diff --git a/app/helpers/email_template_helper.rb b/app/helpers/email_template_helper.rb index 6f16ee4..d264f9a 100644 --- a/app/helpers/email_template_helper.rb +++ b/app/helpers/email_template_helper.rb @@ -6,7 +6,7 @@ module EmailTemplateHelper params[:subject] = params[:email_template].parsed_subject(params[:template_params]) params[:content_type] = "text/html" end - mail(params.except(:email_template)) + mail(params.except(:email_template, :template_params)) end end diff --git a/test/unit/user_mailer_test.rb b/test/unit/user_mailer_test.rb index 92770aa..8b562fa 100644 --- a/test/unit/user_mailer_test.rb +++ b/test/unit/user_mailer_test.rb @@ -44,6 +44,16 @@ fast_create(Person)) assert_equal 'activation template body', mail.body.to_s end + should 'not leak template params into activation email' do + EmailTemplate.create!(:template_type => :user_activation, :name => 'template1', :subject => 'activation template subject', :body => 'activation template body', :owner => Environment.default) + assert_difference 'ActionMailer::Base.deliveries.size' do + u = create_user('some-user') + UserMailer.activation_code(u).deliver + end + mail = ActionMailer::Base.deliveries.last + assert_nil mail['template-params'] + end + private def read_fixture(action) -- libgit2 0.21.2