--- loncom/publisher/lonpublisher.pm	2014/01/15 18:49:56	1.289
+++ loncom/publisher/lonpublisher.pm	2014/08/03 14:20:38	1.293
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Publication Handler
 #
-# $Id: lonpublisher.pm,v 1.289 2014/01/15 18:49:56 bisitz Exp $
+# $Id: lonpublisher.pm,v 1.293 2014/08/03 14:20:38 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -468,7 +468,7 @@ Currently undocumented
 #########################################
 #########################################
 sub set_allow {
-    my ($allow,$logfile,$target,$tag,$oldurl)=@_;
+    my ($allow,$logfile,$target,$tag,$oldurl,$type)=@_;
     my $newurl=&urlfixup($oldurl,$target);
     my $return_url=$oldurl;
     print $logfile 'GUYURL: '.$tag.':'.$oldurl.' - '.$newurl."\n";
@@ -480,6 +480,11 @@ sub set_allow {
 	($newurl !~ /^mailto:/i) &&
 	($newurl !~ /^(?:http|https|ftp):/i) &&
 	($newurl !~ /^\#/)) {
+        if (($type eq 'src') || ($type eq 'href')) {
+            if ($newurl =~ /^([^?]+)\?[^?]*$/) {
+                $newurl = $1;
+            }
+        }
 	$$allow{&absoluteurl($newurl,$target)}=1;
     }
     return $return_url;
@@ -721,9 +726,11 @@ sub fix_ids_and_indices {
 		    foreach my $type ('src','href','background','bgimg') {
 			foreach my $key (keys(%parms)) {
 			    if ($key =~ /^$type$/i) {
+                                next if (($lctag eq 'img') && ($type eq 'src') && 
+                                         ($parms{$key} =~ m{^data\:image/gif;base64,}));
 				$parms{$key}=&set_allow(\%allow,$logfile,
 							$target,$tag,
-							$parms{$key});
+							$parms{$key},$type);
 			    }
 			}
 		    }
@@ -818,6 +825,14 @@ sub fix_ids_and_indices {
 #
                                                     my $spritesheet = $1.'express_show/spritesheet.png';
                                                     $allow{&absoluteurl($spritesheet,$target)}=1;
+
+#
+# Camtasia 8.4: skins/express_show/spritesheet.min.css needed, and included in zip archive.
+# Not referenced directly in <main>.html or <main>_player.html files,
+# so add this file to %allow (where <main> is name user gave to file/archive).
+#
+                                                    my $spritecss = $1.'express_show/spritesheet.min.css';
+                                                    $allow{&absoluteurl($spritecss,$target)}=1;
                                                 }
                                             } elsif ($srctype eq 'PosterImageSrc') {
                                                 if ($url =~ m{^(.+)_First_Frame\.png$}) {
@@ -836,7 +851,39 @@ sub fix_ids_and_indices {
                                 }
                             }
                         }
-                        $outstring .= $script
+                        if ($script =~ m{\.addMediaSrc\((["'])((?!\1).+)\1\);}) {
+                            my $src = $2;
+                            if ($src) {
+                                my $url = &urlfixup($src);
+                                unless ($url=~m{^(?:http|https|ftp)://}) {
+                                    $allow{&absoluteurl($url,$target)}=1;
+                                }
+                            }
+                        }
+                        if ($script =~ /\(document,\s*(['"])script\1,\s*\[([^\]]+)\]\);/s) {
+                            my $scriptslist = $2;
+                            my @srcs = split(/\s*,\s*/,$scriptslist);
+                            foreach my $src (@srcs) {
+                                if ($src =~ /(["'])(?:(?!\1).)+\.js\1/) {
+                                    my $quote = $1;
+                                    my ($url) = ($src =~ m/\Q$quote\E([^$quote]+)\Q$quote\E/);
+                                    $url = &urlfixup($url);
+                                    unless ($url=~m{^(?:http|https|ftp)://}) {
+                                        $allow{&absoluteurl($url,$target)}=1;
+                                    }
+                                }
+                            }
+                        }
+                        if ($script =~ m{loadScript\(\s*(['"])((?:(?!\1).)+\.js)\1,\s*function}is) {
+                            my $src = $2;
+                            if ($src) {
+                                my $url = &urlfixup($src);
+                                unless ($url=~m{^(?:http|https|ftp)://}) {
+                                    $allow{&absoluteurl($url,$target)}=1;
+                                }
+                            }
+                        }
+                        $outstring .= $script;
                     }
                 }
 	    } elsif ($token->[0] eq 'E') {