From 7ec287246fc52dc285436e99b85fae9e68067561 Mon Sep 17 00:00:00 2001
From: FusionPBX <markjcrane@gmail.com>
Date: Thu, 7 Jun 2018 10:55:53 -0600
Subject: [PATCH] Update registrations.php

---
 app/registrations/registrations.php | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/app/registrations/registrations.php b/app/registrations/registrations.php
index 26e10d30dc..113ffeecf8 100644
--- a/app/registrations/registrations.php
+++ b/app/registrations/registrations.php
@@ -271,21 +271,21 @@
 								echo "<tr>\n";
 								echo "	<td valign='top' class='".$row_style[$c]." tr_link_void' style='vertical-align:middle; display: table-cell; align: center;'>\n";
 								echo "		<input type='checkbox' name=\"registrations[$x][checked]\" id='checkbox_".$x."' value='true' onclick=\"if (!this.checked) { document.getElementById('chk_all_".$row['user']."').checked = false; }\">\n";
-								echo "		<input type='hidden' name=\"registrations[$x][user]\" value='".$row['user']."' />\n";
-								echo "		<input type='hidden' name=\"registrations[$x][profile]\" value='".$row['sip_profile_name']."' />\n";
-								echo "		<input type='hidden' name=\"registrations[$x][agent]\" value='".$row['agent']."' />\n";
-								echo "		<input type='hidden' name=\"registrations[$x][domain]\" value='".$row['sip-auth-realm']."' />\n";
+								echo "		<input type='hidden' name=\"registrations[$x][user]\" value='".escape($row['user'])."' />\n";
+								echo "		<input type='hidden' name=\"registrations[$x][profile]\" value='".escape($row['sip_profile_name'])."' />\n";
+								echo "		<input type='hidden' name=\"registrations[$x][agent]\" value='".escape($row['agent'])."' />\n";
+								echo "		<input type='hidden' name=\"registrations[$x][domain]\" value='".escape($row['sip-auth-realm'])."' />\n";
 								echo "	</td>\n";
-								echo "	<td class='".$row_style[$c]."'>".$row['user']."&nbsp;</td>\n";
+								echo "	<td class='".$row_style[$c]."'>".escape($row['user'])."&nbsp;</td>\n";
 								echo "	<td class='".$row_style[$c]."'>".htmlentities($row['agent'])."&nbsp;</td>\n";
 								echo "	<td class='".$row_style[$c]."'>".explode('"',$row['contact'])[1]."</td>\n";
-								echo "	<td class='".$row_style[$c]."'>".$row['lan-ip']."</td>\n";
-								echo "	<td class='".$row_style[$c]."'>".$row['network-ip']."</td>\n";
-								echo "	<td class='".$row_style[$c]."'>".$row['network-port']."</td>\n";
-								echo "	<td class='".$row_style[$c]."'>".$row['host']."</td>\n";
-								echo "	<td class='".$row_style[$c]."'>".$row['status']."</td>\n";
-								echo "	<td class='".$row_style[$c]."'>".$row['ping-time']."</td>\n";
-								echo "	<td class='".$row_style[$c]."'>".$row['sip_profile_name']."</td>\n";
+								echo "	<td class='".$row_style[$c]."'>".escape($row['lan-ip'])."</td>\n";
+								echo "	<td class='".$row_style[$c]."'>".escape($row['network-ip'])."</td>\n";
+								echo "	<td class='".$row_style[$c]."'>".escape($row['network-port'])."</td>\n";
+								echo "	<td class='".$row_style[$c]."'>".escape($row['host'])."</td>\n";
+								echo "	<td class='".$row_style[$c]."'>".escape($row['status'])."</td>\n";
+								echo "	<td class='".$row_style[$c]."'>".escape($row['ping-time'])."</td>\n";
+								echo "	<td class='".$row_style[$c]."'>".escape($row['sip_profile_name'])."</td>\n";
 								echo "	<td class='".$row_style[$c]."' style='text-align: right;' nowrap='nowrap'>\n";
 								echo "		<button type='submit' class='btn-default' name=\"registrations[$x][action]\" value='unregister'>".$text['button-unregister']."</button>\n";
 								echo "		<button type='submit' class='btn-default' name=\"registrations[$x][action]\" value='provision'>".$text['button-provision']."</button>\n";