From 0b1dd6cccf91b59f769fef785c5afa3432cda6c0 Mon Sep 17 00:00:00 2001
From: diptanilsaha <diptanil@frappe.io>
Date: Tue, 18 Aug 2026 22:49:09 +0530
Subject: [PATCH] fix: encode image url and escape alt text in shared media
 macros

---
 erpnext/templates/includes/macros.html | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/erpnext/templates/includes/macros.html b/erpnext/templates/includes/macros.html
index 847ff467f90..b33735e6ee1 100644
--- a/erpnext/templates/includes/macros.html
+++ b/erpnext/templates/includes/macros.html
@@ -2,7 +2,7 @@
 <div class="product-image product-image-square h-100 rounded
 	{% if not website_image -%} missing-image {%- endif %} {{ css_class }}"
 	{% if website_image -%}
-	style="background-image: url('{{ frappe.utils.quoted(website_image) | abs_url }}');"
+	style="background-image: url('{{ (frappe.utils.quoted(website_image) | abs_url).replace("'", "%27") }}');"
 	{%- endif %}>
 </div>
 {% endmacro %}
@@ -10,7 +10,7 @@
 {% macro product_image(website_image, css_class="product-image", alt="", no_border=False) %}
 	<div class="{{ 'border' if not no_border else ''}} text-center rounded {{ css_class }}" style="overflow: hidden;">
 		{% if website_image %}
-			<img itemprop="image" class="website-image h-100 w-100" alt="{{ alt }}" src="{{ frappe.utils.quoted(website_image) | abs_url }}">
+			<img itemprop="image" class="website-image h-100 w-100" alt="{{ alt | e }}" src="{{ frappe.utils.quoted(website_image) | abs_url }}">
 		{% else %}
 			<div class="card-img-top no-image-item">
 				{{ frappe.utils.get_abbr(alt) or "NA" }}
@@ -22,11 +22,11 @@
 {% macro media_image(website_image, name, css_class="") %}
 	<div class="product-image sidebar-image-wrapper {{ css_class }}">
 		{% if not website_image -%}
-		<div class="sidebar-standard-image"> <div class="standard-image" style="background-color: rgb(250, 251, 252);">{{name}}</div> </div>
+		<div class="sidebar-standard-image"> <div class="standard-image" style="background-color: rgb(250, 251, 252);">{{ name | e }}</div> </div>
 		{%- endif %}
 		{% if website_image -%}
-			<a href="{{ frappe.utils.quoted(website_image) }}">
-				<img itemprop="image" src="{{ frappe.utils.quoted(website_image) | abs_url }}"
+			<a href="{{ frappe.utils.quoted(website_image) | abs_url | e }}">
+				<img itemprop="image" src="{{ frappe.utils.quoted(website_image) | abs_url | e }}"
 					class="img-responsive img-thumbnail sidebar-image" style="min-height:100%; min-width:100%;">
 			</a>
 		{%- endif %}