From 40a7ed7b15919b8b6556ac927db64653034c2961 Mon Sep 17 00:00:00 2001
From: FusionPBX <markjcrane@gmail.com>
Date: Wed, 30 Aug 2023 12:50:08 -0600
Subject: [PATCH] xml sanitize allow $1 and $2

Continue to remove any ${variables}  in this format
---
 resources/classes/xml.php | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/resources/classes/xml.php b/resources/classes/xml.php
index 15c992533a..582595f15a 100644
--- a/resources/classes/xml.php
+++ b/resources/classes/xml.php
@@ -1,16 +1,17 @@
 <?php
 
 if (!class_exists('xml')) {
-    class xml {
+	class xml {
 
-        /**
-         * Escapes xml special characters to html entities and sanitze switch special chars.
-         */
-        static function sanitize($string) {
-            return str_replace('$', '', htmlspecialchars($string, ENT_XML1));
-        }
+		/**
+		 * Escapes xml special characters to html entities and sanitze switch special chars.
+		 */
+		static function sanitize($string) {
+			$string = preg_replace('/\$\{[^}]+\}/', '', $string);
+			return htmlspecialchars($string, ENT_XML1);
+		}
 
-    }
+	}
 }
 
-?>
\ No newline at end of file
+?>