--- loncom/interface/lonwishlist.pm	2014/12/20 15:35:40	1.24
+++ loncom/interface/lonwishlist.pm	2015/06/09 21:22:57	1.25
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Utility-routines for wishlist
 #
-# $Id: lonwishlist.pm,v 1.24 2014/12/20 15:35:40 raeburn Exp $
+# $Id: lonwishlist.pm,v 1.25 2015/06/09 21:22:57 damieng Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -536,12 +536,16 @@ sub JSforWishlist {
             ' Paths to LON-CAPA resources must be of the form /res/domain/user/...'.
             ' Paths to external websites must contain the network protocol, e.g. http://...');
     my $warningLinkNotAllowed2 = &mt('The following link is not allowed:').' ';
-    my $warningLink = &mt('You must insert a title and a path!');
-    my $warningFolder = &mt('You must insert a title!');
     my $warningDelete = &mt('Are you sure you want to delete the selected entries? Deleting a folder also deletes all entries within this folder!');
     my $warningSave = &mt('You have unsaved changes. You can either save these changes now by clicking "OK" or click "Cancel" if you do not want to save your changes.');
     my $warningMoveS = &mt('You must select at minimum one entry to move!');
     my $warningMoveD = &mt('You must select a destination folder!');
+    &js_escape(\$warningLinkNotAllowed1);
+    &js_escape(\$warningLinkNotAllowed2);
+    &js_escape(\$warningDelete);
+    &js_escape(\$warningSave);
+    &js_escape(\$warningMoveS);
+    &js_escape(\$warningMoveD);
     $foldersOption = '';
 
     my $js = &Apache::lonhtmlcommon::scripttag(<<JAVASCRIPT);
@@ -1661,6 +1665,8 @@ sub makePopUpNewLink {
             ' or to external websites.'.
             ' Paths to LON-CAPA resources must be of the form /res/domain/user/...'.
             ' Paths to external websites must contain the network protocol, e.g. http://...');
+    &js_escape(\$warningLink);
+    &js_escape(\$warningLinkNotAllowed1);
 
     my $inPageWishlistlink1 = '<h1>'.&mt('Save to Stored Links').'</h1>';
     # If no title is delivered, 'New Link' is called up from the wishlist-interface, so after
@@ -1764,7 +1770,7 @@ sub makePopUpNewFolder {
                                        'bgcolor'   => '#FFFFFF',});
 
     my $warningFolder = &mt('You must insert a title!');
-
+    &js_escape(\$warningFolder);
 
     my $inPageNewFolder = '<h1>'.&mt('New Folder').'</h1>'.
                           '<form method="post" name="newfolder" action="/adm/wishlist" target="wishlist" '.