-
-
+
@@ -52,23 +52,23 @@
{% } %} -->
{{ d.job_card_link }}
+
-
+
-
+
-
{% } %}
diff --git a/erpnext/templates/form_grid/stock_entry_grid.html b/erpnext/templates/form_grid/stock_entry_grid.html
index 8604881812d..d0afa926c50 100644
--- a/erpnext/templates/form_grid/stock_entry_grid.html
+++ b/erpnext/templates/form_grid/stock_entry_grid.html
@@ -12,9 +12,9 @@
{% } else { %}
+
@@ -86,7 +86,7 @@
-
{% if(tasks[i].date) { %}
@@ -89,7 +89,7 @@
{% } %}
+ name="{{ frappe.utils.escape_html(events[i].name) }}" title="{{ __('Mark As Closed') }}">
@@ -161,7 +161,7 @@
-
+
{%= event.subject %}
diff --git a/erpnext/selling/print_format/quotation_with_item_image/quotation_with_item_image.json b/erpnext/selling/print_format/quotation_with_item_image/quotation_with_item_image.json
index ba1474a8173..dc9ebc50970 100644
--- a/erpnext/selling/print_format/quotation_with_item_image/quotation_with_item_image.json
+++ b/erpnext/selling/print_format/quotation_with_item_image/quotation_with_item_image.json
@@ -9,7 +9,7 @@
"docstatus": 0,
"doctype": "Print Format",
"font_size": 14,
- "html": "{%- macro add_header(page_num, max_pages, doc, letter_head, no_letterhead, footer, print_settings=None, print_heading_template=None) -%}\n\n{% if letter_head and not no_letterhead %}\n{{ letter_head }}
\n{% endif %}\n{% if print_heading_template %}\n{{ frappe.render_template(print_heading_template, {\"doc\":doc}) }}\n{% endif %}\n{%- endmacro -%}\n\n{% for page in layout %}\n\n\t
\n{% endfor %}",
+ "html": "{%- macro add_header(page_num, max_pages, doc, letter_head, no_letterhead, footer, print_settings=None, print_heading_template=None) -%}\n\n{% if letter_head and not no_letterhead %}\n\n\t\t{{ add_header(loop.index, layout|len, doc, letter_head, no_letterhead, footer, print_settings) }}\n\t
\n\t{%- if doc.meta.is_submittable and doc.docstatus==2-%}\n\t\t\n\t\t\t
\n\t{%- endif -%}\n\t{%- if doc.meta.is_submittable and doc.docstatus==0 and (print_settings==None or print_settings.add_draft_heading) -%}\n\t\t{{ _(\"CANCELLED\") }}
\n\t\t\n\t\t\t
\n\t{%- endif -%}\n\n\t\n\n\t{{ _(\"DRAFT\") }}
\n\t\t\n\t\t\n\t\t\t
\n\n\t\t\n\t\t{% set item_naming_by = frappe.db.get_single_value(\"Stock Settings\", \"item_naming_by\") %}\n\t\t\n\t\t\t\n\t\t\t\t
\n\n\t\t
\n\t\n| \n\t\t\t\t\t \n\t\t\t\t\t\t \n\t\t\t\t\tCustomer Name: \n\t\t\t\t\t\tBill to: \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t{{ doc.customer_name }} \n\t\t\t\t\t\t\n \t\t\t\t\t{% if doc.customer_address %}\n \t\t\t\t\t\t{% set customer_address = frappe.db.get_value(\"Address\", doc.customer_address, [\"address_line1\", \"address_line2\", \"city\", \"state\", \"pincode\", \"country\"], as_dict=True) %}\n \t\t\t\t\t\t{{ customer_address.address_line1 or \"\" }} \n\n\t\t\t\t\t\n \t\t\t\t\t\t{% if customer_address.address_line2 %}{{ customer_address.address_line2 }} {% endif %}\n \t\t\t\t\t\t{{ customer_address.city or \"\" }} {{ customer_address.state or \"\" }} {{ customer_address.pincode or \"\" }} {{ customer_address.country or \"\" }} \n \t\t\t\t\t{% endif %}\n\t\t\t\t\t\t | \n\n\t\t\t\t\n\t\t\t\t\t \n\t\t\t\t\t\t \n\t\t\t\t\t{{ _(\"Quotation:\") }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t\t{{ doc.name }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t\t{{ _(\"Posting Date:\") }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t\t{{ frappe.utils.format_date(doc.transaction_date) }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t\t{{ _(\"Valid Till:\") }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t{{ frappe.utils.format_date(doc.valid_till) }} \n\t\t\t\t\t | \n\t\t\t
| {{ _(\"No\") }} | \n\t\t\t\t\t{{ _(\"Item\") }} | \n\t\t\t\t\t{% if item_naming_by != \"Item Code\" %}\n\t\t\t\t\t\t{{ _(\"Item Code\") }} | \n\t\t\t\t\t{% endif %}\n\t\t\t\t\t{{ _(\"Quantity\") }} | \n\t\t\t\t\t{{ _(\"Rate\") }} | \n\t\t\t\t\t{{ _(\"Amount\") }} | \n\t\t\t\t|
| {{ loop.index }} | \n\t\t\t\t\t\n\t\t\t\t\t\t
| \n\t\t\t\t\t{% if item_naming_by != \"Item Code\" %}\n\t\t\t\t\t\t{{ item.item_code }} | \n\t\t\t\t\t{% endif %}\n\n\t\t\t\t\t{{ item.get_formatted(\"qty\", 0) }} {{ item.uom }} | \n\t\t\t\t\t{{ item.get_formatted(\"net_rate\", doc) }} | \n\t\t\t\t\t{{ item.get_formatted(\"net_amount\", doc) }} | \n\t\t\t\t
\n\t\t\t\n\t\t\t\t
\n\t\t
\n\n\t\t| {{ _(\"Sub Total:\") }} | \n\t\t\t\t\t{{ doc.get_formatted(\"total\", doc) }} | \n\t\t\t\t
| \n\t\t\t\t\t\t\t{{ _(\"Discount\") }} ({{ doc.additional_discount_percentage }}%):\n\t\t\t\t\t\t | \n\t\t\t\t\t\t{{ doc.get_formatted(\"discount_amount\", doc) }} | \n\t\t\t\t\t
| {{ tax.get_formatted(\"description\") }} ({{ tax.get_formatted(\"rate\") }}%): | \n\t\t\t\t\t\t\t{{ tax.get_formatted(\"tax_amount\") }} | \n\t\t\t\t\t\t
| \n\t\t\t\t\t\t\t{{ _(\"Discount\") }} ({{ doc.additional_discount_percentage }}%):\n\t\t\t\t\t\t | \n\t\t\t\t\t\t{{ doc.get_formatted(\"discount_amount\", doc) }} | \n\t\t\t\t\t
\n\t\t\t\n\t\t\t\t
\n\t\t
\n\n\n\t\t\n\t\t{% if doc.terms %}\n\t\t| \n\t\t\t\t\t\t \n\t\t\t\t\t\t\t {{ _(\"In Words: \") }}{{ doc.in_words }}\n\t\t\t\t\t\t \n\t\t\t\t\t | \n\t\t\t\t\t{{ _(\"Grand Total:\") }} | \n\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t{{ doc.get_formatted(\"grand_total\", doc) }}\n\t\t\t\t\t\t\n\t\t\t\t\t | \n\t\t\t\t
\n\t\t\t
\n\t\t{% endif %}\n\t{{ _(\"Terms and Conditions\") }}
\n\t\t\t{{ doc.terms}}\n\t\t{{ letter_head }}
\n{% endif %}\n{% if print_heading_template %}\n{{ frappe.render_template(print_heading_template, {\"doc\":doc}) }}\n{% endif %}\n{%- endmacro -%}\n\n{% for page in layout %}\n\n\t
\n{% endfor %}",
"idx": 0,
"line_breaks": 0,
"margin_bottom": 15.0,
diff --git a/erpnext/selling/print_format/sales_order_with_item_image/sales_order_with_item_image.json b/erpnext/selling/print_format/sales_order_with_item_image/sales_order_with_item_image.json
index 47c89caccc0..8bf466e7080 100644
--- a/erpnext/selling/print_format/sales_order_with_item_image/sales_order_with_item_image.json
+++ b/erpnext/selling/print_format/sales_order_with_item_image/sales_order_with_item_image.json
@@ -9,7 +9,7 @@
"docstatus": 0,
"doctype": "Print Format",
"font_size": 14,
- "html": "{%- macro add_header(page_num, max_pages, doc, letter_head, no_letterhead, footer, print_settings=None, print_heading_template=None) -%}\n\n{% if letter_head and not no_letterhead %}\n\n\t\t{{ add_header(loop.index, layout|len, doc, letter_head, no_letterhead, footer, print_settings) }}\n\t
\n\t{%- if doc.meta.is_submittable and doc.docstatus==2-%}\n\t\t\n\t\t\t
\n\t{%- endif -%}\n\t{%- if doc.meta.is_submittable and doc.docstatus==0 and (print_settings==None or print_settings.add_draft_heading) -%}\n\t\t{{ _(\"CANCELLED\") }}
\n\t\t\n\t\t\t
\n\t{%- endif -%}\n\n\t\n\n\t{{ _(\"DRAFT\") }}
\n\t\t\n\t\t\n\t\t\t
\n\n\t\t\n\t\t{% set item_naming_by = frappe.db.get_single_value(\"Stock Settings\", \"item_naming_by\") %}\n\t\t\n\t\t\t\n\t\t\t\t
\n\n\t\t
\n\t\n| \n\t\t\t\t\t \n\t\t\t\t\t\t \n\t\t\t\t\tCustomer Name: \n\t\t\t\t\t\tBill to: \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t{{ doc.customer_name }} \n\t\t\t\t\t\t\n \t\t\t\t\t{% if doc.customer_address %}\n \t\t\t\t\t\t{% set customer_address = frappe.db.get_value(\"Address\", doc.customer_address, [\"address_line1\", \"address_line2\", \"city\", \"state\", \"pincode\", \"country\"], as_dict=True) %}\n \t\t\t\t\t\t{{ customer_address.address_line1 or \"\" }} \n\n\t\t\t\t\t\n \t\t\t\t\t\t{% if customer_address.address_line2 %}{{ customer_address.address_line2 }} {% endif %}\n \t\t\t\t\t\t{{ customer_address.city or \"\" }} {{ customer_address.state or \"\" }} {{ customer_address.pincode or \"\" }} {{ customer_address.country or \"\" }} \n \t\t\t\t\t{% endif %}\n\t\t\t\t\t\t | \n\n\t\t\t\t\n\t\t\t\t\t \n\t\t\t\t\t\t \n\t\t\t\t\t{{ _(\"Quotation:\") }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t\t{{ doc.name }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t\t{{ _(\"Posting Date:\") }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t\t{{ frappe.utils.format_date(doc.transaction_date) }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t\t{{ _(\"Valid Till:\") }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t{{ frappe.utils.format_date(doc.valid_till) }} \n\t\t\t\t\t | \n\t\t\t
| {{ _(\"No\") }} | \n\t\t\t\t\t{{ _(\"Item\") }} | \n\t\t\t\t\t{% if item_naming_by != \"Item Code\" %}\n\t\t\t\t\t\t{{ _(\"Item Code\") }} | \n\t\t\t\t\t{% endif %}\n\t\t\t\t\t{{ _(\"Quantity\") }} | \n\t\t\t\t\t{{ _(\"Rate\") }} | \n\t\t\t\t\t{{ _(\"Amount\") }} | \n\t\t\t\t|
| {{ loop.index }} | \n\t\t\t\t\t\n\t\t\t\t\t\t
| \n\t\t\t\t\t{% if item_naming_by != \"Item Code\" %}\n\t\t\t\t\t\t{{ item.item_code }} | \n\t\t\t\t\t{% endif %}\n\n\t\t\t\t\t{{ item.get_formatted(\"qty\", 0) }} {{ item.uom }} | \n\t\t\t\t\t{{ item.get_formatted(\"net_rate\", doc) }} | \n\t\t\t\t\t{{ item.get_formatted(\"net_amount\", doc) }} | \n\t\t\t\t
\n\t\t\t\n\t\t\t\t
\n\t\t
\n\n\t\t| {{ _(\"Sub Total:\") }} | \n\t\t\t\t\t{{ doc.get_formatted(\"total\", doc) }} | \n\t\t\t\t
| \n\t\t\t\t\t\t\t{{ _(\"Discount\") }} ({{ doc.additional_discount_percentage }}%):\n\t\t\t\t\t\t | \n\t\t\t\t\t\t{{ doc.get_formatted(\"discount_amount\", doc) }} | \n\t\t\t\t\t
| {{ tax.get_formatted(\"description\") }} ({{ tax.get_formatted(\"rate\") }}%): | \n\t\t\t\t\t\t\t{{ tax.get_formatted(\"tax_amount\") }} | \n\t\t\t\t\t\t
| \n\t\t\t\t\t\t\t{{ _(\"Discount\") }} ({{ doc.additional_discount_percentage }}%):\n\t\t\t\t\t\t | \n\t\t\t\t\t\t{{ doc.get_formatted(\"discount_amount\", doc) }} | \n\t\t\t\t\t
\n\t\t\t\n\t\t\t\t
\n\t\t
\n\n\n\t\t\n\t\t{% if doc.terms %}\n\t\t| \n\t\t\t\t\t\t \n\t\t\t\t\t\t\t {{ _(\"In Words: \") }}{{ doc.in_words }}\n\t\t\t\t\t\t \n\t\t\t\t\t | \n\t\t\t\t\t{{ _(\"Grand Total:\") }} | \n\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t{{ doc.get_formatted(\"grand_total\", doc) }}\n\t\t\t\t\t\t\n\t\t\t\t\t | \n\t\t\t\t
\n\t\t\t
\n\t\t{% endif %}\n\t{{ _(\"Terms and Conditions\") }}
\n\t\t\t{{ doc.terms}}\n\t\t{{ letter_head }}
\n{% endif %}\n{% if print_heading_template %}\n{{ frappe.render_template(print_heading_template, {\"doc\":doc}) }}\n{% endif %}\n{%- endmacro -%}\n\n{% for page in layout %}\n\n\t
\n{% endfor %}",
+ "html": "{%- macro add_header(page_num, max_pages, doc, letter_head, no_letterhead, footer, print_settings=None, print_heading_template=None) -%}\n\n{% if letter_head and not no_letterhead %}\n\n\t\t{{ add_header(loop.index, layout|len, doc, letter_head, no_letterhead, footer, print_settings) }}\n\t
\n\t{%- if doc.meta.is_submittable and doc.docstatus==2-%}\n\t\t\n\t\t\t
\n\t{%- endif -%}\n\t{%- if doc.meta.is_submittable and doc.docstatus==0 and (print_settings==None or print_settings.add_draft_heading) -%}\n\t\t{{ _(\"CANCELLED\") }}
\n\t\t\n\t\t\t
\n\t{%- endif -%}\n\n\t\n\n\t{{ _(\"DRAFT\") }}
\n\t\t\n\t\t\n\t\t\t
\n\n\t\t\n\t\t{% set item_naming_by = frappe.db.get_single_value(\"Stock Settings\", \"item_naming_by\") %}\n\t\t\n\t\t\t\n\t\t\t\t
\n\n\t\t
\n\t\n| \n\t\t\t\t\t \n\t\t\t\t\t\t \n\t\t\t\t\tCustomer Name: \n\t\t\t\t\t\tBill to: \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t{{ doc.customer_name }} \n\t\t\t\t\t\t\n \t\t\t\t\t{% if doc.customer_address %}\n \t\t\t\t\t\t{% set customer_address = frappe.db.get_value(\"Address\", doc.customer_address, [\"address_line1\", \"address_line2\", \"city\", \"state\", \"pincode\", \"country\"], as_dict=True) %}\n \t\t\t\t\t\t{{ customer_address.address_line1 or \"\" }} \n\n\t\t\t\t\t\n \t\t\t\t\t\t{% if customer_address.address_line2 %}{{ customer_address.address_line2 }} {% endif %}\n \t\t\t\t\t\t{{ customer_address.city or \"\" }} {{ customer_address.state or \"\" }} {{ customer_address.pincode or \"\" }} {{ customer_address.country or \"\" }} \n \t\t\t\t\t{% endif %}\n\t\t\t\t\t\t | \n\n\t\t\t\t\n\t\t\t\t\t \n\t\t\t\t\t\t \n\t\t\t\t\t{{ _(\"Sales Order:\") }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t\t{{ doc.name }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t\t{{ _(\"Order Date:\") }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t\t{{ frappe.utils.format_date(doc.transaction_date) }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t\t{{ _(\"Delivery Date:\") }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t{{ frappe.utils.format_date(doc.delivery_date) }} \n\t\t\t\t\t | \n\t\t\t
| {{ _(\"No\") }} | \n\t\t\t\t\t{{ _(\"Item\") }} | \n\t\t\t\t\t{% if item_naming_by != \"Item Code\" %}\n\t\t\t\t\t\t{{ _(\"Item Code\") }} | \n\t\t\t\t\t{% endif %}\n\t\t\t\t\t{{ _(\"Quantity\") }} | \n\t\t\t\t\t{{ _(\"Rate\") }} | \n\t\t\t\t\t{{ _(\"Amount\") }} | \n\t\t\t\t|
| {{ loop.index }} | \n\t\t\t\t\t\n\t\t\t\t\t\t
| \n\t\t\t\t\t{% if item_naming_by != \"Item Code\" %}\n\t\t\t\t\t\t{{ item.item_code }} | \n\t\t\t\t\t{% endif %}\n\n\t\t\t\t\t{{ item.get_formatted(\"qty\", 0) }} {{ item.uom }} | \n\t\t\t\t\t{{ item.get_formatted(\"net_rate\", doc) }} | \n\t\t\t\t\t{{ item.get_formatted(\"net_amount\", doc) }} | \n\t\t\t\t
\n\t\t\t\n\t\t\t\t
\n\t\t
\n\n\t\t| {{ _(\"Sub Total:\") }} | \n\t\t\t\t\t{{ doc.get_formatted(\"total\", doc) }} | \n\t\t\t\t
| \n\t\t\t\t\t\t\t{{ _(\"Discount\") }} ({{ doc.additional_discount_percentage }}%):\n\t\t\t\t\t\t | \n\t\t\t\t\t\t{{ doc.get_formatted(\"discount_amount\", doc) }} | \n\t\t\t\t\t
| {{ tax.get_formatted(\"description\") }} ({{ tax.get_formatted(\"rate\") }}%): | \n\t\t\t\t\t\t\t{{ tax.get_formatted(\"tax_amount\") }} | \n\t\t\t\t\t\t
| \n\t\t\t\t\t\t\t{{ _(\"Discount\") }} ({{ doc.additional_discount_percentage }}%):\n\t\t\t\t\t\t | \n\t\t\t\t\t\t{{ doc.get_formatted(\"discount_amount\", doc) }} | \n\t\t\t\t\t
\n\t\t\t\n\t\t\t\t
\n\t\t
\n\n\n\t\t\n\t\t{% if doc.terms %}\n\t\t| \n\t\t\t\t\t\t \n\t\t\t\t\t\t\t {{ _(\"In Words: \") }}{{ doc.in_words }}\n\t\t\t\t\t\t \n\t\t\t\t\t | \n\t\t\t\t\t{{ _(\"Grand Total:\") }} | \n\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t{{ doc.get_formatted(\"grand_total\", doc) }}\n\t\t\t\t\t\t\n\t\t\t\t\t | \n\t\t\t\t
\n\t\t\t
\n\t\t{% endif %}\n\t{{ _(\"Terms and Conditions\") }}
\n\t\t\t{{ doc.terms}}\n\t\t{{ letter_head }}
\n{% endif %}\n{% if print_heading_template %}\n{{ frappe.render_template(print_heading_template, {\"doc\":doc}) }}\n{% endif %}\n{%- endmacro -%}\n\n{% for page in layout %}\n\n\t
\n{% endfor %}",
"idx": 0,
"line_breaks": 0,
"margin_bottom": 15.0,
diff --git a/erpnext/stock/doctype/item/item.js b/erpnext/stock/doctype/item/item.js
index d7fde5f6961..909da62a492 100644
--- a/erpnext/stock/doctype/item/item.js
+++ b/erpnext/stock/doctype/item/item.js
@@ -249,7 +249,10 @@ frappe.ui.form.on("Item", {
if (frm.doc.variant_of) {
frm.set_intro(
__("This Item is a Variant of {0} (Template).", [
- `${frm.doc.variant_of}`,
+ `${frappe.utils.escape_html(frm.doc.variant_of)}`,
]),
true
);
diff --git a/erpnext/stock/doctype/shipment/shipment.js b/erpnext/stock/doctype/shipment/shipment.js
index f22139c89f5..9c86fefc183 100644
--- a/erpnext/stock/doctype/shipment/shipment.js
+++ b/erpnext/stock/doctype/shipment/shipment.js
@@ -174,7 +174,10 @@ frappe.ui.form.on("Shipment", {
__("Email or Phone/Mobile of the Contact are mandatory to continue.") +
"" +
__("Please set Email/Phone for the contact") +
- ` ${contact_name}`
+ ` ${frappe.utils.escape_html(contact_name)}`
);
}
let contact_display = r.message.contact_display;
diff --git a/erpnext/stock/print_format/delivery_note_with_item_image/delivery_note_with_item_image.json b/erpnext/stock/print_format/delivery_note_with_item_image/delivery_note_with_item_image.json
index b3dc2dbb580..c6994b956c0 100644
--- a/erpnext/stock/print_format/delivery_note_with_item_image/delivery_note_with_item_image.json
+++ b/erpnext/stock/print_format/delivery_note_with_item_image/delivery_note_with_item_image.json
@@ -9,7 +9,7 @@
"docstatus": 0,
"doctype": "Print Format",
"font_size": 14,
- "html": "{%- macro add_header(page_num, max_pages, doc, letter_head, no_letterhead, footer, print_settings=None, print_heading_template=None) -%}\n\n{% if letter_head and not no_letterhead %}\n\n\t\t{{ add_header(loop.index, layout|len, doc, letter_head, no_letterhead, footer, print_settings) }}\n\t
\n\t{%- if doc.meta.is_submittable and doc.docstatus==2-%}\n\t\t\n\t\t\t
\n\t{%- endif -%}\n\t{%- if doc.meta.is_submittable and doc.docstatus==0 and (print_settings==None or print_settings.add_draft_heading) -%}\n\t\t{{ _(\"CANCELLED\") }}
\n\t\t\n\t\t\t
\n\t{%- endif -%}\n\n\t\n\n\t{{ _(\"DRAFT\") }}
\n\t\t\n\t\t\n\t\t\t
\n\n\t\t\n\t\t{% set item_naming_by = frappe.db.get_single_value(\"Stock Settings\", \"item_naming_by\") %}\n\t\t\n\t\t\t\n\t\t\t\t
\n\n\t\t
\n\t\n| \n\t\t\t\t\t \n\t\t\t\t\t\t \n\t\t\t\t\tCustomer Name: \n\t\t\t\t\t\tBill to: \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t{{ doc.customer_name }} \n\t\t\t\t\t\t\n \t\t\t\t\t{% if doc.customer_address %}\n \t\t\t\t\t\t{% set customer_address = frappe.db.get_value(\"Address\", doc.customer_address, [\"address_line1\", \"address_line2\", \"city\", \"state\", \"pincode\", \"country\"], as_dict=True) %}\n \t\t\t\t\t\t{{ customer_address.address_line1 or \"\" }} \n\n\t\t\t\t\t\n \t\t\t\t\t\t{% if customer_address.address_line2 %}{{ customer_address.address_line2 }} {% endif %}\n \t\t\t\t\t\t{{ customer_address.city or \"\" }} {{ customer_address.state or \"\" }} {{ customer_address.pincode or \"\" }} {{ customer_address.country or \"\" }} \n \t\t\t\t\t{% endif %}\n\t\t\t\t\t\t | \n\n\t\t\t\t\n\t\t\t\t\t \n\t\t\t\t\t\t \n\t\t\t\t\t{{ _(\"Sales Order:\") }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t\t{{ doc.name }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t\t{{ _(\"Order Date:\") }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t\t{{ frappe.utils.format_date(doc.transaction_date) }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t\t{{ _(\"Delivery Date:\") }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t{{ frappe.utils.format_date(doc.delivery_date) }} \n\t\t\t\t\t | \n\t\t\t
| {{ _(\"No\") }} | \n\t\t\t\t\t{{ _(\"Item\") }} | \n\t\t\t\t\t{% if item_naming_by != \"Item Code\" %}\n\t\t\t\t\t\t{{ _(\"Item Code\") }} | \n\t\t\t\t\t{% endif %}\n\t\t\t\t\t{{ _(\"Quantity\") }} | \n\t\t\t\t\t{{ _(\"Rate\") }} | \n\t\t\t\t\t{{ _(\"Amount\") }} | \n\t\t\t\t|
| {{ loop.index }} | \n\t\t\t\t\t\n\t\t\t\t\t\t
| \n\t\t\t\t\t{% if item_naming_by != \"Item Code\" %}\n\t\t\t\t\t\t{{ item.item_code }} | \n\t\t\t\t\t{% endif %}\n\n\t\t\t\t\t{{ item.get_formatted(\"qty\", 0) }} {{ item.uom }} | \n\t\t\t\t\t{{ item.get_formatted(\"net_rate\", doc) }} | \n\t\t\t\t\t{{ item.get_formatted(\"net_amount\", doc) }} | \n\t\t\t\t
\n\t\t\t\n\t\t\t\t
\n\t\t
\n\n\t\t| {{ _(\"Sub Total:\") }} | \n\t\t\t\t\t{{ doc.get_formatted(\"total\", doc) }} | \n\t\t\t\t
| \n\t\t\t\t\t\t\t{{ _(\"Discount\") }} ({{ doc.additional_discount_percentage }}%):\n\t\t\t\t\t\t | \n\t\t\t\t\t\t{{ doc.get_formatted(\"discount_amount\", doc) }} | \n\t\t\t\t\t
| {{ tax.get_formatted(\"description\") }} ({{ tax.get_formatted(\"rate\") }}%): | \n\t\t\t\t\t\t\t{{ tax.get_formatted(\"tax_amount\") }} | \n\t\t\t\t\t\t
| \n\t\t\t\t\t\t\t{{ _(\"Discount\") }} ({{ doc.additional_discount_percentage }}%):\n\t\t\t\t\t\t | \n\t\t\t\t\t\t{{ doc.get_formatted(\"discount_amount\", doc) }} | \n\t\t\t\t\t
\n\t\t\t\n\t\t\t\t
\n\t\t
\n\n\n\t\t\n\t\t{% if doc.terms %}\n\t\t| \n\t\t\t\t\t\t \n\t\t\t\t\t\t\t {{ _(\"In Words: \") }}{{ doc.in_words }}\n\t\t\t\t\t\t \n\t\t\t\t\t | \n\t\t\t\t\t{{ _(\"Grand Total:\") }} | \n\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t{{ doc.get_formatted(\"grand_total\", doc) }}\n\t\t\t\t\t\t\n\t\t\t\t\t | \n\t\t\t\t
\n\t\t\t
\n\t\t{% endif %}\n\t{{ _(\"Terms and Conditions\") }}
\n\t\t\t{{ doc.terms}}\n\t\t{{ letter_head }}
\n{% endif %}\n{% if print_heading_template %}\n{{ frappe.render_template(print_heading_template, {\"doc\":doc}) }}\n{% endif %}\n{%- endmacro -%}\n\n{% for page in layout %}\n\n\t
\n{% endfor %}",
+ "html": "{%- macro add_header(page_num, max_pages, doc, letter_head, no_letterhead, footer, print_settings=None, print_heading_template=None) -%}\n\n{% if letter_head and not no_letterhead %}\n\n\t\t{{ add_header(loop.index, layout|len, doc, letter_head, no_letterhead, footer, print_settings) }}\n\t
\n\t{%- if doc.meta.is_submittable and doc.docstatus==2-%}\n\t\t\n\t\t\t
\n\t{%- endif -%}\n\t{%- if doc.meta.is_submittable and doc.docstatus==0 and (print_settings==None or print_settings.add_draft_heading) -%}\n\t\t{{ _(\"CANCELLED\") }}
\n\t\t\n\t\t\t
\n\t{%- endif -%}\n\n\t\n\n\t{{ _(\"DRAFT\") }}
\n\t\t\n\t\t\n\t\t\t
\n\n\t\t\n\t\t{% set item_naming_by = frappe.db.get_single_value(\"Stock Settings\", \"item_naming_by\") %}\n\t\t\n\t\t\t\n\t\t\t\t
\n\n\t\t
\n\t\n| \n\t\t\t\t\t \n\t\t\t\t\t\t \n\t\t\t\t\t{{ _(\"Customer Name:\") }} \n\t\t\t\t\t\t{{ _(\"Address:\") }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t{{ doc.customer_name }} \n\t\t\t\t\t\t\n \t\t\t\t\t{% if doc.customer_address %}\n \t\t\t\t\t\t{% set customer_address = frappe.db.get_value(\"Address\", doc.customer_address, [\"address_line1\", \"address_line2\", \"city\", \"state\", \"pincode\", \"country\"], as_dict=True) %}\n \t\t\t\t\t\t{{ customer_address.address_line1 or \"\" }} \n\n\t\t\t\t\t\n \t\t\t\t\t\t{% if customer_address.address_line2 %}{{ customer_address.address_line2 }} {% endif %}\n \t\t\t\t\t\t{{ customer_address.city or \"\" }} {{ customer_address.state or \"\" }} {{ customer_address.pincode or \"\" }} {{ customer_address.country or \"\" }} \n \t\t\t\t\t{% endif %}\n\t\t\t\t\t\t | \n\n\t\t\t\t\n\t\t\t\t\t \n\t\t\t\t\t\t \n\t\t\t\t\t{{ _(\"Delivery Note:\") }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t\t{{ doc.name }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t\t{{ _(\"Delivery Date:\") }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t\t{{ frappe.utils.format_date(doc.posting_date) }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t\t{{ _(\"Status:\") }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t{{ doc.status }} \n\t\t\t\t\t | \n\t\t\t
| {{ _(\"No\") }} | \n\t\t\t\t\t{{ _(\"Item\") }} | \n\t\t\t\t\t{% if item_naming_by != \"Item Code\" %}\n\t\t\t\t\t\t{{ _(\"Item Code\") }} | \n\t\t\t\t\t{% endif %}\n\t\t\t\t\t{{ _(\"Quantity\") }} | \n\t\t\t\t\t{{ _(\"Rate\") }} | \n\t\t\t\t\t{{ _(\"Amount\") }} | \n\t\t\t\t|
| {{ loop.index }} | \n\t\t\t\t\t\n\t\t\t\t\t\t
| \n\t\t\t\t\t{% if item_naming_by != \"Item Code\" %}\n\t\t\t\t\t\t{{ item.item_code }} | \n\t\t\t\t\t{% endif %}\n\n\t\t\t\t\t{{ item.get_formatted(\"qty\", 0) }} {{ item.uom }} | \n\t\t\t\t\t{{ item.get_formatted(\"net_rate\", doc) }} | \n\t\t\t\t\t{{ item.get_formatted(\"net_amount\", doc) }} | \n\t\t\t\t
\n\t\t\t\n\t\t\t\t
\n\t\t
\n\n\t\t| {{ _(\"Sub Total:\") }} | \n\t\t\t\t\t{{ doc.get_formatted(\"total\", doc) }} | \n\t\t\t\t
| \n\t\t\t\t\t\t\t{{ _(\"Discount\") }} ({{ doc.additional_discount_percentage }}%):\n\t\t\t\t\t\t | \n\t\t\t\t\t\t{{ doc.get_formatted(\"discount_amount\", doc) }} | \n\t\t\t\t\t
| {{ tax.get_formatted(\"description\") }} ({{ tax.get_formatted(\"rate\") }}%): | \n\t\t\t\t\t\t\t{{ tax.get_formatted(\"tax_amount\") }} | \n\t\t\t\t\t\t
| \n\t\t\t\t\t\t\t{{ _(\"Discount\") }} ({{ doc.additional_discount_percentage }}%):\n\t\t\t\t\t\t | \n\t\t\t\t\t\t{{ doc.get_formatted(\"discount_amount\", doc) }} | \n\t\t\t\t\t
\n\t\t\t\n\t\t\t\t
\n\t\t
\n\n\n\t\t\n\t\t{% if doc.terms %}\n\t\t| \n\t\t\t\t\t\t \n\t\t\t\t\t\t\t {{ _(\"In Words: \") }}{{ doc.in_words }}\n\t\t\t\t\t\t \n\t\t\t\t\t | \n\t\t\t\t\t{{ _(\"Grand Total:\") }} | \n\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t{{ doc.get_formatted(\"grand_total\", doc) }}\n\t\t\t\t\t\t\n\t\t\t\t\t | \n\t\t\t\t
\n\t\t\t
\n\t\t{% endif %}\n\t{{ _(\"Terms and Conditions\") }}
\n\t\t\t{{ doc.terms}}\n\t\t{{ letter_head }}
\n{% endif %}\n{% if print_heading_template %}\n{{ frappe.render_template(print_heading_template, {\"doc\":doc}) }}\n{% endif %}\n{%- endmacro -%}\n\n{% for page in layout %}\n\n\t
\n{% endfor %}",
"idx": 0,
"line_breaks": 0,
"margin_bottom": 15.0,
diff --git a/erpnext/stock/report/serial_no_and_batch_traceability/serial_no_and_batch_traceability.js b/erpnext/stock/report/serial_no_and_batch_traceability/serial_no_and_batch_traceability.js
index 59cb2eb6545..d17b38d7f8f 100644
--- a/erpnext/stock/report/serial_no_and_batch_traceability/serial_no_and_batch_traceability.js
+++ b/erpnext/stock/report/serial_no_and_batch_traceability/serial_no_and_batch_traceability.js
@@ -68,7 +68,7 @@ frappe.query_reports["Serial No and Batch Traceability"] = {
function getTraceabilityLink({ type, value, original_value, item_code, data, filter_values }) {
if (!value) return value;
- const base_url = type === "batch_no" ? "/app/batch/" : "/app/serial-no/";
+ const link_doctype = type === "batch_no" ? "Batch" : "Serial No";
const filter_list = filter_values[type]; // either batches or serial_nos
let css_class = "ellipsis";
@@ -84,7 +84,10 @@ function getTraceabilityLink({ type, value, original_value, item_code, data, fil
css_class = data.direction === "Backward" ? "ellipsis text-success" : "ellipsis text-danger";
}
- return `${original_value}`;
+ return `${frappe.utils.escape_html(original_value)}`;
}
function custom_formatter(value, row, column, data, default_formatter) {
diff --git a/erpnext/templates/form_grid/includes/visible_cols.html b/erpnext/templates/form_grid/includes/visible_cols.html
index 8d79bcdf879..578335ddcd4 100644
--- a/erpnext/templates/form_grid/includes/visible_cols.html
+++ b/erpnext/templates/form_grid/includes/visible_cols.html
@@ -3,7 +3,7 @@
if((df.fieldname !== "description" && df.fieldname !== "item_name") && val) { %}
\n\t\t{{ add_header(loop.index, layout|len, doc, letter_head, no_letterhead, footer, print_settings) }}\n\t
\n\t{%- if doc.meta.is_submittable and doc.docstatus==2-%}\n\t\t\n\t\t\t
\n\t{%- endif -%}\n\t{%- if doc.meta.is_submittable and doc.docstatus==0 and (print_settings==None or print_settings.add_draft_heading) -%}\n\t\t{{ _(\"CANCELLED\") }}
\n\t\t\n\t\t\t
\n\t{%- endif -%}\n\n\t\n\n\t{{ _(\"DRAFT\") }}
\n\t\t\n\t\t\n\t\t\t
\n\n\t\t\n\t\t{% set item_naming_by = frappe.db.get_single_value(\"Stock Settings\", \"item_naming_by\") %}\n\t\t\n\t\t\t\n\t\t\t\t
\n\n\t\t
\n\t\n| \n\t\t\t\t\t \n\t\t\t\t\t\t \n\t\t\t\t\t{{ _(\"Customer Name:\") }} \n\t\t\t\t\t\t{{ _(\"Address:\") }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t{{ doc.customer_name }} \n\t\t\t\t\t\t\n \t\t\t\t\t{% if doc.customer_address %}\n \t\t\t\t\t\t{% set customer_address = frappe.db.get_value(\"Address\", doc.customer_address, [\"address_line1\", \"address_line2\", \"city\", \"state\", \"pincode\", \"country\"], as_dict=True) %}\n \t\t\t\t\t\t{{ customer_address.address_line1 or \"\" }} \n\n\t\t\t\t\t\n \t\t\t\t\t\t{% if customer_address.address_line2 %}{{ customer_address.address_line2 }} {% endif %}\n \t\t\t\t\t\t{{ customer_address.city or \"\" }} {{ customer_address.state or \"\" }} {{ customer_address.pincode or \"\" }} {{ customer_address.country or \"\" }} \n \t\t\t\t\t{% endif %}\n\t\t\t\t\t\t | \n\n\t\t\t\t\n\t\t\t\t\t \n\t\t\t\t\t\t \n\t\t\t\t\t{{ _(\"Delivery Note:\") }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t\t{{ doc.name }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t\t{{ _(\"Delivery Date:\") }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t\t{{ frappe.utils.format_date(doc.posting_date) }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t\t{{ _(\"Status:\") }} \n\t\t\t\t\t\n\t\t\t\t\t\t \n\t\t\t\t{{ doc.status }} \n\t\t\t\t\t | \n\t\t\t
| {{ _(\"No\") }} | \n\t\t\t\t\t{{ _(\"Item\") }} | \n\t\t\t\t\t{% if item_naming_by != \"Item Code\" %}\n\t\t\t\t\t\t{{ _(\"Item Code\") }} | \n\t\t\t\t\t{% endif %}\n\t\t\t\t\t{{ _(\"Quantity\") }} | \n\t\t\t\t\t{{ _(\"Rate\") }} | \n\t\t\t\t\t{{ _(\"Amount\") }} | \n\t\t\t\t|
| {{ loop.index }} | \n\t\t\t\t\t\n\t\t\t\t\t\t
| \n\t\t\t\t\t{% if item_naming_by != \"Item Code\" %}\n\t\t\t\t\t\t{{ item.item_code }} | \n\t\t\t\t\t{% endif %}\n\n\t\t\t\t\t{{ item.get_formatted(\"qty\", 0) }} {{ item.uom }} | \n\t\t\t\t\t{{ item.get_formatted(\"net_rate\", doc) }} | \n\t\t\t\t\t{{ item.get_formatted(\"net_amount\", doc) }} | \n\t\t\t\t
\n\t\t\t\n\t\t\t\t
\n\t\t
\n\n\t\t| {{ _(\"Sub Total:\") }} | \n\t\t\t\t\t{{ doc.get_formatted(\"total\", doc) }} | \n\t\t\t\t
| \n\t\t\t\t\t\t\t{{ _(\"Discount\") }} ({{ doc.additional_discount_percentage }}%):\n\t\t\t\t\t\t | \n\t\t\t\t\t\t{{ doc.get_formatted(\"discount_amount\", doc) }} | \n\t\t\t\t\t
| {{ tax.get_formatted(\"description\") }} ({{ tax.get_formatted(\"rate\") }}%): | \n\t\t\t\t\t\t\t{{ tax.get_formatted(\"tax_amount\") }} | \n\t\t\t\t\t\t
| \n\t\t\t\t\t\t\t{{ _(\"Discount\") }} ({{ doc.additional_discount_percentage }}%):\n\t\t\t\t\t\t | \n\t\t\t\t\t\t{{ doc.get_formatted(\"discount_amount\", doc) }} | \n\t\t\t\t\t
\n\t\t\t\n\t\t\t\t
\n\t\t
\n\n\n\t\t\n\t\t{% if doc.terms %}\n\t\t| \n\t\t\t\t\t\t \n\t\t\t\t\t\t\t {{ _(\"In Words: \") }}{{ doc.in_words }}\n\t\t\t\t\t\t \n\t\t\t\t\t | \n\t\t\t\t\t{{ _(\"Grand Total:\") }} | \n\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t{{ doc.get_formatted(\"grand_total\", doc) }}\n\t\t\t\t\t\t\n\t\t\t\t\t | \n\t\t\t\t
\n\t\t\t
\n\t\t{% endif %}\n\t{{ _(\"Terms and Conditions\") }}
\n\t\t\t{{ doc.terms}}\n\t\t
- {%= __(df.label, null, df.parent) %}:
+ {%= frappe.utils.escape_html(__(df.label, null, df.parent)) %}:
{%= doc.get_formatted(df.fieldname) %}
diff --git a/erpnext/templates/form_grid/item_grid.html b/erpnext/templates/form_grid/item_grid.html
index 72db6c8e653..fac31c7c1a1 100644
--- a/erpnext/templates/form_grid/item_grid.html
+++ b/erpnext/templates/form_grid/item_grid.html
@@ -31,7 +31,7 @@
} %}
- {%= doc.warehouse %}
+ {%= frappe.utils.escape_html(doc.warehouse) %}
{% } %}
@@ -42,14 +42,14 @@
doc.delivered_qty : doc.received_qty;
var pending = flt(doc.qty) - flt(delivered);
%}
- {%= doc.item_code %}
+ {%= frappe.utils.escape_html(doc.item_code) %}
{% } else { %}
- {%= doc.item_code %}
+ {%= frappe.utils.escape_html(doc.item_code) %}
{% } %}
{% if(doc.item_name != doc.item_code && in_list(visible_column_fieldnames, "item_name")) { %}
{% if (doc.item_code) { %}
{% } %} - {%= doc.item_name %}{% } %} + {%= frappe.utils.escape_html(doc.item_name) %}{% } %} {% include "templates/form_grid/includes/visible_cols.html" %}
@@ -57,7 +57,7 @@
@@ -84,7 +84,7 @@
{% if (frappe.perm.is_visible("rate", doc, frm.perm)) { %}
{% } %} - {%= doc.item_name %}{% } %} + {%= frappe.utils.escape_html(doc.item_name) %}{% } %} {% include "templates/form_grid/includes/visible_cols.html" %}
- {%= doc.get_formatted("qty") %} {%= doc.uom || doc.stock_uom %}
+ {%= doc.get_formatted("qty") %} {%= frappe.utils.escape_html(doc.uom || doc.stock_uom) %}
x {%= doc.get_formatted("rate") %}
{% } %}
diff --git a/erpnext/templates/form_grid/material_request_grid.html b/erpnext/templates/form_grid/material_request_grid.html
index 866c06e5863..ff58da62ab5 100644
--- a/erpnext/templates/form_grid/material_request_grid.html
+++ b/erpnext/templates/form_grid/material_request_grid.html
@@ -11,9 +11,9 @@
{% } else { %}
- {%= doc.item_code %}
+ {%= frappe.utils.escape_html(doc.item_code) %}
{% if(doc.item_name != doc.item_code) { %}
-
{%= doc.item_name %}{% } %} +
{%= frappe.utils.escape_html(doc.item_name) %}{% } %} {% include "templates/form_grid/includes/visible_cols.html" %} @@ -35,7 +35,7 @@ {% if(doc.warehouse) { %} - {%= doc.warehouse %} + {%= frappe.utils.escape_html(doc.warehouse) %} {% } %}
@@ -43,7 +43,7 @@
{%= doc.item_name %}{% } %} +
{%= frappe.utils.escape_html(doc.item_name) %}{% } %} {% include "templates/form_grid/includes/visible_cols.html" %} @@ -35,7 +35,7 @@ {% if(doc.warehouse) { %} - {%= doc.warehouse %} + {%= frappe.utils.escape_html(doc.warehouse) %} {% } %}
{%= doc.get_formatted("qty") %}
- {%= doc.uom || doc.stock_uom %}
+ {%= frappe.utils.escape_html(doc.uom || doc.stock_uom) %}
-
{%= doc.item_code %}
+
@@ -42,7 +42,7 @@
{%= frappe.utils.escape_html(doc.item_code) %}
{% if(doc.item_name != doc.item_code) { %}
-
{%= doc.item_name %}{% } %} +
{%= frappe.utils.escape_html(doc.item_name) %}{% } %} {% include "templates/form_grid/includes/visible_cols.html" %}
@@ -30,11 +30,11 @@
}
%}
- {%= doc.s_warehouse %}
+ {%= frappe.utils.escape_html(doc.s_warehouse) %}
{% }; %}
{% if(doc.t_warehouse) { %}
{%= doc.item_name %}{% } %} +
{%= frappe.utils.escape_html(doc.item_name) %}{% } %} {% include "templates/form_grid/includes/visible_cols.html" %}
- {%= doc.t_warehouse %}
+ {%= frappe.utils.escape_html(doc.t_warehouse) %}
{% }; %}
{%= doc.get_formatted("qty") %}
-
{%= doc.uom || doc.stock_uom %} +
{%= frappe.utils.escape_html(doc.uom || doc.stock_uom) %}
diff --git a/erpnext/templates/generators/sales_partner.html b/erpnext/templates/generators/sales_partner.html
index 9dd2db99023..f45e028b676 100644
--- a/erpnext/templates/generators/sales_partner.html
+++ b/erpnext/templates/generators/sales_partner.html
@@ -9,8 +9,8 @@
{%= doc.uom || doc.stock_uom %} +
{%= frappe.utils.escape_html(doc.uom || doc.stock_uom) %}
{% if logo %}
- 
+ 
{% endif %} {% if addresses %} diff --git a/erpnext/templates/includes/macros.html b/erpnext/templates/includes/macros.html index 5c8714db8f9..9886d13fec3 100644 --- a/erpnext/templates/includes/macros.html +++ b/erpnext/templates/includes/macros.html @@ -2,7 +2,7 @@
{% endmacro %}
@@ -10,7 +10,7 @@
{% macro product_image(website_image, css_class="product-image", alt="", no_border=False) %}
diff --git a/erpnext/templates/pages/help.html b/erpnext/templates/pages/help.html
index 726d5e1b881..7e11bcb7d54 100644
--- a/erpnext/templates/pages/help.html
+++ b/erpnext/templates/pages/help.html
@@ -17,12 +17,12 @@
{% for section in get_started_sections %}
-
{% endif %}
{% endblock %}
diff --git a/erpnext/templates/pages/partners.html b/erpnext/templates/pages/partners.html
index 72d6a6478f7..71962b90afa 100644
--- a/erpnext/templates/pages/partners.html
+++ b/erpnext/templates/pages/partners.html
@@ -10,14 +10,14 @@
{% endfor %}
@@ -72,7 +72,7 @@
{% endif %} {% if addresses %} diff --git a/erpnext/templates/includes/macros.html b/erpnext/templates/includes/macros.html index 5c8714db8f9..9886d13fec3 100644 --- a/erpnext/templates/includes/macros.html +++ b/erpnext/templates/includes/macros.html @@ -2,7 +2,7 @@
-
diff --git a/erpnext/templates/pages/order.html b/erpnext/templates/pages/order.html
index 5563a58b730..3107209a75e 100644
--- a/erpnext/templates/pages/order.html
+++ b/erpnext/templates/pages/order.html
@@ -151,7 +151,7 @@
{% if doc.terms %}
{{ section["name"] }}
+{{ section["name"] | e }}
{% for item in section["items"] %}
- {{ item.title }}
+ {{ item.title | e }}
{% if item.description -%}
-
{% endfor %}
@@ -35,15 +35,15 @@
{{ item.description }}
+{{ item.description | e }}
{%- endif %}{{ _("Forum Activity") }}
{% for topic in topics %}
-
- {{ topic[post_params.title] }}
+
+ {{ topic[post_params.title] | e }}
{% if topic[post_params.description] -%}
-
{% endfor %}
-
+
{{ topic[post_params.description] }}
+{{ topic[post_params.description] | e }}
{%- endif %}-
{{ doc.terms }}
+{{ frappe.sanitize_html(doc.terms) }}
-
+
{% if doc.tasks %}
diff --git a/erpnext/templates/pages/projects.js b/erpnext/templates/pages/projects.js
index 622ed42f85f..24c16268e61 100644
--- a/erpnext/templates/pages/projects.js
+++ b/erpnext/templates/pages/projects.js
@@ -45,7 +45,7 @@ frappe.ready(function () {
dataType: "json",
data: {
cmd: "erpnext.templates.pages.projects.get_" + item + "_html",
- project: "{{ doc.name }}",
+ project: "{{ doc.name | e }}",
item_status: item_status,
},
success: function (data) {
@@ -80,7 +80,7 @@ frappe.ready(function () {
dataType: "json",
data: {
cmd: "erpnext.templates.pages.projects.get_" + item + "_html",
- project: "{{ doc.name }}",
+ project: "{{ doc.name | e }}",
start: start,
item_status: item_status,
},
@@ -96,7 +96,7 @@ frappe.ready(function () {
var close_item = function (item, item_name) {
var args = {
- project: "{{ doc.name }}",
+ project: "{{ doc.name | e }}",
item_name: item_name,
};
frappe.call({
diff --git a/erpnext/templates/print_formats/includes/item_table_description.html b/erpnext/templates/print_formats/includes/item_table_description.html
index 7569e50b45c..4ad3d6dd1d1 100644
--- a/erpnext/templates/print_formats/includes/item_table_description.html
+++ b/erpnext/templates/print_formats/includes/item_table_description.html
@@ -5,7 +5,7 @@
{% if doc.in_format_data("image") and doc.get("image") and "image" in display_columns -%}
-
+
{{ partner_info.partner_name }}
{{ partner_info.territory }} - {{ partner_info.partner_type }}
diff --git a/erpnext/templates/pages/projects.html b/erpnext/templates/pages/projects.html index e671e91db2f..10466a6cb2f 100644 --- a/erpnext/templates/pages/projects.html +++ b/erpnext/templates/pages/projects.html @@ -34,7 +34,7 @@{{ _("Tasks") }}
- 
+ 
{%- endif %}
diff --git a/erpnext/www/support/index.html b/erpnext/www/support/index.html
index 3c19198cc16..6702e57cae7 100644
--- a/erpnext/www/support/index.html
+++ b/erpnext/www/support/index.html
@@ -53,7 +53,7 @@
{{ favorite_article['title'] }}
{{ favorite_article['description'] }}
{{ item['category'].name }}
{% for article in item['articles'] %}
- {{ article.title }}
+ {{ article.title }}
{% endfor %}