From 11f2dd2254dbeb1c41bf19b8c38e8fa9bc948efb Mon Sep 17 00:00:00 2001
From: FusionPBX <markjcrane@gmail.com>
Date: Sat, 7 Sep 2019 00:49:39 -0600
Subject: [PATCH] Update recording_play.php

---
 app/recordings/recording_play.php | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/app/recordings/recording_play.php b/app/recordings/recording_play.php
index 81b2cf1157..17a4ee24d5 100644
--- a/app/recordings/recording_play.php
+++ b/app/recordings/recording_play.php
@@ -17,7 +17,7 @@
 
 	The Initial Developer of the Original Code is
 	Mark J Crane <markjcrane@fusionpbx.com>
-	Portions created by the Initial Developer are Copyright (C) 2008-2016
+	Portions created by the Initial Developer are Copyright (C) 2008-2019
 	the Initial Developer. All Rights Reserved.
 
 	Contributor(s):
@@ -37,7 +37,8 @@
 		echo "access denied";
 		exit;
 	}
-	
+
+//get the variables
 	$filename = $_GET['filename'];
 	$type = $_GET['type']; //moh //rec
 
@@ -51,7 +52,7 @@
 <table width="100%" border="0" cellpadding="0" cellspacing="0">
 	<tr>
 		<td align='center'>
-			<b>file: <?php echo $filename ?></b>
+			<b><?php echo escape($filename) ?></b>
 		</td>
 	</tr>
 	<tr>
@@ -69,7 +70,7 @@
 			}
 			else {
 				echo "<audio src=\"http://localhost:8000/mod/recordings/recordings.php?a=download&type=".urlencode($type)."&filename=".urlencode($filename)."\" autoplay=\"autoplay\"></audio>";
-				echo "<embed src=\"recordings.php?a=download&type=".urlencode($type)."&filename=".urlencode($filename)."\" autostart=\"true\" width=\"300\" height=\"90\" name=\"sound_".$filename."\" enablejavascript=\"true\">\n";
+				echo "<embed src=\"recordings.php?a=download&type=".urlencode($type)."&filename=".urlencode($filename)."\" autostart=\"true\" width=\"300\" height=\"90\" name=\"sound_".escape($filename)."\" enablejavascript=\"true\">\n";
 			}
 		}
 		if ($file_ext == "mp3") {