From ed0b8f2928c6b41db30fa431df0ad1b62efd9847 Mon Sep 17 00:00:00 2001
From: FusionPBX <markjcrane@gmail.com>
Date: Wed, 6 Jun 2018 11:11:35 -0600
Subject: [PATCH] Update fax.php

---
 app/fax/fax.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/app/fax/fax.php b/app/fax/fax.php
index d40615a118..6404aa9f51 100644
--- a/app/fax/fax.php
+++ b/app/fax/fax.php
@@ -17,7 +17,7 @@
 
 	The Initial Developer of the Original Code is
 	Mark J Crane <markjcrane@fusionpbx.com>
-	Portions created by the Initial Developer are Copyright (C) 2008-2016
+	Portions created by the Initial Developer are Copyright (C) 2008-2018
 	the Initial Developer. All Rights Reserved.
 
 	Contributor(s):
@@ -142,7 +142,7 @@
 				$fax_email = str_replace("\\", "", $row['fax_email']);
 				$fax_email = substr($fax_email, 0, 50);
 			//show the fax extensions
-				$tr_link = (permission_exists('fax_extension_edit')) ? "href='fax_edit.php?id=".$row['fax_uuid']."'" : null;
+				$tr_link = (permission_exists('fax_extension_edit')) ? "href='fax_edit.php?id=".escape($row['fax_uuid'])."'" : null;
 				echo "<tr ".$tr_link.">\n";
 				echo "	<td valign='top' class='".$row_style[$c]."'>";
 				if (permission_exists('fax_extension_edit')) {
@@ -156,7 +156,7 @@
 				echo "	<td valign='top' class='".$row_style[$c]."'>".escape($fax_email)."&nbsp;</td>\n";
 				echo "	<td valign='top' class='".$row_style[$c]." tr_link_void'>";
 				if (permission_exists('fax_send')) {
-					echo "		<a href='fax_send.php?id=".escape($row['fax_uuid'])."'>".escape($text['label-new'])."</a>&nbsp;&nbsp;";
+					echo "		<a href='fax_send.php?id=".escape($row['fax_uuid'])."'>".$text['label-new']."</a>&nbsp;&nbsp;";
 				}
 				if (permission_exists('fax_inbox_view')) {
 					if ($row['fax_email_inbound_subject_tag'] != '') {