Archives/Athou_commafeed
1
0
Fork 0
mirror of https://github.com/Athou/commafeed.git synced 2026-11-05 03:44:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

escape username in password recovery email

Browse Source
This commit is contained in:
Athou
2026-11-02 12:34:14 +01:00
parent 0c280c4dc4
commit ddff408afe
2 changed files with 43 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
commafeed-server/src/main/java/com/commafeed/frontend/resource/UserREST.java
View File

@@ -35,6 +35,7 @@ import com.commafeed.frontend.model.request.RegistrationRequest;
import com.commafeed.security.AuthenticationContext;
import com.commafeed.security.Roles;
import com.google.common.base.Preconditions;
import com.google.common.html.HtmlEscapers;
import jakarta.annotation.security.PermitAll;
import jakarta.annotation.security.RolesAllowed;
@@ -412,7 +413,7 @@ public class UserREST {
Urls.removeTrailingSlash(config.passwordRecoveryPublicBaseUrl().orElseThrow());
return String.format(
"You asked for password recovery for account '%s', <a href='%s'>follow this link</a> to change your password. Ignore this if you didn't request a password recovery.",
user.getName(), callbackUrl(user, publicUrl));
HtmlEscapers.htmlEscaper().escape(user.getName()), callbackUrl(user, publicUrl));
}
private String callbackUrl(User user, String publicUrl) throws URISyntaxException {