--- loncom/interface/portfolio.pm	2017/05/19 23:41:28	1.258
+++ loncom/interface/portfolio.pm	2020/09/09 01:11:15	1.263
@@ -1,7 +1,7 @@
 # The LearningOnline Network
 # portfolio browser
 #
-# $Id: portfolio.pm,v 1.258 2017/05/19 23:41:28 raeburn Exp $
+# $Id: portfolio.pm,v 1.263 2020/09/09 01:11:15 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -121,8 +121,8 @@ END
                  .'<fieldset>'
                  .'<legend>'.$lt{'upload_label'}.'</legend>'
                  .$groupitem 
-                 .'<input name="uploaddoc" type="file" class="flUpload" />'
-                 .'<input type="hidden" id="free_space" value="'.$free_space.'" />'
+                 .'<input name="uploaddoc" type="file" class="LC_flUpload" />'
+                 .'<input type="hidden" id="LC_free_space" value="'.$free_space.'" />'
                  .'<input type="hidden" name="currentpath" value="'.$current_path.'" />'
                  .'<input type="hidden" name="action" value="'.$env{"form.action"}.'" />'
                  .'<input type="hidden" name="symb" value="'.$env{"form.symb"}.'" />'
@@ -2549,13 +2549,15 @@ sub coursegrp_portfolio_header {
     }
     &Apache::lonhtmlcommon::add_breadcrumb
         ({href=>"/adm/$cdom/$cnum/$env{'form.group'}/smppg?ref=$env{'form.ref'}",
-          text=>"$ucgpterm: $grp_desc",
-          title=>"Go to group's home page"},
+          text=>&mt('Group').": $grp_desc",
+          title=>&mt("Go to group's home page"),
+          no_mt=>1},
          {href=>"/adm/coursegrp_portfolio?".&group_args(),
           text=>"Group Portfolio",
           title=>"Display group portfolio"});
     my $output = &Apache::lonhtmlcommon::breadcrumbs(
-                         &mt('[_1] portfolio files - [_2]',$gpterm,$grp_desc));
+                         &mt('Group portfolio files - [_1]',$grp_desc),
+                                                     undef,undef,undef,undef,1);
     return $output;
 }
 
@@ -2615,6 +2617,45 @@ sub free_space {
     return $free_space;
 }
 
+sub valid_container {
+    my ($uname,$udom,$group) = @_;
+    my $container_prefix;
+    if ($group ne '') {
+        $container_prefix = "/uploaded/$udom/$uname/groups/$group/portfolio";
+    } else {
+        $container_prefix = "/uploaded/$udom/$uname/portfolio";
+    }
+    if ($env{'form.currentpath'}) {
+        $container_prefix .= $env{'form.currentpath'};
+    } else {
+        $container_prefix .= '/';
+    }
+    if ($env{'form.container'} =~ m{^\Q$container_prefix\E(.+)$}) {
+        my $filename = $1;
+        if ($filename eq &Apache::lonnet::clean_filename($filename)) {
+            return 1;
+        }
+    }
+    return;
+}
+
+sub invalid_parms {
+    my ($r,$url,$currentpath) = @_;
+    my $escpath = &HTML::Entities::encode($currentpath,'&<>"');
+    my $rtnlink = '<a href="'.$url;
+    if ($url =~ /\?/) {
+        $rtnlink .= '&';
+    } else {
+        $rtnlink .= '?';
+    }
+    $rtnlink .= 'currentpath='.$escpath;
+    $rtnlink .= '">'.&mt('Return to directory').'</a>';
+    $r->print('<h3>'.&mt('Action disallowed').'</h3>');
+    $r->print(&mt('Some of the data included with this request were invalid'));
+    $r->print('<br />'.$rtnlink);
+    return;
+}
+
 sub handler {
     # this handles file management
     my $r = shift;
@@ -2763,6 +2804,21 @@ sub handler {
             $r->print(&Apache::loncommon::end_page());
             return OK;
         }
+    }
+    if (($env{'form.currentpath'}) && ($env{'form.currentpath'} ne '/')) {
+        my $clean_currentpath = '/'.&Apache::loncommon::clean_path($env{'form.currentpath'}).'/';
+        unless ($env{'form.currentpath'} eq $clean_currentpath) {
+            &invalid_parms($r,$url);
+            $r->print(&Apache::loncommon::end_page());
+            return OK;
+        }
+    }
+    if ($env{'form.container'}) {
+        unless (&valid_container($uname,$udom,$group)) {
+            &invalid_parms($r,$url,$env{'form.currentpath'});
+            $r->print(&Apache::loncommon::end_page());
+            return OK;
+        }
     }
     if (($env{'form.storeupl'}) & (!$env{'form.uploaddoc.filename'})){
    	$r->print(