Prevent XSS attacks with wmd using the google-caja html sanitizer.

[osqa.git] / forum / skins / default / templates / notifications / newmember.html

diff --git a/forum/skins/default/templates/notifications/newmember.html b/forum/skins/default/templates/notifications/newmember.html
index 398226f55eb56eb263677b24b2521333f651ec17..aa5d5ec2bf949f6d5e5e35bdaf7b911c42fbab84 100644 (file)
--- a/forum/skins/default/templates/notifications/newmember.html
+++ b/forum/skins/default/templates/notifications/newmember.html
@@ -1,17 +1,34 @@
-{% extends "email_base.html" %}\r
-{% load i18n %}\r
-{% load extra_tags %}\r
-\r
-{% block content %}\r
-    <p>{% trans "Hello" %} {% user_var username %},</p>\r
-\r
-    <p>\r
-        {% blocktrans with newmember.username as newmember_name and settings.APP_SHORT_NAME as app_title and settings.APP_URL as app_url and newmember.get_profile_url as newmember_url %}\r
-        {{ newmember_name }} has just joined {{ app_title }}. You can visit his profile using the following link: <br />\r
-        <a href="{{ app_url }}{{ newmember_url }}">{{ newmember_name }} profile</a>\r
-        {% endblocktrans %}\r
-    </p>\r
-\r
-    <p>{% blocktrans %}Sincerely,<br />\r
-    Forum Administrator{% endblocktrans %}</p>\r
-{% endblock %}\r
+{% load i18n extra_tags email_tags %}
+
+{% declare %}
+    prefix = html.mark_safe(smart_str(settings.EMAIL_SUBJECT_PREFIX))
+    app_name = smart_str(settings.APP_SHORT_NAME)
+    safe_app_name = html.mark_safe(smart_str(settings.APP_SHORT_NAME))
+    app_url = smart_str(settings.APP_URL)
+    newmember_name = smart_str(newmember.username)
+    safe_newmember_name = html.mark_safe(smart_str(newmember.username))
+    newmember_url = smart_str(newmember.get_profile_url())
+    newmember_link = html.objlink(newmember, style=settings.EMAIL_ANCHOR_STYLE)
+{% enddeclare %}
+
+{% email %}
+    {% subject %}{% blocktrans %}{{ prefix }} {{ safe_newmember_name }} is a new member on {{ safe_app_name }}{% endblocktrans %}{% endsubject %}
+
+    {% htmlcontent notifications/base.html %}
+        <p style="{{ p_style }}">
+            {% blocktrans %}
+            {{ newmember_link }} has just joined {{ app_name }}.
+            View <a style="{{ a_style }}" href="{{ app_url }}{{ newmember_url }}">{{ newmember_name }}'s profile</a>.
+            {% endblocktrans %}
+        </p>
+    {% endhtmlcontent %}
+
+{% textcontent notifications/base_text.html %}
+{% blocktrans %}
+{{ safe_newmember_name }} has just joined {{ safe_app_name }}. You can visit {{ safe_newmember_name }}'s profile using the following url:
+{{ app_url }}{{ newmember_url }}
+{% endblocktrans %}
+{% endtextcontent %}
+
+{% endemail %}
+