From 2ca71f16c4ab77091dc46f0a786e70c9caa1d363 Mon Sep 17 00:00:00 2001 From: "mergify[bot]" <37929162+mergify[bot]@users.noreply.github.com> Date: Sun, 9 Aug 2026 19:30:11 +0000 Subject: [PATCH] fix: escape `customer_details` on lead creation from appointment (backport #57947) (#57948) Co-authored-by: Diptanil Saha --- erpnext/crm/doctype/appointment/appointment.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/erpnext/crm/doctype/appointment/appointment.py b/erpnext/crm/doctype/appointment/appointment.py index da91a73f105..8beed20befa 100644 --- a/erpnext/crm/doctype/appointment/appointment.py +++ b/erpnext/crm/doctype/appointment/appointment.py @@ -13,6 +13,7 @@ from frappe.model.document import Document from frappe.share import add_docshare from frappe.utils import add_to_date, cint, date_diff, get_datetime, get_url, getdate, now, now_datetime from frappe.utils.data import sha256_hash +from frappe.utils.html_utils import escape_html from erpnext.setup.doctype.holiday_list.holiday_list import is_holiday @@ -269,7 +270,11 @@ class Appointment(Document): if self.customer_details: lead.append( "notes", - {"note": self.customer_details, "added_by": frappe.session.user, "added_on": now()}, + { + "note": escape_html(self.customer_details), + "added_by": frappe.session.user, + "added_on": now(), + }, ) self.party = lead.insert(ignore_permissions=True).name