--- rat/lonwrapper.pm	2022/10/27 21:35:30	1.80
+++ rat/lonwrapper.pm	2023/05/22 21:20:56	1.82
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Wrapper for external and binary files as standalone resources
 #
-# $Id: lonwrapper.pm,v 1.80 2022/10/27 21:35:30 raeburn Exp $
+# $Id: lonwrapper.pm,v 1.82 2023/05/22 21:20:56 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -425,9 +425,16 @@ sub handler {
         my %toolhash = &Apache::lonnet::get('exttool_'.$marker,['target','linktext','explanation','id','width','height'],
                                             $cdom,$cnum);
         if ($toolhash{'id'}) {
-            my %ltitools = &Apache::lonnet::get_domain_lti($cdom,'consumer');
-            if (ref($ltitools{$toolhash{'id'}}) eq 'HASH') {
-                $exttoolremote = $ltitools{$toolhash{'id'}}{'url'};
+            my ($idx,%ltitools);
+            if ($toolhash{'id'} =~ /^c(\d+)$/) {
+                $idx = $1;
+                %ltitools = &Apache::lonnet::get_course_lti($cnum,$cdom,'consumer');
+            } else {
+                $idx = $toolhash{'id'};
+                %ltitools = &Apache::lonnet::get_domain_lti($cdom,'consumer');
+            }
+            if (ref($ltitools{$idx}) eq 'HASH') {
+                $exttoolremote = $ltitools{$idx}{'url'};
             }
         }
         if ($toolhash{'target'} eq 'window') {
@@ -484,6 +491,7 @@ sub handler {
                     $title = &mt('External Tool');
                 }
             }
+            $title = &HTML::Entities::encode($title,'\'"<>&');
             $is_supp = 1;
             if ($env{'request.course.id'}) {
                 $cnum = $env{'course.'.$env{'request.course.id'}.'.num'};
@@ -506,6 +514,7 @@ sub handler {
                 &Apache::loncommon::validate_folderpath(1,'',$cnum,$cdom);
             }
             my $title = $env{'form.title'};
+            $title = &HTML::Entities::encode($title,'\'"<>&');
             my $crstype = &Apache::loncommon::course_type();
             $brcrum =
                 &Apache::lonhtmlcommon::docs_breadcrumbs(undef,$crstype,undef,$title,1);