Correctly escape user-defined names in emails

Closes #1151

Signed-off-by: Thomas Citharel <tcit@tcit.fr>

lib/web/templates/email/activity/_comment_activity_item.html.heex

@@ -1,35 +1,35 @@
 <%= case @activity.subject do %>
   <% :event_comment_mention -> %>
     <%= dgettext("activity", "%{profile} mentionned you in a comment under event %{event}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
       event:
         "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
         :event,
         @activity.subject_params["event_uuid"]) |> URI.decode()}\">
-                            #{@activity.subject_params["event_title"]}
+                            #{escape_html(@activity.subject_params["event_title"])}
                         </a>"
     })
     |> raw %>
   <% :participation_event_comment -> %>
     <%= dgettext("activity", "%{profile} has posted an announcement under event %{event}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
       event:
         "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
         :event,
         @activity.subject_params["event_uuid"]) |> URI.decode()}\">
-                            #{@activity.subject_params["event_title"]}
+                            #{escape_html(@activity.subject_params["event_title"])}
                         </a>"
     })
     |> raw %>
   <% :event_new_comment -> %>
     <%= if @activity.subject_params["comment_reply_to"] do %>
       <%= dgettext("activity", "%{profile} has posted a new reply under your event %{event}.", %{
-        profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+        profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
         event:
           "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
           :event,
           @activity.subject_params["event_uuid"]) |> URI.decode()}#comment-#{@activity.subject_params["comment_reply_to_uuid"]}-#{@activity.subject_params["comment_uuid"]}\">
-                                #{@activity.subject_params["event_title"]}
+                                #{escape_html(@activity.subject_params["event_title"])}
                             </a>"
       })
       |> raw %>
@@ -38,12 +38,12 @@
         "activity",
         "%{profile} has posted a new comment under your event %{event}.",
         %{
-          profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+          profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
           event:
             "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
             :event,
             @activity.subject_params["event_uuid"]) |> URI.decode()}#comment-#{@activity.subject_params["comment_uuid"]}\">
-                                #{@activity.subject_params["event_title"]}
+                                #{escape_html(@activity.subject_params["event_title"])}
                             </a>"
         }
       )

lib/web/templates/email/activity/_discussion_activity_item.html.heex

@@ -1,40 +1,40 @@
 <%= case @activity.subject do %>
   <% :discussion_created -> %>
     <%= dgettext("activity", "%{profile} created the discussion %{discussion}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
       discussion:
         "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint, :discussion, Mobilizon.Actors.Actor.preferred_username_and_domain(@activity.group), @activity.subject_params["discussion_slug"]) |> URI.decode()}\">
-                            #{@activity.subject_params["discussion_title"]}</a>"
+                            #{escape_html(@activity.subject_params["discussion_title"])}</a>"
     })
     |> raw %>
   <% :discussion_replied -> %>
     <%= dgettext("activity", "%{profile} replied to the discussion %{discussion}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
       discussion:
         "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint, :discussion, Mobilizon.Actors.Actor.preferred_username_and_domain(@activity.group), @activity.subject_params["discussion_slug"]) |> URI.decode()}\">
-                            #{@activity.subject_params["discussion_title"]}</a>"
+                            #{escape_html(@activity.subject_params["discussion_title"])}</a>"
     })
     |> raw %>
   <% :discussion_renamed -> %>
     <%= dgettext("activity", "%{profile} renamed the discussion %{discussion}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
       discussion:
         "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint, :discussion, Mobilizon.Actors.Actor.preferred_username_and_domain(@activity.group), @activity.subject_params["discussion_slug"]) |> URI.decode()}\">
-                            #{@activity.subject_params["discussion_title"]}</a>"
+                            #{escape_html(@activity.subject_params["discussion_title"])}</a>"
     })
     |> raw %>
   <% :discussion_archived -> %>
     <%= dgettext("activity", "%{profile} archived the discussion %{discussion}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
       discussion:
         "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint, :discussion, Mobilizon.Actors.Actor.preferred_username_and_domain(@activity.group), @activity.subject_params["discussion_slug"]) |> URI.decode()}\">
-                            #{@activity.subject_params["discussion_title"]}</a>"
+                            #{escape_html(@activity.subject_params["discussion_title"])}</a>"
     })
     |> raw %>
   <% :discussion_deleted -> %>
     <%= dgettext("activity", "%{profile} deleted the discussion %{discussion}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
-      discussion: "<b>#{@activity.subject_params["discussion_title"]}</b>"
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
+      discussion: "<b>#{escape_html(@activity.subject_params["discussion_title"])}</b>"
     })
     |> raw %>
 <% end %>

lib/web/templates/email/activity/_event_activity_item.html.heex

@@ -1,52 +1,52 @@
 <%= case @activity.subject do %>
   <% :event_created -> %>
     <%= dgettext("activity", "The event %{event} was created by %{profile}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
       event:
         "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
         :event,
         @activity.subject_params["event_uuid"]) |> URI.decode()}\">
-                            #{@activity.subject_params["event_title"]}
+                            #{escape_html(@activity.subject_params["event_title"])}
                         </a>"
     })
     |> raw %>
   <% :event_updated -> %>
     <%= dgettext("activity", "The event %{event} was updated by %{profile}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
       event:
         "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
         :event,
         @activity.subject_params["event_uuid"]) |> URI.decode()}\">
-                            #{@activity.subject_params["event_title"]}
+                            #{escape_html(@activity.subject_params["event_title"])}
                         </a>"
     })
     |> raw %>
   <% :event_deleted -> %>
     <%= dgettext("activity", "The event %{event} was deleted by %{profile}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
-      event: "<b>#{@activity.subject_params["event_title"]}</b>"
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
+      event: "<b>#{escape_html(@activity.subject_params["event_title"])}</b>"
     })
     |> raw %>
   <% :comment_posted -> %>
     <%= if @activity.subject_params["comment_reply_to"] do %>
       <%= dgettext("activity", "%{profile} replied to a comment on the event %{event}.", %{
-        profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+        profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
         event:
           "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
           :event,
           @activity.subject_params["event_uuid"]) |> URI.decode()}\">
-                            #{@activity.subject_params["event_title"]}
+                            #{escape_html(@activity.subject_params["event_title"])}
                         </a>"
       })
       |> raw %>
     <% else %>
       <%= dgettext("activity", "%{profile} posted a comment on the event %{event}.", %{
-        profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+        profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
         event:
           "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
           :event,
           @activity.subject_params["event_uuid"]) |> URI.decode()}\">
-                            #{@activity.subject_params["event_title"]}
+                            #{escape_html(@activity.subject_params["event_title"])}
                         </a>"
       })
       |> raw %>

lib/web/templates/email/activity/_group_activity_item.html.heex

@@ -1,23 +1,23 @@
 <%= case @activity.subject do %>
   <% :group_created -> %>
     <%= dgettext("activity", "%{profile} created the group %{group}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
       group:
         "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
         :actor,
         @activity.subject_params["group_federated_username"]) |> URI.decode()}\">
-                            #{@activity.subject_params["group_name"]}
+                            #{escape_html(@activity.subject_params["group_name"])}
                         </a>"
     })
     |> raw %>
   <% :group_updated -> %>
     <%= dgettext("activity", "%{profile} updated the group %{group}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
       group:
         "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
         :actor,
         @activity.subject_params["group_federated_username"]) |> URI.decode()}\">
-                            #{@activity.subject_params["group_name"]}
+                            #{escape_html(@activity.subject_params["group_name"])}
                         </a>"
     })
     |> raw %>

lib/web/templates/email/activity/_member_activity_item.html.heex

@@ -1,58 +1,58 @@
 <%= case @activity.subject do %>
   <% :member_request -> %>
     <%= dgettext("activity", "%{member} requested to join the group.", %{
-      member: "<b>#{@activity.subject_params["member_actor_name"]}</b>"
+      member: "<b>#{escape_html(@activity.subject_params["member_actor_name"])}</b>"
     })
     |> raw %>
   <% :member_invited -> %>
     <%= dgettext("activity", "%{member} was invited by %{profile}.", %{
-      member: "<b>#{@activity.subject_params["member_actor_name"]}</b>",
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>"
+      member: "<b>#{escape_html(@activity.subject_params["member_actor_name"])}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>"
     })
     |> raw %>
   <% :member_accepted_invitation -> %>
     <%= dgettext("activity", "%{member} accepted the invitation to join the group.", %{
-      member: "<b>#{@activity.subject_params["member_actor_name"]}</b>"
+      member: "<b>#{escape_html(@activity.subject_params["member_actor_name"])}</b>"
     })
     |> raw %>
   <% :member_rejected_invitation -> %>
     <%= dgettext("activity", "%{member} rejected the invitation to join the group.", %{
-      member: "<b>#{@activity.subject_params["member_actor_name"]}</b>"
+      member: "<b>#{escape_html(@activity.subject_params["member_actor_name"])}</b>"
     })
     |> raw %>
   <% :member_joined -> %>
     <%= dgettext("activity", "%{member} joined the group.", %{
       member:
-        "<b title=\"#{@activity.subject_params["member_actor_federated_username"]}\">#{@activity.subject_params["member_actor_name"]}</b>"
+        "<b title=\"#{@activity.subject_params["member_actor_federated_username"]}\">#{escape_html(@activity.subject_params["member_actor_name"])}</b>"
     })
     |> raw %>
   <% :member_added -> %>
     <%= dgettext("activity", "%{profile} added the member %{member}.", %{
-      member: "<b>#{@activity.subject_params["member_actor_name"]}</b>",
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>"
+      member: "<b>#{escape_html(@activity.subject_params["member_actor_name"])}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>"
     })
     |> raw %>
   <% :member_approved -> %>
     <%= dgettext("activity", "%{profile} approved the member %{member}.", %{
-      member: "<b>#{@activity.subject_params["member_actor_name"]}</b>",
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>"
+      member: "<b>#{escape_html(@activity.subject_params["member_actor_name"])}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>"
     })
     |> raw %>
   <% :member_updated -> %>
     <%= dgettext("activity", "%{profile} updated the member %{member}.", %{
-      member: "<b>#{@activity.subject_params["member_actor_name"]}</b>",
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>"
+      member: "<b>#{escape_html(@activity.subject_params["member_actor_name"])}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>"
     })
     |> raw %>
   <% :member_removed -> %>
     <%= dgettext("activity", "%{profile} excluded member %{member}.", %{
       member: "<b>#{@activity.subject_params["member_actor_name"]}</b>",
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>"
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>"
     })
     |> raw %>
   <% :member_quit -> %>
     <%= dgettext("activity", "%{profile} quit the group.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>"
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>"
     })
     |> raw %>
 <% end %>

lib/web/templates/email/activity/_post_activity_item.html.heex

@@ -1,30 +1,30 @@
 <%= case @activity.subject do %>
   <% :post_created -> %>
     <%= dgettext("activity", "The post %{post} was created by %{profile}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
       post:
         "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
         :post,
         @activity.subject_params["post_slug"]) |> URI.decode()}\">
-                            #{@activity.subject_params["post_title"]}
+                            #{escape_html(@activity.subject_params["post_title"])}
                         </a>"
     })
     |> raw %>
   <% :post_updated -> %>
     <%= dgettext("activity", "The post %{post} was updated by %{profile}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
       post:
         "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
         :post,
         @activity.subject_params["post_slug"]) |> URI.decode()}\">
-                            #{@activity.subject_params["post_title"]}
+                            #{escape_html(@activity.subject_params["post_title"])}
                         </a>"
     })
     |> raw %>
   <% :post_deleted -> %>
     <%= dgettext("activity", "The post %{post} was deleted by %{profile}.", %{
-      profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
-      post: "<b>#{@activity.subject_params["post_title"]}</b>"
+      profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
+      post: "<b>#{escape_html(@activity.subject_params["post_title"])}</b>"
     })
     |> raw %>
 <% end %>

lib/web/templates/email/activity/_resource_activity_item.html.heex

@@ -2,23 +2,23 @@
   <% :resource_created -> %>
     <%= if @activity.subject_params["is_folder"] do %>
       <%= dgettext("activity", "%{profile} created the folder %{resource}.", %{
-        profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+        profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
         resource:
           "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
           :resource,
           @activity.subject_params["resource_uuid"]) |> URI.decode()}\">
-                                #{@activity.subject_params["resource_title"]}
+                                #{escape_html(@activity.subject_params["resource_title"])}
                             </a>"
       })
       |> raw %>
     <% else %>
       <%= dgettext("activity", "%{profile} created the resource %{resource}.", %{
-        profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+        profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
         resource:
           "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
           :resource,
           @activity.subject_params["resource_uuid"]) |> URI.decode()}\">
-                                #{@activity.subject_params["resource_title"]}
+                                #{escape_html(@activity.subject_params["resource_title"])}
                             </a>"
       })
       |> raw %>
@@ -29,14 +29,15 @@
         "activity",
         "%{profile} renamed the folder from %{old_resource_title} to %{resource}.",
         %{
-          profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+          profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
           resource:
             "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
             :resource,
             @activity.subject_params["resource_uuid"]) |> URI.decode()}\">
-                                #{@activity.subject_params["resource_title"]}
+                                #{escape_html(@activity.subject_params["resource_title"])}
                             </a>",
-          old_resource_title: "<b>#{@activity.subject_params["old_resource_title"]}</b>"
+          old_resource_title:
+            "<b>#{escape_html(@activity.subject_params["old_resource_title"])}</b>"
         }
       )
       |> raw %>
@@ -45,14 +46,15 @@
         "activity",
         "%{profile} renamed the resource from %{old_resource_title} to %{resource}.",
         %{
-          profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+          profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
           resource:
             "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
             :resource,
             @activity.subject_params["resource_uuid"]) |> URI.decode()}\">
-                                #{@activity.subject_params["resource_title"]}
+                                #{escape_html(@activity.subject_params["resource_title"])}
                             </a>",
-          old_resource_title: "<b>#{@activity.subject_params["old_resource_title"]}</b>"
+          old_resource_title:
+            "<b>#{escape_html(@activity.subject_params["old_resource_title"])}</b>"
         }
       )
       |> raw %>
@@ -60,23 +62,23 @@
   <% :resource_moved -> %>
     <%= if @activity.subject_params["is_folder"] do %>
       <%= dgettext("activity", "%{profile} moved the folder %{resource}.", %{
-        profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+        profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
         resource:
           "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
           :resource,
           @activity.subject_params["resource_uuid"]) |> URI.decode()}\">
-                                #{@activity.subject_params["resource_title"]}
+                                #{escape_html(@activity.subject_params["resource_title"])}
                             </a>"
       })
       |> raw %>
     <% else %>
       <%= dgettext("activity", "%{profile} moved the resource %{resource}.", %{
-        profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
+        profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
         resource:
           "<a href=\"#{Routes.page_url(Mobilizon.Web.Endpoint,
           :resource,
           @activity.subject_params["resource_uuid"]) |> URI.decode()}\">
-                                #{@activity.subject_params["resource_title"]}
+                                #{escape_html(@activity.subject_params["resource_title"])}
                             </a>"
       })
       |> raw %>
@@ -84,14 +86,14 @@
   <% :resource_deleted -> %>
     <%= if @activity.subject_params["is_folder"] do %>
       <%= dgettext("activity", "%{profile} deleted the folder %{resource}.", %{
-        profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
-        resource: "<b>#{@activity.subject_params["resource_title"]}</b>"
+        profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
+        resource: "<b>#{escape_html(@activity.subject_params["resource_title"])}</b>"
       })
       |> raw %>
     <% else %>
       <%= dgettext("activity", "%{profile} deleted the resource %{resource}.", %{
-        profile: "<b>#{Mobilizon.Actors.Actor.display_name_and_username(@activity.author)}</b>",
-        resource: "<b>#{@activity.subject_params["resource_title"]}</b>"
+        profile: "<b>#{escaped_display_name_and_username(@activity.author)}</b>",
+        resource: "<b>#{escape_html(@activity.subject_params["resource_title"])}</b>"
       })
       |> raw %>
     <% end %>