From dd8c6bb3d3a8b7f3e9aa93a8bb84265174f4de72 Mon Sep 17 00:00:00 2001
From: FusionPBX <markjcrane@gmail.com>
Date: Fri, 29 Jun 2018 20:02:00 -0600
Subject: [PATCH] Update persist_form.php

---
 resources/persist_form.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/resources/persist_form.php b/resources/persist_form.php
index 8bc20f792f..9f2b551448 100644
--- a/resources/persist_form.php
+++ b/resources/persist_form.php
@@ -27,15 +27,15 @@
 function persistform($form_array) {
 	// Remember Form Input Values
 	if (is_array($form_array)) {
-		$content .= "<form method='post' action='".$_SERVER["HTTP_REFERER"]."' target='_self'>\n";
+		$content .= "<form method='post' action='".escape($_SERVER["HTTP_REFERER"])."' target='_self'>\n";
 		foreach ($form_array as $key => $val) {
 			if ($key == "XID" || $key == "ACT" || $key == "RET") continue;
 			if ($key != "persistform") { //clears the persistform value
 			    $content .= "<input type='hidden' name='".escape($key)."' value='".escape($val)."' />\n";
 			}
 		}
-		$content .= "<input type='hidden' name='persistform' value='1' />\n"; //sets persistform to yes
-		$content .= "<input class='btn' type='submit' value='Back' />\n";
+		$content .= "	<input type='hidden' name='persistform' value='1' />\n"; //sets persistform to yes
+		$content .= "	<input class='btn' type='submit' value='Back' />\n";
 		$content .= "</form>\n";
 	}
 	return $content;