From d30f14d5d3c3506201a5315f65c3581b9197d102 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20Gonz=C3=A1lez?= Date: Thu, 3 Sep 2015 02:50:32 +0200 Subject: [PATCH] don't escape confirmation mail templates. This patch would fix at least a part of issue #381 and #420, if it would be applied to all necessary blade files. This could be a security problem as user now maybe can enter malicious code? I am not smart enough to know these php internals. --- resources/views/emails/confirm_text.blade.php | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/resources/views/emails/confirm_text.blade.php b/resources/views/emails/confirm_text.blade.php index 652815a1f94f..7809cbfce1f7 100644 --- a/resources/views/emails/confirm_text.blade.php +++ b/resources/views/emails/confirm_text.blade.php @@ -1,7 +1,7 @@ -{{ trans('texts.confirmation_header') }} +{!! trans('texts.confirmation_header') !!} -{{ $invitationMessage . trans('texts.confirmation_message') }} +{!! $invitationMessage . trans('texts.confirmation_message') !!} {!! URL::to("user/confirm/{$user->confirmation_code}") !!} -{{ trans('texts.email_signature') }} -{{ trans('texts.email_from') }} \ No newline at end of file +{!! trans('texts.email_signature') !!} +{!! trans('texts.email_from') !!}