--- loncom/interface/lonmenu.pm	2017/03/14 21:14:21	1.369.2.70
+++ loncom/interface/lonmenu.pm	2018/09/04 02:22:30	1.369.2.73
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Routines to control the menu
 #
-# $Id: lonmenu.pm,v 1.369.2.70 2017/03/14 21:14:21 raeburn Exp $
+# $Id: lonmenu.pm,v 1.369.2.73 2018/09/04 02:22:30 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -499,6 +499,8 @@ sub secondary_menu {
                         next if ($item->[2] eq 'mgr' && !$canmgr);
                         next if ($item->[2] eq 'vcg' && !$canviewgrps);
                         next if ($item->[2] eq 'crsedit' && !$canedit && !$canvieweditor);
+                        next if ($item->[2] eq 'author' && !$author);
+                        next if ($item->[2] eq 'cca' && !$canmodifycoauthor);
                         push(@scndsub,$item); 
                     }
                 }
@@ -528,6 +530,7 @@ sub secondary_menu {
                 } else {
                     $$menuitem[0] =~ s{\?register=1}{};
                 }
+                $$menuitem[0] = &HTML::Entities::encode($$menuitem[0],'&<>"');
             }
             $menu .= &prep_menuitem(\@$menuitem);
         }
@@ -546,7 +549,7 @@ sub secondary_menu {
             my $londocroot = $Apache::lonnet::perlvar{'lonDocRoot'};
             ($escurl = $env{'request.filename'}) =~ s{^\Q$londocroot\E}{};
             $escurl  = &escape($escurl);
-        }    
+        }
         $menu =~ s/\[url\]/$escurl/g;
         $menu =~ s/\[symb\]/$escsymb/g;
     }
@@ -635,6 +638,20 @@ sub build_submenu {
                     next unless (($env{'user.name'} ne '') && ($env{'user.domain'} ne ''));
                     $href =~ s/\[domain\]/$env{'user.domain'}/g;
                     $href =~ s/\[user\]/$env{'user.name'}/g;
+                } elsif (($href =~ m{^/adm/preferences\?}) && ($href =~ /\[returnurl\]/)) {
+                    my $returnurl = $ENV{'REQUEST_URI'};
+                    if ($ENV{'REQUEST_URI'} =~ m{/adm/preferences\?action=(?:changedomcoord|authorsettings)\&returnurl=([^\&]+)$}) {
+                        $returnurl = $1;
+                    }
+                    if (($returnurl =~ m{^/adm/createuser($|\?action=)}) ||
+                        ($returnurl =~ m{^/priv/$match_domain/$match_username}) ||
+                        ($returnurl =~ m{^/res(/?$|/$match_domain/$match_username)})) {
+                        $returnurl =~ s{\?.*$}{};
+                        $returnurl = '&amp;returnurl='.&HTML::Entities::encode($returnurl,'"<>&\'');
+                    } else {
+                        undef($returnurl);
+                    }
+                    $href =~ s/\[returnurl\]/$returnurl/;
                 }
                 unless (($href eq '') || ($href =~ /^\#/)) {
                     $target = ' target="_top"';
@@ -1469,8 +1486,9 @@ sub prepare_functions {
     }
 
     my $editbutton = '';
+    my $viewsrcbutton = '';
 #
-# Determine whether or not to display 'Edit' icon/button
+# Determine whether or not to display 'Edit' or 'View Source' icon/button
 #
     if ($resurl =~ m{^/?adm/($match_domain)/($match_username)/aboutme$}) {
         my $file=&Apache::lonnet::declutter($env{'request.filename'});
@@ -1503,7 +1521,11 @@ sub prepare_functions {
         if (($perms{'mdc'}) &&
             (($resurl =~ m{^/?public/$cdom/$cnum/syllabus}) ||
             ($resurl =~ m{^/?uploaded/$cdom/$cnum/portfolio/syllabus/}))) {
-            $cfile = $resurl;
+            if ($resurl =~ m{^/}) {
+                $cfile = $resurl;
+            } else {
+                $cfile = "/$resurl";
+            }
             $home = &Apache::lonnet::homeserver($cnum,$cdom);
             if ($env{'form.forceedit'}) {
                 $forceview = 1;
@@ -1540,6 +1562,29 @@ sub prepare_functions {
                     $editbutton = &get_editbutton($cfile,$home,$switchserver,
                                                   $forceedit,$forceview,$forcereg);
                 }
+                if ((($cfile eq '') || (!$editbutton)) &&
+                    ($resurl =~ /$LONCAPA::assess_re/)) {
+                    my $showurl = &Apache::lonnet::clutter($resurl);
+                    if ((&Apache::lonnet::allowed('cre','/')) &&
+                        (&Apache::lonnet::metadata($resurl,'sourceavail') eq 'open')) {
+                        $viewsrcbutton = 1;
+                    } elsif (&Apache::lonnet::allowed('vxc',$env{'request.course.id'})) {
+                        if ($showurl =~ m{^\Q/res/$cdom/\E($match_username)/}) {
+                            my $auname = $1;
+                            if (($env{'request.course.adhocsrcaccess'} ne '') &&
+                                (grep(/^\Q$auname\E$/,split(/,/,$env{'request.course.adhocsrcaccess'})))) {
+                                $viewsrcbutton = 1;
+                            } elsif ((&Apache::lonnet::metadata($resurl,'sourceavail') eq 'open') &&
+                                     (&Apache::lonnet::allowed('bre','/'))) {
+                                $viewsrcbutton = 1;
+                            }
+                        }
+                    }
+                    if ($viewsrcbutton) {
+                        &switch('','',6,1,'pcstr.png','View Source','resource[_2]','open_source()',
+                                'View source code');
+                    }
+                }
             }
         }
     }
@@ -2156,15 +2201,6 @@ return (<<ENDUTILITY)
 
 $dc_popup_cid
 
-function go(url) {
-   if (url!='' && url!= null) {
-       currentURL = null;
-       currentSymb= null;
-       var lcHostname = setLCHost();
-       window.location.href=lcHostname+url;
-   }
-}
-
 $jumptores
 
 function gopost(url,postdata) {