fix: escape interpolated values in portal, print and desk templates (backport #58273) (#58278)

Co-authored-by: diptanilsaha <diptanil@frappe.io>

erpnext/manufacturing/doctype/bom/bom.js

@@ -309,7 +309,9 @@ frappe.ui.form.on("BOM", {
 			frm.set_intro(
 				__("This is a Template BOM and will be used to make the work order for {0} of the item {1}", [
 					`<a class="variants-intro">variants</a>`,
-					`<a href="/app/item/${frm.doc.item}">${frm.doc.item}</a>`,
+					`<a href="${frappe.utils.get_form_link("Item", frm.doc.item)}">${frappe.utils.escape_html(
+						frm.doc.item
+					)}</a>`,
 				]),
 				true
 			);

erpnext/manufacturing/doctype/bom/bom_item_preview.html

@@ -20,11 +20,11 @@
 			<hr style="margin: 15px -15px;">
 			<p>
 				{% if data.value && data.value != "BOM" %}
-				<a style="margin-right: 7px; margin-bottom: 7px" class="btn btn-default btn-xs" href="/app/bom/{{ data.value }}">
+				<a style="margin-right: 7px; margin-bottom: 7px" class="btn btn-default btn-xs" href="/app/bom/{{ frappe.utils.escape_html(data.value) }}">
 					{{ __("Open BOM {0}", [data.value.bold()]) }}</a>
 				{% endif %}
 				{% if data.item_code %}
-				<a style="margin-right: 7px; margin-bottom: 7px"  class="btn btn-default btn-xs" href="/app/item/{{ data.item_code }}">
+				<a style="margin-right: 7px; margin-bottom: 7px"  class="btn btn-default btn-xs" href="/app/item/{{ frappe.utils.escape_html(data.item_code) }}">
 					{{ __("Open Item {0}", [data.item_code.bold()]) }}</a>
 				{% endif %}
 			</p>

erpnext/manufacturing/doctype/work_order/work_order_preview.html

@@ -20,11 +20,11 @@
 			<hr style="margin: 15px -15px;">
 			<p>
 				{% if data.value %}
-				<a style="margin-right: 7px; margin-bottom: 7px" class="btn btn-default btn-xs" href="#Form/Work Order/{{ data.value }}">
+				<a style="margin-right: 7px; margin-bottom: 7px" class="btn btn-default btn-xs" href="#Form/Work Order/{{ frappe.utils.escape_html(data.value) }}">
 					{{ __("Open Work Order {0}", [data.value.bold()]) }}</a>
 				{% endif %}
 				{% if data.item_code %}
-				<a class="btn btn-default btn-xs" href="#Form/Item/{{ data.item_code }}">
+				<a class="btn btn-default btn-xs" href="#Form/Item/{{ frappe.utils.escape_html(data.item_code) }}">
 					{{ __("Open Item {0}", [data.item_code.bold()]) }}</a>
 				{% endif %}
 			</p>

erpnext/manufacturing/doctype/workstation/workstation_job_card.html

@@ -14,10 +14,10 @@
 <div class="form-dashboard-section qrcode-fields col-sm-12 section-body" style="padding-left: 0px;padding-right: 25px;"></div>
 
 {% $.each(data, (idx, d) => { %}
-	<div class="row form-dashboard-section job-card-link form-links border-gray-200" data-name="{{d.name}}">
+	<div class="row form-dashboard-section job-card-link form-links border-gray-200" data-name="{{ frappe.utils.escape_html(d.name) }}">
 		<div class="row form-section" style="width:100%;margin-top:10px">
 			<div class="form-column col-sm-2">
-				<div class="frappe-control bold indicator  {{d.status_colour}}" data-doctype="Job Card" data-name="{{d.name}}" title="{{__(d.status)}}">
+				<div class="frappe-control bold indicator  {{d.status_colour}}" data-doctype="Job Card" data-name="{{ frappe.utils.escape_html(d.name) }}" title="{{__(d.status)}}">
 					{{ d.job_card_link }}
 				</div>
 			</div>
@@ -52,23 +52,23 @@
 				{% } %} -->
 
 			</div>
-			<div class="form-column col-sm-1 btn-start" data-job-card="{{d.name}}">
+			<div class="form-column col-sm-1 btn-start" data-job-card="{{ frappe.utils.escape_html(d.name) }}">
 				<button class="btn btn-default">
 					<span class="menu-item-label" data-label="Start">{{ __('Start') }}</span>
 				</button>
 
 			</div>
-			<div class="form-column col-sm-1 btn-resume" data-job-card="{{d.name}}">
+			<div class="form-column col-sm-1 btn-resume" data-job-card="{{ frappe.utils.escape_html(d.name) }}">
 				<button class="btn btn-default ">
 					<span class="menu-item-label" data-label="Start">{{ __('Resume') }}</span>
 				</button>
 			</div>
-			<div class="form-column col-sm-1 btn-pause" data-job-card="{{d.name}}">
+			<div class="form-column col-sm-1 btn-pause" data-job-card="{{ frappe.utils.escape_html(d.name) }}">
 				<button class="btn btn-default">
 					<span class="menu-item-label" data-label="Start">{{ __('Pause') }}</span>
 				</button>
 			</div>
-			<div class="form-column col-sm-1 btn-complete" data-job-card="{{d.name}}" data-qty="{{d.for_quantity}}">
+			<div class="form-column col-sm-1 btn-complete" data-job-card="{{ frappe.utils.escape_html(d.name) }}" data-qty="{{ d.for_quantity }}">
 				<button class="btn btn-default">
 					<span class="menu-item-label" data-label="Start">{{ __('Complete') }}</span>
 				</button>
@@ -86,7 +86,7 @@
 							</span>
 						</span>
 					</button>
-					<ul class="dropdown-menu dropdown-menu-right menu-actions" role="menu" data-job-card="{{d.name}}">
+					<ul class="dropdown-menu dropdown-menu-right menu-actions" role="menu" data-job-card="{{ frappe.utils.escape_html(d.name) }}">
 						<li>
 							<a class="grey-link dropdown-item btn-transfer-materials" href="#" onclick="return false;">
 								<span class="menu-item-label" data-label="Transfer Materials">{{ __('Transfer Materials') }}</span>

erpnext/manufacturing/report/production_plan_summary/production_plan_summary.js

@@ -23,7 +23,10 @@ frappe.query_reports["Production Plan Summary"] = {
 
 		if (column.fieldname == "item_code") {
 			var color = data.pending_qty > 0 ? "red" : "green";
-			value = `<a style='color:${color}' href="/app/item/${data["item_code"]}" data-doctype="Item">${data["item_code"]}</a>`;
+			value = `<a style='color:${color}' href="${frappe.utils.get_form_link(
+				"Item",
+				data["item_code"]
+			)}" data-doctype="Item">${frappe.utils.escape_html(data["item_code"])}</a>`;
 		}
 
 		return value;

erpnext/projects/doctype/project/project_dashboard.html

@@ -3,7 +3,7 @@
 {% for d in data %}
 <div class="row">
 	<div class="col-xs-4">
-		<a class="small time-sheet-link" data-activity_type="{{ d.activity_type || "" }}">
+		<a class="small time-sheet-link" data-activity_type="{{ frappe.utils.escape_html(d.activity_type || "") }}">
 			{{ d.activity_type || __("Unknown") }}</a>
 	</div>
 	<div class="col-xs-8">

erpnext/public/js/templates/call_link.html

@@ -8,7 +8,7 @@
 			<span class="text-muted"> • {{ comment_when(creation) }}</span>
 		</div>
 		<span>
-			<a class="action-btn" href="/app/call-log/{{ name }}" title="{{ __("Open Call Log") }}">
+			<a class="action-btn" href="/app/call-log/{{ frappe.utils.escape_html(name) }}" title="{{ __("Open Call Log") }}">
 				<svg class="icon icon-sm">
 					<use href="#icon-link-url" class="like-icon"></use>
 				</svg>
@@ -34,7 +34,7 @@
 		<div class="margin-top">
 				<audio
 					controls
-					src="{{ recording_url }}">
+					src="{{ frappe.utils.escape_html(recording_url) }}">
 				</audio>
 		</div>
 		{% } %}

erpnext/public/js/templates/crm_activities.html

@@ -30,13 +30,13 @@
 										<use href="#icon-small-message"></use>
 									</svg>
 								</span>
-								<a href="/app/todo/{{ tasks[i].name }}" title="{{ __('Open Task') }}">
+								<a href="/app/todo/{{ frappe.utils.escape_html(tasks[i].name) }}" title="{{ __('Open Task') }}">
 									{%= tasks[i].description %}
 								</a>
 							</div>
 							<div class="checkbox">
 								<input type="checkbox" class="completion-checkbox"
-									name="{{tasks[i].name}}" title="{{ __('Mark As Closed') }}">
+									name="{{ frappe.utils.escape_html(tasks[i].name) }}" title="{{ __('Mark As Closed') }}">
 							</div>
 						</div>
 						{% if(tasks[i].date) { %}
@@ -89,7 +89,7 @@
 				{% } %}
 				<div class="pl-2 mb-2 mt-2">
 					<div class="label-area font-md">
-						<a href="/app/todo/{{ t.name }}" title="{{ __('Open Task') }}">
+						<a href="/app/todo/{{ frappe.utils.escape_html(t.name) }}" title="{{ __('Open Task') }}">
 							{%= t.description %}
 						</a>
 					</div>
@@ -114,13 +114,13 @@
                                         <use href="#icon-{{ icon_set[events[i].event_category] || 'calendar' }}"></use>
                                     </svg>
                                 </span>
-                                <a href="/app/event/{{ events[i].name }}" title="{{ __('Open Event') }}">
+                                <a href="/app/event/{{ frappe.utils.escape_html(events[i].name) }}" title="{{ __('Open Event') }}">
                                     {%= events[i].subject %}
                                 </a>
                             </div>
                             <div class="checkbox">
                                 <input type="checkbox" class="completion-checkbox"
-                                    name="{{ events[i].name }}" title="{{ __('Mark As Closed') }}">
+                                    name="{{ frappe.utils.escape_html(events[i].name) }}" title="{{ __('Mark As Closed') }}">
                             </div>
                         </div>
                         <div class="text-muted ml-1">
@@ -161,7 +161,7 @@
 								<use href="#icon-{{ icon_set[event.event_category] || 'calendar' }}"></use>
 							</svg>
 						</span>
-						<a href="/app/event/{{ event.name }}" title="{{ __('Open Event') }}">
+						<a href="/app/event/{{ frappe.utils.escape_html(event.name) }}" title="{{ __('Open Event') }}">
 							{%= event.subject %}
 						</a>
 					</div>

erpnext/stock/doctype/item/item.js

@@ -249,7 +249,10 @@ frappe.ui.form.on("Item", {
 		if (frm.doc.variant_of) {
 			frm.set_intro(
 				__("This Item is a Variant of {0} (Template).", [
-					`<a href="/app/item/${frm.doc.variant_of}" onclick="location.reload()">${frm.doc.variant_of}</a>`,
+					`<a href="${frappe.utils.get_form_link(
+						"Item",
+						frm.doc.variant_of
+					)}" onclick="location.reload()">${frappe.utils.escape_html(frm.doc.variant_of)}</a>`,
 				]),
 				true
 			);

erpnext/stock/doctype/shipment/shipment.js

@@ -174,7 +174,10 @@ frappe.ui.form.on("Shipment", {
 							__("Email or Phone/Mobile of the Contact are mandatory to continue.") +
 								"</br>" +
 								__("Please set Email/Phone for the contact") +
-								` <a href='/app/contact/${contact_name}'>${contact_name}</a>`
+								` <a href="${frappe.utils.get_form_link(
+									"Contact",
+									contact_name
+								)}">${frappe.utils.escape_html(contact_name)}</a>`
 						);
 					}
 					let contact_display = r.message.contact_display;

erpnext/stock/report/serial_no_and_batch_traceability/serial_no_and_batch_traceability.js

@@ -68,7 +68,7 @@ frappe.query_reports["Serial No and Batch Traceability"] = {
 function getTraceabilityLink({ type, value, original_value, item_code, data, filter_values }) {
 	if (!value) return value;
 
-	const base_url = type === "batch_no" ? "/app/batch/" : "/app/serial-no/";
+	const link_doctype = type === "batch_no" ? "Batch" : "Serial No";
 	const filter_list = filter_values[type]; // either batches or serial_nos
 
 	let css_class = "ellipsis";
@@ -84,7 +84,10 @@ function getTraceabilityLink({ type, value, original_value, item_code, data, fil
 		css_class = data.direction === "Backward" ? "ellipsis text-success" : "ellipsis text-danger";
 	}
 
-	return `<a class="${css_class}" href="${base_url}${original_value}">${original_value}</a>`;
+	return `<a class="${css_class}" href="${frappe.utils.get_form_link(
+		link_doctype,
+		original_value
+	)}">${frappe.utils.escape_html(original_value)}</a>`;
 }
 
 function custom_formatter(value, row, column, data, default_formatter) {

erpnext/templates/form_grid/includes/visible_cols.html

@@ -3,7 +3,7 @@
 	if((df.fieldname !== "description" && df.fieldname !== "item_name") && val) { %}
 		<div class="row">
 			<div class="col-xs-4 ellipsis">
-				<strong title="{%= __(df.label, null, df.parent) %}">{%= __(df.label, null, df.parent) %}:</strong>
+				<strong title="{%= frappe.utils.escape_html(__(df.label, null, df.parent)) %}">{%= frappe.utils.escape_html(__(df.label, null, df.parent)) %}:</strong>
 			</div>
 			<div class="col-xs-8">
 				{%= doc.get_formatted(df.fieldname) %}

erpnext/templates/form_grid/item_grid.html

@@ -31,7 +31,7 @@
                 } %}
 				<span class="pull-right" title="{%= title %}" style="margin-left: 10px;">
 					<span class="indicator {{ color }}">
-						{%= doc.warehouse %}
+						{%= frappe.utils.escape_html(doc.warehouse) %}
 					</span>
 				</span>
 			{% } %}
@@ -42,14 +42,14 @@
                                                 doc.delivered_qty : doc.received_qty;
                                 var pending = flt(doc.qty) - flt(delivered);
                                 %}
-                <span class="indicator {%= pending>0 ? "orange" : "green" %}">{%= doc.item_code %}</span>
+                <span class="indicator {%= pending>0 ? "orange" : "green" %}">{%= frappe.utils.escape_html(doc.item_code) %}</span>
 			{% } else { %}
-                <strong>{%= doc.item_code %}</strong>
+                <strong>{%= frappe.utils.escape_html(doc.item_code) %}</strong>
             {% } %}
 
 			{% if(doc.item_name != doc.item_code && in_list(visible_column_fieldnames, "item_name")) { %}
 				{% if (doc.item_code) { %}<br>{% } %}
-                {%= doc.item_name %}{% } %}
+                {%= frappe.utils.escape_html(doc.item_name) %}{% } %}
 
 			{% include "templates/form_grid/includes/visible_cols.html" %}
 		</div>
@@ -57,7 +57,7 @@
 		<!-- qty -->
 		<div class="col-sm-2 hidden-xs text-right">
 			{%= doc.get_formatted("qty") %}
-            <span class="small">{%= doc.uom || doc.stock_uom %}</span>
+            <span class="small">{%= frappe.utils.escape_html(doc.uom || doc.stock_uom) %}</span>
 		</div>
 
 		<!-- rate -->
@@ -84,7 +84,7 @@
 
 			{% if (frappe.perm.is_visible("rate", doc, frm.perm)) { %}
 			<div class="visible-xs text-muted">
-				{%= doc.get_formatted("qty") %} <small>{%= doc.uom || doc.stock_uom %}</small>
+				{%= doc.get_formatted("qty") %} <small>{%= frappe.utils.escape_html(doc.uom || doc.stock_uom) %}</small>
 				x {%= doc.get_formatted("rate") %}
 			</div>
 			{% } %}

erpnext/templates/form_grid/material_request_grid.html

@@ -11,9 +11,9 @@
 {% } else { %}
 	<div class="row">
 		<div class="col-sm-4">
-            <span class="indicator {%= (doc.qty<=doc.ordered_qty) ? "green" : "orange" %}">{%= doc.item_code %}</strong>
+            <span class="indicator {%= (doc.qty<=doc.ordered_qty) ? "green" : "orange" %}">{%= frappe.utils.escape_html(doc.item_code) %}</strong>
 			{% if(doc.item_name != doc.item_code) { %}
-				<br>{%= doc.item_name %}{% } %}
+				<br>{%= frappe.utils.escape_html(doc.item_name) %}{% } %}
             <!-- {% if(doc.item_name != doc.description) { %}
                 <p>{%= doc.description %}</p>{% } %} -->
 			{% include "templates/form_grid/includes/visible_cols.html" %}
@@ -35,7 +35,7 @@
 			{% if(doc.warehouse) { %}
 				<span class="label label-default" title="{%= __("For Warehouse") %}"
                     style="margin-right: 10px;">
-					{%= doc.warehouse %}
+					{%= frappe.utils.escape_html(doc.warehouse) %}
 				</span>
 			{% } %}
         </div>
@@ -43,7 +43,7 @@
 		<!-- qty -->
 		<div class="col-sm-2 text-right">
 			{%= doc.get_formatted("qty") %}
-			<span class="small">{%= doc.uom || doc.stock_uom %}</span>
+			<span class="small">{%= frappe.utils.escape_html(doc.uom || doc.stock_uom) %}</span>
 		</div>
 	</div>
 {% } %}

erpnext/templates/form_grid/stock_entry_grid.html

@@ -12,9 +12,9 @@
 	</div>
 {% } else { %}
 	<div class="row">
-		<div class="col-sm-5 col-xs-4"><strong>{%= doc.item_code %}</strong>
+		<div class="col-sm-5 col-xs-4"><strong>{%= frappe.utils.escape_html(doc.item_code) %}</strong>
 			{% if(doc.item_name != doc.item_code) { %}
-				<br>{%= doc.item_name %}{% } %}
+				<br>{%= frappe.utils.escape_html(doc.item_name) %}{% } %}
 			{% include "templates/form_grid/includes/visible_cols.html" %}
 		</div>
 
@@ -30,11 +30,11 @@
 					}
 				%}
 				 <span class="indicator {{ color }}" title="{{ title }}">
-					 {%= doc.s_warehouse %}</span>
+					 {%= frappe.utils.escape_html(doc.s_warehouse) %}</span>
             {% }; %}
 			{% if(doc.t_warehouse) { %}
 				<div><span class="indicator {{ doc.docstatus==1 ? "blue" : "grey" }}" title="{{ __("Target" ) }}">
-					{%= doc.t_warehouse %}</span>
+					{%= frappe.utils.escape_html(doc.t_warehouse) %}</span>
 				</div>
             {% }; %}
 		</div>
@@ -42,7 +42,7 @@
 		<!-- qty -->
 		<div class="col-sm-2 col-xs-2 text-right">
 			{%= doc.get_formatted("qty") %}
-			<br><small>{%= doc.uom || doc.stock_uom %}</small>
+			<br><small>{%= frappe.utils.escape_html(doc.uom || doc.stock_uom) %}</small>
 		</div>
 
 		<!-- amount -->

erpnext/templates/generators/sales_partner.html

@@ -9,8 +9,8 @@
 	<div class="row">
 		<div class="col-md-4">
 			{% if logo %}
-			<img itemprop="brand" src="{{ logo }}" class="partner-logo"
+			<img itemprop="brand" src="{{ logo | abs_url | e }}" class="partner-logo"
-				alt="{{ partner_name }}" title="{{ partner_name }}" />
+				alt="{{ partner_name | e }}" title="{{ partner_name | e }}" />
 			<br><br>
 			{% endif %}
 			{% if addresses %}

erpnext/templates/includes/macros.html

@@ -2,7 +2,7 @@
 <div class="product-image product-image-square h-100 rounded
 	{% if not website_image -%} missing-image {%- endif %} {{ css_class }}"
 	{% if website_image -%}
-	style="background-image: url('{{ frappe.utils.quoted(website_image) | abs_url }}');"
+	style="background-image: url('{{ (frappe.utils.quoted(website_image) | abs_url).replace("'", "%27") }}');"
 	{%- endif %}>
 </div>
 {% endmacro %}
@@ -10,7 +10,7 @@
 {% macro product_image(website_image, css_class="product-image", alt="", no_border=False) %}
 	<div class="{{ 'border' if not no_border else ''}} text-center rounded {{ css_class }}" style="overflow: hidden;">
 		{% if website_image %}
-			<img itemprop="image" class="website-image h-100 w-100" alt="{{ alt }}" src="{{ frappe.utils.quoted(website_image) | abs_url }}">
+			<img itemprop="image" class="website-image h-100 w-100" alt="{{ alt | e }}" src="{{ frappe.utils.quoted(website_image) | abs_url }}">
 		{% else %}
 			<div class="card-img-top no-image-item">
 				{{ frappe.utils.get_abbr(alt) or "NA" }}
@@ -22,11 +22,11 @@
 {% macro media_image(website_image, name, css_class="") %}
 	<div class="product-image sidebar-image-wrapper {{ css_class }}">
 		{% if not website_image -%}
-		<div class="sidebar-standard-image"> <div class="standard-image" style="background-color: rgb(250, 251, 252);">{{name}}</div> </div>
+		<div class="sidebar-standard-image"> <div class="standard-image" style="background-color: rgb(250, 251, 252);">{{ name | e }}</div> </div>
 		{%- endif %}
 		{% if website_image -%}
-			<a href="{{ frappe.utils.quoted(website_image) }}">
+			<a href="{{ frappe.utils.quoted(website_image) | abs_url | e }}">
-				<img itemprop="image" src="{{ frappe.utils.quoted(website_image) | abs_url }}"
+				<img itemprop="image" src="{{ frappe.utils.quoted(website_image) | abs_url | e }}"
 					class="img-responsive img-thumbnail sidebar-image" style="min-height:100%; min-width:100%;">
 			</a>
 		{%- endif %}

erpnext/templates/includes/projects/project_row.html

@@ -33,11 +33,11 @@
                 "full_name", "user_image"
               ], as_dict = True) %}
             {% if user_details.user_image %}
-              <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name }}">
+              <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name | e }}">
                 <img src="{{ user_details.user_image | e }}">
               </span>
             {% else %}
-              <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name }}">
+              <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name | e }}">
                 <div class='standard-image' style="background-color: #F5F4F4; color: #000;">
                   {{ frappe.utils.get_abbr(user_details.full_name) }}
                 </div>

erpnext/templates/includes/projects/project_tasks.html

@@ -26,11 +26,11 @@
 		["full_name", "user_image"],
 		as_dict = True)%}
         {% if user_details.user_image %}
-          <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name }}">
+          <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name | e }}">
             <img src="{{ user_details.user_image | e }}">
           </span>
         {% else %}
-          <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name }}">
+          <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name | e }}">
             <div class='standard-image' style='background-color: #F5F4F4; color: #000;'>
               {{ frappe.utils.get_abbr(user_details.full_name) }}
             </div>

erpnext/templates/includes/projects/project_timesheets.html

@@ -14,11 +14,11 @@
           ], as_dict = True)
  		    %}
         {% if user_details.user_image %}
-          <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name }}">
+          <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name | e }}">
             <img src="{{ user_details.user_image | e }}">
           </span>
         {% else %}
-          <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name }}">
+          <span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name | e }}">
             <div class='standard-image' style='background-color: #F5F4F4; color: #000;'>
               {{ frappe.utils.get_abbr(user_details.full_name) }}
             </div>

erpnext/templates/includes/rfq.js

@@ -5,10 +5,10 @@ window.doc={{ doc.as_json() }};
 
 $(document).ready(function() {
 	new rfq();
-	doc.supplier = "{{ doc.supplier }}"
+	doc.supplier = {{ doc.supplier | tojson }}
-	doc.currency = "{{ doc.currency }}"
+	doc.currency = {{ doc.currency | tojson }}
-	doc.number_format = "{{ doc.number_format }}"
+	doc.number_format = {{ doc.number_format | tojson }}
-	doc.buying_price_list = "{{ doc.buying_price_list }}"
+	doc.buying_price_list = {{ doc.buying_price_list | tojson }}
 });
 
 rfq = class rfq {

erpnext/templates/includes/transaction_row.html

@@ -25,5 +25,5 @@
 			</div>
 		{% endif %}
 	</div>
-	<a class="transaction-item-link" href="/{{ pathname }}/{{ doc.name }}">Link</a>
+	<a class="transaction-item-link" href="/{{ pathname | e }}/{{ doc.name | e }}">Link</a>
 </div>

erpnext/templates/pages/help.html

@@ -17,12 +17,12 @@
 
 {% for section in get_started_sections %}
 <div style="margin-bottom: 30px;">
-	<h2>{{ section["name"] }}</h2>
+	<h2>{{ section["name"] | e }}</h2>
 	{% for item in section["items"] %}
 	<div style="margin: 20px 0;">
-		<a href="{{ item.link }}"><b>{{ item.title }}</b></a>
+		<a href="{{ item.link | e }}"><b>{{ item.title | e }}</b></a>
 		{% if item.description -%}
-		<p>{{ item.description }}</p>
+		<p>{{ item.description | e }}</p>
 		{%- endif %}
 	</div>
 	{% endfor %}
@@ -35,15 +35,15 @@
 	<h2>{{ _("Forum Activity") }}</h2>
 	{% for topic in topics %}
 	<div style="margin: 20px 0;">
-		<a href="{{ topic[post_params.link] }}">
+		<a href="{{ topic[post_params.link] | e }}">
-			<b>{{ topic[post_params.title] }}</b>
+			<b>{{ topic[post_params.title] | e }}</b>
 		</a>
 		{% if topic[post_params.description] -%}
-		<p>{{ topic[post_params.description] }}</p>
+		<p>{{ topic[post_params.description] | e }}</p>
 		{%- endif %}
 	</div>
 	{% endfor %}
-	<p><a href="{{ forum_url }}">{{ _("Visit the forums") }}</a></p>
+	<p><a href="{{ forum_url | e }}">{{ _("Visit the forums") }}</a></p>
 	<hr>
 </div>
 

erpnext/templates/pages/order.html

@@ -151,7 +151,7 @@
 	{% if doc.terms %}
 		<div class="terms-and-condition text-muted small">
 			<hr>
-			<p>{{ doc.terms }}</p>
+			<p>{{ frappe.sanitize_html(doc.terms) }}</p>
 		</div>
 	{% endif %}
 {% endblock %}

erpnext/templates/pages/partners.html

@@ -10,14 +10,14 @@
 	<div class="row">
 		<div class="col-md-3">
 			{% if partner_info.logo -%}
-			<a href="{{ partner_info.route }}">
+			<a href="{{ partner_info.route | abs_url | e }}">
-				<img itemprop="brand" src="{{ partner_info.logo }}" class="partner-logo"
+				<img itemprop="brand" src="{{ partner_info.logo | abs_url | e }}" class="partner-logo"
-					alt="{{ partner_info.partner_name }}" title="{{ partner_info.partner_name }}" />
+					alt="{{ partner_info.partner_name | e }}" title="{{ partner_info.partner_name | e }}" />
 			</a>
 			{%- endif %}
 		</div>
 		<div class="col-md-9">
-			<a href="{{ partner_info.route }}">
+			<a href="{{ partner_info.route | abs_url | e }}">
 				<h4>{{ partner_info.partner_name }}</h4>
 			</a>
 			<p style="color: #999">{{ partner_info.territory }} - {{ partner_info.partner_type }}</p>

erpnext/templates/pages/projects.html

@@ -34,7 +34,7 @@
   <div class="row align-items-center">
     <div class="col-sm-6 my-account-header"> <h4>{{ _("Tasks") }}</h4></div>
     <div class="col-sm-6 text-right">
-      <a class="btn btn-secondary btn-light btn-sm" href='/tasks/new?project={{ doc.project_name }}'>{{ _("New task") }}</a>
+      <a class="btn btn-secondary btn-light btn-sm" href='/tasks/new?project={{ doc.project_name | urlencode }}'>{{ _("New task") }}</a>
     </div>
   </div>
   {% if doc.tasks %}

erpnext/templates/pages/projects.js

@@ -45,7 +45,7 @@ frappe.ready(function () {
 			dataType: "json",
 			data: {
 				cmd: "erpnext.templates.pages.projects.get_" + item + "_html",
-				project: "{{ doc.name }}",
+				project: "{{ doc.name | e }}",
 				item_status: item_status,
 			},
 			success: function (data) {
@@ -80,7 +80,7 @@ frappe.ready(function () {
 			dataType: "json",
 			data: {
 				cmd: "erpnext.templates.pages.projects.get_" + item + "_html",
-				project: "{{ doc.name }}",
+				project: "{{ doc.name | e }}",
 				start: start,
 				item_status: item_status,
 			},
@@ -96,7 +96,7 @@ frappe.ready(function () {
 
 	var close_item = function (item, item_name) {
 		var args = {
-			project: "{{ doc.name }}",
+			project: "{{ doc.name | e }}",
 			item_name: item_name,
 		};
 		frappe.call({

erpnext/templates/print_formats/includes/item_table_description.html

@@ -5,7 +5,7 @@
 
 {% if doc.in_format_data("image") and doc.get("image") and "image" in display_columns -%}
 <div class="pull-left" style="max-width: 40%; margin-right: 10px;">
-	<img class="print-item-image" src="{{ doc.image }}" alt="">
+	<img class="print-item-image" src="{{ doc.image | e }}" alt="">
 </div>
 {%- endif %}
 

erpnext/www/support/index.html

@@ -53,7 +53,7 @@
 						<h3 class="card-title">{{ favorite_article['title'] }}</h3>
 						<p class="card-text">{{ favorite_article['description'] }}</p>
 					</div>
-					<a href="{{ favorite_article['route'] }}" class="stretched-link"></a>
+					<a href="{{ favorite_article['route'] | e }}" class="stretched-link"></a>
 				</div>
 			</div>
 			{% endfor %}
@@ -72,7 +72,7 @@
 				<h5>{{ item['category'].name }}</h5>
 				<div>
 					{% for article in item['articles'] %}
-					<a href="{{ article.route }}" class="mt-2 d-block">{{ article.title }}</a>
+					<a href="{{ article.route | e }}" class="mt-2 d-block">{{ article.title }}</a>
 					{% endfor %}
 				</div>
 			</div>