nsinnovations/erpnext
2
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-08-24 20:46:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #58273 from diptanilsaha/template-output-escaping

Browse Source 
fix: escape interpolated values in portal, print and desk templates
This commit is contained in:
Diptanil Saha
2026-08-18 23:09:09 +05:30
committed by GitHub
parent d91fce90c7 93d6ccd041
commit a667cd7cc6
38 changed files with 136 additions and 122 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
erpnext/accounts/print_format/pos_invoice_with_item_image/pos_invoice_with_item_image.json
View File

File diff suppressed because one or more lines are too long

2
erpnext/accounts/print_format/purchase_invoice_with_item_image/purchase_invoice_with_item_image.json
View File

File diff suppressed because one or more lines are too long

2
erpnext/accounts/print_format/sales_invoice_with_item_image/sales_invoice_with_item_image.json
View File

File diff suppressed because one or more lines are too long

2
erpnext/buying/print_format/purchase_order_with_item_image/purchase_order_with_item_image.json
View File

File diff suppressed because one or more lines are too long

2
erpnext/buying/print_format/request_for_quotation_with_item_image/request_for_quotation_with_item_image.json
View File

File diff suppressed because one or more lines are too long

4
erpnext/manufacturing/doctype/bom/bom.js
View File

@@ -309,7 +309,9 @@ frappe.ui.form.on("BOM", {
frm.set_intro(
__("This is a Template BOM and will be used to make the work order for {0} of the item {1}", [
`<a class="variants-intro">variants</a>`,
`<a href="/app/item/${frm.doc.item}">${frm.doc.item}</a>`,
`<a href="${frappe.utils.get_form_link("Item", frm.doc.item)}">${frappe.utils.escape_html(
frm.doc.item
)}</a>`,
]),
true
);

4
erpnext/manufacturing/doctype/bom/bom_item_preview.html
View File

@@ -20,11 +20,11 @@
<hr style="margin: 15px -15px;">
<p>
{% if data.value && data.value != "BOM" %}
<a style="margin-right: 7px; margin-bottom: 7px" class="btn btn-default btn-xs" href="/app/bom/{{ data.value }}">
<a style="margin-right: 7px; margin-bottom: 7px" class="btn btn-default btn-xs" href="/app/bom/{{ frappe.utils.escape_html(data.value) }}">
{{ __("Open BOM {0}", [data.value.bold()]) }}</a>
{% endif %}
{% if data.item_code %}
<a style="margin-right: 7px; margin-bottom: 7px" class="btn btn-default btn-xs" href="/app/item/{{ data.item_code }}">
<a style="margin-right: 7px; margin-bottom: 7px" class="btn btn-default btn-xs" href="/app/item/{{ frappe.utils.escape_html(data.item_code) }}">
{{ __("Open Item {0}", [data.item_code.bold()]) }}</a>
{% endif %}
</p>

4
erpnext/manufacturing/doctype/work_order/work_order_preview.html
View File

@@ -20,11 +20,11 @@
<hr style="margin: 15px -15px;">
<p>
{% if data.value %}
<a style="margin-right: 7px; margin-bottom: 7px" class="btn btn-default btn-xs" href="#Form/Work Order/{{ data.value }}">
<a style="margin-right: 7px; margin-bottom: 7px" class="btn btn-default btn-xs" href="#Form/Work Order/{{ frappe.utils.escape_html(data.value) }}">
{{ __("Open Work Order {0}", [data.value.bold()]) }}</a>
{% endif %}
{% if data.item_code %}
<a class="btn btn-default btn-xs" href="#Form/Item/{{ data.item_code }}">
<a class="btn btn-default btn-xs" href="#Form/Item/{{ frappe.utils.escape_html(data.item_code) }}">
{{ __("Open Item {0}", [data.item_code.bold()]) }}</a>
{% endif %}
</p>

14
erpnext/manufacturing/doctype/workstation/workstation_job_card.html
View File

@@ -14,10 +14,10 @@
<div class="form-dashboard-section qrcode-fields col-sm-12 section-body" style="padding-left: 0px;padding-right: 25px;"></div>
{% $.each(data, (idx, d) => { %}
<div class="row form-dashboard-section job-card-link form-links border-gray-200" data-name="{{d.name}}">
<div class="row form-dashboard-section job-card-link form-links border-gray-200" data-name="{{ frappe.utils.escape_html(d.name) }}">
<div class="row form-section" style="width:100%;margin-top:10px">
<div class="form-column col-sm-2">
<div class="frappe-control bold indicator {{d.status_colour}}" data-doctype="Job Card" data-name="{{d.name}}" title="{{__(d.status)}}">
<div class="frappe-control bold indicator {{d.status_colour}}" data-doctype="Job Card" data-name="{{ frappe.utils.escape_html(d.name) }}" title="{{__(d.status)}}">
{{ d.job_card_link }}
</div>
</div>
@@ -52,23 +52,23 @@
{% } %} -->
</div>
<div class="form-column col-sm-1 btn-start" data-job-card="{{d.name}}">
<div class="form-column col-sm-1 btn-start" data-job-card="{{ frappe.utils.escape_html(d.name) }}">
<button class="btn btn-default">
<span class="menu-item-label" data-label="Start">{{ __('Start') }}</span>
</button>
</div>
<div class="form-column col-sm-1 btn-resume" data-job-card="{{d.name}}">
<div class="form-column col-sm-1 btn-resume" data-job-card="{{ frappe.utils.escape_html(d.name) }}">
<button class="btn btn-default ">
<span class="menu-item-label" data-label="Start">{{ __('Resume') }}</span>
</button>
</div>
<div class="form-column col-sm-1 btn-pause" data-job-card="{{d.name}}">
<div class="form-column col-sm-1 btn-pause" data-job-card="{{ frappe.utils.escape_html(d.name) }}">
<button class="btn btn-default">
<span class="menu-item-label" data-label="Start">{{ __('Pause') }}</span>
</button>
</div>
<div class="form-column col-sm-1 btn-complete" data-job-card="{{d.name}}" data-qty="{{d.for_quantity}}">
<div class="form-column col-sm-1 btn-complete" data-job-card="{{ frappe.utils.escape_html(d.name) }}" data-qty="{{ d.for_quantity }}">
<button class="btn btn-default">
<span class="menu-item-label" data-label="Start">{{ __('Complete') }}</span>
</button>
@@ -86,7 +86,7 @@
</span>
</span>
</button>
<ul class="dropdown-menu dropdown-menu-right menu-actions" role="menu" data-job-card="{{d.name}}">
<ul class="dropdown-menu dropdown-menu-right menu-actions" role="menu" data-job-card="{{ frappe.utils.escape_html(d.name) }}">
<li>
<a class="grey-link dropdown-item btn-transfer-materials" href="#" onclick="return false;">
<span class="menu-item-label" data-label="Transfer Materials">{{ __('Transfer Materials') }}</span>

5
erpnext/manufacturing/report/production_plan_summary/production_plan_summary.js
View File

@@ -23,7 +23,10 @@ frappe.query_reports["Production Plan Summary"] = {
if (column.fieldname == "item_code") {
var color = data.pending_qty > 0 ? "red" : "green";
value = `<a style='color:${color}' href="/app/item/${data["item_code"]}" data-doctype="Item">${data["item_code"]}</a>`;
value = `<a style='color:${color}' href="${frappe.utils.get_form_link(
"Item",
data["item_code"]
)}" data-doctype="Item">${frappe.utils.escape_html(data["item_code"])}</a>`;
}
return value;

2
erpnext/projects/doctype/project/project_dashboard.html
View File

@@ -3,7 +3,7 @@
{% for d in data %}
<div class="row">
<div class="col-xs-4">
<a class="small time-sheet-link" data-activity_type="{{ d.activity_type || "" }}">
<a class="small time-sheet-link" data-activity_type="{{ frappe.utils.escape_html(d.activity_type || "") }}">
{{ d.activity_type || __("Unknown") }}</a>
</div>
<div class="col-xs-8">

4
erpnext/public/js/templates/call_link.html
View File

@@ -8,7 +8,7 @@
<span class="text-muted"> • {{ comment_when(creation) }}</span>
</div>
<span>
<a class="action-btn" href="/app/call-log/{{ name }}" title="{{ __("Open Call Log") }}">
<a class="action-btn" href="/app/call-log/{{ frappe.utils.escape_html(name) }}" title="{{ __("Open Call Log") }}">
<svg class="icon icon-sm">
<use href="#icon-link" class="like-icon"></use>
</svg>
@@ -34,7 +34,7 @@
<div class="margin-top">
<audio
controls
src="{{ recording_url }}">
src="{{ frappe.utils.escape_html(recording_url) }}">
</audio>
</div>
{% } %}

12
erpnext/public/js/templates/crm_activities.html
View File

@@ -30,13 +30,13 @@
<use href="#icon-message-circle"></use>
</svg>
</span>
<a href="/app/todo/{{ tasks[i].name }}" title="{{ __('Open Task') }}">
<a href="/app/todo/{{ frappe.utils.escape_html(tasks[i].name) }}" title="{{ __('Open Task') }}">
{%= tasks[i].description %}
</a>
</div>
<div class="checkbox">
<input type="checkbox" class="completion-checkbox"
name="{{tasks[i].name}}" title="{{ __('Mark As Closed') }}">
name="{{ frappe.utils.escape_html(tasks[i].name) }}" title="{{ __('Mark As Closed') }}">
</div>
</div>
{% if(tasks[i].date) { %}
@@ -89,7 +89,7 @@
{% } %}
<div class="pl-2 mb-2 mt-2">
<div class="label-area font-md">
<a href="/app/todo/{{ t.name }}" title="{{ __('Open Task') }}">
<a href="/app/todo/{{ frappe.utils.escape_html(t.name) }}" title="{{ __('Open Task') }}">
{%= t.description %}
</a>
</div>
@@ -114,13 +114,13 @@
<use href="#icon-{{ icon_set[events[i].event_category] || 'calendar' }}"></use>
</svg>
</span>
<a href="/app/event/{{ events[i].name }}" title="{{ __('Open Event') }}">
<a href="/app/event/{{ frappe.utils.escape_html(events[i].name) }}" title="{{ __('Open Event') }}">
{%= events[i].subject %}
</a>
</div>
<div class="checkbox">
<input type="checkbox" class="completion-checkbox"
name="{{ events[i].name }}" title="{{ __('Mark As Closed') }}">
name="{{ frappe.utils.escape_html(events[i].name) }}" title="{{ __('Mark As Closed') }}">
</div>
</div>
<div class="text-muted ml-1">
@@ -161,7 +161,7 @@
<use href="#icon-{{ icon_set[event.event_category] || 'calendar' }}"></use>
</svg>
</span>
<a href="/app/event/{{ event.name }}" title="{{ __('Open Event') }}">
<a href="/app/event/{{ frappe.utils.escape_html(event.name) }}" title="{{ __('Open Event') }}">
{%= event.subject %}
</a>
</div>

70
erpnext/public/js/templates/shop_floor_template.html
View File

@@ -704,7 +704,7 @@
<div class="mes-job mes-job--next-up" data-sf-focusable data-kind="job">
<div class="mes-job-image">
{% if (slot.item_image) { %}
<img src="{{ slot.item_image }}" alt="">
<img src="{{ frappe.utils.escape_html(slot.item_image) }}" alt="">
{% } else { %}
<span class="mes-job-image-fallback">{{ frappe.get_abbr(slot.finished_good || slot.production_item, 2) }}</span>
{% } %}
@@ -715,7 +715,7 @@
{% if (slot.is_subcontracted) { %}
<span class="indicator-pill no-indicator-dot purple">{{ __("Subcontract") }}</span>
{% } %}
<a class="mes-job-id" href="/app/job-card/{{ slot.name }}">{{ slot.name }}</a>
<a class="mes-job-id" href="/app/job-card/{{ frappe.utils.escape_html(slot.name) }}">{{ slot.name }}</a>
</div>
<div class="mes-job-sub">
{{ slot.operation }} · {{ format_number(slot.for_quantity, null, 0) }} {{ slot.fg_uom || '' }}
@@ -724,11 +724,11 @@
</div>
<div class="mes-job-next-action">
{% if (slot._materials_ready) { %}
<button class="btn btn-primary mes-btn-start" data-job-card="{{ slot.name }}">
<button class="btn btn-primary mes-btn-start" data-job-card="{{ frappe.utils.escape_html(slot.name) }}">
{{ __("Start Job") }} &rarr;
</button>
{% } else { %}
<button class="btn btn-default mes-btn-transfer" data-job-card="{{ slot.name }}">
<button class="btn btn-default mes-btn-transfer" data-job-card="{{ frappe.utils.escape_html(slot.name) }}">
{{ __("Transfer Materials") }}
</button>
{% } %}
@@ -740,7 +740,7 @@
<div class="mes-job-body">
<div class="mes-job-image">
{% if (slot.item_image) { %}
<img src="{{ slot.item_image }}" alt="">
<img src="{{ frappe.utils.escape_html(slot.item_image) }}" alt="">
{% } else { %}
<span class="mes-job-image-fallback">{{ frappe.get_abbr(slot.finished_good || slot.production_item, 2) }}</span>
{% } %}
@@ -748,7 +748,7 @@
<div class="mes-job-info">
<div class="mes-job-title">{{ slot.finished_good || slot.production_item }}</div>
<div class="mes-job-meta">
<a class="mes-job-id" href="/app/job-card/{{ slot.name }}">{{ slot.name }}</a>
<a class="mes-job-id" href="/app/job-card/{{ frappe.utils.escape_html(slot.name) }}">{{ slot.name }}</a>
<span class="indicator-pill no-indicator-dot {{ slot.status_colour }}">{{ __(slot.status) }}</span>
{% if (slot.is_subcontracted) { %}
<span class="indicator-pill no-indicator-dot purple">{{ __("Subcontract") }}</span>
@@ -758,31 +758,31 @@
{% } else if (slot.qc && slot.qc.status === 'Rejected') { %}
<span class="indicator-pill no-indicator-dot red">{{ __("QC Rejected") }}</span>
{% } else if (slot.qc && slot.qc.required) { %}
<span class="indicator-pill no-indicator-dot orange mes-qc-pill" data-job-card="{{ slot.name }}" style="cursor: pointer;" title="{{ __("Run quality check") }}">{{ __("QC Required") }}</span>
<span class="indicator-pill no-indicator-dot orange mes-qc-pill" data-job-card="{{ frappe.utils.escape_html(slot.name) }}" style="cursor: pointer;" title="{{ __("Run quality check") }}">{{ __("QC Required") }}</span>
{% } else if (slot.qc && slot.qc.has_checklist) { %}
<span class="indicator-pill no-indicator-dot blue mes-qc-pill" data-job-card="{{ slot.name }}" style="cursor: pointer;" title="{{ __("Run quality check") }}">{{ __("QC Available") }}</span>
<span class="indicator-pill no-indicator-dot blue mes-qc-pill" data-job-card="{{ frappe.utils.escape_html(slot.name) }}" style="cursor: pointer;" title="{{ __("Run quality check") }}">{{ __("QC Available") }}</span>
{% } %}
</div>
<div class="mes-job-sub">
{{ slot.operation }} · {{ format_number(slot.total_completed_qty, null, 0) }}/{{ format_number(slot.for_quantity, null, 0) }} {{ slot.fg_uom || '' }}
{% if (slot.work_order) { %} · <a href="/app/work-order/{{ slot.work_order }}">{{ slot.work_order }}</a>{% } %}
{% if (slot.work_order) { %} · <a href="/app/work-order/{{ frappe.utils.escape_html(slot.work_order) }}">{{ slot.work_order }}</a>{% } %}
</div>
</div>
</div>
<div class="mes-job-controls">
<div class="mes-job-timer" data-job-card="{{ slot.name }}">
<div class="mes-job-timer" data-job-card="{{ frappe.utils.escape_html(slot.name) }}">
<span class="h">00</span><span class="colon">:</span><span class="m">00</span><span class="colon">:</span><span class="s">00</span>
</div>
<div class="mes-job-actions">
{% if (slot.is_paused) { %}
<button class="btn btn-primary btn-block mes-btn-resume" data-job-card="{{ slot.name }}">
<button class="btn btn-primary btn-block mes-btn-resume" data-job-card="{{ frappe.utils.escape_html(slot.name) }}">
{{ __("Resume Job") }}
</button>
{% } else { %}
<button class="btn btn-default mes-btn-pause" data-job-card="{{ slot.name }}">
<button class="btn btn-default mes-btn-pause" data-job-card="{{ frappe.utils.escape_html(slot.name) }}">
{{ __("Pause") }}
</button>
<button class="btn btn-primary mes-btn-end-session" data-job-card="{{ slot.name }}" data-qty="{{ slot.for_quantity }}">
<button class="btn btn-primary mes-btn-end-session" data-job-card="{{ frappe.utils.escape_html(slot.name) }}" data-qty="{{ slot.for_quantity }}">
{{ __("End Session") }}
</button>
{% } %}
@@ -800,7 +800,7 @@
{% var ready_n = slot.materials.filter((x) => x.status === 'ready').length; %}
{% var avail_n = slot.materials.filter((x) => x.status === 'available').length; %}
{% var short_n = slot.materials.filter((x) => x.status === 'short').length; %}
<div class="mes-materials-inline{{ short_n > 0 || avail_n > 0 ? ' is-open' : '' }}" data-job-card="{{ slot.name }}">
<div class="mes-materials-inline{{ short_n > 0 || avail_n > 0 ? ' is-open' : '' }}" data-job-card="{{ frappe.utils.escape_html(slot.name) }}">
<div class="mes-materials-summary">
<span class="mes-materials-summary-row">
<span class="mes-materials-summary-left">
@@ -814,7 +814,7 @@
</span>
</span>
{% if (slot.make_material_request && !slot._is_next_up) { %}
<button class="btn btn-default btn-sm mes-btn-transfer mes-materials-summary-btn" data-job-card="{{ slot.name }}" onclick="event.stopPropagation()">
<button class="btn btn-default btn-sm mes-btn-transfer mes-materials-summary-btn" data-job-card="{{ frappe.utils.escape_html(slot.name) }}" onclick="event.stopPropagation()">
{{ __("Transfer Materials") }}
</button>
{% } %}
@@ -843,7 +843,7 @@
{% } %}
{% if (slot && slot.instructions) { %}
<div class="mes-instructions-inline" data-job-card="{{ slot.name }}">
<div class="mes-instructions-inline" data-job-card="{{ frappe.utils.escape_html(slot.name) }}">
<div class="mes-instructions-summary">
<span class="mes-instructions-toggle">{{ frappe.utils.icon("es-line-down", "sm") }}</span>
<span>{{ __("Work Instructions") }}</span>
@@ -889,19 +889,19 @@
</div>
<div class="mes-row-item">
<div class="mes-row-image">
{% if (jc.item_image) { %}<img src="{{ jc.item_image }}" alt="">{% } else { %}<span class="mes-row-image-fallback">{{ frappe.get_abbr(jc.finished_good || jc.production_item, 2) }}</span>{% } %}
{% if (jc.item_image) { %}<img src="{{ frappe.utils.escape_html(jc.item_image) }}" alt="">{% } else { %}<span class="mes-row-image-fallback">{{ frappe.get_abbr(jc.finished_good || jc.production_item, 2) }}</span>{% } %}
</div>
<div class="mes-row-title" title="{{ jc.finished_good || jc.production_item }}">{{ jc.finished_good || jc.production_item }}</div>
<div class="mes-row-title" title="{{ frappe.utils.escape_html(jc.finished_good || jc.production_item) }}">{{ jc.finished_good || jc.production_item }}</div>
</div>
<div class="mes-row-operation">{{ jc.operation }}</div>
<div class="mes-row-id"><a href="/app/job-card/{{ jc.name }}">{{ jc.name }}</a></div>
<div class="mes-row-id"><a href="/app/job-card/{{ frappe.utils.escape_html(jc.name) }}">{{ jc.name }}</a></div>
<div class="mes-row-qty">
{{ format_number(jc.total_completed_qty, null, 0) }} / {{ format_number(jc.for_quantity, null, 0) }}
<span class="mes-row-qty-uom">{{ jc.fg_uom || '' }}</span>
</div>
<div class="mes-row-info"></div>
<div class="mes-row-action">
<button class="btn btn-default btn-sm mes-btn-submit" data-job-card="{{ jc.name }}">
<button class="btn btn-default btn-sm mes-btn-submit" data-job-card="{{ frappe.utils.escape_html(jc.name) }}">
{{ __("Submit") }}
</button>
</div>
@@ -930,19 +930,19 @@
</div>
<div class="mes-row-item">
<div class="mes-row-image">
{% if (jc.item_image) { %}<img src="{{ jc.item_image }}" alt="">{% } else { %}<span class="mes-row-image-fallback">{{ frappe.get_abbr(jc.finished_good || jc.production_item, 2) }}</span>{% } %}
{% if (jc.item_image) { %}<img src="{{ frappe.utils.escape_html(jc.item_image) }}" alt="">{% } else { %}<span class="mes-row-image-fallback">{{ frappe.get_abbr(jc.finished_good || jc.production_item, 2) }}</span>{% } %}
</div>
<div class="mes-row-title" title="{{ jc.finished_good || jc.production_item }}">{{ jc.finished_good || jc.production_item }}</div>
<div class="mes-row-title" title="{{ frappe.utils.escape_html(jc.finished_good || jc.production_item) }}">{{ jc.finished_good || jc.production_item }}</div>
</div>
<div class="mes-row-operation">{{ jc.operation }}</div>
<div class="mes-row-id"><a href="/app/job-card/{{ jc.name }}">{{ jc.name }}</a></div>
<div class="mes-row-id"><a href="/app/job-card/{{ frappe.utils.escape_html(jc.name) }}">{{ jc.name }}</a></div>
<div class="mes-row-qty">
{{ format_number(jc.total_completed_qty, null, 0) }} / {{ format_number(jc.for_quantity, null, 0) }}
<span class="mes-row-qty-uom">{{ jc.fg_uom || '' }}</span>
</div>
<div class="mes-row-info"></div>
<div class="mes-row-action">
<button class="btn btn-default btn-sm mes-btn-make-entry" data-job-card="{{ jc.name }}">
<button class="btn btn-default btn-sm mes-btn-make-entry" data-job-card="{{ frappe.utils.escape_html(jc.name) }}">
{{ __("Make Stock Entry") }}
</button>
</div>
@@ -972,12 +972,12 @@
</div>
<div class="mes-row-item">
<div class="mes-row-image">
{% if (jc.item_image) { %}<img src="{{ jc.item_image }}" alt="">{% } else { %}<span class="mes-row-image-fallback">{{ frappe.get_abbr(jc.finished_good || jc.production_item, 2) }}</span>{% } %}
{% if (jc.item_image) { %}<img src="{{ frappe.utils.escape_html(jc.item_image) }}" alt="">{% } else { %}<span class="mes-row-image-fallback">{{ frappe.get_abbr(jc.finished_good || jc.production_item, 2) }}</span>{% } %}
</div>
<div class="mes-row-title" title="{{ jc.finished_good || jc.production_item }}">{{ jc.finished_good || jc.production_item }}</div>
<div class="mes-row-title" title="{{ frappe.utils.escape_html(jc.finished_good || jc.production_item) }}">{{ jc.finished_good || jc.production_item }}</div>
</div>
<div class="mes-row-operation">{{ jc.operation }}</div>
<div class="mes-row-id"><a href="/app/job-card/{{ jc.name }}">{{ jc.name }}</a></div>
<div class="mes-row-id"><a href="/app/job-card/{{ frappe.utils.escape_html(jc.name) }}">{{ jc.name }}</a></div>
<div class="mes-row-qty">
{{ format_number(jc.for_quantity, null, 0) }}
<span class="mes-row-qty-uom">{{ jc.fg_uom || '' }}</span>
@@ -987,11 +987,11 @@
</div>
<div class="mes-row-action">
{% if (jc._materials_ready) { %}
<button class="btn btn-default btn-sm mes-btn-start" data-job-card="{{ jc.name }}">
<button class="btn btn-default btn-sm mes-btn-start" data-job-card="{{ frappe.utils.escape_html(jc.name) }}">
{{ __("Start") }}
</button>
{% } else { %}
<button class="btn btn-default btn-sm mes-btn-transfer" data-job-card="{{ jc.name }}">
<button class="btn btn-default btn-sm mes-btn-transfer" data-job-card="{{ frappe.utils.escape_html(jc.name) }}">
{{ __("Transfer") }}
</button>
{% } %}
@@ -1022,12 +1022,12 @@
</div>
<div class="mes-row-item">
<div class="mes-row-image">
{% if (jc.item_image) { %}<img src="{{ jc.item_image }}" alt="">{% } else { %}<span class="mes-row-image-fallback">{{ frappe.get_abbr(jc.finished_good || jc.production_item, 2) }}</span>{% } %}
{% if (jc.item_image) { %}<img src="{{ frappe.utils.escape_html(jc.item_image) }}" alt="">{% } else { %}<span class="mes-row-image-fallback">{{ frappe.get_abbr(jc.finished_good || jc.production_item, 2) }}</span>{% } %}
</div>
<div class="mes-row-title" title="{{ jc.finished_good || jc.production_item }}">{{ jc.finished_good || jc.production_item }}</div>
<div class="mes-row-title" title="{{ frappe.utils.escape_html(jc.finished_good || jc.production_item) }}">{{ jc.finished_good || jc.production_item }}</div>
</div>
<div class="mes-row-operation">{{ jc.operation }}</div>
<div class="mes-row-id"><a href="/app/job-card/{{ jc.name }}">{{ jc.name }}</a></div>
<div class="mes-row-id"><a href="/app/job-card/{{ frappe.utils.escape_html(jc.name) }}">{{ jc.name }}</a></div>
<div class="mes-row-qty">
{{ format_number(jc.total_completed_qty, null, 0) }} / {{ format_number(jc.for_quantity, null, 0) }}
<span class="mes-row-qty-uom">{{ jc.fg_uom || '' }}</span>
@@ -1060,12 +1060,12 @@
</div>
<div class="mes-row-item">
<div class="mes-row-image">
{% if (s.item_image) { %}<img src="{{ s.item_image }}" alt="">{% } else { %}<span class="mes-row-image-fallback">{{ frappe.get_abbr(s.finished_good || s.production_item, 2) }}</span>{% } %}
{% if (s.item_image) { %}<img src="{{ frappe.utils.escape_html(s.item_image) }}" alt="">{% } else { %}<span class="mes-row-image-fallback">{{ frappe.get_abbr(s.finished_good || s.production_item, 2) }}</span>{% } %}
</div>
<div class="mes-row-title" title="{{ s.finished_good || s.production_item }}">{{ s.finished_good || s.production_item }}</div>
<div class="mes-row-title" title="{{ frappe.utils.escape_html(s.finished_good || s.production_item) }}">{{ s.finished_good || s.production_item }}</div>
</div>
<div class="mes-row-operation">{{ s.operation }}</div>
<div class="mes-row-id"><a href="/app/job-card/{{ s.name }}">{{ s.name }}</a></div>
<div class="mes-row-id"><a href="/app/job-card/{{ frappe.utils.escape_html(s.name) }}">{{ s.name }}</a></div>
<div class="mes-row-qty">
{{ format_number(s.total_completed_qty, null, 0) }} / {{ format_number(s.for_quantity, null, 0) }}
{% if (cint(s.process_loss_qty) > 0) { %}<div class="mes-row-qty-sub">{{ __("Loss") }}: {{ format_number(s.process_loss_qty, null, 0) }}</div>{% } %}

2
erpnext/selling/print_format/quotation_with_item_image/quotation_with_item_image.json
View File

File diff suppressed because one or more lines are too long

2
erpnext/selling/print_format/sales_order_with_item_image/sales_order_with_item_image.json
View File

File diff suppressed because one or more lines are too long

5
erpnext/stock/doctype/item/item.js
View File

@@ -290,7 +290,10 @@ frappe.ui.form.on("Item", {
if (frm.doc.variant_of) {
frm.set_intro(
__("This Item is a Variant of {0} (Template).", [
`<a href="/app/item/${frm.doc.variant_of}" onclick="location.reload()">${frm.doc.variant_of}</a>`,
`<a href="${frappe.utils.get_form_link(
"Item",
frm.doc.variant_of
)}" onclick="location.reload()">${frappe.utils.escape_html(frm.doc.variant_of)}</a>`,
]),
true
);

5
erpnext/stock/doctype/shipment/shipment.js
View File

@@ -174,7 +174,10 @@ frappe.ui.form.on("Shipment", {
__("Email or Phone/Mobile of the Contact are mandatory to continue.") +
"</br>" +
__("Please set Email/Phone for the contact") +
` <a href='/app/contact/${contact_name}'>${contact_name}</a>`
` <a href="${frappe.utils.get_form_link(
"Contact",
contact_name
)}">${frappe.utils.escape_html(contact_name)}</a>`
);
}
let contact_display = r.message.contact_display;

2
erpnext/stock/print_format/delivery_note_with_item_image/delivery_note_with_item_image.json
View File

File diff suppressed because one or more lines are too long

7
erpnext/stock/report/serial_no_and_batch_traceability/serial_no_and_batch_traceability.js
View File

@@ -68,7 +68,7 @@ frappe.query_reports["Serial No and Batch Traceability"] = {
function getTraceabilityLink({ type, value, original_value, item_code, data, filter_values }) {
if (!value) return value;
const base_url = type === "batch_no" ? "/app/batch/" : "/app/serial-no/";
const link_doctype = type === "batch_no" ? "Batch" : "Serial No";
const filter_list = filter_values[type]; // either batches or serial_nos
let css_class = "ellipsis";
@@ -84,7 +84,10 @@ function getTraceabilityLink({ type, value, original_value, item_code, data, fil
css_class = data.direction === "Backward" ? "ellipsis text-success" : "ellipsis text-danger";
}
return `<a class="${css_class}" href="${base_url}${original_value}">${original_value}</a>`;
return `<a class="${css_class}" href="${frappe.utils.get_form_link(
link_doctype,
original_value
)}">${frappe.utils.escape_html(original_value)}</a>`;
}
function custom_formatter(value, row, column, data, default_formatter) {

2
erpnext/templates/form_grid/includes/visible_cols.html
View File

@@ -3,7 +3,7 @@
if((df.fieldname !== "description" && df.fieldname !== "item_name") && val) { %}
<div class="row">
<div class="col-xs-4 ellipsis">
<strong title="{%= __(df.label, null, df.parent) %}">{%= __(df.label, null, df.parent) %}:</strong>
<strong title="{%= frappe.utils.escape_html(__(df.label, null, df.parent)) %}">{%= frappe.utils.escape_html(__(df.label, null, df.parent)) %}:</strong>
</div>
<div class="col-xs-8">
{%= doc.get_formatted(df.fieldname) %}

12
erpnext/templates/form_grid/item_grid.html
View File

@@ -31,7 +31,7 @@
} %}
<span class="pull-right" title="{%= title %}" style="margin-left: 10px;">
<span class="indicator {{ color }}">
{%= doc.warehouse %}
{%= frappe.utils.escape_html(doc.warehouse) %}
</span>
</span>
{% } %}
@@ -42,14 +42,14 @@
doc.delivered_qty : doc.received_qty;
var pending = flt(doc.qty) - flt(delivered);
%}
<span class="indicator {%= pending>0 ? "orange" : "green" %}">{%= doc.item_code %}</span>
<span class="indicator {%= pending>0 ? "orange" : "green" %}">{%= frappe.utils.escape_html(doc.item_code) %}</span>
{% } else { %}
<strong>{%= doc.item_code %}</strong>
<strong>{%= frappe.utils.escape_html(doc.item_code) %}</strong>
{% } %}
{% if(doc.item_name != doc.item_code && in_list(visible_column_fieldnames, "item_name")) { %}
{% if (doc.item_code) { %}<br>{% } %}
{%= doc.item_name %}{% } %}
{%= frappe.utils.escape_html(doc.item_name) %}{% } %}
{% include "templates/form_grid/includes/visible_cols.html" %}
</div>
@@ -57,7 +57,7 @@
<!-- qty -->
<div class="col-sm-2 hidden-xs text-right">
{%= doc.get_formatted("qty") %}
<span class="small">{%= doc.uom || doc.stock_uom %}</span>
<span class="small">{%= frappe.utils.escape_html(doc.uom || doc.stock_uom) %}</span>
</div>
<!-- rate -->
@@ -84,7 +84,7 @@
{% if (frappe.perm.is_visible("rate", doc, frm.perm)) { %}
<div class="visible-xs text-muted">
{%= doc.get_formatted("qty") %} <small>{%= doc.uom || doc.stock_uom %}</small>
{%= doc.get_formatted("qty") %} <small>{%= frappe.utils.escape_html(doc.uom || doc.stock_uom) %}</small>
x {%= doc.get_formatted("rate") %}
</div>
{% } %}

8
erpnext/templates/form_grid/material_request_grid.html
View File

@@ -11,9 +11,9 @@
{% } else { %}
<div class="row">
<div class="col-sm-4">
<span class="indicator {%= (doc.qty<=doc.ordered_qty) ? "green" : "orange" %}">{%= doc.item_code %}</strong>
<span class="indicator {%= (doc.qty<=doc.ordered_qty) ? "green" : "orange" %}">{%= frappe.utils.escape_html(doc.item_code) %}</strong>
{% if(doc.item_name != doc.item_code) { %}
<br>{%= doc.item_name %}{% } %}
<br>{%= frappe.utils.escape_html(doc.item_name) %}{% } %}
<!-- {% if(doc.item_name != doc.description) { %}
<p>{%= doc.description %}</p>{% } %} -->
{% include "templates/form_grid/includes/visible_cols.html" %}
@@ -35,7 +35,7 @@
{% if(doc.warehouse) { %}
<span class="label label-default" title="{%= __("For Warehouse") %}"
style="margin-right: 10px;">
{%= doc.warehouse %}
{%= frappe.utils.escape_html(doc.warehouse) %}
</span>
{% } %}
</div>
@@ -43,7 +43,7 @@
<!-- qty -->
<div class="col-sm-2 text-right">
{%= doc.get_formatted("qty") %}
<span class="small">{%= doc.uom || doc.stock_uom %}</span>
<span class="small">{%= frappe.utils.escape_html(doc.uom || doc.stock_uom) %}</span>
</div>
</div>
{% } %}

10
erpnext/templates/form_grid/stock_entry_grid.html
View File

@@ -12,9 +12,9 @@
</div>
{% } else { %}
<div class="row">
<div class="col-sm-5 col-xs-4"><strong>{%= doc.item_code %}</strong>
<div class="col-sm-5 col-xs-4"><strong>{%= frappe.utils.escape_html(doc.item_code) %}</strong>
{% if(doc.item_name != doc.item_code) { %}
<br>{%= doc.item_name %}{% } %}
<br>{%= frappe.utils.escape_html(doc.item_name) %}{% } %}
{% include "templates/form_grid/includes/visible_cols.html" %}
</div>
@@ -30,11 +30,11 @@
}
%}
<span class="indicator {{ color }}" title="{{ title }}">
{%= doc.s_warehouse %}</span>
{%= frappe.utils.escape_html(doc.s_warehouse) %}</span>
{% }; %}
{% if(doc.t_warehouse) { %}
<div><span class="indicator {{ doc.docstatus==1 ? "blue" : "grey" }}" title="{{ __("Target" ) }}">
{%= doc.t_warehouse %}</span>
{%= frappe.utils.escape_html(doc.t_warehouse) %}</span>
</div>
{% }; %}
</div>
@@ -42,7 +42,7 @@
<!-- qty -->
<div class="col-sm-2 col-xs-2 text-right">
{%= doc.get_formatted("qty") %}
<br><small>{%= doc.uom || doc.stock_uom %}</small>
<br><small>{%= frappe.utils.escape_html(doc.uom || doc.stock_uom) %}</small>
</div>
<!-- amount -->

4
erpnext/templates/generators/sales_partner.html
View File

@@ -9,8 +9,8 @@
<div class="row">
<div class="col-md-4">
{% if logo %}
<img itemprop="brand" src="{{ logo }}" class="partner-logo"
alt="{{ partner_name }}" title="{{ partner_name }}" />
<img itemprop="brand" src="{{ logo | abs_url | e }}" class="partner-logo"
alt="{{ partner_name | e }}" title="{{ partner_name | e }}" />
<br><br>
{% endif %}
{% if addresses %}

10
erpnext/templates/includes/macros.html
View File

@@ -2,7 +2,7 @@
<div class="product-image product-image-square h-100 rounded
{% if not website_image -%} missing-image {%- endif %} {{ css_class }}"
{% if website_image -%}
style="background-image: url('{{ frappe.utils.quoted(website_image) | abs_url }}');"
style="background-image: url('{{ (frappe.utils.quoted(website_image) | abs_url).replace("'", "%27") }}');"
{%- endif %}>
</div>
{% endmacro %}
@@ -10,7 +10,7 @@
{% macro product_image(website_image, css_class="product-image", alt="", no_border=False) %}
<div class="{{ 'border' if not no_border else ''}} text-center rounded {{ css_class }}" style="overflow: hidden;">
{% if website_image %}
<img itemprop="image" class="website-image h-100 w-100" alt="{{ alt }}" src="{{ frappe.utils.quoted(website_image) | abs_url }}">
<img itemprop="image" class="website-image h-100 w-100" alt="{{ alt | e }}" src="{{ frappe.utils.quoted(website_image) | abs_url }}">
{% else %}
<div class="card-img-top no-image-item">
{{ frappe.utils.get_abbr(alt) or "NA" }}
@@ -22,11 +22,11 @@
{% macro media_image(website_image, name, css_class="") %}
<div class="product-image sidebar-image-wrapper {{ css_class }}">
{% if not website_image -%}
<div class="sidebar-standard-image"> <div class="standard-image" style="background-color: rgb(250, 251, 252);">{{name}}</div> </div>
<div class="sidebar-standard-image"> <div class="standard-image" style="background-color: rgb(250, 251, 252);">{{ name | e }}</div> </div>
{%- endif %}
{% if website_image -%}
<a href="{{ frappe.utils.quoted(website_image) }}">
<img itemprop="image" src="{{ frappe.utils.quoted(website_image) | abs_url }}"
<a href="{{ frappe.utils.quoted(website_image) | abs_url | e }}">
<img itemprop="image" src="{{ frappe.utils.quoted(website_image) | abs_url | e }}"
class="img-responsive img-thumbnail sidebar-image" style="min-height:100%; min-width:100%;">
</a>
{%- endif %}

4
erpnext/templates/includes/projects/project_row.html
View File

@@ -33,11 +33,11 @@
"full_name", "user_image"
], as_dict = True) %}
{% if user_details.user_image %}
<span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name }}">
<span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name | e }}">
<img src="{{ user_details.user_image | e }}">
</span>
{% else %}
<span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name }}">
<span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name | e }}">
<div class='standard-image' style="background-color: #F5F4F4; color: #000;">
{{ frappe.utils.get_abbr(user_details.full_name) }}
</div>

4
erpnext/templates/includes/projects/project_tasks.html
View File

@@ -26,11 +26,11 @@
["full_name", "user_image"],
as_dict = True)%}
{% if user_details.user_image %}
<span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name }}">
<span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name | e }}">
<img src="{{ user_details.user_image | e }}">
</span>
{% else %}
<span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name }}">
<span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name | e }}">
<div class='standard-image' style='background-color: #F5F4F4; color: #000;'>
{{ frappe.utils.get_abbr(user_details.full_name) }}
</div>

4
erpnext/templates/includes/projects/project_timesheets.html
View File

@@ -14,11 +14,11 @@
], as_dict = True)
%}
{% if user_details.user_image %}
<span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name }}">
<span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name | e }}">
<img src="{{ user_details.user_image | e }}">
</span>
{% else %}
<span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name }}">
<span class="avatar avatar-small" style="width:32px; height:32px;" title="{{ user_details.full_name | e }}">
<div class='standard-image' style='background-color: #F5F4F4; color: #000;'>
{{ frappe.utils.get_abbr(user_details.full_name) }}
</div>

8
erpnext/templates/includes/rfq.js
View File

@@ -5,10 +5,10 @@ window.doc={{ doc.as_json() }};
$(document).ready(function() {
new rfq();
doc.supplier = "{{ doc.supplier }}"
doc.currency = "{{ doc.currency }}"
doc.number_format = "{{ doc.number_format }}"
doc.buying_price_list = "{{ doc.buying_price_list }}"
doc.supplier = {{ doc.supplier | tojson }}
doc.currency = {{ doc.currency | tojson }}
doc.number_format = {{ doc.number_format | tojson }}
doc.buying_price_list = {{ doc.buying_price_list | tojson }}
});
rfq = class rfq {

2
erpnext/templates/includes/transaction_row.html
View File

@@ -25,5 +25,5 @@
</div>
{% endif %}
</div>
<a class="transaction-item-link" href="/{{ pathname }}/{{ doc.name }}">Link</a>
<a class="transaction-item-link" href="/{{ pathname | e }}/{{ doc.name | e }}">Link</a>
</div>

14
erpnext/templates/pages/help.html
View File

@@ -17,12 +17,12 @@
{% for section in get_started_sections %}
<div style="margin-bottom: 30px;">
<h2>{{ section["name"] }}</h2>
<h2>{{ section["name"] | e }}</h2>
{% for item in section["items"] %}
<div style="margin: 20px 0;">
<a href="{{ item.link }}"><b>{{ item.title }}</b></a>
<a href="{{ item.link | e }}"><b>{{ item.title | e }}</b></a>
{% if item.description -%}
<p>{{ item.description }}</p>
<p>{{ item.description | e }}</p>
{%- endif %}
</div>
{% endfor %}
@@ -35,15 +35,15 @@
<h2>{{ _("Forum Activity") }}</h2>
{% for topic in topics %}
<div style="margin: 20px 0;">
<a href="{{ topic[post_params.link] }}">
<b>{{ topic[post_params.title] }}</b>
<a href="{{ topic[post_params.link] | e }}">
<b>{{ topic[post_params.title] | e }}</b>
</a>
{% if topic[post_params.description] -%}
<p>{{ topic[post_params.description] }}</p>
<p>{{ topic[post_params.description] | e }}</p>
{%- endif %}
</div>
{% endfor %}
<p><a href="{{ forum_url }}">{{ _("Visit the forums") }}</a></p>
<p><a href="{{ forum_url | e }}">{{ _("Visit the forums") }}</a></p>
<hr>
</div>

2
erpnext/templates/pages/order.html
View File

@@ -151,7 +151,7 @@
{% if doc.terms %}
<div class="terms-and-condition text-muted small">
<hr>
<p>{{ doc.terms }}</p>
<p>{{ frappe.sanitize_html(doc.terms) }}</p>
</div>
{% endif %}
{% endblock %}

8
erpnext/templates/pages/partners.html
View File

@@ -10,14 +10,14 @@
<div class="row">
<div class="col-md-3">
{% if partner_info.logo -%}
<a href="{{ partner_info.route }}">
<img itemprop="brand" src="{{ partner_info.logo }}" class="partner-logo"
alt="{{ partner_info.partner_name }}" title="{{ partner_info.partner_name }}" />
<a href="{{ partner_info.route | abs_url | e }}">
<img itemprop="brand" src="{{ partner_info.logo | abs_url | e }}" class="partner-logo"
alt="{{ partner_info.partner_name | e }}" title="{{ partner_info.partner_name | e }}" />
</a>
{%- endif %}
</div>
<div class="col-md-9">
<a href="{{ partner_info.route }}">
<a href="{{ partner_info.route | abs_url | e }}">
<h4>{{ partner_info.partner_name }}</h4>
</a>
<p style="color: #999">{{ partner_info.territory }} - {{ partner_info.partner_type }}</p>

2
erpnext/templates/pages/projects.html
View File

@@ -34,7 +34,7 @@
<div class="row align-items-center">
<div class="col-sm-6 my-account-header"> <h4>{{ _("Tasks") }}</h4></div>
<div class="col-sm-6 text-right">
<a class="btn btn-secondary btn-light btn-sm" href='/tasks/new?project={{ doc.project_name }}'>{{ _("New task") }}</a>
<a class="btn btn-secondary btn-light btn-sm" href='/tasks/new?project={{ doc.project_name | urlencode }}'>{{ _("New task") }}</a>
</div>
</div>
{% if doc.tasks %}

6
erpnext/templates/pages/projects.js
View File

@@ -45,7 +45,7 @@ frappe.ready(function () {
dataType: "json",
data: {
cmd: "erpnext.templates.pages.projects.get_" + item + "_html",
project: "{{ doc.name }}",
project: "{{ doc.name | e }}",
item_status: item_status,
},
success: function (data) {
@@ -80,7 +80,7 @@ frappe.ready(function () {
dataType: "json",
data: {
cmd: "erpnext.templates.pages.projects.get_" + item + "_html",
project: "{{ doc.name }}",
project: "{{ doc.name | e }}",
start: start,
item_status: item_status,
},
@@ -96,7 +96,7 @@ frappe.ready(function () {
var close_item = function (item, item_name) {
var args = {
project: "{{ doc.name }}",
project: "{{ doc.name | e }}",
item_name: item_name,
};
frappe.call({

2
erpnext/templates/print_formats/includes/item_table_description.html
View File

@@ -5,7 +5,7 @@
{% if doc.in_format_data("image") and doc.get("image") and "image" in display_columns -%}
<div class="pull-left" style="max-width: 40%; margin-right: 10px;">
<img class="print-item-image" src="{{ doc.image }}" alt="">
<img class="print-item-image" src="{{ doc.image | e }}" alt="">
</div>
{%- endif %}

4
erpnext/www/support/index.html
View File

@@ -53,7 +53,7 @@
<h3 class="card-title">{{ favorite_article['title'] }}</h3>
<p class="card-text">{{ favorite_article['description'] }}</p>
</div>
<a href="{{ favorite_article['route'] }}" class="stretched-link"></a>
<a href="{{ favorite_article['route'] | e }}" class="stretched-link"></a>
</div>
</div>
{% endfor %}
@@ -72,7 +72,7 @@
<h5>{{ item['category'].name }}</h5>
<div>
{% for article in item['articles'] %}
<a href="{{ article.route }}" class="mt-2 d-block">{{ article.title }}</a>
<a href="{{ article.route | e }}" class="mt-2 d-block">{{ article.title }}</a>
{% endfor %}
</div>
</div>