--- rat/lonwrapper.pm	2022/10/27 21:35:30	1.80
+++ rat/lonwrapper.pm	2023/11/18 21:45:11	1.84
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Wrapper for external and binary files as standalone resources
 #
-# $Id: lonwrapper.pm,v 1.80 2022/10/27 21:35:30 raeburn Exp $
+# $Id: lonwrapper.pm,v 1.84 2023/11/18 21:45:11 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -82,7 +82,7 @@ sub wrapper {
         }
     }
 
-    my $noiframe = &Apache::loncommon::modal_link($url.$anchor,$lt{'show'},500,400);
+    my $noiframe = &Apache::loncommon::modal_link(&HTML::Entities::encode($url.$anchor,'&<>"\''),$lt{'show'},500,400);
     my $args = {'bgcolor' => '#FFFFFF'};
     if ($forcereg) {
         $args->{'force_register'} = $forcereg;
@@ -95,6 +95,8 @@ sub wrapper {
     }
     if ($env{'form.only_body'}) {
         $args->{'only_body'} = $env{'form.only_body'};
+    } elsif (($is_supp) && ($env{'form.folderpath'} ne '')) {
+        $args->{'bread_crumbs_nomenu'} = 1;
     }
 
     my ($countdown,$donemsg,$headjs);
@@ -302,7 +304,7 @@ ENDLINK
     } else {
         my $offset = 5;
         &Apache::loncommon::get_unprocessed_cgi($ENV{'QUERY_STRING'},['inhibitmenu']);
-        if ($env{'form.inhibitmenu'} eq 'yes') {
+        if (($env{'form.inhibitmenu'} eq 'yes') || ($env{'form.only_body'})) {
             $offset = 0;
         }
         my $script = &Apache::lonhtmlcommon::scripttag(<<SCRIPT);
@@ -425,9 +427,16 @@ sub handler {
         my %toolhash = &Apache::lonnet::get('exttool_'.$marker,['target','linktext','explanation','id','width','height'],
                                             $cdom,$cnum);
         if ($toolhash{'id'}) {
-            my %ltitools = &Apache::lonnet::get_domain_lti($cdom,'consumer');
-            if (ref($ltitools{$toolhash{'id'}}) eq 'HASH') {
-                $exttoolremote = $ltitools{$toolhash{'id'}}{'url'};
+            my ($idx,%ltitools);
+            if ($toolhash{'id'} =~ /^c(\d+)$/) {
+                $idx = $1;
+                %ltitools = &Apache::lonnet::get_course_lti($cnum,$cdom,'consumer');
+            } else {
+                $idx = $toolhash{'id'};
+                %ltitools = &Apache::lonnet::get_domain_lti($cdom,'consumer');
+            }
+            if (ref($ltitools{$idx}) eq 'HASH') {
+                $exttoolremote = $ltitools{$idx}{'url'};
             }
         }
         if ($toolhash{'target'} eq 'window') {
@@ -446,7 +455,7 @@ sub handler {
     }
     if (($is_ext) || ($exttool)) {
         &Apache::loncommon::get_unprocessed_cgi($ENV{'QUERY_STRING'},
-            ['forceedit','register','folderpath','symb','idx','title','anchor']);
+            ['forceedit','register','folderpath','symb','idx','title','anchor','only_body']);
         if (($env{'form.forceedit'}) &&
             (&Apache::lonnet::allowed('mdc',$env{'request.course.id'})) &&
             (($env{'form.folderpath'} =~ /^supplemental/) ||
@@ -484,14 +493,17 @@ sub handler {
                     $title = &mt('External Tool');
                 }
             }
+            $title = &HTML::Entities::encode($title,'\'"<>&');
             $is_supp = 1;
             if ($env{'request.course.id'}) {
                 $cnum = $env{'course.'.$env{'request.course.id'}.'.num'};
                 $cdom = $env{'course.'.$env{'request.course.id'}.'.domain'};
                 &Apache::loncommon::validate_folderpath(1,'',$cnum,$cdom);
             }
-            $brcrum =
-                &Apache::lonhtmlcommon::docs_breadcrumbs(undef,$crstype,undef,$title,1);
+            unless ($env{'form.only_body'}) {
+                $brcrum =
+                    &Apache::lonhtmlcommon::docs_breadcrumbs(undef,$crstype,undef,$title,1);
+            }
         }
     } elsif ($env{'request.course.id'}) {
         my $courseurl = &Apache::lonnet::courseid_to_courseurl($env{'request.course.id'});
@@ -499,17 +511,19 @@ sub handler {
         if ($url =~ m{^\Q/uploaded/$courseurl/supplemental/\E}) {
             $is_supp = 1;
             &Apache::loncommon::get_unprocessed_cgi($ENV{'QUERY_STRING'},
-                                                    ['folderpath','title']);
+                                                    ['folderpath','title','only_body']);
             if ($env{'form.folderpath'}) {
                 $cnum = $env{'course.'.$env{'request.course.id'}.'.num'};
                 $cdom = $env{'course.'.$env{'request.course.id'}.'.domain'};
                 &Apache::loncommon::validate_folderpath(1,'',$cnum,$cdom);
             }
             my $title = $env{'form.title'};
+            $title = &HTML::Entities::encode($title,'\'"<>&');
             my $crstype = &Apache::loncommon::course_type();
-            $brcrum =
-                &Apache::lonhtmlcommon::docs_breadcrumbs(undef,$crstype,undef,$title,1);
-
+            unless ($env{'form.only_body'}) {
+                $brcrum =
+                    &Apache::lonhtmlcommon::docs_breadcrumbs(undef,$crstype,undef,$title,1);
+            }
         }
     }