>_
.issue.db
/highway
Dashboard
Issues
Memory
Lessons
Audit Log
New Issue
Edit Issue #1029
Update issue details
Title *
Description
Found during #1018 sweep, not fixed there: enterprise/apps/pre_installed/welcome_email.py send (recipient_name, tenant_id, login/doc URLs) and api/app_templates/welcome_email.py, welcome_email_with_secret.py format raw values into HTML. #1018 fixed api/blueprints/v1/users_helpers.py, api/utils/invitation_email.py and enterprise/apps/pre_installed/invitation_email.py. EARS: When an app builds an HTML email body, every caller-supplied value shall be HTML-escaped (html is in the app import allowlist). Pre-installed app source changes reach tenants only through a published version + per-tenant upgrade.
Priority
Low
Medium
High
Critical
Status
Open
In Progress
Closed
Won't Do
Due Date (YYYY-MM-DD)
Tags (comma separated)
Related Issues (IDs)
Enter IDs of issues related to this one. They will be linked as 'related'.
Update Issue
Cancel