--- rat/lonwrapper.pm	2022/10/27 21:35:30	1.80
+++ rat/lonwrapper.pm	2022/10/29 18:52:58	1.81
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Wrapper for external and binary files as standalone resources
 #
-# $Id: lonwrapper.pm,v 1.80 2022/10/27 21:35:30 raeburn Exp $
+# $Id: lonwrapper.pm,v 1.81 2022/10/29 18:52:58 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -484,6 +484,7 @@ sub handler {
                     $title = &mt('External Tool');
                 }
             }
+            $title = &HTML::Entities::encode($title,'\'"<>&');
             $is_supp = 1;
             if ($env{'request.course.id'}) {
                 $cnum = $env{'course.'.$env{'request.course.id'}.'.num'};
@@ -506,6 +507,7 @@ sub handler {
                 &Apache::loncommon::validate_folderpath(1,'',$cnum,$cdom);
             }
             my $title = $env{'form.title'};
+            $title = &HTML::Entities::encode($title,'\'"<>&');
             my $crstype = &Apache::loncommon::course_type();
             $brcrum =
                 &Apache::lonhtmlcommon::docs_breadcrumbs(undef,$crstype,undef,$title,1);