--- loncom/interface/loncoursegroups.pm	2014/12/11 01:19:07	1.127
+++ loncom/interface/loncoursegroups.pm	2017/03/19 17:59:15	1.127.2.1
@@ -1,6 +1,6 @@
 # The LearningOnline Network with CAPA
 #
-# $Id: loncoursegroups.pm,v 1.127 2014/12/11 01:19:07 raeburn Exp $
+# $Id: loncoursegroups.pm,v 1.127.2.1 2017/03/19 17:59:15 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -37,6 +37,7 @@ use Apache::lonnavmaps();
 use Apache::longroup();
 use Apache::portfolio();
 use Apache::Constants qw(:common :http);
+use HTML::Entities;
 use LONCAPA::map();
 use lib '/home/httpd/lib/perl/';
 use LONCAPA;
@@ -135,7 +136,7 @@ function changeSort(caller) {
 }
 function openGroupRoster(group,status) {
     var url = '/adm/grouproster?';
-    url += 'group='+group+'&status='+status+'&ref=popup';
+    url += 'group='+group+'&status='+status+'&ref=popup';
     var title = 'Group_Membership';
     var options = 'scrollbars=1,resizable=1,menubar=0';
     options += ',width=700,height=600';
@@ -169,13 +170,13 @@ sub display_groups {
     my %curr_groups = ();
     my %grp_info = ();
     my %actionlinks = (
-      modify => '<a href="/adm/coursegroups?action=modify&refpage='.
-                         $env{'form.refpage'}.'&state=pick_task&groupname=',
-      view => '<a href="',
-      delete => '<a href="/adm/coursegroups?action=delete&refpage='.
-                         $env{'form.refpage'}.'&state=verify&groupname=',
-      reenable => '<a href="/adm/coursegroups?action=reenable&refpage='.
-                         $env{'form.refpage'}.'&state=verify&groupname=',
+      modify   => '/adm/coursegroups?action=modify&refpage='.
+                  $env{'form.refpage'}.'&state=pick_task&groupname=',
+      view     => '',
+      delete   => '/adm/coursegroups?action=delete&refpage='.
+                  $env{'form.refpage'}.'&state=verify&groupname=',
+      reenable => '/adm/coursegroups?action=reenable&refpage='.
+                  $env{'form.refpage'}.'&state=verify&groupname=',
     );
     my %lt = &Apache::lonlocal::texthash( 
                           modify => 'Modify',
@@ -226,7 +227,7 @@ sub display_groups {
             if (!defined($navmap)) {
                 $r->print('<div class="LC_error">'.
                           &mt('An error occurred retrieving information about resources in the course.').'<br />'.
-                          &mt('It is recommended that you [_1]re-initialize the course[_2] and then return to this page.','<a href="/adm/roles?selectrole=1&newrole='.$env{'request.role'}.'&orgurl=%2fadm%2fcoursegroups">','</a>').
+                          &mt('It is recommended that you [_1]re-initialize the course[_2] and then return to this page.','<a href="/adm/roles?selectrole=1&amp;newrole='.$env{'request.role'}.'&amp;orgurl=%2fadm%2fcoursegroups">','</a>').
                           '</div>');
                 return;
             }
@@ -249,7 +250,7 @@ sub display_groups {
         <th><a href="javascript:changeSort('creator')">$lt{'crea'}</a></th>
         <th><a href="javascript:changeSort('creation')">$lt{'crtd'}</a></th>
         <th><a href="javascript:changeSort('modified')">$lt{'last'}</a></th>
-        <th>$lt{'func'}</b></td>
+        <th>$lt{'func'}</th>
         <th><a href="javascript:changeSort('quota')">$lt{'quot'}</a></th>
         <th><a href="javascript:changeSort('totalmembers')">$lt{'memb'}</a></th>
         <th><a href="javascript:changeSort('totalfiles')">$lt{'file'}</a></th>
@@ -328,25 +329,30 @@ END
                     if (!$functionality) {
                         $functionality = &mt('None available');
                     }
-                    my $link = $actionlinks{$action};
+                    my $link;
                     if ($action eq 'modify' || $action eq 'delete' || 
                         $action eq 'reenable') {
-                        $link .= $group;
+                        $link = '<a href="'.&HTML::Entities::encode($actionlinks{$action}.$group,'<>&"').
+                                '">'.$lt{$action}.'</a>';
                     } else {
-                        $link .= 
-                            &Apache::longroup::get_group_link($cdom,$cnum,$group,$navmap);
-                        $link .= (($link=~/\?/)?'&amp;':'?').'ref=grouplist';
-                        if (exists($env{'form.refpage'})) {
-                            $link .= '&amp;refpage='.$env{'form.refpage'};
+                        $link = 
+                            &Apache::longroup::get_group_link($cdom,$cnum,$group,$navmap); 
+                        if ($link) {
+                            $link = '<a href="'.$link;
+                            $link .= (($link=~/\?/)?'&amp;':'?').'ref=grouplist';
+                            if (exists($env{'form.refpage'})) {
+                                $link .= '&amp;refpage='.$env{'form.refpage'};
+                            }
+                            $link .= '">'.$lt{$action}.'</a>';
                         }
                     }
-                    $link .= '">'.$lt{$action}.'</a>';
                     if ($action eq 'view') { 
                         if ($manage_permission) { 
-                            $link .= '&nbsp;&nbsp;'.$actionlinks{'modify'}.
-                                      $group.'">'.$lt{'modify'}.'</a>'.
-                                     '&nbsp;&nbsp;'.$actionlinks{'delete'}.
-                                      $group.'">'.$lt{'delete'}.'</a>';
+                            $link .= '&nbsp;&nbsp;<a href="'.
+                                      &HTML::Entities::encode($actionlinks{'modify'}.$group,'<>&"').
+                                      '">'.$lt{'modify'}.'</a>&nbsp;&nbsp;<a href="'.
+                                      &HTML::Entities::encode($actionlinks{'delete'}.$group,'<>&"').
+                                      '">'.$lt{'delete'}.'</a>';
                         }
                     }
                     $r->print(&Apache::loncommon::start_data_table_row('LC_data_table_dense').
@@ -401,7 +407,7 @@ END
                 if (!defined($navmap)) {
                     $r->print('<div class="LC_error">'.
                               &mt('An error occurred retrieving information about resources in the course.').'<br />'.
-                              &mt('It is recommended that you [_1]re-initialize the course[_2] and then return to this page.','<a href="/adm/roles?selectrole=1&newrole='.$env{'request.role'}.'&orgurl=%2fadm%2fcoursegroups">','</a>').
+                              &mt('It is recommended that you [_1]re-initialize the course[_2] and then return to this page.','<a href="/adm/roles?selectrole=1&amp;newrole='.$env{'request.role'}.'&amp;orgurl=%2fadm%2fcoursegroups">','</a>').
                               '</div>');
                     return;
                 }
@@ -897,7 +903,7 @@ function changeSort(caller) {
           faq=>9,bug=>'Instructor Interface',});
         if ($action eq 'modify' || $action eq 'delete') {
             &Apache::lonhtmlcommon::add_breadcrumb
-            ({href=>"/adm/coursegroups?refpage=cusr&action=$action",
+            ({href=>"/adm/coursegroups?refpage=cusr&amp;action=$action",
               text=>"Groups",
               faq=>9,bug=>'Instructor Interface',});
         }
@@ -3756,21 +3762,21 @@ sub modify_menu {
 	items => [
 
           { linktext => "Modify default $gpterm settings",
-            url => '/adm/coursegroups?action=modify&refpage='.$env{'form.refpage'}.'&groupname='.$groupname.'&state=change_settings&branch=settings',
+            url => '/adm/coursegroups?action=modify&amp;refpage='.$env{'form.refpage'}.'&amp;groupname='.$groupname.'&amp;state=change_settings&amp;branch=settings',
             icon => 'grp_settings.png',
             alttext => "Modify default $gpterm settings",
             permission => '1',
             help => 'Course_Modify_Group',            
             },
           { linktext => 'Modify access, tools and privileges for members',
-            url => '/adm/coursegroups?action=modify&refpage='.$env{'form.refpage'}.'&groupname='.$groupname.'&state=change_members&branch=members',
+            url => '/adm/coursegroups?action=modify&amp;refpage='.$env{'form.refpage'}.'&amp;groupname='.$groupname.'&amp;state=change_members&amp;branch=members',
             icon => 'grp_tools.png',
             alttext => 'Modify access, tools and privileges for members',
             permission => '1',
             help => 'Course_Modify_Group_Membership',
             },
           { linktext => "Add member(s) to the $gpterm",
-            url => '/adm/coursegroups?action=modify&refpage='.$env{'form.refpage'}.'&groupname='.$groupname.'&state=add_members&branch=adds',
+            url => '/adm/coursegroups?action=modify&amp;refpage='.$env{'form.refpage'}.'&amp;groupname='.$groupname.'&amp;state=add_members&amp;branch=adds',
             icon => 'grp_add.png',
             alttext =>  "Add member(s) to the $gpterm",
             permission => '1',