E-Mail rendering: Consistent markdown evaluation between preview and mail

src/pretix/base/email.py

@@ -1,8 +1,6 @@
 import logging
 from smtplib import SMTPResponseException
 
-import bleach
-import markdown
 from django.conf import settings
 from django.core.mail.backends.smtp import EmailBackend
 from django.dispatch import receiver
@@ -12,7 +10,7 @@ from inlinestyler.utils import inline_css
 
 from pretix.base.models import Event, Order
 from pretix.base.signals import register_html_mail_renderers
-from pretix.base.templatetags.rich_text import markdown_compile
+from pretix.base.templatetags.rich_text import markdown_compile_email
 
 logger = logging.getLogger('pretix.base.email')
 
@@ -98,7 +96,7 @@ class TemplateBasedMailRenderer(BaseHTMLMailRenderer):
         raise NotImplementedError()
 
     def render(self, plain_body: str, plain_signature: str, subject: str, order: Order) -> str:
-        body_md = bleach.linkify(markdown_compile(plain_body))
+        body_md = markdown_compile_email(plain_body)
         htmlctx = {
             'site': settings.PRETIX_INSTANCE_NAME,
             'site_url': settings.SITE_URL,
@@ -112,7 +110,7 @@ class TemplateBasedMailRenderer(BaseHTMLMailRenderer):
 
         if plain_signature:
             signature_md = plain_signature.replace('\n', '<br>\n')
-            signature_md = bleach.linkify(bleach.clean(markdown.markdown(signature_md), tags=bleach.ALLOWED_TAGS + ['p', 'br']))
+            signature_md = markdown_compile_email(signature_md)
             htmlctx['signature'] = signature_md
 
         if order:

src/pretix/base/templatetags/rich_text.py

@@ -78,6 +78,21 @@ def abslink_callback(attrs, new=False):
     return attrs
 
 
+def markdown_compile_email(source):
+    return bleach.linkify(bleach.clean(
+        markdown.markdown(
+            source,
+            extensions=[
+                'markdown.extensions.sane_lists',
+                #  'markdown.extensions.nl2br' # disabled for backwards-compatibility
+            ]
+        ),
+        tags=ALLOWED_TAGS,
+        attributes=ALLOWED_ATTRIBUTES,
+        protocols=ALLOWED_PROTOCOLS,
+    ))
+
+
 def markdown_compile(source):
     return bleach.clean(
         markdown.markdown(

src/pretix/control/views/event.py

@@ -5,7 +5,6 @@ from datetime import timedelta
 from decimal import Decimal
 from urllib.parse import urlsplit
 
-import bleach
 from django.conf import settings
 from django.contrib import messages
 from django.contrib.contenttypes.models import ContentType
@@ -39,7 +38,7 @@ from pretix.base.services import tickets
 from pretix.base.services.invoices import build_preview_invoice_pdf
 from pretix.base.signals import register_ticket_outputs
 from pretix.base.templatetags.money import money_filter
-from pretix.base.templatetags.rich_text import markdown_compile
+from pretix.base.templatetags.rich_text import markdown_compile_email
 from pretix.control.forms.event import (
     CancelSettingsForm, CommentForm, DisplaySettingsForm, EventDeleteForm,
     EventMetaValueForm, EventSettingsForm, EventUpdateForm,
@@ -664,9 +663,9 @@ class MailSettingsPreview(EventPermissionRequiredMixin, View):
                 idx = matched.group('idx')
                 if idx in self.supported_locale:
                     with translation.override(self.supported_locale[idx]):
-                        msgs[self.supported_locale[idx]] = bleach.linkify(markdown_compile(
+                        msgs[self.supported_locale[idx]] = markdown_compile_email(
                             v.format_map(self.placeholders(preview_item))
-                        ))
+                        )
 
         return JsonResponse({
             'item': preview_item,