From de265b471149a7adb87f88a7a44aafe6c5d94a80 Mon Sep 17 00:00:00 2001
From: jll-02 <63648645+jll-02@users.noreply.github.com>
Date: Fri, 11 Nov 2022 13:41:45 +0100
Subject: [PATCH] fix(security): prevent xss attack in search (#18847)

(cherry picked from commit bfab7191543961c6cb77fe267063877c31b616ce)
---
 frappe/templates/includes/navbar/navbar_search.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/frappe/templates/includes/navbar/navbar_search.html b/frappe/templates/includes/navbar/navbar_search.html
index 67b4d6505a3..2602fe1f8c5 100644
--- a/frappe/templates/includes/navbar/navbar_search.html
+++ b/frappe/templates/includes/navbar/navbar_search.html
@@ -2,8 +2,8 @@
 	<li>
 		<form action='/search'>
 		<input name='q' class='form-control navbar-search' type='text'
-			value='{{ frappe.form_dict.q or ''}}'
+			value='{{ frappe.form_dict.q|e or ''}}'
 			{% if not frappe.form_dict.q%}placeholder="{{ _("Search...") }}"{% endif %}>
 		</form>
 	</li>
-{% endif %}
\ No newline at end of file
+{% endif %}