From 7b0f7439f011ac0f13dd100d067ec219295611b5 Mon Sep 17 00:00:00 2001
From: Mira Weller <weller@rami.io>
Date: Wed, 29 May 2024 18:40:18 +0200
Subject: [PATCH] Improve validation of email templates

---
 src/pretix/base/forms/validators.py |  6 +++++-
 src/pretix/control/views/event.py   | 15 +++++++++------
 2 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/src/pretix/base/forms/validators.py b/src/pretix/base/forms/validators.py
index bc9d69f265..e68643b0de 100644
--- a/src/pretix/base/forms/validators.py
+++ b/src/pretix/base/forms/validators.py
@@ -39,6 +39,8 @@ from django.core.validators import BaseValidator
 from django.utils.translation import gettext_lazy as _
 from i18nfield.strings import LazyI18nString
 
+from pretix.helpers.format import SafeFormatter
+
 
 class PlaceholderValidator(BaseValidator):
     """
@@ -57,7 +59,9 @@ class PlaceholderValidator(BaseValidator):
                 self.__call__(v)
             return
 
-        if value.count('{') != value.count('}'):
+        try:
+            SafeFormatter(None).parse(value)
+        except ValueError:
             raise ValidationError(
                 _('Invalid placeholder syntax: You used a different number of "{" than of "}".'),
                 code='invalid_placeholder_syntax',
diff --git a/src/pretix/control/views/event.py b/src/pretix/control/views/event.py
index cb4838dd67..cffd876b1d 100644
--- a/src/pretix/control/views/event.py
+++ b/src/pretix/control/views/event.py
@@ -758,12 +758,15 @@ class MailSettingsPreview(EventPermissionRequiredMixin, View):
                 idx = matched.group('idx')
                 if idx in self.supported_locale:
                     with language(self.supported_locale[idx], self.request.event.settings.region):
-                        if k.startswith('mail_subject_'):
-                            msgs[self.supported_locale[idx]] = format_map(bleach.clean(v), self.placeholders(preview_item))
-                        else:
-                            msgs[self.supported_locale[idx]] = markdown_compile_email(
-                                format_map(v, self.placeholders(preview_item))
-                            )
+                        try:
+                            if k.startswith('mail_subject_'):
+                                msgs[self.supported_locale[idx]] = format_map(bleach.clean(v), self.placeholders(preview_item))
+                            else:
+                                msgs[self.supported_locale[idx]] = markdown_compile_email(
+                                    format_map(v, self.placeholders(preview_item))
+                                )
+                        except ValueError:
+                            msgs[self.supported_locale[idx]] = _('Invalid placeholder syntax: You used a different number of "{" than of "}".')
 
         return JsonResponse({
             'item': preview_item,