--- loncom/interface/lonsyllabus.pm	2006/05/11 16:29:20	1.52
+++ loncom/interface/lonsyllabus.pm	2006/08/16 19:40:46	1.54
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # Syllabus
 #
-# $Id: lonsyllabus.pm,v 1.52 2006/05/11 16:29:20 www Exp $
+# $Id: lonsyllabus.pm,v 1.54 2006/08/16 19:40:46 albertel Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -38,6 +38,7 @@ use Apache::lonannounce;
 use Apache::lonlocal;
 use Apache::lonhtmlcommon;
 use Apache::lonspeller();
+use HTML::Entities();
 
 sub handler {
     my $r = shift;
@@ -177,7 +178,9 @@ sub handler {
 # ----------------------------------------------------- Only if not public call
     if ($env{'user.environment'}) {
 # does this user have privileges to post, etc?
-       if ($env{'request.course.id'}) {
+       if ($env{'request.course.id'}
+	   && $cdom eq $env{'course.'.$env{'request.course.id'}.'.domain'}
+	   && $cnum eq $env{'course.'.$env{'request.course.id'}.'.num'}) {
           $allowed=&Apache::lonnet::allowed('mdc',$env{'request.course.id'});
 	  $privileged=$allowed;
 	  if (($syllabus{'uploaded.lastmodified'}) && (!$forceedit)) {
@@ -319,7 +322,7 @@ sub handler {
               if ($allowed) {
                  $r->print(
 	   '<br /><textarea cols="80" rows="12" name="'.$_.'" id="'.$_.'">'.
-			   $syllabus{$_}.
+			   &HTML::Entities::encode($syllabus{$_},'"&<>').
            '</textarea> <input type="submit" name="storesyl" value="Store" />');
 	      }
 	  }