Skip to content

Commit def7ebd

Browse files
authored
Html encodes the user's name in the invite email. (#18343)
1 parent 8c2b1eb commit def7ebd

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

src/Umbraco.Web.BackOffice/Controllers/UsersController.cs

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -664,10 +664,11 @@ private async Task SendUserInviteEmailAsync(UserBasic? userDisplay, string? from
664664
var emailSubject = _localizedTextService.Localize("user", "inviteEmailCopySubject",
665665
// Ensure the culture of the found user is used for the email!
666666
UmbracoUserExtensions.GetUserCulture(to?.Language, _localizedTextService, _globalSettings));
667+
var name = userDisplay is null ? string.Empty : System.Web.HttpUtility.HtmlEncode(userDisplay.Name);
667668
var emailBody = _localizedTextService.Localize("user", "inviteEmailCopyFormat",
668669
// Ensure the culture of the found user is used for the email!
669670
UmbracoUserExtensions.GetUserCulture(to?.Language, _localizedTextService, _globalSettings),
670-
new[] { userDisplay?.Name, from, WebUtility.HtmlEncode(message)!.ReplaceLineEndings("<br/>"), inviteUri.ToString(), senderEmail });
671+
new[] { name, from, WebUtility.HtmlEncode(message)!.ReplaceLineEndings("<br/>"), inviteUri.ToString(), senderEmail });
671672

672673
// This needs to be in the correct mailto format including the name, else
673674
// the name cannot be captured in the email sending notification.

0 commit comments

Comments
 (0)