vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix(standard_macros): escape fields in standard print format template

Browse source 
Escaping on output, and reverting changes made in formatters.py.
This commit is contained in:
AarDG10 2026-04-28 08:07:10 +05:30
parent 242e7b55ca
commit 9bcac62d98
4 changed files with 8 additions and 54 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
frappe/email/doctype/auto_email_report/auto_email_report.py
View file

@ -392,7 +392,7 @@ def make_links(columns, data):
def update_field_types(columns):
for col in columns:
if col.fieldtype in ("Link", "Dynamic Link", "Currency") and col.options != "Currency":
col.fieldtype = "HTML Editor"
col.fieldtype = "Data"
col.options = ""
return columns

4
frappe/templates/print_formats/standard_macros.html
View file

@ -118,7 +118,7 @@ data-fieldname="{{ df.fieldname }}" data-fieldtype="{{ df.fieldtype }}"
{%- endif %}
{%- if df.fieldtype=="Code" %}
<pre class="value">{{ doc.get(df.fieldname)|e }}</pre>
{%- elif df.fieldtype in ("Text", "Long Text") -%}
{%- elif df.fieldtype in ("Text", "Long Text", "Small Text") -%}
{{ doc.get_formatted(df.fieldname, parent_doc or doc, translated=df.translatable)|e }}
{%- else -%}
{{ doc.get_formatted(df.fieldname, parent_doc or doc, translated=df.translatable) }}
@ -171,7 +171,7 @@ data-fieldname="{{ df.fieldname }}" data-fieldtype="{{ df.fieldtype }}"
{% elif df.fieldtype=="Data" %}
{%- set parent = parent_doc or doc -%}
{{ doc.get_formatted(df.fieldname, parent, translated=df.translatable, absolute_value=parent.absolute_value) |e }}
{% elif df.fieldtype in ("Text", "Long Text") %}
{% elif df.fieldtype in ("Text", "Long Text", "Small Text") %}
{%- set parent = parent_doc or doc -%}
{{ doc.get_formatted(df.fieldname, parent, translated=df.translatable, absolute_value=parent.absolute_value) |e }}
{% else %}

35
frappe/tests/test_formatter.py
View file

@ -1,7 +1,6 @@
import frappe
from frappe import format
from frappe.tests import IntegrationTestCase
from frappe.utils.formatters import format_value
class TestFormatter(IntegrationTestCase):
@ -18,37 +17,3 @@ class TestFormatter(IntegrationTestCase):
self.assertEqual(format(100000, df, doc, format="#,###.##"), "$ 100,000.00")
frappe.db.set_default("currency", None)
def test_safe_formatting(self):
"""Test that in certain field types, the values are escaped."""
payload = "<script>alert('testing')</script>"
sanitized_payload = "&lt;script&gt;alert(&apos;testing&apos;)&lt;/script&gt;"
data_df = frappe._dict({"fieldname": "book_name", "fieldtype": "Data"})
self.assertEqual(format_value(payload, data_df), sanitized_payload)
text_df = frappe._dict({"fieldname": "book_description", "fieldtype": "Text"})
self.assertEqual(format_value(payload, text_df), sanitized_payload)
html_df = frappe._dict({"fieldname": "book_title", "fieldtype": "HTML Editor"})
self.assertEqual(format_value(payload, html_df), payload)
editor_df = frappe._dict({"fieldtype": "Text Editor"})
formatted_editor = format_value("<b>Bold</b>", editor_df)
self.assertEqual(formatted_editor, "<div class='ql-snow'><b>Bold</b></div>")
ltext_df = frappe._dict({"fieldname": "book_long_description", "fieldtype": "Long Text"})
self.assertEqual(format_value(payload, ltext_df), sanitized_payload)
select_df = frappe._dict({"fieldtype": "Select", "parent": "Task"})
value = "Open"
self.assertEqual(format_value(value, select_df), "Open")
self.assertEqual(format_value(payload, select_df), sanitized_payload)
link_df = frappe._dict({"fieldtype": "Link", "options": "User"})
self.assertEqual(format_value(payload, link_df, doc=None), sanitized_payload)
doc = frappe._dict({"__link_titles": {"User::attacker@example.com": "<svg onload=alert(1)>"}})
formatted = format_value("attacker@example.com", link_df, doc)
self.assertIn("&lt;svg", formatted)
self.assertEqual(format_value(payload, df=None), sanitized_payload)

21
frappe/utils/formatters.py
View file

@ -60,8 +60,6 @@ def format_value(value, df=None, doc=None, currency=None, translated=False, form
value = frappe._(value)
if not df:
if isinstance(value, str):
return frappe.utils.escape_html(value)
return value
elif df.get("fieldtype") == "Date":
@ -101,8 +99,7 @@ def format_value(value, df=None, doc=None, currency=None, translated=False, form
elif df.get("fieldtype") in ("Text", "Small Text"):
if not BLOCK_TAGS_PATTERN.search(value):
escaped_value = frappe.utils.escape_html(frappe.safe_decode(value))
return escaped_value.replace("\n", "<br>")
return frappe.safe_decode(value).replace("\n", "<br>")
elif df.get("fieldtype") == "Markdown Editor":
return frappe.utils.markdown(value)
@ -127,28 +124,20 @@ def format_value(value, df=None, doc=None, currency=None, translated=False, form
elif df.get("fieldtype") in ["Link", "Dynamic Link"]:
if not doc or not doc.get("__link_titles") or not df.options:
return frappe.utils.escape_html(cstr(value))
return value
doctype = df.options
if df.get("fieldtype") == "Dynamic Link":
if not df.parent:
return frappe.utils.escape_html(cstr(value))
return value
meta = frappe.get_meta(df.parent)
_field = meta.get_field(df.options)
doctype = _field.options
link_title = doc.__link_titles.get(f"{doctype}::{value}", value)
return frappe.utils.escape_html(cstr(link_title))
return doc.__link_titles.get(f"{doctype}::{value}", value)
elif df.get("fieldtype") == "Select":
if isinstance(value, str):
translated_value = frappe._(value, context=df.parent or "")
return frappe.utils.escape_html(translated_value)
elif df.get("fieldtype") == "HTML Editor":
return value
if isinstance(value, str):
value = frappe.utils.escape_html(value)
return frappe._(value, context=df.parent or "")
return value