nsinnovations/erpnext
2
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-08-25 04:53:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: escape item, warehouse and label values in form grid templates

Browse Source
This commit is contained in:
diptanilsaha
2026-08-18 22:49:28 +05:30
parent 0541635f48
commit ffb7a708e4
4 changed files with 16 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
erpnext/templates/form_grid/includes/visible_cols.html
View File

@@ -3,7 +3,7 @@
if((df.fieldname !== "description" && df.fieldname !== "item_name") && val) { %}
<div class="row">
<div class="col-xs-4 ellipsis">
<strong title="{%= __(df.label, null, df.parent) %}">{%= __(df.label, null, df.parent) %}:</strong>
<strong title="{%= frappe.utils.escape_html(__(df.label, null, df.parent)) %}">{%= frappe.utils.escape_html(__(df.label, null, df.parent)) %}:</strong>
</div>
<div class="col-xs-8">
{%= doc.get_formatted(df.fieldname) %}

12
erpnext/templates/form_grid/item_grid.html
View File

@@ -31,7 +31,7 @@
} %}
<span class="pull-right" title="{%= title %}" style="margin-left: 10px;">
<span class="indicator {{ color }}">
{%= doc.warehouse %}
{%= frappe.utils.escape_html(doc.warehouse) %}
</span>
</span>
{% } %}
@@ -42,14 +42,14 @@
doc.delivered_qty : doc.received_qty;
var pending = flt(doc.qty) - flt(delivered);
%}
<span class="indicator {%= pending>0 ? "orange" : "green" %}">{%= doc.item_code %}</span>
<span class="indicator {%= pending>0 ? "orange" : "green" %}">{%= frappe.utils.escape_html(doc.item_code) %}</span>
{% } else { %}
<strong>{%= doc.item_code %}</strong>
<strong>{%= frappe.utils.escape_html(doc.item_code) %}</strong>
{% } %}
{% if(doc.item_name != doc.item_code && in_list(visible_column_fieldnames, "item_name")) { %}
{% if (doc.item_code) { %}<br>{% } %}
{%= doc.item_name %}{% } %}
{%= frappe.utils.escape_html(doc.item_name) %}{% } %}
{% include "templates/form_grid/includes/visible_cols.html" %}
</div>
@@ -57,7 +57,7 @@
<!-- qty -->
<div class="col-sm-2 hidden-xs text-right">
{%= doc.get_formatted("qty") %}
<span class="small">{%= doc.uom || doc.stock_uom %}</span>
<span class="small">{%= frappe.utils.escape_html(doc.uom || doc.stock_uom) %}</span>
</div>
<!-- rate -->
@@ -84,7 +84,7 @@
{% if (frappe.perm.is_visible("rate", doc, frm.perm)) { %}
<div class="visible-xs text-muted">
{%= doc.get_formatted("qty") %} <small>{%= doc.uom || doc.stock_uom %}</small>
{%= doc.get_formatted("qty") %} <small>{%= frappe.utils.escape_html(doc.uom || doc.stock_uom) %}</small>
x {%= doc.get_formatted("rate") %}
</div>
{% } %}

8
erpnext/templates/form_grid/material_request_grid.html
View File

@@ -11,9 +11,9 @@
{% } else { %}
<div class="row">
<div class="col-sm-4">
<span class="indicator {%= (doc.qty<=doc.ordered_qty) ? "green" : "orange" %}">{%= doc.item_code %}</strong>
<span class="indicator {%= (doc.qty<=doc.ordered_qty) ? "green" : "orange" %}">{%= frappe.utils.escape_html(doc.item_code) %}</strong>
{% if(doc.item_name != doc.item_code) { %}
<br>{%= doc.item_name %}{% } %}
<br>{%= frappe.utils.escape_html(doc.item_name) %}{% } %}
<!-- {% if(doc.item_name != doc.description) { %}
<p>{%= doc.description %}</p>{% } %} -->
{% include "templates/form_grid/includes/visible_cols.html" %}
@@ -35,7 +35,7 @@
{% if(doc.warehouse) { %}
<span class="label label-default" title="{%= __("For Warehouse") %}"
style="margin-right: 10px;">
{%= doc.warehouse %}
{%= frappe.utils.escape_html(doc.warehouse) %}
</span>
{% } %}
</div>
@@ -43,7 +43,7 @@
<!-- qty -->
<div class="col-sm-2 text-right">
{%= doc.get_formatted("qty") %}
<span class="small">{%= doc.uom || doc.stock_uom %}</span>
<span class="small">{%= frappe.utils.escape_html(doc.uom || doc.stock_uom) %}</span>
</div>
</div>
{% } %}

10
erpnext/templates/form_grid/stock_entry_grid.html
View File

@@ -12,9 +12,9 @@
</div>
{% } else { %}
<div class="row">
<div class="col-sm-5 col-xs-4"><strong>{%= doc.item_code %}</strong>
<div class="col-sm-5 col-xs-4"><strong>{%= frappe.utils.escape_html(doc.item_code) %}</strong>
{% if(doc.item_name != doc.item_code) { %}
<br>{%= doc.item_name %}{% } %}
<br>{%= frappe.utils.escape_html(doc.item_name) %}{% } %}
{% include "templates/form_grid/includes/visible_cols.html" %}
</div>
@@ -30,11 +30,11 @@
}
%}
<span class="indicator {{ color }}" title="{{ title }}">
{%= doc.s_warehouse %}</span>
{%= frappe.utils.escape_html(doc.s_warehouse) %}</span>
{% }; %}
{% if(doc.t_warehouse) { %}
<div><span class="indicator {{ doc.docstatus==1 ? "blue" : "grey" }}" title="{{ __("Target" ) }}">
{%= doc.t_warehouse %}</span>
{%= frappe.utils.escape_html(doc.t_warehouse) %}</span>
</div>
{% }; %}
</div>
@@ -42,7 +42,7 @@
<!-- qty -->
<div class="col-sm-2 col-xs-2 text-right">
{%= doc.get_formatted("qty") %}
<br><small>{%= doc.uom || doc.stock_uom %}</small>
<br><small>{%= frappe.utils.escape_html(doc.uom || doc.stock_uom) %}</small>
</div>
<!-- amount -->