CVE-2022-0752: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Generic in GitHub repository hestiacp/hestiacp prior to 1.5.9.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-03-04T12:15Z
Repository: https://github.com/hestiacp/hestiacp
Language: HTML
Files changed: install/deb/phpmyadmin/hestia-sso.php, web/delete/backup/exclusion/index.php, web/delete/backup/index.php, web/delete/cron/index.php, web/delete/db/index.php, web/delete/dns/index.php, web/delete/key/index.php, web/delete/log/auth/index.php, web/delete/log/index.php, web/delete/mail/index.php, web/delete/notification/index.php, web/delete/web/cache/index.php, web/delete/web/index.php, web/download/backup/index.php, web/edit/cron/index.php, web/edit/db/index.php, web/edit/dns/index.php, web/edit/firewall/index.php, web/edit/ip/index.php, web/edit/mail/index.php, web/edit/package/index.php, web/edit/user/index.php, web/edit/web/index.php, web/inc/main.php, web/login/index.php, web/suspend/cron/index.php, web/suspend/db/index.php, web/suspend/dns/index.php, web/suspend/mail/index.php, web/suspend/user/index.php, web/suspend/web/index.php, web/templates/includes/title.html, web/templates/pages/add_cron.html, web/templates/pages/add_db.html, web/templates/pages/add_dns.html, web/templates/pages/add_dns_rec.html, web/templates/pages/add_firewall.html, web/templates/pages/add_firewall_banlist.html, web/templates/pages/add_firewall_ipset.html, web/templates/pages/add_ip.html, web/templates/pages/add_key.html, web/templates/pages/add_mail.html, web/templates/pages/add_mail_acc.html, web/templates/pages/add_package.html, web/templates/pages/add_user.html, web/templates/pages/add_web.html, web/templates/pages/edit_backup_exclusions.html, web/templates/pages/edit_cron.html, web/templates/pages/edit_db.html, web/templates/pages/edit_dns.html, web/templates/pages/edit_dns_rec.html, web/templates/pages/edit_firewall.html, web/templates/pages/edit_ip.html, web/templates/pages/edit_mail.html, web/templates/pages/edit_mail_acc.html, web/templates/pages/edit_package.html, web/templates/pages/edit_server.html, web/templates/pages/edit_server_bind9.html, web/templates/pages/edit_server_dovecot.html, web/templates/pages/edit_server_httpd.html, web/templates/pages/edit_server_mysql.html, web/templates/pages/edit_server_nginx.html, web/templates/pages/edit_server_pgsql.html, web/templates/pages/edit_server_php.html, web/templates/pages/edit_server_service.html, web/templates/pages/edit_user.html, web/templates/pages/edit_web.html, web/templates/pages/generate_ssl.html, web/templates/pages/list_backup_detail.html, web/templates/pages/list_cron.html, web/templates/pages/list_db.html, web/templates/pages/list_dns.html, web/templates/pages/list_dns_rec.html, web/templates/pages/list_mail.html, web/templates/pages/list_mail_acc.html, web/templates/pages/list_packages.html, web/templates/pages/list_ssl.html, web/templates/pages/list_user.html, web/templates/pages/list_web.html, web/templates/pages/list_webapps.html, web/templates/pages/list_weblog.html, web/templates/pages/login/reset_2.html, web/templates/pages/login/reset_3.html, web/templates/pages/setup_webapp.html, web/unsuspend/cron/index.php, web/unsuspend/db/index.php, web/unsuspend/dns/index.php, web/unsuspend/mail/index.php, web/unsuspend/web/index.php
Commit date: 2022-02-22 12:29:46 +0100
Commit message: Fix XXS issues (#2432)

* XSS patches

* Reslove XSS vulnrebilty

* Resolve XSS vulnrebility

* Prevent showing edit form from non exsiting records

* Improve error handling message

Create a function

* Make sure $user from $_SESSION is escapeshellarg

Prevent double escapeshellarg in Edit/web/index

* Enable translateable errors in /inc/main.php

Fix  "White" screen issue when trying to loginas non existing user

* Prevent double escapeshellarg()

* Do not remove unset($output)

* Resolve linting errors
Diff: diff --git a/install/deb/phpmyadmin/hestia-sso.php b/install/deb/phpmyadmin/hestia-sso.php
index 0db02ec1b..be913d9a4 100644
--- a/install/deb/phpmyadmin/hestia-sso.php
+++ b/install/deb/phpmyadmin/hestia-sso.php
@@ -145,11 +145,15 @@ function session_invalid()
             if (isset($_GET['user']) && isset($_GET['hestia_token'])) {
                 $database = $_GET['database'];
                 $user = $_GET['user'];
                 $host = 'localhost';
                 $token = $_GET['hestia_token'];
-                $time = $_GET['exp'];
+                if(is_numeric($_GET['exp'])){
+                    $time = $_GET['exp'];
+                }else{
+                    $time = 0; 
+                }
 
                 if ($time + 60 > time()) {
                     //note: Possible issues with cloudflare due to ip obfuscation
                     $ip = $api -> get_user_ip();
                     if (!password_verify($database.$user.$ip.$time.PHPMYADMIN_KEY, $token)) {
diff --git a/web/delete/backup/exclusion/index.php b/web/delete/backup/exclusion/index.php
index 343874db3..f16abeb7f 100644
--- a/web/delete/backup/exclusion/index.php
+++ b/web/delete/backup/exclusion/index.php
@@ -2,20 +2,19 @@
 
 ob_start();
 include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 
 if (($_SESSION['userContext'] === 'admin') && (!empty($_GET['user']))) {
-    $user=$_GET['user'];
+    $user=escapeshellarg($_GET['user']);
 }
 
 // Check token
 verify_csrf($_GET);
 
 if (!empty($_GET['system'])) {
-    $v_username = escapeshellarg($user);
     $v_system = escapeshellarg($_GET['system']);
-    exec(HESTIA_CMD."v-delete-user-backup-exclusions ".$v_username." ".$v_system, $output, $return_var);
+    exec(HESTIA_CMD."v-delete-user-backup-exclusions ".$user." ".$v_system, $output, $return_var);
 }
 check_return_code($return_var, $output);
 unset($output);
 
 $back = $_SESSION['back'];
diff --git a/web/delete/backup/index.php b/web/delete/backup/index.php
index dd8bfb9af..f7ec611a8 100644
--- a/web/delete/backup/index.php
+++ b/web/delete/backup/index.php
@@ -2,20 +2,19 @@
 
 ob_start();
 include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 
 if (($_SESSION['userContext'] === 'admin') && (!empty($_GET['user']))) {
-    $user=$_GET['user'];
+    $user=escapeshellarg($_GET['user']);
 }
 
 // Check token
 verify_csrf($_GET);
 
 if (!empty($_GET['backup'])) {
-    $v_username = escapeshellarg($user);
     $v_backup = escapeshellarg($_GET['backup']);
-    exec(HESTIA_CMD."v-delete-user-backup ".$v_username." ".$v_backup, $output, $return_var);
+    exec(HESTIA_CMD."v-delete-user-backup ".$user." ".$v_backup, $output, $return_var);
 }
 check_return_code($return_var, $output);
 unset($output);
 
 $back = $_SESSION['back'];
diff --git a/web/delete/cron/index.php b/web/delete/cron/index.php
index d41f4a92d..78f29849f 100644
--- a/web/delete/cron/index.php
+++ b/web/delete/cron/index.php
@@ -2,20 +2,20 @@
 
 ob_start();
 include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 
 if (($_SESSION['userContext'] === 'admin') && (!empty($_GET['user']))) {
-    $user=$_GET['user'];
+    $user=escapeshellarg($_GET['user']);
 }
 
 // Check token
 verify_csrf($_GET);
 
 if (!empty($_GET['job'])) {
     $v_username = escapeshellarg($user);
     $v_job = escapeshellarg($_GET['job']);
-    exec(HESTIA_CMD."v-delete-cron-job ".$v_username." ".$v_job, $output, $return_var);
+    exec(HESTIA_CMD."v-delete-cron-job ".$user." ".$v_job, $output, $return_var);
 }
 check_return_code($return_var, $output);
 unset($output);
 
 $back = $_SESSION['back'];
diff --git a/web/delete/db/index.php b/web/delete/db/index.php
index d5e8631f4..8fc6fce57 100644
--- a/web/delete/db/index.php
+++ b/web/delete/db/index.php
@@ -2,20 +2,19 @@
 
 ob_start();
 include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 
 if (($_SESSION['userContext'] === 'admin') && (!empty($_GET['user']))) {
-    $user=$_GET['user'];
+    $user=escapeshellarg($_GET['user']);
 }
 
 // Check token
 verify_csrf($_GET);
 
 if (!empty($_GET['database'])) {
-    $v_username = escapeshellarg($user);
     $v_database = escapeshellarg($_GET['database']);
-    exec(HESTIA_CMD."v-delete-database ".$v_username." ".$v_database, $output, $return_var);
+    exec(HESTIA_CMD."v-delete-database ".$user." ".$v_database, $output, $return_var);
 }
 check_return_code($return_var, $output);
 unset($output);
 
 $back = $_SESSION['back'];
diff --git a/web/delete/dns/index.php b/web/delete/dns/index.php
index a994a95ff..03c68cf90 100644
--- a/web/delete/dns/index.php
+++ b/web/delete/dns/index.php
@@ -3,21 +3,20 @@
 ob_start();
 include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 
 // Delete as someone else?
 if (($_SESSION['userContext'] === 'admin') && (!empty($_GET['user']))) {
-    $user=$_GET['user'];
+    $user=escapeshellarg($_GET['user']);
 }
 
 // Check token
 verify_csrf($_GET);
 
 // DNS domain
 if ((!empty($_GET['domain'])) && (empty($_GET['record_id']))) {
-    $v_username = escapeshellarg($user);
     $v_domain = escapeshellarg($_GET['domain']);
-    exec(HESTIA_CMD."v-delete-dns-domain ".$v_username." ".$v_domain, $output, $return_var);
+    exec(HESTIA_CMD."v-delete-dns-domain ".$user." ".$v_domain, $output, $return_var);
     check_return_code($return_var, $output);
     unset($output);
 
     $back = $_SESSION['back'];
     if (!empty($back)) {
@@ -39,12 +38,18 @@ if ((!empty($_GET['domain'])) && (!empty($_GET['record_id']))) {
     $back = $_SESSION['back'];
     if (!empty($back)) {
         header("Location: ".$back);
         exit;
     }
-    header("Location: /list/dns/?domain=".$_GET['domain']);
-    exit;
+    if($return_var > 0){
+        header("Location: /list/dns/");
+        exit;
+    }else{
+        header("Location: /list/dns/?domain=".$_GET['domain']);
+        exit;
+    }
+    
 }
 
 $back = $_SESSION['back'];
 if (!empty($back)) {
     header("Location: ".$back);
diff --git a/web/delete/key/index.php b/web/delete/key/index.php
index d73e5e199..9cc6ee81e 100644
--- a/web/delete/key/index.php
+++ b/web/delete/key/index.php
@@ -5,17 +5,16 @@ include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 
 // Check token
 verify_csrf($_GET);
 
 if (($_SESSION['userContext'] === 'admin') && (!empty($_GET['user']))) {
-    $user = $_GET['user'];
+    $user=escapeshellarg($_GET['user']);
 }
 
 if (!empty($_GET['key'])) {
     $v_key = escapeshellarg(trim($_GET['key']));
-    $v_user = escapeshellarg(trim($user));
-    exec(HESTIA_CMD."v-delete-user-ssh-key ".$v_user." ".$v_key);
+    exec(HESTIA_CMD."v-delete-user-ssh-key ".$user." ".$v_key);
     check_return_code($return_var, $output);
 }
 
 unset($output);
 
diff --git a/web/delete/log/auth/index.php b/web/delete/log/auth/index.php
index b572d38a2..84c6a6d88 100644
--- a/web/delete/log/auth/index.php
+++ b/web/delete/log/auth/index.php
@@ -5,17 +5,16 @@ include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 // Check token
 verify_csrf($_GET);
 
 // Check if administrator is viewing system log (currently 'admin' user)
 if (($_SESSION['userContext'] === "admin") && (isset($_GET['user']))) {
-    $user=$_GET['user'];
+    $user=escapeshellarg($_GET['user']);
     $token=$_SESSION['token'];
 }
 
 // Clear log
-$v_username = escapeshellarg($user);
-exec(HESTIA_CMD."v-delete-user-auth-log ".$v_username, $output, $return_var);
+exec(HESTIA_CMD."v-delete-user-auth-log ".$user, $output, $return_var);
 check_return_code($return_var, $output);
 unset($output);
 
 
 $ip = $_SERVER['REMOTE_ADDR'];
@@ -30,11 +29,11 @@ $v_user_agent = escapeshellarg($user_agent);
 
 $v_session_id = escapeshellarg($_SESSION['token']);
 
 // Add current user session back to log unless impersonating another user
 if (!isset($_SESSION['look'])) {
-    exec(HESTIA_CMD."v-log-user-login ".$v_username." ".$v_ip." success ".$v_session_id." ".$v_user_agent, $output, $return_var);
+    exec(HESTIA_CMD."v-log-user-login ".$user." ".$v_ip." success ".$v_session_id." ".$v_user_agent, $output, $return_var);
 }
 
 // Flush session messages
 unset($_SESSION['error_msg']);
 unset($_SESSION['ok_msg']);
diff --git a/web/delete/log/index.php b/web/delete/log/index.php
index df8f6552c..67376ad50 100644
--- a/web/delete/log/index.php
+++ b/web/delete/log/index.php
@@ -5,28 +5,31 @@ include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 // Check token
 verify_csrf($_GET);
 
 // Check if administrator is viewing system log (currently 'admin' user)
 if (($_SESSION['userContext'] === "admin") && (!empty($_GET['user']))) {
-    $user=$_GET['user'];
+    $user=escapeshellarg($_GET['user']);
     $token=$_SESSION['token'];
 }
 
-// Set correct page reload target
-if (($_SESSION['userContext'] === "admin") && (!empty($_GET['user']))) {
-    header("Location: /list/log/?user=$user&token=$token");
-} else {
-    header("Location: /list/log/");
-}
-
 // Clear log
-$v_username = escapeshellarg($user);
-exec(HESTIA_CMD."v-delete-user-log ".$v_username." ".$output, $return_var);
+exec(HESTIA_CMD."v-delete-user-log ".$user." ".$output, $return_var);
 check_return_code($return_var, $output);
 unset($output);
 unset($token);
 
+if($return_var > 0){
+    header("Location: /list/log/");
+}else{
+    // Set correct page reload target
+    if (($_SESSION['userContext'] === "admin") && (!empty($_GET['user']))) {
+        header("Location: /list/log/?user=$user&token=$token");
+    } else {
+        header("Location: /list/log/");
+    }
+}
+
 // Render page
 render_page($user, $TAB, 'list_log');
 
 // Flush session messages
 unset($_SESSION['error_msg']);
diff --git a/web/delete/mail/index.php b/web/delete/mail/index.php
index c5e312443..111295fba 100644
--- a/web/delete/mail/index.php
+++ b/web/delete/mail/index.php
@@ -3,47 +3,53 @@
 ob_start();
 include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 
 // Delete as someone else?
 if (($_SESSION['userContext'] === 'admin') && (!empty($_GET['user']))) {
-    $user=$_GET['user'];
+    $user=scapeshellarg($user);
 }
 
 // Check token
 verify_csrf($_GET);
 
 // Mail domain
 if ((!empty($_GET['domain'])) && (empty($_GET['account']))) {
     $v_username = escapeshellarg($user);
     $v_domain = escapeshellarg($_GET['domain']);
-    exec(HESTIA_CMD."v-delete-mail-domain ".$v_username." ".$v_domain, $output, $return_var);
+    exec(HESTIA_CMD."v-delete-mail-domain ".$user." ".$v_domain, $output, $return_var);
     check_return_code($return_var, $output);
     unset($output);
     $back = $_SESSION['back'];
+    if($return_var > 0){
+       header("Location: /list/mail/"); 
+    }
     if (!empty($back)) {
         header("Location: ".$back);
         exit;
     }
     header("Location: /list/mail/");
     exit;
 }
 
 // Mail account
 if ((!empty($_GET['domain'])) && (!empty($_GET['account']))) {
-    $v_username = escapeshellarg($user);
     $v_domain = escapeshellarg($_GET['domain']);
     $v_account = escapeshellarg($_GET['account']);
-    exec(HESTIA_CMD."v-delete-mail-account ".$v_username." ".$v_domain." ".$v_account, $output, $return_var);
+    exec(HESTIA_CMD."v-delete-mail-account ".$user." ".$v_domain." ".$v_account, $output, $return_var);
     check_return_code($return_var, $output);
     unset($output);
+    if($return_var > 0){
+       header("Location: /list/mail/"); 
+    }else{
     $back = $_SESSION['back'];
     if (!empty($back)) {
         header("Location: ".$back);
         exit;
     }
     header("Location: /list/mail/?domain=".$_GET['domain']);
     exit;
+    }
 }
 
 $back = $_SESSION['back'];
 if (!empty($back)) {
     header("Location: ".$back);
diff --git a/web/delete/notification/index.php b/web/delete/notification/index.php
index 8009e8f89..ba0347acd 100644
--- a/web/delete/notification/index.php
+++ b/web/delete/notification/index.php
@@ -4,19 +4,18 @@ include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 
 // Check token
 verify_csrf($_GET);
 
 if ($_GET['delete'] == 1) {
-    $v_username = escapeshellarg($user);
     $v_id = escapeshellarg((int)$_GET['notification_id']);
-    exec(HESTIA_CMD."v-delete-user-notification ".$v_username." ".$v_id, $output, $return_var);
+    exec(HESTIA_CMD."v-delete-user-notification ".$user." ".$v_id, $output, $return_var);
     check_return_code($return_var, $output);
     unset($output);
 } else {
     $v_username = escapeshellarg($user);
     $v_id = escapeshellarg((int)$_GET['notification_id']);
-    exec(HESTIA_CMD."v-acknowledge-user-notification ".$v_username." ".$v_id, $output, $return_var);
+    exec(HESTIA_CMD."v-acknowledge-user-notification ".$user." ".$v_id, $output, $return_var);
     check_return_code($return_var, $output);
     unset($output);
 }
 
 exit;
diff --git a/web/delete/web/cache/index.php b/web/delete/web/cache/index.php
index 5a386e3e7..f8f06a2c5 100644
--- a/web/delete/web/cache/index.php
+++ b/web/delete/web/cache/index.php
@@ -6,17 +6,16 @@ include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 // Check token
 verify_csrf($_GET);
 
 // Delete as someone else?
 if (($_SESSION['userContext'] === 'admin') && (!empty($_GET['user']))) {
-    $user=$_GET['user'];
+    $user=escapeshellarg($_GET['user']);
 }
 
 if (!empty($_GET['domain'])) {
-    $v_username = escapeshellarg($user);
     $v_domain = escapeshellarg($_GET['domain']);
-    exec(HESTIA_CMD."v-purge-nginx-cache ".$v_username." ".$v_domain, $output, $return_var);
+    exec(HESTIA_CMD."v-purge-nginx-cache ".$user." ".$v_domain, $output, $return_var);
     check_return_code($return_var, $output);
 }
 $_SESSION['ok_msg'] = _('Nginx cache has been successfully purged');
 header("Location: /edit/web/?domain=".$_GET['domain']);
 exit;
diff --git a/web/delete/web/index.php b/web/delete/web/index.php
index e2dbb7ed5..e991053f5 100644
--- a/web/delete/web/index.php
+++ b/web/delete/web/index.php
@@ -6,17 +6,16 @@ include($_SERVER['DOCUMENT_ROOT'] . '/inc/main.php');
 // Check token
 verify_csrf($_GET);
 
 // Delete as someone else?
 if (($_SESSION['userContext'] === 'admin') && (!empty($_GET['user']))) {
-    $user = $_GET['user'];
+    $user = escapeshellarg($user);
 }
 
 if (!empty($_GET['domain'])) {
-    $v_username = escapeshellarg($user);
     $v_domain = escapeshellarg($_GET['domain']);
-    exec(HESTIA_CMD . 'v-delete-web-domain ' . $v_username . ' ' . $v_domain . " 'yes'", $output, $return_var);
+    exec(HESTIA_CMD . 'v-delete-web-domain ' . $user . ' ' . $v_domain . " 'yes'", $output, $return_var);
     check_return_code($return_var, $output);
     unset($output);
 }
 
 $back = $_SESSION['back'];
diff --git a/web/download/backup/index.php b/web/download/backup/index.php
index 7c895820d..a1f43918b 100644
--- a/web/download/backup/index.php
+++ b/web/download/backup/index.php
@@ -7,13 +7,12 @@ include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 verify_csrf($_GET);
 
 $backup = $_GET['backup'];
 
 if (!file_exists('/backup/'.$backup)) {
-    $v_username = escapeshellarg($user);
     $backup = escapeshellarg($_GET['backup']);
-    exec(HESTIA_CMD."v-schedule-user-backup-download ".$v_username." ".$backup, $output, $return_var);
+    exec(HESTIA_CMD."v-schedule-user-backup-download ".$user." ".$backup, $output, $return_var);
     if ($return_var == 0) {
         $_SESSION['error_msg'] = _('BACKUP_DOWNLOAD_SCHEDULED');
     } else {
         $_SESSION['error_msg'] = implode('<br>', $output);
         if (empty($_SESSION['error_msg'])) {
diff --git a/web/edit/cron/index.php b/web/edit/cron/index.php
index 160867e2d..06e31b3f0 100644
--- a/web/edit/cron/index.php
+++ b/web/edit/cron/index.php
@@ -17,11 +17,11 @@ if (empty($_GET['job'])) {
 }
 
 // List cron job
 $v_job = escapeshellarg($_GET['job']);
 exec(HESTIA_CMD."v-list-cron-job ".$user." ".$v_job." 'json'", $output, $return_var);
-check_return_code($return_var, $output);
+check_return_code_redirect($return_var, $output, '/list/cron/');
 
 $data = json_decode(implode('', $output), true);
 unset($output);
 
 // Parse cron job
diff --git a/web/edit/db/index.php b/web/edit/db/index.php
index dc5f50740..ef5c89a65 100644
--- a/web/edit/db/index.php
+++ b/web/edit/db/index.php
@@ -18,11 +18,11 @@ if (($_SESSION['userContext'] === 'admin') && (!empty($_GET['user']))) {
 }
 
 // List datbase
 $v_database = $_GET['database'];
 exec(HESTIA_CMD."v-list-database ".$user." ".escapeshellarg($v_database)." 'json'", $output, $return_var);
-check_return_code($return_var, $output);
+check_return_code_redirect($return_var, $output, '/list/db/');
 $data = json_decode(implode('', $output), true);
 unset($output);
 
 // Parse database
 $v_username = $user;
diff --git a/web/edit/dns/index.php b/web/edit/dns/index.php
index 89a86735a..87438e6d6 100644
--- a/web/edit/dns/index.php
+++ b/web/edit/dns/index.php
@@ -24,11 +24,11 @@ unset($output);
 
 // List dns domain
 if ((!empty($_GET['domain'])) && (empty($_GET['record_id']))) {
     $v_domain = escapeshellarg($_GET['domain']);
     exec(HESTIA_CMD."v-list-dns-domain ".$user." ".$v_domain." json", $output, $return_var);
-    check_return_code($return_var, $output);
+    check_return_code_redirect($return_var, $output,'/list/dns/');
     $data = json_decode(implode('', $output), true);
     unset($output);
 
     // Parse dns domain
     $v_username = $user;
@@ -56,14 +56,13 @@ if ((!empty($_GET['domain'])) && (empty($_GET['record_id']))) {
 // List dns record
 if ((!empty($_GET['domain'])) && (!empty($_GET['record_id']))) {
     $v_domain = escapeshellarg($_GET['domain']);
     $v_record_id = escapeshellarg($_GET['record_id']);
     exec(HESTIA_CMD."v-list-dns-records ".$user." ".$v_domain." 'json'", $output, $return_var);
-    check_return_code($return_var, $output);
+    check_return_code_redirect($return_var, $output,'/list/dns/');
     $data = json_decode(implode('', $output), true);
     unset($output);
-
     // Parse dns record
     $v_username = $user;
     $v_domain = $_GET['domain'];
     $v_record_id = $_GET['record_id'];
     $v_rec = $data[$v_record_id]['RECORD'];
@@ -204,10 +203,14 @@ if ((!empty($_POST['save'])) && (!empty($_GET['domain'])) && (!empty($_GET['reco
 // Render page
 if (empty($_GET['record_id'])) {
     // Display body for dns domain
     render_page($user, $TAB, 'edit_dns');
 } else {
+    if(empty($data[$_GET['record_id']])){
+        header("Location: /list/dns/");
+        $_SESSION['error_msg'] = _("Unknown record ID");
+    }
     // Display body for dns record
     render_page($user, $TAB, 'edit_dns_rec');
 }
 
 // Flush session messages
diff --git a/web/edit/firewall/index.php b/web/edit/firewall/index.php
index 666816fa0..f0ba0e350 100644
--- a/web/edit/firewall/index.php
+++ b/web/edit/firewall/index.php
@@ -19,11 +19,11 @@ if (empty($_GET['rule'])) {
 }
 
 // List rule
 $v_rule = escapeshellarg($_GET['rule']);
 exec(HESTIA_CMD."v-list-firewall-rule ".$v_rule." 'json'", $output, $return_var);
-check_return_code($return_var, $output);
+check_return_code_redirect($return_var, $output,'/list/firewall');
 $data = json_decode(implode('', $output), true);
 unset($output);
 
 // Parse rule
 $v_rule = $_GET['rule'];
diff --git a/web/edit/ip/index.php b/web/edit/ip/index.php
index 81cd8c0fa..ad48556a0 100644
--- a/web/edit/ip/index.php
+++ b/web/edit/ip/index.php
@@ -19,11 +19,11 @@ if (empty($_GET['ip'])) {
 }
 
 // List ip
 $v_ip = escapeshellarg($_GET['ip']);
 exec(HESTIA_CMD."v-list-sys-ip ".$v_ip." 'json'", $output, $return_var);
-check_return_code($return_var, $output);
+check_return_code_redirect($return_var, $output,'/list/ip');
 $data = json_decode(implode('', $output), true);
 unset($output);
 
 // Parse ip
 $v_username = $user;
diff --git a/web/edit/mail/index.php b/web/edit/mail/index.php
index 032809037..d5807c8df 100644
--- a/web/edit/mail/index.php
+++ b/web/edit/mail/index.php
@@ -30,19 +30,14 @@ $webmail_clients = json_decode(implode('', $output), true);
 unset($output);
 
 // List mail domain
 if ((!empty($_GET['domain'])) && (empty($_GET['account']))) {
     $v_domain = $_GET['domain'];
-    if ($_SESSION['userContext'] !== 'admin') {
-        if (!in_array($v_domain, $user_domains)) {
-            header("Location: /list/mail/");
-            exit;
-        }
-    }
 
     exec(HESTIA_CMD."v-list-mail-domain ".$user." ".escapeshellarg($v_domain)." json", $output, $return_var);
     $data = json_decode(implode('', $output), true);
+    check_return_code_redirect($return_var, $output, '/list/mail/');
     unset($output);
 
     // Parse domain
     $v_antispam = $data[$v_domain]['ANTISPAM'];
     $v_antivirus = $data[$v_domain]['ANTIVIRUS'];
@@ -87,20 +82,15 @@ if ((!empty($_GET['domain'])) && (empty($_GET['account']))) {
 }
 
 // List mail account
 if ((!empty($_GET['domain'])) && (!empty($_GET['account']))) {
     $v_domain = $_GET['domain'];
-    if ($_SESSION['userContext'] !== 'admin') {
-        if (!in_array($v_domain, $user_domains)) {
-            header("Location: /list/mail/");
-            exit;
-        }
-    }
 
     $v_account = $_GET['account'];
     exec(HESTIA_CMD."v-list-mail-account ".$user." ".escapeshellarg($v_domain)." ".escapeshellarg($v_account)." 'json'", $output, $return_var);
     $data = json_decode(implode('', $output), true);
+    check_return_code_redirect($return_var, $output, '/list/mail/');
     unset($output);
 
     // Parse mail account
     $v_username = $user;
     $v_password = "";
diff --git a/web/edit/package/index.php b/web/edit/package/index.php
index 17ff469b3..c8308ba30 100644
--- a/web/edit/package/index.php
+++ b/web/edit/package/index.php
@@ -26,10 +26,11 @@ if ($_GET['package'] === 'system') {
 }
 
 // List package
 $v_package = escapeshellarg($_GET['package']);
 exec(HESTIA_CMD."v-list-user-package ".$v_package." 'json'", $output, $return_var);
+check_return_code_redirect($return_var, $output, '/list/package/');
 $data = json_decode(implode('', $output), true);
 unset($output);
 
 // Parse package
 $v_package = $_GET['package'];
diff --git a/web/edit/user/index.php b/web/edit/user/index.php
index 59f7ddfd8..2b054aa42 100644
--- a/web/edit/user/index.php
+++ b/web/edit/user/index.php
@@ -31,11 +31,12 @@ if (($_SESSION['userContext'] === 'admin') && (isset($_SESSION['look'])) && ($us
 // Check token
 verify_csrf($_GET);
 
 // List user
 exec(HESTIA_CMD."v-list-user ".escapeshellarg($v_username)." json", $output, $return_var);
-check_return_code($return_var, $output);
+check_return_code_redirect($return_var, $output, '/list/user/');
+
 $data = json_decode(implode('', $output), true);
 unset($output);
 
 // Parse user
 $v_password = "";
diff --git a/web/edit/web/index.php b/web/edit/web/index.php
index 5165bdf87..c739152ee 100644
--- a/web/edit/web/index.php
+++ b/web/edit/web/index.php
@@ -17,25 +17,19 @@ if (empty($_GET['domain'])) {
 if (($_SESSION['userContext'] === 'admin') && (!empty($_GET['user']))) {
     $user=escapeshellarg($_GET['user']);
 }
 
 // Get all user domains
-exec(HESTIA_CMD."v-list-web-domains ".escapeshellarg($user)." json", $output, $return_var);
+exec(HESTIA_CMD."v-list-web-domains ".$user." json", $output, $return_var);
 $user_domains = json_decode(implode('', $output), true);
 $user_domains = array_keys($user_domains);
 unset($output);
 
-// List domain
 $v_domain = $_GET['domain'];
-if ($_SESSION['userContext'] !== 'admin') {
-    if (!in_array($v_domain, $user_domains)) {
-        header("Location: /list/mail/");
-        exit;
-    }
-}
-
 exec(HESTIA_CMD."v-list-web-domain ".$user." ".escapeshellarg($v_domain)." json", $output, $return_var);
+# Check if domain exists if not return /list/web/
+check_return_code_redirect($return_var, $output, '/list/web/');
 $data = json_decode(implode('', $output), true);
 unset($output);
 
 // Parse domain
 $v_username = $user;
diff --git a/web/inc/main.php b/web/inc/main.php
index c081307d6..982aca7d5 100644
--- a/web/inc/main.php
+++ b/web/inc/main.php
@@ -111,15 +111,15 @@ if (!defined('NO_AUTH_REQUIRED')) {
         $_SESSION['LAST_ACTIVITY'] = time();
     }
 }
 
 if (isset($_SESSION['user'])) {
-    $user = $_SESSION['user'];
+    $user = escapeshellarg($_SESSION['user']);
 }
 
 if (isset($_SESSION['look']) && ($_SESSION['userContext'] === 'admin')) {
-    $user = $_SESSION['look'];
+    $user = escapeshellarg($_SESSION['look']);
 }
 
 require_once(dirname(__FILE__) . '/i18n.php');
 
 function check_error($return_var)
@@ -138,10 +138,21 @@ function check_return_code($return_var, $output)
             $error = sprintf(_('Error code:'), $return_var);
         }
         $_SESSION['error_msg'] = $error;
     }
 }
+function check_return_code_redirect($return_var, $output, $location){
+    if ($return_var != 0) {
+        $error = implode('<br>', $output);
+        if (empty($error)) {
+            $error = sprintf(_('Error code:'), $return_var);
+        }
+        $_SESSION['error_msg'] = $error;
+        header("Location:".$location);
+    }
+
+}
 
 function render_page($user, $TAB, $page)
 {
     $__template_dir = dirname(__DIR__) . '/templates/';
     $__pages_js_dir = dirname(__DIR__) . '/js/pages/';
@@ -187,29 +198,46 @@ function verify_csrf($method, $return = false)
     } else {
         return true;
     }
 }
 
+function show_error_panel($data){
+    if (!empty($data['error_msg'])) {
+        $msg_icon = 'fa-exclamation-circle status-icon red';
+        $msg_text = $data['error_msg'];
+        $msg_id = 'vst-error';
+    } else {
+        if (!empty($data['ok_msg'])) {
+        $msg_icon = 'fa-check-circle status-icon green';
+        $msg_text = $data['ok_msg'];
+        $msg_id = 'vst-ok';
+    }
+    }
+    ?>
+        <span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=htmlentities($msg_text);?></span>
+    <?php
+}
+
 function top_panel($user, $TAB)
 {
     global $panel;
     $command = HESTIA_CMD . 'v-list-user ' . escapeshellarg($user) . " 'json'";
     exec($command, $output, $return_var);
     if ($return_var > 0) {
-        echo '<span style="font-size: 18px;"><b>ERROR: Unable to retrieve account details.</b><br>Please <b><a href="/login/">log in</a></b> again.</span>';
         destroy_sessions();
+        $_SESSION['error_msg'] = _('You have been logged out. Please log in again.');
         header('Location: /login/');
         exit;
     }
     $panel = json_decode(implode('', $output), true);
     unset($output);
 
     // Log out active sessions for suspended users
     if (($panel[$user]['SUSPENDED'] === 'yes') && ($_SESSION['POLICY_USER_VIEW_SUSPENDED'] !== 'yes')) {
         if(empty($_SESSION['look'])){
-        $_SESSION['error_msg'] = 'You have been logged out. Please log in again.';
         destroy_sessions();
+        $_SESSION['error_msg'] = _('You have been logged out. Please log in again.');
         header('Location: /login/');
         }
     }
 
     // Reset user permissions if changed while logged in
diff --git a/web/login/index.php b/web/login/index.php
index ee6ad222c..20d97f321 100644
--- a/web/login/index.php
+++ b/web/login/index.php
@@ -34,10 +34,13 @@ if (isset($_SESSION['user'])) {
                 exec(HESTIA_CMD . "v-log-action system 'Warning' 'Security' 'User impersonation session started (User: $v_user, Administrator: $v_impersonator)'", $output, $return_var);
                 // Reset account details for File Manager to impersonated user
                 unset($_SESSION['_sf2_attributes']);
                 unset($_SESSION['_sf2_meta']);
                 header('Location: /login/');
+            }else{
+                # User doesn't exists
+                header('Location: /');
             }
         }
         exit;
     }
 
diff --git a/web/suspend/cron/index.php b/web/suspend/cron/index.php
index 0beffcb82..823034c2c 100644
--- a/web/suspend/cron/index.php
+++ b/web/suspend/cron/index.php
@@ -4,13 +4,12 @@ include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 
 // Check token
 verify_csrf($_GET);
 
 if (!empty($_GET['job'])) {
-    $v_username = escapeshellarg($user);
     $v_job = escapeshellarg($_GET['job']);
-    exec(HESTIA_CMD."v-suspend-cron-job ".$v_username." ".$v_job, $output, $return_var);
+    exec(HESTIA_CMD."v-suspend-cron-job ".$user." ".$v_job, $output, $return_var);
     check_return_code($return_var, $output);
     unset($output);
 }
 
 $back = $_SESSION['back'];
diff --git a/web/suspend/db/index.php b/web/suspend/db/index.php
index 8837ddf69..47566a7ed 100644
--- a/web/suspend/db/index.php
+++ b/web/suspend/db/index.php
@@ -8,13 +8,12 @@ include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 
 // Check token
 verify_csrf($_GET);
 
 if (!empty($_GET['database'])) {
-    $v_username = escapeshellarg($user);
     $v_database = escapeshellarg($_GET['database']);
-    exec(HESTIA_CMD."v-suspend-database ".$v_username." ".$v_database, $output, $return_var);
+    exec(HESTIA_CMD."v-suspend-database ".$user." ".$v_database, $output, $return_var);
     check_return_code($return_var, $output);
     unset($output);
 }
 
 $back = $_SESSION['back'];
diff --git a/web/suspend/dns/index.php b/web/suspend/dns/index.php
index 07367cd61..080988f11 100644
--- a/web/suspend/dns/index.php
+++ b/web/suspend/dns/index.php
@@ -9,13 +9,12 @@ include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 // Check token
 verify_csrf($_GET);
 
 // DNS domain
 if ((!empty($_GET['domain'])) && (empty($_GET['record_id']))) {
-    $v_username = escapeshellarg($user);
     $v_domain = escapeshellarg($_GET['domain']);
-    exec(HESTIA_CMD."v-suspend-dns-domain ".$v_username." ".$v_domain, $output, $return_var);
+    exec(HESTIA_CMD."v-suspend-dns-domain ".$user." ".$v_domain, $output, $return_var);
     check_return_code($return_var, $output);
     unset($output);
     $back = $_SESSION['back'];
     if (!empty($back)) {
         header("Location: ".$back);
@@ -25,14 +24,13 @@ if ((!empty($_GET['domain'])) && (empty($_GET['record_id']))) {
     exit;
 }
 
 // DNS record
 if ((!empty($_GET['domain'])) && (!empty($_GET['record_id']))) {
-    $v_username = escapeshellarg($user);
     $v_domain = escapeshellarg($_GET['domain']);
     $v_record_id = escapeshellarg($_GET['record_id']);
-    exec(HESTIA_CMD."v-suspend-dns-record ".$v_username." ".$v_domain." ".$v_record_id, $output, $return_var);
+    exec(HESTIA_CMD."v-suspend-dns-record ".$user." ".$v_domain." ".$v_record_id, $output, $return_var);
     check_return_code($return_var, $output);
     unset($output);
     $back = $_SESSION['back'];
     if (!empty($back)) {
         header("Location: ".$back);
diff --git a/web/suspend/mail/index.php b/web/suspend/mail/index.php
index 4f92d2678..ca304e2fd 100644
--- a/web/suspend/mail/index.php
+++ b/web/suspend/mail/index.php
@@ -9,13 +9,12 @@ include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 // Check token
 verify_csrf($_GET);
 
 // Mail domain
 if ((!empty($_GET['domain'])) && (empty($_GET['account']))) {
-    $v_username = escapeshellarg($user);
     $v_domain = escapeshellarg($_GET['domain']);
-    exec(HESTIA_CMD."v-suspend-mail-domain ".$v_username." ".$v_domain, $output, $return_var);
+    exec(HESTIA_CMD."v-suspend-mail-domain ".$user." ".$v_domain, $output, $return_var);
     check_return_code($return_var, $output);
     unset($output);
     $back=getenv("HTTP_REFERER");
     if (!empty($back)) {
         header("Location: ".$back);
@@ -28,11 +27,11 @@ if ((!empty($_GET['domain'])) && (empty($_GET['account']))) {
 // Mail account
 if ((!empty($_GET['domain'])) && (!empty($_GET['account']))) {
     $v_username = escapeshellarg($user);
     $v_domain = escapeshellarg($_GET['domain']);
     $v_account = escapeshellarg($_GET['account']);
-    exec(HESTIA_CMD."v-suspend-mail-account ".$v_username." ".$v_domain." ".$v_account, $output, $return_var);
+    exec(HESTIA_CMD."v-suspend-mail-account ".$user." ".$v_domain." ".$v_account, $output, $return_var);
     check_return_code($return_var, $output);
     unset($output);
     $back = $_SESSION['back'];
     if (!empty($back)) {
         header("Location: ".$back);
diff --git a/web/suspend/user/index.php b/web/suspend/user/index.php
index 35a38ec38..1ef376286 100644
--- a/web/suspend/user/index.php
+++ b/web/suspend/user/index.php
@@ -14,12 +14,11 @@ if ($_SESSION['userContext'] != 'admin') {
     header("Location: /list/user");
     exit;
 }
 
 if (!empty($_GET['user'])) {
-    $v_username = escapeshellarg($_GET['user']);
-    exec(HESTIA_CMD."v-suspend-user ".$v_username, $output, $return_var);
+    exec(HESTIA_CMD."v-suspend-user ".$user, $output, $return_var);
 }
 check_return_code($return_var, $output);
 unset($output);
 
 $back = $_SESSION['back'];
diff --git a/web/suspend/web/index.php b/web/suspend/web/index.php
index 9d1b11196..d5dcfaac2 100644
--- a/web/suspend/web/index.php
+++ b/web/suspend/web/index.php
@@ -10,11 +10,11 @@ include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 verify_csrf($_GET);
 
 if (!empty($_GET['domain'])) {
     $v_username = escapeshellarg($user);
     $v_domain = escapeshellarg($_GET['domain']);
-    exec(HESTIA_CMD."v-suspend-web-domain ".$v_username." ".$v_domain, $output, $return_var);
+    exec(HESTIA_CMD."v-suspend-web-domain ".$user." ".$v_domain, $output, $return_var);
 }
 check_return_code($return_var, $output);
 unset($output);
 
 $back = $_SESSION['back'];
diff --git a/web/templates/includes/title.html b/web/templates/includes/title.html
index f46c0d77d..513c92460 100644
--- a/web/templates/includes/title.html
+++ b/web/templates/includes/title.html
@@ -1,2 +1,2 @@
 <meta charset="utf-8">
-<title><?=$_SERVER['HTTP_HOST']; ?> - <?=_($TAB)?> - <?=_('Hestia Control Panel');?></title>
\ No newline at end of file
+<title><?=htmlentities($_SERVER['HTTP_HOST']); ?> - <?=_($TAB)?> - <?=_('Hestia Control Panel');?></title>
\ No newline at end of file
diff --git a/web/templates/pages/add_cron.html b/web/templates/pages/add_cron.html
index 1ab5eab7a..65e3713a3 100644
--- a/web/templates/pages/add_cron.html
+++ b/web/templates/pages/add_cron.html
@@ -339,24 +339,11 @@
 								<span class="page-title"><?=_('Adding Cron Job');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text input-label">
 								<?=_('Command');?>
diff --git a/web/templates/pages/add_db.html b/web/templates/pages/add_db.html
index 9f546927a..2c9bde74a 100644
--- a/web/templates/pages/add_db.html
+++ b/web/templates/pages/add_db.html
@@ -35,24 +35,11 @@
 								<span class="page-title"><?=_('Adding database');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<?php if (($user == 'admin') && (($_GET['accept'] !== "true")))  {?>
 							<tr>
 								<td class="step-top">
diff --git a/web/templates/pages/add_dns.html b/web/templates/pages/add_dns.html
index a2bbcd6a9..d37be1e25 100644
--- a/web/templates/pages/add_dns.html
+++ b/web/templates/pages/add_dns.html
@@ -35,24 +35,11 @@
 								<span class="page-title"><?=_('Adding DNS Domain');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<?php if (($user == 'admin') && (($_GET['accept'] !== "true")))  {?>
 							<tr>
 								<td class="step-top">
diff --git a/web/templates/pages/add_dns_rec.html b/web/templates/pages/add_dns_rec.html
index 252d3a269..74f1c6e2a 100644
--- a/web/templates/pages/add_dns_rec.html
+++ b/web/templates/pages/add_dns_rec.html
@@ -35,24 +35,11 @@
 								<span class="page-title"><?=_('Adding DNS Record');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top">
 								<?=_('Domain');?>
diff --git a/web/templates/pages/add_firewall.html b/web/templates/pages/add_firewall.html
index 55fcbd18c..622febce2 100644
--- a/web/templates/pages/add_firewall.html
+++ b/web/templates/pages/add_firewall.html
@@ -35,24 +35,11 @@
 								<span class="page-title"><?=_('Adding Firewall Rule');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top">
 								<?=_('Action') ?>
diff --git a/web/templates/pages/add_firewall_banlist.html b/web/templates/pages/add_firewall_banlist.html
index 684cf1f48..f96594de2 100644
--- a/web/templates/pages/add_firewall_banlist.html
+++ b/web/templates/pages/add_firewall_banlist.html
@@ -35,24 +35,11 @@
 								<span class="page-title"><?=_('Adding IP Address to Banlist');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text input-label">
 								<?=_('IP address');?> <span class="optional">(<?=_('CIDR format is supported');?>)</span>
diff --git a/web/templates/pages/add_firewall_ipset.html b/web/templates/pages/add_firewall_ipset.html
index dece08db1..e41843877 100644
--- a/web/templates/pages/add_firewall_ipset.html
+++ b/web/templates/pages/add_firewall_ipset.html
@@ -35,24 +35,11 @@
 								<span class="page-title"><?=_('Adding Firewall Ipset List');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top">
 								<?=_('Ip List Name') ?>
diff --git a/web/templates/pages/add_ip.html b/web/templates/pages/add_ip.html
index 5ac65cf7b..738893534 100644
--- a/web/templates/pages/add_ip.html
+++ b/web/templates/pages/add_ip.html
@@ -35,24 +35,11 @@
 								<span class="page-title"><?=_('Adding IP address');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top">
 								<?=_('IP address') ?>
diff --git a/web/templates/pages/add_key.html b/web/templates/pages/add_key.html
index c8794a910..4b9ba4ec0 100644
--- a/web/templates/pages/add_key.html
+++ b/web/templates/pages/add_key.html
@@ -39,24 +39,11 @@
 								<span class="page-title"><?=_('Add SSH Key');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top">
 								<?=_('SSH KEY') ?>
diff --git a/web/templates/pages/add_mail.html b/web/templates/pages/add_mail.html
index 62126ab81..d3ed77092 100644
--- a/web/templates/pages/add_mail.html
+++ b/web/templates/pages/add_mail.html
@@ -35,24 +35,11 @@
 								<span class="page-title"><?=_('Adding Mail Domain');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<?php if (($user == 'admin') && (($_GET['accept'] !== "true")))  {?>
 							<tr>
 								<td class="step-top">
diff --git a/web/templates/pages/add_mail_acc.html b/web/templates/pages/add_mail_acc.html
index eea7e1356..a2fe153ba 100644
--- a/web/templates/pages/add_mail_acc.html
+++ b/web/templates/pages/add_mail_acc.html
@@ -35,24 +35,11 @@
 								<span class="page-title"><?=_('Adding Mail Account');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top">
 								<?=_('Domain');?>
@@ -167,11 +154,11 @@
 						<table>
 							<?php $uname_arr=posix_uname(); $hostname=$uname_arr['nodename']; ?>
 							<tr>
 								<td colspan="2">
 									<select id="mail_configuration" class="vst-list flat">
-										<option v_type="hostname" domain="<?=$v_domain?>"><?=_('Use domain hostname');?></option>
+										<option v_type="hostname" domain="<?=htmlentities($v_domain)?>"><?=_('Use domain hostname');?></option>
 										<option v_type="starttls"><?=_('Use STARTTLS');?></option>
 										<option v_type="ssl"><?=_('Use SSL / TLS');?></option>
 										<option v_type="no_encryption" domain="<?=htmlentities(trim($v_domain, "'"))?>" no_encryption="<?=_('No encryption');?>"><?=_('No encryption');?></option>
 									</select>
 								</td>
@@ -189,11 +176,11 @@
 								</td>
 							</tr>
 							<tr>
 								<td><?=_('IMAP hostname');?>:</td>
 								<td>
-									<div id="td_imap_hostname">mail.<?=$v_domain?></div>
+									<div id="td_imap_hostname">mail.<?=htmlentities($v_domain)?></div>
 								</td>
 							</tr>
 							<tr>
 								<td><?=_('IMAP port');?>:</td>
 								<td>
@@ -213,11 +200,11 @@
 								</td>
 							</tr>
 							<tr>
 								<td><?=_('SMTP hostname');?>:</td>
 								<td>
-									<div id="td_smtp_hostname">mail.<?=$v_domain?></div>
+									<div id="td_smtp_hostname">mail.<?=htmlentities($v_domain)?></div>
 								</td>
 							</tr>
 							<tr>
 								<td><?=_('SMTP port');?>:</td>
 								<td>
@@ -238,11 +225,11 @@
 							</tr>
 							<?php if ($_SESSION['WEBMAIL_SYSTEM']) {?>
 								<tr>
 									<td><?=_('Webmail URL');?>:</td>
 									<td>
-										<div><a class="vst" href="http://<?=$v_webmail_alias?>" target="_blank">http://<?=$v_webmail_alias?> <i></i></a></div>
+										<div><a class="vst" href="http://<?=htmlentities($v_webmail_alias)?>" target="_blank">http://<?=htmlentities($v_webmail_alias)?> <i></i></a></div>
 									</td>
 								</tr>
 							<?php } ?>
 						</table>
 					</div>
diff --git a/web/templates/pages/add_package.html b/web/templates/pages/add_package.html
index 39e63c6c1..f2969ad69 100644
--- a/web/templates/pages/add_package.html
+++ b/web/templates/pages/add_package.html
@@ -35,24 +35,11 @@
 								<span class="page-title"><?=_('Adding Package');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top">
 								<?=_('Package Name');?>
diff --git a/web/templates/pages/add_user.html b/web/templates/pages/add_user.html
index 923f5c968..b74dacb5a 100644
--- a/web/templates/pages/add_user.html
+++ b/web/templates/pages/add_user.html
@@ -35,24 +35,11 @@
 								<span class="page-title"><?=_('Adding User');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top">
 								<?=_('Username');?>
diff --git a/web/templates/pages/add_web.html b/web/templates/pages/add_web.html
index c2a598982..8da975e40 100644
--- a/web/templates/pages/add_web.html
+++ b/web/templates/pages/add_web.html
@@ -37,24 +37,11 @@
 								<span class="page-title"><?=_('Add Web Domain');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<?php if (($user == 'admin') && (($_GET['accept'] !== "true")))  {?>
 							<tr>
 								<td class="step-top">
@@ -309,21 +296,21 @@
 											<?=_('Point to');?>
 										</td>
 									</tr>
 									<tr>
 										<td>
-											<input type="hidden" name="v-custom-doc-root_prepath" value="<?=$v_custom_doc_root_prepath;?>">
+											<input type="hidden" name="v-custom-doc-root_prepath" value="<?=htmlentities($v_custom_doc_root_prepath);?>">
 											<select class="vst-list" name="v-custom-doc-domain">
 												<option value="<?=htmlentities(trim($v_domain, "'"))?>" id="v-custom-doc-domain-main"><?=htmlentities(trim($v_domain, "'"))?></option>
 												<?php
 													foreach ($user_domains  as $domain) {
 														if($domain != $v_domain ){
 														if($v_custom_doc_domain == $domain){
 													?>
-													<option value="<?=$domain;?>" selected="selected"><?=$domain;?></option>
+													<option value="<?=htmlentities($domain);?>" selected="selected"><?=htmlentities($domain);?></option>
 												<?php } else{ ?>
-													<option value="<?=$domain;?>"><?=$domain;?></option>
+													<option value="<?=htmlentities($domain);?>"><?=htmlentities($domain);?></option>
 												<?php } } } ?>
 											</select>
 										</td>
 									</tr>
 									<tr>
diff --git a/web/templates/pages/edit_backup_exclusions.html b/web/templates/pages/edit_backup_exclusions.html
index 970e3f99e..e70bb2d00 100644
--- a/web/templates/pages/edit_backup_exclusions.html
+++ b/web/templates/pages/edit_backup_exclusions.html
@@ -36,24 +36,11 @@
 								<span class="page-title"><?=_('Editing Backup Exclusions');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top">
 								<?=_('Web Domains');?>
diff --git a/web/templates/pages/edit_cron.html b/web/templates/pages/edit_cron.html
index 644259aca..765448a5a 100644
--- a/web/templates/pages/edit_cron.html
+++ b/web/templates/pages/edit_cron.html
@@ -340,24 +340,11 @@
 								<span class="page-title"><?=_('Editing Cron Job');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text input-label">
 								<?=_('Command');?>
diff --git a/web/templates/pages/edit_db.html b/web/templates/pages/edit_db.html
index a2027d670..91cb030fa 100644
--- a/web/templates/pages/edit_db.html
+++ b/web/templates/pages/edit_db.html
@@ -36,24 +36,11 @@
 								<span class="page-title"><?=_('Editing Database');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top">
 								<?=_('Database');?>
diff --git a/web/templates/pages/edit_dns.html b/web/templates/pages/edit_dns.html
index b87e4e1c8..984530a4d 100644
--- a/web/templates/pages/edit_dns.html
+++ b/web/templates/pages/edit_dns.html
@@ -36,24 +36,11 @@
 								<span class="page-title"><?=_('Editing DNS Domain');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top">
 								<?=_('Domain');?>
diff --git a/web/templates/pages/edit_dns_rec.html b/web/templates/pages/edit_dns_rec.html
index 063760d05..e19d4c59e 100644
--- a/web/templates/pages/edit_dns_rec.html
+++ b/web/templates/pages/edit_dns_rec.html
@@ -36,24 +36,11 @@
 								<span class="page-title"><?=_('Editing DNS Record');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top">
 								<?=_('Domain');?>
diff --git a/web/templates/pages/edit_firewall.html b/web/templates/pages/edit_firewall.html
index abfd16343..57fac3b80 100644
--- a/web/templates/pages/edit_firewall.html
+++ b/web/templates/pages/edit_firewall.html
@@ -36,24 +36,11 @@
 								<span class="page-title"><?=_('Editing Firewall Rule');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top">
 								<?=_('Action'); ?>
diff --git a/web/templates/pages/edit_ip.html b/web/templates/pages/edit_ip.html
index e8525bf01..1922b5b2d 100644
--- a/web/templates/pages/edit_ip.html
+++ b/web/templates/pages/edit_ip.html
@@ -36,24 +36,11 @@
 								<span class="page-title"><?=_('Editing IP Address');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top">
 								<?=_('IP address'); ?>
diff --git a/web/templates/pages/edit_mail.html b/web/templates/pages/edit_mail.html
index 611a5d6ad..b7b16cacf 100644
--- a/web/templates/pages/edit_mail.html
+++ b/web/templates/pages/edit_mail.html
@@ -36,24 +36,11 @@
 								<span class="page-title"><?=_('Editing Mail Domain');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top">
 								<?=_('Domain');?>
@@ -131,21 +118,22 @@
 									</tr>
 									<tr id="le-warning" class="step-top">
 										<td>
 											<span class="alert alert-info alert-with-icon">
 												<i class="fas fa-exclamation"></i>
-												<?=_("To enable Let's Encrypt SSL, ensure that DNS records exist for mail.$v_domain and $v_webmail_alias!")?><br />
+												<?php echo $v_webmail_alias;?>
+												<?=sprintf(_("To enable Let's Encrypt SSL, ensure that DNS records exist for mail.%s and %s!"), $v_domain, $v_webmail_alias); ?><br />
 											</span>
 										</td>
 									</tr>
 									<tr>
 										<td>
 											<table id="ssl-details" style="<?php if ($v_letsencrypt == 'yes' || $v_letsencrypt == 'on') { echo 'display: none;'; } ?>">
 												<tr>
 													<td class="vst-text input-label step-top">
 														<?=_('SSL Certificate');?>
-														<span id="generate-csr"> / <a class="generate" target="_blank" href="/generate/ssl/?domain=<?=$v_domain?>"><?=_('Generate CSR');?></a></span>
+														<span id="generate-csr"> / <a class="generate" target="_blank" href="/generate/ssl/?domain=<?=htmlentities($v_domain)?>"><?=_('Generate CSR');?></a></span>
 													</td>
 												</tr>
 												<tr>
 													<td>
 														<textarea size="20" class="vst-textinput short console" <?php if ($v_letsencrypt == 'yes') echo 'disabled' ?> name="v_ssl_crt"><?=htmlentities(trim($v_ssl_crt, "'"))?></textarea>
@@ -179,61 +167,61 @@
 															<tr>
 																<td>
 																	<b><?=_('SUBJECT');?>:</b>
 																</td>
 																<td class="details">
-																	<?=$v_ssl_subject?>
+																	<?=htmlentities($v_ssl_subject);?>
 																</td>
 															</tr>
 															<?php if ($v_ssl_aliases){?>
 																<tr>
 																	<td>
 																		<b><?=_('Aliases');?>:</b>
 																	</td>
 																	<td class="details">
-																		<?=$v_ssl_aliases?>
+																		<?=htmlentities($v_ssl_aliases)?>
 																	</td>
 																</tr>
 															<?php } ?>
 															<tr>
 																<td>
 																	<b><?=_('NOT_BEFORE');?>:</b>
 																</td>
 																<td class="details">
-																	<?=$v_ssl_not_before?>
+																	<?=htmlentities($v_ssl_not_before)?>
 																</td>
 															</tr>
 															<tr>
 																<td>
 																	<b><?=_('NOT_AFTER');?>:</b>
 																</td>
 																<td class="details">
-																	<?=$v_ssl_not_after?>
+																	<?=htmlentities($v_ssl_not_after)?>
 																</td>
 															</tr>
 															<tr>
 																<td>
 																	<b><?=_('SIGNATURE');?>:</b>
 																</td>
 																<td class="details">
-																	<?=$v_ssl_signature?>
+																	<?=htmlentities($v_ssl_signature)?>
 																</td>
 															</tr>
 															<tr>
 																<td>
 																	<b><?=_('PUB_KEY');?>:</b>
 																</td>
 																<td class="details">
-																	<?=$v_ssl_pub_key?>
+																	<?=htmlentities($v_ssl_pub_key)?>
 																</td>
 															</tr>
 															<tr>
 																<td>
 																	<b><?=_('ISSUER');?>:</b>
 																</td>
 																<td class="details">
-																	<?=$v_ssl_issuer?>
+																	<?=htmlentities($v_ssl_issuer)?>
 																</td>
 															</tr>
 														</table>
 													</td>
 												</tr>
diff --git a/web/templates/pages/edit_mail_acc.html b/web/templates/pages/edit_mail_acc.html
index 860d9781b..19d6de8b1 100644
--- a/web/templates/pages/edit_mail_acc.html
+++ b/web/templates/pages/edit_mail_acc.html
@@ -36,24 +36,11 @@
 								<span class="page-title"><?=_('Editing Mail Account');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top input-label">
 								<?=_('Account');?>
@@ -197,11 +184,11 @@
 								</td>
 							</tr>
 							<tr>
 								<td><?=_('IMAP hostname');?>:</td>
 								<td>
-									<div id="td_imap_hostname">mail.<?=$v_domain?></div>
+									<div id="td_imap_hostname">mail.<?=htmlentities($v_domain)?></div>
 								</td>
 							</tr>
 							<tr>
 								<td><?=_('IMAP port');?>:</td>
 								<td>
@@ -221,11 +208,11 @@
 								</td>
 							</tr>
 							<tr>
 								<td><?=_('SMTP hostname');?>:</td>
 								<td>
-									<div id="td_smtp_hostname">mail.<?=$v_domain?></div>
+									<div id="td_smtp_hostname">mail.<?=htmlentities($v_domain)?></div>
 								</td>
 							</tr>
 							<tr>
 								<td><?=_('SMTP port');?>:</td>
 								<td>
@@ -246,11 +233,11 @@
 							</tr>
 							<?php if ($_SESSION['WEBMAIL_SYSTEM']) { ?>
 								<tr>
 									<td><?=_('Webmail URL');?>:</td>
 									<td>
-										<div><a class="vst" href="http://<?=$v_webmail_alias?>" target="_blank">http://<?=$v_webmail_alias?> <i></i></a></div>
+										<div><a class="vst" href="http://<?=htmlentities($v_webmail_alias)?>" target="_blank">http://<?=htmlentities($v_webmail_alias)?> <i></i></a></div>
 									</td>
 								</tr>
 							<?php } ?>
 						</table>
 					</div>
diff --git a/web/templates/pages/edit_package.html b/web/templates/pages/edit_package.html
index 0bda36907..557118e69 100644
--- a/web/templates/pages/edit_package.html
+++ b/web/templates/pages/edit_package.html
@@ -36,24 +36,11 @@
 								<span class="page-title"><?=_('Editing Package');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top">
 								<?=_('Package Name');?>
diff --git a/web/templates/pages/edit_server.html b/web/templates/pages/edit_server.html
index 1fb32aa49..f2540cc75 100644
--- a/web/templates/pages/edit_server.html
+++ b/web/templates/pages/edit_server.html
@@ -39,28 +39,13 @@
 								<span class="page-title"><?=_('Configuring Server');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
-								<br><br>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
-
 						<!-- Basic options tab -->
 						<tr>
 							<td class="vst-text input-label step-top advanced-options">
 								<a href="javascript:elementHideShow('basic');" class="vst-text">
 									<i class="fas fa-cog"></i><b><?=_('Basic options');?> <img src="/images/arrow.png"></b>
diff --git a/web/templates/pages/edit_server_bind9.html b/web/templates/pages/edit_server_bind9.html
index 787979f04..7f702ed5d 100644
--- a/web/templates/pages/edit_server_bind9.html
+++ b/web/templates/pages/edit_server_bind9.html
@@ -35,24 +35,11 @@
 								<span class="page-title"><?=_('Configuring Server');?>: <?=$v_service_name;?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top">
 								<?=$v_options_path;?>
diff --git a/web/templates/pages/edit_server_dovecot.html b/web/templates/pages/edit_server_dovecot.html
index e8ffbcc54..245731afe 100644
--- a/web/templates/pages/edit_server_dovecot.html
+++ b/web/templates/pages/edit_server_dovecot.html
@@ -35,24 +35,11 @@
 								<span class="page-title"><?=_('Configuring Server');?>: <?=$v_service_name;?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top">
 								<?=$v_config_path;?>
diff --git a/web/templates/pages/edit_server_httpd.html b/web/templates/pages/edit_server_httpd.html
index 1c742f9ba..63843e8a6 100644
--- a/web/templates/pages/edit_server_httpd.html
+++ b/web/templates/pages/edit_server_httpd.html
@@ -36,24 +36,11 @@
 								<span class="page-title"><?=_('Configuring Server');?>: <?=$v_service_name;?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top">
 								<?=$v_config_path;?>
diff --git a/web/templates/pages/edit_server_mysql.html b/web/templates/pages/edit_server_mysql.html
index 421958f3a..14c0cff7f 100644
--- a/web/templates/pages/edit_server_mysql.html
+++ b/web/templates/pages/edit_server_mysql.html
@@ -35,24 +35,11 @@
 								<span class="page-title"><?=_('Configuring Server');?>: <?=$v_service_name;?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top">
 								max_connections
diff --git a/web/templates/pages/edit_server_nginx.html b/web/templates/pages/edit_server_nginx.html
index fdd58cb98..af9171828 100644
--- a/web/templates/pages/edit_server_nginx.html
+++ b/web/templates/pages/edit_server_nginx.html
@@ -36,24 +36,11 @@
 								<span class="page-title"><?=_('Configuring Server');?>: <?=$v_service_name;?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top">
 								worker_processes
diff --git a/web/templates/pages/edit_server_pgsql.html b/web/templates/pages/edit_server_pgsql.html
index 08a116c43..4f7997e87 100644
--- a/web/templates/pages/edit_server_pgsql.html
+++ b/web/templates/pages/edit_server_pgsql.html
@@ -35,24 +35,11 @@
 								<span class="page-title"><?=_('Configuring Server');?>: <?=$v_service_name;?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top">
 								<?=$v_options_path;?>
diff --git a/web/templates/pages/edit_server_php.html b/web/templates/pages/edit_server_php.html
index 9bf27e20c..f115ca53d 100644
--- a/web/templates/pages/edit_server_php.html
+++ b/web/templates/pages/edit_server_php.html
@@ -35,24 +35,11 @@
 								<span class="page-title"><?=_('Configuring Server');?>: PHP</span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top">
 								max_execution_time
diff --git a/web/templates/pages/edit_server_service.html b/web/templates/pages/edit_server_service.html
index 0fae36259..7a1fc3b4f 100644
--- a/web/templates/pages/edit_server_service.html
+++ b/web/templates/pages/edit_server_service.html
@@ -35,24 +35,11 @@
 								<span class="page-title"><?=_('Configuring Server');?>: <?=$v_service_name;?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top">
 								<?=$v_config_path;?>
diff --git a/web/templates/pages/edit_user.html b/web/templates/pages/edit_user.html
index 185450b7b..1e3797cf8 100644
--- a/web/templates/pages/edit_user.html
+++ b/web/templates/pages/edit_user.html
@@ -3,12 +3,12 @@
 	<div class="l-sort clearfix">
 		<div class="l-unit-toolbar__buttonstrip">
 			<a class="ui-button cancel" dir="ltr" id="btn-back" href="/list/user/"><i class="fas fa-arrow-left status-icon blue"></i><?=_('Back');?></a>
 			<?php 
 				if (($_SESSION['userContext'] === 'admin') && (!isset($_SESSION['look'])) && ($_SESSION['user'] !== $v_username)) {
-					$ssh_key_url = "/list/key/?user=".$user."&token=".$_SESSION['token']."";
-					$log_url = "/list/log/?user=".$user."&token=".$_SESSION['token']."";
+					$ssh_key_url = "/list/key/?user=".htmlentities($user)."&token=".$_SESSION['token']."";
+					$log_url = "/list/log/?user=".htmlentities($user)."&token=".$_SESSION['token']."";
 				} else {
 					$ssh_key_url = "/list/key/";
 					$log_url = "/list/log/";
 				} 
 			?>
@@ -20,18 +20,18 @@
 		<div class="l-unit-toolbar__buttonstrip float-right">
 			<div class="actions-panel clearfix">
 			<?php if (($_SESSION['user'] == $v_username) || (isset($_SESSION['look']))) {?>
 				<!-- Do not show delete button for currently logged in user-->
 			<?} else {?>
-				<a href="/login/?loginas=<?=$v_username?>&token=<?=$_SESSION['token']?>" id="btn-create" class="ui-button cancel" dir="ltr" title="<?=_('login as');?>"><i class="fas fa-sign-in-alt status-icon maroon"></i><?=_('login as');?></a>
+				<a href="/login/?loginas=<?=htmlentities($v_username)?>&token=<?=$_SESSION['token']?>" id="btn-create" class="ui-button cancel" dir="ltr" title="<?=_('login as');?>"><i class="fas fa-sign-in-alt status-icon maroon"></i><?=_('login as');?></a>
 				<div class="display-inline-block" key-action="js">
 					<a class="data-controls do_delete ui-button danger cancel">
 						<i class="do_delete fas fa-times-circle status-icon red"></i>
 						<?=_('Delete');?>
-						<input type="hidden" name="delete_url" value="/delete/user/?user=<?=$v_username?>&token=<?=$_SESSION['token']?>" />
+						<input type="hidden" name="delete_url" value="/delete/user/?user=<?=htmlentities($v_username)?>&token=<?=$_SESSION['token']?>" />
 						<div class="confirmation-text-delete hidden" title="<?=_('Confirmation');?>">
-							<p class="confirmation"><?=sprintf(_('DELETE_USER_CONFIRMATION'),$v_username)?></p>
+							<p class="confirmation"><?=sprintf(_('DELETE_USER_CONFIRMATION'),htmlentities($v_username))?></p>
 						</div>
 					</a>
 				</div>
 			<?php } ?>
 			<a href="#" class="ui-button" data-action="submit" data-id="vstobjects"><i class="fas fa-save status-icon purple"></i> <?=_('Save');?></a>
@@ -66,24 +66,11 @@
 								<span class="page-title"><?=_('Editing User');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top">
 								<?=_('Username');?>
@@ -156,11 +143,11 @@
 										<td id="password-options" style="<?php if ($data[$user]['LOGIN_DISABLED'] == "yes") { echo 'display: none;'; } else { echo 'display: table-cell;'; }?>">
 											<label><input type="checkbox" class="vst-checkbox password-option" name="v_twofa" <?php if(!empty($v_twofa)) echo "checked=yes" ?>><?=_('Enable 2FA');?></label>
 											<?php if (!empty($v_twofa)) { ?>
 											<p><?=_('2FA Reset Code:').' '.$v_twofa; ?></br></p>
 											<p><?=_('Please scan the code below in your 2FA application:'); ?></p>
-											<div><img class="qr-code" src="<?=$v_qrcode; ?>"></div>
+											<div><img class="qr-code" src="<?=htmlentities($v_qrcode); ?>"></div>
 											<?php } ?>
 										</td>
 									</tr>
 									<tr>
 										<td id="password-options-ip" style="<?php if ($data[$user]['LOGIN_DISABLED'] == "yes") { echo 'display: none;'; } else { echo 'display: table-cell;'; }?>">
diff --git a/web/templates/pages/edit_web.html b/web/templates/pages/edit_web.html
index 2bb311d34..fc009664f 100644
--- a/web/templates/pages/edit_web.html
+++ b/web/templates/pages/edit_web.html
@@ -3,15 +3,15 @@
 	<div class="l-sort clearfix">
 		<div class="l-unit-toolbar__buttonstrip">
 			<a class="ui-button cancel" dir="ltr" id="btn-back" href="/list/web/"><i class="fas fa-arrow-left status-icon blue"></i><?=_('Back');?></a>
 		</div>
 		<div class="l-unit-toolbar__buttonstrip float-right">
-			<a href="/delete/web/cache/?domain=<?=$v_domain;?>&token=<?=$_SESSION['token'];?>" class="ui-button cancel <?php if ( $v_nginx_cache == 'yes' || ($v_proxy_template == 'caching' && $_SESSION['PROXY_SYSTEM'] == 'nginx')) { echo "block"; } else{ echo "hidden"; }?>" id="v-clear-cache">
+			<a href="/delete/web/cache/?domain=<?=htmlentities($v_domain);?>&token=<?=$_SESSION['token'];?>" class="ui-button cancel <?php if ( $v_nginx_cache == 'yes' || ($v_proxy_template == 'caching' && $_SESSION['PROXY_SYSTEM'] == 'nginx')) { echo "block"; } else{ echo "hidden"; }?>" id="v-clear-cache">
 				<i class="fas fa-trash status-icon red"></i><?=_('Purge Nginx Cache');?>
 			</a>
 			<?php if ($_SESSION['PLUGIN_APP_INSTALLER'] !== 'false') {?>
-				<a href="/add/webapp/?domain=<?=$v_domain?>" class="ui-button cancel" dir="ltr">
+				<a href="/add/webapp/?domain=<?=htmlentities($v_domain);?>" class="ui-button cancel" dir="ltr">
 					<i class="fas fa-magic status-icon blue"></i> <?=_('Quick Install App');?>
 				</a>
 			<?php } ?>
 			<a href="#" class="ui-button" data-action="submit" data-id="vstobjects"><i class="fas fa-save status-icon purple"></i><?=_('Save');?></a>
 		</div>
@@ -44,24 +44,11 @@
 								<span class="page-title"><?=_('Editing Domain');?></span>
 							</td>
 						</tr>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text step-top">
 								<?=_('Domain');?>
@@ -171,12 +158,12 @@
 						<tr>
 							<td class="step-left">
 								<table style="display:<?php if (empty($v_redirect)) { echo 'none';} else {echo 'block';}?> ;" id="v_redirect">
 									<tr>
 										<td>
-											<label><input type="radio" name="v-redirect" value="<?='www.'.$v_domain;?>" <?php if ($v_redirect == "www.".$v_domain) echo "checked"; ?> class="v-redirect-custom-value"><?=sprintf(_('Redirect visitors to %s'),"www.".$v_domain);?></label></input><br />
-											<label><input type="radio" name="v-redirect" value="<?=$v_domain;?>" <?php if( $v_redirect == $v_domain) echo "checked";?> class="v-redirect-custom-value"><?=sprintf(_('Redirect visitors to %s'),$v_domain);?></label></input><br />
+											<label><input type="radio" name="v-redirect" value="<?='www.'.htmlentities($v_domain);?>" <?php if ($v_redirect == "www.".$v_domain) echo "checked"; ?> class="v-redirect-custom-value"><?=sprintf(_('Redirect visitors to %s'),"www.".htmlentities($v_domain));?></label></input><br />
+											<label><input type="radio" name="v-redirect" value="<?=htmlentities($v_domain);?>" <?php if( $v_redirect == $v_domain) echo "checked";?> class="v-redirect-custom-value"><?=sprintf(_('Redirect visitors to %s'),htmlentities($v_domain));?></label></input><br />
 											<label><input type="radio" name="v-redirect" value="custom" <?php if( !empty($v_redirect_custom)) echo "checked";?> class="v-redirect-custom-value"><?=_("Redirect visitors to a custom domain or web address");?></label></input>
 										</td>
 									</tr>
 									<tr>
 										<td>
@@ -255,11 +242,11 @@
 										<td>
 											<table id="ssl-details" style="<?php if ($v_letsencrypt == 'yes' || $v_letsencrypt == 'on') { echo 'display: none;'; } ?>">
 												<tr>
 													<td class="vst-text input-label step-top">
 														<?=_('SSL Certificate');?>
-														<span id="generate-csr"> / <a class="generate" target="_blank" href="/generate/ssl/?domain=<?=$v_domain?>"><?=_('Generate CSR');?></a></span>
+														<span id="generate-csr"> / <a class="generate" target="_blank" href="/generate/ssl/?domain=<?=htmlentities($v_domain)?>"><?=_('Generate CSR');?></a></span>
 													</td>
 												</tr>
 												<tr>
 													<td>
 														<textarea size="20" class="vst-textinput short console" name="v_ssl_crt" id="ssl_crt"><?=htmlentities(trim($v_ssl_crt, "'"))?></textarea>
@@ -501,13 +488,13 @@
 												<tr>
 													<td>
 														<input type="hidden" name="v-custom-doc-root_prepath" value="<?=$v_custom_doc_root_prepath;?>">
 														<select class="vst-list" name="v-custom-doc-domain">
 															<?php foreach ($user_domains as $domain): ?>
-															<option value="<?=$domain;?>"
+															<option value="<?=htmlentities($domain);?>"
 																<?=($v_custom_doc_domain === $domain || (empty($v_custom_doc_domain) && $domain === $v_domain))?' selected="selected" ':''; ?>>
-																<?=$domain;?>
+																<?=htmlentities($domain);?>
 															</option>
 															<?php endforeach; ?>
 														</select>
 													</td>
 												</tr>
diff --git a/web/templates/pages/generate_ssl.html b/web/templates/pages/generate_ssl.html
index 8260786bd..0d47112a2 100644
--- a/web/templates/pages/generate_ssl.html
+++ b/web/templates/pages/generate_ssl.html
@@ -1,22 +1,9 @@
 <div class="l-center">
 	<div class="l-sort clearfix">
 		<div class="l-sort-toolbar clearfix float-left">
-			<?php
-				if (!empty($_SESSION['error_msg'])) {
-					$msg_icon = 'fa-exclamation-circle status-icon red';
-					$msg_text = htmlentities($_SESSION['error_msg']);
-					$msg_id = 'vst-error';
-				} else {
-					if (!empty($_SESSION['ok_msg'])) {
-						$msg_icon = 'fa-check-circle status-icon green';
-						$msg_text = $_SESSION['ok_msg'];
-						$msg_id = 'vst-ok';
-					}
-				}
-			?>
-			<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+			<?php show_error_panel($_SESSION);?>
 		</div>
 	</div>
 </div>
 
 <div class="l-separator"></div>
diff --git a/web/templates/pages/list_backup_detail.html b/web/templates/pages/list_backup_detail.html
index f124fbf06..c906c8bbb 100644
--- a/web/templates/pages/list_backup_detail.html
+++ b/web/templates/pages/list_backup_detail.html
@@ -51,11 +51,11 @@
 		</div>
 	</div>
 
 	<!-- List web domains -->
 	<?php
-		$backup = $_GET['backup'];
+		$backup = htmlentities($_GET['backup']);
 		$web = explode(',',$data[$backup]['WEB']);
 		foreach ($web as $key) {
 			if (!empty($key)) {
 				++$i;
 		?>
@@ -181,11 +181,10 @@
 		</div>
 	<?php }} ?>
 
 	<!-- List Cron Jobs -->
 	<?php
-		$backup = $_GET['backup'];
 		if (!empty($data[$backup]['CRON'])) {
 			if (!empty($key)) {
 		?>
 		<div class="l-unit">
 			<div class="l-unit__col l-unit__col--right">
diff --git a/web/templates/pages/list_cron.html b/web/templates/pages/list_cron.html
index 22cdb12aa..5d51111c4 100644
--- a/web/templates/pages/list_cron.html
+++ b/web/templates/pages/list_cron.html
@@ -19,12 +19,12 @@
 			<table>
 				<tr>
 					<td class="sort-by" title="<?=_('Sort items');?>">
 						<?=_('sort by');?>: <span>
 							<b>
-								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Command'; } else { $label = 'Date'; } ?>
-								<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
+								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = _('Name'); } else { $label = _('Date'); } ?>
+								<?=$label;?> <i class="fas fa-sort-alpha-down"></i>
 							</b>
 						</span>
 					</td>
 					<td class="l-sort-toolbar__search-box">
 						<form action="/search/" method="get">
diff --git a/web/templates/pages/list_db.html b/web/templates/pages/list_db.html
index d3fcdab4d..0328a0317 100644
--- a/web/templates/pages/list_db.html
+++ b/web/templates/pages/list_db.html
@@ -38,12 +38,12 @@
 			<table>
 				<tr>
 					<td class="sort-by" title="<?=_('Sort items');?>">
 						<?=_('sort by');?>: <span>
 							<b>
-								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Name'; } else { $label = 'Date'; } ?>
-								<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
+								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = _('Name'); } else { $label = _('Date'); } ?>
+								<?=$label;?> <i class="fas fa-sort-alpha-down"></i>
 							</b>
 						</span>
 					</td>
 					<td class="l-sort-toolbar__search-box">
 						<form action="/search/" method="get">
diff --git a/web/templates/pages/list_dns.html b/web/templates/pages/list_dns.html
index 67a200cc5..8d1ff8103 100644
--- a/web/templates/pages/list_dns.html
+++ b/web/templates/pages/list_dns.html
@@ -18,12 +18,12 @@
 				<table>
 					<tr>
 						<td class="sort-by" title="<?=_('Sort items');?>">
 							<?=_('sort by');?>: <span>
 								<b>
-									<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Name'; } else { $label = 'Date'; } ?>
-									<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
+									<?php if ($_SESSION['userSortOrder'] === 'name') { $label = _('Name'); } else { $label = _('Date'); } ?>
+									<?=$label;?> <i class="fas fa-sort-alpha-down"></i>
 								</b>
 							</span>
 						</td>
 						<td class="l-sort-toolbar__search-box">
 							<form action="/search/" method="get">
diff --git a/web/templates/pages/list_dns_rec.html b/web/templates/pages/list_dns_rec.html
index 2b9f4a6b6..bd698b3e3 100644
--- a/web/templates/pages/list_dns_rec.html
+++ b/web/templates/pages/list_dns_rec.html
@@ -19,12 +19,12 @@
 			<table>
 				<tr>
 					<td class="sort-by" title="<?=_('Sort items');?>">
 						<?=_('sort by');?>: <span>
 							<b>
-								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Record'; } else { $label = 'Date'; } ?>
-								<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
+								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = _('Record'); } else { $label = _('Date'); } ?>
+								<?=$label;?> <i class="fas fa-sort-alpha-down"></i>
 							</b>
 						</span>
 					</td>
 					<td class="l-sort-toolbar__search-box">
 						<form action="/search/" method="get">
diff --git a/web/templates/pages/list_mail.html b/web/templates/pages/list_mail.html
index 7862f5512..a15860e1a 100644
--- a/web/templates/pages/list_mail.html
+++ b/web/templates/pages/list_mail.html
@@ -16,12 +16,12 @@
 			<table>
 				<tr>
 					<td class="sort-by" title="<?=_('Sort items');?>">
 						<?=_('sort by');?>: <span>
 							<b>
-								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Name'; } else { $label = 'Date'; } ?>
-								<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
+								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = _('Name'); } else { $label = _('Date'); } ?>
+								<?=$label;?> <i class="fas fa-sort-alpha-down"></i>
 							</b>
 						</span>
 					</td>
 					<td class="l-sort-toolbar__search-box">
 						<form action="/search/" method="get">
diff --git a/web/templates/pages/list_mail_acc.html b/web/templates/pages/list_mail_acc.html
index e8bdcafb3..448e56366 100644
--- a/web/templates/pages/list_mail_acc.html
+++ b/web/templates/pages/list_mail_acc.html
@@ -22,12 +22,12 @@
 			<table>
 				<tr>
 					<td class="sort-by" title="<?=_('Sort items');?>">
 						<?=_('sort by');?>: <span>
 							<b>
-								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Name'; } else { $label = 'Date'; } ?>
-								<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
+								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = _('Name'); } else { $label = _('Date'); } ?>
+								<?=$label;?> <i class="fas fa-sort-alpha-down"></i>
 							</b>
 						</span>
 					</td>
 					<td class="l-sort-toolbar__search-box">
 						<form action="/search/" method="get">
@@ -125,22 +125,22 @@
 					$autoreply_icon = 'fa-check-circle status-icon green';
 				}
 			}
 		?>
 		<div class="l-unit <?php if ($status == 'suspended') echo 'l-unit--suspended'; if($_SESSION['favourites']['MAIL_ACC'][$key." @".$_GET['domain']]==1) echo ' l-unit--starred' ; ?> animated fadeIn"
-			v_unit_id="<?=$key."@".$_GET['domain']?>" v_section="mail_acc" sort-date="<?=strtotime($data[$key]['DATE'].' '.$data[$key]['TIME'])?>" sort-name="<?=$key?>" sort-disk="<?=$data[$key]['U_DISK']?>"
+			v_unit_id="<?=$key."@".htmlentities($_GET['domain']);?>" v_section="mail_acc" sort-date="<?=strtotime($data[$key]['DATE'].' '.$data[$key]['TIME'])?>" sort-name="<?=$key?>" sort-disk="<?=$data[$key]['U_DISK']?>"
 			sort-quota="<?=$data[$key]['QUOTA']?>" sort-star="
 			<?php if ($_SESSION['favourites']['MAIL_ACC'][$key."@".$_GET['domain']] == 1) echo '1'; else echo '0'; ?>">
 			<div class="l-unit__col l-unit__col--right">
 				<div class="clearfix l-unit__stat-col--left super-compact">
 					<input id="check<?=$i ?>" class="ch-toggle" type="checkbox" title="<?=_('Select');?>" name="account[]" value="<?=$key?>" <?=$display_mode;?>>
 				</div>
 				<div class="clearfix l-unit__stat-col--left wide-3 truncate">
 					<?php if (($read_only === 'true') || ($data[$key]['SUSPENDED'] == 'yes')) { ?>
-						<b><?=$key."@".$_GET['domain']?></b>
+						<b><?=$key."@".htmlentities($_GET['domain']);?></b>
 					<?php } else { ?>
-						<b><a href="/edit/mail/?domain=<?=htmlspecialchars($_GET['domain'])?>&account=<?=$key?>&token=<?=$_SESSION['token']?>" title="<?=_('Editing Mail Account');?>: <?=$key?>@<?=htmlspecialchars($_GET['domain'])?>"><?=$key."@".$_GET['domain']?></a></b>
+						<b><a href="/edit/mail/?domain=<?=htmlspecialchars($_GET['domain'])?>&account=<?=$key?>&token=<?=$_SESSION['token']?>" title="<?=_('Editing Mail Account');?>: <?=$key?>@<?=htmlspecialchars($_GET['domain'])?>"><?=$key."@".htmlentities($_GET['domain']);?></a></b>
 					<?php } ?>
 				</div>
 				<!-- START QUICK ACTION TOOLBAR AREA -->
 				<div class="clearfix l-unit__stat-col--left text-right compact-4">
 					<div class="l-unit-toolbar__col l-unit-toolbar__col--right noselect">
diff --git a/web/templates/pages/list_packages.html b/web/templates/pages/list_packages.html
index 68d382a47..56698380d 100644
--- a/web/templates/pages/list_packages.html
+++ b/web/templates/pages/list_packages.html
@@ -13,14 +13,15 @@
 			<table>
 				<tr>
 					<td class="sort-by" title="<?=_('Sort items');?>">
 						<?=_('sort by');?>: <span>
 							<b>
-								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Name'; } else { $label = 'Date'; } ?>
-								<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
+								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = _('Name'); } else { $label = _('Date'); } ?>
+								<?=$label;?> <i class="fas fa-sort-alpha-down"></i>
 							</b>
 						</span>
+					</td>
 					<td>
 						<form action="/bulk/package/" method="post" id="objects">
 							<input type="hidden" name="token" value="<?=$_SESSION['token']?>" />
 							<div class="l-select">
 								<select class="" name="action">
diff --git a/web/templates/pages/list_ssl.html b/web/templates/pages/list_ssl.html
index 0e105c78a..e4f1a735b 100644
--- a/web/templates/pages/list_ssl.html
+++ b/web/templates/pages/list_ssl.html
@@ -30,49 +30,36 @@
 							<td class="step-top">
 								<span class="page-title"><?=_('Generating CSR');?></span>
 							</td>
 						<tr>
 							<td>
-								<?php
-									if (!empty($_SESSION['error_msg'])) {
-										$msg_icon = 'fa-exclamation-circle status-icon red';
-										$msg_text = htmlentities($_SESSION['error_msg']);
-										$msg_id = 'vst-error';
-									} else {
-										if (!empty($_SESSION['ok_msg'])) {
-											$msg_icon = 'fa-check-circle status-icon green';
-											$msg_text = $_SESSION['ok_msg'];
-											$msg_id = 'vst-ok';
-										}
-									}
-								?>
-								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
+								<?php show_error_panel($_SESSION);?>
 							</td>
 						</tr>
 						</tr>
 						<tr>
-							<td class="vst-text" style="padding: 12px 0 0 0;"><?=_('SSL Certificate');?> <a href="javascript:saveTextToBlob('<?php echo $v_domain;?>.crt', 'v_crt');"><i class="fas fa-download"></i></a>
+							<td class="vst-text" style="padding: 12px 0 0 0;"><?=_('SSL Certificate');?> <a href="javascript:saveTextToBlob('<?php echo htmlentities($v_domain);?>.crt', 'v_crt');"><i class="fas fa-download"></i></a>
 							</td>
 						</tr>
 						<tr>
 							<td>
 								<textarea size="20" class="vst-textinput" name="v_crt" id="v_crt"><?=$v_crt ?> </textarea>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text" style="padding: 12px 0 0 0;">
-								<?=_('SSL Key');?> <a href="javascript:saveTextToBlob('<?php echo $v_domain;?>.key', 'v_key');"><i class="fas fa-download"></i></a>
+								<?=_('SSL Key');?> <a href="javascript:saveTextToBlob('<?php echo htmlentities($v_domain);?>.key', 'v_key');"><i class="fas fa-download"></i></a>
 							</td>
 						</tr>
 						<tr>
 							<td>
 								<textarea size="20" class="vst-textinput" name="v_key" id="v_key"><?=$v_key ?> </textarea>
 							</td>
 						</tr>
 						<tr>
 							<td class="vst-text" style="padding: 24px 0 0 0;">
-								<?=_('SSL CSR');?> <a href="javascript:saveTextToBlob('<?php echo $v_domain;?>.csr', 'v_crt');"><i class="fas fa-download"></i></a>
+								<?=_('SSL CSR');?> <a href="javascript:saveTextToBlob('<?php echo htmlentities($v_domain);?>.csr', 'v_crt');"><i class="fas fa-download"></i></a>
 							</td>
 						</tr>
 						<tr>
 							<td>
 								<textarea size="20" class="vst-textinput" name="v_csr" id="v_csr"><?=$v_csr ?> </textarea>
diff --git a/web/templates/pages/list_user.html b/web/templates/pages/list_user.html
index ef674db4a..c3a248773 100644
--- a/web/templates/pages/list_user.html
+++ b/web/templates/pages/list_user.html
@@ -15,12 +15,12 @@
 			<table>
 				<tr>
 					<td class="sort-by" title="<?=_('Sort items');?>">
 						<?=_('sort by');?>: <span>
 							<b>
-								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Name'; } else { $label = 'Date'; } ?>
-								<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
+								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = _('Name'); } else { $label = _('Date'); } ?>
+								<?=$label;?> <i class="fas fa-sort-alpha-down"></i>
 							</b>
 						</span>
 					</td>
 					<td class="l-sort-toolbar__search-box">
 						<form action="/search/" method="get">
diff --git a/web/templates/pages/list_web.html b/web/templates/pages/list_web.html
index b47910548..d41886827 100644
--- a/web/templates/pages/list_web.html
+++ b/web/templates/pages/list_web.html
@@ -17,12 +17,12 @@
 			<table>
 				<tr>
 					<td class="sort-by" title="<?=_('Sort items');?>">
 						<?=_('sort by');?>: <span>
 							<b>
-								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Name'; } else { $label = 'Date'; } ?>
-								<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
+								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = ('Name'); } else { $label = _('Date'); } ?>
+								<?=$label?> <i class="fas fa-sort-alpha-down"></i>
 							</b>
 						</span>
 					</td>
 					<td class="l-sort-toolbar__search-box">
 						<form action="/search/" method="get">
diff --git a/web/templates/pages/list_webapps.html b/web/templates/pages/list_webapps.html
index ccacb6085..c347495d7 100644
--- a/web/templates/pages/list_webapps.html
+++ b/web/templates/pages/list_webapps.html
@@ -1,10 +1,10 @@
 <!-- Begin toolbar -->
 <div class="l-center edit">
 	<div class="l-sort clearfix">
 		<div class="l-unit-toolbar__buttonstrip">
-			<a class="ui-button cancel" dir="ltr" id="btn-back" href="/edit/web/?domain=<?=$v_domain?>"><i class="fas fa-arrow-left status-icon blue"></i><?=_('Back');?></a>
+			<a class="ui-button cancel" dir="ltr" id="btn-back" href="/edit/web/?domain=<?=htmlentities($v_domain)?>"><i class="fas fa-arrow-left status-icon blue"></i><?=_('Back');?></a>
 		</div>
 		<div class="l-unit-toolbar__buttonstrip float-right">
 		</div>
 	</div>
 </div>
@@ -43,11 +43,11 @@
 			<div class="card <?=($webapp['enabled']?'':'disable');?>">
 				<span class="card-thumb"><img src="/src/app/WebApp/Installers/<?=$webapp['name'];?>/<?=$webapp['thumbnail'];?>"></span>
 				<div class="card-details">
 					<p class="card-title"><?=$webapp['name'];?></p>
 					<p><?=_('version');?>: <?=$webapp['version'];?></p>
-					<a href="/add/webapp/?app=<?=$webapp['name'];?>&domain=<?=$v_domain?>" class="ui-button cancel" dir="ltr"><?=_('Setup');?></a>
+					<a href="/add/webapp/?app=<?=$webapp['name'];?>&domain=<?=htmlentities($v_domain)?>" class="ui-button cancel" dir="ltr"><?=_('Setup');?></a>
 				</div>
 			</div>
 		<?php endforeach; ?>
 	</div>
 </div>
\ No newline at end of file
diff --git a/web/templates/pages/list_weblog.html b/web/templates/pages/list_weblog.html
index cb8b33e07..5dd0093c0 100644
--- a/web/templates/pages/list_weblog.html
+++ b/web/templates/pages/list_weblog.html
@@ -29,11 +29,11 @@
 				<div class="l-menu__item <?php if($_GET['type'] == 'access') echo 'l-menu__item--active' ?>"><a href="/list/web-log/?domain=<?=htmlentities($_GET['domain'])?>&type=access&token=<?=$_SESSION['token']?>"><i class="fas fa-eye"></i>&nbsp;&nbsp;&nbsp;<?=_('Access Log');?></a><a href="/download/web-log/?domain=<?=htmlentities($_GET['domain'])?>&type=access&&token=<?=$_SESSION['token']?>" title="<?=_('Download');?>"><i class="fas fa-download"></i></a></div>
 				<div class="l-menu__item <?php if($_GET['type'] == 'error') echo 'l-menu__item--active' ?>"><a href="/list/web-log/?domain=<?=htmlentities($_GET['domain'])?>&type=error&token=<?=$_SESSION['token']?>"><i class="fas fa-exclamation-circle"></i>&nbsp;&nbsp;&nbsp;<?=_('Error Log');?></a><a href="/download/web-log/?domain=<?=htmlentities($_GET['domain'])?>&type=error&token=<?=$_SESSION['token']?>" title="<?=_('Download');?>"><i class="fas fa-download"></i></a></div>
 			</div>
 			<div class="l-profile">
 				<div class="l-menu__item"><a href="javascript:location.reload();" title="<?=_('Refresh');?>"><i class="fas fa-redo"></i></a></div>
-				<div class="l-menu__item"><a href="/edit/user/?user=<?=$user; ?>" title="<?=$user?>" class="l-profile__username"><i class="fas fa-user-circle"></i></a></div>
+				<div class="l-menu__item"><a href="/edit/user/?user=<?=htmlentities($user); ?>" title="<?=htmlentities($user)?>" class="l-profile__username"><i class="fas fa-user-circle"></i></a></div>
 				<div class="l-menu__item"><a href="/logout/?token=<?=$_SESSION['token']?>" title="<?=_('Log out');?>" class="l-profile__logout"><i class="fas fa-sign-out-alt"></i></a></div>
 			</div>
 		</div>
 	</div>
 
diff --git a/web/templates/pages/login/reset_2.html b/web/templates/pages/login/reset_2.html
index d05aed255..2c680d5f5 100644
--- a/web/templates/pages/login/reset_2.html
+++ b/web/templates/pages/login/reset_2.html
@@ -24,12 +24,12 @@
 										<td style="padding: 12px 0 0 2px;" colspan=2><?=_('Reset Code');?></td>
 									</tr>
 									<tr>
 										<td>
 											<input type="hidden" name="action" value="confirm">
-											<input type="hidden" name="token" value="<?=$_SESSION['token'];?>"/>
-											<input type="hidden" name="user" value="<?=htmlentities($_GET['user'], ENT_QUOTES|ENT_HTML5)?>">
+											<input type="hidden" name="token" value="<?=htmlentities($_SESSION['token']);?>"/>
+											<input type="hidden" name="user" value="<?=htmlentities($_GET['user'])?>">
 											<input tabindex="1" type="text" size="20px" style="width:240px" name="code" class="vst-input">
 										</td>
 									</tr>
 									<tr>
 										<td style="padding: 20px 0 12px 0;">
diff --git a/web/templates/pages/login/reset_3.html b/web/templates/pages/login/reset_3.html
index b5950c0ae..89533fb85 100644
--- a/web/templates/pages/login/reset_3.html
+++ b/web/templates/pages/login/reset_3.html
@@ -16,13 +16,13 @@
 										</td>
 									</tr>
 									<tr>
 										<td style="padding: 12px 0 0 2px;">
 											<input type="hidden" name="action" value="confirm">
-											<input type="hidden" name="token" value="<?=$_SESSION['token'];?>"/>
-											<input type="hidden" name="user" value="<?=htmlentities($_GET['user'], ENT_QUOTES|ENT_HTML5)?>">
-											<input type="hidden" name="code" value="<?=htmlentities($_GET['code'], ENT_QUOTES|ENT_HTML5)?>">
+											<input type="hidden" name="token" value="<?=htmlentities($_SESSION['token']);?>"/>
+											<input type="hidden" name="user" value="<?=htmlentities($_GET['user']);?>">
+											<input type="hidden" name="code" value="<?=htmlentities($_GET['code']);?>">
 											<?=_('New Password');?>
 										</td>
 									</tr>
 									<tr>
 										<td>
diff --git a/web/templates/pages/setup_webapp.html b/web/templates/pages/setup_webapp.html
index 493196bc2..a1ff7e128 100644
--- a/web/templates/pages/setup_webapp.html
+++ b/web/templates/pages/setup_webapp.html
@@ -1,10 +1,10 @@
 <!-- Begin toolbar -->
 <div class="l-center edit">
 	<div class="l-sort clearfix">
 		<div class="l-unit-toolbar__buttonstrip">
-			<a class="ui-button cancel" dir="ltr" id="btn-back" href="/add/webapp/?domain=<?=$v_domain?>"><i class="fas fa-arrow-left status-icon blue"></i><?=_('Back');?></a>
+			<a class="ui-button cancel" dir="ltr" id="btn-back" href="/add/webapp/?domain=<?=htmlentities($v_domain);?>"><i class="fas fa-arrow-left status-icon blue"></i><?=_('Back');?></a>
 		</div>
 		<div class="l-unit-toolbar__buttonstrip float-right">
 			<?php
 				if (!empty($_SESSION['error_msg'])) {
 					echo "<span class=\"vst-error\"> → ".htmlentities($_SESSION['error_msg'])."</span>";
@@ -54,10 +54,11 @@
 								$f_placeholder = (!empty($form_control['placeholder']))?$form_control['placeholder']:'';
 						}
 
 						$f_value = htmlentities($f_value);
 						$f_label = htmlentities($f_label);
+						$f_name = htmlentities($f_name);
 						$f_placeholder = htmlentities($f_placeholder);
 					?>
 					<div class="form-group">
 						<label style="padding-bottom: 2px;" for="<?=$f_name?>"><?=$f_label?>
 							<?php if ($f_type === 'password'):?> / <a href="javascript:randomString('<?=$f_name?>');" class="generate"><?=_('generate');?></a> <?php endif?>
diff --git a/web/unsuspend/cron/index.php b/web/unsuspend/cron/index.php
index accbd8603..e984cea81 100644
--- a/web/unsuspend/cron/index.php
+++ b/web/unsuspend/cron/index.php
@@ -7,13 +7,12 @@ include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 
 // Check token
 verify_csrf($_GET);
 
 if (!empty($_GET['job'])) {
-    $v_username = escapeshellarg($user);
     $v_job = escapeshellarg($_GET['job']);
-    exec(HESTIA_CMD."v-unsuspend-cron-job ".$v_username." ".$v_job, $output, $return_var);
+    exec(HESTIA_CMD."v-unsuspend-cron-job ".$user." ".$v_job, $output, $return_var);
     check_return_code($return_var, $output);
     unset($output);
 }
 
 $back=getenv("HTTP_REFERER");
diff --git a/web/unsuspend/db/index.php b/web/unsuspend/db/index.php
index a111cc4bf..32de99aab 100644
--- a/web/unsuspend/db/index.php
+++ b/web/unsuspend/db/index.php
@@ -7,13 +7,12 @@ include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 
 // Check token
 verify_csrf($_GET);
 
 if (!empty($_GET['database'])) {
-    $v_username = escapeshellarg($user);
     $v_database = escapeshellarg($_GET['database']);
-    exec(HESTIA_CMD."v-unsuspend-database ".$v_username." ".$v_database, $output, $return_var);
+    exec(HESTIA_CMD."v-unsuspend-database ".$user." ".$v_database, $output, $return_var);
     check_return_code($return_var, $output);
     unset($output);
 }
 
 $back=getenv("HTTP_REFERER");
diff --git a/web/unsuspend/dns/index.php b/web/unsuspend/dns/index.php
index e89703507..9fdebf52b 100644
--- a/web/unsuspend/dns/index.php
+++ b/web/unsuspend/dns/index.php
@@ -7,13 +7,12 @@ include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 // Check token
 verify_csrf($_GET);
 
 // DNS domain
 if ((!empty($_GET['domain'])) && (empty($_GET['record_id']))) {
-    $v_username = escapeshellarg($user);
     $v_domain = escapeshellarg($_GET['domain']);
-    exec(HESTIA_CMD."v-unsuspend-dns-domain ".$v_username." ".$v_domain, $output, $return_var);
+    exec(HESTIA_CMD."v-unsuspend-dns-domain ".$user." ".$v_domain, $output, $return_var);
     if ($return_var != 0) {
         $error = implode('<br>', $output);
         if (empty($error)) {
             $error = _('Error: Hestia did not return any output.');
         }
@@ -29,14 +28,13 @@ if ((!empty($_GET['domain'])) && (empty($_GET['record_id']))) {
     exit;
 }
 
 // DNS record
 if ((!empty($_GET['domain'])) && (!empty($_GET['record_id']))) {
-    $v_username = escapeshellarg($user);
     $v_domain = escapeshellarg($_GET['domain']);
     $v_record_id = escapeshellarg($_GET['record_id']);
-    exec(HESTIA_CMD."v-unsuspend-dns-record ".$v_username." ".$v_domain." ".$v_record_id, $output, $return_var);
+    exec(HESTIA_CMD."v-unsuspend-dns-record ".$user." ".$v_domain." ".$v_record_id, $output, $return_var);
     if ($return_var != 0) {
         $error = implode('<br>', $output);
         if (empty($error)) {
             $error = _('Error: Hestia did not return any output.');
         }
diff --git a/web/unsuspend/mail/index.php b/web/unsuspend/mail/index.php
index 3bad8b47b..c1873ef51 100644
--- a/web/unsuspend/mail/index.php
+++ b/web/unsuspend/mail/index.php
@@ -7,13 +7,12 @@ include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 // Check token
 verify_csrf($_GET);
 
 // Mail domain
 if ((!empty($_GET['domain'])) && (empty($_GET['account']))) {
-    $v_username = escapeshellarg($user);
     $v_domain = escapeshellarg($_GET['domain']);
-    exec(HESTIA_CMD."v-unsuspend-mail-domain ".$v_username." ".$v_domain, $output, $return_var);
+    exec(HESTIA_CMD."v-unsuspend-mail-domain ".$user." ".$v_domain, $output, $return_var);
     if ($return_var != 0) {
         $error = implode('<br>', $output);
         if (empty($error)) {
             $error = _('Error: Hestia did not return any output.');
         }
@@ -32,11 +31,11 @@ if ((!empty($_GET['domain'])) && (empty($_GET['account']))) {
 // Mail account
 if ((!empty($_GET['domain'])) && (!empty($_GET['account']))) {
     $v_username = escapeshellarg($user);
     $v_domain = escapeshellarg($_GET['domain']);
     $v_account = escapeshellarg($_GET['account']);
-    exec(HESTIA_CMD."v-unsuspend-mail-account ".$v_username." ".$v_domain." ".$v_account, $output, $return_var);
+    exec(HESTIA_CMD."v-unsuspend-mail-account ".$user." ".$v_domain." ".$v_account, $output, $return_var);
     if ($return_var != 0) {
         $error = implode('<br>', $output);
         if (empty($error)) {
             $error = _('Error: Hestia did not return any output.');
         }
diff --git a/web/unsuspend/web/index.php b/web/unsuspend/web/index.php
index 94d40c78e..70140cb6c 100644
--- a/web/unsuspend/web/index.php
+++ b/web/unsuspend/web/index.php
@@ -6,13 +6,12 @@ include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 
 // Check token
 verify_csrf($_GET);
 
 if (!empty($_GET['domain'])) {
-    $v_username = escapeshellarg($user);
     $v_domain = escapeshellarg($_GET['domain']);
-    exec(HESTIA_CMD."v-unsuspend-domain ".$v_username." ".$v_domain, $output, $return_var);
+    exec(HESTIA_CMD."v-unsuspend-domain ".$user." ".$v_domain, $output, $return_var);
     check_return_code($return_var, $output);
     unset($output);
 }
 
 

Vulnerable code:                 $time = $_GET['exp'];
    $user=$_GET['user'];
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-delete-user-backup-exclusions ".$v_username." ".$v_system, $output, $return_var);
    $user=$_GET['user'];
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-delete-user-backup ".$v_username." ".$v_backup, $output, $return_var);
    $user=$_GET['user'];
    exec(HESTIA_CMD."v-delete-cron-job ".$v_username." ".$v_job, $output, $return_var);
    $user=$_GET['user'];
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-delete-database ".$v_username." ".$v_database, $output, $return_var);
    $user=$_GET['user'];
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-delete-dns-domain ".$v_username." ".$v_domain, $output, $return_var);
    header("Location: /list/dns/?domain=".$_GET['domain']);
    exit;
    $user = $_GET['user'];
    $v_user = escapeshellarg(trim($user));
    exec(HESTIA_CMD."v-delete-user-ssh-key ".$v_user." ".$v_key);
    $user=$_GET['user'];
$v_username = escapeshellarg($user);
exec(HESTIA_CMD."v-delete-user-auth-log ".$v_username, $output, $return_var);
    exec(HESTIA_CMD."v-log-user-login ".$v_username." ".$v_ip." success ".$v_session_id." ".$v_user_agent, $output, $return_var);
    $user=$_GET['user'];
// Set correct page reload target
if (($_SESSION['userContext'] === "admin") && (!empty($_GET['user']))) {
    header("Location: /list/log/?user=$user&token=$token");
} else {
    header("Location: /list/log/");
}

$v_username = escapeshellarg($user);
exec(HESTIA_CMD."v-delete-user-log ".$v_username." ".$output, $return_var);
    $user=$_GET['user'];
    exec(HESTIA_CMD."v-delete-mail-domain ".$v_username." ".$v_domain, $output, $return_var);
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-delete-mail-account ".$v_username." ".$v_domain." ".$v_account, $output, $return_var);
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-delete-user-notification ".$v_username." ".$v_id, $output, $return_var);
    exec(HESTIA_CMD."v-acknowledge-user-notification ".$v_username." ".$v_id, $output, $return_var);
    $user=$_GET['user'];
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-purge-nginx-cache ".$v_username." ".$v_domain, $output, $return_var);
    $user = $_GET['user'];
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD . 'v-delete-web-domain ' . $v_username . ' ' . $v_domain . " 'yes'", $output, $return_var);
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-schedule-user-backup-download ".$v_username." ".$backup, $output, $return_var);
check_return_code($return_var, $output);
check_return_code($return_var, $output);
    check_return_code($return_var, $output);
    check_return_code($return_var, $output);

check_return_code($return_var, $output);
check_return_code($return_var, $output);
    if ($_SESSION['userContext'] !== 'admin') {
        if (!in_array($v_domain, $user_domains)) {
            header("Location: /list/mail/");
            exit;
        }
    }
    if ($_SESSION['userContext'] !== 'admin') {
        if (!in_array($v_domain, $user_domains)) {
            header("Location: /list/mail/");
            exit;
        }
    }
check_return_code($return_var, $output);
exec(HESTIA_CMD."v-list-web-domains ".escapeshellarg($user)." json", $output, $return_var);
// List domain
if ($_SESSION['userContext'] !== 'admin') {
    if (!in_array($v_domain, $user_domains)) {
        header("Location: /list/mail/");
        exit;
    }
}

    $user = $_SESSION['user'];
    $user = $_SESSION['look'];
        echo '<span style="font-size: 18px;"><b>ERROR: Unable to retrieve account details.</b><br>Please <b><a href="/login/">log in</a></b> again.</span>';
        $_SESSION['error_msg'] = 'You have been logged out. Please log in again.';
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-suspend-cron-job ".$v_username." ".$v_job, $output, $return_var);
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-suspend-database ".$v_username." ".$v_database, $output, $return_var);
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-suspend-dns-domain ".$v_username." ".$v_domain, $output, $return_var);
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-suspend-dns-record ".$v_username." ".$v_domain." ".$v_record_id, $output, $return_var);
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-suspend-mail-domain ".$v_username." ".$v_domain, $output, $return_var);
    exec(HESTIA_CMD."v-suspend-mail-account ".$v_username." ".$v_domain." ".$v_account, $output, $return_var);
    $v_username = escapeshellarg($_GET['user']);
    exec(HESTIA_CMD."v-suspend-user ".$v_username, $output, $return_var);
    exec(HESTIA_CMD."v-suspend-web-domain ".$v_username." ".$v_domain, $output, $return_var);
<title><?=$_SERVER['HTTP_HOST']; ?> - <?=_($TAB)?> - <?=_('Hestia Control Panel');?></title>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
										<option v_type="hostname" domain="<?=$v_domain?>"><?=_('Use domain hostname');?></option>
									<div id="td_imap_hostname">mail.<?=$v_domain?></div>
									<div id="td_smtp_hostname">mail.<?=$v_domain?></div>
										<div><a class="vst" href="http://<?=$v_webmail_alias?>" target="_blank">http://<?=$v_webmail_alias?> <i></i></a></div>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
											<input type="hidden" name="v-custom-doc-root_prepath" value="<?=$v_custom_doc_root_prepath;?>">
													<option value="<?=$domain;?>" selected="selected"><?=$domain;?></option>
													<option value="<?=$domain;?>"><?=$domain;?></option>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
												<?=_("To enable Let's Encrypt SSL, ensure that DNS records exist for mail.$v_domain and $v_webmail_alias!")?><br />
														<span id="generate-csr"> / <a class="generate" target="_blank" href="/generate/ssl/?domain=<?=$v_domain?>"><?=_('Generate CSR');?></a></span>
																	<?=$v_ssl_subject?>
																		<?=$v_ssl_aliases?>
																	<?=$v_ssl_not_before?>
																	<?=$v_ssl_not_after?>
																	<?=$v_ssl_signature?>
																	<?=$v_ssl_pub_key?>
																	<?=$v_ssl_issuer?>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
									<div id="td_imap_hostname">mail.<?=$v_domain?></div>
									<div id="td_smtp_hostname">mail.<?=$v_domain?></div>
										<div><a class="vst" href="http://<?=$v_webmail_alias?>" target="_blank">http://<?=$v_webmail_alias?> <i></i></a></div>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<br><br>

								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
					$ssh_key_url = "/list/key/?user=".$user."&token=".$_SESSION['token']."";
					$log_url = "/list/log/?user=".$user."&token=".$_SESSION['token']."";
				<a href="/login/?loginas=<?=$v_username?>&token=<?=$_SESSION['token']?>" id="btn-create" class="ui-button cancel" dir="ltr" title="<?=_('login as');?>"><i class="fas fa-sign-in-alt status-icon maroon"></i><?=_('login as');?></a>
						<input type="hidden" name="delete_url" value="/delete/user/?user=<?=$v_username?>&token=<?=$_SESSION['token']?>" />
							<p class="confirmation"><?=sprintf(_('DELETE_USER_CONFIRMATION'),$v_username)?></p>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
											<div><img class="qr-code" src="<?=$v_qrcode; ?>"></div>
			<a href="/delete/web/cache/?domain=<?=$v_domain;?>&token=<?=$_SESSION['token'];?>" class="ui-button cancel <?php if ( $v_nginx_cache == 'yes' || ($v_proxy_template == 'caching' && $_SESSION['PROXY_SYSTEM'] == 'nginx')) { echo "block"; } else{ echo "hidden"; }?>" id="v-clear-cache">
				<a href="/add/webapp/?domain=<?=$v_domain?>" class="ui-button cancel" dir="ltr">
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
											<label><input type="radio" name="v-redirect" value="<?='www.'.$v_domain;?>" <?php if ($v_redirect == "www.".$v_domain) echo "checked"; ?> class="v-redirect-custom-value"><?=sprintf(_('Redirect visitors to %s'),"www.".$v_domain);?></label></input><br />
											<label><input type="radio" name="v-redirect" value="<?=$v_domain;?>" <?php if( $v_redirect == $v_domain) echo "checked";?> class="v-redirect-custom-value"><?=sprintf(_('Redirect visitors to %s'),$v_domain);?></label></input><br />
														<span id="generate-csr"> / <a class="generate" target="_blank" href="/generate/ssl/?domain=<?=$v_domain?>"><?=_('Generate CSR');?></a></span>
															<option value="<?=$domain;?>"
																<?=$domain;?>
			<?php
				if (!empty($_SESSION['error_msg'])) {
					$msg_icon = 'fa-exclamation-circle status-icon red';
					$msg_text = htmlentities($_SESSION['error_msg']);
					$msg_id = 'vst-error';
				} else {
					if (!empty($_SESSION['ok_msg'])) {
						$msg_icon = 'fa-check-circle status-icon green';
						$msg_text = $_SESSION['ok_msg'];
						$msg_id = 'vst-ok';
					}
				}
			?>
			<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
		$backup = $_GET['backup'];
		$backup = $_GET['backup'];
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Command'; } else { $label = 'Date'; } ?>
								<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Name'; } else { $label = 'Date'; } ?>
								<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
									<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Name'; } else { $label = 'Date'; } ?>
									<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Record'; } else { $label = 'Date'; } ?>
								<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Name'; } else { $label = 'Date'; } ?>
								<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Name'; } else { $label = 'Date'; } ?>
								<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
			v_unit_id="<?=$key."@".$_GET['domain']?>" v_section="mail_acc" sort-date="<?=strtotime($data[$key]['DATE'].' '.$data[$key]['TIME'])?>" sort-name="<?=$key?>" sort-disk="<?=$data[$key]['U_DISK']?>"
						<b><?=$key."@".$_GET['domain']?></b>
						<b><a href="/edit/mail/?domain=<?=htmlspecialchars($_GET['domain'])?>&account=<?=$key?>&token=<?=$_SESSION['token']?>" title="<?=_('Editing Mail Account');?>: <?=$key?>@<?=htmlspecialchars($_GET['domain'])?>"><?=$key."@".$_GET['domain']?></a></b>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Name'; } else { $label = 'Date'; } ?>
								<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
							<td class="vst-text" style="padding: 12px 0 0 0;"><?=_('SSL Certificate');?> <a href="javascript:saveTextToBlob('<?php echo $v_domain;?>.crt', 'v_crt');"><i class="fas fa-download"></i></a>
								<?=_('SSL Key');?> <a href="javascript:saveTextToBlob('<?php echo $v_domain;?>.key', 'v_key');"><i class="fas fa-download"></i></a>
								<?=_('SSL CSR');?> <a href="javascript:saveTextToBlob('<?php echo $v_domain;?>.csr', 'v_crt');"><i class="fas fa-download"></i></a>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Name'; } else { $label = 'Date'; } ?>
								<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Name'; } else { $label = 'Date'; } ?>
								<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
			<a class="ui-button cancel" dir="ltr" id="btn-back" href="/edit/web/?domain=<?=$v_domain?>"><i class="fas fa-arrow-left status-icon blue"></i><?=_('Back');?></a>
					<a href="/add/webapp/?app=<?=$webapp['name'];?>&domain=<?=$v_domain?>" class="ui-button cancel" dir="ltr"><?=_('Setup');?></a>
				<div class="l-menu__item"><a href="/edit/user/?user=<?=$user; ?>" title="<?=$user?>" class="l-profile__username"><i class="fas fa-user-circle"></i></a></div>
											<input type="hidden" name="token" value="<?=$_SESSION['token'];?>"/>
											<input type="hidden" name="user" value="<?=htmlentities($_GET['user'], ENT_QUOTES|ENT_HTML5)?>">
											<input type="hidden" name="token" value="<?=$_SESSION['token'];?>"/>
											<input type="hidden" name="user" value="<?=htmlentities($_GET['user'], ENT_QUOTES|ENT_HTML5)?>">
											<input type="hidden" name="code" value="<?=htmlentities($_GET['code'], ENT_QUOTES|ENT_HTML5)?>">
			<a class="ui-button cancel" dir="ltr" id="btn-back" href="/add/webapp/?domain=<?=$v_domain?>"><i class="fas fa-arrow-left status-icon blue"></i><?=_('Back');?></a>
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-unsuspend-cron-job ".$v_username." ".$v_job, $output, $return_var);
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-unsuspend-database ".$v_username." ".$v_database, $output, $return_var);
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-unsuspend-dns-domain ".$v_username." ".$v_domain, $output, $return_var);
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-unsuspend-dns-record ".$v_username." ".$v_domain." ".$v_record_id, $output, $return_var);
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-unsuspend-mail-domain ".$v_username." ".$v_domain, $output, $return_var);
    exec(HESTIA_CMD."v-unsuspend-mail-account ".$v_username." ".$v_domain." ".$v_account, $output, $return_var);
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-unsuspend-domain ".$v_username." ".$v_domain, $output, $return_var);
Fixed code:                 if(is_numeric($_GET['exp'])){
                    $time = $_GET['exp'];
                }else{
                    $time = 0; 
                }
    $user=escapeshellarg($_GET['user']);
    exec(HESTIA_CMD."v-delete-user-backup-exclusions ".$user." ".$v_system, $output, $return_var);
    $user=escapeshellarg($_GET['user']);
    exec(HESTIA_CMD."v-delete-user-backup ".$user." ".$v_backup, $output, $return_var);
    $user=escapeshellarg($_GET['user']);
    exec(HESTIA_CMD."v-delete-cron-job ".$user." ".$v_job, $output, $return_var);
    $user=escapeshellarg($_GET['user']);
    exec(HESTIA_CMD."v-delete-database ".$user." ".$v_database, $output, $return_var);
    $user=escapeshellarg($_GET['user']);
    exec(HESTIA_CMD."v-delete-dns-domain ".$user." ".$v_domain, $output, $return_var);
    if($return_var > 0){
        header("Location: /list/dns/");
        exit;
    }else{
        header("Location: /list/dns/?domain=".$_GET['domain']);
        exit;
    }
    
    $user=escapeshellarg($_GET['user']);
    exec(HESTIA_CMD."v-delete-user-ssh-key ".$user." ".$v_key);
    $user=escapeshellarg($_GET['user']);
exec(HESTIA_CMD."v-delete-user-auth-log ".$user, $output, $return_var);
    exec(HESTIA_CMD."v-log-user-login ".$user." ".$v_ip." success ".$v_session_id." ".$v_user_agent, $output, $return_var);
    $user=escapeshellarg($_GET['user']);
exec(HESTIA_CMD."v-delete-user-log ".$user." ".$output, $return_var);
if($return_var > 0){
    header("Location: /list/log/");
}else{
    // Set correct page reload target
    if (($_SESSION['userContext'] === "admin") && (!empty($_GET['user']))) {
        header("Location: /list/log/?user=$user&token=$token");
    } else {
        header("Location: /list/log/");
    }
}

    $user=scapeshellarg($user);
    exec(HESTIA_CMD."v-delete-mail-domain ".$user." ".$v_domain, $output, $return_var);
    if($return_var > 0){
       header("Location: /list/mail/"); 
    }
    exec(HESTIA_CMD."v-delete-mail-account ".$user." ".$v_domain." ".$v_account, $output, $return_var);
    if($return_var > 0){
       header("Location: /list/mail/"); 
    }else{
    }
    exec(HESTIA_CMD."v-delete-user-notification ".$user." ".$v_id, $output, $return_var);
    exec(HESTIA_CMD."v-acknowledge-user-notification ".$user." ".$v_id, $output, $return_var);
    $user=escapeshellarg($_GET['user']);
    exec(HESTIA_CMD."v-purge-nginx-cache ".$user." ".$v_domain, $output, $return_var);
    $user = escapeshellarg($user);
    exec(HESTIA_CMD . 'v-delete-web-domain ' . $user . ' ' . $v_domain . " 'yes'", $output, $return_var);
    exec(HESTIA_CMD."v-schedule-user-backup-download ".$user." ".$backup, $output, $return_var);
check_return_code_redirect($return_var, $output, '/list/cron/');
check_return_code_redirect($return_var, $output, '/list/db/');
    check_return_code_redirect($return_var, $output,'/list/dns/');
    check_return_code_redirect($return_var, $output,'/list/dns/');
    if(empty($data[$_GET['record_id']])){
        header("Location: /list/dns/");
        $_SESSION['error_msg'] = _("Unknown record ID");
    }
check_return_code_redirect($return_var, $output,'/list/firewall');
check_return_code_redirect($return_var, $output,'/list/ip');
    check_return_code_redirect($return_var, $output, '/list/mail/');
    check_return_code_redirect($return_var, $output, '/list/mail/');
check_return_code_redirect($return_var, $output, '/list/package/');
check_return_code_redirect($return_var, $output, '/list/user/');

exec(HESTIA_CMD."v-list-web-domains ".$user." json", $output, $return_var);
# Check if domain exists if not return /list/web/
check_return_code_redirect($return_var, $output, '/list/web/');
    $user = escapeshellarg($_SESSION['user']);
    $user = escapeshellarg($_SESSION['look']);
function check_return_code_redirect($return_var, $output, $location){
    if ($return_var != 0) {
        $error = implode('<br>', $output);
        if (empty($error)) {
            $error = sprintf(_('Error code:'), $return_var);
        }
        $_SESSION['error_msg'] = $error;
        header("Location:".$location);
    }

}
function show_error_panel($data){
    if (!empty($data['error_msg'])) {
        $msg_icon = 'fa-exclamation-circle status-icon red';
        $msg_text = $data['error_msg'];
        $msg_id = 'vst-error';
    } else {
        if (!empty($data['ok_msg'])) {
        $msg_icon = 'fa-check-circle status-icon green';
        $msg_text = $data['ok_msg'];
        $msg_id = 'vst-ok';
    }
    }
    ?>
        <span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=htmlentities($msg_text);?></span>
    <?php
}

        $_SESSION['error_msg'] = _('You have been logged out. Please log in again.');
        $_SESSION['error_msg'] = _('You have been logged out. Please log in again.');
            }else{
                # User doesn't exists
                header('Location: /');
    exec(HESTIA_CMD."v-suspend-cron-job ".$user." ".$v_job, $output, $return_var);
    exec(HESTIA_CMD."v-suspend-database ".$user." ".$v_database, $output, $return_var);
    exec(HESTIA_CMD."v-suspend-dns-domain ".$user." ".$v_domain, $output, $return_var);
    exec(HESTIA_CMD."v-suspend-dns-record ".$user." ".$v_domain." ".$v_record_id, $output, $return_var);
    exec(HESTIA_CMD."v-suspend-mail-domain ".$user." ".$v_domain, $output, $return_var);
    exec(HESTIA_CMD."v-suspend-mail-account ".$user." ".$v_domain." ".$v_account, $output, $return_var);
    exec(HESTIA_CMD."v-suspend-user ".$user, $output, $return_var);
    exec(HESTIA_CMD."v-suspend-web-domain ".$user." ".$v_domain, $output, $return_var);
<title><?=htmlentities($_SERVER['HTTP_HOST']); ?> - <?=_($TAB)?> - <?=_('Hestia Control Panel');?></title>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
										<option v_type="hostname" domain="<?=htmlentities($v_domain)?>"><?=_('Use domain hostname');?></option>
									<div id="td_imap_hostname">mail.<?=htmlentities($v_domain)?></div>
									<div id="td_smtp_hostname">mail.<?=htmlentities($v_domain)?></div>
										<div><a class="vst" href="http://<?=htmlentities($v_webmail_alias)?>" target="_blank">http://<?=htmlentities($v_webmail_alias)?> <i></i></a></div>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
											<input type="hidden" name="v-custom-doc-root_prepath" value="<?=htmlentities($v_custom_doc_root_prepath);?>">
													<option value="<?=htmlentities($domain);?>" selected="selected"><?=htmlentities($domain);?></option>
													<option value="<?=htmlentities($domain);?>"><?=htmlentities($domain);?></option>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
												<?php echo $v_webmail_alias;?>
												<?=sprintf(_("To enable Let's Encrypt SSL, ensure that DNS records exist for mail.%s and %s!"), $v_domain, $v_webmail_alias); ?><br />
														<span id="generate-csr"> / <a class="generate" target="_blank" href="/generate/ssl/?domain=<?=htmlentities($v_domain)?>"><?=_('Generate CSR');?></a></span>
																	<?=htmlentities($v_ssl_subject);?>
																		<?=htmlentities($v_ssl_aliases)?>
																	<?=htmlentities($v_ssl_not_before)?>
																	<?=htmlentities($v_ssl_not_after)?>
																	<?=htmlentities($v_ssl_signature)?>
																	<?=htmlentities($v_ssl_pub_key)?>
																	<?=htmlentities($v_ssl_issuer)?>
								<?php show_error_panel($_SESSION);?>
									<div id="td_imap_hostname">mail.<?=htmlentities($v_domain)?></div>
									<div id="td_smtp_hostname">mail.<?=htmlentities($v_domain)?></div>
										<div><a class="vst" href="http://<?=htmlentities($v_webmail_alias)?>" target="_blank">http://<?=htmlentities($v_webmail_alias)?> <i></i></a></div>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
					$ssh_key_url = "/list/key/?user=".htmlentities($user)."&token=".$_SESSION['token']."";
					$log_url = "/list/log/?user=".htmlentities($user)."&token=".$_SESSION['token']."";
				<a href="/login/?loginas=<?=htmlentities($v_username)?>&token=<?=$_SESSION['token']?>" id="btn-create" class="ui-button cancel" dir="ltr" title="<?=_('login as');?>"><i class="fas fa-sign-in-alt status-icon maroon"></i><?=_('login as');?></a>
						<input type="hidden" name="delete_url" value="/delete/user/?user=<?=htmlentities($v_username)?>&token=<?=$_SESSION['token']?>" />
							<p class="confirmation"><?=sprintf(_('DELETE_USER_CONFIRMATION'),htmlentities($v_username))?></p>
								<?php show_error_panel($_SESSION);?>
											<div><img class="qr-code" src="<?=htmlentities($v_qrcode); ?>"></div>
			<a href="/delete/web/cache/?domain=<?=htmlentities($v_domain);?>&token=<?=$_SESSION['token'];?>" class="ui-button cancel <?php if ( $v_nginx_cache == 'yes' || ($v_proxy_template == 'caching' && $_SESSION['PROXY_SYSTEM'] == 'nginx')) { echo "block"; } else{ echo "hidden"; }?>" id="v-clear-cache">
				<a href="/add/webapp/?domain=<?=htmlentities($v_domain);?>" class="ui-button cancel" dir="ltr">
								<?php show_error_panel($_SESSION);?>
											<label><input type="radio" name="v-redirect" value="<?='www.'.htmlentities($v_domain);?>" <?php if ($v_redirect == "www.".$v_domain) echo "checked"; ?> class="v-redirect-custom-value"><?=sprintf(_('Redirect visitors to %s'),"www.".htmlentities($v_domain));?></label></input><br />
											<label><input type="radio" name="v-redirect" value="<?=htmlentities($v_domain);?>" <?php if( $v_redirect == $v_domain) echo "checked";?> class="v-redirect-custom-value"><?=sprintf(_('Redirect visitors to %s'),htmlentities($v_domain));?></label></input><br />
														<span id="generate-csr"> / <a class="generate" target="_blank" href="/generate/ssl/?domain=<?=htmlentities($v_domain)?>"><?=_('Generate CSR');?></a></span>
															<option value="<?=htmlentities($domain);?>"
																<?=htmlentities($domain);?>
			<?php show_error_panel($_SESSION);?>
		$backup = htmlentities($_GET['backup']);
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = _('Name'); } else { $label = _('Date'); } ?>
								<?=$label;?> <i class="fas fa-sort-alpha-down"></i>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = _('Name'); } else { $label = _('Date'); } ?>
								<?=$label;?> <i class="fas fa-sort-alpha-down"></i>
									<?php if ($_SESSION['userSortOrder'] === 'name') { $label = _('Name'); } else { $label = _('Date'); } ?>
									<?=$label;?> <i class="fas fa-sort-alpha-down"></i>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = _('Record'); } else { $label = _('Date'); } ?>
								<?=$label;?> <i class="fas fa-sort-alpha-down"></i>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = _('Name'); } else { $label = _('Date'); } ?>
								<?=$label;?> <i class="fas fa-sort-alpha-down"></i>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = _('Name'); } else { $label = _('Date'); } ?>
								<?=$label;?> <i class="fas fa-sort-alpha-down"></i>
			v_unit_id="<?=$key."@".htmlentities($_GET['domain']);?>" v_section="mail_acc" sort-date="<?=strtotime($data[$key]['DATE'].' '.$data[$key]['TIME'])?>" sort-name="<?=$key?>" sort-disk="<?=$data[$key]['U_DISK']?>"
						<b><?=$key."@".htmlentities($_GET['domain']);?></b>
						<b><a href="/edit/mail/?domain=<?=htmlspecialchars($_GET['domain'])?>&account=<?=$key?>&token=<?=$_SESSION['token']?>" title="<?=_('Editing Mail Account');?>: <?=$key?>@<?=htmlspecialchars($_GET['domain'])?>"><?=$key."@".htmlentities($_GET['domain']);?></a></b>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = _('Name'); } else { $label = _('Date'); } ?>
								<?=$label;?> <i class="fas fa-sort-alpha-down"></i>
					</td>
								<?php show_error_panel($_SESSION);?>
							<td class="vst-text" style="padding: 12px 0 0 0;"><?=_('SSL Certificate');?> <a href="javascript:saveTextToBlob('<?php echo htmlentities($v_domain);?>.crt', 'v_crt');"><i class="fas fa-download"></i></a>
								<?=_('SSL Key');?> <a href="javascript:saveTextToBlob('<?php echo htmlentities($v_domain);?>.key', 'v_key');"><i class="fas fa-download"></i></a>
								<?=_('SSL CSR');?> <a href="javascript:saveTextToBlob('<?php echo htmlentities($v_domain);?>.csr', 'v_crt');"><i class="fas fa-download"></i></a>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = _('Name'); } else { $label = _('Date'); } ?>
								<?=$label;?> <i class="fas fa-sort-alpha-down"></i>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = ('Name'); } else { $label = _('Date'); } ?>
								<?=$label?> <i class="fas fa-sort-alpha-down"></i>
			<a class="ui-button cancel" dir="ltr" id="btn-back" href="/edit/web/?domain=<?=htmlentities($v_domain)?>"><i class="fas fa-arrow-left status-icon blue"></i><?=_('Back');?></a>
					<a href="/add/webapp/?app=<?=$webapp['name'];?>&domain=<?=htmlentities($v_domain)?>" class="ui-button cancel" dir="ltr"><?=_('Setup');?></a>
				<div class="l-menu__item"><a href="/edit/user/?user=<?=htmlentities($user); ?>" title="<?=htmlentities($user)?>" class="l-profile__username"><i class="fas fa-user-circle"></i></a></div>
											<input type="hidden" name="token" value="<?=htmlentities($_SESSION['token']);?>"/>
											<input type="hidden" name="user" value="<?=htmlentities($_GET['user'])?>">
											<input type="hidden" name="token" value="<?=htmlentities($_SESSION['token']);?>"/>
											<input type="hidden" name="user" value="<?=htmlentities($_GET['user']);?>">
											<input type="hidden" name="code" value="<?=htmlentities($_GET['code']);?>">
			<a class="ui-button cancel" dir="ltr" id="btn-back" href="/add/webapp/?domain=<?=htmlentities($v_domain);?>"><i class="fas fa-arrow-left status-icon blue"></i><?=_('Back');?></a>
						$f_name = htmlentities($f_name);
    exec(HESTIA_CMD."v-unsuspend-cron-job ".$user." ".$v_job, $output, $return_var);
    exec(HESTIA_CMD."v-unsuspend-database ".$user." ".$v_database, $output, $return_var);
    exec(HESTIA_CMD."v-unsuspend-dns-domain ".$user." ".$v_domain, $output, $return_var);
    exec(HESTIA_CMD."v-unsuspend-dns-record ".$user." ".$v_domain." ".$v_record_id, $output, $return_var);
    exec(HESTIA_CMD."v-unsuspend-mail-domain ".$user." ".$v_domain, $output, $return_var);
    exec(HESTIA_CMD."v-unsuspend-mail-account ".$user." ".$v_domain." ".$v_account, $output, $return_var);
    exec(HESTIA_CMD."v-unsuspend-domain ".$user." ".$v_domain, $output, $return_var);