search

vintasoftware / django-templated-email

Django module to easily send templated emails using django templates, or using a transactional mail provider (mailchimp, silverpop, etc.)
MIT License
702 stars 130 forks source link

HTML escaping is used for context variables on plain text part and subject #108

Closed MacLake closed 3 years ago

MacLake commented 6 years ago

The template engine is designed to escape fields that are handed over to the context dictionary. This is desirable for HTML, but not for plain text. Nevertheless also every context variable in {% block plain %} {% endblock %} or in {% block subject %} {% endblock %} is escaped. E. g. “1 < 2 > 0 O'Leary "the master"” becomes “1 &lt; 2 &gt; 0 O&#39;Leary &quot;the master&quot;”.

Workaround is to use

{% block plain %} {% autoescape off %}
…
{% endblock %} {% endautoescape %}

But it would be better if autoescape is switched off by django-templated-email for blocks subject and plain in order to avoid unexpected results or at least write about autoescape off in the documentation.

clokep commented 3 years ago

I believe that this is fixed in clokep/django-render-block#21, which I've released in version 0.8 just now.