--- rat/lonwrapper.pm	2017/05/10 13:49:21	1.63
+++ rat/lonwrapper.pm	2017/05/10 19:25:28	1.64
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Wrapper for external and binary files as standalone resources
 #
-# $Id: lonwrapper.pm,v 1.63 2017/05/10 13:49:21 raeburn Exp $
+# $Id: lonwrapper.pm,v 1.64 2017/05/10 19:25:28 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -38,7 +38,8 @@ use Apache::loncommon();
 use Apache::lonhtmlcommon();
 use Apache::lonextresedit();
 use Apache::lonexttool();
-use LONCAPA qw(:DEFAULT :match);;
+use LONCAPA qw(:DEFAULT :match);
+use HTML::Entities();
 
 # ================================================================ Main Handler
 sub wrapper {
@@ -104,6 +105,7 @@ sub wrapper {
             if ($linktext eq '') {
                 $linktext = &mt('Launch External Tool');
             }
+            $url = &HTML::Entities::encode($url,'"<>&');
             if ($exttool eq 'tab') {
                 $output .= '<div>'.
                            '<a href="'.$url.'" target="LCExternalToolTab" style="padding:0;clear:both;margin:0;border:0">'.
@@ -112,6 +114,7 @@ sub wrapper {
             } else {
                 $output .= <<"ENDLINK";
 <script type="text/javascript">
+// <![CDATA[
 var windowObjectReference = null; 
 var PreviousUrl; 
                            
@@ -128,6 +131,7 @@ function openSinglePopup(strUrl) {
     };
     PreviousUrl = strUrl;
 }
+// ]]>
 </script>
 <div>
 <a href="$url" target="LCExternalToolPopUp" onclick="openSinglePopup(this.href); return false;">
@@ -139,8 +143,9 @@ ENDLINK
                 $output .= '<div>'.$explanation.'</div>';
             }
         } else {
+            my $dest = &HTML::Entities::encode($url.$anchor,'&<>"');
             $output .= '<div style="overflow:scroll; -webkit-overflow-scrolling:touch;">'."\n".
-                       '<iframe src="'.$url.$anchor.'" height="100%" width="100%" frameborder="0">'."\n".
+                       '<iframe src="'.$dest.'" height="100%" width="100%" frameborder="0">'."\n".
                        "$lt{'noif'} $noiframe\n".
                        "</iframe>\n".
                        "</div>\n";
@@ -179,11 +184,12 @@ ENDLINK
         window.onload = function(){  \$(window).trigger('resize') };
 SCRIPT
         # javascript will position the iframe if window was resized (or zoomed)
+        my $dest = &HTML::Entities::encode($url.$anchor,'&<>"');
         return <<ENDFRAME;
         $startpage
         $script
         <div class="LC_iframecontainer">
-            <iframe src="$url$anchor">$lt{'noif'} $noiframe</iframe>
+            <iframe src="$dest">$lt{'noif'} $noiframe</iframe>
         </div>
         $endpage
 ENDFRAME
@@ -339,7 +345,7 @@ described at http://www.lon-capa.org.
 
 =over
 
-=item wrapper($url,$brcrum,$absolute,$is_ext,$is_pdf,$title))
+=item wrapper($url,$brcrum,$absolute,$is_ext,$is_pdf,$linktext,$explanation,$title,$width,$height)
 
 =over