kolaente 18ff059326 fix(notifications): escape user input in conversational email header ...

Doer name, project and task titles were interpolated raw into the header
HTML. The sanitizer stripped images but still let an attacker-controlled
title inject arbitrary links. Plain-text rendering now fully unescapes
entities so the escaped values read correctly there.

2026-10-19 21:06:10 +02:00

..

database.go

feat(notifications): add clearing stored notifications (#2735)

2026-08-29 21:22:43 +00:00

db.go

…

events.go

…

logo.png

…

mail_render.go

fix(notifications): escape user input in conversational email header

2026-10-19 21:06:10 +02:00

mail_test.go

fix(notifications): escape user input in conversational email header

2026-10-19 21:06:10 +02:00

mail.go

fix(notifications): escape user input in conversational email header

2026-10-19 21:06:10 +02:00

main_test.go

…

markdown_escape_test.go

fix(deps): update module github.com/yuin/goldmark to v2 (#3627)

2026-08-27 20:34:29 +00:00

markdown_escape.go

…

notification_test.go

fix(notifications): skip mail rendering when the mailer is disabled

2026-10-01 15:38:27 +02:00

notification.go

fix(notifications): skip mail rendering when the mailer is disabled

2026-10-01 15:38:27 +02:00

notify_disabled_test.go

…

testing.go

…