update email template #821
Conversation
WalkthroughThe pull request modifies the Changes
Possibly related PRs
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
wp-content/civi-extensions/goonjcustom/Civi/InstitutionCollectionCampService.php (1)
723-731: Consider using a template engine for better maintainability.The email HTML is embedded directly in the code, mixing presentation with logic. Consider using a template engine (like Twig or Smarty) or moving the template to a separate file for better separation of concerns.
Example structure:
// templates/emails/outcome.html.twig Dear {{ contactName }}, Thank you for coordinating the camp <strong>{{ campCode }}</strong>... // In the code return $twig->render('emails/outcome.html.twig', [ 'contactName' => $contactName, 'campCode' => $campCode, 'campAddress' => $campAddress, 'campOutcomeFormUrl' => $campOutcomeFormUrl ]);
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
wp-content/civi-extensions/goonjcustom/Civi/InstitutionCollectionCampService.php(1 hunks)
🔇 Additional comments (1)
wp-content/civi-extensions/goonjcustom/Civi/InstitutionCollectionCampService.php (1)
723-731: LGTM! Email content improvements look good.The changes to the email content are well-done:
- Clear and professional greeting
- Better explanation of the form's purpose
- Added target="_blank" for better UX
- Concise and clear instructions
| <p>Dear $contactName,</p> | ||
| <p>Thank you for coordinating the camp <strong>$campCode</strong> at <strong>$campAddress</strong>. | ||
| Please fill out the following form after the camp/drive ends, once you have an overview of the event's outcomes:</p> | ||
| <ol> | ||
| <li><a href=\"$campOutcomeFormUrl\" target=\"_blank\">Camp Outcome Form</a><br> | ||
| This form is essential for providing feedback and recording the outcomes of the event.</li> | ||
| </ol> | ||
| <p>We appreciate your cooperation.</p> | ||
| <p>Warm Regards,<br>Urban Relations Team</p>"; |
There was a problem hiding this comment.
Escape HTML variables to prevent XSS vulnerabilities.
The email template directly interpolates PHP variables into HTML without proper escaping. This could lead to XSS vulnerabilities if any of the variables contain malicious content.
Apply this diff to escape the variables:
- <p>Dear $contactName,</p>
- <p>Thank you for coordinating the camp <strong>$campCode</strong> at <strong>$campAddress</strong>.
+ <p>Dear <?php echo htmlspecialchars($contactName, ENT_QUOTES, 'UTF-8'); ?>,</p>
+ <p>Thank you for coordinating the camp <strong><?php echo htmlspecialchars($campCode, ENT_QUOTES, 'UTF-8'); ?></strong> at <strong><?php echo htmlspecialchars($campAddress, ENT_QUOTES, 'UTF-8'); ?></strong>. Committable suggestion skipped: line range outside the PR's diff.
Summary by CodeRabbit