search

2amigos / yii2-usuario

Highly customizable and extensible user management, authentication, and authorization Yii2 extension
https://github.com/2amigos/yii2-usuario
Other
294 stars 142 forks source link

Welcome email: reported Password is not HTML-encoded #530

Closed edegaudenzi closed 8 months ago

edegaudenzi commented 10 months ago

What steps will reproduce the problem?

Register a new user with generatePasswords set to True.

What is the expected result?

A Welcome email reporting the generated password

What do you get instead?

A Welcome email partially reporting the generated password due to the fact that the random password can casually form pieces of HTML

E.g. if the generated password is Ar4Ke<divQp, when you open the email with Outlook, Thunderbird or even in the browser you'll see Ar4Ke, making you believe this is actually the password.

Problem is that ->password is not Html::encode()'d at echoing time in 2amigos/yii2-usuario/src/User/resources/views/mail/welcome.php