From d3573105c47c6a0b61304373dbe5086f8ad4e843 Mon Sep 17 00:00:00 2001
From: "mergify[bot]" <37929162+mergify[bot]@users.noreply.github.com>
Date: Wed, 19 Aug 2026 02:43:18 +0530
Subject: [PATCH] fix: escape interpolated values in text positions across
portal and desk templates (backport #58286) (#58288)
---
erpnext/public/js/templates/crm_activities.html | 4 ++--
erpnext/templates/generators/sales_partner.html | 6 +++---
erpnext/templates/includes/projects/project_row.html | 2 +-
erpnext/templates/includes/projects/project_tasks.html | 2 +-
erpnext/templates/includes/transaction_row.html | 2 +-
erpnext/templates/pages/order.html | 4 ++--
erpnext/templates/pages/partners.html | 2 +-
erpnext/templates/pages/projects.html | 4 ++--
erpnext/templates/pages/projects.js | 6 +++---
erpnext/www/support/index.html | 8 ++++----
10 files changed, 20 insertions(+), 20 deletions(-)
diff --git a/erpnext/public/js/templates/crm_activities.html b/erpnext/public/js/templates/crm_activities.html
index bae219705bc..3cdcabeb6ae 100644
--- a/erpnext/public/js/templates/crm_activities.html
+++ b/erpnext/public/js/templates/crm_activities.html
@@ -115,7 +115,7 @@
- {%= events[i].subject %}
+ {%= frappe.utils.escape_html(events[i].subject) %}
diff --git a/erpnext/templates/generators/sales_partner.html b/erpnext/templates/generators/sales_partner.html
index f45e028b676..8577140d039 100644
--- a/erpnext/templates/generators/sales_partner.html
+++ b/erpnext/templates/generators/sales_partner.html
@@ -16,9 +16,9 @@
{% if addresses %}
{% for address in addresses %}
- {% if address.partner_address %}{{ address.partner_address }}
{% endif %}
- {% if address.phone %}{{ address.phone }}
{% endif %}
- {% if address.email %} {{ address.email }}
{% endif %}
+ {% if address.partner_address %}{{ address.partner_address | e }}
{% endif %}
+ {% if address.phone %}{{ address.phone | e }}
{% endif %}
+ {% if address.email %} {{ address.email | e }}
{% endif %}
{% endfor %}
{% endif %}
diff --git a/erpnext/templates/includes/projects/project_row.html b/erpnext/templates/includes/projects/project_row.html
index b0a9a276f2a..1d131314d9f 100644
--- a/erpnext/templates/includes/projects/project_row.html
+++ b/erpnext/templates/includes/projects/project_row.html
@@ -6,7 +6,7 @@
{{ doc.name }}
- {{ doc.project_name }}
+ {{ doc.project_name | e }}
{% if doc.percent_complete %}
diff --git a/erpnext/templates/includes/projects/project_tasks.html b/erpnext/templates/includes/projects/project_tasks.html
index 132fc7cf625..32719adf71d 100644
--- a/erpnext/templates/includes/projects/project_tasks.html
+++ b/erpnext/templates/includes/projects/project_tasks.html
@@ -8,7 +8,7 @@
{% endif %}
- {{ task.subject }}
+ {{ task.subject | e }}
{{ task.status }}
diff --git a/erpnext/templates/includes/transaction_row.html b/erpnext/templates/includes/transaction_row.html
index e8f71391b1c..03e04a3a1e8 100644
--- a/erpnext/templates/includes/transaction_row.html
+++ b/erpnext/templates/includes/transaction_row.html
@@ -12,7 +12,7 @@
- {{ doc.items_preview }}
+ {{ doc.items_preview | e }}
{% if doc.is_rounded_total_disabled() and doc.get('grand_total') %}
diff --git a/erpnext/templates/pages/order.html b/erpnext/templates/pages/order.html
index 3107209a75e..ec9d75e350a 100644
--- a/erpnext/templates/pages/order.html
+++ b/erpnext/templates/pages/order.html
@@ -73,11 +73,11 @@
{%- set party_name = doc.supplier_name if doc.doctype in ['Supplier Quotation', 'Purchase Invoice', 'Purchase Order'] else doc.customer_name %}
- {{ party_name }}
+ {{ party_name | e }}
{% if doc.contact_display and doc.contact_display != party_name %}
- {{ doc.contact_display }}
+ {{ doc.contact_display | e }}
{% endif %}
diff --git a/erpnext/templates/pages/partners.html b/erpnext/templates/pages/partners.html
index 71962b90afa..5b6ae2c5670 100644
--- a/erpnext/templates/pages/partners.html
+++ b/erpnext/templates/pages/partners.html
@@ -21,7 +21,7 @@
{{ partner_info.partner_name }}
{{ partner_info.territory }} - {{ partner_info.partner_type }}
- {{ partner_info.introduction }}
+ {{ partner_info.introduction | e }}
diff --git a/erpnext/templates/pages/projects.html b/erpnext/templates/pages/projects.html
index 10466a6cb2f..2b55679fa71 100644
--- a/erpnext/templates/pages/projects.html
+++ b/erpnext/templates/pages/projects.html
@@ -1,7 +1,7 @@
{% extends "templates/web.html" %}
{% block title %}
- {{ doc.project_name }}
+ {{ doc.project_name | e }}
{% endblock %}
{% block head_include %}
@@ -9,7 +9,7 @@
{% endblock %}
{% block header %}
-
+
{% endblock %}
{% block style %}
diff --git a/erpnext/templates/pages/projects.js b/erpnext/templates/pages/projects.js
index 24c16268e61..bf037bcf6a5 100644
--- a/erpnext/templates/pages/projects.js
+++ b/erpnext/templates/pages/projects.js
@@ -45,7 +45,7 @@ frappe.ready(function () {
dataType: "json",
data: {
cmd: "erpnext.templates.pages.projects.get_" + item + "_html",
- project: "{{ doc.name | e }}",
+ project: frappe.utils.get_url_arg("project"),
item_status: item_status,
},
success: function (data) {
@@ -80,7 +80,7 @@ frappe.ready(function () {
dataType: "json",
data: {
cmd: "erpnext.templates.pages.projects.get_" + item + "_html",
- project: "{{ doc.name | e }}",
+ project: frappe.utils.get_url_arg("project"),
start: start,
item_status: item_status,
},
@@ -96,7 +96,7 @@ frappe.ready(function () {
var close_item = function (item, item_name) {
var args = {
- project: "{{ doc.name | e }}",
+ project: frappe.utils.get_url_arg("project"),
item_name: item_name,
};
frappe.call({
diff --git a/erpnext/www/support/index.html b/erpnext/www/support/index.html
index 6702e57cae7..d2625cd55ad 100644
--- a/erpnext/www/support/index.html
+++ b/erpnext/www/support/index.html
@@ -49,9 +49,9 @@
- {{ favorite_article['category'] }}
-
{{ favorite_article['title'] }}
-
{{ favorite_article['description'] }}
+ {{ favorite_article['category'] | e }}
+
{{ favorite_article['title'] | e }}
+
{{ favorite_article['description'] | e }}
@@ -72,7 +72,7 @@
{{ item['category'].name }}