From 42af4ce7b005f1dc28d5590fc637478bcb540a2b Mon Sep 17 00:00:00 2001
From: "mergify[bot]" <37929162+mergify[bot]@users.noreply.github.com>
Date: Mon, 22 Jun 2026 03:00:50 +0530
Subject: [PATCH] fix: escape user image url on various templates (backport
 #56269) (#56270)

Co-authored-by: Diptanil Saha <diptanil@frappe.io>
fix: escape user image url on various templates (#56269)
---
 erpnext/templates/emails/daily_project_summary.html         | 2 +-
 erpnext/templates/includes/projects/project_row.html        | 2 +-
 erpnext/templates/includes/projects/project_tasks.html      | 2 +-
 erpnext/templates/includes/projects/project_timesheets.html | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/erpnext/templates/emails/daily_project_summary.html b/erpnext/templates/emails/daily_project_summary.html
index 5ccc6101665..689a503a7d1 100644
--- a/erpnext/templates/emails/daily_project_summary.html
+++ b/erpnext/templates/emails/daily_project_summary.html
@@ -10,7 +10,7 @@
 		<td width="15"></td>
 		<td valign="top" width="24">
 			{% if user.image %}
-			<img class="sender-avatar" width="24" height="24" embed="{{ user.image }}"/>
+			<img class="sender-avatar" width="24" height="24" embed="{{ user.image | e }}"/>
 			{% else %}
 			<div class="sender-avatar-placeholder">
 				{{ user.full_name[0] }}
diff --git a/erpnext/templates/includes/projects/project_row.html b/erpnext/templates/includes/projects/project_row.html
index ccb306afcdb..7c8d23f056d 100644
--- a/erpnext/templates/includes/projects/project_row.html
+++ b/erpnext/templates/includes/projects/project_row.html
@@ -34,7 +34,7 @@
               ], as_dict = True) %}
             {% if user_details.user_image %}
               <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name }}">
-                <img src="{{ user_details.user_image }}">
+                <img src="{{ user_details.user_image | e }}">
               </span>
             {% else %}
               <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name }}">
diff --git a/erpnext/templates/includes/projects/project_tasks.html b/erpnext/templates/includes/projects/project_tasks.html
index 4069d3dcca5..43fa591cd47 100644
--- a/erpnext/templates/includes/projects/project_tasks.html
+++ b/erpnext/templates/includes/projects/project_tasks.html
@@ -27,7 +27,7 @@
 		as_dict = True)%}
         {% if user_details.user_image %}
           <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name }}">
-            <img src="{{ user_details.user_image }}">
+            <img src="{{ user_details.user_image | e }}">
           </span>
         {% else %}
           <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name }}">
diff --git a/erpnext/templates/includes/projects/project_timesheets.html b/erpnext/templates/includes/projects/project_timesheets.html
index b8e06829192..6c3f8011ecd 100644
--- a/erpnext/templates/includes/projects/project_timesheets.html
+++ b/erpnext/templates/includes/projects/project_timesheets.html
@@ -15,7 +15,7 @@
  		    %}
         {% if user_details.user_image %}
           <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name }}">
-            <img src="{{ user_details.user_image }}">
+            <img src="{{ user_details.user_image | e }}">
           </span>
         {% else %}
           <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name }}">