Merge pull request #46003 from akhilnarang/fix-xss

fix(send_message): escape HTML in the text

erpnext/templates/utils.py

@@ -3,6 +3,7 @@
 
 
 import frappe
+from frappe.utils import escape_html
 
 
 @frappe.whitelist(allow_guest=True)
@@ -11,6 +12,8 @@ def send_message(sender, message, subject="Website Query"):
 
 	website_send_message(sender, message, subject)
 
+	message = escape_html(message)
+
 	lead = customer = None
 	customer = frappe.db.sql(
 		"""select distinct dl.link_name from `tabDynamic Link` dl