From e5c226f3a05d226cd728aa412eeeb4620ba840ba Mon Sep 17 00:00:00 2001
From: FusionPBX <markjcrane@gmail.com>
Date: Mon, 2 Jul 2018 10:44:14 -0600
Subject: [PATCH] Update contacts.php

---
 app/contacts/contacts.php | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/app/contacts/contacts.php b/app/contacts/contacts.php
index 90b2328252..6be9b884af 100644
--- a/app/contacts/contacts.php
+++ b/app/contacts/contacts.php
@@ -17,7 +17,7 @@
 
 	The Initial Developer of the Original Code is
 	Mark J Crane <markjcrane@fusionpbx.com>
-	Portions created by the Initial Developer are Copyright (C) 2008-2016
+	Portions created by the Initial Developer are Copyright (C) 2008-2018
 	the Initial Developer. All Rights Reserved.
 
 	Contributor(s):
@@ -178,7 +178,7 @@
 	$offset = $rows_per_page * $page;
 
 //get the list
-	$sql = str_replace('count(*) as num_rows', '*', $sql); // modify query created above
+	$sql = str_replace('count(*) as num_rows', '*', $sql);
 	if (strlen($order_by) > 0) {
 		$sql .= "order by ".$order_by." ".$order." ";
 	}
@@ -191,8 +191,7 @@
 	$sql .= "limit ".$rows_per_page." offset ".$offset." ";
 	$prep_statement = $db->prepare(check_sql($sql));
 	$prep_statement->execute();
-	$result = $prep_statement->fetchAll(PDO::FETCH_NAMED);
-	$result_count = count($result);
+	$contacts = $prep_statement->fetchAll(PDO::FETCH_NAMED);
 	unset ($prep_statement, $sql);
 
 //show the content
@@ -204,7 +203,7 @@
 	echo "		</td>\n";
 	echo "		<td align='right' valign='top' width='50%' nowrap='nowrap'>\n";
 	echo "			<form method='get' name='frm_search' action=''>\n";
-	echo "				<input class='formfld' style='text-align: right;' type='text' name='search_all' id='search_all' value=\"".$search_all."\">\n";
+	echo "				<input class='formfld' style='text-align: right;' type='text' name='search_all' id='search_all' value=\"".escape($search_all)."\">\n";
 	echo "				<input class='btn' type='submit' name='submit' value=\"".$text['button-search']."\">\n";
 	if (permission_exists('contact_add')) {
 		echo 				"<input type='button' class='btn' alt='".$text['button-import']."' onclick=\"window.location='contact_import.php'\" value='".$text['button-import']."'>\n";
@@ -242,9 +241,9 @@
 	echo "</td>\n";
 	echo "</tr>\n";
 
-	if ($result_count > 0) {
-		foreach($result as $row) {
-			$tr_link = "href='contact_edit.php?id=".$row['contact_uuid']."&query_string=".urlencode($_SERVER["QUERY_STRING"])."'";
+	if (is_array($contacts)) {
+		foreach($contacts as $row) {
+			$tr_link = "href='contact_edit.php?id=".escape($row['contact_uuid'])."&query_string=".urlencode($_SERVER["QUERY_STRING"])."'";
 			echo "<tr ".$tr_link.">\n";
 			echo "	<td valign='top' class='".$row_style[$c]."'>".ucwords(escape($row['contact_type']))."&nbsp;</td>\n";
 			echo "	<td valign='top' class='".$row_style[$c]."' style='width: 35%; max-width: 50px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;'><a href='contact_edit.php?id=".escape($row['contact_uuid'])."&query_string=".urlencode($_SERVER["QUERY_STRING"])."'>".escape($row['contact_organization'])."</a>&nbsp;</td>\n";
@@ -270,7 +269,7 @@
 			echo "</tr>\n";
 			if ($c==0) { $c=1; } else { $c=0; }
 		} //end foreach
-		unset($sql, $result, $row_count);
+		unset($sql, $contacts);
 	} //end if results
 
 	echo "<tr>\n";