dbxe
/
fusionpbx
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Escape user data on service_edit.php (#3116)

This commit is contained in:
AlexanderDCrane 2018-06-09 20:42:39 -06:00 committed by FusionPBX
parent 54c017a993
commit 23eceb0cc2
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
app/services/service_edit.php
View File

@ -17,7 +17,7 @@
The Initial Developer of the Original Code is
Mark J Crane <markjcrane@fusionpbx.com>
Portions created by the Initial Developer are Copyright (C) 2008-2014
Portions created by the Initial Developer are Copyright (C) 2008-2018
the Initial Developer. All Rights Reserved.
Contributor(s):
@ -190,7 +190,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
echo " ".$text['label-name']."\n";
echo "</td>\n";
echo "<td class='vtable' align='left'>\n";
echo " <input class='formfld' type='text' name='service_name' maxlength='255' value=\"$service_name\">\n";
echo " <input class='formfld' type='text' name='service_name' maxlength='255' value=\"".escape($service_name)."\">\n";
echo "<br />\n";
echo $text['description-name']."\n";
echo "</td>\n";
@ -272,7 +272,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
echo " ".$text['label-description']."\n";
echo "</td>\n";
echo "<td class='vtable' align='left'>\n";
echo " <textarea class='formfld' name='service_description' rows='4'>$service_description</textarea>\n";
echo " <textarea class='formfld' name='service_description' rows='4'>".escape($service_description)."</textarea>\n";
echo "<br />\n";
echo $text['description-description']."\n";
echo "</td>\n";
@ -280,7 +280,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
echo " <tr>\n";
echo " <td colspan='2' align='right'>\n";
if ($action == "update") {
echo " <input type='hidden' name='service_uuid' value='$service_uuid'>\n";
echo " <input type='hidden' name='service_uuid' value='".escape($service_uuid)."'>\n";
}
echo " <br>";
echo " <input type='submit' name='submit' class='btn' value='".$text['button-save']."'>\n";
@ -292,4 +292,4 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
//show the footer
require_once "resources/footer.php";
?>
?>