2

I updated Sprout Email from 4.0.8 to 4.4.9, along with Craft now being at 3.6.15.

Since then the variables inside my (redactor) custom field aren’t replaced anymore. The email template ist basically the example template outputting basic html and: {{ email.emailBodyHtml_de }}.

The content of email.emailBodyHtml_de contains things like {firstName} and {{ siteUrl }}, but they are not replaced with the User Model values (the notification is triggered at user save).

When I add {{ object.firstName }} to the html template, it outputs the name correctly, but the variables coming from the custom field aren’t replaced.

Has something changed that I am missing?

Any hint is much appreciated.

Cheers, Mark

medoingthings
  • 949
  • 9
  • 16

1 Answers1

1

This was a change introduced in v4.2.0 to address a security vulnerability. It was noted in the changelog and upgrade notes.

The Subject and Default Body will still render values dynamically but any personalization needed for custom fields would currently, as you've discovered, need to be handled in the templates.

I do have plans to review this more closely and see if I can find a workaround for custom fields, but for the time being, had to revert to the support above for security considerations.

Ben Parizek
  • 13,448
  • 1
  • 33
  • 98
  • 1
    Thanks for the clarification! Might be a good idea to clarify the example notification template as well: https://github.com/barrelstrength/craft-sprout-base-email/blob/v1/src/templates/examples/notification/email.twig#L31 Keep up the great work, much appreciated! – medoingthings May 27 '21 at 19:48