fix: sanitize all-products search before displaying results (#21764)
Signed-off-by: Chinmay D. Pai <chinmaydpai@gmail.com>
diff --git a/erpnext/www/all-products/index.html b/erpnext/www/all-products/index.html
index f090214..0126b59 100644
--- a/erpnext/www/all-products/index.html
+++ b/erpnext/www/all-products/index.html
@@ -11,7 +11,7 @@
<div class="input-group input-group-sm mb-3">
<input type="search" class="form-control" placeholder="{{_('Search')}}"
aria-label="{{_('Product Search')}}" aria-describedby="product-search"
- value="{{ frappe.form_dict.search or '' }}"
+ value="{{ frappe.sanitize_html(frappe.form_dict.search) or '' }}"
>
</div>
</div>