fix(accounts): escape cheque print template messages

erpnext/accounts/doctype/cheque_print_template/cheque_print_template.js

@@ -27,7 +27,7 @@ frappe.ui.form.on("Cheque Print Template", {
 					<span style="top: {{ acc_pay_dist_from_top_edge }}cm;\
 						left: {{ acc_pay_dist_from_left_edge }}cm;\
 						border-bottom: solid 1px;border-top:solid 1px;\
-						position: absolute;"> {{ message_to_show || __("Account Pay Only") }} </span>\
+						position: absolute;"> {{ frappe.utils.escape_html(message_to_show || __("Account Pay Only")) }} </span>\
 					{% endif %}\
 					<span style="top: {{ date_dist_from_top_edge }}cm;\
 						left: {{ date_dist_from_left_edge }}cm;\

erpnext/accounts/doctype/cheque_print_template/cheque_print_template.py

@@ -1,6 +1,7 @@
 # Copyright (c) 2015, Frappe Technologies Pvt. Ltd. and contributors
 # For license information, please see license.txt
 
+import re
 
 import frappe
 from frappe import _
@@ -71,11 +72,11 @@ def create_or_update_cheque_print_format(template_name):
 		account_payee = """
 		<span style="top:{acc_pay_dist_from_top_edge}cm; left:{acc_pay_dist_from_left_edge}cm;
 			border-bottom: solid 1px;border-top:solid 1px; width:2cm;text-align: center; position: absolute;">
-				{message_to_show}
+				{{{{ {message_to_show} | e }}}}
 		</span>""".format(
 			acc_pay_dist_from_top_edge=doc.acc_pay_dist_from_top_edge,
 			acc_pay_dist_from_left_edge=doc.acc_pay_dist_from_left_edge,
-			message_to_show=doc.message_to_show or _("Account Pay Only"),
+			message_to_show=frappe.as_json(doc.message_to_show or _("Account Pay Only"), ensure_ascii=False),
 		)
 
 	cheque_print.html = """
@@ -146,3 +147,68 @@ def create_or_update_cheque_print_format(template_name):
 	frappe.db.set_value("Cheque Print Template", template_name, "has_print_format", 1)
 
 	return cheque_print
+
+
+def update_existing_cheque_print_formats():
+	frappe.only_for("System Manager")
+
+	template_names = frappe.get_all("Cheque Print Template", pluck="name")
+	if not template_names:
+		return
+
+	default_messages = None
+	for template_name in frappe.get_all(
+		"Print Format",
+		filters={
+			"name": ["in", template_names],
+			"doc_type": "Payment Entry",
+			"standard": "No",
+			"custom_format": 1,
+			"print_format_type": "Jinja",
+			"raw_printing": 0,
+		},
+		pluck="name",
+	):
+		print_format = frappe.get_doc("Print Format", template_name)
+		# Only migrate a region that still matches the saved message, preserving custom markup.
+		message = re.search(
+			r'border-bottom: solid 1px;border-top:solid 1px; width:2cm;text-align: center; position: absolute;">\n\t{4}'
+			r"(?P<message>.*)"
+			r"\n\t{2}</span>\n\t{2}<span[^>]*>\n\t{3}{{ frappe\.utils\.formatdate\(doc\.reference_date\) or '' }}",
+			print_format.html or "",
+			flags=re.DOTALL,
+		)
+		saved_message = frappe.db.get_value("Cheque Print Template", template_name, "message_to_show")
+		if not saved_message and default_messages is None:
+			default_messages = {"Account Pay Only"}
+			default_messages.update(
+				_("Account Pay Only", lang=language) for language in frappe.get_all("Language", pluck="name")
+			)
+
+		for message_text in [saved_message] if saved_message else default_messages:
+			escaped_message = "{{ " + frappe.as_json(message_text, ensure_ascii=False) + " | e }}"
+			if message and message["message"] in (message_text, escaped_message):
+				break
+		else:
+			frappe.log_error(
+				title=_("Cheque Print Format Requires Review"),
+				message=_(
+					"The account-payee message in Print Format {0} could not be identified unambiguously. "
+					"Its HTML has been preserved. "
+					"Review and escape the message in its custom HTML, or regenerate the format "
+					"using Update Print Format."
+				).format(print_format.name),
+				reference_doctype="Print Format",
+				reference_name=print_format.name,
+			)
+			continue
+
+		if message["message"] == escaped_message:
+			continue
+
+		print_format.html = (
+			print_format.html[: message.start("message")]
+			+ escaped_message
+			+ print_format.html[message.end("message") :]
+		)
+		print_format.save()

erpnext/patches.txt

@@ -463,3 +463,4 @@ erpnext.patches.v16_0.set_user_on_timesheets
 erpnext.patches.v16_0.scope_voice_call_settings_to_desk_users
 execute:frappe.db.set_value("Dunning", {"docstatus": 0}, "status", "Draft", update_modified=False)
 execute:frappe.db.set_value("Dunning", {"docstatus": 2}, "status", "Cancelled", update_modified=False)
+execute:frappe.get_attr("erpnext.accounts.doctype.cheque_print_template.cheque_print_template.update_existing_cheque_print_formats")()