- Merge request !13Issue #3322273: Provide a template to customize the content of the notification mail β (Merged) created by Lukas von Blarer
- First commit to issue fork.
-
poker10 β
committed 68b5ea4c on 8.x-1.x authored by
luksak β
Issue #3322273: Provide a template to customize the content of the...
-
poker10 β
committed 68b5ea4c on 8.x-1.x authored by
luksak β
- πΈπ°Slovakia poker10
Thanks for reporting and working on this. I think this is a useful feature.
Updated the code in the MR:
- moved the logic from the .module file to theCommerceStockNotifyQueue::processItem()
- removed static call toDrupal::service()
- kept the original parameter names for BC
- addedDeprecationHelper
to handlerenderPlain
deprecation
- removed the language fix which landed in another issueMerging this to the 8.x-1.x now. Further improvements can be made if needed in follow-ups. Thanks!
- πΈπ°Slovakia poker10
Need to say, that previously, it was possible to send non-filtered HTML in the
$message
variable directly to the email body (which is not good from the security perspective). After this commit, the variable is filtered by twig (which is not good for BC reason). We cannot useXss::filter()
or any other filtering because some sites could have a whole HTML pages in the field HTML body field (including styles, attributes, various HTML tags, ...), so it would not help much regarding BC. It seems like that any filtering option will have a potential to break the "unlimited" options provided until this was committed.I am not sure how extensively this HTML options were used, but I think there are two options now:
1. Keep it filtered by default (as it is now) and force existing sites to convert the field HTML to the twig (which is the most secure way) or to override the template and use the
|raw
filter (the fastest way).2. Mark the
Administer Commerce stock notifications
permission as restricted and allow|raw
filter on the$message
variable in the default twig template. That is not a best solution, but this will preserve all options.Will wait for some opinions from sites using the module. Thanks.