From e70468d5d7419c75e22d7b5e4e2353ec4c317a5b Mon Sep 17 00:00:00 2001
From: FusionPBX <markjcrane@gmail.com>
Date: Tue, 5 Jun 2018 12:29:24 -0600
Subject: [PATCH] Update bridges.php

---
 app/bridges/bridges.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/app/bridges/bridges.php b/app/bridges/bridges.php
index 8715e43fe9..7d3bef717c 100644
--- a/app/bridges/bridges.php
+++ b/app/bridges/bridges.php
@@ -175,7 +175,7 @@
 		}
 	}
 
-	echo "				<input type='text' class='txt' style='width: 150px; margin-left: 15px;' name='search' id='search' value='".$search."'>\n";
+	echo "				<input type='text' class='txt' style='width: 150px; margin-left: 15px;' name='search' id='search' value='".escape($search)."'>\n";
 	echo "				<input type='submit' class='btn' name='submit' value='".$text['button-search']."'>\n";
 	echo "			</td>\n";
 	echo "		</form>\n";
@@ -215,14 +215,14 @@
 			echo "<tr ".$tr_link.">\n";
 			echo "	<td valign='top' class='".$row_style[$c]." tr_link_void' style='align: center; padding: 3px 3px 0px 8px;'>\n";
 			echo "		<input type='checkbox' name=\"bridges[$x][checked]\" id='checkbox_".$x."' value='true' onclick=\"if (!this.checked) { document.getElementById('chk_all_".$x."').checked = false; }\">\n";
-			echo "		<input type='hidden' name=\"bridges[$x][bridge_uuid]\" value='".$row['bridge_uuid']."' />\n";
+			echo "		<input type='hidden' name=\"bridges[$x][bridge_uuid]\" value='".escape($row['bridge_uuid'])."' />\n";
 			echo "	</td>\n";
 			echo "	<td valign='top' class='".$row_style[$c]."'>".escape($row['bridge_name'])."&nbsp;</td>\n";
 			echo "	<td valign='top' class='".$row_style[$c]."'>".escape($row['bridge_destination'])."&nbsp;</td>\n";
 			echo "	<td valign='top' class='".$row_style[$c]."'>".escape($row['bridge_enabled'])."&nbsp;</td>\n";
 			echo "	<td class='list_control_icons'>";
 			if (permission_exists('bridge_edit')) {
-				echo "<a href='bridge_edit.php?id=".$row['bridge_uuid']."' alt='".$text['button-edit']."'>$v_link_label_edit</a>";
+				echo "<a href='bridge_edit.php?id=".escape($row['bridge_uuid'])."' alt='".$text['button-edit']."'>$v_link_label_edit</a>";
 			}
 			if (permission_exists('bridge_delete')) {
 				echo "<button type='submit' class='btn btn-default list_control_icon' name=\"bridges[$x][action]\" alt='".$text['button-delete']."' value='delete'><span class='glyphicon glyphicon-remove'></span></button>";