Problem/Motivation

group_notify_mail() is currently doing this:

  $message['body'][] = Html::escape($params['content']);
  $message['body'][] = Html::escape($params['link']);

That means that the emails being sent out are full of escaped HTML. If you 'View source' on a message, you see this:

Posted by: Admin Root

<article id="node-1839"  data-history-node-id="1839" data-quickedit-entity-id="node/1839" role="article" class="contextual-region" about="/private-audio/test-audio-august-13-2020">
  <div>dww was here</div>
  
      <h2><span data-quickedit-field-id="node/1839/title/en/group_notify_email" class="field field--name-title field--type-string field--label-hidden">Test audio - August 13, 2020</span>
</h2>
...

And the message appears like so in your inbox:

Posted by: Admin Root <article id="node-1839" data-history-node-id="1839" data-quickedit-entity-id="node/1839" role="article" class="contextual-region" about="/private-audio/test-audio-august-13-2020"> <div>dww was here</div> <h2><span data-quickedit-field-id="node/1839/title/en/group_notify_email" class="field field--name-title field--type-string field--label-hidden">Test audio - August 13, 2020</span> </h2>...

Calling this a 'major' bug, since it seems to break the fundamental feature of this module, and there seems to be no work-around other than patching it.

Steps to reproduce

  1. Configure a node type to send emails.
  2. Configure the group_notify_email view mode for this node type to include markup.
  3. Generate a notification.
  4. Look at the results.

Proposed resolution

Don't use Html::escape(). Rely on the fact that the text format on the nodes should already be configured to prevent unsafe markup, or that only folks we trust have access to create them. We don't need to escape the HTML again, we need to send it off to the mailer system just like we were sending it to a browser. Then the raw message source looks like this:

Posted by: Admin Root

<article id="node-1839" data-history-node-id="1839" data-quickedit-entity-id="node/1839" role="article" class="contextual-region" about="http://dev.breema.com/private-audio/test-audio-august-13-2020"><div>dww was here</div>
  
      <h2><span data-quickedit-field-id="node/1839/title/en/group_notify_email" class="field field--name-title field--type-string field--label-hidden">Test audio - August 13, 2020</span>
</h2>

And the e-mail looks like it's supposed to in your inbox (see screenshots below).

Remaining tasks

  1. Agree this is the right move. I don't understand how/why it's been like this all along. Maybe I'm missing something?
  2. Upload the patch.
  3. Reviews / refinements.
  4. Commit.

User interface changes

HTML emails will now actually contain renderable HTML, not escaped tags that end up looking like raw HTML.

Before

Email with double-escaped HTML that appears as raw tags

After

Email with actual HTML tags that appears normally in your inbox

API changes

Nope.

Data model changes

N/A

CommentFileSizeAuthor
#2 3165156-2.patch707 bytesdww
normal-html-email.png18.65 KBdww
escaped-html-email.png62.64 KBdww

Comments

dww created an issue. See original summary.

dww’s picture

Issue summary: View changes
Status: Active » Needs review
StatusFileSize
new707 bytes
gregcube’s picture

Agree this is the right move. I don't understand how/why it's been like this all along. Maybe I'm missing something?

Definitely the right move. Bonehead oversight on my part.

  • gregcube committed 1faf9d6 on 8.x-1.x authored by dww
    Issue #3165156 by dww: Using Html::escape() means we can't send HTML e-...
dww’s picture

Issue summary: View changes
Status: Needs review » Fixed

Cool, thanks for confirming! I'm not sure I'd call it "bonehead" -- always better safe than sorry. 😉 Would much rather have bugs from being too paranoid and safe, than to have sec holes...

But good to know this is agreeable, since it'll make the emails much more useful.

Thanks for the quick commit!
-Derek

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.