--- rat/lonwrapper.pm	2017/05/10 13:49:21	1.63
+++ rat/lonwrapper.pm	2017/11/30 14:41:30	1.65
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Wrapper for external and binary files as standalone resources
 #
-# $Id: lonwrapper.pm,v 1.63 2017/05/10 13:49:21 raeburn Exp $
+# $Id: lonwrapper.pm,v 1.65 2017/11/30 14:41:30 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -38,7 +38,8 @@ use Apache::loncommon();
 use Apache::lonhtmlcommon();
 use Apache::lonextresedit();
 use Apache::lonexttool();
-use LONCAPA qw(:DEFAULT :match);;
+use LONCAPA qw(:DEFAULT :match);
+use HTML::Entities();
 
 # ================================================================ Main Handler
 sub wrapper {
@@ -104,6 +105,7 @@ sub wrapper {
             if ($linktext eq '') {
                 $linktext = &mt('Launch External Tool');
             }
+            $url = &HTML::Entities::encode($url,'"<>&');
             if ($exttool eq 'tab') {
                 $output .= '<div>'.
                            '<a href="'.$url.'" target="LCExternalToolTab" style="padding:0;clear:both;margin:0;border:0">'.
@@ -112,6 +114,7 @@ sub wrapper {
             } else {
                 $output .= <<"ENDLINK";
 <script type="text/javascript">
+// <![CDATA[
 var windowObjectReference = null; 
 var PreviousUrl; 
                            
@@ -128,6 +131,7 @@ function openSinglePopup(strUrl) {
     };
     PreviousUrl = strUrl;
 }
+// ]]>
 </script>
 <div>
 <a href="$url" target="LCExternalToolPopUp" onclick="openSinglePopup(this.href); return false;">
@@ -139,8 +143,9 @@ ENDLINK
                 $output .= '<div>'.$explanation.'</div>';
             }
         } else {
+            my $dest = &HTML::Entities::encode($url.$anchor,'&<>"');
             $output .= '<div style="overflow:scroll; -webkit-overflow-scrolling:touch;">'."\n".
-                       '<iframe src="'.$url.$anchor.'" height="100%" width="100%" frameborder="0">'."\n".
+                       '<iframe src="'.$dest.'" height="100%" width="100%" frameborder="0">'."\n".
                        "$lt{'noif'} $noiframe\n".
                        "</iframe>\n".
                        "</div>\n";
@@ -179,11 +184,12 @@ ENDLINK
         window.onload = function(){  \$(window).trigger('resize') };
 SCRIPT
         # javascript will position the iframe if window was resized (or zoomed)
+        my $dest = &HTML::Entities::encode($url.$anchor,'&<>"');
         return <<ENDFRAME;
         $startpage
         $script
         <div class="LC_iframecontainer">
-            <iframe src="$url$anchor">$lt{'noif'} $noiframe</iframe>
+            <iframe src="$dest">$lt{'noif'} $noiframe</iframe>
         </div>
         $endpage
 ENDFRAME
@@ -220,7 +226,7 @@ sub handler {
         my %toolhash = &Apache::lonnet::get('exttool_'.$marker,['target','linktext','explanation','id','width','height'],
                                             $cdom,$cnum);
         if ($toolhash{'id'}) {
-            my %ltitools = &Apache::lonnet::get_domain_ltitools($cdom);
+            my %ltitools = &Apache::lonnet::get_domain_lti($cdom,'consumer');
             if (ref($ltitools{$toolhash{'id'}}) eq 'HASH') {
                 $exttoolremote = $ltitools{$toolhash{'id'}}{'url'};
             }
@@ -339,7 +345,7 @@ described at http://www.lon-capa.org.
 
 =over
 
-=item wrapper($url,$brcrum,$absolute,$is_ext,$is_pdf,$title))
+=item wrapper($url,$brcrum,$absolute,$is_ext,$is_pdf,$linktext,$explanation,$title,$width,$height)
 
 =over