From 10fcd7915581826d6b7f61cc093a68e5e5798dd5 Mon Sep 17 00:00:00 2001
From: yuri <yurikuzn@users.noreply.github.com>
Date: Tue, 23 Jul 2019 11:35:12 +0300
Subject: [PATCH 1/4] portal home tab

---
 client/src/views/site-portal/navbar.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/views/site-portal/navbar.js b/client/src/views/site-portal/navbar.js
index 578e390fa4..b1a4af8af5 100644
--- a/client/src/views/site-portal/navbar.js
+++ b/client/src/views/site-portal/navbar.js
@@ -42,7 +42,7 @@ define('views/site-portal/navbar', 'views/site/navbar', function (Dep) {
             var tabList = this.getConfig().get('tabList') || [];
             tabList = Espo.Utils.clone(tabList || []);
 
-            if (this.getThemeManager().getParam('navbarIsVertical')) {
+            if (this.getThemeManager().getParam('navbarIsVertical') || tabList.length) {
                 tabList.unshift('Home');
             }
             return tabList;

From 49fa22fa3d90738eb82fdafa6634e79975ef62f6 Mon Sep 17 00:00:00 2001
From: yuri <yurikuzn@users.noreply.github.com>
Date: Tue, 23 Jul 2019 11:37:07 +0300
Subject: [PATCH 2/4] v

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 17a5f80f33..10f9f58e59 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "espocrm",
-  "version": "5.6.5",
+  "version": "5.6.6",
   "description": "",
   "main": "index.php",
   "repository": {

From 34e33bd13a255a0a69d3c374f989828d691d42b4 Mon Sep 17 00:00:00 2001
From: yuri <yurikuzn@users.noreply.github.com>
Date: Tue, 23 Jul 2019 13:29:01 +0300
Subject: [PATCH 3/4] searchPanelInPortalDisabled

---
 client/src/views/list.js | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/client/src/views/list.js b/client/src/views/list.js
index f53c32fbe6..23ecb9ca47 100644
--- a/client/src/views/list.js
+++ b/client/src/views/list.js
@@ -76,10 +76,16 @@ define('views/list', ['views/main', 'search-manager'], function (Dep, SearchMana
 
             this.setViewMode(this.viewMode);
 
-            if (this.getMetadata().get('clientDefs.' + this.scope + '.searchPanelDisabled')) {
+            if (this.getMetadata().get(['clientDefs', this.scope, 'searchPanelDisabled'])) {
                 this.searchPanel = false;
             }
 
+            if (this.getUser().isPortal()) {
+                if (this.getMetadata().get(['clientDefs', this.scope, 'searchPanelInPortalDisabled'])) {
+                    this.searchPanel = false;
+                }
+            }
+
             if (this.getMetadata().get(['clientDefs', this.scope, 'createDisabled'])) {
                 this.createButton = false;
             }

From 4ab7d19776011288b875abd3eef1e1f6f75289e2 Mon Sep 17 00:00:00 2001
From: yuri <yurikuzn@users.noreply.github.com>
Date: Tue, 23 Jul 2019 17:50:02 +0300
Subject: [PATCH 4/4] xss fixes

---
 .../views/email/fields/email-address-varchar.js   | 15 +++++++++++++++
 .../views/email/fields/from-address-varchar.js    | 15 +++++++++++++++
 .../views/fields/link-multiple-with-primary.js    |  2 +-
 client/src/views/notification/items/assign.js     |  2 +-
 .../views/notification/items/email-received.js    | 11 +++++------
 .../views/notification/items/entity-removed.js    |  6 +++---
 client/src/views/notification/items/message.js    |  6 +++---
 client/src/views/site/navbar.js                   |  3 +--
 client/src/views/stream/note.js                   |  2 +-
 client/src/views/stream/notes/assign.js           |  2 +-
 client/src/views/stream/notes/create-related.js   |  2 +-
 client/src/views/stream/notes/create.js           |  2 +-
 client/src/views/stream/notes/email-received.js   |  4 ++--
 client/src/views/stream/notes/email-sent.js       |  4 ++--
 client/src/views/stream/notes/mention-in-post.js  |  5 ++---
 client/src/views/stream/notes/post.js             |  6 +++---
 client/src/views/stream/notes/relate.js           |  2 +-
 client/src/views/stream/notes/status.js           |  2 +-
 18 files changed, 59 insertions(+), 32 deletions(-)

diff --git a/client/src/views/email/fields/email-address-varchar.js b/client/src/views/email/fields/email-address-varchar.js
index 16bde39ac5..6fdb69540f 100644
--- a/client/src/views/email/fields/email-address-varchar.js
+++ b/client/src/views/email/fields/email-address-varchar.js
@@ -203,6 +203,10 @@ Espo.define('views/email/fields/email-address-varchar', ['views/fields/varchar',
         },
 
         addAddress: function (address, name, type, id) {
+            if (name) {
+                name = this.getHelper().escapeString(name);
+            }
+
             if (this.justAddedAddress) {
                 this.deleteAddress(this.justAddedAddress);
             }
@@ -236,6 +240,13 @@ Espo.define('views/email/fields/email-address-varchar', ['views/fields/varchar',
         },
 
         addAddressHtml: function (address, name) {
+            if (name) {
+                name = this.getHelper().escapeString(name);
+            }
+            if (address) {
+                name = this.getHelper().escapeString(address);
+            }
+
             var conteiner = this.$el.find('.link-container');
             var html =
             '<div data-address="'+address+'" class="list-group-item">' +
@@ -288,6 +299,10 @@ Espo.define('views/email/fields/email-address-varchar', ['views/fields/varchar',
 
             var addressHtml = '<span>' + address + '</span>';
 
+            if (name) {
+                name = this.getHelper().escapeString(name);
+            }
+
             var lineHtml;
             if (id) {
                 lineHtml = '<div>' + '<a href="#' + entityType + '/view/' + id + '">' + name + '</a> <span class="text-muted">&#187;</span> ' + addressHtml + '</div>';
diff --git a/client/src/views/email/fields/from-address-varchar.js b/client/src/views/email/fields/from-address-varchar.js
index 7ee43b3314..8c12df447d 100644
--- a/client/src/views/email/fields/from-address-varchar.js
+++ b/client/src/views/email/fields/from-address-varchar.js
@@ -106,6 +106,11 @@ Espo.define('views/email/fields/from-address-varchar', 'views/fields/varchar', f
             var fromString = this.model.get('fromString') || this.model.get('fromName');
 
             var name = this.nameHash[address] || this.parseNameFromStringAddress(fromString) || null;
+
+            if (name) {
+                name = this.getHelper().escapeString(name);
+            }
+
             var entityType = this.typeHash[address] || null;
             var id = this.idHash[address] || null;
 
@@ -129,6 +134,8 @@ Espo.define('views/email/fields/from-address-varchar', 'views/fields/varchar', f
         },
 
         getCreateHtml: function (address) {
+            address = this.getHelper().escapeString(address);
+
             var html = '<span class="dropdown email-address-create-dropdown pull-right">' +
                 '<button class="dropdown-toggle btn btn-link btn-sm" data-toggle="dropdown">' +
                     '<span class="caret text-muted"></span>' +
@@ -179,6 +186,10 @@ Espo.define('views/email/fields/from-address-varchar', 'views/fields/varchar', f
                 }
             }
 
+            if (name) {
+                name = this.getHelper().escapeString(name);
+            }
+
             var attributes = {
                 emailAddress: address
             };
@@ -240,6 +251,10 @@ Espo.define('views/email/fields/from-address-varchar', 'views/fields/varchar', f
                 }
             }
 
+            if (name) {
+                name = this.getHelper().escapeString(name);
+            }
+
             var attributes = {
                 emailAddress: address
             };
diff --git a/client/src/views/fields/link-multiple-with-primary.js b/client/src/views/fields/link-multiple-with-primary.js
index eb99144657..c790478338 100644
--- a/client/src/views/fields/link-multiple-with-primary.js
+++ b/client/src/views/fields/link-multiple-with-primary.js
@@ -130,7 +130,7 @@ Espo.define('views/fields/link-multiple-with-primary', 'views/fields/link-multip
             var $container = this.$el.find('.link-container');
             var $el = $('<div class="form-inline list-group-item link-with-role clearfix link-group-item-with-primary">').addClass('link-' + id).attr('data-id', id);
 
-            var nameHtml = '<div>' + name + '&nbsp;' + '</div>';
+            var nameHtml = '<div>' + this.getHelper().escapeString(name) + '&nbsp;' + '</div>';
             var removeHtml = '<a href="javascript:" class="pull-right" data-id="' + id + '" data-action="clearLink"><span class="fas fa-times"></a>';
 
             $left = $('<div>');
diff --git a/client/src/views/notification/items/assign.js b/client/src/views/notification/items/assign.js
index e8de5a0056..4469acda7c 100644
--- a/client/src/views/notification/items/assign.js
+++ b/client/src/views/notification/items/assign.js
@@ -40,7 +40,7 @@ Espo.define('views/notification/items/assign', 'views/notification/items/base',
             this.userId = data.userId;
 
             this.messageData['entityType'] = Espo.Utils.upperCaseFirst((this.translate(data.entityType, 'scopeNames') || '').toLowerCase());
-            this.messageData['entity'] = '<a href="#' + data.entityType + '/view/' + data.entityId + '">' + data.entityName + '</a>';
+            this.messageData['entity'] = '<a href="#' + this.getHelper().escapeString(data.entityType) + '/view/' + this.getHelper().escapeString(data.entityId) + '">' + this.getHelper().escapeString(data.entityName) + '</a>';
 
             this.createMessage();
         },
diff --git a/client/src/views/notification/items/email-received.js b/client/src/views/notification/items/email-received.js
index 8f6fa64d28..fb0f59e713 100644
--- a/client/src/views/notification/items/email-received.js
+++ b/client/src/views/notification/items/email-received.js
@@ -46,19 +46,18 @@ Espo.define('views/notification/items/email-received', 'views/notification/items
 
             this.userId = data.userId;
 
-            this.messageData['entityType'] = Espo.Utils.upperCaseFirst((this.translate(data.entityType, 'scopeNames') || '').toLowerCase());
+            this.messageData['entityType'] = this.getHelper().escapeString(Espo.Utils.upperCaseFirst((this.translate(data.entityType, 'scopeNames') || '').toLowerCase()));
             if (data.personEntityId) {
-                this.messageData['from'] = '<a href="#' + data.personEntityType + '/view/' + data.personEntityId + '">' + data.personEntityName + '</a>';
+                this.messageData['from'] = '<a href="#' + this.getHelper().escapeString(data.personEntityType) + '/view/' + this.getHelper().escapeString(data.personEntityId) + '">' + this.getHelper().escapeString(data.personEntityName) + '</a>';
             } else {
-                this.messageData['from'] = data.fromString || this.translate('empty address');
+                this.messageData['from'] = this.getHelper().escapeString(data.fromString || this.translate('empty address'));
             }
 
-            this.emailId = data.emailId;
-            this.emailName = data.emailName;
+            this.emailId = this.getHelper().escapeString(data.emailId);
+            this.emailName = this.getHelper().escapeString(data.emailName);
 
             this.createMessage();
         }
 
     });
 });
-
diff --git a/client/src/views/notification/items/entity-removed.js b/client/src/views/notification/items/entity-removed.js
index 217dd41616..ca2e54fbd2 100644
--- a/client/src/views/notification/items/entity-removed.js
+++ b/client/src/views/notification/items/entity-removed.js
@@ -39,10 +39,10 @@ Espo.define('views/notification/items/entity-removed', 'views/notification/items
 
             this.userId = data.userId;
 
-            this.messageData['entityType'] = (this.translate(data.entityType, 'scopeNames') || '').toLowerCase();
+            this.messageData['entityType'] = this.getHelper().escapeString((this.translate(data.entityType, 'scopeNames') || '').toLowerCase());
 
-            this.messageData['user'] = '<a href="#User/view/' + data.userId + '">' + data.userName + '</a>';
-            this.messageData['entity'] = '<a href="#'+data.entityType+'/view/' + data.entityId + '">' + data.entityName + '</a>';
+            this.messageData['user'] = '<a href="#User/view/' + this.getHelper().escapeString(data.userId) + '">' + this.getHelper().escapeString(data.userName) + '</a>';
+            this.messageData['entity'] = '<a href="#'+this.getHelper().escapeString(data.entityType)+'/view/' + this.getHelper().escapeString(data.entityId) + '">' + this.getHelper().escapeString(data.entityName) + '</a>';
 
             this.createMessage();
         }
diff --git a/client/src/views/notification/items/message.js b/client/src/views/notification/items/message.js
index a75b2c13f7..fa5a88a764 100644
--- a/client/src/views/notification/items/message.js
+++ b/client/src/views/notification/items/message.js
@@ -47,10 +47,10 @@ Espo.define('views/notification/items/message', 'views/notification/items/base',
 
             this.userId = data.userId;
 
-            this.messageData['entityType'] = Espo.Utils.upperCaseFirst((this.translate(data.entityType, 'scopeNames') || '').toLowerCase());
+            this.messageData['entityType'] = this.getHelper().escapeString(Espo.Utils.upperCaseFirst((this.translate(data.entityType, 'scopeNames') || '').toLowerCase()));
 
-            this.messageData['user'] = '<a href="#User/view/' + data.userId + '">' + data.userName + '</a>';
-            this.messageData['entity'] = '<a href="#'+data.entityType+'/view/' + data.entityId + '">' + data.entityName + '</a>';
+            this.messageData['user'] = '<a href="#User/view/' + this.getHelper().escapeString(data.userId) + '">' + this.getHelper().escapeString(data.userName) + '</a>';
+            this.messageData['entity'] = '<a href="#'+this.getHelper().escapeString(data.entityType)+'/view/' + this.getHelper().escapeString(data.entityId) + '">' + this.getHelper().escapeString(data.entityName) + '</a>';
 
             this.createMessage();
         }
diff --git a/client/src/views/site/navbar.js b/client/src/views/site/navbar.js
index 069b4e01f4..25a48a4477 100644
--- a/client/src/views/site/navbar.js
+++ b/client/src/views/site/navbar.js
@@ -41,7 +41,6 @@ Espo.define('views/site/navbar', 'view', function (Dep) {
                 menuDataList: this.getMenuDataList(),
                 quickCreateList: this.quickCreateList,
                 enableQuickCreate: this.quickCreateList.length > 0,
-                userName: this.getUser().get('name'),
                 userId: this.getUser().id,
                 logoSrc: this.getLogoSrc()
             };
@@ -528,7 +527,7 @@ Espo.define('views/site/navbar', 'view', function (Dep) {
             var list = [
                 {
                     link: '#User/view/' + this.getUser().id,
-                    html: avatarHtml + this.getUser().get('name')
+                    html: avatarHtml + this.getHelper().escapeString(this.getUser().get('name')),
                 },
                 {divider: true}
             ];
diff --git a/client/src/views/stream/note.js b/client/src/views/stream/note.js
index 46d74a674c..4e2de43044 100644
--- a/client/src/views/stream/note.js
+++ b/client/src/views/stream/note.js
@@ -85,7 +85,7 @@ Espo.define('views/stream/note', 'view', function (Dep) {
             this.messageData = {
                 'user': 'field:createdBy',
                 'entity': 'field:parent',
-                'entityType': this.translateEntityType(this.model.get('parentType')),
+                'entityType': this.getHelper().escapeString(this.translateEntityType(this.model.get('parentType'))),
             };
 
             if (!this.options.noEdit && (this.isEditable || this.isRemovable)) {
diff --git a/client/src/views/stream/notes/assign.js b/client/src/views/stream/notes/assign.js
index 147605badc..649dbacf48 100644
--- a/client/src/views/stream/notes/assign.js
+++ b/client/src/views/stream/notes/assign.js
@@ -52,7 +52,7 @@ Espo.define('views/stream/notes/assign', 'views/stream/note', function (Dep) {
             this.assignedUserId = data.assignedUserId || null;
             this.assignedUserName = data.assignedUserName || null;
 
-            this.messageData['assignee'] = '<a href="#User/view/' + data.assignedUserId + '">' + data.assignedUserName + '</a>';
+            this.messageData['assignee'] = '<a href="#User/view/' + this.getHelper().escapeString(data.assignedUserId) + '">' + this.getHelper().escapeString(data.assignedUserName) + '</a>';
 
             if (this.isUserStream) {
                 if (this.assignedUserId) {
diff --git a/client/src/views/stream/notes/create-related.js b/client/src/views/stream/notes/create-related.js
index b269f4eed1..1d6ab2ba4d 100644
--- a/client/src/views/stream/notes/create-related.js
+++ b/client/src/views/stream/notes/create-related.js
@@ -56,7 +56,7 @@ Espo.define('views/stream/notes/create-related', 'views/stream/note', function (
             this.entityName = this.model.get('relatedName') ||  data.entityName || null;
 
             this.messageData['relatedEntityType'] = this.translateEntityType(this.entityType);
-            this.messageData['relatedEntity'] = '<a href="#' + this.entityType + '/view/' + this.entityId + '">' + this.entityName +'</a>';
+            this.messageData['relatedEntity'] = '<a href="#' + this.getHelper().escapeString(this.entityType) + '/view/' + this.getHelper().escapeString(this.entityId) + '">' + this.getHelper().escapeString(this.entityName) +'</a>';
 
             this.createMessage();
         }
diff --git a/client/src/views/stream/notes/create.js b/client/src/views/stream/notes/create.js
index cda35873a8..60c2021a5c 100644
--- a/client/src/views/stream/notes/create.js
+++ b/client/src/views/stream/notes/create.js
@@ -52,7 +52,7 @@ Espo.define('views/stream/notes/create', 'views/stream/note', function (Dep) {
                 this.assignedUserId = data.assignedUserId || null;
                 this.assignedUserName = data.assignedUserName || null;
 
-                this.messageData['assignee'] = '<a href="#User/view/' + this.assignedUserId + '">' + this.assignedUserName + '</a>';
+                this.messageData['assignee'] = '<a href="#User/view/' + this.assignedUserId + '">' + this.getHelper().escapeString(this.assignedUserName) + '</a>';
 
                 var isYou = false;
                 if (this.isUserStream) {
diff --git a/client/src/views/stream/notes/email-received.js b/client/src/views/stream/notes/email-received.js
index 1987018083..5cbd5d5b32 100644
--- a/client/src/views/stream/notes/email-received.js
+++ b/client/src/views/stream/notes/email-received.js
@@ -67,7 +67,7 @@ Espo.define('views/stream/notes/email-received', 'views/stream/note', function (
                 }
             }
 
-            this.messageData['email'] = '<a href="#Email/view/' + data.emailId + '">' + data.emailName + '</a>';
+            this.messageData['email'] = '<a href="#Email/view/' + this.getHelper().escapeString(data.emailId) + '">' + this.getHelper().escapeString(data.emailName) + '</a>';
 
             this.messageName = 'emailReceived';
 
@@ -77,7 +77,7 @@ Espo.define('views/stream/notes/email-received', 'views/stream/note', function (
 
             if (data.personEntityId) {
                 this.messageName += 'From';
-                this.messageData['from'] = '<a href="#'+data.personEntityType+'/view/' + data.personEntityId + '">' + data.personEntityName + '</a>';
+                this.messageData['from'] = '<a href="#'+this.getHelper().escapeString(data.personEntityType)+'/view/' + this.getHelper().escapeString(data.personEntityId) + '">' + this.getHelper().escapeString(data.personEntityName) + '</a>';
             }
 
             if (this.model.get('parentType') === data.personEntityType && this.model.get('parentId') == data.personEntityId) {
diff --git a/client/src/views/stream/notes/email-sent.js b/client/src/views/stream/notes/email-sent.js
index c033fee552..fb56a0b636 100644
--- a/client/src/views/stream/notes/email-sent.js
+++ b/client/src/views/stream/notes/email-sent.js
@@ -65,11 +65,11 @@ Espo.define('views/stream/notes/email-sent', 'views/stream/note', function (Dep)
                 }
             }
 
-            this.messageData['email'] = '<a href="#Email/view/' + data.emailId + '">' + data.emailName + '</a>';
+            this.messageData['email'] = '<a href="#Email/view/' + this.getHelper().escapeString(data.emailId) + '">' + this.getHelper().escapeString(data.emailName) + '</a>';
 
             this.messageName = 'emailSent';
 
-            this.messageData['by'] = '<a href="#'+data.personEntityType+'/view/' + data.personEntityId + '">' + data.personEntityName + '</a>';
+            this.messageData['by'] = '<a href="#'+this.getHelper().escapeString(data.personEntityType)+'/view/' + this.getHelper().escapeString(data.personEntityId) + '">' + this.getHelper().escapeString(data.personEntityName) + '</a>';
 
 
             if (this.isThis) {
diff --git a/client/src/views/stream/notes/mention-in-post.js b/client/src/views/stream/notes/mention-in-post.js
index 2ea90e7979..80d98cf559 100644
--- a/client/src/views/stream/notes/mention-in-post.js
+++ b/client/src/views/stream/notes/mention-in-post.js
@@ -76,7 +76,7 @@ Espo.define('views/stream/notes/mention-in-post', 'views/stream/note', function
                                 teamIdList.forEach(function (teamId) {
                                     var teamName = teamNameHash[teamId];
                                     if (teamName) {
-                                        teamHtmlList.push('<a href="#Team/view/' + teamId + '">' + teamName + '</a>');
+                                        teamHtmlList.push('<a href="#Team/view/' + this.getHelper().escapeString(teamId) + '">' + this.getHelper().escapeString(teamName) + '</a>');
                                     }
                                 }, this);
 
@@ -93,7 +93,7 @@ Espo.define('views/stream/notes/mention-in-post', 'views/stream/note', function
                                     userIdList.forEach(function (userId) {
                                         var userName = userNameHash[userId];
                                         if (userName) {
-                                            userHtmlList.push('<a href="#User/view/' + userId + '">' + userName + '</a>');
+                                            userHtmlList.push('<a href="#User/view/' + this.getHelper().escapeString(userId) + '">' + this.getHelper().escapeString(userName) + '</a>');
                                         }
                                     }, this);
                                     this.messageData['target'] = userHtmlList.join(', ');
@@ -113,4 +113,3 @@ Espo.define('views/stream/notes/mention-in-post', 'views/stream/note', function
 
     });
 });
-
diff --git a/client/src/views/stream/notes/post.js b/client/src/views/stream/notes/post.js
index 96c6a6c748..a50af61e3d 100644
--- a/client/src/views/stream/notes/post.js
+++ b/client/src/views/stream/notes/post.js
@@ -85,7 +85,7 @@ Espo.define('views/stream/notes/post', 'views/stream/note', function (Dep) {
                         teamIdList.forEach(function (teamId) {
                             var teamName = teamNameHash[teamId];
                             if (teamName) {
-                                teamHtmlList.push('<a href="#Team/view/' + teamId + '">' + teamName + '</a>');
+                                teamHtmlList.push('<a href="#Team/view/' + this.getHelper().escapeString(teamId) + '">' + this.getHelper().escapeString(teamName) + '</a>');
                             }
                         }, this);
 
@@ -103,7 +103,7 @@ Espo.define('views/stream/notes/post', 'views/stream/note', function (Dep) {
                         portalIdList.forEach(function (portalId) {
                             var portalName = portalNameHash[portalId];
                             if (portalName) {
-                                portalHtmlList.push('<a href="#Portal/view/' + portalId + '">' + portalName + '</a>');
+                                portalHtmlList.push('<a href="#Portal/view/' + this.getHelper().escapeString(portalId) + '">' + this.getHelper().escapeString(portalName) + '</a>');
                             }
                         }, this);
 
@@ -135,7 +135,7 @@ Espo.define('views/stream/notes/post', 'views/stream/note', function (Dep) {
                                     } else {
                                         var userName = userNameHash[userId];
                                         if (userName) {
-                                            userHtmlList.push('<a href="#User/view/' + userId + '">' + userName + '</a>');
+                                            userHtmlList.push('<a href="#User/view/' + this.getHelper().escapeString(userId) + '">' + this.getHelper().escapeString(userName) + '</a>');
                                         }
                                     }
                                 }
diff --git a/client/src/views/stream/notes/relate.js b/client/src/views/stream/notes/relate.js
index 261a8eb963..0ae91a4198 100644
--- a/client/src/views/stream/notes/relate.js
+++ b/client/src/views/stream/notes/relate.js
@@ -55,7 +55,7 @@ Espo.define('views/stream/notes/relate', 'views/stream/note', function (Dep) {
             this.entityName = this.model.get('relatedName') ||  data.entityName || null;
 
             this.messageData['relatedEntityType'] = this.translateEntityType(this.entityType);
-            this.messageData['relatedEntity'] = '<a href="#' + this.entityType + '/view/' + this.entityId + '">' + this.entityName +'</a>';
+            this.messageData['relatedEntity'] = '<a href="#' + this.getHelper().escapeString(this.entityType) + '/view/' + this.getHelper().escapeString(this.entityId) + '">' + this.getHelper().escapeString(this.entityName) +'</a>';
 
             this.createMessage();
         },
diff --git a/client/src/views/stream/notes/status.js b/client/src/views/stream/notes/status.js
index 571eb40381..4723ede35f 100644
--- a/client/src/views/stream/notes/status.js
+++ b/client/src/views/stream/notes/status.js
@@ -56,7 +56,7 @@ Espo.define('views/stream/notes/status', 'views/stream/note', function (Dep) {
 
             this.style = data.style || 'default';
 
-            this.statusText = this.getLanguage().translateOption(value, field, this.model.get('parentType'));
+            this.statusText = this.getHelper().escapeString(this.getLanguage().translateOption(value, field, this.model.get('parentType')));
 
             this.messageData['field'] = this.translate(field, 'fields', this.model.get('parentType')).toLowerCase();