nsinnovations/erpnext
2
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-08-21 18:29:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: escape interpolated values in text positions across portal and desk templates (backport #58286) (#58288)

Browse Source
This commit is contained in:
mergify[bot]
2026-08-19 02:43:18 +05:30
committed by GitHub
parent 9e2173e4c2
commit d3573105c4
10 changed files with 20 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
erpnext/public/js/templates/crm_activities.html
View File

@@ -115,7 +115,7 @@
</svg>
</span>
<a href="/app/event/{{ frappe.utils.escape_html(events[i].name) }}" title="{{ __('Open Event') }}">
{%= events[i].subject %}
{%= frappe.utils.escape_html(events[i].subject) %}
</a>
</div>
<div class="checkbox">
@@ -162,7 +162,7 @@
</svg>
</span>
<a href="/app/event/{{ frappe.utils.escape_html(event.name) }}" title="{{ __('Open Event') }}">
{%= event.subject %}
{%= frappe.utils.escape_html(event.subject) %}
</a>
</div>
<div class="checkbox">

6
erpnext/templates/generators/sales_partner.html
View File

@@ -16,9 +16,9 @@
{% if addresses %}
{% for address in addresses %}
<address>
{% if address.partner_address %}<p itemprop="address">{{ address.partner_address }}</p>{% endif %}
{% if address.phone %}<p itemprop="telephone">{{ address.phone }}</p>{% endif %}
{% if address.email %}<p itemprop="email"><span class="fa fa-envelope"></span> {{ address.email }}</p>{% endif %}
{% if address.partner_address %}<p itemprop="address">{{ address.partner_address | e }}</p>{% endif %}
{% if address.phone %}<p itemprop="telephone">{{ address.phone | e }}</p>{% endif %}
{% if address.email %}<p itemprop="email"><span class="fa fa-envelope"></span> {{ address.email | e }}</p>{% endif %}
</address>
{% endfor %}
{% endif %}

2
erpnext/templates/includes/projects/project_row.html
View File

@@ -6,7 +6,7 @@
{{ doc.name }}
</div>
<div class="col-xs-2 project-name">
{{ doc.project_name }}
{{ doc.project_name | e }}
</div>
<div class="col-xs-3 text-center">
{% if doc.percent_complete %}

2
erpnext/templates/includes/projects/project_tasks.html
View File

@@ -8,7 +8,7 @@
<i class="fa fa-level-up fa-rotate-90"></i>
</span>
{% endif %}
{{ task.subject }}</a>
{{ task.subject | e }}</a>
</div>
<div class="col-sm-2">{{ task.status }}</div>
<div class="col-sm-2 small text-muted">

2
erpnext/templates/includes/transaction_row.html
View File

@@ -12,7 +12,7 @@
</div>
<div class="col-sm-2">
<div class="small text-muted items-preview ellipsis ellipsis-width">
{{ doc.items_preview }}
{{ doc.items_preview | e }}
</div>
</div>
{% if doc.is_rounded_total_disabled() and doc.get('grand_total') %}

4
erpnext/templates/pages/order.html
View File

@@ -73,11 +73,11 @@
</div>
<div class="text-right col-2">
{%- set party_name = doc.supplier_name if doc.doctype in ['Supplier Quotation', 'Purchase Invoice', 'Purchase Order'] else doc.customer_name %}
<b>{{ party_name }}</b>
<b>{{ party_name | e }}</b>
{% if doc.contact_display and doc.contact_display != party_name %}
<br>
{{ doc.contact_display }}
{{ doc.contact_display | e }}
{% endif %}
</div>
</div>

2
erpnext/templates/pages/partners.html
View File

@@ -21,7 +21,7 @@
<h4>{{ partner_info.partner_name }}</h4>
</a>
<p style="color: #999">{{ partner_info.territory }} - {{ partner_info.partner_type }}</p>
<p>{{ partner_info.introduction }}</p>
<p>{{ partner_info.introduction | e }}</p>
</div>
</div>
<hr>

4
erpnext/templates/pages/projects.html
View File

@@ -1,7 +1,7 @@
{% extends "templates/web.html" %}
{% block title %}
{{ doc.project_name }}
{{ doc.project_name | e }}
{% endblock %}
{% block head_include %}
@@ -9,7 +9,7 @@
{% endblock %}
{% block header %}
<h3 class="my-account-header">{{ doc.project_name }}</h3>
<h3 class="my-account-header">{{ doc.project_name | e }}</h3>
{% endblock %}
{% block style %}

6
erpnext/templates/pages/projects.js
View File

@@ -45,7 +45,7 @@ frappe.ready(function () {
dataType: "json",
data: {
cmd: "erpnext.templates.pages.projects.get_" + item + "_html",
project: "{{ doc.name | e }}",
project: frappe.utils.get_url_arg("project"),
item_status: item_status,
},
success: function (data) {
@@ -80,7 +80,7 @@ frappe.ready(function () {
dataType: "json",
data: {
cmd: "erpnext.templates.pages.projects.get_" + item + "_html",
project: "{{ doc.name | e }}",
project: frappe.utils.get_url_arg("project"),
start: start,
item_status: item_status,
},
@@ -96,7 +96,7 @@ frappe.ready(function () {
var close_item = function (item, item_name) {
var args = {
project: "{{ doc.name | e }}",
project: frappe.utils.get_url_arg("project"),
item_name: item_name,
};
frappe.call({

8
erpnext/www/support/index.html
View File

@@ -49,9 +49,9 @@
<div class="card card-md h-100 kb-card">
<div class="card-body">
<h6 class="card-subtitle mb-2 text-uppercase small text-muted">
{{ favorite_article['category'] }}</h6>
<h3 class="card-title">{{ favorite_article['title'] }}</h3>
<p class="card-text">{{ favorite_article['description'] }}</p>
{{ favorite_article['category'] | e }}</h6>
<h3 class="card-title">{{ favorite_article['title'] | e }}</h3>
<p class="card-text">{{ favorite_article['description'] | e }}</p>
</div>
<a href="{{ favorite_article['route'] | e }}" class="stretched-link"></a>
</div>
@@ -72,7 +72,7 @@
<h5>{{ item['category'].name }}</h5>
<div>
{% for article in item['articles'] %}
<a href="{{ article.route | e }}" class="mt-2 d-block">{{ article.title }}</a>
<a href="{{ article.route | e }}" class="mt-2 d-block">{{ article.title | e }}</a>
{% endfor %}
</div>
</div>