From bc0fd611d473c6481dc528a7b497760bb9f74bcc Mon Sep 17 00:00:00 2001
From: diptanilsaha <diptanil@frappe.io>
Date: Tue, 18 Aug 2026 22:49:05 +0530
Subject: [PATCH] fix: escape forum topics and get started sections on help
 page

---
 erpnext/templates/pages/help.html | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/erpnext/templates/pages/help.html b/erpnext/templates/pages/help.html
index 726d5e1b881..7e11bcb7d54 100644
--- a/erpnext/templates/pages/help.html
+++ b/erpnext/templates/pages/help.html
@@ -17,12 +17,12 @@
 
 {% for section in get_started_sections %}
 <div style="margin-bottom: 30px;">
-	<h2>{{ section["name"] }}</h2>
+	<h2>{{ section["name"] | e }}</h2>
 	{% for item in section["items"] %}
 	<div style="margin: 20px 0;">
-		<a href="{{ item.link }}"><b>{{ item.title }}</b></a>
+		<a href="{{ item.link | e }}"><b>{{ item.title | e }}</b></a>
 		{% if item.description -%}
-		<p>{{ item.description }}</p>
+		<p>{{ item.description | e }}</p>
 		{%- endif %}
 	</div>
 	{% endfor %}
@@ -35,15 +35,15 @@
 	<h2>{{ _("Forum Activity") }}</h2>
 	{% for topic in topics %}
 	<div style="margin: 20px 0;">
-		<a href="{{ topic[post_params.link] }}">
-			<b>{{ topic[post_params.title] }}</b>
+		<a href="{{ topic[post_params.link] | e }}">
+			<b>{{ topic[post_params.title] | e }}</b>
 		</a>
 		{% if topic[post_params.description] -%}
-		<p>{{ topic[post_params.description] }}</p>
+		<p>{{ topic[post_params.description] | e }}</p>
 		{%- endif %}
 	</div>
 	{% endfor %}
-	<p><a href="{{ forum_url }}">{{ _("Visit the forums") }}</a></p>
+	<p><a href="{{ forum_url | e }}">{{ _("Visit the forums") }}</a></p>
 	<hr>
 </div>