Hi. I just updated to version 1.7.2 due to hosting provider forcing me to run on php8.4 or pay additionally per month. Previous InvoicePlane versions allowed me to create a html email with css styling. 1.7.2 is actively stripping all css from the email. Is it possible to somehow bypass this and make my emails look good again?
Thanks
You can gamble and open up
application/modules/mailer/controllers/Mailer.php
There is a call for “html_sanitizer_helper”.
The gamble is that you comment out that helper.
It might choke further down the line though.
Do the same in
application/modules/invoices/controllers/Cron.php if you’re using recurring invoices.
The function that is doing all this cleaning is
sanitize_email_template_html
1 Like
You can gamble and open up
application/modules/mailer/controllers/Mailer.php
There is a call for “html_sanitizer_helper”.
The gamble is that you comment out that helper.
It might choke further down the line though.
Do the same in
application/modules/invoices/controllers/Cron.php if you’re using recurring invoices.
The function that is doing all this cleaning is
sanitize_email_template_html
These are the vulnerabilities that the sanitizations were needed for:
| Vulnerability | GHSA | PR(s) |
|---|---|---|
| Email template preview XSS | GHSA-4wqv-84px-8jc6 | #1486, #1500, #1516 |
| Stored XSS via client email in mailer | GHSA-477r-xmgc-vcvj | #1635 |
So basically if you open PR #1635 on GitHub you will see “what was done”
And you want to undo those “fixes” if you want your emails to look nice
1 Like
Thanks. I figured out if I moved away from using tables and used <div> instead with inline css, not as much of the css gets stripped out. I managed to recreate my emails to match the previous ones.
1 Like