fix!: use IIFE for dynamic JS evaluation (#33973)

Co-authored-by: Ankush Menat <ankush@frappe.io>
This commit is contained in:
Sagar Vora 2025-11-22 11:18:50 +05:30 committed by GitHub
parent 1e0415e6dd
commit 370efbd3e8
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
5 changed files with 5 additions and 8 deletions

View file

@ -61,7 +61,7 @@ frappe.ui.form.on("Auto Email Report", {
report_name: frm.doc.report,
},
callback: function (r) {
frappe.dom.eval(r.message.script || "");
frappe.dom.eval(r.message.script);
frm.script_setup_for = frm.doc.report;
frm.trigger("show_filters");
},

View file

@ -27,10 +27,7 @@ frappe.dom = {
},
eval: function (txt) {
if (!txt) return;
var el = document.createElement("script");
el.appendChild(document.createTextNode(txt));
// execute the script globally
document.getElementsByTagName("head")[0].appendChild(el);
new Function(txt)();
},
remove_script_and_style: function (txt) {

View file

@ -86,7 +86,7 @@ frappe.views.Page = class Page {
// set content, script and style
if (this.pagedoc.content) this.wrapper.innerHTML = this.pagedoc.content;
frappe.dom.eval(this.pagedoc.__script || this.pagedoc.script || "");
frappe.dom.eval(this.pagedoc.__script || this.pagedoc.script);
frappe.dom.set_style(this.pagedoc.style || "");
// set breadcrumbs

View file

@ -430,7 +430,7 @@ frappe.views.QueryReport = class QueryReport extends frappe.views.BaseList {
report_name: this.report_name,
})
.then((settings) => {
frappe.dom.eval(settings.script || "");
frappe.dom.eval(settings.script);
frappe.after_ajax(() => {
this.report_settings = this.get_local_report_settings(
settings.custom_report_name

View file

@ -129,7 +129,7 @@ frappe.report_utils = {
report_name: report_name,
})
.then((r) => {
frappe.dom.eval(r.script || "");
frappe.dom.eval(r.script);
return frappe.after_ajax(() => {
if (
frappe.query_reports[report_name] &&