nsinnovations/erpnext
2
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-08-14 15:11:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: set restrict_globals=True in frappe.render_template (backport #57899) (#57901)

Browse Source 
Co-authored-by: Diptanil Saha <diptanil@frappe.io>
This commit is contained in:
mergify[bot]
2026-08-09 00:04:14 +05:30
committed by GitHub
parent de9d306bfd
commit af7953a933
6 changed files with 11 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
erpnext/accounts/custom/address.py
View File

@@ -65,4 +65,6 @@ def get_shipping_address(company, address=None):
if address: if address:
address_as_dict = address[0] address_as_dict = address[0]
name, address_template = get_address_templates(address_as_dict) name, address_template = get_address_templates(address_as_dict)
return address_as_dict.get("name"), frappe.render_template(address_template, address_as_dict) return address_as_dict.get("name"), frappe.render_template(
address_template, address_as_dict, restrict_globals=True
)

2
erpnext/accounts/doctype/payment_request/payment_request.py
View File

@@ -461,7 +461,7 @@ class PaymentRequest(Document):
} }
if self.message: if self.message:
return frappe.render_template(self.message, context) return frappe.render_template(self.message, context, restrict_globals=True)
def set_failed(self): def set_failed(self):
pass pass

4
erpnext/buying/doctype/request_for_quotation/request_for_quotation.py
View File

@@ -325,14 +325,14 @@ class RequestforQuotation(BuyingController):
message_template = self.mfs_html if self.use_html else self.message_for_supplier message_template = self.mfs_html if self.use_html else self.message_for_supplier
# nosemgrep: frappe-semgrep-rules.rules.security.frappe-ssti # nosemgrep: frappe-semgrep-rules.rules.security.frappe-ssti
rendered_message = frappe.render_template(message_template, doc_args) rendered_message = frappe.render_template(message_template, doc_args, restrict_globals=True)
subject_source = ( subject_source = (
self.subject self.subject
or frappe.get_value("Email Template", self.email_template, "subject") or frappe.get_value("Email Template", self.email_template, "subject")
or _("Request for Quotation") or _("Request for Quotation")
) )
rendered_subject = frappe.render_template(subject_source, doc_args) rendered_subject = frappe.render_template(subject_source, doc_args, restrict_globals=True)
if preview: if preview:
return { return {
"message": rendered_message, "message": rendered_message,

4
erpnext/crm/doctype/contract_template/contract_template.py
View File

@@ -30,7 +30,7 @@ class ContractTemplate(Document):
def validate(self): def validate(self):
if self.contract_terms: if self.contract_terms:
validate_template(self.contract_terms) validate_template(self.contract_terms, restrict_globals=True)
@frappe.whitelist() @frappe.whitelist()
@@ -42,6 +42,6 @@ def get_contract_template(template_name, doc):
contract_terms = None contract_terms = None
if contract_template.contract_terms: if contract_template.contract_terms:
contract_terms = frappe.render_template(contract_template.contract_terms, doc) contract_terms = frappe.render_template(contract_template.contract_terms, doc, restrict_globals=True)
return {"contract_template": contract_template, "contract_terms": contract_terms} return {"contract_template": contract_template, "contract_terms": contract_terms}

4
erpnext/crm/doctype/email_campaign/email_campaign.py
View File

@@ -171,8 +171,8 @@ def send_mail(entry, email_campaign):
context = {"doc": frappe.get_doc("Email Group", recipient)} context = {"doc": frappe.get_doc("Email Group", recipient)}
# Render template # Render template
subject = frappe.render_template(email_template.get("subject"), context) subject = frappe.render_template(email_template.get("subject"), context, restrict_globals=True)
content = frappe.render_template(email_template.response_, context) content = frappe.render_template(email_template.response_, context, restrict_globals=True)
try: try:
comm = make( comm = make(

2
erpnext/stock/doctype/delivery_trip/delivery_trip.py
View File

@@ -406,7 +406,7 @@ def notify_customers(delivery_trip):
frappe.sendmail( frappe.sendmail(
recipients=contact_info.email_id, recipients=contact_info.email_id,
subject=dispatch_template.subject, subject=dispatch_template.subject,
message=frappe.render_template(dispatch_template.response, context), message=frappe.render_template(dispatch_template.response, context, restrict_globals=True),
attachments=get_attachments(stop), attachments=get_attachments(stop),
) )