search

csharpfritz / CoreWiki

A simple ASP.NET Core wiki that we are working on during live coding streams
MIT License
410 stars 155 forks source link

Use the Razor engine to generate the email body for notifications #169

Closed erwindevreugd closed 6 years ago

parithon commented 6 years ago

Looks like you might want to look at Microsoft.AspNetCore.Razor.Language.dll and the RazorTemplateEngine class.

JustCallMeAD commented 6 years ago

Wouldn't using Razor for the email templates be a security issue?

I think the reason a basic html parser was used in the first place was so that (in the future) you could allow site editors / admins to edit the email templates without giving them access to Razor (this is a security risk).

Maybe it would be worth considering looking at how Orchard does things using Liquid (https://orchardcore.readthedocs.io/en/dev/OrchardCore.Modules/OrchardCore.Liquid/README/).

Based on Shopify templating engine: Safe, customer-facing template language for flexible web apps - https://shopify.github.io/liquid/

If you use something like liquid then it can also be used for other type of templates such as site / layout templates :)

EDIT: Checkout this nuget package as it is the standalone version of liquid - https://github.com/sebastienros/fluid

black-byte commented 6 years ago

You can checkout also scriban at https://github.com/lunet-io/scriban

Franklin89 commented 6 years ago

@JustCallMeAD could you ellaborate on the security concern a bit?