--- loncom/interface/lonhtmlcommon.pm	2004/09/29 14:50:43	1.90
+++ loncom/interface/lonhtmlcommon.pm	2004/11/19 19:31:13	1.96
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # a pile of common html routines
 #
-# $Id: lonhtmlcommon.pm,v 1.90 2004/09/29 14:50:43 www Exp $
+# $Id: lonhtmlcommon.pm,v 1.96 2004/11/19 19:31:13 albertel Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -127,11 +127,12 @@ sub select_recent {
     my ($area,$fieldname,$event)=@_;
     my %recent=&Apache::lonnet::dump(&recent_filename($area));
     my $return="\n<select name='$fieldname'".
-	($event?" onChange='$event'":'').
+	($event?" onchange='$event'":'').
 	">\n<option value=''>--- ".&mt('Recent')." ---</option>";
     foreach (sort keys %recent) {
 	unless ($_=~/^error\:/) {
-	    $return.="\n<option value='$_'>".
+	    my $escaped = &Apache::loncommon::escape_url($_);
+	    $return.="\n<option value='$escaped'>".
 		&Apache::lonnet::unescape((split(/\&/,$recent{$_}))[1]).
 		'</option>';
 	}
@@ -286,7 +287,7 @@ sub date_setter {
             document.$formname.$dname\_day.value = 30;
         }
     }
-
+    
     function $dname\_disable() {
         document.$formname.$dname\_month.disabled=true;
         document.$formname.$dname\_day.disabled=true;
@@ -318,64 +319,62 @@ document.$formname.$dname\_year.value,
     }
 </script>
 ENDJS
-    $result .= "  <nobr><select name=\"$dname\_month\" ".$special.' '.
-        $state.' '.
-        "onChange=\"javascript:$dname\_checkday()\" >\n";
+    $result .= '  <nobr>';
+    my $monthselector = qq{<select name="$dname\_month" $special $state onchange="javascript:$dname\_checkday()" >};
     # Month
     my @Months = qw/January February  March     April   May      June 
                     July    August    September October November December/;
     # Pad @Months with a bogus value to make indexing easier
     unshift(@Months,'If you can read this an error occurred');
-    if ($includeempty) { $result.="<option value=''></option>"; }
+    if ($includeempty) { $monthselector.="<option value=''></option>"; }
     for(my $m = 1;$m <=$#Months;$m++) {
-        $result .= "      <option value=\"$m\" ";
-        $result .= "selected " if ($m-1 eq $month);
-        $result .= "> ".&mt($Months[$m])." </option>\n";
+        $monthselector .= qq{      <option value="$m" };
+        $monthselector .= "selected " if ($m-1 eq $month);
+        $monthselector .= '> '.&mt($Months[$m]).' </option>';
     }
-    $result .= "  </select>\n";
+    $monthselector.= '  </select>';
     # Day
-    $result .= "  <input type=\"text\" name=\"$dname\_day\" ".$state.' '.
-            "value=\"$mday\" size=\"3\" ".$special.' '.
-            "onChange=\"javascript:$dname\_checkday()\" />\n";
+    my $dayselector = qq{<input type="text" name="$dname\_day" $state value="$mday" size="3" $special onchange="javascript:$dname\_checkday()" />};
     # Year
-    $result .= "  <input type=\"year\" name=\"$dname\_year\" ".$state.' '.
-            "value=\"$year\" size=\"5\" ".$special.' '.
-            "onChange=\"javascript:$dname\_checkday()\" />\n";
-    $result .= "&nbsp;&nbsp;";
-    if (! $no_hh_mm_ss) {
-        # Hours
-        $result .= "  <select name=\"$dname\_hour\" ".$special." ".$state.' '.
-            ">\n";
-        if ($includeempty) { $result.="<option value=''></option>"; }
-        for (my $h = 0;$h<24;$h++) {
-            $result .= "      <option value=\"$h\" ";
-            $result .= "selected " if (defined($hour) && $hour == $h);
-            $result .= "> ";
-            my $timest='';
-            if ($h == 0) {
-                $timest .= "12 am";
-            } elsif($h == 12) {
-                $timest .= "12 noon";
-            } elsif($h < 12) {
-                $timest .= "$h am";
-            } else {
-                $timest .= $h-12 ." pm";
-            }
-            $timest=&mt($timest);
-            $result .= $timest." </option>\n";
-        } 
-        $result .= "  </select>\n";
-        $result .= "  <input type=\"text\" name=\"$dname\_minute\" ".
-            $special.' '.
-            $state.' '.
-            "value=\"$min\" size=\"3\" /> m\n";
-        $result .= "  <input type=\"text\" name=\"$dname\_second\" ".
-            $special.' '.
-            $state.' '.
-            "value=\"$sec\" size=\"3\" /> s\n";
+    my $yearselector = qq{<input type="year" name="$dname\_year" $state value="$year" size="5" $special onchange="javascript:$dname\_checkday()" />};
+    #
+    my $hourselector = qq{<select name="$dname\_hour" $special $state >};
+    if ($includeempty) { 
+        $hourselector.=qq{<option value=''></option>};
+    }
+    for (my $h = 0;$h<24;$h++) {
+        $hourselector .= qq{<option value="$h" };
+        $hourselector .= "selected " if (defined($hour) && $hour == $h);
+        $hourselector .= ">";
+        my $timest='';
+        if ($h == 0) {
+            $timest .= "12 am";
+        } elsif($h == 12) {
+            $timest .= "12 noon";
+        } elsif($h < 12) {
+            $timest .= "$h am";
+        } else {
+            $timest .= $h-12 ." pm";
+        }
+        $timest=&mt($timest);
+        $hourselector .= $timest." </option>\n";
+    }
+    $hourselector .= "  </select>\n";
+    my $minuteselector = qq{<input type="text" name="$dname\_minute" $special $state value="$min" size="3" />};
+    my $secondselector= qq{<input type="text" name="$dname\_second" $special $state value="$sec" size="3" />};
+    my $cal_link = qq{<a href="javascript:$dname\_opencalendar()">};
+    #
+    if ($no_hh_mm_ss) {
+        $result .= &mt('[_1] [_2] [_3] [_4]Select Date[_5]',
+                       $monthselector,$dayselector,$yearselector,
+                       $cal_link,'</a>');
+    } else {
+        $result .= &mt('[_1] [_2] [_3] [_4] [_5]m [_6]s [_7]Select Date[_8]',
+                       $monthselector,$dayselector,$yearselector,
+                       $hourselector,$minuteselector,$secondselector,
+                       $cal_link,'</a>');
     }
-    $result .= "<a href=\"javascript:$dname\_opencalendar()\">".
-    &mt('Select Date')."</a></nobr>\n<!-- end $dname date setting form -->\n";
+    $result .= "</nobr>\n<!-- end $dname date setting form -->\n";
     return $result;
 }
 
@@ -804,8 +803,10 @@ sub Increment_PrgWin {
     my $sec = $time_est % 60;
     # 
     my $str;
-    if ($min == 1 && $sec > 1) {
+    if ($min == 0 && $sec > 1) {
         $str = '[_2] seconds';
+    } elsif ($min == 1 && $sec > 1) {
+        $str = '1 minute [_2] seconds';
     } elsif ($min == 1 && $sec < 2) {
         $str = '1 minute';
     } elsif ($min < 10 && $sec > 1) {
@@ -885,9 +886,12 @@ sub crumbs {
 	    unless ($path eq $uri) { $path.='/'; }
 	    my $linkpath=$path;
 	    if ($form) {
-		$linkpath="javascript:$form.action='$path';$form.submit();";
+		my $escaped_path = &Apache::loncommon::escape_single($path);
+		$linkpath="javascript:$form.action='$escaped_path';$form.submit();";
 	    }
-	    $output.='<a href="'.$linkpath.'"'.($target?' target="'.$target.'"':'').'>'.$_.'</a>/';
+	    my $escaped_linkpath = &Apache::loncommon::escape_single($linkpath);
+	    my $escaped_target   = &Apache::loncommon::escape_single($target);
+	    $output.='<a href="'.$escaped_linkpath.'"'.($target?' target="'.$escaped_target.'"':'').'>'.$_.'</a>/';
 	}
     } else {
 	$output.=$uri;
@@ -902,7 +906,7 @@ sub spellheader {
     my $nothing = &javascript_nothing();
     return (<<ENDCHECK);
 <script type="text/javascript"> 
-// BEGIN LON-CAPA Internal
+//<!-- BEGIN LON-CAPA Internal
 var checkwin;
 
 function spellcheckerwindow() {
@@ -910,7 +914,7 @@ function spellcheckerwindow() {
     checkwin.document.writeln('<html><body bgcolor="#DDDDDD"><form name="spellcheckform" action="/adm/spellcheck" method="post"><input type="hidden" name="text" value="" /></form></body></html>');
     checkwin.document.close();
 }
-// END LON-CAPA Internal
+// END LON-CAPA Internal -->
 </script>
 ENDCHECK
 }
@@ -974,7 +978,7 @@ sub disablelink {
     if (defined($#fields)) {
 	unless ($#fields>=0) { return ''; }
     }
-    return '<a href="/adm/preferences?action=set_wysiwyg&wysiwyg=off&returnurl='.&Apache::lonnet::escape($ENV{'REQUEST_URI'}).'">'.&mt('Disable WYSIWYG Editor').'</a>';
+    return '<a href="'.&HTML::Entities::encode('/adm/preferences?action=set_wysiwyg&wysiwyg=off&returnurl=','<>&"').&Apache::lonnet::escape($ENV{'REQUEST_URI'}).'">'.&mt('Disable WYSIWYG Editor').'</a>';
 }
 
 sub enablelink {
@@ -982,7 +986,7 @@ sub enablelink {
     if (defined($#fields)) {
 	unless ($#fields>=0) { return ''; }
     }
-    return '<a href="/adm/preferences?action=set_wysiwyg&wysiwyg=on&returnurl='.&Apache::lonnet::escape($ENV{'REQUEST_URI'}).'">'.&mt('Enable WYSIWYG Editor').'</a>';
+    return '<a href="'.&HTML::Entities::encode('/adm/preferences?action=set_wysiwyg&wysiwyg=on&returnurl=','<>&"').&Apache::lonnet::escape($ENV{'REQUEST_URI'}).'">'.&mt('Enable WYSIWYG Editor').'</a>';
 }
 
 # ----------------------------------------- Script to activate only some fields