From 24cc7939c82b70b78194641cd57fd5ddbf0ae194 Mon Sep 17 00:00:00 2001
From: Manas Solanki <manas@erpnext.com>
Date: Mon, 11 Dec 2017 14:29:27 +0530
Subject: [PATCH] escape the user name in the show desktop page (#4599)

---
 frappe/core/page/modules_setup/modules_setup.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/frappe/core/page/modules_setup/modules_setup.html b/frappe/core/page/modules_setup/modules_setup.html
index 48e186d37f..4bc70ef7c8 100644
--- a/frappe/core/page/modules_setup/modules_setup.html
+++ b/frappe/core/page/modules_setup/modules_setup.html
@@ -11,11 +11,11 @@
 		<div class="col-sm-3">
 			<select class="form-control" name="user">
 				{% for user in users %}
-				<option value="{{ user.name }}"
+				<option value="{{ user.name | e }}"
 					{% if user.name == frappe.user %}selected{% endif %}>
 					<!-- {{ variable | e }} "e" or "escape(s)" will escape the characters such "<, >, &, '"
 					in the HTML text (http://jinja.pocoo.org/docs/dev/templates/#escape) -->
-					{{ (user.first_name or "") | e }} {{ (user.last_name or "") | e }} ({{ user.name }})</option>
+					{{ (user.first_name or "") | e }} {{ (user.last_name or "") | e }} ({{ user.name | e }})</option>
 				{% endfor %}
 			</select>
 		</div>