From 3f019e7855619222efa857638da7833150f2b3e4 Mon Sep 17 00:00:00 2001
From: FusionPBX <markjcrane@gmail.com>
Date: Fri, 31 Jan 2020 21:09:41 -0700
Subject: [PATCH] Update xml_cdr.php

---
 app/xml_cdr/xml_cdr.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/xml_cdr/xml_cdr.php b/app/xml_cdr/xml_cdr.php
index 6010315676..63f10fd598 100644
--- a/app/xml_cdr/xml_cdr.php
+++ b/app/xml_cdr/xml_cdr.php
@@ -700,7 +700,7 @@
 						$content .= "	<td class='middle no-link no-wrap'>";
 						$content .= "		<a href=\"javascript:void(0)\" onclick=\"send_cmd('".PROJECT_PATH."/app/click_to_call/click_to_call.php?src_cid_name=".urlencode(escape($row['caller_id_name']))."&src_cid_number=".urlencode(escape($row['caller_id_number']))."&dest_cid_name=".urlencode($_SESSION['user']['extension'][0]['outbound_caller_id_name'])."&dest_cid_number=".urlencode($_SESSION['user']['extension'][0]['outbound_caller_id_number'])."&src=".urlencode($_SESSION['user']['extension'][0]['user'])."&dest=".urlencode(escape($row['caller_id_number']))."&rec=false&ringback=us-ring&auto_answer=true');\">\n";
 						if (is_numeric($row['caller_id_number'])) {
-							$content .= "		".format_phone(substr($row['caller_id_number'], 0, 20)).' ';
+							$content .= "		".escape(format_phone(substr($row['caller_id_number'], 0, 20))).' ';
 						}
 						else {
 							$content .= "		".escape(substr($row['caller_id_number'], 0, 20)).' ';