From 49b2b155b6122ade55bb723c2d979a96e568446d Mon Sep 17 00:00:00 2001
From: Chinmay Pai <chinmaydpai@gmail.com>
Date: Tue, 26 May 2020 18:21:11 +0530
Subject: [PATCH] fix: sanitize all-products search before displaying results
 (#21764)

Signed-off-by: Chinmay D. Pai <chinmaydpai@gmail.com>
---
 erpnext/www/all-products/index.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/erpnext/www/all-products/index.html b/erpnext/www/all-products/index.html
index f09021412b..0126b59c64 100644
--- a/erpnext/www/all-products/index.html
+++ b/erpnext/www/all-products/index.html
@@ -11,7 +11,7 @@
 		<div class="input-group input-group-sm mb-3">
 			<input type="search" class="form-control" placeholder="{{_('Search')}}"
 				aria-label="{{_('Product Search')}}" aria-describedby="product-search"
-				value="{{ frappe.form_dict.search or '' }}"
+				value="{{ frappe.sanitize_html(frappe.form_dict.search) or '' }}"
 			>
 		</div>
 	</div>