ext/erpnext
2
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-10-29 22:57:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(crm): escape contact form subject

Browse Source 
(cherry picked from commit cb2394428f)

# Conflicts:
#	erpnext/templates/test_utils.py
This commit is contained in:
Nabin Hait
2026-10-22 09:33:09 +00:00
committed by Mergify
parent e007159c21
commit 524d2e2370
2 changed files with 25 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
erpnext/templates/test_utils.py
+24
View File
@@ -32,6 +32,7 @@ class TestTemplateUtils(FrappeTestCase):
opportunity = frappe.db.get_value(
"Opportunity", {"contact_email": sender}, ["opportunity_from", "party_name"], as_dict=True
)
<<<<<<< HEAD
self.assertEqual(opportunity.opportunity_from, "Lead")
self.assertNotEqual(opportunity.party_name, "_Test Customer")
@@ -66,3 +67,26 @@ class TestTemplateUtils(FrappeTestCase):
colleague = frappe.db.get_value("Opportunity", {"title": "Colleague renewal"}, "opportunity_from")
self.assertEqual(own, ("Customer", "_Test Customer"))
self.assertEqual(colleague, "Lead")
=======
self.assertTrue(lead)
self.assertFalse(lead.lead_owner)
def test_contact_us_subject_is_stored_as_text(self):
frappe.db.set_single_value("CRM Settings", "enable_opportunity_creation_from_contact_us", 1)
self.addCleanup(frappe.db.set_default, "company", frappe.db.get_default("company"))
frappe.db.set_default("company", "_Test Company")
subject = '<img src=x onerror="alert(1)" '
with self.set_user("Guest"):
send_message("_test_contact_us_subject@example.com", "Need a quote", subject)
opportunity = frappe.db.get_value(
"Opportunity",
{"contact_email": "_test_contact_us_subject@example.com"},
["name", "title"],
as_dict=True,
)
stored_subject = frappe.db.get_value("Communication", {"reference_name": opportunity.name}, "subject")
for value in (opportunity.title, stored_subject):
self.assertNotIn("<img", value)
self.assertIn("&lt;img", value)
>>>>>>> cb23944 (fix(crm): escape contact form subject)
erpnext/templates/utils.py
+1
View File
@@ -19,6 +19,7 @@ def send_message(sender: str, message: str, subject: str = "Website Query"):
website_send_message(sender, message, subject)
message = escape_html(message)
subject = escape_html(subject)
oppotunity_creation = frappe.get_single_value(
"CRM Settings", "enable_opportunity_creation_from_contact_us"