vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix(send_message): escape HTML in the text

Browse source 
Signed-off-by: Akhil Narang <me@akhilnarang.dev>
This commit is contained in:
Akhil Narang 2025-02-19 12:23:47 +05:30
parent e16f3b1c84
commit f2d0baf79d
No known key found for this signature in database
GPG key ID: 9DCC61E211BF645F
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
frappe/www/contact.py
View file

@ -6,7 +6,7 @@ from contextlib import suppress
import frappe
from frappe import _
from frappe.rate_limiter import rate_limit
from frappe.utils import validate_email_address
from frappe.utils import escape_html, validate_email_address
sitemap = 1
@ -30,6 +30,8 @@ def get_context(context):
def send_message(sender, message, subject="Website Query"):
sender = validate_email_address(sender, throw=True)
message = escape_html(message)
with suppress(frappe.OutgoingEmailError):
if forward_to_email := frappe.db.get_single_value("Contact Us Settings", "forward_to_email"):
frappe.sendmail(recipients=forward_to_email, reply_to=sender, content=message, subject=subject)