From: Ivan Kohler <ivan@freeside.biz>
Date: Tue, 7 Mar 2017 04:21:05 +0000 (-0800)
Subject: Merge branch 'master' of git.freeside.biz:/home/git/freeside
X-Git-Url: http://git.freeside.biz/gitweb/?p=freeside.git;a=commitdiff_plain;h=b3a7f5819aab1d878a68dd85174fe934ab66c026;hp=77d97788cf400c58c4d0c7c908e5923266c74f7a

Merge branch 'master' of git.freeside.biz:/home/git/freeside
---

diff --git a/httemplate/misc/email-customers.html b/httemplate/misc/email-customers.html
index b228b7202..981d0e6da 100644
--- a/httemplate/misc/email-customers.html
+++ b/httemplate/misc/email-customers.html
@@ -67,8 +67,8 @@ from/subject/body cgi params
     <INPUT TYPE="hidden" NAME="msgnum" VALUE="<% $msg_template->msgnum %>">
 %   # kludge these through hidden inputs because they're not really part
 %   # of the template, but should be sticky during draft editing
-    <INPUT TYPE="hidden" NAME="from_name" VALUE="<% $cgi->param('from_name') %>">
-    <INPUT TYPE="hidden" NAME="from_addr" VALUE="<% $cgi->param('from_addr') %>">
+    <INPUT TYPE="hidden" NAME="from_name" VALUE="<% scalar($cgi->param('from_name')) |h %>">
+    <INPUT TYPE="hidden" NAME="from_addr" VALUE="<% scalar($cgi->param('from_addr')) |h %>">
 
 %   if ( !$msg_template->disabled ) {
       <& /elements/tr-td-label.html, 'label' => 'Template:' &>