vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 4

Escape success message (#3644)

Browse source
This commit is contained in:
Nabin Hait 2017-07-08 19:33:58 +05:30 • committed by GitHub
parent cd27a947d0
commit d366bde7c1
2 changed files with 3 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
frappe/website/doctype/web_form/templates/web_form.html
View file

@ -350,10 +350,9 @@
{% block script %}
<script>
{% set seccess_msg = success_message.replace("'", "\'") %}
window.web_form_settings = {
allow_incomplete: {{ allow_incomplete or 0 }},
success_link: '<p>{{ success_msg or _("Your information has been submitted") }}</p><p><a href="{{ success_url or "/" }}" class="btn btn-sm btn-default">{{ _("Continue") }}</a></p>',
success_link: '<p>{{ success_message or _("Your information has been submitted") }}</p><p><a href="{{ success_url or "/" }}" class="btn btn-sm btn-default">{{ _("Continue") }}</a></p>',
datepicker_format: "{{ frappe.date_format }}",
web_form_doctype: "{{ doc_type }}",
web_form_name: "{{ name }}",

4
frappe/website/doctype/web_form/web_form.py
View file

@ -164,8 +164,8 @@ def get_context(context):
and (frappe.session.user!="Guest" or not self.login_required))
if context.success_message:
context.success_message = context.success_message.replace("\n",
"<br>").replace("'", "\'")
context.success_message = frappe.db.escape(context.success_message.replace("\n",
"<br>"))
self.add_custom_context_and_script(context)
if not context.max_attachment_size: