From ec47489f4ea78f2e0947a912b33608c9c9f32385 Mon Sep 17 00:00:00 2001
From: frytimo <tim@fusionpbx.com>
Date: Thu, 3 Jul 2025 15:19:12 -0300
Subject: [PATCH] Escape characters for button link (#7409)

---
 resources/classes/button.php | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/resources/classes/button.php b/resources/classes/button.php
index c82b34551b..49f73ded7c 100644
--- a/resources/classes/button.php
+++ b/resources/classes/button.php
@@ -109,7 +109,7 @@ if (!class_exists('button')) {
 			//link
 				if (!empty($array['link'])) {
 					$anchor = "<a ";
-					$anchor .= "href='".$array['link']."' ";
+					$anchor .= "href='" . self::escape_href($array['link']) . "' ";
 					$anchor .= "target='".(!empty($array['target']) ? $array['target'] : '_self')."' ";
 					//ensure only margin* styles are applied to the anchor element
 					if (!empty($array['style']) && is_array($array['style']) && @sizeof($array['style']) != 0) {
@@ -134,6 +134,12 @@ if (!class_exists('button')) {
 			return substr_count($value, "'") ? '"'.$value.'"' : "'".$value."'";
 		}
 
+		private static function escape_href(string $url): string {
+			// clear whitespace
+			$url = trim($url);
+
+			return htmlspecialchars($url, ENT_QUOTES, 'UTF-8');
+		}
 	}
 }