fix: escape data in multiple templates (backport #57742) (#57770)

Co-authored-by: diptanilsaha <diptanil@frappe.io>

erpnext/manufacturing/doctype/plant_floor/stock_summary_template.html

@@ -2,9 +2,9 @@
 <div class="row" style="border-bottom:1px solid var(--border-color); padding:4px 5px; margin-top: 3px;margin-bottom: 3px;">
 	<div class="col-sm-1">
 		{% if(row.image) { %}
-			<img style="width:50px;height:50px;" src="{{row.image}}">
+			<img style="width:50px;height:50px;" src="{{frappe.utils.escape_html(row.image)}}">
 		{% } else { %}
-			<div style="width:50px;height:50px;background-color:var(--control-bg);text-align:center;padding-top:15px">{{frappe.get_abbr(row.item_code, 2)}}</div>
+			<div style="width:50px;height:50px;background-color:var(--control-bg);text-align:center;padding-top:15px">{{frappe.get_abbr(frappe.utils.escape_html(row.item_code), 2)}}</div>
 		{% } %}
 	</div>
 	<div class="col-sm-3">
@@ -13,7 +13,7 @@
 		{% } else { %}
 			{{row.item_link}}
 			<p>
-				{{row.item_name}}
+				{{frappe.utils.escape_html(row.item_name)}}
 			</p>
 		{% } %}
 
@@ -52,10 +52,10 @@
 		</span>
 	</div>
 	<div class="col-sm-1">
-		<button style="margin-left: 7px;" class="btn btn-default btn-xs btn-add" data-item-code="{{ escape(row.item_code) }}">{{ __("Add") }}</button>
+		<button style="margin-left: 7px;" class="btn btn-default btn-xs btn-add" data-item-code="{{ frappe.utils.escape_html(row.item_code) }}">{{ __("Add") }}</button>
 	</div>
 	<div class="col-sm-1">
-		<button style="margin-left: 7px;" class="btn btn-default btn-xs btn-move" data-item-code="{{ escape(row.item_code) }}">{{ __("Move") }}</button>
+		<button style="margin-left: 7px;" class="btn btn-default btn-xs btn-move" data-item-code="{{ frappe.utils.escape_html(row.item_code) }}">{{ __("Move") }}</button>
 	</div>
 </div>
 {% }); %}

erpnext/manufacturing/doctype/workstation/workstation.py

@@ -513,7 +513,7 @@ def get_workstations(**kwargs):
 		d.color = color_map.get(d.status, "red")
 		d.workstation_link = get_url_to_form("Workstation", d.name)
 		if d.status != "Production":
-			d.status_image = d.off_status_image
+			d.status_image = frappe.utils.escape_html(d.off_status_image)
 			d.workstation_off = "workstation-off"
 
 	return data

erpnext/public/js/plant_floor_visual/visual_plant.js

@@ -168,7 +168,7 @@ class VisualPlantFloor {
 				.find(".workstation-image-container")
 				.append(
 					`<div class="workstation-image-cls workstation-abbr" style="margin:6px; height:82px">${frappe.get_abbr(
-						data.name,
+						frappe.utils.escape_html(data.name),
 						2
 					)}</div>`
 				);

erpnext/public/js/templates/item_selector.html

@@ -1,17 +1,19 @@
 <div class="app-listing item-list image-view-container item-selector">
 {% for (var i=0; i < data.length; i++) { var item = data[i]; %}
+	{% const item_name = frappe.utils.escape_html(item.name); %}
+	{% const item_title = frappe.utils.escape_html(item.item_name || item.name); %}
 	{% if (i % 4 === 0) { %}<div class="image-view-row">{% } %}
-	<div class="image-view-item" data-name="{{ item.name }}">
+	<div class="image-view-item" data-name="{{ item_name }}">
 		<div class="image-view-header doclist-row">
 			<div class="list-value">
-				<a class="grey list-id" data-name="{{item.name}}"
+				<a class="grey list-id" data-name="{{ item_name }}"
-					title="{{ item.item_name || item.name}}">
+					title="{{ item_title }}">
-					{{item.item_name || item.name}}</a>
+					{{ item_title }}</a>
 			</div>
 		</div>
 		<div class="image-view-body">
-			<a  data-item-code="{{ item.name }}"
+			<a  data-item-code="{{ item_name }}"
-				title="{{ item.item_name || item.name }}"
+				title="{{ item_title }}"
 			>
 				<div class="image-field"
 					style="
@@ -22,11 +24,11 @@
 				>
 					{% if (!item.image) { %}
 					<span class="placeholder-text">
-						{%= frappe.get_abbr(item.item_name || item.name) %}
+						{%= frappe.get_abbr(item_title) %}
 					</span>
 					{% } %}
 					{% if (item.image) { %}
-					<img src="{{ item.image }}" alt="{{item.item_name || item.name}}">
+					<img src="{{ frappe.utils.escape_html(item.image) }}" alt="{{ item_title }}">
 					{% } %}
 				</div>
 			</a>

erpnext/public/js/templates/visual_plant_floor_template.html

@@ -1,5 +1,6 @@
 {% $.each(workstations, (idx, row) => { %}
-	<div class="workstation-wrapper" data-workstation="{{row.name}}">
+	{% const row_workstation_name = frappe.utils.escape_html(row.name); %}
+	<div class="workstation-wrapper" data-workstation="{{row_workstation_name}}">
 		<div class="workstation-status text-left" style="">
 			<span class="indicator-pill no-indicator-dot whitespace-nowrap {{row.color}}" style="margin: 8px 0px 0px 8px;">
 				<span class="workstation-status-title" style="font-size:10px">{{row.status}}</span>
@@ -10,12 +11,12 @@
 				{% if(row.status_image) { %}
 					<img class="workstation-image-cls" src="{{row.status_image}}">
 				{% } else { %}
-					<div class="workstation-image-cls workstation-abbr" style="margin:6px; height:82px">{{frappe.get_abbr(row.name, 2)}}</div>
+					<div class="workstation-image-cls workstation-abbr" style="margin:6px; height:82px">{{frappe.get_abbr(row_workstation_name, 2)}}</div>
 				{% } %}
 			</div>
-			<span class="ellipsis" title="{{row.name}}">
+			<span class="ellipsis" title="{{row_workstation_name}}">
 				<div style="font-size:11px; text-align:center;padding-bottom:8px">{{row.workstation_name}}</div>
 			</span>
 		</div>
 	</div>
-{% }); %}
+{% }); %}