tomas
/
pocketbase
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

added test for escaped alert info

This commit is contained in:
Gani Georgiev 2025-11-12 15:15:54 +02:00
parent ddb8c88a37
commit 94b11bf2c3
2 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
mails/record.go
View File

@ -16,7 +16,7 @@ func SendRecordAuthAlert(app core.App, authRecord *core.Record, info string) err
mailClient := app.NewMailClient()
subject, body, err := resolveEmailTemplate(app, authRecord, authRecord.Collection().AuthAlert.EmailTemplate, map[string]any{
core.EmailPlaceholderAlertInfo: info,
core.EmailPlaceholderAlertInfo: html.EscapeString(info),
})
if err != nil {
return err

6
mails/record_test.go
View File

@ -15,12 +15,14 @@ func TestSendRecordAuthAlert(t *testing.T) {
testApp, _ := tests.NewTestApp()
defer testApp.Cleanup()
info := "<p>test_info</p>"
user, _ := testApp.FindFirstRecordByData("users", "email", "test@example.com")
// to test that it is escaped
user.Set("name", "<p>"+user.GetString("name")+"</p>")
err := mails.SendRecordAuthAlert(testApp, user, "test_info")
err := mails.SendRecordAuthAlert(testApp, user, info)
if err != nil {
t.Fatal(err)
}
@ -34,7 +36,7 @@ func TestSendRecordAuthAlert(t *testing.T) {
"login to your " + testApp.Settings().Meta.AppName + " account from a new location",
"If this was you",
"If this wasn't you",
"test_info",
html.EscapeString(info),
}
for _, part := range expectedParts {
if !strings.Contains(testApp.TestMailer.LastMessage().HTML, part) {