The subject of the e-mail to notify admins about new members to the mandatory group is over-encoded, such that group names containing a single quote will be sent with the group containing an HTML entity. For instance, if our group name is "Bob's Group" then the e-mail subject will say "Bob's Group".

This is caused by the placeholder used in the t() function used to create the subject. The module is currently using @, which strips all HTML and encodes certain characters as entities. According to the t() documentation on api.drupal.org, ! would be a better choice.

I can't create a patch at the moment, but the fix is to change:

$subj = t("'@name' joined @site and was assigned to group '@group'.", array('@group' => $node->title, '@name' => $account->name, '@site' => variable_get('site_name', 'drupal')));

to

$subj = t("'!name' joined !site and was assigned to group '!group'.", array('!group' => $node->title, '!name' => $account->name, '!site' => variable_get('site_name', 'drupal')));

Comments

pwolanin’s picture

Is there any risk of having <script> tags and such embedded in an e-mail?

junyor’s picture

In theory, yes. But I think most mail clients are smart enough by this point to disable SCRIPT entirely, if they even support it. And I don't see how there could be problems with SCRIPT in mail subjects, since they are plaintext-only fields.

pwolanin’s picture

Status: Active » Closed (duplicate)