--- loncom/interface/lonmenu.pm	2017/02/25 19:43:16	1.469
+++ loncom/interface/lonmenu.pm	2017/05/10 19:26:24	1.473
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Routines to control the menu
 #
-# $Id: lonmenu.pm,v 1.469 2017/02/25 19:43:16 raeburn Exp $
+# $Id: lonmenu.pm,v 1.473 2017/05/10 19:26:24 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -513,6 +513,7 @@ sub secondary_menu {
                         }
                     }
                 }
+                $$menuitem[0] = &HTML::Entities::encode($$menuitem[0],'&<>"');
             }
             $menu .= &prep_menuitem(\@$menuitem);
         }
@@ -531,7 +532,7 @@ sub secondary_menu {
             my $londocroot = $Apache::lonnet::perlvar{'lonDocRoot'};
             ($escurl = $env{'request.filename'}) =~ s{^\Q$londocroot\E}{};
             $escurl  = &escape($escurl);
-        }    
+        }
         $menu =~ s/\[url\]/$escurl/g;
         $menu =~ s/\[symb\]/$escsymb/g;
     }
@@ -918,7 +919,7 @@ if ($env{'browser.mobile'}) {
     $is_mobile = 1;
 }
 
-            unless ($env{'request.noversionuri'}=~/\/(bulletinboard|smppg|navmaps|syllabus|aboutme|viewclasslist|portfolio|exttools?)(\?|$)/) {
+            unless ($env{'request.noversionuri'}=~/\/(bulletinboard|smppg|navmaps|syllabus|aboutme|viewclasslist|portfolio|ext\.tool)(\?|$)/) {
 		if ((!$env{'request.enc'}) && ($env{'request.noversionuri'} !~ m{^/adm/wrapper/ext/}) && ($env{'request.noversionuri'} !~ m{^/uploaded/$match_domain/$match_courseid/docs/})) {
 		    $menuitems.=(<<ENDREALRES);
 s&6&3&catalog.png&Info&info[_1]&catalog_info('$is_mobile')&Show Metadata
@@ -1130,7 +1131,11 @@ sub prepare_functions {
         if (($perms{'mdc'}) &&
             (($resurl =~ m{^/?public/$cdom/$cnum/syllabus}) ||
             ($resurl =~ m{^/?uploaded/$cdom/$cnum/portfolio/syllabus/}))) {
-            $cfile = $resurl;
+            if ($resurl =~ m{^/}) {
+                $cfile = $resurl;
+            } else {
+                $cfile = "/$resurl";
+            }
             $home = &Apache::lonnet::homeserver($cnum,$cdom);
             if ($env{'form.forceedit'}) {
                 $forceview = 1;
@@ -1216,7 +1221,7 @@ sub prepare_functions {
         if (($env{'form.folderpath'} =~ /^supplemental/) &&
             (&Apache::lonnet::allowed('mdc',$env{'request.course.id'})) &&
             (($resurl =~ m{^/adm/wrapper/ext/}) ||
-             ($resurl =~ m{^/adm/$cdom/$cnum/\d+/exttools?$}) ||
+             ($resurl =~ m{^/adm/$cdom/$cnum/\d+/ext\.tool$}) ||
              ($resurl =~ m{^/uploaded/$cdom/$cnum/supplemental/}) ||
              ($resurl eq '/adm/supplemental') ||
              ($resurl =~ m{^/public/$cdom/$cnum/syllabus$}) ||