From c13e9f4faa2106d58ddb15c0d64a2d488c8cccaf Mon Sep 17 00:00:00 2001
From: FusionPBX <markjcrane@gmail.com>
Date: Tue, 10 Sep 2019 08:23:24 -0600
Subject: [PATCH] Update dialplan_xml.php

---
 app/dialplans/dialplan_xml.php | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/app/dialplans/dialplan_xml.php b/app/dialplans/dialplan_xml.php
index 506cde7b7b..82d0be72fb 100644
--- a/app/dialplans/dialplan_xml.php
+++ b/app/dialplans/dialplan_xml.php
@@ -178,8 +178,8 @@
 
 //show the content
 	echo "<form method='post' name='frm' id='frm'>\n";
-	echo "	<input type='hidden' name='app_uuid' value='".$app_uuid."'>\n";
-	echo "	<input type='hidden' name='dialplan_uuid' value='".$dialplan_uuid."'>\n";
+	echo "	<input type='hidden' name='app_uuid' value='".escape($app_uuid)."'>\n";
+	echo "	<input type='hidden' name='dialplan_uuid' value='".escape($dialplan_uuid)."'>\n";
 	echo "	<textarea name='dialplan_xml' id='dialplan_xml' style='display: none;'>".$dialplan_xml."</textarea>";
 	echo "	<table width='100%' border='0' cellpadding='0' cellspacing='1'>\n";
 	echo "		<tr>\n";
@@ -187,7 +187,7 @@
 	echo "				<span class='title'>".$text['title-dialplan_edit']." XML</span><br />\n";
 	echo "			</td>\n";
 	echo "			<td width='70%' align='right'>\n";
-	echo "				<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='dialplan_edit.php?id=".$dialplan_uuid.(is_uuid($app_uuid) ? "&app_uuid=".$app_uuid : null)."';\" value='".$text['button-back']."'>\n";
+	echo "				<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='dialplan_edit.php?id=".urlencode($dialplan_uuid).(is_uuid($app_uuid) ? "&app_uuid=".urlencode($app_uuid) : null)."';\" value='".$text['button-back']."'>\n";
 	echo "				<input type='button' class='btn' value='".$text['button-save']."' onclick=\"set_value(); $('#frm').submit();\">\n";
 	echo "			</td>\n";
 	echo "		</tr>\n";
@@ -197,7 +197,7 @@
 	echo "			</td>\n";
 	echo "		</tr>\n";
 	echo "	</table>";
-	echo "	<br />\n";
+	//echo "	<br />\n";
 	echo "	<table cellpadding='0' cellspacing='0' border='0' style='width: 100%;'>\n";
 	echo "		<tr>\n";
 	echo "			<td valign='middle' style='padding: 0 6px;' width='100%'><span id='description'></span></td>\n";
@@ -310,4 +310,4 @@
 //show the footer
 	require_once "resources/footer.php";
 
-?>
\ No newline at end of file
+?>