Correctly escape user-defined names in emails

Closes #1151 Signed-off-by: Thomas Citharel <tcit@tcit.fr>
2022-10-31 13:00:45 +01:00
parent 695d773d50
commit 470a3e594b
28 changed files with 162 additions and 118 deletions
--- a/lib/web/templates/email/group_member_removal.html.heex
+++ b/lib/web/templates/email/group_member_removal.html.heex
@@ -46,7 +46,7 @@
          <p style="margin: 0;">
            <%= gettext(
              "You have been removed from group %{link_start}<b>%{group}</b>%{link_end}. You will not be able to access this group's private content anymore.",
-              group: @group.name,
+              group: escape_html(display_name(@group)),
              link_start: "<a href=\"#{@group.url}\">",
              link_end: "</a>"
            )