From f044a0f4a96750ddf4ef88a60d3f39b237166dc0 Mon Sep 17 00:00:00 2001
From: AlexanderDCrane <40072887+AlexanderDCrane@users.noreply.github.com>
Date: Mon, 27 Aug 2018 20:32:27 -0600
Subject: [PATCH] Update voicemail_option_edit.php (#3313)

---
 app/voicemails/voicemail_option_edit.php | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/app/voicemails/voicemail_option_edit.php b/app/voicemails/voicemail_option_edit.php
index 769a87533a..4cfa12390e 100644
--- a/app/voicemails/voicemail_option_edit.php
+++ b/app/voicemails/voicemail_option_edit.php
@@ -161,7 +161,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
 	echo "	<br><br>";
 	echo "</td>\n";
 	echo "<td width='70%' align='right' nowrap='nowrap' valign='top'>";
-	echo "	<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='voicemail_edit.php?id=".$voicemail_uuid."'\" value='".$text['button-back']."'>";
+	echo "	<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='voicemail_edit.php?id=".escape($voicemail_uuid)."'\" value='".$text['button-back']."'>";
 	echo "	<input type='submit' name='submit' class='btn' value='".$text['button-save']."'>\n";
 	echo "</td>\n";
 	echo "</tr>\n";
@@ -171,7 +171,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
 	echo "	".$text['label-option']."\n";
 	echo "</td>\n";
 	echo "<td class='vtable' align='left'>\n";
-	echo "  <input class='formfld' type='text' name='voicemail_option_digits' maxlength='255' value='$voicemail_option_digits'>\n";
+	echo "  <input class='formfld' type='text' name='voicemail_option_digits' maxlength='255' value='".escape($voicemail_option_digits)."'>\n";
 	echo "<br />\n";
 	echo $text['description-option']."\n";
 	echo "</td>\n";
@@ -226,15 +226,15 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
 	echo "	".$text['label-description']."\n";
 	echo "</td>\n";
 	echo "<td class='vtable' align='left'>\n";
-	echo "	<input class='formfld' type='text' name='voicemail_option_description' maxlength='255' value=\"".$voicemail_option_description."\">\n";
+	echo "	<input class='formfld' type='text' name='voicemail_option_description' maxlength='255' value=\"".escape($voicemail_option_description)."\">\n";
 	echo "<br />\n";
 	echo $text['description-description']."\n";
 	echo "</td>\n";
 	echo "</tr>\n";
 	echo "	<tr>\n";
 	echo "		<td colspan='2' align='right'>\n";
-	echo "			<input type='hidden' name='voicemail_uuid' value='$voicemail_uuid'>\n";
-	echo "			<input type='hidden' name='voicemail_option_uuid' value='$voicemail_option_uuid'>\n";
+	echo "			<input type='hidden' name='voicemail_uuid' value='".escape($voicemail_uuid)."'>\n";
+	echo "			<input type='hidden' name='voicemail_option_uuid' value='".escape($voicemail_option_uuid)."'>\n";
 	echo "			<br>";
 	echo "			<input type='submit' name='submit' class='btn' value='".$text['button-save']."'>\n";
 	echo "		</td>\n";