From 4c0f0299ea87d77a1ef4222ab3523c968cff8f0b Mon Sep 17 00:00:00 2001
From: diptanilsaha <diptanil@frappe.io>
Date: Tue, 18 Aug 2026 22:49:02 +0530
Subject: [PATCH] fix: escape assigned user full name in project portal row
 templates

---
 erpnext/templates/includes/projects/project_row.html        | 4 ++--
 erpnext/templates/includes/projects/project_tasks.html      | 4 ++--
 erpnext/templates/includes/projects/project_timesheets.html | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/erpnext/templates/includes/projects/project_row.html b/erpnext/templates/includes/projects/project_row.html
index 7c8d23f056d..b0a9a276f2a 100644
--- a/erpnext/templates/includes/projects/project_row.html
+++ b/erpnext/templates/includes/projects/project_row.html
@@ -33,11 +33,11 @@
                 "full_name", "user_image"
               ], as_dict = True) %}
             {% if user_details.user_image %}
-              <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name }}">
+              <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name | e }}">
                 <img src="{{ user_details.user_image | e }}">
               </span>
             {% else %}
-              <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name }}">
+              <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name | e }}">
                 <div class='standard-image' style="background-color: #F5F4F4; color: #000;">
                   {{ frappe.utils.get_abbr(user_details.full_name) }}
                 </div>
diff --git a/erpnext/templates/includes/projects/project_tasks.html b/erpnext/templates/includes/projects/project_tasks.html
index d914dd90b38..c1f9cc16112 100644
--- a/erpnext/templates/includes/projects/project_tasks.html
+++ b/erpnext/templates/includes/projects/project_tasks.html
@@ -26,11 +26,11 @@
 		["full_name", "user_image"],
 		as_dict = True)%}
         {% if user_details.user_image %}
-          <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name }}">
+          <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name | e }}">
             <img src="{{ user_details.user_image | e }}">
           </span>
         {% else %}
-          <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name }}">
+          <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name | e }}">
             <div class='standard-image' style='background-color: #F5F4F4; color: #000;'>
               {{ frappe.utils.get_abbr(user_details.full_name) }}
             </div>
diff --git a/erpnext/templates/includes/projects/project_timesheets.html b/erpnext/templates/includes/projects/project_timesheets.html
index 6c3f8011ecd..8e118d2499c 100644
--- a/erpnext/templates/includes/projects/project_timesheets.html
+++ b/erpnext/templates/includes/projects/project_timesheets.html
@@ -14,11 +14,11 @@
           ], as_dict = True)
  		    %}
         {% if user_details.user_image %}
-          <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name }}">
+          <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name | e }}">
             <img src="{{ user_details.user_image | e }}">
           </span>
         {% else %}
-          <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name }}">
+          <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name | e }}">
             <div class='standard-image' style='background-color: #F5F4F4; color: #000;'>
               {{ frappe.utils.get_abbr(user_details.full_name) }}
             </div>