vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 4

chore: escape instead of sanitizing

Browse source
This commit is contained in:
Ankush Menat 2023-09-11 18:01:09 +05:30
parent 35000c2e4f
commit 3e8a192828
2 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
frappe/templates/includes/navbar/navbar_search.html
View file

@ -3,7 +3,7 @@
<form action='/search'>
<input name='q' class='form-control navbar-search' type='text'
value='{{ frappe.form_dict.q|e if frappe.form_dict.q else ''}}'
{% if not frappe.form_dict.q%}placeholder="{{ _("Search...") }}"{% endif %}>
{% if not frappe.form_dict.q %}placeholder="{{ _("Search...") }}"{% endif %}>
</form>
</li>
{% endif %}

2
frappe/templates/includes/search_template.html
View file

@ -28,7 +28,7 @@
</div>
</div>
{% if frappe.form_dict.scope %}
<input type="text" hidden name="scope" value="{{ frappe.sanitize_html(frappe.form_dict.scope) }}">
<input type="text" hidden name="scope" value="{{ frappe.utils.escape_html(frappe.form_dict.scope) }}">
{% endif %}
</form>
</div>