--- loncom/interface/lonwishlist.pm	2014/12/15 17:36:22	1.23
+++ loncom/interface/lonwishlist.pm	2018/04/14 02:29:44	1.27
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Utility-routines for wishlist
 #
-# $Id: lonwishlist.pm,v 1.23 2014/12/15 17:36:22 raeburn Exp $
+# $Id: lonwishlist.pm,v 1.27 2018/04/14 02:29:44 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -536,12 +536,16 @@ sub JSforWishlist {
             ' Paths to LON-CAPA resources must be of the form /res/domain/user/...'.
             ' Paths to external websites must contain the network protocol, e.g. http://...');
     my $warningLinkNotAllowed2 = &mt('The following link is not allowed:').' ';
-    my $warningLink = &mt('You must insert a title and a path!');
-    my $warningFolder = &mt('You must insert a title!');
     my $warningDelete = &mt('Are you sure you want to delete the selected entries? Deleting a folder also deletes all entries within this folder!');
     my $warningSave = &mt('You have unsaved changes. You can either save these changes now by clicking "OK" or click "Cancel" if you do not want to save your changes.');
     my $warningMoveS = &mt('You must select at minimum one entry to move!');
     my $warningMoveD = &mt('You must select a destination folder!');
+    &js_escape(\$warningLinkNotAllowed1);
+    &js_escape(\$warningLinkNotAllowed2);
+    &js_escape(\$warningDelete);
+    &js_escape(\$warningSave);
+    &js_escape(\$warningMoveS);
+    &js_escape(\$warningMoveD);
     $foldersOption = '';
 
     my $js = &Apache::lonhtmlcommon::scripttag(<<JAVASCRIPT);
@@ -1131,8 +1135,9 @@ sub wishlistView {
         }
         # entry is a link
         else {
+            my $quotable_link = &Apache::loncommon::escape_single($n->value()->path());
             $wishlistHTMLview .= '<td id="padd'.$index.'" style="padding-left:'.(($indent_view-$indentConst)<=0?$indentConst:$indent_view).'px; min-width: 220px;">'.
-                                 '<a href="javascript:preview('."'".$n->value()->path()."'".');">'.
+                                 '<a href="javascript:preview('."'".$quotable_link."'".');">'.
                                  '<img src="/res/adm/pages/wishlist-link.png" id="img'.$index.'" alt="link" />'.
                                  $n->value()->title().'</a></td>';
         }
@@ -1305,9 +1310,10 @@ sub wishlistMove {
                $highlight = 'style="color:red;"';
             }
             # link-image and title
+            my $quotable_link = &Apache::loncommon::escape_single($n->value()->path());
             $wishlistHTMLmove .= '<td></td>'.
                                  '<td id="padd'.$index.'" style="padding-left:'.(($indent_move-$indentConst)<=0?$indentConst:$indent_move).'px; min-width: 220px;">'.
-                                 '<a href="javascript:preview('."'".$n->value()->path()."'".');" '.$highlight.'>'.
+                                 '<a href="javascript:preview('."'".$quotable_link."'".');" '.$highlight.'>'.
                                  '<img src="/res/adm/pages/wishlist-link.png" id="img'.$index.'" alt="link"/>'.
                                  $n->value()->title().'</a></td>';
         }
@@ -1425,7 +1431,8 @@ sub wishlistImport {
         else {
             $wishlistHTMLimport .= '<td id="padd'.$index.'" style="padding-left:'.(($indent_imp-$indentConst)<=0?$indentConst:$indent_imp).'px; min-width: 220px;">';
             unless ($nopick{$n->value()->path()}) {
-                $wishlistHTMLimport .= '<a href="javascript:preview('."'".$n->value()->path()."'".');">';
+                my $quotable_link = &Apache::loncommon::escape_single($n->value()->path());
+                $wishlistHTMLimport .= '<a href="javascript:preview('."'".$quotable_link."'".');">';
             }
             $wishlistHTMLimport .= '<img src="/res/adm/pages/'.$image.'" id="img'.$index.'" alt="link" />'.
                                    '<span '.$style.'>'.$n->value()->title().'</span></a></td>';
@@ -1473,6 +1480,11 @@ sub makePage {
     $root = $rootgiven;
     @childrenRt = $root->children();
 
+    my $windowname = 'loncapaclient';
+    if ($env{'request.lti.login'}) {
+        $windowname .= 'lti';
+    }
+
     # breadcrumbs and start_page
     &Apache::lonhtmlcommon::clear_breadcrumbs();
     &Apache::lonhtmlcommon::add_breadcrumb(
@@ -1481,9 +1493,9 @@ sub makePage {
     my $startPage = &Apache::loncommon::start_page('Stored Links',undef,
                                                      {'add_entries' => {
                                                         'onload' => 'javascript:onLoadAction('."'".$mode."'".');',
-                                                        'onunload' => 'javascript:window.name = '."'loncapaclient'"}});
+                                                        'onunload' => 'javascript:window.name = '."'$windowname'"}});
 
-    my $breadcrumbs = &Apache::lonhtmlcommon::breadcrumbs(&mt('Stored Links'),'Wishlist');
+    my $breadcrumbs = &Apache::lonhtmlcommon::breadcrumbs('Stored Links','Wishlist');
 
     # get javascript-code for wishlist-interactions
     my $js = &JSforWishlist();
@@ -1658,6 +1670,8 @@ sub makePopUpNewLink {
             ' or to external websites.'.
             ' Paths to LON-CAPA resources must be of the form /res/domain/user/...'.
             ' Paths to external websites must contain the network protocol, e.g. http://...');
+    &js_escape(\$warningLink);
+    &js_escape(\$warningLinkNotAllowed1);
 
     my $inPageWishlistlink1 = '<h1>'.&mt('Save to Stored Links').'</h1>';
     # If no title is delivered, 'New Link' is called up from the wishlist-interface, so after
@@ -1761,7 +1775,7 @@ sub makePopUpNewFolder {
                                        'bgcolor'   => '#FFFFFF',});
 
     my $warningFolder = &mt('You must insert a title!');
-
+    &js_escape(\$warningFolder);
 
     my $inPageNewFolder = '<h1>'.&mt('New Folder').'</h1>'.
                           '<form method="post" name="newfolder" action="/adm/wishlist" target="wishlist" '.