>_
.issue.db
/highway
Dashboard
Issues
Memory
Lessons
Audit Log
New Issue
Edit Issue #1018
Update issue details
Title *
Description
EARS: When the API builds an HTML email body, every interpolated value shall be HTML-escaped. Found during #1010 sweep: api/blueprints/v1/users_helpers.py _send_user_welcome_email formats tenant_name, admin_name, roles_display, email, base_url raw into USER_WELCOME_EMAIL_TEMPLATE; api/utils/invitation_email.py formats inviter_name, tenant_display_name, roles_display, message (caller-supplied invitation text) and invitation_url raw. api/blueprints/v1/invitations_helpers.py already escapes (pattern to copy). Not fixed in #1010 (emails, not routes; invitation_email.py is being edited by another agent).
Priority
Low
Medium
High
Critical
Status
Open
In Progress
Closed
Won't Do
Due Date (YYYY-MM-DD)
Tags (comma separated)
Related Issues (IDs)
Enter IDs of issues related to this one. They will be linked as 'related'.
Update Issue
Cancel