Mail: Handle all rendering in mail.py, return values for log (#5895)

* Mail: Handle all rendering in mail.py, return values for log * Apply suggestions from code review
2026-05-12 16:24:00 +00:00 · 2026-03-10 09:53:09 +01:00
parent e6ea8fb5bf
commit 4f449ce6b4
12 changed files with 102 additions and 134 deletions
--- a/src/pretix/base/payment.py
+++ b/src/pretix/base/payment.py
@@ -1295,6 +1295,7 @@ class ManualPayment(BasePaymentProvider):

    def format_map(self, order, payment):
        return {
+            # Possible placeholder injection, we should make sure to never include user-controlled variables here
            'order': order.code,
            'amount': payment.amount,
            'currency': self.event.currency,