From af7953a933189fba01bc00a0408bb40d655c645c Mon Sep 17 00:00:00 2001 From: "mergify[bot]" <37929162+mergify[bot]@users.noreply.github.com> Date: Sun, 9 Aug 2026 00:04:14 +0530 Subject: [PATCH] fix: set `restrict_globals=True` in `frappe.render_template` (backport #57899) (#57901) Co-authored-by: Diptanil Saha --- erpnext/accounts/custom/address.py | 4 +++- erpnext/accounts/doctype/payment_request/payment_request.py | 2 +- .../doctype/request_for_quotation/request_for_quotation.py | 4 ++-- erpnext/crm/doctype/contract_template/contract_template.py | 4 ++-- erpnext/crm/doctype/email_campaign/email_campaign.py | 4 ++-- erpnext/stock/doctype/delivery_trip/delivery_trip.py | 2 +- 6 files changed, 11 insertions(+), 9 deletions(-) diff --git a/erpnext/accounts/custom/address.py b/erpnext/accounts/custom/address.py index 246aee3b0ec..53b304b6916 100644 --- a/erpnext/accounts/custom/address.py +++ b/erpnext/accounts/custom/address.py @@ -65,4 +65,6 @@ def get_shipping_address(company, address=None): if address: address_as_dict = address[0] name, address_template = get_address_templates(address_as_dict) - return address_as_dict.get("name"), frappe.render_template(address_template, address_as_dict) + return address_as_dict.get("name"), frappe.render_template( + address_template, address_as_dict, restrict_globals=True + ) diff --git a/erpnext/accounts/doctype/payment_request/payment_request.py b/erpnext/accounts/doctype/payment_request/payment_request.py index f5dc2fb479e..218ab9196f3 100644 --- a/erpnext/accounts/doctype/payment_request/payment_request.py +++ b/erpnext/accounts/doctype/payment_request/payment_request.py @@ -461,7 +461,7 @@ class PaymentRequest(Document): } if self.message: - return frappe.render_template(self.message, context) + return frappe.render_template(self.message, context, restrict_globals=True) def set_failed(self): pass diff --git a/erpnext/buying/doctype/request_for_quotation/request_for_quotation.py b/erpnext/buying/doctype/request_for_quotation/request_for_quotation.py index 95b0ec8b389..c4ada801cd2 100644 --- a/erpnext/buying/doctype/request_for_quotation/request_for_quotation.py +++ b/erpnext/buying/doctype/request_for_quotation/request_for_quotation.py @@ -325,14 +325,14 @@ class RequestforQuotation(BuyingController): message_template = self.mfs_html if self.use_html else self.message_for_supplier # nosemgrep: frappe-semgrep-rules.rules.security.frappe-ssti - rendered_message = frappe.render_template(message_template, doc_args) + rendered_message = frappe.render_template(message_template, doc_args, restrict_globals=True) subject_source = ( self.subject or frappe.get_value("Email Template", self.email_template, "subject") or _("Request for Quotation") ) - rendered_subject = frappe.render_template(subject_source, doc_args) + rendered_subject = frappe.render_template(subject_source, doc_args, restrict_globals=True) if preview: return { "message": rendered_message, diff --git a/erpnext/crm/doctype/contract_template/contract_template.py b/erpnext/crm/doctype/contract_template/contract_template.py index 700197500fb..d0bf738d79d 100644 --- a/erpnext/crm/doctype/contract_template/contract_template.py +++ b/erpnext/crm/doctype/contract_template/contract_template.py @@ -30,7 +30,7 @@ class ContractTemplate(Document): def validate(self): if self.contract_terms: - validate_template(self.contract_terms) + validate_template(self.contract_terms, restrict_globals=True) @frappe.whitelist() @@ -42,6 +42,6 @@ def get_contract_template(template_name, doc): contract_terms = None if contract_template.contract_terms: - contract_terms = frappe.render_template(contract_template.contract_terms, doc) + contract_terms = frappe.render_template(contract_template.contract_terms, doc, restrict_globals=True) return {"contract_template": contract_template, "contract_terms": contract_terms} diff --git a/erpnext/crm/doctype/email_campaign/email_campaign.py b/erpnext/crm/doctype/email_campaign/email_campaign.py index 4454ede5310..dbc4382a041 100644 --- a/erpnext/crm/doctype/email_campaign/email_campaign.py +++ b/erpnext/crm/doctype/email_campaign/email_campaign.py @@ -171,8 +171,8 @@ def send_mail(entry, email_campaign): context = {"doc": frappe.get_doc("Email Group", recipient)} # Render template - subject = frappe.render_template(email_template.get("subject"), context) - content = frappe.render_template(email_template.response_, context) + subject = frappe.render_template(email_template.get("subject"), context, restrict_globals=True) + content = frappe.render_template(email_template.response_, context, restrict_globals=True) try: comm = make( diff --git a/erpnext/stock/doctype/delivery_trip/delivery_trip.py b/erpnext/stock/doctype/delivery_trip/delivery_trip.py index e1e308c735e..fbaafbe73fd 100644 --- a/erpnext/stock/doctype/delivery_trip/delivery_trip.py +++ b/erpnext/stock/doctype/delivery_trip/delivery_trip.py @@ -406,7 +406,7 @@ def notify_customers(delivery_trip): frappe.sendmail( recipients=contact_info.email_id, subject=dispatch_template.subject, - message=frappe.render_template(dispatch_template.response, context), + message=frappe.render_template(dispatch_template.response, context, restrict_globals=True), attachments=get_attachments(stop), )