From ca765f5645ffc2094b74308c48dd389ed745c33d Mon Sep 17 00:00:00 2001 From: gabrieljablonski Date: Fri, 3 Apr 2026 13:43:49 -0300 Subject: [PATCH] fix(mailer): update enterprise Devise template and fix HTML escaping in email translations - Add i18n to enterprise confirmation_instructions.html.erb (SAML/SSO support) - Add SSO-specific translation keys (en + pt_BR) - Use raw output (<%==) in Devise ERB templates to prevent apostrophe HTML-encoding --- .../mailer/confirmation_instructions.html.erb | 10 +++---- .../devise/mailer/password_change.html.erb | 4 +-- .../reset_password_instructions.html.erb | 10 +++---- .../mailer/unlock_instructions.html.erb | 6 ++--- config/locales/en.yml | 4 +++ config/locales/pt_BR.yml | 4 +++ .../mailer/confirmation_instructions.html.erb | 27 ++++++++++--------- 7 files changed, 37 insertions(+), 28 deletions(-) diff --git a/app/views/devise/mailer/confirmation_instructions.html.erb b/app/views/devise/mailer/confirmation_instructions.html.erb index b7210f3bc..c58d6be42 100644 --- a/app/views/devise/mailer/confirmation_instructions.html.erb +++ b/app/views/devise/mailer/confirmation_instructions.html.erb @@ -1,21 +1,21 @@ -

<%= t('mailer.common.hi', name: @resource.name) %>,

+

<%== t('mailer.common.hi', name: @resource.name) %>,

<% account_user = @resource&.account_users&.first %> <% brand_name = global_config['BRAND_NAME'] || 'Chatwoot' %> <% if account_user&.inviter.present? && @resource.unconfirmed_email.blank? %> -

<%= t('mailer.devise.confirmation_instructions.invited', inviter_name: account_user.inviter.name, account_name: account_user.account.name, brand_name: brand_name) %>

+

<%== t('mailer.devise.confirmation_instructions.invited', inviter_name: account_user.inviter.name, account_name: account_user.account.name, brand_name: brand_name) %>

<% end %> <% if @resource.confirmed? %> -

<%= t('mailer.devise.confirmation_instructions.login_message', brand_name: brand_name) %>

+

<%== t('mailer.devise.confirmation_instructions.login_message', brand_name: brand_name) %>

<% else %> <% if account_user&.inviter.blank? %>

- <%= t('mailer.devise.confirmation_instructions.welcome', brand_name: brand_name) %> + <%== t('mailer.devise.confirmation_instructions.welcome', brand_name: brand_name) %>

<% end %> -

<%= t('mailer.devise.confirmation_instructions.activate') %>

+

<%== t('mailer.devise.confirmation_instructions.activate') %>

<% end %> diff --git a/app/views/devise/mailer/password_change.html.erb b/app/views/devise/mailer/password_change.html.erb index 79b2b0fa3..c00d198b0 100644 --- a/app/views/devise/mailer/password_change.html.erb +++ b/app/views/devise/mailer/password_change.html.erb @@ -1,3 +1,3 @@ -

<%= t('mailer.devise.password_change.greeting', name: @resource.name) %>

+

<%== t('mailer.devise.password_change.greeting', name: @resource.name) %>

-

<%= t('mailer.devise.password_change.body') %>

+

<%== t('mailer.devise.password_change.body') %>

diff --git a/app/views/devise/mailer/reset_password_instructions.html.erb b/app/views/devise/mailer/reset_password_instructions.html.erb index 67a20fea7..35a187364 100644 --- a/app/views/devise/mailer/reset_password_instructions.html.erb +++ b/app/views/devise/mailer/reset_password_instructions.html.erb @@ -1,10 +1,10 @@ -

<%= t('mailer.devise.reset_password_instructions.greeting', name: @resource.name) %>

+

<%== t('mailer.devise.reset_password_instructions.greeting', name: @resource.name) %>

-

<%= t('mailer.devise.reset_password_instructions.body') %>

+

<%== t('mailer.devise.reset_password_instructions.body') %>

<%= link_to t('mailer.devise.reset_password_instructions.action'), frontend_url('auth/password/edit', reset_password_token: @token) %>

-

<%= t('mailer.devise.reset_password_instructions.copy_paste') %> <%= frontend_url('auth/password/edit', reset_password_token: @token) %>

+

<%== t('mailer.devise.reset_password_instructions.copy_paste') %> <%= frontend_url('auth/password/edit', reset_password_token: @token) %>

-

<%= t('mailer.devise.reset_password_instructions.ignore') %>

-

<%= t('mailer.devise.reset_password_instructions.no_change') %>

+

<%== t('mailer.devise.reset_password_instructions.ignore') %>

+

<%== t('mailer.devise.reset_password_instructions.no_change') %>

diff --git a/app/views/devise/mailer/unlock_instructions.html.erb b/app/views/devise/mailer/unlock_instructions.html.erb index 55d7ef259..8c21349f6 100644 --- a/app/views/devise/mailer/unlock_instructions.html.erb +++ b/app/views/devise/mailer/unlock_instructions.html.erb @@ -1,7 +1,7 @@ -

<%= t('mailer.devise.unlock_instructions.greeting', name: @resource.name) %>

+

<%== t('mailer.devise.unlock_instructions.greeting', name: @resource.name) %>

-

<%= t('mailer.devise.unlock_instructions.body') %>

+

<%== t('mailer.devise.unlock_instructions.body') %>

-

<%= t('mailer.devise.unlock_instructions.action_prompt') %>

+

<%== t('mailer.devise.unlock_instructions.action_prompt') %>

<%= link_to t('mailer.devise.unlock_instructions.unlock_account'), unlock_url(@resource, unlock_token: @token) %>

diff --git a/config/locales/en.yml b/config/locales/en.yml index 33ba949cd..37bcb929b 100644 --- a/config/locales/en.yml +++ b/config/locales/en.yml @@ -706,6 +706,10 @@ en: activate: "Please take a moment and click the link below and activate your account." confirm_account: "Confirm my account" login_account: "Login to my account" + invited_sso: "%{inviter_name}, with %{account_name}, has invited you to access %{brand_name} via Single Sign-On (SSO)." + sso_no_password: "Your organization uses SSO for secure authentication. You will not need a password to access your account." + sso_login: "You can now access your account by logging in through your organization's SSO portal." + sso_access: "You can access your account by logging in through your organization's SSO portal." reset_password_instructions: greeting: "Hello %{name}!" body: "Someone has requested a link to change your password. You can do this through the link below." diff --git a/config/locales/pt_BR.yml b/config/locales/pt_BR.yml index 9fa61a1b8..50cff0fa2 100644 --- a/config/locales/pt_BR.yml +++ b/config/locales/pt_BR.yml @@ -687,6 +687,10 @@ pt_BR: activate: "Reserve um momento e clique no link abaixo para ativar sua conta." confirm_account: "Confirmar minha conta" login_account: "Acessar minha conta" + invited_sso: "%{inviter_name}, de %{account_name}, convidou você para acessar o %{brand_name} via Single Sign-On (SSO)." + sso_no_password: "Sua organização utiliza SSO para autenticação segura. Você não precisará de uma senha para acessar sua conta." + sso_login: "Agora você pode acessar sua conta fazendo login pelo portal SSO da sua organização." + sso_access: "Você pode acessar sua conta fazendo login pelo portal SSO da sua organização." reset_password_instructions: greeting: "Olá %{name}!" body: "Alguém solicitou um link para alterar sua senha. Você pode fazer isso através do link abaixo." diff --git a/enterprise/app/views/devise/mailer/confirmation_instructions.html.erb b/enterprise/app/views/devise/mailer/confirmation_instructions.html.erb index 91837f980..90d860e31 100644 --- a/enterprise/app/views/devise/mailer/confirmation_instructions.html.erb +++ b/enterprise/app/views/devise/mailer/confirmation_instructions.html.erb @@ -1,45 +1,46 @@ -

Hi <%= @resource.name %>,

+

<%== t('mailer.common.hi', name: @resource.name) %>,

<% account_user = @resource&.account_users&.first %> <% is_saml_account = account_user&.account&.saml_enabled? %> +<% brand_name = global_config['BRAND_NAME'] || 'Chatwoot' %> <% if account_user&.inviter.present? && @resource.unconfirmed_email.blank? %> <% if is_saml_account %> -

<%= account_user.inviter.name %>, with <%= account_user.account.name %>, has invited you to access <%= global_config['BRAND_NAME'] || 'Chatwoot' %> via Single Sign-On (SSO).

-

Your organization uses SSO for secure authentication. You will not need a password to access your account.

+

<%== t('mailer.devise.confirmation_instructions.invited_sso', inviter_name: account_user.inviter.name, account_name: account_user.account.name, brand_name: brand_name) %>

+

<%== t('mailer.devise.confirmation_instructions.sso_no_password') %>

<% else %> -

<%= account_user.inviter.name %>, with <%= account_user.account.name %>, has invited you to try out <%= global_config['BRAND_NAME'] || 'Chatwoot' %>.

+

<%== t('mailer.devise.confirmation_instructions.invited', inviter_name: account_user.inviter.name, account_name: account_user.account.name, brand_name: brand_name) %>

<% end %> <% end %> <% if @resource.confirmed? %> -

You can login to your <%= global_config['BRAND_NAME'] || 'Chatwoot' %> account through the link below:

+

<%== t('mailer.devise.confirmation_instructions.login_message', brand_name: brand_name) %>

<% else %> <% if account_user&.inviter.blank? %>

- Welcome to <%= global_config['BRAND_NAME'] || 'Chatwoot' %>! We have a suite of powerful tools ready for you to explore. Before that we quickly need to verify your email address to know it's really you. + <%== t('mailer.devise.confirmation_instructions.welcome', brand_name: brand_name) %>

<% end %> <% unless is_saml_account %> -

Please take a moment and click the link below and activate your account.

+

<%== t('mailer.devise.confirmation_instructions.activate') %>

<% end %> <% end %> <% if @resource.unconfirmed_email.present? %> -

<%= link_to 'Confirm my account', frontend_url('auth/confirmation', confirmation_token: @token) %>

+

<%= link_to t('mailer.devise.confirmation_instructions.confirm_account'), frontend_url('auth/confirmation', confirmation_token: @token) %>

<% elsif @resource.confirmed? %> <% if is_saml_account %> -

You can now access your account by logging in through your organization's SSO portal.

+

<%== t('mailer.devise.confirmation_instructions.sso_login') %>

<% else %> -

<%= link_to 'Login to my account', frontend_url('auth/sign_in') %>

+

<%= link_to t('mailer.devise.confirmation_instructions.login_account'), frontend_url('auth/sign_in') %>

<% end %> <% elsif account_user&.inviter.present? %> <% if is_saml_account %> -

You can access your account by logging in through your organization's SSO portal.

+

<%== t('mailer.devise.confirmation_instructions.sso_access') %>

<% else %> -

<%= link_to 'Confirm my account', frontend_url('auth/password/edit', reset_password_token: @resource.send(:set_reset_password_token)) %>

+

<%= link_to t('mailer.devise.confirmation_instructions.confirm_account'), frontend_url('auth/password/edit', reset_password_token: @resource.send(:set_reset_password_token)) %>

<% end %> <% else %> -

<%= link_to 'Confirm my account', frontend_url('auth/confirmation', confirmation_token: @token) %>

+

<%= link_to t('mailer.devise.confirmation_instructions.confirm_account'), frontend_url('auth/confirmation', confirmation_token: @token) %>

<% end %>