File 'include/views/js/configuration.httpconf.edit.js.php' builds a query string for 'popup_httpstep.php' using unencoded values for 'steps_names[]' array parameter.

If a web step name has characters such as '&url=xxx', the corresponding parameter in this query string will be overwritten and the 'url' field will show 'xxx' instead of the actual step url.

This can be fixed simply by adding 'encodeURIComponent' as shown in the attached patchfile.

File: include/views/js/configuration.httpconf.edit.js.php
Lines: 161 and 175