--- loncom/interface/lonmenu.pm	2017/04/10 05:37:47	1.369.2.71
+++ loncom/interface/lonmenu.pm	2019/02/22 01:57:36	1.369.2.74
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Routines to control the menu
 #
-# $Id: lonmenu.pm,v 1.369.2.71 2017/04/10 05:37:47 raeburn Exp $
+# $Id: lonmenu.pm,v 1.369.2.74 2019/02/22 01:57:36 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -499,6 +499,9 @@ sub secondary_menu {
                         next if ($item->[2] eq 'mgr' && !$canmgr);
                         next if ($item->[2] eq 'vcg' && !$canviewgrps);
                         next if ($item->[2] eq 'crsedit' && !$canedit && !$canvieweditor);
+                        next if ($item->[2] eq 'params' && !$canmodpara && !$canviewpara);
+                        next if ($item->[2] eq 'author' && !$author);
+                        next if ($item->[2] eq 'cca' && !$canmodifycoauthor);
                         push(@scndsub,$item); 
                     }
                 }
@@ -528,6 +531,7 @@ sub secondary_menu {
                 } else {
                     $$menuitem[0] =~ s{\?register=1}{};
                 }
+                $$menuitem[0] = &HTML::Entities::encode($$menuitem[0],'&<>"');
             }
             $menu .= &prep_menuitem(\@$menuitem);
         }
@@ -546,7 +550,7 @@ sub secondary_menu {
             my $londocroot = $Apache::lonnet::perlvar{'lonDocRoot'};
             ($escurl = $env{'request.filename'}) =~ s{^\Q$londocroot\E}{};
             $escurl  = &escape($escurl);
-        }    
+        }
         $menu =~ s/\[url\]/$escurl/g;
         $menu =~ s/\[symb\]/$escsymb/g;
     }
@@ -635,6 +639,20 @@ sub build_submenu {
                     next unless (($env{'user.name'} ne '') && ($env{'user.domain'} ne ''));
                     $href =~ s/\[domain\]/$env{'user.domain'}/g;
                     $href =~ s/\[user\]/$env{'user.name'}/g;
+                } elsif (($href =~ m{^/adm/preferences\?}) && ($href =~ /\[returnurl\]/)) {
+                    my $returnurl = $ENV{'REQUEST_URI'};
+                    if ($ENV{'REQUEST_URI'} =~ m{/adm/preferences\?action=(?:changedomcoord|authorsettings)\&returnurl=([^\&]+)$}) {
+                        $returnurl = $1;
+                    }
+                    if (($returnurl =~ m{^/adm/createuser($|\?action=)}) ||
+                        ($returnurl =~ m{^/priv/$match_domain/$match_username}) ||
+                        ($returnurl =~ m{^/res(/?$|/$match_domain/$match_username)})) {
+                        $returnurl =~ s{\?.*$}{};
+                        $returnurl = '&amp;returnurl='.&HTML::Entities::encode($returnurl,'"<>&\'');
+                    } else {
+                        undef($returnurl);
+                    }
+                    $href =~ s/\[returnurl\]/$returnurl/;
                 }
                 unless (($href eq '') || ($href =~ /^\#/)) {
                     $target = ' target="_top"';
@@ -1469,8 +1487,9 @@ sub prepare_functions {
     }
 
     my $editbutton = '';
+    my $viewsrcbutton = '';
 #
-# Determine whether or not to display 'Edit' icon/button
+# Determine whether or not to display 'Edit' or 'View Source' icon/button
 #
     if ($resurl =~ m{^/?adm/($match_domain)/($match_username)/aboutme$}) {
         my $file=&Apache::lonnet::declutter($env{'request.filename'});
@@ -1544,6 +1563,29 @@ sub prepare_functions {
                     $editbutton = &get_editbutton($cfile,$home,$switchserver,
                                                   $forceedit,$forceview,$forcereg);
                 }
+                if ((($cfile eq '') || (!$editbutton)) &&
+                    ($resurl =~ /$LONCAPA::assess_re/)) {
+                    my $showurl = &Apache::lonnet::clutter($resurl);
+                    if ((&Apache::lonnet::allowed('cre','/')) &&
+                        (&Apache::lonnet::metadata($resurl,'sourceavail') eq 'open')) {
+                        $viewsrcbutton = 1;
+                    } elsif (&Apache::lonnet::allowed('vxc',$env{'request.course.id'})) {
+                        if ($showurl =~ m{^\Q/res/$cdom/\E($match_username)/}) {
+                            my $auname = $1;
+                            if (($env{'request.course.adhocsrcaccess'} ne '') &&
+                                (grep(/^\Q$auname\E$/,split(/,/,$env{'request.course.adhocsrcaccess'})))) {
+                                $viewsrcbutton = 1;
+                            } elsif ((&Apache::lonnet::metadata($resurl,'sourceavail') eq 'open') &&
+                                     (&Apache::lonnet::allowed('bre','/'))) {
+                                $viewsrcbutton = 1;
+                            }
+                        }
+                    }
+                    if ($viewsrcbutton) {
+                        &switch('','',6,1,'pcstr.png','View Source','resource[_2]','open_source()',
+                                'View source code');
+                    }
+                }
             }
         }
     }