From c011fcbb9057a1c4f50f0c674cb670116bd4f256 Mon Sep 17 00:00:00 2001
From: FusionPBX <markjcrane@gmail.com>
Date: Fri, 29 Jun 2018 19:59:19 -0600
Subject: [PATCH] Update persist_form_var.php

---
 resources/persist_form_var.php | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/resources/persist_form_var.php b/resources/persist_form_var.php
index 21ea89fd14..2b96cbbf3d 100644
--- a/resources/persist_form_var.php
+++ b/resources/persist_form_var.php
@@ -17,26 +17,26 @@
 
 	The Initial Developer of the Original Code is
 	Mark J Crane <markjcrane@fusionpbx.com>
-	Portions created by the Initial Developer are Copyright (C) 2008-2012
+	Portions created by the Initial Developer are Copyright (C) 2008-2018
 	the Initial Developer. All Rights Reserved.
 
 	Contributor(s):
 	Mark J Crane <markjcrane@fusionpbx.com>
 */
 
-function persistformvar($formarray) {
+function persistformvar($form_array) {
 	// Remember Form Input Values
-	if(is_array($formarray)) {
-	  $content .= "<form method='post' action='".$_SERVER["HTTP_REFERER"]."' target='_self'>\n";
-	 foreach($formarray as $key => $val) {
-	   if($key == "XID" || $key == "ACT" || $key == "RET") continue;
-       if ($key != "persistform") { //clears the persistform value
-            $content .= "<input type='hidden' name='$key' value='$val' />\n";
-       }
-	 }
-    	$content .= "<input type='hidden' name='persistformvar' value='true' />\n"; //sets persistform to yes
-	 $content .= "<input class='btn' type='submit' value='Back' />\n";
-	 $content .= "</form>\n";
+	if (is_array($form_array)) {
+		$content .= "<form method='post' action='".escape($_SERVER["HTTP_REFERER"])."' target='_self'>\n";
+		foreach($form_array as $key => $val) {
+			if ($key == "XID" || $key == "ACT" || $key == "RET") continue;
+			if ($key != "persistform") { //clears the persistform value
+				$content .= "	<input type='hidden' name='".escape($key)."' value='".escape($val)."' />\n";
+			}
+		}
+		$content .= "	<input type='hidden' name='persistformvar' value='true' />\n"; //sets persistform to yes
+		$content .= "	<input class='btn' type='submit' value='Back' />\n";
+		$content .= "</form>\n";
 	}
 	echo $content;
 	//return $content;