From 5c4fb99f6859e15ac3a6bb63af9eddd9d605e860 Mon Sep 17 00:00:00 2001
From: diptanilsaha <diptanil@frappe.io>
Date: Tue, 18 Aug 2026 22:49:03 +0530
Subject: [PATCH] fix: urlencode project name in project portal page and script

---
 erpnext/templates/pages/projects.html | 2 +-
 erpnext/templates/pages/projects.js   | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/erpnext/templates/pages/projects.html b/erpnext/templates/pages/projects.html
index e671e91db2f..10466a6cb2f 100644
--- a/erpnext/templates/pages/projects.html
+++ b/erpnext/templates/pages/projects.html
@@ -34,7 +34,7 @@
   <div class="row align-items-center">
     <div class="col-sm-6 my-account-header"> <h4>{{ _("Tasks") }}</h4></div>
     <div class="col-sm-6 text-right">
-      <a class="btn btn-secondary btn-light btn-sm" href='/tasks/new?project={{ doc.project_name }}'>{{ _("New task") }}</a>
+      <a class="btn btn-secondary btn-light btn-sm" href='/tasks/new?project={{ doc.project_name | urlencode }}'>{{ _("New task") }}</a>
     </div>
   </div>
   {% if doc.tasks %}
diff --git a/erpnext/templates/pages/projects.js b/erpnext/templates/pages/projects.js
index 622ed42f85f..24c16268e61 100644
--- a/erpnext/templates/pages/projects.js
+++ b/erpnext/templates/pages/projects.js
@@ -45,7 +45,7 @@ frappe.ready(function () {
 			dataType: "json",
 			data: {
 				cmd: "erpnext.templates.pages.projects.get_" + item + "_html",
-				project: "{{ doc.name }}",
+				project: "{{ doc.name | e }}",
 				item_status: item_status,
 			},
 			success: function (data) {
@@ -80,7 +80,7 @@ frappe.ready(function () {
 			dataType: "json",
 			data: {
 				cmd: "erpnext.templates.pages.projects.get_" + item + "_html",
-				project: "{{ doc.name }}",
+				project: "{{ doc.name | e }}",
 				start: start,
 				item_status: item_status,
 			},
@@ -96,7 +96,7 @@ frappe.ready(function () {
 
 	var close_item = function (item, item_name) {
 		var args = {
-			project: "{{ doc.name }}",
+			project: "{{ doc.name | e }}",
 			item_name: item_name,
 		};
 		frappe.call({