From 824ae57e44e6dd98f3fc4ea2d5e71308dc075ea4 Mon Sep 17 00:00:00 2001 From: "mergify[bot]" <37929162+mergify[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 06:52:25 +0000 Subject: [PATCH] fix: escape data in multiple templates (backport #57742) (#57770) Co-authored-by: diptanilsaha --- .../plant_floor/stock_summary_template.html | 10 +++++----- .../doctype/workstation/workstation.py | 2 +- .../js/plant_floor_visual/visual_plant.js | 2 +- erpnext/public/js/templates/item_selector.html | 18 ++++++++++-------- .../templates/visual_plant_floor_template.html | 9 +++++---- 5 files changed, 22 insertions(+), 19 deletions(-) diff --git a/erpnext/manufacturing/doctype/plant_floor/stock_summary_template.html b/erpnext/manufacturing/doctype/plant_floor/stock_summary_template.html index 69c8f44f4e7..d5f252c42c3 100644 --- a/erpnext/manufacturing/doctype/plant_floor/stock_summary_template.html +++ b/erpnext/manufacturing/doctype/plant_floor/stock_summary_template.html @@ -2,9 +2,9 @@
{% if(row.image) { %} - + {% } else { %} -
{{frappe.get_abbr(row.item_code, 2)}}
+
{{frappe.get_abbr(frappe.utils.escape_html(row.item_code), 2)}}
{% } %}
@@ -13,7 +13,7 @@ {% } else { %} {{row.item_link}}

- {{row.item_name}} + {{frappe.utils.escape_html(row.item_name)}}

{% } %} @@ -52,10 +52,10 @@
- +
- +
{% }); %} diff --git a/erpnext/manufacturing/doctype/workstation/workstation.py b/erpnext/manufacturing/doctype/workstation/workstation.py index 3a0fc175142..772318a6446 100644 --- a/erpnext/manufacturing/doctype/workstation/workstation.py +++ b/erpnext/manufacturing/doctype/workstation/workstation.py @@ -513,7 +513,7 @@ def get_workstations(**kwargs): d.color = color_map.get(d.status, "red") d.workstation_link = get_url_to_form("Workstation", d.name) if d.status != "Production": - d.status_image = d.off_status_image + d.status_image = frappe.utils.escape_html(d.off_status_image) d.workstation_off = "workstation-off" return data diff --git a/erpnext/public/js/plant_floor_visual/visual_plant.js b/erpnext/public/js/plant_floor_visual/visual_plant.js index 75b1aa3479f..7ae050b87ab 100644 --- a/erpnext/public/js/plant_floor_visual/visual_plant.js +++ b/erpnext/public/js/plant_floor_visual/visual_plant.js @@ -168,7 +168,7 @@ class VisualPlantFloor { .find(".workstation-image-container") .append( `
${frappe.get_abbr( - data.name, + frappe.utils.escape_html(data.name), 2 )}
` ); diff --git a/erpnext/public/js/templates/item_selector.html b/erpnext/public/js/templates/item_selector.html index 86a15f49072..0839077f57d 100644 --- a/erpnext/public/js/templates/item_selector.html +++ b/erpnext/public/js/templates/item_selector.html @@ -1,17 +1,19 @@
{% for (var i=0; i < data.length; i++) { var item = data[i]; %} + {% const item_name = frappe.utils.escape_html(item.name); %} + {% const item_title = frappe.utils.escape_html(item.item_name || item.name); %} {% if (i % 4 === 0) { %}
{% } %} -
+
- - {{item.item_name || item.name}} + + {{ item_title }}
-
- {%= frappe.get_abbr(item.item_name || item.name) %} + {%= frappe.get_abbr(item_title) %} {% } %} {% if (item.image) { %} - {{item.item_name || item.name}} + {{ item_title }} {% } %}
diff --git a/erpnext/public/js/templates/visual_plant_floor_template.html b/erpnext/public/js/templates/visual_plant_floor_template.html index 273a5406eeb..affd4093782 100644 --- a/erpnext/public/js/templates/visual_plant_floor_template.html +++ b/erpnext/public/js/templates/visual_plant_floor_template.html @@ -1,5 +1,6 @@ {% $.each(workstations, (idx, row) => { %} -
+ {% const row_workstation_name = frappe.utils.escape_html(row.name); %} +
{{row.status}} @@ -10,12 +11,12 @@ {% if(row.status_image) { %} {% } else { %} -
{{frappe.get_abbr(row.name, 2)}}
+
{{frappe.get_abbr(row_workstation_name, 2)}}
{% } %}
- +
{{row.workstation_name}}
-{% }); %} \ No newline at end of file +{% }); %}