From 79284d8430a2df93cea728f3517cb31dd0fe8492 Mon Sep 17 00:00:00 2001
From: diptanilsaha <diptanil@frappe.io>
Date: Tue, 18 Aug 2026 22:49:39 +0530
Subject: [PATCH] fix: escape item and document values in manufacturing preview
 templates

---
 .../doctype/bom/bom_item_preview.html              |  4 ++--
 .../doctype/work_order/work_order_preview.html     |  4 ++--
 .../doctype/workstation/workstation_job_card.html  | 14 +++++++-------
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/erpnext/manufacturing/doctype/bom/bom_item_preview.html b/erpnext/manufacturing/doctype/bom/bom_item_preview.html
index 06dd4365c67..d3c308bbd8e 100644
--- a/erpnext/manufacturing/doctype/bom/bom_item_preview.html
+++ b/erpnext/manufacturing/doctype/bom/bom_item_preview.html
@@ -20,11 +20,11 @@
 			<hr style="margin: 15px -15px;">
 			<p>
 				{% if data.value && data.value != "BOM" %}
-				<a style="margin-right: 7px; margin-bottom: 7px" class="btn btn-default btn-xs" href="/app/bom/{{ data.value }}">
+				<a style="margin-right: 7px; margin-bottom: 7px" class="btn btn-default btn-xs" href="/app/bom/{{ frappe.utils.escape_html(data.value) }}">
 					{{ __("Open BOM {0}", [data.value.bold()]) }}</a>
 				{% endif %}
 				{% if data.item_code %}
-				<a style="margin-right: 7px; margin-bottom: 7px"  class="btn btn-default btn-xs" href="/app/item/{{ data.item_code }}">
+				<a style="margin-right: 7px; margin-bottom: 7px"  class="btn btn-default btn-xs" href="/app/item/{{ frappe.utils.escape_html(data.item_code) }}">
 					{{ __("Open Item {0}", [data.item_code.bold()]) }}</a>
 				{% endif %}
 			</p>
diff --git a/erpnext/manufacturing/doctype/work_order/work_order_preview.html b/erpnext/manufacturing/doctype/work_order/work_order_preview.html
index 95bdd291ee0..112c8d8250e 100644
--- a/erpnext/manufacturing/doctype/work_order/work_order_preview.html
+++ b/erpnext/manufacturing/doctype/work_order/work_order_preview.html
@@ -20,11 +20,11 @@
 			<hr style="margin: 15px -15px;">
 			<p>
 				{% if data.value %}
-				<a style="margin-right: 7px; margin-bottom: 7px" class="btn btn-default btn-xs" href="#Form/Work Order/{{ data.value }}">
+				<a style="margin-right: 7px; margin-bottom: 7px" class="btn btn-default btn-xs" href="#Form/Work Order/{{ frappe.utils.escape_html(data.value) }}">
 					{{ __("Open Work Order {0}", [data.value.bold()]) }}</a>
 				{% endif %}
 				{% if data.item_code %}
-				<a class="btn btn-default btn-xs" href="#Form/Item/{{ data.item_code }}">
+				<a class="btn btn-default btn-xs" href="#Form/Item/{{ frappe.utils.escape_html(data.item_code) }}">
 					{{ __("Open Item {0}", [data.item_code.bold()]) }}</a>
 				{% endif %}
 			</p>
diff --git a/erpnext/manufacturing/doctype/workstation/workstation_job_card.html b/erpnext/manufacturing/doctype/workstation/workstation_job_card.html
index 1931a60ec09..10cb07ebe10 100644
--- a/erpnext/manufacturing/doctype/workstation/workstation_job_card.html
+++ b/erpnext/manufacturing/doctype/workstation/workstation_job_card.html
@@ -14,10 +14,10 @@
 <div class="form-dashboard-section qrcode-fields col-sm-12 section-body" style="padding-left: 0px;padding-right: 25px;"></div>
 
 {% $.each(data, (idx, d) => { %}
-	<div class="row form-dashboard-section job-card-link form-links border-gray-200" data-name="{{d.name}}">
+	<div class="row form-dashboard-section job-card-link form-links border-gray-200" data-name="{{ frappe.utils.escape_html(d.name) }}">
 		<div class="row form-section" style="width:100%;margin-top:10px">
 			<div class="form-column col-sm-2">
-				<div class="frappe-control bold indicator  {{d.status_colour}}" data-doctype="Job Card" data-name="{{d.name}}" title="{{__(d.status)}}">
+				<div class="frappe-control bold indicator  {{d.status_colour}}" data-doctype="Job Card" data-name="{{ frappe.utils.escape_html(d.name) }}" title="{{__(d.status)}}">
 					{{ d.job_card_link }}
 				</div>
 			</div>
@@ -52,23 +52,23 @@
 				{% } %} -->
 
 			</div>
-			<div class="form-column col-sm-1 btn-start" data-job-card="{{d.name}}">
+			<div class="form-column col-sm-1 btn-start" data-job-card="{{ frappe.utils.escape_html(d.name) }}">
 				<button class="btn btn-default">
 					<span class="menu-item-label" data-label="Start">{{ __('Start') }}</span>
 				</button>
 
 			</div>
-			<div class="form-column col-sm-1 btn-resume" data-job-card="{{d.name}}">
+			<div class="form-column col-sm-1 btn-resume" data-job-card="{{ frappe.utils.escape_html(d.name) }}">
 				<button class="btn btn-default ">
 					<span class="menu-item-label" data-label="Start">{{ __('Resume') }}</span>
 				</button>
 			</div>
-			<div class="form-column col-sm-1 btn-pause" data-job-card="{{d.name}}">
+			<div class="form-column col-sm-1 btn-pause" data-job-card="{{ frappe.utils.escape_html(d.name) }}">
 				<button class="btn btn-default">
 					<span class="menu-item-label" data-label="Start">{{ __('Pause') }}</span>
 				</button>
 			</div>
-			<div class="form-column col-sm-1 btn-complete" data-job-card="{{d.name}}" data-qty="{{d.for_quantity}}">
+			<div class="form-column col-sm-1 btn-complete" data-job-card="{{ frappe.utils.escape_html(d.name) }}" data-qty="{{ d.for_quantity }}">
 				<button class="btn btn-default">
 					<span class="menu-item-label" data-label="Start">{{ __('Complete') }}</span>
 				</button>
@@ -86,7 +86,7 @@
 							</span>
 						</span>
 					</button>
-					<ul class="dropdown-menu dropdown-menu-right menu-actions" role="menu" data-job-card="{{d.name}}">
+					<ul class="dropdown-menu dropdown-menu-right menu-actions" role="menu" data-job-card="{{ frappe.utils.escape_html(d.name) }}">
 						<li>
 							<a class="grey-link dropdown-item btn-transfer-materials" href="#" onclick="return false;">
 								<span class="menu-item-label" data-label="Transfer Materials">{{ __('Transfer Materials') }}</span>