diff --git a/app/devices/device_edit.php b/app/devices/device_edit.php
index f484d7494a..90a31a0c4c 100644
--- a/app/devices/device_edit.php
+++ b/app/devices/device_edit.php
@@ -880,7 +880,7 @@ require_once "resources/require.php";
 				if (strtolower($device_vendor) == "aastra" || strlen($device_vendor) == 0 || strlen($device_username) > 0) {
 					echo "<optgroup label='Aastra'>";
 					?>
-<option value='blf' <?php if ($row['device_key_type'] == "blf") { echo $selected;$found=true; } ?>><?php echo $text['label-blf'] ?></option>
+					<option value='blf' <?php if ($row['device_key_type'] == "blf") { echo $selected;$found=true; } ?>><?php echo $text['label-blf'] ?></option>
 					<option value='blfxfer' <?php if ($row['device_key_type'] == "blfxfer") { echo $selected;$found=true; } ?>><?php echo $text['label-blf_xfer'] ?></option>
 					<option value='callers' <?php if ($row['device_key_type'] == "callers") { echo $selected;$found=true; } ?>><?php echo $text['label-callers'] ?></option>
 
diff --git a/app/dialplan/resources/switch/conf/dialplan/999_local_extension.xml b/app/dialplan/resources/switch/conf/dialplan/999_local_extension.xml
index bfe432fd99..e383b8dabb 100644
--- a/app/dialplan/resources/switch/conf/dialplan/999_local_extension.xml
+++ b/app/dialplan/resources/switch/conf/dialplan/999_local_extension.xml
@@ -2,14 +2,26 @@
 	<extension name="local_extension" number="[ext]" continue="false" app_uuid="71cf1310-b6e3-415b-8745-3cbdc8e15212">
 		<condition field="destination_number" expression="(^\d{2,7}$)">
 			<!--<action application="pre_answer"/>-->
-			<action application="set" data="dialed_extension=$1"/>
-			<action application="export" data="dialed_extension=$1"/>
+			<action application="export" data="dialed_extension=$1" inline="true"/>
 			<action application="limit" data="hash ${domain_name} $1 ${limit_max} ${limit_destination}"/>
-			<!-- bind_meta_app can have these args <key> [a|b|ab] [a|b|o|s] <app> -->
-			<action application="bind_meta_app" data="1 ab s execute_extension::dx XML ${context}"/>
-			<action application="bind_meta_app" data="2 ab s record_session::$${recordings_dir}/${domain_name}/archive/${strftime(%Y)}/${strftime(%b)}/${strftime(%d)}/${uuid}.${record_ext}"/>
-			<action application="bind_meta_app" data="3 ab s execute_extension::cf XML ${context}"/>
-			<action application="bind_meta_app" data="4 ab s execute_extension::att_xfer XML ${context}"/>
+		</condition>
+
+		<!--Allow transfer/record only for internal users-->
+		<condition field="${sip_authorized}" expression="true" break="never">
+			<action application="set" data="bind_target=both" inline="true"/>
+			<!-- set to `peer` to prevent manipulate of call by callee -->
+			<anti-action application="set" data="bind_target=both" inline="true"/>
+		</condition>
+
+		<condition>
+			<action application="bind_digit_action" data="local,*1,exec:execute_extension,dx XML ${context},${bind_target}"/>
+			<action application="bind_digit_action" data="local,*2,exec:record_session,$${recordings_dir}/${domain_name}/archive/${strftime(%Y)}/${strftime(%b)}/${strftime(%d)}/${uuid}.${record_ext},${bind_target}"/>
+			<action application="bind_digit_action" data="local,*3,exec:execute_extension,cf XML ${context},${bind_target}"/>
+			<action application="bind_digit_action" data="local,*4,exec:execute_extension,att_xfer XML ${context},${bind_target}"/>
+			<action application="digit_action_set_realm" data="local"/>
+		</condition>
+
+		<condition>
 			<!--<action application="set" data="ringback=${ringback}"/>-->
 			<action application="set" data="hangup_after_bridge=true"/>
 			<!--<action application="set" data="continue_on_fail=NORMAL_TEMPORARY_FAILURE,USER_BUSY,NO_ANSWER,TIMEOUT,NO_ROUTE_DESTINATION"/> -->
@@ -31,7 +43,7 @@
 			<action application="sleep" data="1000"/>
 			<!--<action application="voicemail" data="default ${domain_name} ${dialed_extension}"/>-->
 			<action application="set" data="voicemail_action=save"/>
-			<action application="set" data="voicemail_id=$1"/>
+			<action application="set" data="voicemail_id=${dialed_extension}"/>
 			<action application="set" data="voicemail_profile=default"/>
 			<action application="lua" data="app.lua voicemail"/>
 		</condition>
diff --git a/resources/install/scripts/app/ring_groups/index.lua b/resources/install/scripts/app/ring_groups/index.lua
index 336f5ace28..fed00574a0 100644
--- a/resources/install/scripts/app/ring_groups/index.lua
+++ b/resources/install/scripts/app/ring_groups/index.lua
@@ -69,9 +69,8 @@
 	if (not default_voice) then default_voice = 'callie'; end
 
 --get record_ext
-	if (session:getVariable("record_ext")) then
-		record_ext = session:getVariable("record_ext");
-	else
+	record_ext = session:getVariable("record_ext");
+	if (not record_ext) then
 		record_ext = "wav";
 	end
 
@@ -491,11 +490,23 @@
 					session:execute("set", "hangup_after_bridge=true");
 					session:execute("set", "continue_on_fail=true");
 
-				--set bind meta app
-					session:execute("bind_meta_app", "1 ab s execute_extension::dx XML "..context);
-					session:execute("bind_meta_app", "2 ab s record_session::"..recordings_dir.."/archive/"..os.date("%Y").."/"..os.date("%m").."/"..os.date("%d").."}/"..uuid..".wav");
-					session:execute("bind_meta_app", "3 ab s execute_extension::cf XML "..context);
-					session:execute("bind_meta_app", "4 ab s execute_extension::att_xfer XML "..context);
+					local bind_target = 'both'
+					-- if session:getVariable("sip_authorized") ~= "true" then
+					-- 	bind_target = 'peer'
+					-- end
+
+				--set bind digit action
+					local record_file = recordings_dir.."/archive/"..os.date("%Y").."/"..os.date("%m").."/"..os.date("%d").."}/"..uuid.."."..record_ext
+					local bindings = {
+						"local,*1,exec:execute_extension,dx XML " .. context,
+						"local,*2,exec:record_session," .. record_file,
+						"local,*3,exec:execute_extension,cf XML " .. context,
+						"local,*4,exec:execute_extension,att_xfer XML " .. context,
+					}
+					for _, str in ipairs(bindings) do
+						session:execute("bind_digit_action", str .. "," .. bind_target)
+					end
+					session:execute("digit_action_set_realm", "local")
 
 					--if the user is busy rollover to the next destination
 						if (ring_group_strategy == "rollover") then