From 245b73b94f08a0386288e044381016d4ba840270 Mon Sep 17 00:00:00 2001
From: Aditya Hase <aditya@adityahase.com>
Date: Wed, 30 Jan 2019 19:56:04 +0530
Subject: [PATCH] fix(search): Fix possible reflected XSS attack vector
 (#16522)

---
 erpnext/templates/pages/product_search.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/erpnext/templates/pages/product_search.html b/erpnext/templates/pages/product_search.html
index d5a56b2cac..f9efd485d3 100644
--- a/erpnext/templates/pages/product_search.html
+++ b/erpnext/templates/pages/product_search.html
@@ -10,7 +10,7 @@
 <script>
 frappe.ready(function() {
 	var txt = frappe.utils.get_url_arg("search");
-	$(".search-results").html('{{ _("Search results for") + ": " + html2text(frappe.form_dict.search or "")|trim }}');
+	$(".search-results").html('{{ _("Search results for") + ": " + html2text(frappe.form_dict.search or "") | e | trim }}');
 	window.search = txt;
 	window.start = 0;
 	window.get_product_list();