From 021ff8f8e51cd1254d19e88e7aedc4b795067f8d Mon Sep 17 00:00:00 2001
From: FusionPBX <markjcrane@gmail.com>
Date: Sat, 10 Aug 2019 09:30:59 -0600
Subject: [PATCH] Update conference_profile_params.php

---
 app/conference_profiles/conference_profile_params.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/conference_profiles/conference_profile_params.php b/app/conference_profiles/conference_profile_params.php
index 2f5912417f..cfca810c5f 100644
--- a/app/conference_profiles/conference_profile_params.php
+++ b/app/conference_profiles/conference_profile_params.php
@@ -73,7 +73,7 @@
 	echo th_order_by('profile_param_description', $text['label-profile_param_description'], $order_by, $order);
 	echo "<td class='list_control_icons'>";
 	if (permission_exists('conference_profile_param_add')) {
-		echo "<a href='conference_profile_param_edit.php?conference_profile_uuid=".$_GET['id']."' alt='".$text['button-add']."'>$v_link_label_add</a>";
+		echo "<a href='conference_profile_param_edit.php?conference_profile_uuid=".escape($_GET['id'])."' alt='".$text['button-add']."'>$v_link_label_add</a>";
 	}
 	else {
 		echo "&nbsp;\n";
@@ -113,7 +113,7 @@
 	echo "		<td width='33.3%' align='center' nowrap='nowrap'>$paging_controls</td>\n";
 	echo "		<td class='list_control_icons'>";
 	if (permission_exists('conference_profile_param_add')) {
-		echo 		"<a href='conference_profile_param_edit.php?conference_profile_uuid=".$_GET['id']."' alt='".$text['button-add']."'>$v_link_label_add</a>";
+		echo 		"<a href='conference_profile_param_edit.php?conference_profile_uuid=".escape($_GET['id'])."' alt='".$text['button-add']."'>$v_link_label_add</a>";
 	}
 	else {
 		echo 		"&nbsp;";