From 9a4cb48429e1fb46711f1a654a0ce370c0a8fbac Mon Sep 17 00:00:00 2001
From: diptanilsaha <diptanil@frappe.io>
Date: Tue, 18 Aug 2026 22:49:22 +0530
Subject: [PATCH] fix: escape partner logo url and partner name in partner
 pages

---
 erpnext/templates/generators/sales_partner.html | 4 ++--
 erpnext/templates/pages/partners.html           | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/erpnext/templates/generators/sales_partner.html b/erpnext/templates/generators/sales_partner.html
index df0e04b2441..d0add7ef08c 100644
--- a/erpnext/templates/generators/sales_partner.html
+++ b/erpnext/templates/generators/sales_partner.html
@@ -9,8 +9,8 @@
 	<div class="row">
 		<div class="col-md-4">
 			{% if logo %}
-			<img itemprop="brand" src="{{ logo }}" class="partner-logo"
-				alt="{{ partner_name }}" title="{{ partner_name }}" />
+			<img itemprop="brand" src="{{ logo | abs_url | e }}" class="partner-logo"
+				alt="{{ partner_name | e }}" title="{{ partner_name | e }}" />
 			<br><br>
 			{% endif %}
 			{% if addresses %}
diff --git a/erpnext/templates/pages/partners.html b/erpnext/templates/pages/partners.html
index 72d6a6478f7..71962b90afa 100644
--- a/erpnext/templates/pages/partners.html
+++ b/erpnext/templates/pages/partners.html
@@ -10,14 +10,14 @@
 	<div class="row">
 		<div class="col-md-3">
 			{% if partner_info.logo -%}
-			<a href="{{ partner_info.route }}">
-				<img itemprop="brand" src="{{ partner_info.logo }}" class="partner-logo"
-					alt="{{ partner_info.partner_name }}" title="{{ partner_info.partner_name }}" />
+			<a href="{{ partner_info.route | abs_url | e }}">
+				<img itemprop="brand" src="{{ partner_info.logo | abs_url | e }}" class="partner-logo"
+					alt="{{ partner_info.partner_name | e }}" title="{{ partner_info.partner_name | e }}" />
 			</a>
 			{%- endif %}
 		</div>
 		<div class="col-md-9">
-			<a href="{{ partner_info.route }}">
+			<a href="{{ partner_info.route | abs_url | e }}">
 				<h4>{{ partner_info.partner_name }}</h4>
 			</a>
 			<p style="color: #999">{{ partner_info.territory }} - {{ partner_info.partner_type }}</p>