer);
+        my @answer = %answer;
+        %answer = map {&HTML::Entities::encode($_, '"<>&')}  @answer;
 	my %grading=&Apache::lonnet::str2hash($record->{$version."resource.$partid.$respid.submissiongrading"});
 	my @items=&Apache::lonnet::str2array($record->{$version."resource.$partid.$respid.submissionitems"});
 	my ($toprow,$middlerow,$bottomrow);
@@ -368,6 +372,8 @@ sub cleanRecord {
 	    $bottomrow.'</tr></table></blockquote>';
     } elsif ($response eq 'radiobutton') {
 	my %answer=&Apache::lonnet::str2hash($answer);
+        my @answer = %answer;
+        %answer = map {&HTML::Entities::encode($_, '"<>&')}  @answer;
 	my ($toprow,$bottomrow);
 	my $correct = 
 	    &get_radiobutton_correct_foil($partid,$respid,$symb,$uname,$udom,$type,$trial,$rndseed);
@@ -400,10 +406,11 @@ sub cleanRecord {
 	    $env{'form.kwstyle'}  = $keyhash{$loginuser.'_kwstyle'} ne '' ? $keyhash{$loginuser.'_kwstyle'} : '';
 	    $env{'form.'.$symb} = 1; # so that we don't have to read it from disk for multiple sub of the same prob.
 	}
-	$answer =~ s-\n-<br />-g;
-	return '<br /><br /><blockquote><tt>'.&keywords_highlight($answer).'</tt></blockquote>';
+	return '<br /><br /><blockquote><tt>'.&keywords_highlight(&HTML::Entities::encode($answer, '"<>&')).'</tt></blockquote>';
+
     } elsif ( $response eq 'organic') {
-	my $result='Smile representation: "<tt>'.$answer.'</tt>"';
+        my $result=&mt('Smile representation: [_1]',
+                           '"<tt>'.&HTML::Entities::encode($answer, '"<>&').'</tt>"');
 	my $jme=$record->{$version."resource.$partid.$respid.molecule"};
 	$result.=&Apache::chemresponse::jme_img($jme,$answer,400);
 	return $result;
@@ -442,8 +449,9 @@ sub cleanRecord {
 	$answer = 
 	    &Apache::loncommon::format_previous_attempt_value('submission',
 							      $answer);
+	return $answer;
     }
-    return $answer;
+    return &HTML::Entities::encode($answer, '"<>&');
 }
 
 #-- A couple of common js functions
@@ -2218,7 +2226,7 @@ sub submission {
 	    foreach my $submission (@$string) {
 		my ($partid,$respid) = ($submission =~ /^resource\.([^\.]*)\.([^\.]*)\.submission/);
 		if (join('_',@{$part}) ne ($partid.'_'.$respid)) { next; }
-		my ($ressub,$hide,$subval) = split(/:/,$submission,3);
+		my ($ressub,$hide,$draft,$subval) = split(/:/,$submission,4);
 		# Similarity check
                 my $similar='';
                 my ($type,$trial,$rndseed);
@@ -2287,9 +2295,17 @@ sub submission {
                     if ($hide eq 'anon') {
                         $lastsubonly.='<br /><b>'.&mt('Anonymous Survey').'</b>'; 
                     } else {
-             	        $lastsubonly.='<br /><b>'.&mt('Submitted Answer:').' </b>'.
+             	        $lastsubonly.='<br /><b>'.&mt('Submitted Answer:').' </b>';
+                        if ($draft) {
+                            $lastsubonly.= ' <span class="LC_warning">'.&mt('Draft Copy').'</span>';
+                        }
+                        $subval =
 			    &cleanRecord($subval,$responsetype,$symb,$partid,
 					 $respid,\%record,$order,undef,$uname,$udom,$type,$trial,$rndseed);
+                        if ($responsetype eq 'essay') {
+                            $subval =~ s{\n}{<br />}g;
+                        }
+                        $lastsubonly.=$subval."\n";
                     }
 	            if ($similar) {$lastsubonly.="<br /><br />$similar\n";}
 		    $lastsubonly.='</div>';
@@ -2302,6 +2318,7 @@ sub submission {
     if ($env{'form.lastSub'} eq 'datesub') {
         my ($parts,$handgrade,$responseType) = &response_type($symb,\$res_error);
 	$request->print(&displaySubByDates($symb,\%record,$parts,$responseType,$checkIcon,$uname,$udom));
+  
     } 
     if ($env{'form.lastSub'} =~ /^(last|all)$/) {
         $request->print(&Apache::loncommon::get_previous_attempt($symb,$uname,$udom,
@@ -2535,10 +2552,8 @@ sub get_last_submission {
                 }
             }
 	    my ($partid,$foo) = split(/submission$/,$key);
-	    my $draft  = $lasthash{$partid.'awarddetail'} eq 'DRAFT' ?
-		'<span class="LC_warning">'.&mt('Draft Copy').'</span> ' : '';
-	    #push(@string, join(':', $key, $hide, $draft.$lasthash{$key}));
-            push(@string, join(':', $key, $hide, $draft.(
+	    my $draft  = $lasthash{$partid.'awarddetail'} eq 'DRAFT' ? 1 : 0;
+            push(@string, join(':', $key, $hide, $draft, (
                 ref($lasthash{$key}) eq 'ARRAY' ?
                     join(',', @{$lasthash{$key}}) : $lasthash{$key}) ));
 	}
@@ -2765,7 +2780,10 @@ sub processHandGrade {
 		next;
 	    }
 	    if ($errorflag eq 'not_allowed') {
-		$request->print("<span class=\"LC_warning\">Not allowed to modify grades for $uname:$udom</span>");
+		$request->print(
+                    '<span class="LC_error">'
+                   .&mt('Not allowed to modify grades for [_1]',"$uname:$udom")
+                   .'</span>');
 		$ctr++;
 		next;
 	    }
@@ -6605,7 +6623,7 @@ sub scantron_warning_screen {
 	$scantron_config{'CODEstart'} &&
 	$scantron_config{'CODElength'}) {
 	$CODElist=$env{'form.scantron_CODElist'};
-	if ($env{'form.scantron_CODElist'} eq '') { $CODElist='<span class="LC_warning">None</span>'; }
+	if ($env{'form.scantron_CODElist'} eq '') { $CODElist='<span class="LC_warning">'.&mt('None').'</span>'; }
 	$CODElist=
 	    '<tr><td><b>'.&mt('List of CODES to validate against:').'</b></td><td><tt>'.
 	    $env{'form.scantron_CODElist'}.'</tt></td></tr>';
@@ -8238,7 +8256,7 @@ sub hand_bubble_option {
         return &mt('The sequence to be graded contains response types which are handgraded.').'<p>'.
                &mt('If you have already graded these by bubbling sheets to indicate points awarded, [_1]what point value is assigned to a filled last bubble in each row?','<br />').
                '<label><input type="radio" name="scantron_lastbubblepoints" value="'.$bubbles_per_row.'" checked="checked" />'.&mt('[quant,_1,point]',$bubbles_per_row).'</label>&nbsp;'.&mt('or').'&nbsp;'.
-               '<label><input type="radio" name="scantron_lastbubblepoints" value="0"/>0 points</label></p>';
+               '<label><input type="radio" name="scantron_lastbubblepoints" value="0" />'.&mt('0 points').'</label></p>';
     }
     return;
 }
@@ -8901,7 +8919,7 @@ sub scantron_download_scantron_data {
     &Apache::lonnet::allowuploaded('/adm/grades',$skipped);
     $r->print('
     <p>
-	'.&mt('[_1]Original[_2] file as uploaded by the bubblesheet office.',
+	'.&mt('[_1]Original[_2] file as uploaded by the bubblesheet scanning office.',
 	      '<a href="'.$orig.'">','</a>').'
     </p>
     <p>
@@ -9072,14 +9090,14 @@ sub checkscantron_results {
 '<td>'.&mt('Bubblesheet').'</td><td>'.$showscandata.'</td><td rowspan="2">'.$last.'</td><td rowspan="2">'.$pid.'</td>'."\n".
 '</tr>'."\n".
 '<tr class="'.$css_class.'">'."\n".
-'<td>Submissions</td><td>'.$showrecord.'</td></tr>'."\n";
+'<td>'.&mt('Submissions').'</td><td>'.$showrecord.'</td></tr>'."\n";
                     $passed ++;
                 } else {
                     my $css_class = ($failed % 2)?'LC_odd_row':'LC_even_row';
                     $badstudents .= '<tr class="'.$css_class.'"><td>'.&mt('Bubblesheet').'</td><td><span class="LC_nobreak">'.$scandata{$pid}.'</span></td><td rowspan="2">'.$last.'</td><td rowspan="2">'.$pid.'</td>'."\n".
 '</tr>'."\n".
 '<tr class="'.$css_class.'">'."\n".
-'<td>Submissions</td><td><span class="LC_nobreak">'.$record{$pid}.'</span></td>'."\n".
+'<td>'.&mt('Submissions').'</td><td><span class="LC_nobreak">'.$record{$pid}.'</span></td>'."\n".
 '</tr>'."\n";
                     $failed ++;
                 }